@camunda/ccma-shared-types 10.7.1 → 10.9.0

package/dist/_tests/approvals/approval-rules.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/_tests/approvals/llm-budget-top-up.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/_tests/types/SalesPlanType.type.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/agent-tokens/agent-tokens.d.ts

@@ -13,6 +13,21 @@ export declare const AGENT_CLAIM = "https://camunda.com/agent";
 export declare const AGENT_CLIENT_ID_PREFIX = "ccma_";
 /** AGENT_TOKENS_FEATURE_FLAG closes create and rotate while it is off. */
 export declare const AGENT_TOKENS_FEATURE_FLAG = "control.agentTokens";
+/**
+ * AGENT_SLACK_GRANTS_FEATURE_FLAG closes the create and the extend of a
+ * binding, and the create of a grant, while it is off. The redeem stays open:
+ * a code made before the flag went off works until it expires (`AGENT_GRANT_TTL_MS`).
+ */
+export declare const AGENT_SLACK_GRANTS_FEATURE_FLAG = "control.agentSlackGrants";
+/**
+ * The form of a Slack channel ID: public (`C`) or private (`G`) channel.
+ * A binding stores the ID, never the name.
+ */
+export declare const AGENT_SLACK_CHANNEL_PATTERN: RegExp;
+/** AGENT_GRANT_TTL_MS is the time in which a grant code can be redeemed. */
+export declare const AGENT_GRANT_TTL_MS = 120000;
+/** AGENT_GRANTS_PER_HOUR_MAX is the limit of new grants for one binding. */
+export declare const AGENT_GRANTS_PER_HOUR_MAX = 10;
 /** AGENT_TOKEN_EXPIRY_DAYS lists the lifetimes that a creator can choose. */
 export declare const AGENT_TOKEN_EXPIRY_DAYS: readonly [7, 30, 90];
 export type AgentTokenExpiryDays = (typeof AGENT_TOKEN_EXPIRY_DAYS)[number];
@@ -20,6 +35,11 @@ export type AgentTokenExpiryDays = (typeof AGENT_TOKEN_EXPIRY_DAYS)[number];
 export declare const AGENT_TOKEN_NAME_MAX = 64;
 /** AGENT_TOKENS_ACTIVE_MAX is the limit of active clients for one creator. */
 export declare const AGENT_TOKENS_ACTIVE_MAX = 10;
+/**
+ * `secret` is a client with an id and a secret. `slack` is a binding to one
+ * Slack channel: it has no secret, and a grant gives it a token.
+ */
+export type AgentTokenKind = 'secret' | 'slack';
 /** Phase 1 has read access only. Phase 2 adds `write`. */
 export type AgentAccess = 'read';
 /** The value of `AGENT_CLAIM` in a verified agent token. */
@@ -39,6 +59,9 @@ export interface AgentToken {
     clientId: string;
     name: string;
     access: AgentAccess;
+    kind: AgentTokenKind;
+    /** The channel ID of a binding. It is absent when `kind` is `secret`. */
+    slackChannelId?: string;
     status: AgentTokenStatus;
     createdAt: string;
     expiresAt: string;
@@ -50,7 +73,8 @@ export interface AgentToken {
  * that holds `clientSecret`, and the backend cannot show the secret again.
  */
 export interface AgentTokenCreated extends AgentToken {
-    clientSecret: string;
+    /** Absent for a binding, which has no secret. */
+    clientSecret?: string;
 }
 /** One agent client, as the admin list shows it. */
 export interface AgentTokenAdmin extends AgentToken {
@@ -64,6 +88,41 @@ export interface AgentTokenAdmin extends AgentToken {
 export interface CreateAgentTokenDto {
     name: string;
     expiresInDays: AgentTokenExpiryDays;
+    /** Set it to make a binding to this channel. Then there is no secret. */
+    slackChannelId?: string;
+}
+/** The body of `POST /api/agent-tokens/:uuid/extend`. */
+export interface ExtendAgentTokenDto {
+    expiresInDays: AgentTokenExpiryDays;
+}
+/** The body of `POST /internal/agent-grants`. CloudBot sends it. */
+export interface CreateAgentGrantDto {
+    slackChannelId: string;
+    slackThreadTs: string;
+    requestedBySlackUserId: string;
+    requestedByEmail: string;
+    /** The S256 challenge of the PKCE verifier that only ccmacli knows. */
+    codeChallenge: string;
+}
+/** The answer of `POST /internal/agent-grants`. */
+export interface AgentGrantCreated {
+    code: string;
+    expiresAt: string;
+}
+/** Why control-backend refuses a grant. CloudBot words the reply from it. */
+export type AgentGrantRefusalReason = 'no_binding' | 'expired' | 'revoked' | 'inactive' | 'requester_unknown' | 'rate_limited' | 'thread_busy' | 'feature_off';
+/** The body of the 409 answer of `POST /internal/agent-grants`. */
+export interface AgentGrantRefusal {
+    code: string;
+    message: string;
+    reason: AgentGrantRefusalReason;
+    expiredAt?: string;
+    ownerEmail?: string;
+}
+/** The body of `POST /internal/agent-grants/redeem`. token-issuer sends it. */
+export interface RedeemAgentGrantDto {
+    code: string;
+    codeVerifier: string;
 }
 /** The answer of `POST /internal/agent-clients/verify`. */
 export interface AgentVerifyResponse {
@@ -75,8 +134,8 @@ export interface AgentVerifyResponse {
  * The answer of `GET /internal/agent-clients/:uuid/status`.
  *
  * `permissions` is `AGENT_READ_PERMISSIONS` of all backends, intersected with
- * the permissions of the creator at create time. It is empty when `active` is
- * false.
+ * the permissions of the creator at the create or the last extend. It is empty
+ * when `active` is false.
  */
 export interface AgentStatusResponse {
     active: boolean;

package/dist/agent-tokens/agent-tokens.js

@@ -3,6 +3,10 @@ import { ConsolePermissions } from "../permissions/console.permissions.js";
 const AGENT_CLAIM = "https://camunda.com/agent";
 const AGENT_CLIENT_ID_PREFIX = "ccma_";
 const AGENT_TOKENS_FEATURE_FLAG = "control.agentTokens";
+const AGENT_SLACK_GRANTS_FEATURE_FLAG = "control.agentSlackGrants";
+const AGENT_SLACK_CHANNEL_PATTERN = /^[CG][A-Z0-9]{8,}$/;
+const AGENT_GRANT_TTL_MS = 12e4;
+const AGENT_GRANTS_PER_HOUR_MAX = 10;
 const AGENT_TOKEN_EXPIRY_DAYS = [7, 30, 90];
 const AGENT_TOKEN_NAME_MAX = 64;
 const AGENT_TOKENS_ACTIVE_MAX = 10;
@@ -51,7 +55,11 @@ export {
   AGENT_CLAIM,
   AGENT_CLIENT_ID_PREFIX,
   AGENT_ERROR,
+  AGENT_GRANTS_PER_HOUR_MAX,
+  AGENT_GRANT_TTL_MS,
   AGENT_READ_PERMISSIONS,
+  AGENT_SLACK_CHANNEL_PATTERN,
+  AGENT_SLACK_GRANTS_FEATURE_FLAG,
   AGENT_TOKENS_ACTIVE_MAX,
   AGENT_TOKENS_FEATURE_FLAG,
   AGENT_TOKEN_EXPIRY_DAYS,

package/dist/agent-tokens/agent-tokens.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/agent-tokens/agent-tokens.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { AccountsPermissions } from '../permissions/accounts.permissions.js'\nimport { ConsolePermissions } from '../permissions/console.permissions.js'\n\n/**\n * The agent tokens of ccmacli: machine credentials that a Camundi creates in\n * Camunda Control for an agent, with read access only.\n *\n * control-backend stores the clients. token-issuer exchanges the credentials\n * for an Auth0 token of the agent audience. control-backend, console-backend\n * and accounts-backend accept that token on their read routes. Every type and\n * rule that two of these services share is in this file.\n */\n\n/** AGENT_CLAIM is the claim of an agent token that names the client. */\nexport const AGENT_CLAIM = 'https://camunda.com/agent'\n\n/** AGENT_CLIENT_ID_PREFIX starts every client id of an agent client. */\nexport const AGENT_CLIENT_ID_PREFIX = 'ccma_'\n\n/** AGENT_TOKENS_FEATURE_FLAG closes create and rotate while it is off. */\nexport const AGENT_TOKENS_FEATURE_FLAG = 'control.agentTokens'\n\n/** AGENT_TOKEN_EXPIRY_DAYS lists the lifetimes that a creator can choose. */\nexport const AGENT_TOKEN_EXPIRY_DAYS = [7, 30, 90] as const\n\nexport type AgentTokenExpiryDays = (typeof AGENT_TOKEN_EXPIRY_DAYS)[number]\n\n/** AGENT_TOKEN_NAME_MAX is the length limit of a name, after the trim. */\nexport const AGENT_TOKEN_NAME_MAX = 64\n\n/** AGENT_TOKENS_ACTIVE_MAX is the limit of active clients for one creator. */\nexport const AGENT_TOKENS_ACTIVE_MAX = 10\n\n/** Phase 1 has read access only. Phase 2 adds `write`. */\nexport type AgentAccess = 'read'\n\n/** The value of `AGENT_CLAIM` in a verified agent token. */\nexport interface AgentClaim {\n  uuid: string\n  access: AgentAccess\n  /** The `sub` of the Camundi who created the client. */\n  createdByUserId: string\n}\n\n/** `inactive` means that the creator is no longer a Camundi. */\nexport type AgentTokenStatus = 'active' | 'expired' | 'revoked' | 'inactive'\n\n/** AGENT_TOKEN_STATUSES lists every value of `AgentTokenStatus`. */\nexport const AGENT_TOKEN_STATUSES = [\n  'active',\n  'expired',\n  'revoked',\n  'inactive',\n] as const satisfies readonly AgentTokenStatus[]\n\n/** One agent client, as its creator sees it. It never holds the secret. */\nexport interface AgentToken {\n  uuid: string\n  clientId: string\n  name: string\n  access: AgentAccess\n  status: AgentTokenStatus\n  createdAt: string\n  expiresAt: string\n  lastUsedAt?: string\n  revokedAt?: string\n}\n\n/**\n * AgentTokenCreated is the answer of create and rotate. It is the only answer\n * that holds `clientSecret`, and the backend cannot show the secret again.\n */\nexport interface AgentTokenCreated extends AgentToken {\n  clientSecret: string\n}\n\n/** One agent client, as the admin list shows it. */\nexport interface AgentTokenAdmin extends AgentToken {\n  createdBy: { userId: string; email: string }\n  revokedByUserId?: string\n}\n\n/** The body of `POST /api/agent-tokens`. */\nexport interface CreateAgentTokenDto {\n  name: string\n  expiresInDays: AgentTokenExpiryDays\n}\n\n/** The answer of `POST /internal/agent-clients/verify`. */\nexport interface AgentVerifyResponse {\n  uuid: string\n  access: AgentAccess\n  createdByUserId: string\n}\n\n/**\n * The answer of `GET /internal/agent-clients/:uuid/status`.\n *\n * `permissions` is `AGENT_READ_PERMISSIONS` of all backends, intersected with\n * the permissions of the creator at create time. It is empty when `active` is\n * false.\n */\nexport interface AgentStatusResponse {\n  active: boolean\n  permissions: string[]\n}\n\n/**\n * AGENT_READ_PERMISSIONS is the most that an agent token can do in each\n * backend. A backend intersects its set with the `permissions` of the status\n * answer, so an agent never holds a permission that its creator did not hold.\n *\n * `crtp` is a publish permission. It is here for one read only, the\n * release-train sanity check. The agent allowlist of console-backend, which a\n * later change of epic #10804 adds, must be the bound. Never add a route to\n * that allowlist that `crtp` guards for a write.\n */\nexport const AGENT_READ_PERMISSIONS: Readonly<{\n  control: readonly string[]\n  console: readonly string[]\n  accounts: readonly string[]\n}> = {\n  control: [AccountsPermissions.READ_ALL],\n  console: [\n    ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN_SEE,\n    ConsolePermissions.CLUSTERS_READALLCLUSTERINFO,\n    ConsolePermissions.CLUSTER_PLAN_SEE_ALL,\n    ConsolePermissions.RELEASE_TRAIN_PUBLISH,\n  ],\n  accounts: [AccountsPermissions.READ_ALL],\n}\n\n/** agentReadPermissionUnion is the union of the three backend sets. */\nexport function agentReadPermissionUnion(): string[] {\n  return [\n    ...new Set([\n      ...AGENT_READ_PERMISSIONS.control,\n      ...AGENT_READ_PERMISSIONS.console,\n      ...AGENT_READ_PERMISSIONS.accounts,\n    ]),\n  ]\n}\n\n/** The codes of the two denials that only an agent token can get. */\nexport const AGENT_ERROR = {\n  readOnly: 'auth.agent_read_only',\n  inactive: 'auth.agent_inactive',\n} as const\n\nconst UUID_SHAPE =\n  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\n/**\n * parseAgentClaim reads `AGENT_CLAIM` from the payload of a VERIFIED token.\n * It returns `undefined` when the claim is absent or has a wrong shape, and\n * the caller must then refuse the token.\n */\nexport function parseAgentClaim(\n  payload: Record<string, unknown>,\n): AgentClaim | undefined {\n  const claim = payload[AGENT_CLAIM]\n  if (typeof claim !== 'object' || claim === null || Array.isArray(claim)) {\n    return undefined\n  }\n  const { uuid, access, createdByUserId } = claim as Record<string, unknown>\n  if (\n    typeof uuid !== 'string' ||\n    !UUID_SHAPE.test(uuid) ||\n    access !== 'read' ||\n    typeof createdByUserId !== 'string' ||\n    createdByUserId.length === 0\n  ) {\n    return undefined\n  }\n  return { uuid, access, createdByUserId }\n}\n"],
-  "mappings": "AAMA,SAAS,2BAA2B;AACpC,SAAS,0BAA0B;AAa5B,MAAM,cAAc;AAGpB,MAAM,yBAAyB;AAG/B,MAAM,4BAA4B;AAGlC,MAAM,0BAA0B,CAAC,GAAG,IAAI,EAAE;AAK1C,MAAM,uBAAuB;AAG7B,MAAM,0BAA0B;AAiBhC,MAAM,uBAAuB;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAgEO,MAAM,yBAIR;AAAA,EACH,SAAS,CAAC,oBAAoB,QAAQ;AAAA,EACtC,SAAS;AAAA,IACP,mBAAmB;AAAA,IACnB,mBAAmB;AAAA,IACnB,mBAAmB;AAAA,IACnB,mBAAmB;AAAA,EACrB;AAAA,EACA,UAAU,CAAC,oBAAoB,QAAQ;AACzC;AAGO,SAAS,2BAAqC;AACnD,SAAO;AAAA,IACL,GAAG,oBAAI,IAAI;AAAA,MACT,GAAG,uBAAuB;AAAA,MAC1B,GAAG,uBAAuB;AAAA,MAC1B,GAAG,uBAAuB;AAAA,IAC5B,CAAC;AAAA,EACH;AACF;AAGO,MAAM,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,UAAU;AACZ;AAEA,MAAM,aACJ;AAOK,SAAS,gBACd,SACwB;AACxB,QAAM,QAAQ,QAAQ,WAAW;AACjC,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG;AACvE,WAAO;AAAA,EACT;AACA,QAAM,EAAE,MAAM,QAAQ,gBAAgB,IAAI;AAC1C,MACE,OAAO,SAAS,YAChB,CAAC,WAAW,KAAK,IAAI,KACrB,WAAW,UACX,OAAO,oBAAoB,YAC3B,gBAAgB,WAAW,GAC3B;AACA,WAAO;AAAA,EACT;AACA,SAAO,EAAE,MAAM,QAAQ,gBAAgB;AACzC;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { AccountsPermissions } from '../permissions/accounts.permissions.js'\nimport { ConsolePermissions } from '../permissions/console.permissions.js'\n\n/**\n * The agent tokens of ccmacli: machine credentials that a Camundi creates in\n * Camunda Control for an agent, with read access only.\n *\n * control-backend stores the clients. token-issuer exchanges the credentials\n * for an Auth0 token of the agent audience. control-backend, console-backend\n * and accounts-backend accept that token on their read routes. Every type and\n * rule that two of these services share is in this file.\n */\n\n/** AGENT_CLAIM is the claim of an agent token that names the client. */\nexport const AGENT_CLAIM = 'https://camunda.com/agent'\n\n/** AGENT_CLIENT_ID_PREFIX starts every client id of an agent client. */\nexport const AGENT_CLIENT_ID_PREFIX = 'ccma_'\n\n/** AGENT_TOKENS_FEATURE_FLAG closes create and rotate while it is off. */\nexport const AGENT_TOKENS_FEATURE_FLAG = 'control.agentTokens'\n\n/**\n * AGENT_SLACK_GRANTS_FEATURE_FLAG closes the create and the extend of a\n * binding, and the create of a grant, while it is off. The redeem stays open:\n * a code made before the flag went off works until it expires (`AGENT_GRANT_TTL_MS`).\n */\nexport const AGENT_SLACK_GRANTS_FEATURE_FLAG = 'control.agentSlackGrants'\n\n/**\n * The form of a Slack channel ID: public (`C`) or private (`G`) channel.\n * A binding stores the ID, never the name.\n */\nexport const AGENT_SLACK_CHANNEL_PATTERN = /^[CG][A-Z0-9]{8,}$/\n\n/** AGENT_GRANT_TTL_MS is the time in which a grant code can be redeemed. */\nexport const AGENT_GRANT_TTL_MS = 120_000\n\n/** AGENT_GRANTS_PER_HOUR_MAX is the limit of new grants for one binding. */\nexport const AGENT_GRANTS_PER_HOUR_MAX = 10\n\n/** AGENT_TOKEN_EXPIRY_DAYS lists the lifetimes that a creator can choose. */\nexport const AGENT_TOKEN_EXPIRY_DAYS = [7, 30, 90] as const\n\nexport type AgentTokenExpiryDays = (typeof AGENT_TOKEN_EXPIRY_DAYS)[number]\n\n/** AGENT_TOKEN_NAME_MAX is the length limit of a name, after the trim. */\nexport const AGENT_TOKEN_NAME_MAX = 64\n\n/** AGENT_TOKENS_ACTIVE_MAX is the limit of active clients for one creator. */\nexport const AGENT_TOKENS_ACTIVE_MAX = 10\n\n/**\n * `secret` is a client with an id and a secret. `slack` is a binding to one\n * Slack channel: it has no secret, and a grant gives it a token.\n */\nexport type AgentTokenKind = 'secret' | 'slack'\n\n/** Phase 1 has read access only. Phase 2 adds `write`. */\nexport type AgentAccess = 'read'\n\n/** The value of `AGENT_CLAIM` in a verified agent token. */\nexport interface AgentClaim {\n  uuid: string\n  access: AgentAccess\n  /** The `sub` of the Camundi who created the client. */\n  createdByUserId: string\n}\n\n/** `inactive` means that the creator is no longer a Camundi. */\nexport type AgentTokenStatus = 'active' | 'expired' | 'revoked' | 'inactive'\n\n/** AGENT_TOKEN_STATUSES lists every value of `AgentTokenStatus`. */\nexport const AGENT_TOKEN_STATUSES = [\n  'active',\n  'expired',\n  'revoked',\n  'inactive',\n] as const satisfies readonly AgentTokenStatus[]\n\n/** One agent client, as its creator sees it. It never holds the secret. */\nexport interface AgentToken {\n  uuid: string\n  clientId: string\n  name: string\n  access: AgentAccess\n  kind: AgentTokenKind\n  /** The channel ID of a binding. It is absent when `kind` is `secret`. */\n  slackChannelId?: string\n  status: AgentTokenStatus\n  createdAt: string\n  expiresAt: string\n  lastUsedAt?: string\n  revokedAt?: string\n}\n\n/**\n * AgentTokenCreated is the answer of create and rotate. It is the only answer\n * that holds `clientSecret`, and the backend cannot show the secret again.\n */\nexport interface AgentTokenCreated extends AgentToken {\n  /** Absent for a binding, which has no secret. */\n  clientSecret?: string\n}\n\n/** One agent client, as the admin list shows it. */\nexport interface AgentTokenAdmin extends AgentToken {\n  createdBy: { userId: string; email: string }\n  revokedByUserId?: string\n}\n\n/** The body of `POST /api/agent-tokens`. */\nexport interface CreateAgentTokenDto {\n  name: string\n  expiresInDays: AgentTokenExpiryDays\n  /** Set it to make a binding to this channel. Then there is no secret. */\n  slackChannelId?: string\n}\n\n/** The body of `POST /api/agent-tokens/:uuid/extend`. */\nexport interface ExtendAgentTokenDto {\n  expiresInDays: AgentTokenExpiryDays\n}\n\n/** The body of `POST /internal/agent-grants`. CloudBot sends it. */\nexport interface CreateAgentGrantDto {\n  slackChannelId: string\n  slackThreadTs: string\n  requestedBySlackUserId: string\n  requestedByEmail: string\n  /** The S256 challenge of the PKCE verifier that only ccmacli knows. */\n  codeChallenge: string\n}\n\n/** The answer of `POST /internal/agent-grants`. */\nexport interface AgentGrantCreated {\n  code: string\n  expiresAt: string\n}\n\n/** Why control-backend refuses a grant. CloudBot words the reply from it. */\nexport type AgentGrantRefusalReason =\n  | 'no_binding'\n  | 'expired'\n  | 'revoked'\n  | 'inactive'\n  | 'requester_unknown'\n  | 'rate_limited'\n  | 'thread_busy'\n  | 'feature_off'\n\n/** The body of the 409 answer of `POST /internal/agent-grants`. */\nexport interface AgentGrantRefusal {\n  code: string\n  message: string\n  reason: AgentGrantRefusalReason\n  expiredAt?: string\n  ownerEmail?: string\n}\n\n/** The body of `POST /internal/agent-grants/redeem`. token-issuer sends it. */\nexport interface RedeemAgentGrantDto {\n  code: string\n  codeVerifier: string\n}\n\n/** The answer of `POST /internal/agent-clients/verify`. */\nexport interface AgentVerifyResponse {\n  uuid: string\n  access: AgentAccess\n  createdByUserId: string\n}\n\n/**\n * The answer of `GET /internal/agent-clients/:uuid/status`.\n *\n * `permissions` is `AGENT_READ_PERMISSIONS` of all backends, intersected with\n * the permissions of the creator at the create or the last extend. It is empty\n * when `active` is false.\n */\nexport interface AgentStatusResponse {\n  active: boolean\n  permissions: string[]\n}\n\n/**\n * AGENT_READ_PERMISSIONS is the most that an agent token can do in each\n * backend. A backend intersects its set with the `permissions` of the status\n * answer, so an agent never holds a permission that its creator did not hold.\n *\n * `crtp` is a publish permission. It is here for one read only, the\n * release-train sanity check. The agent allowlist of console-backend, which a\n * later change of epic #10804 adds, must be the bound. Never add a route to\n * that allowlist that `crtp` guards for a write.\n */\nexport const AGENT_READ_PERMISSIONS: Readonly<{\n  control: readonly string[]\n  console: readonly string[]\n  accounts: readonly string[]\n}> = {\n  control: [AccountsPermissions.READ_ALL],\n  console: [\n    ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN_SEE,\n    ConsolePermissions.CLUSTERS_READALLCLUSTERINFO,\n    ConsolePermissions.CLUSTER_PLAN_SEE_ALL,\n    ConsolePermissions.RELEASE_TRAIN_PUBLISH,\n  ],\n  accounts: [AccountsPermissions.READ_ALL],\n}\n\n/** agentReadPermissionUnion is the union of the three backend sets. */\nexport function agentReadPermissionUnion(): string[] {\n  return [\n    ...new Set([\n      ...AGENT_READ_PERMISSIONS.control,\n      ...AGENT_READ_PERMISSIONS.console,\n      ...AGENT_READ_PERMISSIONS.accounts,\n    ]),\n  ]\n}\n\n/** The codes of the two denials that only an agent token can get. */\nexport const AGENT_ERROR = {\n  readOnly: 'auth.agent_read_only',\n  inactive: 'auth.agent_inactive',\n} as const\n\nconst UUID_SHAPE =\n  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\n/**\n * parseAgentClaim reads `AGENT_CLAIM` from the payload of a VERIFIED token.\n * It returns `undefined` when the claim is absent or has a wrong shape, and\n * the caller must then refuse the token.\n */\nexport function parseAgentClaim(\n  payload: Record<string, unknown>,\n): AgentClaim | undefined {\n  const claim = payload[AGENT_CLAIM]\n  if (typeof claim !== 'object' || claim === null || Array.isArray(claim)) {\n    return undefined\n  }\n  const { uuid, access, createdByUserId } = claim as Record<string, unknown>\n  if (\n    typeof uuid !== 'string' ||\n    !UUID_SHAPE.test(uuid) ||\n    access !== 'read' ||\n    typeof createdByUserId !== 'string' ||\n    createdByUserId.length === 0\n  ) {\n    return undefined\n  }\n  return { uuid, access, createdByUserId }\n}\n"],
+  "mappings": "AAMA,SAAS,2BAA2B;AACpC,SAAS,0BAA0B;AAa5B,MAAM,cAAc;AAGpB,MAAM,yBAAyB;AAG/B,MAAM,4BAA4B;AAOlC,MAAM,kCAAkC;AAMxC,MAAM,8BAA8B;AAGpC,MAAM,qBAAqB;AAG3B,MAAM,4BAA4B;AAGlC,MAAM,0BAA0B,CAAC,GAAG,IAAI,EAAE;AAK1C,MAAM,uBAAuB;AAG7B,MAAM,0BAA0B;AAuBhC,MAAM,uBAAuB;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAqHO,MAAM,yBAIR;AAAA,EACH,SAAS,CAAC,oBAAoB,QAAQ;AAAA,EACtC,SAAS;AAAA,IACP,mBAAmB;AAAA,IACnB,mBAAmB;AAAA,IACnB,mBAAmB;AAAA,IACnB,mBAAmB;AAAA,EACrB;AAAA,EACA,UAAU,CAAC,oBAAoB,QAAQ;AACzC;AAGO,SAAS,2BAAqC;AACnD,SAAO;AAAA,IACL,GAAG,oBAAI,IAAI;AAAA,MACT,GAAG,uBAAuB;AAAA,MAC1B,GAAG,uBAAuB;AAAA,MAC1B,GAAG,uBAAuB;AAAA,IAC5B,CAAC;AAAA,EACH;AACF;AAGO,MAAM,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,UAAU;AACZ;AAEA,MAAM,aACJ;AAOK,SAAS,gBACd,SACwB;AACxB,QAAM,QAAQ,QAAQ,WAAW;AACjC,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG;AACvE,WAAO;AAAA,EACT;AACA,QAAM,EAAE,MAAM,QAAQ,gBAAgB,IAAI;AAC1C,MACE,OAAO,SAAS,YAChB,CAAC,WAAW,KAAK,IAAI,KACrB,WAAW,UACX,OAAO,oBAAoB,YAC3B,gBAAgB,WAAW,GAC3B;AACA,WAAO;AAAA,EACT;AACA,SAAO,EAAE,MAAM,QAAQ,gBAAgB;AACzC;",
   "names": []
 }

package/dist/approvals/approval-rules.d.ts

@@ -0,0 +1,172 @@
+import type { Stage } from '../constants/misc.const.js';
+import { type ApprovalUseCaseType } from './use-cases.const.js';
+/**
+ * The approvals of one type of request.
+ *
+ * The count is the number of approvals from holders of the run permissions of
+ * the request (`requiredPermissions`). The opener counts too: when the opener
+ * holds every run permission, the request gets the approval of the opener
+ * when it is created. The opener cannot approve the request by hand
+ * (`canAcknowledge`).
+ */
+export interface ApprovalRule {
+    /** The approvals on prod. */
+    prod: number;
+    /** The approvals on dev, int and local. When it is not set, `prod` applies. */
+    testStages?: number;
+}
+/**
+ * How many approvals each type of request needs. This table is the one source
+ * of that number, for control-backend, control-frontend, and the routes of
+ * accounts and console that run an approved action.
+ *
+ * - **0**: no approval. Only a holder, or a person whom the use case opens the
+ *   request to, can open it.
+ * - **1**: a holder does the action alone. The request of a holder runs when
+ *   it is created. The request of a person who is not a holder waits for one
+ *   holder.
+ * - **2**: four eyes. The request of a holder waits for one other holder. The
+ *   request of a person who is not a holder waits for two holders.
+ * - **3**: six eyes on prod.
+ *
+ * Before #10483 a use case counted only the approvals of people other than
+ * the opener. Thus an old count and a count of this table are not the same
+ * unit.
+ */
+export declare const APPROVAL_RULES: {
+    readonly "cluster-ttl-deletion": {
+        readonly prod: 0;
+    };
+    readonly "create-personal-organisation": {
+        readonly prod: 0;
+    };
+    readonly "create-custom-hardware-sizing": {
+        readonly prod: 0;
+    };
+    readonly "remove-custom-hardware-sizing": {
+        readonly prod: 0;
+    };
+    readonly "create-custom-generation": {
+        readonly prod: 0;
+    };
+    readonly "remove-custom-generation": {
+        readonly prod: 0;
+    };
+    readonly "self-service-cluster-modification": {
+        readonly prod: 0;
+    };
+    readonly "revoke-approval-override": {
+        readonly prod: 0;
+    };
+    readonly "extend-trial": {
+        readonly prod: 1;
+    };
+    readonly "change-org-limits": {
+        readonly prod: 1;
+    };
+    readonly "llm-budget-top-up": {
+        readonly prod: 1;
+    };
+    readonly "change-sales-plan": {
+        readonly prod: 1;
+    };
+    readonly "request-in-negotiation": {
+        readonly prod: 1;
+    };
+    readonly "onboard-to-enterprise": {
+        readonly prod: 1;
+    };
+    readonly "automated-enterprise-onboarding": {
+        readonly prod: 1;
+    };
+    readonly "change-cluster-plan-type": {
+        readonly prod: 1;
+    };
+    readonly "delete-internal-backup": {
+        readonly prod: 1;
+    };
+    readonly "release-train-publish": {
+        readonly prod: 1;
+    };
+    readonly "release-train-rollback": {
+        readonly prod: 1;
+    };
+    readonly "change-platform-roles": {
+        readonly prod: 2;
+    };
+    readonly "change-user-email": {
+        readonly prod: 2;
+    };
+    readonly "delete-user": {
+        readonly prod: 2;
+    };
+    readonly "purge-users": {
+        readonly prod: 2;
+    };
+    readonly "update-user-metadata": {
+        readonly prod: 2;
+    };
+    readonly "delete-organization": {
+        readonly prod: 2;
+    };
+    readonly "send-to-expired-trial": {
+        readonly prod: 2;
+    };
+    readonly "delete-sso-connection": {
+        readonly prod: 2;
+    };
+    readonly "delete-api-client": {
+        readonly prod: 2;
+    };
+    readonly "move-cluster-org": {
+        readonly prod: 2;
+    };
+    readonly "edit-generation": {
+        readonly prod: 2;
+    };
+    readonly "change-generation-versions": {
+        readonly prod: 2;
+    };
+    readonly "cluster-bulk-generation-update": {
+        readonly prod: 2;
+    };
+    readonly "cluster-bulk-plan-update": {
+        readonly prod: 2;
+    };
+    readonly "cluster-bulk-plan-type-update": {
+        readonly prod: 2;
+    };
+    readonly "cluster-bulk-sleep-wakeup": {
+        readonly prod: 2;
+    };
+    readonly "cluster-bulk-spec-update": {
+        readonly prod: 2;
+    };
+    readonly "cluster-bulk-deletion": {
+        readonly prod: 3;
+        readonly testStages: 2;
+    };
+    readonly "delete-cluster-corpses": {
+        readonly prod: 3;
+        readonly testStages: 2;
+    };
+    readonly "force-delete-cluster-plan-type": {
+        readonly prod: 3;
+        readonly testStages: 2;
+    };
+    readonly "change-feature-flag": {
+        readonly prod: 3;
+        readonly testStages: 2;
+    };
+    readonly "grant-approval-override": {
+        readonly prod: 2;
+    };
+};
+/** The types whose count on the test stages is not the count on prod. */
+export type StageDependentApprovalType = {
+    [K in ApprovalUseCaseType]: (typeof APPROVAL_RULES)[K] extends {
+        testStages: number;
+    } ? K : never;
+}[ApprovalUseCaseType];
+/** The approvals that a request of `type` needs on `stage`. */
+export declare function approvalsRequiredFor(type: ApprovalUseCaseType, stage: Stage): number;

package/dist/approvals/approval-rules.js

@@ -0,0 +1,71 @@
+import {
+  APPROVAL_USE_CASE_TYPES as T
+} from "./use-cases.const.js";
+const APPROVAL_RULES = {
+  // No approval. A use case that is open to every Camundi, or that only a
+  // system opens.
+  [T.clusterTtlDeletion]: { prod: 0 },
+  [T.createPersonalOrganisation]: { prod: 0 },
+  [T.createCustomHardwareSizing]: { prod: 0 },
+  [T.removeCustomHardwareSizing]: { prod: 0 },
+  [T.createCustomGeneration]: { prod: 0 },
+  [T.removeCustomGeneration]: { prod: 0 },
+  [T.selfServiceClusterModification]: { prod: 0 },
+  // Only the run of a grant opens it, as the system, and it runs by itself at
+  // the end of the grant. Ending a grant takes power away.
+  [T.revokeApprovalOverride]: { prod: 0 },
+  // A holder does it alone. Before #10483 a holder did these actions in
+  // accounts-frontend or console-frontend with no second person.
+  [T.extendTrial]: { prod: 1 },
+  [T.changeOrgLimits]: { prod: 1 },
+  [T.llmBudgetTopUp]: { prod: 1 },
+  [T.changeSalesPlan]: { prod: 1 },
+  [T.requestInNegotiation]: { prod: 1 },
+  [T.onboardToEnterprise]: { prod: 1 },
+  [T.automatedEnterpriseOnboarding]: { prod: 1 },
+  [T.changeClusterPlanType]: { prod: 1 },
+  [T.deleteInternalBackup]: { prod: 1 },
+  [T.releaseTrainPublish]: { prod: 1 },
+  [T.releaseTrainRollback]: { prod: 1 },
+  // Four eyes. The action removes data or access, changes a person, moves a
+  // cluster to another customer, or restarts every cluster of a generation.
+  [T.changePlatformRoles]: { prod: 2 },
+  [T.changeUserEmail]: { prod: 2 },
+  [T.deleteUser]: { prod: 2 },
+  [T.purgeUsers]: { prod: 2 },
+  [T.updateUserMetadata]: { prod: 2 },
+  [T.deleteOrganization]: { prod: 2 },
+  [T.sendToExpiredTrial]: { prod: 2 },
+  [T.deleteSsoConnection]: { prod: 2 },
+  [T.deleteApiClient]: { prod: 2 },
+  [T.moveClusterOrg]: { prod: 2 },
+  [T.editGeneration]: { prod: 2 },
+  [T.changeGenerationVersions]: { prod: 2 },
+  // One decision changes many clusters. A deletion cannot be undone, so it
+  // needs six eyes on prod.
+  [T.clusterBulkGenerationUpdate]: { prod: 2 },
+  [T.clusterBulkPlanUpdate]: { prod: 2 },
+  [T.clusterBulkPlanTypeUpdate]: { prod: 2 },
+  [T.clusterBulkSleepWakeup]: { prod: 2 },
+  [T.clusterBulkSpecUpdate]: { prod: 2 },
+  [T.clusterBulkDeletion]: { prod: 3, testStages: 2 },
+  [T.deleteClusterCorpses]: { prod: 3, testStages: 2 },
+  [T.forceDeleteClusterPlanType]: { prod: 3, testStages: 2 },
+  // A flag of prod turns a feature on or off for every customer.
+  [T.changeFeatureFlag]: { prod: 3, testStages: 2 },
+  // A grant lets one Camundi run many requests with no second person. The
+  // opener and one other holder, on every stage. The grantee approves
+  // neither by hand nor when they open it, thus a grant for oneself needs
+  // two other holders. The console team has three people, so a third
+  // approval would block a grant for oneself.
+  [T.grantApprovalOverride]: { prod: 2 }
+};
+function approvalsRequiredFor(type, stage) {
+  const rule = APPROVAL_RULES[type];
+  return stage === "prod" ? rule.prod : rule.testStages ?? rule.prod;
+}
+export {
+  APPROVAL_RULES,
+  approvalsRequiredFor
+};
+//# sourceMappingURL=approval-rules.js.map

package/dist/approvals/approval-rules.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/approvals/approval-rules.ts"],
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type { Stage } from '../constants/misc.const.js'\nimport {\n  type ApprovalUseCaseType,\n  APPROVAL_USE_CASE_TYPES as T,\n} from './use-cases.const.js'\n\n/**\n * The approvals of one type of request.\n *\n * The count is the number of approvals from holders of the run permissions of\n * the request (`requiredPermissions`). The opener counts too: when the opener\n * holds every run permission, the request gets the approval of the opener\n * when it is created. The opener cannot approve the request by hand\n * (`canAcknowledge`).\n */\nexport interface ApprovalRule {\n  /** The approvals on prod. */\n  prod: number\n  /** The approvals on dev, int and local. When it is not set, `prod` applies. */\n  testStages?: number\n}\n\n/**\n * How many approvals each type of request needs. This table is the one source\n * of that number, for control-backend, control-frontend, and the routes of\n * accounts and console that run an approved action.\n *\n * - **0**: no approval. Only a holder, or a person whom the use case opens the\n *   request to, can open it.\n * - **1**: a holder does the action alone. The request of a holder runs when\n *   it is created. The request of a person who is not a holder waits for one\n *   holder.\n * - **2**: four eyes. The request of a holder waits for one other holder. The\n *   request of a person who is not a holder waits for two holders.\n * - **3**: six eyes on prod.\n *\n * Before #10483 a use case counted only the approvals of people other than\n * the opener. Thus an old count and a count of this table are not the same\n * unit.\n */\nexport const APPROVAL_RULES = {\n  // No approval. A use case that is open to every Camundi, or that only a\n  // system opens.\n  [T.clusterTtlDeletion]: { prod: 0 },\n  [T.createPersonalOrganisation]: { prod: 0 },\n  [T.createCustomHardwareSizing]: { prod: 0 },\n  [T.removeCustomHardwareSizing]: { prod: 0 },\n  [T.createCustomGeneration]: { prod: 0 },\n  [T.removeCustomGeneration]: { prod: 0 },\n  [T.selfServiceClusterModification]: { prod: 0 },\n  // Only the run of a grant opens it, as the system, and it runs by itself at\n  // the end of the grant. Ending a grant takes power away.\n  [T.revokeApprovalOverride]: { prod: 0 },\n\n  // A holder does it alone. Before #10483 a holder did these actions in\n  // accounts-frontend or console-frontend with no second person.\n  [T.extendTrial]: { prod: 1 },\n  [T.changeOrgLimits]: { prod: 1 },\n  [T.llmBudgetTopUp]: { prod: 1 },\n  [T.changeSalesPlan]: { prod: 1 },\n  [T.requestInNegotiation]: { prod: 1 },\n  [T.onboardToEnterprise]: { prod: 1 },\n  [T.automatedEnterpriseOnboarding]: { prod: 1 },\n  [T.changeClusterPlanType]: { prod: 1 },\n  [T.deleteInternalBackup]: { prod: 1 },\n  [T.releaseTrainPublish]: { prod: 1 },\n  [T.releaseTrainRollback]: { prod: 1 },\n\n  // Four eyes. The action removes data or access, changes a person, moves a\n  // cluster to another customer, or restarts every cluster of a generation.\n  [T.changePlatformRoles]: { prod: 2 },\n  [T.changeUserEmail]: { prod: 2 },\n  [T.deleteUser]: { prod: 2 },\n  [T.purgeUsers]: { prod: 2 },\n  [T.updateUserMetadata]: { prod: 2 },\n  [T.deleteOrganization]: { prod: 2 },\n  [T.sendToExpiredTrial]: { prod: 2 },\n  [T.deleteSsoConnection]: { prod: 2 },\n  [T.deleteApiClient]: { prod: 2 },\n  [T.moveClusterOrg]: { prod: 2 },\n  [T.editGeneration]: { prod: 2 },\n  [T.changeGenerationVersions]: { prod: 2 },\n\n  // One decision changes many clusters. A deletion cannot be undone, so it\n  // needs six eyes on prod.\n  [T.clusterBulkGenerationUpdate]: { prod: 2 },\n  [T.clusterBulkPlanUpdate]: { prod: 2 },\n  [T.clusterBulkPlanTypeUpdate]: { prod: 2 },\n  [T.clusterBulkSleepWakeup]: { prod: 2 },\n  [T.clusterBulkSpecUpdate]: { prod: 2 },\n  [T.clusterBulkDeletion]: { prod: 3, testStages: 2 },\n  [T.deleteClusterCorpses]: { prod: 3, testStages: 2 },\n  [T.forceDeleteClusterPlanType]: { prod: 3, testStages: 2 },\n\n  // A flag of prod turns a feature on or off for every customer.\n  [T.changeFeatureFlag]: { prod: 3, testStages: 2 },\n\n  // A grant lets one Camundi run many requests with no second person. The\n  // opener and one other holder, on every stage. The grantee approves\n  // neither by hand nor when they open it, thus a grant for oneself needs\n  // two other holders. The console team has three people, so a third\n  // approval would block a grant for oneself.\n  [T.grantApprovalOverride]: { prod: 2 },\n} as const satisfies Record<ApprovalUseCaseType, ApprovalRule>\n\n/** The types whose count on the test stages is not the count on prod. */\nexport type StageDependentApprovalType = {\n  [K in ApprovalUseCaseType]: (typeof APPROVAL_RULES)[K] extends {\n    testStages: number\n  }\n    ? K\n    : never\n}[ApprovalUseCaseType]\n\n/** The approvals that a request of `type` needs on `stage`. */\nexport function approvalsRequiredFor(\n  type: ApprovalUseCaseType,\n  stage: Stage,\n): number {\n  const rule: ApprovalRule = APPROVAL_RULES[type]\n  return stage === 'prod' ? rule.prod : (rule.testStages ?? rule.prod)\n}\n"],
+  "mappings": "AAOA;AAAA,EAEE,2BAA2B;AAAA,OACtB;AAoCA,MAAM,iBAAiB;AAAA;AAAA;AAAA,EAG5B,CAAC,EAAE,kBAAkB,GAAG,EAAE,MAAM,EAAE;AAAA,EAClC,CAAC,EAAE,0BAA0B,GAAG,EAAE,MAAM,EAAE;AAAA,EAC1C,CAAC,EAAE,0BAA0B,GAAG,EAAE,MAAM,EAAE;AAAA,EAC1C,CAAC,EAAE,0BAA0B,GAAG,EAAE,MAAM,EAAE;AAAA,EAC1C,CAAC,EAAE,sBAAsB,GAAG,EAAE,MAAM,EAAE;AAAA,EACtC,CAAC,EAAE,sBAAsB,GAAG,EAAE,MAAM,EAAE;AAAA,EACtC,CAAC,EAAE,8BAA8B,GAAG,EAAE,MAAM,EAAE;AAAA;AAAA;AAAA,EAG9C,CAAC,EAAE,sBAAsB,GAAG,EAAE,MAAM,EAAE;AAAA;AAAA;AAAA,EAItC,CAAC,EAAE,WAAW,GAAG,EAAE,MAAM,EAAE;AAAA,EAC3B,CAAC,EAAE,eAAe,GAAG,EAAE,MAAM,EAAE;AAAA,EAC/B,CAAC,EAAE,cAAc,GAAG,EAAE,MAAM,EAAE;AAAA,EAC9B,CAAC,EAAE,eAAe,GAAG,EAAE,MAAM,EAAE;AAAA,EAC/B,CAAC,EAAE,oBAAoB,GAAG,EAAE,MAAM,EAAE;AAAA,EACpC,CAAC,EAAE,mBAAmB,GAAG,EAAE,MAAM,EAAE;AAAA,EACnC,CAAC,EAAE,6BAA6B,GAAG,EAAE,MAAM,EAAE;AAAA,EAC7C,CAAC,EAAE,qBAAqB,GAAG,EAAE,MAAM,EAAE;AAAA,EACrC,CAAC,EAAE,oBAAoB,GAAG,EAAE,MAAM,EAAE;AAAA,EACpC,CAAC,EAAE,mBAAmB,GAAG,EAAE,MAAM,EAAE;AAAA,EACnC,CAAC,EAAE,oBAAoB,GAAG,EAAE,MAAM,EAAE;AAAA;AAAA;AAAA,EAIpC,CAAC,EAAE,mBAAmB,GAAG,EAAE,MAAM,EAAE;AAAA,EACnC,CAAC,EAAE,eAAe,GAAG,EAAE,MAAM,EAAE;AAAA,EAC/B,CAAC,EAAE,UAAU,GAAG,EAAE,MAAM,EAAE;AAAA,EAC1B,CAAC,EAAE,UAAU,GAAG,EAAE,MAAM,EAAE;AAAA,EAC1B,CAAC,EAAE,kBAAkB,GAAG,EAAE,MAAM,EAAE;AAAA,EAClC,CAAC,EAAE,kBAAkB,GAAG,EAAE,MAAM,EAAE;AAAA,EAClC,CAAC,EAAE,kBAAkB,GAAG,EAAE,MAAM,EAAE;AAAA,EAClC,CAAC,EAAE,mBAAmB,GAAG,EAAE,MAAM,EAAE;AAAA,EACnC,CAAC,EAAE,eAAe,GAAG,EAAE,MAAM,EAAE;AAAA,EAC/B,CAAC,EAAE,cAAc,GAAG,EAAE,MAAM,EAAE;AAAA,EAC9B,CAAC,EAAE,cAAc,GAAG,EAAE,MAAM,EAAE;AAAA,EAC9B,CAAC,EAAE,wBAAwB,GAAG,EAAE,MAAM,EAAE;AAAA;AAAA;AAAA,EAIxC,CAAC,EAAE,2BAA2B,GAAG,EAAE,MAAM,EAAE;AAAA,EAC3C,CAAC,EAAE,qBAAqB,GAAG,EAAE,MAAM,EAAE;AAAA,EACrC,CAAC,EAAE,yBAAyB,GAAG,EAAE,MAAM,EAAE;AAAA,EACzC,CAAC,EAAE,sBAAsB,GAAG,EAAE,MAAM,EAAE;AAAA,EACtC,CAAC,EAAE,qBAAqB,GAAG,EAAE,MAAM,EAAE;AAAA,EACrC,CAAC,EAAE,mBAAmB,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA,EAClD,CAAC,EAAE,oBAAoB,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA,EACnD,CAAC,EAAE,0BAA0B,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA;AAAA,EAGzD,CAAC,EAAE,iBAAiB,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOhD,CAAC,EAAE,qBAAqB,GAAG,EAAE,MAAM,EAAE;AACvC;AAYO,SAAS,qBACd,MACA,OACQ;AACR,QAAM,OAAqB,eAAe,IAAI;AAC9C,SAAO,UAAU,SAAS,KAAK,OAAQ,KAAK,cAAc,KAAK;AACjE;",
+  "names": []
+}

package/dist/approvals/cluster-bulk-operation.d.ts

@@ -13,6 +13,7 @@
  */
 import { ClusterBulkOperationStatus, ClusterBulkOperationType } from '../enums/ClusterBulkOperation.enum.js';
 import type { ClusterBulkOperationParameter } from '../types/ClusterBulkOperation.type.js';
+import { type ApprovalUseCaseType } from './use-cases.const.js';
 /**
  * The most clusters that one request holds.
  *
@@ -41,30 +42,11 @@ export declare const CLUSTER_BULK_OPERATION_CLUSTER_NAME_MAX_LENGTH = 100;
 export declare const CLUSTER_BULK_SLEEPING_CLUSTER_DELAY_MS = 60000;
 /** What one operation type needs, and which use case carries it. */
 export interface ClusterBulkOperationRule {
-    useCase: string;
+    useCase: ApprovalUseCaseType;
     label: string;
     /** The permission that opens, approves and runs a request of this type. */
     permission: string;
 }
-/**
- * The floor of approvals of a cluster bulk operation on prod, for every type.
- * Dev, int and local use `CLUSTER_BULK_OPERATION_TEST_STAGE_MIN_ACKS`.
- *
- * A bulk operation changes many clusters with one decision, so it needs two
- * people other than the requester. Every other use case needs one. This
- * floor is separate from `MINIMUM_EYEPAIRS` and is not lowered with it: the
- * approval flow needs 2 other people, and the old flow of console-backend
- * needs the count of `MINIMUM_EYEPAIRS`. That flow reads
- * `requiredBulkOperationAcks`.
- */
-export declare const CLUSTER_BULK_OPERATION_MIN_ACKS = 2;
-/**
- * The floor of approvals of a cluster bulk operation on dev, int and local.
- *
- * A test stage often has one other Camundi who can approve. One approval
- * there still tests the whole flow.
- */
-export declare const CLUSTER_BULK_OPERATION_TEST_STAGE_MIN_ACKS = 1;
 /**
  * The rules of each operation type.
  *
@@ -109,6 +91,9 @@ export interface ClusterBulkPlanUpdateSettings {
 /**
  * No `keepModification`: the parameter of a plan type update in the old flow
  * has none, and its dialog never sends it.
+ *
+ * No packages either: each cluster keeps its packages, and console checks
+ * them against the free reservations of the organization.
  */
 export interface ClusterBulkPlanTypeUpdateSettings {
     targetPlanTypeId: string;

package/dist/approvals/cluster-bulk-operation.js

@@ -3,13 +3,13 @@ import {
   ClusterBulkOperationType
 } from "../enums/ClusterBulkOperation.enum.js";
 import { ConsolePermissions } from "../permissions/console.permissions.js";
-import { APPROVAL_USE_CASE_TYPES } from "./use-cases.const.js";
+import {
+  APPROVAL_USE_CASE_TYPES
+} from "./use-cases.const.js";
 const CLUSTER_BULK_OPERATION_MAX_CLUSTERS = 3e3;
 const CLUSTER_BULK_OPERATION_NAME_MAX_LENGTH = 200;
 const CLUSTER_BULK_OPERATION_CLUSTER_NAME_MAX_LENGTH = 100;
 const CLUSTER_BULK_SLEEPING_CLUSTER_DELAY_MS = 6e4;
-const CLUSTER_BULK_OPERATION_MIN_ACKS = 2;
-const CLUSTER_BULK_OPERATION_TEST_STAGE_MIN_ACKS = 1;
 const CLUSTER_BULK_OPERATION_RULES = {
   [ClusterBulkOperationType.GENERATION_UPDATE]: {
     useCase: APPROVAL_USE_CASE_TYPES.clusterBulkGenerationUpdate,
@@ -114,10 +114,8 @@ function clusterBulkResultOf(executionResult, clusterId) {
 export {
   CLUSTER_BULK_OPERATION_CLUSTER_NAME_MAX_LENGTH,
   CLUSTER_BULK_OPERATION_MAX_CLUSTERS,
-  CLUSTER_BULK_OPERATION_MIN_ACKS,
   CLUSTER_BULK_OPERATION_NAME_MAX_LENGTH,
   CLUSTER_BULK_OPERATION_RULES,
-  CLUSTER_BULK_OPERATION_TEST_STAGE_MIN_ACKS,
   CLUSTER_BULK_OPERATION_TYPES,
   CLUSTER_BULK_SLEEPING_CLUSTER_DELAY_MS,
   clusterBulkOperationTypeOf,

package/dist/approvals/cluster-bulk-operation.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/approvals/cluster-bulk-operation.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/**\n * The cluster bulk operation on the approval mechanism of control-backend.\n *\n * control-backend and control-frontend both read this file. The backend\n * builds its six use cases from `CLUSTER_BULK_OPERATION_RULES`, and the form\n * of the frontend reads the same table to run `canCreate` before the request\n * goes out. A permission that only one side knew would be a button that the\n * server then refuses.\n *\n * console-backend reads the step types at the end. control-backend calls one\n * step for each cluster, and console-backend does the work of that step with\n * the same code that its own bulk operation runs.\n */\n\nimport {\n  ClusterBulkOperationStatus,\n  ClusterBulkOperationType,\n} from '../enums/ClusterBulkOperation.enum.js'\nimport { ConsolePermissions } from '../permissions/console.permissions.js'\nimport type { ClusterBulkOperationParameter } from '../types/ClusterBulkOperation.type.js'\nimport { APPROVAL_USE_CASE_TYPES } from './use-cases.const.js'\n\n/**\n * The most clusters that one request holds.\n *\n * The payload is a json column, and the create route reads it in one body of\n * at most 1 MiB. 3000 clusters with the longest names stay far below that.\n * A larger set is two requests, which is also two decisions for the people\n * who approve.\n */\nexport const CLUSTER_BULK_OPERATION_MAX_CLUSTERS = 3000\n\n/** The longest name of an operation. The name is what the queue shows. */\nexport const CLUSTER_BULK_OPERATION_NAME_MAX_LENGTH = 200\n\n/**\n * The longest cluster name that the payload keeps.\n *\n * The name is a copy for a reader. The id alone decides what the step\n * changes.\n */\nexport const CLUSTER_BULK_OPERATION_CLUSTER_NAME_MAX_LENGTH = 100\n\n/**\n * The wait between two sleeping clusters of one datacenter.\n *\n * The same number as the bulk operation of console-backend. A wake-up loads\n * the datacenter, and many wake-ups together overload it. Datacenters do not\n * wait for each other.\n */\nexport const CLUSTER_BULK_SLEEPING_CLUSTER_DELAY_MS = 60_000\n\n/** What one operation type needs, and which use case carries it. */\nexport interface ClusterBulkOperationRule {\n  useCase: string\n  label: string\n  /** The permission that opens, approves and runs a request of this type. */\n  permission: string\n}\n\n/**\n * The floor of approvals of a cluster bulk operation on prod, for every type.\n * Dev, int and local use `CLUSTER_BULK_OPERATION_TEST_STAGE_MIN_ACKS`.\n *\n * A bulk operation changes many clusters with one decision, so it needs two\n * people other than the requester. Every other use case needs one. This\n * floor is separate from `MINIMUM_EYEPAIRS` and is not lowered with it: the\n * approval flow needs 2 other people, and the old flow of console-backend\n * needs the count of `MINIMUM_EYEPAIRS`. That flow reads\n * `requiredBulkOperationAcks`.\n */\nexport const CLUSTER_BULK_OPERATION_MIN_ACKS = 2\n\n/**\n * The floor of approvals of a cluster bulk operation on dev, int and local.\n *\n * A test stage often has one other Camundi who can approve. One approval\n * there still tests the whole flow.\n */\nexport const CLUSTER_BULK_OPERATION_TEST_STAGE_MIN_ACKS = 1\n\n/**\n * The rules of each operation type.\n *\n * The permissions are the ones that the bulk operation of console-backend\n * checks today (`getBulkOpRequiredPermission`), so a Camundi who can run one\n * flow can run the other. `CLUSTERS_READALLCLUSTERINFO` is part of every\n * type there, and `clusterBulkRequiredPermissions` adds it here.\n */\nexport const CLUSTER_BULK_OPERATION_RULES: Record<\n  ClusterBulkOperationType,\n  ClusterBulkOperationRule\n> = {\n  [ClusterBulkOperationType.GENERATION_UPDATE]: {\n    useCase: APPROVAL_USE_CASE_TYPES.clusterBulkGenerationUpdate,\n    label: 'Generation update',\n    permission: ConsolePermissions.CLUSTERS_CAN_UPDATE_GENERATION,\n  },\n  [ClusterBulkOperationType.PLAN_UPDATE]: {\n    useCase: APPROVAL_USE_CASE_TYPES.clusterBulkPlanUpdate,\n    label: 'Plan update',\n    permission: ConsolePermissions.CLUSTERS_CAN_UPDATE_CLUSTERPLANTYPE,\n  },\n  [ClusterBulkOperationType.PLAN_TYPE_UPDATE]: {\n    useCase: APPROVAL_USE_CASE_TYPES.clusterBulkPlanTypeUpdate,\n    label: 'Plan type update',\n    permission: ConsolePermissions.CLUSTERS_CAN_UPDATE_CLUSTERPLANTYPE,\n  },\n  [ClusterBulkOperationType.SLEEP_WAKEUP]: {\n    useCase: APPROVAL_USE_CASE_TYPES.clusterBulkSleepWakeup,\n    label: 'Sleep / wake up',\n    permission: ConsolePermissions.CLUSTERS_CAN_SEND_TO_SLEEP,\n  },\n  [ClusterBulkOperationType.DELETION]: {\n    useCase: APPROVAL_USE_CASE_TYPES.clusterBulkDeletion,\n    label: 'Deletion',\n    permission: ConsolePermissions.CLUSTERS_DELETE_CLUSTER,\n  },\n  [ClusterBulkOperationType.SPEC_UPDATE]: {\n    useCase: APPROVAL_USE_CASE_TYPES.clusterBulkSpecUpdate,\n    label: 'Spec update',\n    permission: ConsolePermissions.CLUSTERS_CAN_UPDATE_CLUSTERPLANTYPE,\n  },\n}\n\n/** The operation types in the order that a form offers them. */\nexport const CLUSTER_BULK_OPERATION_TYPES: ClusterBulkOperationType[] = [\n  ClusterBulkOperationType.GENERATION_UPDATE,\n  ClusterBulkOperationType.PLAN_UPDATE,\n  ClusterBulkOperationType.PLAN_TYPE_UPDATE,\n  ClusterBulkOperationType.SLEEP_WAKEUP,\n  ClusterBulkOperationType.SPEC_UPDATE,\n  ClusterBulkOperationType.DELETION,\n]\n\n/** The operation type of a use case, or `undefined` for any other use case. */\nexport function clusterBulkOperationTypeOf(\n  useCase: string,\n): ClusterBulkOperationType | undefined {\n  return CLUSTER_BULK_OPERATION_TYPES.find(\n    (type) => CLUSTER_BULK_OPERATION_RULES[type].useCase === useCase,\n  )\n}\n\n/** One cluster of a request. */\nexport interface ClusterBulkTargetDto {\n  id: string\n  /** A copy for a reader. The step reads the id alone. */\n  name?: string\n  orgId?: string\n}\n\nexport interface ClusterBulkGenerationUpdateSettings {\n  targetGenerationId: string\n  /** A copy for a reader. */\n  targetGenerationName?: string\n  /** See `ClusterBulkOperationGenerationUpdateParameter.yoloAllClusters`. */\n  yoloAllClusters?: boolean\n  /** See `ClusterBulkOperationGenerationUpdateParameter.yoloForceUpdate`. */\n  yoloForceUpdate?: boolean\n  /**\n   * Changes only a cluster with auto-update on. console-backend reads the\n   * cluster when its step runs, because the customer can turn auto-update off\n   * while the request waits.\n   */\n  onlyAutoUpgrade?: boolean\n}\n\nexport interface ClusterBulkPlanUpdateSettings {\n  targetPlanId: string\n  targetPlanName?: string\n  /** Keeps the active modification of a cluster through the change. */\n  keepModification?: boolean\n}\n\n/**\n * No `keepModification`: the parameter of a plan type update in the old flow\n * has none, and its dialog never sends it.\n */\nexport interface ClusterBulkPlanTypeUpdateSettings {\n  targetPlanTypeId: string\n  targetPlanTypeName?: string\n}\n\nexport interface ClusterBulkSleepWakeupSettings {\n  action: 'sleep' | 'wakeup'\n}\n\n/** The settings of each type. Deletion and spec update have none. */\nexport interface ClusterBulkSettingsByType {\n  [ClusterBulkOperationType.GENERATION_UPDATE]: ClusterBulkGenerationUpdateSettings\n  [ClusterBulkOperationType.PLAN_UPDATE]: ClusterBulkPlanUpdateSettings\n  [ClusterBulkOperationType.PLAN_TYPE_UPDATE]: ClusterBulkPlanTypeUpdateSettings\n  [ClusterBulkOperationType.SLEEP_WAKEUP]: ClusterBulkSleepWakeupSettings\n  [ClusterBulkOperationType.DELETION]: Record<string, never>\n  [ClusterBulkOperationType.SPEC_UPDATE]: Record<string, never>\n}\n\n/** The payload of a request, for one operation type. */\nexport interface ClusterBulkOperationPayloadDto<\n  T extends ClusterBulkOperationType = ClusterBulkOperationType,\n> {\n  name: string\n  clusters: ClusterBulkTargetDto[]\n  settings: ClusterBulkSettingsByType[T]\n}\n\n/** True when the settings of a generation update go past a safety check. */\nexport function isClusterBulkYolo(\n  type: ClusterBulkOperationType,\n  settings: unknown,\n): boolean {\n  if (\n    type !== ClusterBulkOperationType.GENERATION_UPDATE ||\n    typeof settings !== 'object' ||\n    settings === null\n  ) {\n    return false\n  }\n  const typed = settings as ClusterBulkGenerationUpdateSettings\n  return typed.yoloAllClusters === true || typed.yoloForceUpdate === true\n}\n\n/**\n * Every permission that a request of this type and these settings needs.\n *\n * control-backend stores the answer on the request as\n * `requiredPermissions`, and the form passes the same answer to `canCreate`.\n * A yolo flag adds `CLUSTERS_CAN_UPDATE_GENERATION_YOLO`, which is the rule\n * of `needsGenerationYolo` in console-backend.\n */\nexport function clusterBulkRequiredPermissions(\n  type: ClusterBulkOperationType,\n  settings: unknown,\n): string[] {\n  const permissions = [\n    CLUSTER_BULK_OPERATION_RULES[type].permission,\n    ConsolePermissions.CLUSTERS_READALLCLUSTERINFO,\n  ]\n  if (isClusterBulkYolo(type, settings)) {\n    permissions.push(ConsolePermissions.CLUSTERS_CAN_UPDATE_GENERATION_YOLO)\n  }\n  return permissions\n}\n\n/**\n * Turns the settings of a request into the parameter of console-backend.\n *\n * The step route of console-backend reads the parameter shape of its own\n * bulk operation, so one function in console-backend serves both flows.\n * `nop` of the sleep action is not reachable from here on purpose: a request\n * that changes nothing is not a request that people approve.\n */\nexport function clusterBulkParameterOf(\n  type: ClusterBulkOperationType,\n  settings: unknown,\n): ClusterBulkOperationParameter {\n  const values = (settings ?? {}) as Record<string, unknown>\n  switch (type) {\n    case ClusterBulkOperationType.GENERATION_UPDATE:\n      return {\n        toGenerationUuid: String(values.targetGenerationId),\n        yoloAllClusters: values.yoloAllClusters === true,\n        yoloForceUpdate: values.yoloForceUpdate === true,\n        // Only when set, so the parameter of a plain update stays as it was.\n        ...(values.onlyAutoUpgrade === true && { onlyAutoUpgrade: true }),\n      }\n    case ClusterBulkOperationType.PLAN_UPDATE:\n      return {\n        toPlanUuid: String(values.targetPlanId),\n        yolo: false,\n        keepModification: values.keepModification === true,\n      }\n    case ClusterBulkOperationType.PLAN_TYPE_UPDATE:\n      return {\n        toPlanTypeUuid: String(values.targetPlanTypeId),\n        yolo: false,\n      }\n    case ClusterBulkOperationType.SLEEP_WAKEUP:\n      return { toSleep: values.action === 'wakeup' ? 'wakeup' : 'sleep' }\n    default:\n      return undefined\n  }\n}\n\n/** The outcome of one cluster, once its step finished. */\nexport type ClusterBulkFinalStatus =\n  | ClusterBulkOperationStatus.DONE\n  | ClusterBulkOperationStatus.ERRORED\n  | ClusterBulkOperationStatus.SKIPPED\n\n/**\n * What a request records for one cluster, in `executionResult`.\n *\n * `executionResult` of a bulk request is an object with ONE key for each\n * cluster that finished, keyed by the id of the cluster. A cluster with no\n * key has not run yet. That is what lets an interrupted run skip the\n * clusters that are finished, and what a reader shows as \"not reached\".\n */\nexport interface ClusterBulkClusterResultDto {\n  result: ClusterBulkFinalStatus\n  /** Why a cluster errored or was skipped, or a note on a done cluster. */\n  error?: string\n  /** An ISO timestamp: when the step answered. */\n  at: string\n}\n\n/** Reads the result of one cluster out of `executionResult`. */\nexport function clusterBulkResultOf(\n  executionResult: Record<string, unknown> | undefined,\n  clusterId: string,\n): ClusterBulkClusterResultDto | undefined {\n  const entry = executionResult?.[clusterId]\n  if (typeof entry !== 'object' || entry === null) {\n    return undefined\n  }\n  const result = (entry as { result?: unknown }).result\n  if (\n    result !== ClusterBulkOperationStatus.DONE &&\n    result !== ClusterBulkOperationStatus.ERRORED &&\n    result !== ClusterBulkOperationStatus.SKIPPED\n  ) {\n    return undefined\n  }\n  return entry as ClusterBulkClusterResultDto\n}\n\n/**\n * The body of the step route of console-backend.\n *\n * `api/admin/approvals/clusters/:clusterId/bulk-step`. One call does the work\n * of one operation type on one cluster.\n */\nexport interface ClusterBulkStepRequestDto {\n  type: ClusterBulkOperationType\n  parameter: ClusterBulkOperationParameter\n  /**\n   * When true, a sleeping cluster is NOT changed. The answer is `deferred`,\n   * with the datacenter of the cluster.\n   *\n   * This is how control-backend keeps the stagger of the old run: the first\n   * pass changes the awake clusters and learns which ones sleep, and a second\n   * pass changes the sleeping ones: one lane for each datacenter, the lanes\n   * side by side, and the clusters of one lane\n   * `CLUSTER_BULK_SLEEPING_CLUSTER_DELAY_MS` apart.\n   */\n  deferIfSleeping: boolean\n}\n\n/** The answer of the step route. */\nexport type ClusterBulkStepResultDto =\n  | {\n      outcome: 'finished'\n      result: ClusterBulkFinalStatus\n      error?: string\n    }\n  | {\n      outcome: 'deferred'\n      /** The k8s context of the cluster, or `unknown`. */\n      datacenter: string\n    }\n"],
-  "mappings": "AAoBA;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B;AAEnC,SAAS,+BAA+B;AAUjC,MAAM,sCAAsC;AAG5C,MAAM,yCAAyC;AAQ/C,MAAM,iDAAiD;AASvD,MAAM,yCAAyC;AAqB/C,MAAM,kCAAkC;AAQxC,MAAM,6CAA6C;AAUnD,MAAM,+BAGT;AAAA,EACF,CAAC,yBAAyB,iBAAiB,GAAG;AAAA,IAC5C,SAAS,wBAAwB;AAAA,IACjC,OAAO;AAAA,IACP,YAAY,mBAAmB;AAAA,EACjC;AAAA,EACA,CAAC,yBAAyB,WAAW,GAAG;AAAA,IACtC,SAAS,wBAAwB;AAAA,IACjC,OAAO;AAAA,IACP,YAAY,mBAAmB;AAAA,EACjC;AAAA,EACA,CAAC,yBAAyB,gBAAgB,GAAG;AAAA,IAC3C,SAAS,wBAAwB;AAAA,IACjC,OAAO;AAAA,IACP,YAAY,mBAAmB;AAAA,EACjC;AAAA,EACA,CAAC,yBAAyB,YAAY,GAAG;AAAA,IACvC,SAAS,wBAAwB;AAAA,IACjC,OAAO;AAAA,IACP,YAAY,mBAAmB;AAAA,EACjC;AAAA,EACA,CAAC,yBAAyB,QAAQ,GAAG;AAAA,IACnC,SAAS,wBAAwB;AAAA,IACjC,OAAO;AAAA,IACP,YAAY,mBAAmB;AAAA,EACjC;AAAA,EACA,CAAC,yBAAyB,WAAW,GAAG;AAAA,IACtC,SAAS,wBAAwB;AAAA,IACjC,OAAO;AAAA,IACP,YAAY,mBAAmB;AAAA,EACjC;AACF;AAGO,MAAM,+BAA2D;AAAA,EACtE,yBAAyB;AAAA,EACzB,yBAAyB;AAAA,EACzB,yBAAyB;AAAA,EACzB,yBAAyB;AAAA,EACzB,yBAAyB;AAAA,EACzB,yBAAyB;AAC3B;AAGO,SAAS,2BACd,SACsC;AACtC,SAAO,6BAA6B;AAAA,IAClC,CAAC,SAAS,6BAA6B,IAAI,EAAE,YAAY;AAAA,EAC3D;AACF;AAkEO,SAAS,kBACd,MACA,UACS;AACT,MACE,SAAS,yBAAyB,qBAClC,OAAO,aAAa,YACpB,aAAa,MACb;AACA,WAAO;AAAA,EACT;AACA,QAAM,QAAQ;AACd,SAAO,MAAM,oBAAoB,QAAQ,MAAM,oBAAoB;AACrE;AAUO,SAAS,+BACd,MACA,UACU;AACV,QAAM,cAAc;AAAA,IAClB,6BAA6B,IAAI,EAAE;AAAA,IACnC,mBAAmB;AAAA,EACrB;AACA,MAAI,kBAAkB,MAAM,QAAQ,GAAG;AACrC,gBAAY,KAAK,mBAAmB,mCAAmC;AAAA,EACzE;AACA,SAAO;AACT;AAUO,SAAS,uBACd,MACA,UAC+B;AAC/B,QAAM,SAAU,YAAY,CAAC;AAC7B,UAAQ,MAAM;AAAA,IACZ,KAAK,yBAAyB;AAC5B,aAAO;AAAA,QACL,kBAAkB,OAAO,OAAO,kBAAkB;AAAA,QAClD,iBAAiB,OAAO,oBAAoB;AAAA,QAC5C,iBAAiB,OAAO,oBAAoB;AAAA;AAAA,QAE5C,GAAI,OAAO,oBAAoB,QAAQ,EAAE,iBAAiB,KAAK;AAAA,MACjE;AAAA,IACF,KAAK,yBAAyB;AAC5B,aAAO;AAAA,QACL,YAAY,OAAO,OAAO,YAAY;AAAA,QACtC,MAAM;AAAA,QACN,kBAAkB,OAAO,qBAAqB;AAAA,MAChD;AAAA,IACF,KAAK,yBAAyB;AAC5B,aAAO;AAAA,QACL,gBAAgB,OAAO,OAAO,gBAAgB;AAAA,QAC9C,MAAM;AAAA,MACR;AAAA,IACF,KAAK,yBAAyB;AAC5B,aAAO,EAAE,SAAS,OAAO,WAAW,WAAW,WAAW,QAAQ;AAAA,IACpE;AACE,aAAO;AAAA,EACX;AACF;AAyBO,SAAS,oBACd,iBACA,WACyC;AACzC,QAAM,QAAQ,kBAAkB,SAAS;AACzC,MAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,WAAO;AAAA,EACT;AACA,QAAM,SAAU,MAA+B;AAC/C,MACE,WAAW,2BAA2B,QACtC,WAAW,2BAA2B,WACtC,WAAW,2BAA2B,SACtC;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/**\n * The cluster bulk operation on the approval mechanism of control-backend.\n *\n * control-backend and control-frontend both read this file. The backend\n * builds its six use cases from `CLUSTER_BULK_OPERATION_RULES`, and the form\n * of the frontend reads the same table to run `canCreate` before the request\n * goes out. A permission that only one side knew would be a button that the\n * server then refuses.\n *\n * console-backend reads the step types at the end. control-backend calls one\n * step for each cluster, and console-backend does the work of that step with\n * the same code that its own bulk operation runs.\n */\n\nimport {\n  ClusterBulkOperationStatus,\n  ClusterBulkOperationType,\n} from '../enums/ClusterBulkOperation.enum.js'\nimport { ConsolePermissions } from '../permissions/console.permissions.js'\nimport type { ClusterBulkOperationParameter } from '../types/ClusterBulkOperation.type.js'\nimport {\n  APPROVAL_USE_CASE_TYPES,\n  type ApprovalUseCaseType,\n} from './use-cases.const.js'\n\n/**\n * The most clusters that one request holds.\n *\n * The payload is a json column, and the create route reads it in one body of\n * at most 1 MiB. 3000 clusters with the longest names stay far below that.\n * A larger set is two requests, which is also two decisions for the people\n * who approve.\n */\nexport const CLUSTER_BULK_OPERATION_MAX_CLUSTERS = 3000\n\n/** The longest name of an operation. The name is what the queue shows. */\nexport const CLUSTER_BULK_OPERATION_NAME_MAX_LENGTH = 200\n\n/**\n * The longest cluster name that the payload keeps.\n *\n * The name is a copy for a reader. The id alone decides what the step\n * changes.\n */\nexport const CLUSTER_BULK_OPERATION_CLUSTER_NAME_MAX_LENGTH = 100\n\n/**\n * The wait between two sleeping clusters of one datacenter.\n *\n * The same number as the bulk operation of console-backend. A wake-up loads\n * the datacenter, and many wake-ups together overload it. Datacenters do not\n * wait for each other.\n */\nexport const CLUSTER_BULK_SLEEPING_CLUSTER_DELAY_MS = 60_000\n\n/** What one operation type needs, and which use case carries it. */\nexport interface ClusterBulkOperationRule {\n  useCase: ApprovalUseCaseType\n  label: string\n  /** The permission that opens, approves and runs a request of this type. */\n  permission: string\n}\n\n/**\n * The rules of each operation type.\n *\n * The permissions are the ones that the bulk operation of console-backend\n * checks today (`getBulkOpRequiredPermission`), so a Camundi who can run one\n * flow can run the other. `CLUSTERS_READALLCLUSTERINFO` is part of every\n * type there, and `clusterBulkRequiredPermissions` adds it here.\n */\nexport const CLUSTER_BULK_OPERATION_RULES: Record<\n  ClusterBulkOperationType,\n  ClusterBulkOperationRule\n> = {\n  [ClusterBulkOperationType.GENERATION_UPDATE]: {\n    useCase: APPROVAL_USE_CASE_TYPES.clusterBulkGenerationUpdate,\n    label: 'Generation update',\n    permission: ConsolePermissions.CLUSTERS_CAN_UPDATE_GENERATION,\n  },\n  [ClusterBulkOperationType.PLAN_UPDATE]: {\n    useCase: APPROVAL_USE_CASE_TYPES.clusterBulkPlanUpdate,\n    label: 'Plan update',\n    permission: ConsolePermissions.CLUSTERS_CAN_UPDATE_CLUSTERPLANTYPE,\n  },\n  [ClusterBulkOperationType.PLAN_TYPE_UPDATE]: {\n    useCase: APPROVAL_USE_CASE_TYPES.clusterBulkPlanTypeUpdate,\n    label: 'Plan type update',\n    permission: ConsolePermissions.CLUSTERS_CAN_UPDATE_CLUSTERPLANTYPE,\n  },\n  [ClusterBulkOperationType.SLEEP_WAKEUP]: {\n    useCase: APPROVAL_USE_CASE_TYPES.clusterBulkSleepWakeup,\n    label: 'Sleep / wake up',\n    permission: ConsolePermissions.CLUSTERS_CAN_SEND_TO_SLEEP,\n  },\n  [ClusterBulkOperationType.DELETION]: {\n    useCase: APPROVAL_USE_CASE_TYPES.clusterBulkDeletion,\n    label: 'Deletion',\n    permission: ConsolePermissions.CLUSTERS_DELETE_CLUSTER,\n  },\n  [ClusterBulkOperationType.SPEC_UPDATE]: {\n    useCase: APPROVAL_USE_CASE_TYPES.clusterBulkSpecUpdate,\n    label: 'Spec update',\n    permission: ConsolePermissions.CLUSTERS_CAN_UPDATE_CLUSTERPLANTYPE,\n  },\n}\n\n/** The operation types in the order that a form offers them. */\nexport const CLUSTER_BULK_OPERATION_TYPES: ClusterBulkOperationType[] = [\n  ClusterBulkOperationType.GENERATION_UPDATE,\n  ClusterBulkOperationType.PLAN_UPDATE,\n  ClusterBulkOperationType.PLAN_TYPE_UPDATE,\n  ClusterBulkOperationType.SLEEP_WAKEUP,\n  ClusterBulkOperationType.SPEC_UPDATE,\n  ClusterBulkOperationType.DELETION,\n]\n\n/** The operation type of a use case, or `undefined` for any other use case. */\nexport function clusterBulkOperationTypeOf(\n  useCase: string,\n): ClusterBulkOperationType | undefined {\n  return CLUSTER_BULK_OPERATION_TYPES.find(\n    (type) => CLUSTER_BULK_OPERATION_RULES[type].useCase === useCase,\n  )\n}\n\n/** One cluster of a request. */\nexport interface ClusterBulkTargetDto {\n  id: string\n  /** A copy for a reader. The step reads the id alone. */\n  name?: string\n  orgId?: string\n}\n\nexport interface ClusterBulkGenerationUpdateSettings {\n  targetGenerationId: string\n  /** A copy for a reader. */\n  targetGenerationName?: string\n  /** See `ClusterBulkOperationGenerationUpdateParameter.yoloAllClusters`. */\n  yoloAllClusters?: boolean\n  /** See `ClusterBulkOperationGenerationUpdateParameter.yoloForceUpdate`. */\n  yoloForceUpdate?: boolean\n  /**\n   * Changes only a cluster with auto-update on. console-backend reads the\n   * cluster when its step runs, because the customer can turn auto-update off\n   * while the request waits.\n   */\n  onlyAutoUpgrade?: boolean\n}\n\nexport interface ClusterBulkPlanUpdateSettings {\n  targetPlanId: string\n  targetPlanName?: string\n  /** Keeps the active modification of a cluster through the change. */\n  keepModification?: boolean\n}\n\n/**\n * No `keepModification`: the parameter of a plan type update in the old flow\n * has none, and its dialog never sends it.\n *\n * No packages either: each cluster keeps its packages, and console checks\n * them against the free reservations of the organization.\n */\nexport interface ClusterBulkPlanTypeUpdateSettings {\n  targetPlanTypeId: string\n  targetPlanTypeName?: string\n}\n\nexport interface ClusterBulkSleepWakeupSettings {\n  action: 'sleep' | 'wakeup'\n}\n\n/** The settings of each type. Deletion and spec update have none. */\nexport interface ClusterBulkSettingsByType {\n  [ClusterBulkOperationType.GENERATION_UPDATE]: ClusterBulkGenerationUpdateSettings\n  [ClusterBulkOperationType.PLAN_UPDATE]: ClusterBulkPlanUpdateSettings\n  [ClusterBulkOperationType.PLAN_TYPE_UPDATE]: ClusterBulkPlanTypeUpdateSettings\n  [ClusterBulkOperationType.SLEEP_WAKEUP]: ClusterBulkSleepWakeupSettings\n  [ClusterBulkOperationType.DELETION]: Record<string, never>\n  [ClusterBulkOperationType.SPEC_UPDATE]: Record<string, never>\n}\n\n/** The payload of a request, for one operation type. */\nexport interface ClusterBulkOperationPayloadDto<\n  T extends ClusterBulkOperationType = ClusterBulkOperationType,\n> {\n  name: string\n  clusters: ClusterBulkTargetDto[]\n  settings: ClusterBulkSettingsByType[T]\n}\n\n/** True when the settings of a generation update go past a safety check. */\nexport function isClusterBulkYolo(\n  type: ClusterBulkOperationType,\n  settings: unknown,\n): boolean {\n  if (\n    type !== ClusterBulkOperationType.GENERATION_UPDATE ||\n    typeof settings !== 'object' ||\n    settings === null\n  ) {\n    return false\n  }\n  const typed = settings as ClusterBulkGenerationUpdateSettings\n  return typed.yoloAllClusters === true || typed.yoloForceUpdate === true\n}\n\n/**\n * Every permission that a request of this type and these settings needs.\n *\n * control-backend stores the answer on the request as\n * `requiredPermissions`, and the form passes the same answer to `canCreate`.\n * A yolo flag adds `CLUSTERS_CAN_UPDATE_GENERATION_YOLO`, which is the rule\n * of `needsGenerationYolo` in console-backend.\n */\nexport function clusterBulkRequiredPermissions(\n  type: ClusterBulkOperationType,\n  settings: unknown,\n): string[] {\n  const permissions = [\n    CLUSTER_BULK_OPERATION_RULES[type].permission,\n    ConsolePermissions.CLUSTERS_READALLCLUSTERINFO,\n  ]\n  if (isClusterBulkYolo(type, settings)) {\n    permissions.push(ConsolePermissions.CLUSTERS_CAN_UPDATE_GENERATION_YOLO)\n  }\n  return permissions\n}\n\n/**\n * Turns the settings of a request into the parameter of console-backend.\n *\n * The step route of console-backend reads the parameter shape of its own\n * bulk operation, so one function in console-backend serves both flows.\n * `nop` of the sleep action is not reachable from here on purpose: a request\n * that changes nothing is not a request that people approve.\n */\nexport function clusterBulkParameterOf(\n  type: ClusterBulkOperationType,\n  settings: unknown,\n): ClusterBulkOperationParameter {\n  const values = (settings ?? {}) as Record<string, unknown>\n  switch (type) {\n    case ClusterBulkOperationType.GENERATION_UPDATE:\n      return {\n        toGenerationUuid: String(values.targetGenerationId),\n        yoloAllClusters: values.yoloAllClusters === true,\n        yoloForceUpdate: values.yoloForceUpdate === true,\n        // Only when set, so the parameter of a plain update stays as it was.\n        ...(values.onlyAutoUpgrade === true && { onlyAutoUpgrade: true }),\n      }\n    case ClusterBulkOperationType.PLAN_UPDATE:\n      return {\n        toPlanUuid: String(values.targetPlanId),\n        yolo: false,\n        keepModification: values.keepModification === true,\n      }\n    case ClusterBulkOperationType.PLAN_TYPE_UPDATE:\n      return {\n        toPlanTypeUuid: String(values.targetPlanTypeId),\n        yolo: false,\n      }\n    case ClusterBulkOperationType.SLEEP_WAKEUP:\n      return { toSleep: values.action === 'wakeup' ? 'wakeup' : 'sleep' }\n    default:\n      return undefined\n  }\n}\n\n/** The outcome of one cluster, once its step finished. */\nexport type ClusterBulkFinalStatus =\n  | ClusterBulkOperationStatus.DONE\n  | ClusterBulkOperationStatus.ERRORED\n  | ClusterBulkOperationStatus.SKIPPED\n\n/**\n * What a request records for one cluster, in `executionResult`.\n *\n * `executionResult` of a bulk request is an object with ONE key for each\n * cluster that finished, keyed by the id of the cluster. A cluster with no\n * key has not run yet. That is what lets an interrupted run skip the\n * clusters that are finished, and what a reader shows as \"not reached\".\n */\nexport interface ClusterBulkClusterResultDto {\n  result: ClusterBulkFinalStatus\n  /** Why a cluster errored or was skipped, or a note on a done cluster. */\n  error?: string\n  /** An ISO timestamp: when the step answered. */\n  at: string\n}\n\n/** Reads the result of one cluster out of `executionResult`. */\nexport function clusterBulkResultOf(\n  executionResult: Record<string, unknown> | undefined,\n  clusterId: string,\n): ClusterBulkClusterResultDto | undefined {\n  const entry = executionResult?.[clusterId]\n  if (typeof entry !== 'object' || entry === null) {\n    return undefined\n  }\n  const result = (entry as { result?: unknown }).result\n  if (\n    result !== ClusterBulkOperationStatus.DONE &&\n    result !== ClusterBulkOperationStatus.ERRORED &&\n    result !== ClusterBulkOperationStatus.SKIPPED\n  ) {\n    return undefined\n  }\n  return entry as ClusterBulkClusterResultDto\n}\n\n/**\n * The body of the step route of console-backend.\n *\n * `api/admin/approvals/clusters/:clusterId/bulk-step`. One call does the work\n * of one operation type on one cluster.\n */\nexport interface ClusterBulkStepRequestDto {\n  type: ClusterBulkOperationType\n  parameter: ClusterBulkOperationParameter\n  /**\n   * When true, a sleeping cluster is NOT changed. The answer is `deferred`,\n   * with the datacenter of the cluster.\n   *\n   * This is how control-backend keeps the stagger of the old run: the first\n   * pass changes the awake clusters and learns which ones sleep, and a second\n   * pass changes the sleeping ones: one lane for each datacenter, the lanes\n   * side by side, and the clusters of one lane\n   * `CLUSTER_BULK_SLEEPING_CLUSTER_DELAY_MS` apart.\n   */\n  deferIfSleeping: boolean\n}\n\n/** The answer of the step route. */\nexport type ClusterBulkStepResultDto =\n  | {\n      outcome: 'finished'\n      result: ClusterBulkFinalStatus\n      error?: string\n    }\n  | {\n      outcome: 'deferred'\n      /** The k8s context of the cluster, or `unknown`. */\n      datacenter: string\n    }\n"],
+  "mappings": "AAoBA;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B;AAEnC;AAAA,EACE;AAAA,OAEK;AAUA,MAAM,sCAAsC;AAG5C,MAAM,yCAAyC;AAQ/C,MAAM,iDAAiD;AASvD,MAAM,yCAAyC;AAkB/C,MAAM,+BAGT;AAAA,EACF,CAAC,yBAAyB,iBAAiB,GAAG;AAAA,IAC5C,SAAS,wBAAwB;AAAA,IACjC,OAAO;AAAA,IACP,YAAY,mBAAmB;AAAA,EACjC;AAAA,EACA,CAAC,yBAAyB,WAAW,GAAG;AAAA,IACtC,SAAS,wBAAwB;AAAA,IACjC,OAAO;AAAA,IACP,YAAY,mBAAmB;AAAA,EACjC;AAAA,EACA,CAAC,yBAAyB,gBAAgB,GAAG;AAAA,IAC3C,SAAS,wBAAwB;AAAA,IACjC,OAAO;AAAA,IACP,YAAY,mBAAmB;AAAA,EACjC;AAAA,EACA,CAAC,yBAAyB,YAAY,GAAG;AAAA,IACvC,SAAS,wBAAwB;AAAA,IACjC,OAAO;AAAA,IACP,YAAY,mBAAmB;AAAA,EACjC;AAAA,EACA,CAAC,yBAAyB,QAAQ,GAAG;AAAA,IACnC,SAAS,wBAAwB;AAAA,IACjC,OAAO;AAAA,IACP,YAAY,mBAAmB;AAAA,EACjC;AAAA,EACA,CAAC,yBAAyB,WAAW,GAAG;AAAA,IACtC,SAAS,wBAAwB;AAAA,IACjC,OAAO;AAAA,IACP,YAAY,mBAAmB;AAAA,EACjC;AACF;AAGO,MAAM,+BAA2D;AAAA,EACtE,yBAAyB;AAAA,EACzB,yBAAyB;AAAA,EACzB,yBAAyB;AAAA,EACzB,yBAAyB;AAAA,EACzB,yBAAyB;AAAA,EACzB,yBAAyB;AAC3B;AAGO,SAAS,2BACd,SACsC;AACtC,SAAO,6BAA6B;AAAA,IAClC,CAAC,SAAS,6BAA6B,IAAI,EAAE,YAAY;AAAA,EAC3D;AACF;AAqEO,SAAS,kBACd,MACA,UACS;AACT,MACE,SAAS,yBAAyB,qBAClC,OAAO,aAAa,YACpB,aAAa,MACb;AACA,WAAO;AAAA,EACT;AACA,QAAM,QAAQ;AACd,SAAO,MAAM,oBAAoB,QAAQ,MAAM,oBAAoB;AACrE;AAUO,SAAS,+BACd,MACA,UACU;AACV,QAAM,cAAc;AAAA,IAClB,6BAA6B,IAAI,EAAE;AAAA,IACnC,mBAAmB;AAAA,EACrB;AACA,MAAI,kBAAkB,MAAM,QAAQ,GAAG;AACrC,gBAAY,KAAK,mBAAmB,mCAAmC;AAAA,EACzE;AACA,SAAO;AACT;AAUO,SAAS,uBACd,MACA,UAC+B;AAC/B,QAAM,SAAU,YAAY,CAAC;AAC7B,UAAQ,MAAM;AAAA,IACZ,KAAK,yBAAyB;AAC5B,aAAO;AAAA,QACL,kBAAkB,OAAO,OAAO,kBAAkB;AAAA,QAClD,iBAAiB,OAAO,oBAAoB;AAAA,QAC5C,iBAAiB,OAAO,oBAAoB;AAAA;AAAA,QAE5C,GAAI,OAAO,oBAAoB,QAAQ,EAAE,iBAAiB,KAAK;AAAA,MACjE;AAAA,IACF,KAAK,yBAAyB;AAC5B,aAAO;AAAA,QACL,YAAY,OAAO,OAAO,YAAY;AAAA,QACtC,MAAM;AAAA,QACN,kBAAkB,OAAO,qBAAqB;AAAA,MAChD;AAAA,IACF,KAAK,yBAAyB;AAC5B,aAAO;AAAA,QACL,gBAAgB,OAAO,OAAO,gBAAgB;AAAA,QAC9C,MAAM;AAAA,MACR;AAAA,IACF,KAAK,yBAAyB;AAC5B,aAAO,EAAE,SAAS,OAAO,WAAW,WAAW,WAAW,QAAQ;AAAA,IACpE;AACE,aAAO;AAAA,EACX;AACF;AAyBO,SAAS,oBACd,iBACA,WACyC;AACzC,QAAM,QAAQ,kBAAkB,SAAS;AACzC,MAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,WAAO;AAAA,EACT;AACA,QAAM,SAAU,MAA+B;AAC/C,MACE,WAAW,2BAA2B,QACtC,WAAW,2BAA2B,WACtC,WAAW,2BAA2B,SACtC;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;",
   "names": []
 }

package/dist/approvals/delete-cluster-corpses.d.ts

@@ -1,10 +1,3 @@
-/**
- * The flag of the `delete-cluster-corpses` use case.
- *
- * control-backend opens a request only while it is on. Control shows the
- * request in place of the direct "Delete all corpses" while it is on.
- */
-export declare const DELETE_CLUSTER_CORPSES_FLAG = "control.deleteClusterCorpses";
 /**
  * The two kinds of cluster corpse.
  *
@@ -32,14 +25,6 @@ export declare const DELETE_CLUSTER_CORPSES_MAX = 500;
  * a short time.
  */
 export declare const CLUSTER_CORPSE_MIN_AGE_MS: number;
-/**
- * The approvals of a corpse deletion on prod: two people other than the
- * person who asks, the same as a cluster bulk deletion
- * (`CLUSTER_BULK_OPERATION_MIN_ACKS`).
- */
-export declare const DELETE_CLUSTER_CORPSES_MIN_ACKS_PROD = 2;
-/** The approvals of a corpse deletion on dev, int and local. */
-export declare const DELETE_CLUSTER_CORPSES_MIN_ACKS_TEST_STAGE = 1;
 /** One corpse, as console answers it to control-backend. */
 export interface ClusterCorpseDto {
     /** The uuid of the cluster row, or the name of the Kubernetes resource. */