@camunda/ccma-shared-types 10.8.0 → 10.10.0

package/dist/constants/misc.const.d.ts

@@ -31,34 +31,33 @@ export declare const MAX_LENGTH_CLUSTER_NAME = 50;
 export declare const NAMES_OF_ENTERPRISE_SALESPLANS_WITH_SLEEPING_CLUSTERS: string[];
 /**
  * Each count is the number of people, other than the creator, who must
- * acknowledge. The creator cannot acknowledge their own operation or
- * modification. Thus a count of 1 needs two people: the creator and one other
- * person.
+ * acknowledge. The creator cannot acknowledge their own modification. Thus a
+ * count of 1 needs two people: the creator and one other person.
+ *
+ * Only the cluster modifications read these counts. A cluster bulk operation
+ * counts the creator too. Its counts come from `APPROVAL_RULES`: see
+ * `minimumBulkOperationEyes`.
  */
 export declare const MINIMUM_EYEPAIRS: {
-    CLUSTER_DELETION: number;
-    CLUSTER_GENERATION_UPDATE: number;
-    CLUSTER_PLAN_UPDATE: number;
-    CLUSTER_PLAN_TYPE_UPDATE: number;
-    CLUSTER_SLEEP_WAKEUP: number;
-    CLUSTER_SPEC_UPDATE: number;
     CLUSTER_PLAN_MODIFICATION: number;
     CLUSTER_MODIFICATION: number;
 };
 /**
  * The lowest `eyes` of a cluster bulk operation of console-backend on prod,
- * for each type. Int has a lower floor, thus do not read the map directly.
- * For the lowest `eyes` on a stage, use `minimumBulkOperationEyes`. For the
- * count that an operation needs, use `requiredBulkOperationAcks`.
+ * for each type. It is the number of people who must approve, the creator
+ * included. Int has a lower floor for some types, thus do not read the map
+ * directly. For the lowest `eyes` on a stage, use `minimumBulkOperationEyes`.
+ * For the count that an operation needs, use `requiredBulkOperationAcks`.
  */
 export declare const MINIMUM_EYEPAIRS_BY_BULK_OPERATION_TYPE: Record<ClusterBulkOperationType, number>;
 /**
- * countBulkOperationAcks is the number of different users, other than its
- * creator, who acknowledged a cluster bulk operation of console-backend.
+ * countBulkOperationAcks is the number of different people who approved a
+ * cluster bulk operation of console-backend. The creator is one of them.
  *
- * The creator cannot approve their own request, as in the approvals of
- * control-backend. An ack of the creator that a row already holds does not
- * count.
+ * The creator always counts: a request needs `clusters.canReadAllClusterInfo`
+ * to be created, acknowledged and executed, thus the creator holds every
+ * permission that an approval needs. The creator cannot acknowledge by hand,
+ * but an ack of the creator that a row already holds does not count twice.
  */
 export declare function countBulkOperationAcks(operation: {
     createdBy?: string;
@@ -66,29 +65,25 @@ export declare function countBulkOperationAcks(operation: {
         userId: string;
     }>;
 }): number;
-/**
- * The lowest `eyes` of a cluster bulk operation of console-backend on int, for
- * every type. It is a floor: an operation that asks for more keeps its count.
- *
- * Int often has only one other Camundi who can approve. One approval there
- * still tests the whole flow. Prod keeps the minimum of the type. The approval
- * flow of control-backend uses this number on int too.
- */
-export declare const INT_MINIMUM_BULK_OPERATION_ACKS = 1;
 /**
  * minimumBulkOperationEyes is the lowest `eyes` that a cluster bulk operation
- * of `type` can have on `stage`. On int it is
- * `INT_MINIMUM_BULK_OPERATION_ACKS`. On every other stage, and on an unknown
- * `stage`, it is the minimum of the type. Dev and local count no
- * acknowledgement, but this function still gives the minimum of the type
- * there.
+ * of `type` can have on `stage`. It counts people, the creator included. It
+ * is the count of `APPROVAL_RULES` for the use case of the type. On int, that
+ * is the count of the test stages. On every other stage, and on an unknown
+ * `stage`, it is the count of prod. Dev and local count no acknowledgement,
+ * but this function still gives the count of prod there.
  */
 export declare function minimumBulkOperationEyes(type: ClusterBulkOperationType, stage: string | undefined): number;
 /**
- * minimumBulkOperationAcks is how many different users must acknowledge a
- * cluster bulk operation of console-backend on a stage that counts the
- * acknowledgements. It is the `eyes` of the operation, and never less than
- * `minimumBulkOperationEyes` of `stage`. The creator is not one of the users.
+ * minimumBulkOperationAcks is how many different people, the creator
+ * included, must approve a cluster bulk operation of console-backend on a
+ * stage that counts the approvals. It is the `eyes` of the operation, and
+ * never less than `minimumBulkOperationEyes` of `stage`.
+ *
+ * The floor matters for a row that was open at the deploy of the count that
+ * includes the creator. That row holds `eyes` of the old unit, which did not
+ * count the creator. On prod, an old `eyes` of 1 is now the creator alone.
+ * The floor makes such a row need one more person.
  *
  * `stage` is optional, because the first version of this function had no
  * `stage`. Without it, the function gives the count of prod.
@@ -98,19 +93,20 @@ export declare function minimumBulkOperationAcks(operation: {
     eyes: number;
 }, stage?: string): number;
 /**
- * requiredBulkOperationAcks is how many different users must acknowledge a
- * cluster bulk operation of console-backend before it can run on `stage`.
- * The dev and local stages need none. Every other stage, and an unknown
- * `stage`, needs `minimumBulkOperationAcks` of that stage.
+ * requiredBulkOperationAcks is how many different people, the creator
+ * included, must approve a cluster bulk operation of console-backend before
+ * it can run on `stage`. The dev and local stages need none. Every other
+ * stage, and an unknown `stage`, needs `minimumBulkOperationAcks` of that
+ * stage.
  */
 export declare function requiredBulkOperationAcks(operation: {
     type: ClusterBulkOperationType;
     eyes: number;
 }, stage: string | undefined): number;
 /**
- * missingBulkOperationAcks is how many more users, other than its creator,
- * must acknowledge a cluster bulk operation of console-backend before it can
- * run on `stage`. 0 means that it can run.
+ * missingBulkOperationAcks is how many more people must approve a cluster
+ * bulk operation of console-backend before it can run on `stage`. The
+ * creator already counts. 0 means that it can run.
  */
 export declare function missingBulkOperationAcks(operation: {
     type: ClusterBulkOperationType;

package/dist/constants/misc.const.js

@@ -1,4 +1,5 @@
-import { CLUSTER_BULK_OPERATION_TEST_STAGE_MIN_ACKS } from "../approvals/cluster-bulk-operation.js";
+import { approvalsRequiredFor } from "../approvals/approval-rules.js";
+import { CLUSTER_BULK_OPERATION_RULES } from "../approvals/cluster-bulk-operation.js";
 import { ClusterBulkOperationType } from "../enums/ClusterBulkOperation.enum.js";
 const CONSOLE_API_USER_ID = "console-api";
 const CAMUNDA_CLAIMS_NAMESPACE = "https://camunda.com/meta";
@@ -14,39 +15,38 @@ const NAMES_OF_ENTERPRISE_SALESPLANS_WITH_SLEEPING_CLUSTERS = [
   "Camunda Partner"
 ];
 const MINIMUM_EYEPAIRS = {
-  CLUSTER_DELETION: 2,
-  CLUSTER_GENERATION_UPDATE: 1,
-  CLUSTER_PLAN_UPDATE: 1,
-  CLUSTER_PLAN_TYPE_UPDATE: 1,
-  // These two had no name, and each reader fell back to
-  // `CLUSTER_PLAN_UPDATE`. The values are the same as that fallback.
-  CLUSTER_SLEEP_WAKEUP: 1,
-  CLUSTER_SPEC_UPDATE: 1,
   CLUSTER_PLAN_MODIFICATION: 1,
   CLUSTER_MODIFICATION: 1
 };
-const MINIMUM_EYEPAIRS_BY_BULK_OPERATION_TYPE = {
-  [ClusterBulkOperationType.DELETION]: MINIMUM_EYEPAIRS.CLUSTER_DELETION,
-  [ClusterBulkOperationType.GENERATION_UPDATE]: MINIMUM_EYEPAIRS.CLUSTER_GENERATION_UPDATE,
-  [ClusterBulkOperationType.PLAN_UPDATE]: MINIMUM_EYEPAIRS.CLUSTER_PLAN_UPDATE,
-  [ClusterBulkOperationType.PLAN_TYPE_UPDATE]: MINIMUM_EYEPAIRS.CLUSTER_PLAN_TYPE_UPDATE,
-  [ClusterBulkOperationType.SLEEP_WAKEUP]: MINIMUM_EYEPAIRS.CLUSTER_SLEEP_WAKEUP,
-  [ClusterBulkOperationType.SPEC_UPDATE]: MINIMUM_EYEPAIRS.CLUSTER_SPEC_UPDATE
-};
-const HIGHEST_BULK_OPERATION_MINIMUM = Math.max(
-  ...Object.values(MINIMUM_EYEPAIRS_BY_BULK_OPERATION_TYPE)
+const BULK_OPERATION_TYPES = Object.values(ClusterBulkOperationType);
+function bulkOperationMinimumOf(type, stage) {
+  return approvalsRequiredFor(CLUSTER_BULK_OPERATION_RULES[type].useCase, stage);
+}
+function highestBulkOperationMinimum(stage) {
+  return Math.max(
+    ...BULK_OPERATION_TYPES.map((type) => bulkOperationMinimumOf(type, stage))
+  );
+}
+const MINIMUM_EYEPAIRS_BY_BULK_OPERATION_TYPE = Object.fromEntries(
+  BULK_OPERATION_TYPES.map((type) => [
+    type,
+    bulkOperationMinimumOf(type, "prod")
+  ])
 );
+const HIGHEST_BULK_OPERATION_MINIMUM = {
+  int: highestBulkOperationMinimum("int"),
+  prod: highestBulkOperationMinimum("prod")
+};
 function countBulkOperationAcks(operation) {
-  return new Set(
-    operation.acks.map((ack) => ack.userId).filter((userId) => userId !== operation.createdBy)
-  ).size;
+  const people = new Set(operation.acks.map((ack) => ack.userId));
+  if (operation.createdBy !== void 0) {
+    people.add(operation.createdBy);
+  }
+  return people.size;
 }
-const INT_MINIMUM_BULK_OPERATION_ACKS = CLUSTER_BULK_OPERATION_TEST_STAGE_MIN_ACKS;
 function minimumBulkOperationEyes(type, stage) {
-  if (stage === "int") {
-    return INT_MINIMUM_BULK_OPERATION_ACKS;
-  }
-  return Object.hasOwn(MINIMUM_EYEPAIRS_BY_BULK_OPERATION_TYPE, type) ? MINIMUM_EYEPAIRS_BY_BULK_OPERATION_TYPE[type] : HIGHEST_BULK_OPERATION_MINIMUM;
+  const countStage = stage === "int" ? "int" : "prod";
+  return Object.hasOwn(CLUSTER_BULK_OPERATION_RULES, type) ? bulkOperationMinimumOf(type, countStage) : HIGHEST_BULK_OPERATION_MINIMUM[countStage];
 }
 function minimumBulkOperationAcks(operation, stage) {
   return Math.max(
@@ -72,7 +72,6 @@ export {
   CONSOLE_API_USER_ID,
   FIRSTNAME_LASTNAME_MAX_LENGTH,
   HOTBACKUP_MIN_CREATE_PERIOD,
-  INT_MINIMUM_BULK_OPERATION_ACKS,
   MAX_HARDWARE_PACKAGE_COUNT,
   MAX_LENGTH_CLUSTER_NAME,
   MINIMUM_EYEPAIRS,

package/dist/constants/misc.const.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/constants/misc.const.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { CLUSTER_BULK_OPERATION_TEST_STAGE_MIN_ACKS } from '../approvals/cluster-bulk-operation.js'\nimport { ClusterBulkOperationType } from '../enums/ClusterBulkOperation.enum.js'\n\nexport const CONSOLE_API_USER_ID = 'console-api'\n\n/**\n * The namespace of the custom claims that Auth0 adds to a token of this fleet.\n *\n * An Auth0 API access token carries no `email` claim of its own. The rules of\n * the tenant put the email of the person under this namespace instead, and\n * every reader of the fleet must look there. A service that reads a top-level\n * `email` claim gets nothing, and the failure is silent: the identity is still\n * valid, so the request continues with an empty email.\n */\nexport const CAMUNDA_CLAIMS_NAMESPACE = 'https://camunda.com/meta'\n\n/**\n * The email of an actor whose token carries no email.\n *\n * It is a value and not an empty string, because an empty string reads like a\n * field that nobody wrote. A record that says `unknown` says that the token had\n * no email, which is a different fact.\n *\n * A rule that compares two people MUST NOT treat two of these as one person.\n * `isSameActorEmail` in `approvals/policy.ts` holds that.\n */\nexport const UNKNOWN_ACTOR_EMAIL = 'unknown'\nexport const TEMPORARY_CLUSTER_NAME = 'Get Started'\nexport type Stage = 'local' | 'dev' | 'int' | 'prod'\nexport const HOTBACKUP_MIN_CREATE_PERIOD = 1000 * 60 * 60 * 0.25 // 15 minutes\n\nexport const SECRETS_MAX_LENGTH = 4096\nexport const FIRSTNAME_LASTNAME_MAX_LENGTH = 255\n\nexport const STARTING_PRICE_PER_MONTH_IN_EURO = 99\n\nexport const MAX_LENGTH_CLUSTER_NAME = 50\n\nexport const NAMES_OF_ENTERPRISE_SALESPLANS_WITH_SLEEPING_CLUSTERS = [\n  'CELP with sleeping clusters',\n  'Camunda Partner',\n]\n\n/**\n * Each count is the number of people, other than the creator, who must\n * acknowledge. The creator cannot acknowledge their own operation or\n * modification. Thus a count of 1 needs two people: the creator and one other\n * person.\n */\nexport const MINIMUM_EYEPAIRS = {\n  CLUSTER_DELETION: 2,\n  CLUSTER_GENERATION_UPDATE: 1,\n  CLUSTER_PLAN_UPDATE: 1,\n  CLUSTER_PLAN_TYPE_UPDATE: 1,\n  // These two had no name, and each reader fell back to\n  // `CLUSTER_PLAN_UPDATE`. The values are the same as that fallback.\n  CLUSTER_SLEEP_WAKEUP: 1,\n  CLUSTER_SPEC_UPDATE: 1,\n  CLUSTER_PLAN_MODIFICATION: 1,\n  CLUSTER_MODIFICATION: 1,\n}\n\n/**\n * The lowest `eyes` of a cluster bulk operation of console-backend on prod,\n * for each type. Int has a lower floor, thus do not read the map directly.\n * For the lowest `eyes` on a stage, use `minimumBulkOperationEyes`. For the\n * count that an operation needs, use `requiredBulkOperationAcks`.\n */\nexport const MINIMUM_EYEPAIRS_BY_BULK_OPERATION_TYPE: Record<\n  ClusterBulkOperationType,\n  number\n> = {\n  [ClusterBulkOperationType.DELETION]: MINIMUM_EYEPAIRS.CLUSTER_DELETION,\n  [ClusterBulkOperationType.GENERATION_UPDATE]:\n    MINIMUM_EYEPAIRS.CLUSTER_GENERATION_UPDATE,\n  [ClusterBulkOperationType.PLAN_UPDATE]: MINIMUM_EYEPAIRS.CLUSTER_PLAN_UPDATE,\n  [ClusterBulkOperationType.PLAN_TYPE_UPDATE]:\n    MINIMUM_EYEPAIRS.CLUSTER_PLAN_TYPE_UPDATE,\n  [ClusterBulkOperationType.SLEEP_WAKEUP]:\n    MINIMUM_EYEPAIRS.CLUSTER_SLEEP_WAKEUP,\n  [ClusterBulkOperationType.SPEC_UPDATE]: MINIMUM_EYEPAIRS.CLUSTER_SPEC_UPDATE,\n}\n\n// A stored row can hold a type that the map does not name, and a request can\n// hold no `eyes`. Each makes the count NaN, and a check of `acks < NaN`\n// passes. Thus off int, such a type gets the highest minimum. Such an `eyes`\n// is 0 on every stage.\nconst HIGHEST_BULK_OPERATION_MINIMUM = Math.max(\n  ...Object.values(MINIMUM_EYEPAIRS_BY_BULK_OPERATION_TYPE),\n)\n\n/**\n * countBulkOperationAcks is the number of different users, other than its\n * creator, who acknowledged a cluster bulk operation of console-backend.\n *\n * The creator cannot approve their own request, as in the approvals of\n * control-backend. An ack of the creator that a row already holds does not\n * count.\n */\nexport function countBulkOperationAcks(operation: {\n  createdBy?: string\n  acks: ReadonlyArray<{ userId: string }>\n}): number {\n  return new Set(\n    operation.acks\n      .map((ack) => ack.userId)\n      .filter((userId) => userId !== operation.createdBy),\n  ).size\n}\n\n/**\n * The lowest `eyes` of a cluster bulk operation of console-backend on int, for\n * every type. It is a floor: an operation that asks for more keeps its count.\n *\n * Int often has only one other Camundi who can approve. One approval there\n * still tests the whole flow. Prod keeps the minimum of the type. The approval\n * flow of control-backend uses this number on int too.\n */\nexport const INT_MINIMUM_BULK_OPERATION_ACKS =\n  CLUSTER_BULK_OPERATION_TEST_STAGE_MIN_ACKS\n\n/**\n * minimumBulkOperationEyes is the lowest `eyes` that a cluster bulk operation\n * of `type` can have on `stage`. On int it is\n * `INT_MINIMUM_BULK_OPERATION_ACKS`. On every other stage, and on an unknown\n * `stage`, it is the minimum of the type. Dev and local count no\n * acknowledgement, but this function still gives the minimum of the type\n * there.\n */\nexport function minimumBulkOperationEyes(\n  type: ClusterBulkOperationType,\n  stage: string | undefined,\n): number {\n  if (stage === 'int') {\n    return INT_MINIMUM_BULK_OPERATION_ACKS\n  }\n  // A key of Object.prototype, such as 'constructor', is not a type.\n  return Object.hasOwn(MINIMUM_EYEPAIRS_BY_BULK_OPERATION_TYPE, type)\n    ? MINIMUM_EYEPAIRS_BY_BULK_OPERATION_TYPE[type]\n    : HIGHEST_BULK_OPERATION_MINIMUM\n}\n\n/**\n * minimumBulkOperationAcks is how many different users must acknowledge a\n * cluster bulk operation of console-backend on a stage that counts the\n * acknowledgements. It is the `eyes` of the operation, and never less than\n * `minimumBulkOperationEyes` of `stage`. The creator is not one of the users.\n *\n * `stage` is optional, because the first version of this function had no\n * `stage`. Without it, the function gives the count of prod.\n */\nexport function minimumBulkOperationAcks(\n  operation: {\n    type: ClusterBulkOperationType\n    eyes: number\n  },\n  stage?: string,\n): number {\n  return Math.max(\n    Number.isFinite(operation.eyes) ? operation.eyes : 0,\n    minimumBulkOperationEyes(operation.type, stage),\n  )\n}\n\n/**\n * requiredBulkOperationAcks is how many different users must acknowledge a\n * cluster bulk operation of console-backend before it can run on `stage`.\n * The dev and local stages need none. Every other stage, and an unknown\n * `stage`, needs `minimumBulkOperationAcks` of that stage.\n */\nexport function requiredBulkOperationAcks(\n  operation: { type: ClusterBulkOperationType; eyes: number },\n  stage: string | undefined,\n): number {\n  if (stage === 'dev' || stage === 'local') {\n    return 0\n  }\n  return minimumBulkOperationAcks(operation, stage)\n}\n\n/**\n * missingBulkOperationAcks is how many more users, other than its creator,\n * must acknowledge a cluster bulk operation of console-backend before it can\n * run on `stage`. 0 means that it can run.\n */\nexport function missingBulkOperationAcks(\n  operation: {\n    type: ClusterBulkOperationType\n    eyes: number\n    createdBy?: string\n    acks: ReadonlyArray<{ userId: string }>\n  },\n  stage: string | undefined,\n): number {\n  return Math.max(\n    0,\n    requiredBulkOperationAcks(operation, stage) -\n      countBulkOperationAcks(operation),\n  )\n}\n\nexport const MAX_HARDWARE_PACKAGE_COUNT = 4\n"],
-  "mappings": "AAMA,SAAS,kDAAkD;AAC3D,SAAS,gCAAgC;AAElC,MAAM,sBAAsB;AAW5B,MAAM,2BAA2B;AAYjC,MAAM,sBAAsB;AAC5B,MAAM,yBAAyB;AAE/B,MAAM,8BAA8B,MAAO,KAAK,KAAK;AAErD,MAAM,qBAAqB;AAC3B,MAAM,gCAAgC;AAEtC,MAAM,mCAAmC;AAEzC,MAAM,0BAA0B;AAEhC,MAAM,wDAAwD;AAAA,EACnE;AAAA,EACA;AACF;AAQO,MAAM,mBAAmB;AAAA,EAC9B,kBAAkB;AAAA,EAClB,2BAA2B;AAAA,EAC3B,qBAAqB;AAAA,EACrB,0BAA0B;AAAA;AAAA;AAAA,EAG1B,sBAAsB;AAAA,EACtB,qBAAqB;AAAA,EACrB,2BAA2B;AAAA,EAC3B,sBAAsB;AACxB;AAQO,MAAM,0CAGT;AAAA,EACF,CAAC,yBAAyB,QAAQ,GAAG,iBAAiB;AAAA,EACtD,CAAC,yBAAyB,iBAAiB,GACzC,iBAAiB;AAAA,EACnB,CAAC,yBAAyB,WAAW,GAAG,iBAAiB;AAAA,EACzD,CAAC,yBAAyB,gBAAgB,GACxC,iBAAiB;AAAA,EACnB,CAAC,yBAAyB,YAAY,GACpC,iBAAiB;AAAA,EACnB,CAAC,yBAAyB,WAAW,GAAG,iBAAiB;AAC3D;AAMA,MAAM,iCAAiC,KAAK;AAAA,EAC1C,GAAG,OAAO,OAAO,uCAAuC;AAC1D;AAUO,SAAS,uBAAuB,WAG5B;AACT,SAAO,IAAI;AAAA,IACT,UAAU,KACP,IAAI,CAAC,QAAQ,IAAI,MAAM,EACvB,OAAO,CAAC,WAAW,WAAW,UAAU,SAAS;AAAA,EACtD,EAAE;AACJ;AAUO,MAAM,kCACX;AAUK,SAAS,yBACd,MACA,OACQ;AACR,MAAI,UAAU,OAAO;AACnB,WAAO;AAAA,EACT;AAEA,SAAO,OAAO,OAAO,yCAAyC,IAAI,IAC9D,wCAAwC,IAAI,IAC5C;AACN;AAWO,SAAS,yBACd,WAIA,OACQ;AACR,SAAO,KAAK;AAAA,IACV,OAAO,SAAS,UAAU,IAAI,IAAI,UAAU,OAAO;AAAA,IACnD,yBAAyB,UAAU,MAAM,KAAK;AAAA,EAChD;AACF;AAQO,SAAS,0BACd,WACA,OACQ;AACR,MAAI,UAAU,SAAS,UAAU,SAAS;AACxC,WAAO;AAAA,EACT;AACA,SAAO,yBAAyB,WAAW,KAAK;AAClD;AAOO,SAAS,yBACd,WAMA,OACQ;AACR,SAAO,KAAK;AAAA,IACV;AAAA,IACA,0BAA0B,WAAW,KAAK,IACxC,uBAAuB,SAAS;AAAA,EACpC;AACF;AAEO,MAAM,6BAA6B;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { approvalsRequiredFor } from '../approvals/approval-rules.js'\nimport { CLUSTER_BULK_OPERATION_RULES } from '../approvals/cluster-bulk-operation.js'\nimport { ClusterBulkOperationType } from '../enums/ClusterBulkOperation.enum.js'\n\nexport const CONSOLE_API_USER_ID = 'console-api'\n\n/**\n * The namespace of the custom claims that Auth0 adds to a token of this fleet.\n *\n * An Auth0 API access token carries no `email` claim of its own. The rules of\n * the tenant put the email of the person under this namespace instead, and\n * every reader of the fleet must look there. A service that reads a top-level\n * `email` claim gets nothing, and the failure is silent: the identity is still\n * valid, so the request continues with an empty email.\n */\nexport const CAMUNDA_CLAIMS_NAMESPACE = 'https://camunda.com/meta'\n\n/**\n * The email of an actor whose token carries no email.\n *\n * It is a value and not an empty string, because an empty string reads like a\n * field that nobody wrote. A record that says `unknown` says that the token had\n * no email, which is a different fact.\n *\n * A rule that compares two people MUST NOT treat two of these as one person.\n * `isSameActorEmail` in `approvals/policy.ts` holds that.\n */\nexport const UNKNOWN_ACTOR_EMAIL = 'unknown'\nexport const TEMPORARY_CLUSTER_NAME = 'Get Started'\nexport type Stage = 'local' | 'dev' | 'int' | 'prod'\nexport const HOTBACKUP_MIN_CREATE_PERIOD = 1000 * 60 * 60 * 0.25 // 15 minutes\n\nexport const SECRETS_MAX_LENGTH = 4096\nexport const FIRSTNAME_LASTNAME_MAX_LENGTH = 255\n\nexport const STARTING_PRICE_PER_MONTH_IN_EURO = 99\n\nexport const MAX_LENGTH_CLUSTER_NAME = 50\n\nexport const NAMES_OF_ENTERPRISE_SALESPLANS_WITH_SLEEPING_CLUSTERS = [\n  'CELP with sleeping clusters',\n  'Camunda Partner',\n]\n\n/**\n * Each count is the number of people, other than the creator, who must\n * acknowledge. The creator cannot acknowledge their own modification. Thus a\n * count of 1 needs two people: the creator and one other person.\n *\n * Only the cluster modifications read these counts. A cluster bulk operation\n * counts the creator too. Its counts come from `APPROVAL_RULES`: see\n * `minimumBulkOperationEyes`.\n */\nexport const MINIMUM_EYEPAIRS = {\n  CLUSTER_PLAN_MODIFICATION: 1,\n  CLUSTER_MODIFICATION: 1,\n}\n\nconst BULK_OPERATION_TYPES = Object.values(ClusterBulkOperationType)\n\n// Only int has its own count. Dev and local read the count of prod, as their\n// `eyes` is stored but not checked (see `requiredBulkOperationAcks`).\ntype BulkOperationCountStage = 'int' | 'prod'\n\nfunction bulkOperationMinimumOf(\n  type: ClusterBulkOperationType,\n  stage: BulkOperationCountStage,\n): number {\n  return approvalsRequiredFor(CLUSTER_BULK_OPERATION_RULES[type].useCase, stage)\n}\n\nfunction highestBulkOperationMinimum(stage: BulkOperationCountStage): number {\n  return Math.max(\n    ...BULK_OPERATION_TYPES.map((type) => bulkOperationMinimumOf(type, stage)),\n  )\n}\n\n/**\n * The lowest `eyes` of a cluster bulk operation of console-backend on prod,\n * for each type. It is the number of people who must approve, the creator\n * included. Int has a lower floor for some types, thus do not read the map\n * directly. For the lowest `eyes` on a stage, use `minimumBulkOperationEyes`.\n * For the count that an operation needs, use `requiredBulkOperationAcks`.\n */\nexport const MINIMUM_EYEPAIRS_BY_BULK_OPERATION_TYPE: Record<\n  ClusterBulkOperationType,\n  number\n> = Object.fromEntries(\n  BULK_OPERATION_TYPES.map((type) => [\n    type,\n    bulkOperationMinimumOf(type, 'prod'),\n  ]),\n) as Record<ClusterBulkOperationType, number>\n\n// A stored row can hold a type that the map does not name, and a request can\n// hold no `eyes`. Each makes the count NaN, and a check of `acks < NaN`\n// passes. Thus such a type gets the highest minimum of the stage. Such an\n// `eyes` is 0 on every stage.\nconst HIGHEST_BULK_OPERATION_MINIMUM = {\n  int: highestBulkOperationMinimum('int'),\n  prod: highestBulkOperationMinimum('prod'),\n}\n\n/**\n * countBulkOperationAcks is the number of different people who approved a\n * cluster bulk operation of console-backend. The creator is one of them.\n *\n * The creator always counts: a request needs `clusters.canReadAllClusterInfo`\n * to be created, acknowledged and executed, thus the creator holds every\n * permission that an approval needs. The creator cannot acknowledge by hand,\n * but an ack of the creator that a row already holds does not count twice.\n */\nexport function countBulkOperationAcks(operation: {\n  createdBy?: string\n  acks: ReadonlyArray<{ userId: string }>\n}): number {\n  const people = new Set(operation.acks.map((ack) => ack.userId))\n  if (operation.createdBy !== undefined) {\n    people.add(operation.createdBy)\n  }\n  return people.size\n}\n\n/**\n * minimumBulkOperationEyes is the lowest `eyes` that a cluster bulk operation\n * of `type` can have on `stage`. It counts people, the creator included. It\n * is the count of `APPROVAL_RULES` for the use case of the type. On int, that\n * is the count of the test stages. On every other stage, and on an unknown\n * `stage`, it is the count of prod. Dev and local count no acknowledgement,\n * but this function still gives the count of prod there.\n */\nexport function minimumBulkOperationEyes(\n  type: ClusterBulkOperationType,\n  stage: string | undefined,\n): number {\n  const countStage: BulkOperationCountStage = stage === 'int' ? 'int' : 'prod'\n  // A key of Object.prototype, such as 'constructor', is not a type.\n  return Object.hasOwn(CLUSTER_BULK_OPERATION_RULES, type)\n    ? bulkOperationMinimumOf(type, countStage)\n    : HIGHEST_BULK_OPERATION_MINIMUM[countStage]\n}\n\n/**\n * minimumBulkOperationAcks is how many different people, the creator\n * included, must approve a cluster bulk operation of console-backend on a\n * stage that counts the approvals. It is the `eyes` of the operation, and\n * never less than `minimumBulkOperationEyes` of `stage`.\n *\n * The floor matters for a row that was open at the deploy of the count that\n * includes the creator. That row holds `eyes` of the old unit, which did not\n * count the creator. On prod, an old `eyes` of 1 is now the creator alone.\n * The floor makes such a row need one more person.\n *\n * `stage` is optional, because the first version of this function had no\n * `stage`. Without it, the function gives the count of prod.\n */\nexport function minimumBulkOperationAcks(\n  operation: {\n    type: ClusterBulkOperationType\n    eyes: number\n  },\n  stage?: string,\n): number {\n  return Math.max(\n    Number.isFinite(operation.eyes) ? operation.eyes : 0,\n    minimumBulkOperationEyes(operation.type, stage),\n  )\n}\n\n/**\n * requiredBulkOperationAcks is how many different people, the creator\n * included, must approve a cluster bulk operation of console-backend before\n * it can run on `stage`. The dev and local stages need none. Every other\n * stage, and an unknown `stage`, needs `minimumBulkOperationAcks` of that\n * stage.\n */\nexport function requiredBulkOperationAcks(\n  operation: { type: ClusterBulkOperationType; eyes: number },\n  stage: string | undefined,\n): number {\n  if (stage === 'dev' || stage === 'local') {\n    return 0\n  }\n  return minimumBulkOperationAcks(operation, stage)\n}\n\n/**\n * missingBulkOperationAcks is how many more people must approve a cluster\n * bulk operation of console-backend before it can run on `stage`. The\n * creator already counts. 0 means that it can run.\n */\nexport function missingBulkOperationAcks(\n  operation: {\n    type: ClusterBulkOperationType\n    eyes: number\n    createdBy?: string\n    acks: ReadonlyArray<{ userId: string }>\n  },\n  stage: string | undefined,\n): number {\n  return Math.max(\n    0,\n    requiredBulkOperationAcks(operation, stage) -\n      countBulkOperationAcks(operation),\n  )\n}\n\nexport const MAX_HARDWARE_PACKAGE_COUNT = 4\n"],
+  "mappings": "AAMA,SAAS,4BAA4B;AACrC,SAAS,oCAAoC;AAC7C,SAAS,gCAAgC;AAElC,MAAM,sBAAsB;AAW5B,MAAM,2BAA2B;AAYjC,MAAM,sBAAsB;AAC5B,MAAM,yBAAyB;AAE/B,MAAM,8BAA8B,MAAO,KAAK,KAAK;AAErD,MAAM,qBAAqB;AAC3B,MAAM,gCAAgC;AAEtC,MAAM,mCAAmC;AAEzC,MAAM,0BAA0B;AAEhC,MAAM,wDAAwD;AAAA,EACnE;AAAA,EACA;AACF;AAWO,MAAM,mBAAmB;AAAA,EAC9B,2BAA2B;AAAA,EAC3B,sBAAsB;AACxB;AAEA,MAAM,uBAAuB,OAAO,OAAO,wBAAwB;AAMnE,SAAS,uBACP,MACA,OACQ;AACR,SAAO,qBAAqB,6BAA6B,IAAI,EAAE,SAAS,KAAK;AAC/E;AAEA,SAAS,4BAA4B,OAAwC;AAC3E,SAAO,KAAK;AAAA,IACV,GAAG,qBAAqB,IAAI,CAAC,SAAS,uBAAuB,MAAM,KAAK,CAAC;AAAA,EAC3E;AACF;AASO,MAAM,0CAGT,OAAO;AAAA,EACT,qBAAqB,IAAI,CAAC,SAAS;AAAA,IACjC;AAAA,IACA,uBAAuB,MAAM,MAAM;AAAA,EACrC,CAAC;AACH;AAMA,MAAM,iCAAiC;AAAA,EACrC,KAAK,4BAA4B,KAAK;AAAA,EACtC,MAAM,4BAA4B,MAAM;AAC1C;AAWO,SAAS,uBAAuB,WAG5B;AACT,QAAM,SAAS,IAAI,IAAI,UAAU,KAAK,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC;AAC9D,MAAI,UAAU,cAAc,QAAW;AACrC,WAAO,IAAI,UAAU,SAAS;AAAA,EAChC;AACA,SAAO,OAAO;AAChB;AAUO,SAAS,yBACd,MACA,OACQ;AACR,QAAM,aAAsC,UAAU,QAAQ,QAAQ;AAEtE,SAAO,OAAO,OAAO,8BAA8B,IAAI,IACnD,uBAAuB,MAAM,UAAU,IACvC,+BAA+B,UAAU;AAC/C;AAgBO,SAAS,yBACd,WAIA,OACQ;AACR,SAAO,KAAK;AAAA,IACV,OAAO,SAAS,UAAU,IAAI,IAAI,UAAU,OAAO;AAAA,IACnD,yBAAyB,UAAU,MAAM,KAAK;AAAA,EAChD;AACF;AASO,SAAS,0BACd,WACA,OACQ;AACR,MAAI,UAAU,SAAS,UAAU,SAAS;AACxC,WAAO;AAAA,EACT;AACA,SAAO,yBAAyB,WAAW,KAAK;AAClD;AAOO,SAAS,yBACd,WAMA,OACQ;AACR,SAAO,KAAK;AAAA,IACV;AAAA,IACA,0BAA0B,WAAW,KAAK,IACxC,uBAAuB,SAAS;AAAA,EACpC;AACF;AAEO,MAAM,6BAA6B;",
   "names": []
 }

package/dist/dtos/AlertSubscription.dto.d.ts

@@ -21,6 +21,8 @@ export interface AlertSubscriptionDto {
     recepientEmail?: string;
 }
 export interface AlertSubscriptionEntryDto {
+    /** The incident key. The camunda-exporter sends it with the name `id`. */
+    id?: string;
     errorMessage?: string;
     errorType?: string;
     flowNodeId?: string;

package/dist/dtos/AlertSubscription.dto.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/dtos/AlertSubscription.dto.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type {\n  AlertSubscriptionReportType,\n  AlertSubscriptionType,\n} from '../enums/AlertSubscription.enum.js'\n\nexport interface AlertSubscriptionDto {\n  uuid: string\n  userIdOrWebhook: string\n  type: AlertSubscriptionType\n  report: AlertSubscriptionReportType\n  webhookAuth?: AlertSubscriptionWebhookAuth\n  createdBy: string\n  createdByName: string\n  created: Date\n  updatedBy: string\n  updatedByName: string\n  updated: Date\n  lastTimeTriggered?: Date\n  numberOfTimesTriggered: number\n  /**\n   * The address of an `Email` subscription. alert-distributor adds it from the\n   * user id, which its list endpoint then replaces with the name of the user.\n   * Thus this field is the only reliable way to identify the person.\n   */\n  recepientEmail?: string\n}\n\nexport interface AlertSubscriptionEntryDto {\n  errorMessage?: string\n  errorType?: string\n  flowNodeId?: string\n  jobKey?: string\n  creationTime?: string\n  processInstanceId?: string\n  processName?: string\n  processVersion?: number\n  bpmnProcessId?: string\n}\n\nexport const HMAC_SUPPORTED_ALGORITHM = 'sha256'\nexport const HMAC_HEADER_POSITION = 'X-Camunda-Signature-256'\n\n/**\n * Webhook targets a customer may not point an alert at, to limit SSRF.\n *\n * Despite the name, each entry is a URL prefix, scheme included: callers match\n * with `url.href.startsWith(entry)`. So add entries as `https://<host>`, with\n * no trailing slash and no path.\n */\nexport const FORBIDDEN_HOSTNAMES_FOR_WEBHOOK_ALERTS = [\n  'https://camunda.com',\n  'https://console.cloud.camunda.io',\n  'https://accounts.cloud.camunda.io',\n  'https://console.camunda.io',\n  'https://accounts.camunda.io',\n  'https://console.ultrawombat.com',\n  'https://console.cloud.ultrawombat.com',\n  'https://accounts.cloud.ultrawombat.com',\n  'https://accounts.ultrawombat.com',\n  'https://console.cloud.dev.ultrawombat.com',\n  'https://console.dev.ultrawombat.com',\n  'https://accounts.cloud.dev.ultrawombat.com',\n  'https://accounts.dev.ultrawombat.com',\n  // Hub and consolelegacy, all stages.\n  // Note: This list contains URL prefixes (`https://<host>`), not bare hostnames.\n  // Callers compare with `url.href.startsWith(...)`.\n  'https://hub.dev.ultrawombat.com',\n  'https://hub.ultrawombat.com',\n  'https://hub.camunda.io',\n  'https://consolelegacy.dev.ultrawombat.com',\n  'https://consolelegacy.ultrawombat.com',\n  'https://consolelegacy.camunda.io',\n]\n\nexport type ALERT_SUBSCRIPTION_TYPES = 'ProcessAlert'\nexport type ALERT_SUBSCRIPTION_REPORT_TYPES = 'Email' | 'Webhook'\n\nexport interface AlertSubscriptionWebhookAuth {\n  hmac?: {\n    secret: string\n  }\n}\n\nexport type CheckFailedReason =\n  | 'urlEmpty'\n  | 'urlNoHead'\n  | 'generatedHmacNotAccepted'\n  | 'urlBad'\n  | 'urlPrivate'\n"],
-  "mappings": "AA6CO,MAAM,2BAA2B;AACjC,MAAM,uBAAuB;AAS7B,MAAM,yCAAyC;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type {\n  AlertSubscriptionReportType,\n  AlertSubscriptionType,\n} from '../enums/AlertSubscription.enum.js'\n\nexport interface AlertSubscriptionDto {\n  uuid: string\n  userIdOrWebhook: string\n  type: AlertSubscriptionType\n  report: AlertSubscriptionReportType\n  webhookAuth?: AlertSubscriptionWebhookAuth\n  createdBy: string\n  createdByName: string\n  created: Date\n  updatedBy: string\n  updatedByName: string\n  updated: Date\n  lastTimeTriggered?: Date\n  numberOfTimesTriggered: number\n  /**\n   * The address of an `Email` subscription. alert-distributor adds it from the\n   * user id, which its list endpoint then replaces with the name of the user.\n   * Thus this field is the only reliable way to identify the person.\n   */\n  recepientEmail?: string\n}\n\nexport interface AlertSubscriptionEntryDto {\n  /** The incident key. The camunda-exporter sends it with the name `id`. */\n  id?: string\n  errorMessage?: string\n  errorType?: string\n  flowNodeId?: string\n  jobKey?: string\n  creationTime?: string\n  processInstanceId?: string\n  processName?: string\n  processVersion?: number\n  bpmnProcessId?: string\n}\n\nexport const HMAC_SUPPORTED_ALGORITHM = 'sha256'\nexport const HMAC_HEADER_POSITION = 'X-Camunda-Signature-256'\n\n/**\n * Webhook targets a customer may not point an alert at, to limit SSRF.\n *\n * Despite the name, each entry is a URL prefix, scheme included: callers match\n * with `url.href.startsWith(entry)`. So add entries as `https://<host>`, with\n * no trailing slash and no path.\n */\nexport const FORBIDDEN_HOSTNAMES_FOR_WEBHOOK_ALERTS = [\n  'https://camunda.com',\n  'https://console.cloud.camunda.io',\n  'https://accounts.cloud.camunda.io',\n  'https://console.camunda.io',\n  'https://accounts.camunda.io',\n  'https://console.ultrawombat.com',\n  'https://console.cloud.ultrawombat.com',\n  'https://accounts.cloud.ultrawombat.com',\n  'https://accounts.ultrawombat.com',\n  'https://console.cloud.dev.ultrawombat.com',\n  'https://console.dev.ultrawombat.com',\n  'https://accounts.cloud.dev.ultrawombat.com',\n  'https://accounts.dev.ultrawombat.com',\n  // Hub and consolelegacy, all stages.\n  // Note: This list contains URL prefixes (`https://<host>`), not bare hostnames.\n  // Callers compare with `url.href.startsWith(...)`.\n  'https://hub.dev.ultrawombat.com',\n  'https://hub.ultrawombat.com',\n  'https://hub.camunda.io',\n  'https://consolelegacy.dev.ultrawombat.com',\n  'https://consolelegacy.ultrawombat.com',\n  'https://consolelegacy.camunda.io',\n]\n\nexport type ALERT_SUBSCRIPTION_TYPES = 'ProcessAlert'\nexport type ALERT_SUBSCRIPTION_REPORT_TYPES = 'Email' | 'Webhook'\n\nexport interface AlertSubscriptionWebhookAuth {\n  hmac?: {\n    secret: string\n  }\n}\n\nexport type CheckFailedReason =\n  | 'urlEmpty'\n  | 'urlNoHead'\n  | 'generatedHmacNotAccepted'\n  | 'urlBad'\n  | 'urlPrivate'\n"],
+  "mappings": "AA+CO,MAAM,2BAA2B;AACjC,MAAM,uBAAuB;AAS7B,MAAM,yCAAyC;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;",
   "names": []
 }

package/dist/dtos/ApprovalJob.dto.d.ts

@@ -16,14 +16,18 @@
  * person to press the button). `executed` or `failed` after the action ran. A
  * request that never reaches the threshold ends `rejected`, `withdrawn` or
  * `expired`.
+ *
+ * `scheduled` is a request that the service opened by itself, and that runs
+ * at `runAt` with no approval. It does not expire, and nobody can withdraw or
+ * reject it. A holder of its permissions can run it before `runAt`.
  */
-export declare const APPROVAL_JOB_STATUSES: readonly ["pending", "approved", "executing", "executed", "failed", "rejected", "withdrawn", "expired"];
+export declare const APPROVAL_JOB_STATUSES: readonly ["pending", "scheduled", "approved", "executing", "executed", "failed", "rejected", "withdrawn", "expired"];
 export type ApprovalJobStatus = (typeof APPROVAL_JOB_STATUSES)[number];
 /**
  * The states in which the action of a request is still COMING.
  *
- * `pending` waits for approvals, `approved` waits for a person to press the
- * button, and `executing` is running now. Each of them can still change the
+ * `pending` waits for approvals, `scheduled` waits for its time, `approved`
+ * waits for a person to press the button, and `executing` is running now. Each of them can still change the
  * world, so two requests for one target must not be in these states together.
  * `dedupeKey` reads this set for that reason.
  *
@@ -34,7 +38,7 @@ export type ApprovalJobStatus = (typeof APPROVAL_JOB_STATUSES)[number];
  *
  * `executed`, `rejected`, `withdrawn` and `expired` are the end of a request.
  */
-export declare const APPROVAL_LIVE_STATUSES: readonly ["pending", "approved", "executing"];
+export declare const APPROVAL_LIVE_STATUSES: readonly ["pending", "scheduled", "approved", "executing"];
 /**
  * How many requests one page of the list holds when the caller asks for no
  * number.
@@ -231,6 +235,19 @@ export interface ApprovalM2mActor {
     requestedBy: ApprovalActor;
     /** The Camundis who approved it. Empty when the use case needs none. */
     approvedBy: ApprovalActor[];
+    /**
+     * The Camundi who ran the request with an approval override grant, in
+     * place of the approvals that it still needed. Absent for every other run.
+     *
+     * control-backend checked the grant, the permissions of this person and
+     * `APPROVAL_OVERRIDE_DENYLIST` before the run. A receiver that counts the
+     * approvals of an overridable type accepts this person in place of the
+     * approvals that are missing, and refuses this field for every other type.
+     * This person can be the person in `requestedBy`, because that is what a
+     * grant is for. A receiver that refuses the target of an action as an
+     * approver refuses this person as well, also when they asked.
+     */
+    overriddenBy?: ApprovalActor;
 }
 /**
  * What one value of a summary field is.
@@ -440,9 +457,53 @@ export interface ApprovalJobDto {
      * and "it did 2998 of 3000, and these two refused".
      */
     executionResult?: Record<string, unknown>;
+    /** An ISO timestamp: when a `scheduled` request runs by itself. */
+    runAt?: string;
+    /**
+     * The person who ran this request with an approval override grant, in
+     * place of the approvals that it still needed. See `canOverride`.
+     */
+    overriddenBy?: ApprovalActor;
+    /**
+     * An ISO timestamp: when that person used the override. The run window of
+     * an overridden request starts here. See `runWindowEnd`.
+     */
+    overriddenAt?: string;
+    /** Why that person used the override. It is necessary. */
+    overrideReason?: string;
+    /**
+     * The approval override grant that the override used. A later run needs
+     * this grant to be active still. See `canRunOverridden`.
+     */
+    overrideGrantId?: string;
     createdAt: string;
     updatedAt: string;
 }
+/**
+ * One approval override grant, as the API returns it.
+ *
+ * A grant lets one Camundi run a `pending` request of an overridable use case
+ * with no approval, until `expiresAt`. A grant is active while `revokedAt` is
+ * absent and `expiresAt` is in the future. See `isOverrideGrantActive`.
+ */
+export interface ApprovalOverrideGrantDto {
+    id: string;
+    /** The Auth0 `sub` of the person who holds the grant. */
+    userId: string;
+    email: string;
+    /** The `grant-approval-override` request that made this grant. */
+    grantedByJobId: string;
+    /** The `revoke-approval-override` request that ends this grant. */
+    revokeJobId?: string;
+    reason: string;
+    /** An ISO timestamp. */
+    createdAt: string;
+    /** An ISO timestamp. The grant ends here, also when no revoke ran. */
+    expiresAt: string;
+    /** An ISO timestamp: when the revoke request ran. */
+    revokedAt?: string;
+    revokedByJobId?: string;
+}
 /**
  * What a use case is, as the API reports it.
  *
@@ -540,10 +601,13 @@ export interface ApprovalUseCaseDto {
      *
      * `create-personal-organisation` and the two use cases of custom hardware
      * sizing set it. The two use cases of custom hardware sizing do the second
-     * check in two ways:
+     * check in three ways:
      *
      * - Creating a plan, and unlinking a plan from one organization, read the
      *   role of the person in that organization. Only an OWNER passes.
+     * - Linking an existing plan to an organization reads the same role.
+     *   Only an OWNER passes. The dedupe key is the only bound on how often a
+     *   person can ask for a link.
      * - Deleting a plan reads no role. Console checks that the person created
      *   the plan. Accounts reads the organizations that the person is a member
      *   of, in any role, and removes the plan from their lists.

package/dist/dtos/ApprovalJob.dto.js

@@ -1,5 +1,6 @@
 const APPROVAL_JOB_STATUSES = [
   "pending",
+  "scheduled",
   "approved",
   "executing",
   "executed",
@@ -10,6 +11,7 @@ const APPROVAL_JOB_STATUSES = [
 ];
 const APPROVAL_LIVE_STATUSES = [
   "pending",
+  "scheduled",
   "approved",
   "executing"
 ];

package/dist/dtos/ApprovalJob.dto.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/dtos/ApprovalJob.dto.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/**\n * The wire types of the generic approval mechanism.\n *\n * This file holds no logic and no dependency, because three consumers read it:\n * control-backend, control-frontend and cloudbot. The rules that read these\n * types are in `../approvals/policy.js`, and they are pure for the same reason.\n */\n\n/**\n * Every state that an approval request can hold.\n *\n * A `const` tuple, not an enum, so it is both the union type and the list that\n * validates a status filter at run time.\n *\n * The path of a request: `pending` until it reaches the threshold. Then\n * `executing` (automatic mode) or `approved` (explicit mode, which waits for a\n * person to press the button). `executed` or `failed` after the action ran. A\n * request that never reaches the threshold ends `rejected`, `withdrawn` or\n * `expired`.\n */\nexport const APPROVAL_JOB_STATUSES = [\n  'pending',\n  'approved',\n  'executing',\n  'executed',\n  'failed',\n  'rejected',\n  'withdrawn',\n  'expired',\n] as const\n\nexport type ApprovalJobStatus = (typeof APPROVAL_JOB_STATUSES)[number]\n\n/**\n * The states in which the action of a request is still COMING.\n *\n * `pending` waits for approvals, `approved` waits for a person to press the\n * button, and `executing` is running now. Each of them can still change the\n * world, so two requests for one target must not be in these states together.\n * `dedupeKey` reads this set for that reason.\n *\n * `failed` is NOT here, although a person can run a failed request again. A\n * failed request runs only when a person presses the button, and that person\n * sees the row. Blocking a new request on a failed one would also trap the\n * key: `canWithdraw` accepts `pending` alone, so nobody could close it.\n *\n * `executed`, `rejected`, `withdrawn` and `expired` are the end of a request.\n */\nexport const APPROVAL_LIVE_STATUSES = [\n  'pending',\n  'approved',\n  'executing',\n] as const satisfies readonly ApprovalJobStatus[]\n\n/**\n * How many requests one page of the list holds when the caller asks for no\n * number.\n *\n * The list is a work queue that a Camundi reads, so the page is large: a\n * person wants the whole queue and not ten rows at a time. What the number is\n * for is the ceiling below.\n */\nexport const APPROVAL_PAGE_SIZE_DEFAULT = 500\n\n/**\n * The largest page that the service builds, and the largest that a caller may\n * ask for. The API answers 400 above it.\n *\n * The list had no limit at all. One authenticated caller could then make the\n * service read the whole table into memory, serialize it, and do it again, so\n * the cost of a request grew with the age of the service and with nothing that\n * the caller had to pay for. A ceiling turns that into a fixed cost.\n *\n * It is HERE and not only in the service, because the view must know it: a\n * page that asked for more would get a 400 instead of rows.\n */\nexport const APPROVAL_PAGE_SIZE_MAX = 2000\n\n/**\n * The columns that the queue can be ordered by.\n *\n * A NAME and not an SQL expression: the repository maps each one, so a caller\n * can never name a column that this list does not hold. `status` orders by the\n * EFFECTIVE status, because a `pending` row whose time ran out reads as\n * `expired` everywhere else.\n */\nexport const APPROVAL_SORT_FIELDS = [\n  'createdAt',\n  'expiresAt',\n  'status',\n  'type',\n  'createdBy',\n] as const\n\nexport type ApprovalSortField = (typeof APPROVAL_SORT_FIELDS)[number]\n\nexport type ApprovalSortOrder = 'asc' | 'desc'\n\n/** The default order of the queue: the newest request first. */\nexport const APPROVAL_SORT_DEFAULT: {\n  sort: ApprovalSortField\n  order: ApprovalSortOrder\n} = { sort: 'createdAt', order: 'desc' }\n\n/**\n * The longest reason that a request, a rejection or a withdrawal accepts.\n *\n * ONE number, because three routes of control-backend hold it and three fields\n * of control-frontend must stop there. A field that let a person write more\n * than the schema accepts turns their sentence into a 400 after they wrote it.\n */\nexport const APPROVAL_REASON_MAX_LENGTH = 2000\n\n/**\n * The largest number of approvals that a caller can ask for.\n *\n * A request that asks for 400 approvals can never reach them, so it is a\n * request that only fills the table and expires. The ceiling turns that into a\n * 400 at the moment a person types it. It is HERE because the form of the\n * bulk operation must stop at the same number as the route.\n */\nexport const APPROVAL_ACKS_MAX = 10\n\n/**\n * The longest search text that the list accepts.\n *\n * A search runs `ILIKE` over the payload of every visible row, so the cost of\n * one call follows the length of the text. Nothing a person types to find a\n * request is near this.\n */\nexport const APPROVAL_SEARCH_MAX_LENGTH = 200\n\n/**\n * APPROVAL_TYPE_FILTER_MAX is the most use case types that one `type` filter\n * names. The registry holds fewer, so the ceiling only stops a list with no\n * end. control-backend answers 400 above it.\n */\nexport const APPROVAL_TYPE_FILTER_MAX = 100\n\n/** APPROVAL_TYPE_MAX_LENGTH is the longest type that a `type` filter names. */\nexport const APPROVAL_TYPE_MAX_LENGTH = 200\n\n/**\n * The payload field that names the organization a request acts on.\n *\n * It is a CONVENTION, and this constant is what makes the convention readable\n * from both sides. A use case whose action hits one organization puts the id of\n * that organization in this field, and `GET /api/approvals?orgId=\u2026` then finds\n * the request with no knowledge of the use case. The filter reads this one\n * field of the payload, so it matches the whole id and nothing else. The free\n * text search reads the payload as TEXT, which also matches an id that only\n * appears inside another field, and it cannot answer \"the requests of this\n * organization\".\n *\n * The organization page of control-frontend does NOT read this field. It asks\n * the entity-link filter (`entityType=org`), which reads a row that\n * `relatedEntities` of a use case writes \u2014 see `ApprovalEntityRef`. The summary\n * is separate again: the `org` field of a `summarize` result is what a READER\n * follows.\n */\nexport const APPROVAL_PAYLOAD_ORG_FIELD = 'orgId'\n\n/**\n * How many requests each status and each use case type holds, for the filters\n * of the queue.\n *\n * Every status number answers the SAME question as the list beside it: the\n * counts are built with the visibility rule, the action filter and the search\n * text of the caller, and with the lazy expiry. A count that ignored one of\n * those would send a person to a filter that then shows nothing. `byType` is\n * the exception: see its own note.\n */\nexport interface ApprovalStatusCountsDto {\n  /** Every request that matches, whatever its status. */\n  all: number\n  /** One number for each status. A status with no request is 0, never absent. */\n  byStatus: Record<ApprovalJobStatus, number>\n  /**\n   * One number for each use case type, over every status.\n   *\n   * It ignores the type filter, so a type facet keeps its number while it is\n   * on or off. Every other filter applies. A type with no request has no key,\n   * so read a missing key as 0, and read only an own key: a type id such as\n   * `__proto__` must not reach the prototype.\n   *\n   * Optional, because an older control-backend does not send it. Read an\n   * absent field as no counts.\n   */\n  byType?: Record<string, number>\n}\n\n/**\n * What happens when a request reaches its threshold.\n *\n * `auto` runs the action immediately. `explicit` holds the request at\n * `approved` and waits for a person to run it.\n */\nexport type ApprovalExecutionMode = 'auto' | 'explicit'\n\n/**\n * WHERE the action runs. It is a separate question from who starts it.\n *\n * - `inline` runs the action inside the call that started it, and the answer\n *   already carries the outcome. Right for one call to another service.\n * - `background` answers as soon as the request is claimed, and the action\n *   runs on. It reports into `ApprovalJobDto.progress`, and the row is the\n *   only place that holds the progress, so a reload and a second person read\n *   the same numbers. A pod that stops loses the run, and the reconciler of\n *   control-backend recovers the row.\n *\n * An action over thousands of targets MUST be `background`. `inline` would\n * hold one HTTP request for the whole run, and the ingress, the load balancer\n * and the browser each have their own deadline before it finishes.\n *\n * An `inline` action must not read `context.signal`. The runner trusts the\n * result of an `inline` action that returns after a drain, and it would count\n * a partial run as `executed`. An action that stops between targets is\n * `background`.\n */\nexport type ApprovalActionMode = 'inline' | 'background'\n\n/**\n * A person, as an approval request records them.\n *\n * Both keys are kept. The machine then never has to choose one identity key,\n * which is what split the earlier acknowledgement flows: some held an email and\n * some held a user id, and the two could not be compared.\n */\nexport interface ApprovalActor {\n  userId: string\n  email: string\n}\n\nexport interface ApprovalAck extends ApprovalActor {\n  /** An ISO timestamp. It is in a json column, so it is a string, not a Date. */\n  date: string\n}\n\n/**\n * Who asked for an action, and who agreed to it.\n *\n * Every route of `api/admin/approvals` takes this envelope, and control-backend\n * builds it from the request that it runs. The envelope exists because the\n * token cannot carry it: the call is machine to machine, so `sub` holds the id\n * of the Auth0 application and not a person. A service that reads the token\n * alone therefore writes \"control-backend\" into its audit record, which hides\n * the two Camundis that the whole mechanism exists to record.\n *\n * `approvedBy` is a list, because a use case can need more than one approval,\n * and the record must name all of them. It can also be EMPTY: how many\n * approvals an action needs is a number of the use case, and `move-cluster-org`\n * holds zero on purpose. The person in `requestedBy` is never in the list: the\n * four-eyes rule is that the person who asks is not the person who agrees, and\n * control-backend holds that rule.\n *\n * Each person carries both keys of `ApprovalActor`. The email is what a route\n * uses to ask Auth0 about the person, and the user id is what an audit record\n * holds, because every other record of the fleet holds an Auth0 `sub`.\n *\n * CAUTION: The envelope is a CLAIM of the caller, and not proof. A route that\n * acts on it must ask Auth0 again whether `requestedBy` may do the action.\n * That means the permission of the action. For a use case with\n * `openToEveryone`, it means that the person is a Camundi, because no\n * permission runs that action. `api/admin/approvals` in accounts-backend does\n * that. See the note on `M2M_CONTROL_APPROVALS`.\n */\nexport interface ApprovalM2mActor {\n  /** The id of the approval request, to join the records of both services. */\n  requestId: string\n  /** The Camundi who opened the request. */\n  requestedBy: ApprovalActor\n  /** The Camundis who approved it. Empty when the use case needs none. */\n  approvedBy: ApprovalActor[]\n}\n\n/**\n * What one value of a summary field is.\n *\n * `text` is what a person reads. `id` is what a link points at, and it is\n * absent when the kind names no entity. The two are separate because the text\n * is a COPY that the request keeps: an organization that gets a new name after\n * the request was opened must still read as the organization that the person\n * chose.\n */\nexport interface ApprovalSummaryValue {\n  text: string\n  id?: string\n}\n\n/**\n * How a reader must render one field of a summary.\n *\n * `org`, `cluster` and `user` name an entity, so a reader can link to it and\n * can resolve a fresh name. The others are plain: `date` is an ISO timestamp,\n * and `code` is a value that must keep its characters, such as a json fragment.\n */\nexport const APPROVAL_SUMMARY_FIELD_KINDS = [\n  'text',\n  'number',\n  'boolean',\n  'date',\n  'org',\n  'cluster',\n  'user',\n  'code',\n] as const\n\nexport type ApprovalSummaryFieldKind =\n  (typeof APPROVAL_SUMMARY_FIELD_KINDS)[number]\n\n/**\n * One labelled field of the payload of a request.\n *\n * This is what makes ONE view able to show EVERY use case. The payload of a\n * request is an object of anything, so a generic view can only print it as\n * json. The use case turns it into labelled fields here, and the view renders\n * a field by its kind: it links an `org`, it formats a `date`, and it lists\n * 300 clusters as 300 links.\n *\n * `values` is always an array. A field that holds one value holds an array of\n * one, so a reader needs no branch for \"one or many\".\n */\nexport interface ApprovalSummaryField {\n  label: string\n  kind: ApprovalSummaryFieldKind\n  values: ApprovalSummaryValue[]\n  /**\n   * The values that this request replaces, for a field that changes. A view\n   * shows them as removed beside `values` as added. A field with no\n   * `previous` is not a change.\n   */\n  previous?: ApprovalSummaryValue[]\n  /** The count of `previous`, when the list cut it. Like `total`, for `previous`. */\n  previousTotal?: number\n  /**\n   * How many values the field holds, when `values` holds only the first of\n   * them. The list route cuts every field to `APPROVAL_LIST_SUMMARY_VALUES_MAX`\n   * values. The detail route sends every value and no `total`.\n   */\n  total?: number\n}\n\n/**\n * How many values of one summary field a row of the list carries.\n *\n * A bulk operation names up to 3000 clusters in one field. A page of 100 such\n * rows would carry 300,000 values that no row shows. The view shows at most\n * 12 values of a field, so the list stops there, and `total` holds the count.\n */\nexport const APPROVAL_LIST_SUMMARY_VALUES_MAX = 12\n\n/**\n * The kinds of entity that an approval request can concern.\n *\n * These are the entities that a request is findable by: the org and cluster\n * detail pages ask \"which requests touch me\", and the answer reads a row for\n * each entity. It is a subset of `APPROVAL_SUMMARY_FIELD_KINDS` \u2014 the kinds that\n * name an entity \u2014 because only those carry an id that a page can match.\n */\nexport const APPROVAL_ENTITY_TYPES = ['cluster', 'org', 'user'] as const\n\nexport type ApprovalEntityType = (typeof APPROVAL_ENTITY_TYPES)[number]\n\n/**\n * One entity that an approval request concerns.\n *\n * A use case reports these from its payload, and the service writes one row for\n * each into `approval_job_entity`. That row is what makes a request findable by\n * an entity it touches, without a text search over the payload: a cluster-move\n * request names its cluster, its target organization AND its source\n * organization, so it shows on all three detail pages. The `summary` still\n * carries the words a reader sees; this carries only the ids a page matches.\n */\nexport interface ApprovalEntityRef {\n  type: ApprovalEntityType\n  id: string\n}\n\n/**\n * How long a run may go quiet before a reader calls it stalled.\n *\n * The pod that runs an action writes its progress and renews its lease on one\n * timer, so a healthy run touches the row well inside this window. A row that\n * is `executing` and older than this held a pod that stopped, and the\n * reconciler of control-backend is on its way to it.\n *\n * It lives here, and not in the config of the service, because a READER needs\n * it: the browser must decide what to show without a second call, and a number\n * that only the backend knew would make the two disagree. `ACTION_LEASE_MS` in\n * `config/index.ts` is held below this on purpose.\n */\nexport const APPROVAL_RUN_STALE_MS = 120_000\n\n/**\n * What an action reports while it runs.\n *\n * This is what makes a long action watchable. Every field is in the DATABASE\n * and not in the answer to the call that started the run, so three readers see\n * the same thing: the person who pressed the button, the same person after a\n * reload, and a second person who opens the request.\n *\n * `total` can be 0 while an action counts its targets, and it stays 0 for an\n * action that cannot count them. A reader must then show that it runs, and no\n * percentage.\n */\nexport interface ApprovalProgress {\n  /** Targets in total. 0 means the action did not say. */\n  total: number\n  /** Targets finished, whatever the outcome of each one. */\n  done: number\n  /** Targets that finished with an error. Part of `done`. */\n  failed: number\n  /** One short line for a person, such as the step that runs now. */\n  note?: string\n  /** An ISO timestamp: when the run started. */\n  startedAt: string\n  /** An ISO timestamp: when the run last wrote anything. */\n  updatedAt: string\n}\n\n/** The share of the work that is finished, or `undefined` with no total. */\nexport function progressFraction(\n  progress: ApprovalProgress | undefined,\n): number | undefined {\n  if (!progress || progress.total <= 0) {\n    return undefined\n  }\n  return Math.min(1, progress.done / progress.total)\n}\n\n/**\n * Reports whether a running request went quiet.\n *\n * True means that the pod which held the run stopped, or lost the row. It does\n * NOT mean that the action failed: the reconciler either runs it again, or it\n * writes `failed` so that a person can. See `APPROVAL_RUN_STALE_MS`.\n */\nexport function isRunStalled(job: ApprovalJobDto, now: Date): boolean {\n  if (job.status !== 'executing') {\n    return false\n  }\n  const lastSign = job.progress?.updatedAt ?? job.executingSince\n  if (!lastSign) {\n    return false\n  }\n  return now.getTime() - new Date(lastSign).getTime() > APPROVAL_RUN_STALE_MS\n}\n\n/** One approval request, as the API returns it. */\nexport interface ApprovalJobDto {\n  id: string\n  type: string\n  dedupeKey?: string\n  payload: Record<string, unknown>\n  /**\n   * The payload as labelled fields. See `ApprovalSummaryField`.\n   *\n   * The use case builds it when the request is opened AND every time the\n   * request is read, so a field that a later version of the use case adds\n   * appears on a request that is already open.\n   */\n  summary: ApprovalSummaryField[]\n  /** Why the person opened the request. Some use cases demand one. */\n  reason?: string\n  createdBy: ApprovalActor\n  acks: ApprovalAck[]\n  /**\n   * How many approvals THIS request needs.\n   *\n   * It is on the request and not only on the use case, because the person who\n   * opens one can ask for more than the floor of the use case. A bulk\n   * operation over 3000 clusters is the same action as one over 3, and it can\n   * still deserve a third pair of eyes. `ApprovalUseCaseDto.minAcks` is the\n   * floor that a caller cannot go below.\n   */\n  requiredAcks: number\n  /**\n   * What a person must hold to approve, reject or run THIS request.\n   *\n   * It is on the request and not only on the use case, because a payload can\n   * raise the guard: a generation update with `yoloForceUpdate` needs the yolo\n   * permission on top of the base one, and the same use case without the flag\n   * does not. The set is computed ONE time, when the request is opened, so it\n   * is also the record of what the request was guarded by.\n   *\n   * A person needs EVERY permission in the set, not one of them.\n   */\n  requiredPermissions: string[]\n  executionMode: ApprovalExecutionMode\n  actionMode: ApprovalActionMode\n  status: ApprovalJobStatus\n  closedBy?: ApprovalActor\n  closedReason?: string\n  /** An ISO timestamp. */\n  expiresAt: string\n  /**\n   * An ISO timestamp: when the current run took the request.\n   *\n   * It is set every time a run starts, so a run that the reconciler starts\n   * again moves it. `attempts` says how many runs there were.\n   */\n  executingSince?: string\n  /** How many times a run started. A recovery raises it. */\n  attempts: number\n  /**\n   * What the action reports while it runs. See `ApprovalProgress`.\n   *\n   * It stays on the row after the run, so the record of a finished run says\n   * how many targets it touched and how many refused.\n   */\n  progress?: ApprovalProgress\n  executedAt?: string\n  executionError?: string\n  /**\n   * What the action reported when it ran.\n   *\n   * The shape belongs to the use case. An action over many targets puts the\n   * result of each target here, which is the difference between \"it failed\"\n   * and \"it did 2998 of 3000, and these two refused\".\n   */\n  executionResult?: Record<string, unknown>\n  createdAt: string\n  updatedAt: string\n}\n\n/**\n * What a use case is, as the API reports it.\n *\n * The frontend needs `requiredPermission` to run the same rule as the backend.\n * PR #9301 kept this registry a second time, by hand, in the frontend. A\n * registry that the server owns means a new use case needs no frontend deploy.\n */\nexport interface ApprovalUseCaseDto {\n  type: string\n  /** A short name for a person to read. */\n  label: string\n  /** One sentence: what the action does, and what it cannot undo. */\n  description: string\n  /** The approvals a new request asks for when the caller names no number. */\n  defaultAcks: number\n  /**\n   * The floor. A caller can ask for more approvals, never for fewer.\n   *\n   * It is a separate number from `defaultAcks` because the two answer\n   * different questions: the default is what the form offers, and the floor is\n   * what the service refuses to go below.\n   */\n  minAcks: number\n  ttlDays: number\n  executionMode: ApprovalExecutionMode\n  /** See `ApprovalActionMode`. An action over many targets is `background`. */\n  actionMode: ApprovalActionMode\n  /**\n   * True when a run that was interrupted can start again by itself.\n   *\n   * It is a promise about the ACTION, and the reconciler reads it. Set it only\n   * when the action can run a second time over the same payload and do no harm\n   * twice: it must read what the first run already finished, out of\n   * `ApprovalJobDto.executionResult`, and skip it.\n   *\n   * False, the default, is the safe answer. An interrupted run then lands in\n   * `failed`, which a person can run again from the detail page, and a person\n   * decides whether running it twice is safe.\n   */\n  resumable: boolean\n  /**\n   * The permission that every request of this use case needs to approve,\n   * reject or run. A payload can add more. See\n   * `ApprovalJobDto.requiredPermissions`, which is the effective set.\n   *\n   * It is also the permission to SEE a request of this use case, because a\n   * person who cannot act on one has no reason to read it. The person who\n   * opened a request always sees that request.\n   *\n   * The one exception to \"or run\" is a use case with `openToEveryone`. It has\n   * no approval, so this permission only decides who sees the requests of\n   * other people. Any signed-in person can open and run such a request.\n   */\n  requiredPermission: string\n  /**\n   * The permission to open a request. Absent means any signed-in Camundi.\n   *\n   * Set it when the pool that can ASK must be as small as the pool that can\n   * approve. Leave it absent when the approvals alone are the guard, and the\n   * proposal is not.\n   */\n  createPermission?: string\n  /** True when a request cannot be opened without a reason. */\n  reasonRequired: boolean\n  /**\n   * True when the ACTION needs the email address of the person who asked.\n   *\n   * A token can carry no address, and the row then stores\n   * `UNKNOWN_ACTOR_EMAIL`. An action that sends that placeholder to another\n   * service asks it to find a user that does not exist, so the request can\n   * only fail \u2014 and it fails at the END, after other people spent their\n   * approvals on it. A use case that carries the creator into its call sets\n   * this, and `canCreate` then refuses such a caller at the start.\n   *\n   * `extend-trial` and `send-to-expired-trial` are two: both send the creator\n   * to accounts in an `ApprovalM2mActor`, and accounts reads the permissions\n   * of that person again before it acts.\n   *\n   * `move-cluster-org` does NOT set this. Its envelope reaches console, which\n   * reads the user id alone and needs no address.\n   */\n  creatorEmailRequired?: boolean\n  /**\n   * A use case with no approval that any signed-in person can open AND run.\n   *\n   * A request with a floor of zero runs when it is opened, so `canCreate`\n   * asks the person to hold `requiredPermission`. This flag lifts that one\n   * rule, for an action whose run needs no permission of the person. Set it\n   * only when two things hold:\n   *\n   * - Something else bounds how often a person can ask.\n   * - The service that runs the action authorizes the person again at its\n   *   source, so that nobody can change what is not theirs. The action can\n   *   touch an organization only when that check lets the person change it.\n   *\n   * `create-personal-organisation` and the two use cases of custom hardware\n   * sizing set it. The two use cases of custom hardware sizing do the second\n   * check in two ways:\n   *\n   * - Creating a plan, and unlinking a plan from one organization, read the\n   *   role of the person in that organization. Only an OWNER passes.\n   * - Deleting a plan reads no role. Console checks that the person created\n   *   the plan. Accounts reads the organizations that the person is a member\n   *   of, in any role, and removes the plan from their lists.\n   */\n  openToEveryone?: boolean\n  /**\n   * A use case with no approval that only a service of the fleet opens.\n   *\n   * The service holds `createPermission`, an m2m permission, and not\n   * `requiredPermission`. This flag lets that holder open and thus run a\n   * request with a floor of zero. `requiredPermission` then decides only who\n   * sees the requests and who can run a failed one again. Without a\n   * `createPermission` the flag lifts nothing.\n   *\n   * `cluster-ttl-deletion` sets it. The request exists for the record: the\n   * list, the entity pages and the audit trail show each deletion.\n   */\n  openedBySystem?: boolean\n}\n"],
-  "mappings": "AA0BO,MAAM,wBAAwB;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAmBO,MAAM,yBAAyB;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AACF;AAUO,MAAM,6BAA6B;AAcnC,MAAM,yBAAyB;AAU/B,MAAM,uBAAuB;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOO,MAAM,wBAGT,EAAE,MAAM,aAAa,OAAO,OAAO;AAShC,MAAM,6BAA6B;AAUnC,MAAM,oBAAoB;AAS1B,MAAM,6BAA6B;AAOnC,MAAM,2BAA2B;AAGjC,MAAM,2BAA2B;AAoBjC,MAAM,6BAA6B;AAwInC,MAAM,+BAA+B;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AA4CO,MAAM,mCAAmC;AAUzC,MAAM,wBAAwB,CAAC,WAAW,OAAO,MAAM;AAgCvD,MAAM,wBAAwB;AA8B9B,SAAS,iBACd,UACoB;AACpB,MAAI,CAAC,YAAY,SAAS,SAAS,GAAG;AACpC,WAAO;AAAA,EACT;AACA,SAAO,KAAK,IAAI,GAAG,SAAS,OAAO,SAAS,KAAK;AACnD;AASO,SAAS,aAAa,KAAqB,KAAoB;AACpE,MAAI,IAAI,WAAW,aAAa;AAC9B,WAAO;AAAA,EACT;AACA,QAAM,WAAW,IAAI,UAAU,aAAa,IAAI;AAChD,MAAI,CAAC,UAAU;AACb,WAAO;AAAA,EACT;AACA,SAAO,IAAI,QAAQ,IAAI,IAAI,KAAK,QAAQ,EAAE,QAAQ,IAAI;AACxD;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/**\n * The wire types of the generic approval mechanism.\n *\n * This file holds no logic and no dependency, because three consumers read it:\n * control-backend, control-frontend and cloudbot. The rules that read these\n * types are in `../approvals/policy.js`, and they are pure for the same reason.\n */\n\n/**\n * Every state that an approval request can hold.\n *\n * A `const` tuple, not an enum, so it is both the union type and the list that\n * validates a status filter at run time.\n *\n * The path of a request: `pending` until it reaches the threshold. Then\n * `executing` (automatic mode) or `approved` (explicit mode, which waits for a\n * person to press the button). `executed` or `failed` after the action ran. A\n * request that never reaches the threshold ends `rejected`, `withdrawn` or\n * `expired`.\n *\n * `scheduled` is a request that the service opened by itself, and that runs\n * at `runAt` with no approval. It does not expire, and nobody can withdraw or\n * reject it. A holder of its permissions can run it before `runAt`.\n */\nexport const APPROVAL_JOB_STATUSES = [\n  'pending',\n  'scheduled',\n  'approved',\n  'executing',\n  'executed',\n  'failed',\n  'rejected',\n  'withdrawn',\n  'expired',\n] as const\n\nexport type ApprovalJobStatus = (typeof APPROVAL_JOB_STATUSES)[number]\n\n/**\n * The states in which the action of a request is still COMING.\n *\n * `pending` waits for approvals, `scheduled` waits for its time, `approved`\n * waits for a person to press the button, and `executing` is running now. Each of them can still change the\n * world, so two requests for one target must not be in these states together.\n * `dedupeKey` reads this set for that reason.\n *\n * `failed` is NOT here, although a person can run a failed request again. A\n * failed request runs only when a person presses the button, and that person\n * sees the row. Blocking a new request on a failed one would also trap the\n * key: `canWithdraw` accepts `pending` alone, so nobody could close it.\n *\n * `executed`, `rejected`, `withdrawn` and `expired` are the end of a request.\n */\nexport const APPROVAL_LIVE_STATUSES = [\n  'pending',\n  'scheduled',\n  'approved',\n  'executing',\n] as const satisfies readonly ApprovalJobStatus[]\n\n/**\n * How many requests one page of the list holds when the caller asks for no\n * number.\n *\n * The list is a work queue that a Camundi reads, so the page is large: a\n * person wants the whole queue and not ten rows at a time. What the number is\n * for is the ceiling below.\n */\nexport const APPROVAL_PAGE_SIZE_DEFAULT = 500\n\n/**\n * The largest page that the service builds, and the largest that a caller may\n * ask for. The API answers 400 above it.\n *\n * The list had no limit at all. One authenticated caller could then make the\n * service read the whole table into memory, serialize it, and do it again, so\n * the cost of a request grew with the age of the service and with nothing that\n * the caller had to pay for. A ceiling turns that into a fixed cost.\n *\n * It is HERE and not only in the service, because the view must know it: a\n * page that asked for more would get a 400 instead of rows.\n */\nexport const APPROVAL_PAGE_SIZE_MAX = 2000\n\n/**\n * The columns that the queue can be ordered by.\n *\n * A NAME and not an SQL expression: the repository maps each one, so a caller\n * can never name a column that this list does not hold. `status` orders by the\n * EFFECTIVE status, because a `pending` row whose time ran out reads as\n * `expired` everywhere else.\n */\nexport const APPROVAL_SORT_FIELDS = [\n  'createdAt',\n  'expiresAt',\n  'status',\n  'type',\n  'createdBy',\n] as const\n\nexport type ApprovalSortField = (typeof APPROVAL_SORT_FIELDS)[number]\n\nexport type ApprovalSortOrder = 'asc' | 'desc'\n\n/** The default order of the queue: the newest request first. */\nexport const APPROVAL_SORT_DEFAULT: {\n  sort: ApprovalSortField\n  order: ApprovalSortOrder\n} = { sort: 'createdAt', order: 'desc' }\n\n/**\n * The longest reason that a request, a rejection or a withdrawal accepts.\n *\n * ONE number, because three routes of control-backend hold it and three fields\n * of control-frontend must stop there. A field that let a person write more\n * than the schema accepts turns their sentence into a 400 after they wrote it.\n */\nexport const APPROVAL_REASON_MAX_LENGTH = 2000\n\n/**\n * The largest number of approvals that a caller can ask for.\n *\n * A request that asks for 400 approvals can never reach them, so it is a\n * request that only fills the table and expires. The ceiling turns that into a\n * 400 at the moment a person types it. It is HERE because the form of the\n * bulk operation must stop at the same number as the route.\n */\nexport const APPROVAL_ACKS_MAX = 10\n\n/**\n * The longest search text that the list accepts.\n *\n * A search runs `ILIKE` over the payload of every visible row, so the cost of\n * one call follows the length of the text. Nothing a person types to find a\n * request is near this.\n */\nexport const APPROVAL_SEARCH_MAX_LENGTH = 200\n\n/**\n * APPROVAL_TYPE_FILTER_MAX is the most use case types that one `type` filter\n * names. The registry holds fewer, so the ceiling only stops a list with no\n * end. control-backend answers 400 above it.\n */\nexport const APPROVAL_TYPE_FILTER_MAX = 100\n\n/** APPROVAL_TYPE_MAX_LENGTH is the longest type that a `type` filter names. */\nexport const APPROVAL_TYPE_MAX_LENGTH = 200\n\n/**\n * The payload field that names the organization a request acts on.\n *\n * It is a CONVENTION, and this constant is what makes the convention readable\n * from both sides. A use case whose action hits one organization puts the id of\n * that organization in this field, and `GET /api/approvals?orgId=\u2026` then finds\n * the request with no knowledge of the use case. The filter reads this one\n * field of the payload, so it matches the whole id and nothing else. The free\n * text search reads the payload as TEXT, which also matches an id that only\n * appears inside another field, and it cannot answer \"the requests of this\n * organization\".\n *\n * The organization page of control-frontend does NOT read this field. It asks\n * the entity-link filter (`entityType=org`), which reads a row that\n * `relatedEntities` of a use case writes \u2014 see `ApprovalEntityRef`. The summary\n * is separate again: the `org` field of a `summarize` result is what a READER\n * follows.\n */\nexport const APPROVAL_PAYLOAD_ORG_FIELD = 'orgId'\n\n/**\n * How many requests each status and each use case type holds, for the filters\n * of the queue.\n *\n * Every status number answers the SAME question as the list beside it: the\n * counts are built with the visibility rule, the action filter and the search\n * text of the caller, and with the lazy expiry. A count that ignored one of\n * those would send a person to a filter that then shows nothing. `byType` is\n * the exception: see its own note.\n */\nexport interface ApprovalStatusCountsDto {\n  /** Every request that matches, whatever its status. */\n  all: number\n  /** One number for each status. A status with no request is 0, never absent. */\n  byStatus: Record<ApprovalJobStatus, number>\n  /**\n   * One number for each use case type, over every status.\n   *\n   * It ignores the type filter, so a type facet keeps its number while it is\n   * on or off. Every other filter applies. A type with no request has no key,\n   * so read a missing key as 0, and read only an own key: a type id such as\n   * `__proto__` must not reach the prototype.\n   *\n   * Optional, because an older control-backend does not send it. Read an\n   * absent field as no counts.\n   */\n  byType?: Record<string, number>\n}\n\n/**\n * What happens when a request reaches its threshold.\n *\n * `auto` runs the action immediately. `explicit` holds the request at\n * `approved` and waits for a person to run it.\n */\nexport type ApprovalExecutionMode = 'auto' | 'explicit'\n\n/**\n * WHERE the action runs. It is a separate question from who starts it.\n *\n * - `inline` runs the action inside the call that started it, and the answer\n *   already carries the outcome. Right for one call to another service.\n * - `background` answers as soon as the request is claimed, and the action\n *   runs on. It reports into `ApprovalJobDto.progress`, and the row is the\n *   only place that holds the progress, so a reload and a second person read\n *   the same numbers. A pod that stops loses the run, and the reconciler of\n *   control-backend recovers the row.\n *\n * An action over thousands of targets MUST be `background`. `inline` would\n * hold one HTTP request for the whole run, and the ingress, the load balancer\n * and the browser each have their own deadline before it finishes.\n *\n * An `inline` action must not read `context.signal`. The runner trusts the\n * result of an `inline` action that returns after a drain, and it would count\n * a partial run as `executed`. An action that stops between targets is\n * `background`.\n */\nexport type ApprovalActionMode = 'inline' | 'background'\n\n/**\n * A person, as an approval request records them.\n *\n * Both keys are kept. The machine then never has to choose one identity key,\n * which is what split the earlier acknowledgement flows: some held an email and\n * some held a user id, and the two could not be compared.\n */\nexport interface ApprovalActor {\n  userId: string\n  email: string\n}\n\nexport interface ApprovalAck extends ApprovalActor {\n  /** An ISO timestamp. It is in a json column, so it is a string, not a Date. */\n  date: string\n}\n\n/**\n * Who asked for an action, and who agreed to it.\n *\n * Every route of `api/admin/approvals` takes this envelope, and control-backend\n * builds it from the request that it runs. The envelope exists because the\n * token cannot carry it: the call is machine to machine, so `sub` holds the id\n * of the Auth0 application and not a person. A service that reads the token\n * alone therefore writes \"control-backend\" into its audit record, which hides\n * the two Camundis that the whole mechanism exists to record.\n *\n * `approvedBy` is a list, because a use case can need more than one approval,\n * and the record must name all of them. It can also be EMPTY: how many\n * approvals an action needs is a number of the use case, and `move-cluster-org`\n * holds zero on purpose. The person in `requestedBy` is never in the list: the\n * four-eyes rule is that the person who asks is not the person who agrees, and\n * control-backend holds that rule.\n *\n * Each person carries both keys of `ApprovalActor`. The email is what a route\n * uses to ask Auth0 about the person, and the user id is what an audit record\n * holds, because every other record of the fleet holds an Auth0 `sub`.\n *\n * CAUTION: The envelope is a CLAIM of the caller, and not proof. A route that\n * acts on it must ask Auth0 again whether `requestedBy` may do the action.\n * That means the permission of the action. For a use case with\n * `openToEveryone`, it means that the person is a Camundi, because no\n * permission runs that action. `api/admin/approvals` in accounts-backend does\n * that. See the note on `M2M_CONTROL_APPROVALS`.\n */\nexport interface ApprovalM2mActor {\n  /** The id of the approval request, to join the records of both services. */\n  requestId: string\n  /** The Camundi who opened the request. */\n  requestedBy: ApprovalActor\n  /** The Camundis who approved it. Empty when the use case needs none. */\n  approvedBy: ApprovalActor[]\n  /**\n   * The Camundi who ran the request with an approval override grant, in\n   * place of the approvals that it still needed. Absent for every other run.\n   *\n   * control-backend checked the grant, the permissions of this person and\n   * `APPROVAL_OVERRIDE_DENYLIST` before the run. A receiver that counts the\n   * approvals of an overridable type accepts this person in place of the\n   * approvals that are missing, and refuses this field for every other type.\n   * This person can be the person in `requestedBy`, because that is what a\n   * grant is for. A receiver that refuses the target of an action as an\n   * approver refuses this person as well, also when they asked.\n   */\n  overriddenBy?: ApprovalActor\n}\n\n/**\n * What one value of a summary field is.\n *\n * `text` is what a person reads. `id` is what a link points at, and it is\n * absent when the kind names no entity. The two are separate because the text\n * is a COPY that the request keeps: an organization that gets a new name after\n * the request was opened must still read as the organization that the person\n * chose.\n */\nexport interface ApprovalSummaryValue {\n  text: string\n  id?: string\n}\n\n/**\n * How a reader must render one field of a summary.\n *\n * `org`, `cluster` and `user` name an entity, so a reader can link to it and\n * can resolve a fresh name. The others are plain: `date` is an ISO timestamp,\n * and `code` is a value that must keep its characters, such as a json fragment.\n */\nexport const APPROVAL_SUMMARY_FIELD_KINDS = [\n  'text',\n  'number',\n  'boolean',\n  'date',\n  'org',\n  'cluster',\n  'user',\n  'code',\n] as const\n\nexport type ApprovalSummaryFieldKind =\n  (typeof APPROVAL_SUMMARY_FIELD_KINDS)[number]\n\n/**\n * One labelled field of the payload of a request.\n *\n * This is what makes ONE view able to show EVERY use case. The payload of a\n * request is an object of anything, so a generic view can only print it as\n * json. The use case turns it into labelled fields here, and the view renders\n * a field by its kind: it links an `org`, it formats a `date`, and it lists\n * 300 clusters as 300 links.\n *\n * `values` is always an array. A field that holds one value holds an array of\n * one, so a reader needs no branch for \"one or many\".\n */\nexport interface ApprovalSummaryField {\n  label: string\n  kind: ApprovalSummaryFieldKind\n  values: ApprovalSummaryValue[]\n  /**\n   * The values that this request replaces, for a field that changes. A view\n   * shows them as removed beside `values` as added. A field with no\n   * `previous` is not a change.\n   */\n  previous?: ApprovalSummaryValue[]\n  /** The count of `previous`, when the list cut it. Like `total`, for `previous`. */\n  previousTotal?: number\n  /**\n   * How many values the field holds, when `values` holds only the first of\n   * them. The list route cuts every field to `APPROVAL_LIST_SUMMARY_VALUES_MAX`\n   * values. The detail route sends every value and no `total`.\n   */\n  total?: number\n}\n\n/**\n * How many values of one summary field a row of the list carries.\n *\n * A bulk operation names up to 3000 clusters in one field. A page of 100 such\n * rows would carry 300,000 values that no row shows. The view shows at most\n * 12 values of a field, so the list stops there, and `total` holds the count.\n */\nexport const APPROVAL_LIST_SUMMARY_VALUES_MAX = 12\n\n/**\n * The kinds of entity that an approval request can concern.\n *\n * These are the entities that a request is findable by: the org and cluster\n * detail pages ask \"which requests touch me\", and the answer reads a row for\n * each entity. It is a subset of `APPROVAL_SUMMARY_FIELD_KINDS` \u2014 the kinds that\n * name an entity \u2014 because only those carry an id that a page can match.\n */\nexport const APPROVAL_ENTITY_TYPES = ['cluster', 'org', 'user'] as const\n\nexport type ApprovalEntityType = (typeof APPROVAL_ENTITY_TYPES)[number]\n\n/**\n * One entity that an approval request concerns.\n *\n * A use case reports these from its payload, and the service writes one row for\n * each into `approval_job_entity`. That row is what makes a request findable by\n * an entity it touches, without a text search over the payload: a cluster-move\n * request names its cluster, its target organization AND its source\n * organization, so it shows on all three detail pages. The `summary` still\n * carries the words a reader sees; this carries only the ids a page matches.\n */\nexport interface ApprovalEntityRef {\n  type: ApprovalEntityType\n  id: string\n}\n\n/**\n * How long a run may go quiet before a reader calls it stalled.\n *\n * The pod that runs an action writes its progress and renews its lease on one\n * timer, so a healthy run touches the row well inside this window. A row that\n * is `executing` and older than this held a pod that stopped, and the\n * reconciler of control-backend is on its way to it.\n *\n * It lives here, and not in the config of the service, because a READER needs\n * it: the browser must decide what to show without a second call, and a number\n * that only the backend knew would make the two disagree. `ACTION_LEASE_MS` in\n * `config/index.ts` is held below this on purpose.\n */\nexport const APPROVAL_RUN_STALE_MS = 120_000\n\n/**\n * What an action reports while it runs.\n *\n * This is what makes a long action watchable. Every field is in the DATABASE\n * and not in the answer to the call that started the run, so three readers see\n * the same thing: the person who pressed the button, the same person after a\n * reload, and a second person who opens the request.\n *\n * `total` can be 0 while an action counts its targets, and it stays 0 for an\n * action that cannot count them. A reader must then show that it runs, and no\n * percentage.\n */\nexport interface ApprovalProgress {\n  /** Targets in total. 0 means the action did not say. */\n  total: number\n  /** Targets finished, whatever the outcome of each one. */\n  done: number\n  /** Targets that finished with an error. Part of `done`. */\n  failed: number\n  /** One short line for a person, such as the step that runs now. */\n  note?: string\n  /** An ISO timestamp: when the run started. */\n  startedAt: string\n  /** An ISO timestamp: when the run last wrote anything. */\n  updatedAt: string\n}\n\n/** The share of the work that is finished, or `undefined` with no total. */\nexport function progressFraction(\n  progress: ApprovalProgress | undefined,\n): number | undefined {\n  if (!progress || progress.total <= 0) {\n    return undefined\n  }\n  return Math.min(1, progress.done / progress.total)\n}\n\n/**\n * Reports whether a running request went quiet.\n *\n * True means that the pod which held the run stopped, or lost the row. It does\n * NOT mean that the action failed: the reconciler either runs it again, or it\n * writes `failed` so that a person can. See `APPROVAL_RUN_STALE_MS`.\n */\nexport function isRunStalled(job: ApprovalJobDto, now: Date): boolean {\n  if (job.status !== 'executing') {\n    return false\n  }\n  const lastSign = job.progress?.updatedAt ?? job.executingSince\n  if (!lastSign) {\n    return false\n  }\n  return now.getTime() - new Date(lastSign).getTime() > APPROVAL_RUN_STALE_MS\n}\n\n/** One approval request, as the API returns it. */\nexport interface ApprovalJobDto {\n  id: string\n  type: string\n  dedupeKey?: string\n  payload: Record<string, unknown>\n  /**\n   * The payload as labelled fields. See `ApprovalSummaryField`.\n   *\n   * The use case builds it when the request is opened AND every time the\n   * request is read, so a field that a later version of the use case adds\n   * appears on a request that is already open.\n   */\n  summary: ApprovalSummaryField[]\n  /** Why the person opened the request. Some use cases demand one. */\n  reason?: string\n  createdBy: ApprovalActor\n  acks: ApprovalAck[]\n  /**\n   * How many approvals THIS request needs.\n   *\n   * It is on the request and not only on the use case, because the person who\n   * opens one can ask for more than the floor of the use case. A bulk\n   * operation over 3000 clusters is the same action as one over 3, and it can\n   * still deserve a third pair of eyes. `ApprovalUseCaseDto.minAcks` is the\n   * floor that a caller cannot go below.\n   */\n  requiredAcks: number\n  /**\n   * What a person must hold to approve, reject or run THIS request.\n   *\n   * It is on the request and not only on the use case, because a payload can\n   * raise the guard: a generation update with `yoloForceUpdate` needs the yolo\n   * permission on top of the base one, and the same use case without the flag\n   * does not. The set is computed ONE time, when the request is opened, so it\n   * is also the record of what the request was guarded by.\n   *\n   * A person needs EVERY permission in the set, not one of them.\n   */\n  requiredPermissions: string[]\n  executionMode: ApprovalExecutionMode\n  actionMode: ApprovalActionMode\n  status: ApprovalJobStatus\n  closedBy?: ApprovalActor\n  closedReason?: string\n  /** An ISO timestamp. */\n  expiresAt: string\n  /**\n   * An ISO timestamp: when the current run took the request.\n   *\n   * It is set every time a run starts, so a run that the reconciler starts\n   * again moves it. `attempts` says how many runs there were.\n   */\n  executingSince?: string\n  /** How many times a run started. A recovery raises it. */\n  attempts: number\n  /**\n   * What the action reports while it runs. See `ApprovalProgress`.\n   *\n   * It stays on the row after the run, so the record of a finished run says\n   * how many targets it touched and how many refused.\n   */\n  progress?: ApprovalProgress\n  executedAt?: string\n  executionError?: string\n  /**\n   * What the action reported when it ran.\n   *\n   * The shape belongs to the use case. An action over many targets puts the\n   * result of each target here, which is the difference between \"it failed\"\n   * and \"it did 2998 of 3000, and these two refused\".\n   */\n  executionResult?: Record<string, unknown>\n  /** An ISO timestamp: when a `scheduled` request runs by itself. */\n  runAt?: string\n  /**\n   * The person who ran this request with an approval override grant, in\n   * place of the approvals that it still needed. See `canOverride`.\n   */\n  overriddenBy?: ApprovalActor\n  /**\n   * An ISO timestamp: when that person used the override. The run window of\n   * an overridden request starts here. See `runWindowEnd`.\n   */\n  overriddenAt?: string\n  /** Why that person used the override. It is necessary. */\n  overrideReason?: string\n  /**\n   * The approval override grant that the override used. A later run needs\n   * this grant to be active still. See `canRunOverridden`.\n   */\n  overrideGrantId?: string\n  createdAt: string\n  updatedAt: string\n}\n\n/**\n * One approval override grant, as the API returns it.\n *\n * A grant lets one Camundi run a `pending` request of an overridable use case\n * with no approval, until `expiresAt`. A grant is active while `revokedAt` is\n * absent and `expiresAt` is in the future. See `isOverrideGrantActive`.\n */\nexport interface ApprovalOverrideGrantDto {\n  id: string\n  /** The Auth0 `sub` of the person who holds the grant. */\n  userId: string\n  email: string\n  /** The `grant-approval-override` request that made this grant. */\n  grantedByJobId: string\n  /** The `revoke-approval-override` request that ends this grant. */\n  revokeJobId?: string\n  reason: string\n  /** An ISO timestamp. */\n  createdAt: string\n  /** An ISO timestamp. The grant ends here, also when no revoke ran. */\n  expiresAt: string\n  /** An ISO timestamp: when the revoke request ran. */\n  revokedAt?: string\n  revokedByJobId?: string\n}\n\n/**\n * What a use case is, as the API reports it.\n *\n * The frontend needs `requiredPermission` to run the same rule as the backend.\n * PR #9301 kept this registry a second time, by hand, in the frontend. A\n * registry that the server owns means a new use case needs no frontend deploy.\n */\nexport interface ApprovalUseCaseDto {\n  type: string\n  /** A short name for a person to read. */\n  label: string\n  /** One sentence: what the action does, and what it cannot undo. */\n  description: string\n  /** The approvals a new request asks for when the caller names no number. */\n  defaultAcks: number\n  /**\n   * The floor. A caller can ask for more approvals, never for fewer.\n   *\n   * It is a separate number from `defaultAcks` because the two answer\n   * different questions: the default is what the form offers, and the floor is\n   * what the service refuses to go below.\n   */\n  minAcks: number\n  ttlDays: number\n  executionMode: ApprovalExecutionMode\n  /** See `ApprovalActionMode`. An action over many targets is `background`. */\n  actionMode: ApprovalActionMode\n  /**\n   * True when a run that was interrupted can start again by itself.\n   *\n   * It is a promise about the ACTION, and the reconciler reads it. Set it only\n   * when the action can run a second time over the same payload and do no harm\n   * twice: it must read what the first run already finished, out of\n   * `ApprovalJobDto.executionResult`, and skip it.\n   *\n   * False, the default, is the safe answer. An interrupted run then lands in\n   * `failed`, which a person can run again from the detail page, and a person\n   * decides whether running it twice is safe.\n   */\n  resumable: boolean\n  /**\n   * The permission that every request of this use case needs to approve,\n   * reject or run. A payload can add more. See\n   * `ApprovalJobDto.requiredPermissions`, which is the effective set.\n   *\n   * It is also the permission to SEE a request of this use case, because a\n   * person who cannot act on one has no reason to read it. The person who\n   * opened a request always sees that request.\n   *\n   * The one exception to \"or run\" is a use case with `openToEveryone`. It has\n   * no approval, so this permission only decides who sees the requests of\n   * other people. Any signed-in person can open and run such a request.\n   */\n  requiredPermission: string\n  /**\n   * The permission to open a request. Absent means any signed-in Camundi.\n   *\n   * Set it when the pool that can ASK must be as small as the pool that can\n   * approve. Leave it absent when the approvals alone are the guard, and the\n   * proposal is not.\n   */\n  createPermission?: string\n  /** True when a request cannot be opened without a reason. */\n  reasonRequired: boolean\n  /**\n   * True when the ACTION needs the email address of the person who asked.\n   *\n   * A token can carry no address, and the row then stores\n   * `UNKNOWN_ACTOR_EMAIL`. An action that sends that placeholder to another\n   * service asks it to find a user that does not exist, so the request can\n   * only fail \u2014 and it fails at the END, after other people spent their\n   * approvals on it. A use case that carries the creator into its call sets\n   * this, and `canCreate` then refuses such a caller at the start.\n   *\n   * `extend-trial` and `send-to-expired-trial` are two: both send the creator\n   * to accounts in an `ApprovalM2mActor`, and accounts reads the permissions\n   * of that person again before it acts.\n   *\n   * `move-cluster-org` does NOT set this. Its envelope reaches console, which\n   * reads the user id alone and needs no address.\n   */\n  creatorEmailRequired?: boolean\n  /**\n   * A use case with no approval that any signed-in person can open AND run.\n   *\n   * A request with a floor of zero runs when it is opened, so `canCreate`\n   * asks the person to hold `requiredPermission`. This flag lifts that one\n   * rule, for an action whose run needs no permission of the person. Set it\n   * only when two things hold:\n   *\n   * - Something else bounds how often a person can ask.\n   * - The service that runs the action authorizes the person again at its\n   *   source, so that nobody can change what is not theirs. The action can\n   *   touch an organization only when that check lets the person change it.\n   *\n   * `create-personal-organisation` and the two use cases of custom hardware\n   * sizing set it. The two use cases of custom hardware sizing do the second\n   * check in three ways:\n   *\n   * - Creating a plan, and unlinking a plan from one organization, read the\n   *   role of the person in that organization. Only an OWNER passes.\n   * - Linking an existing plan to an organization reads the same role.\n   *   Only an OWNER passes. The dedupe key is the only bound on how often a\n   *   person can ask for a link.\n   * - Deleting a plan reads no role. Console checks that the person created\n   *   the plan. Accounts reads the organizations that the person is a member\n   *   of, in any role, and removes the plan from their lists.\n   */\n  openToEveryone?: boolean\n  /**\n   * A use case with no approval that only a service of the fleet opens.\n   *\n   * The service holds `createPermission`, an m2m permission, and not\n   * `requiredPermission`. This flag lets that holder open and thus run a\n   * request with a floor of zero. `requiredPermission` then decides only who\n   * sees the requests and who can run a failed one again. Without a\n   * `createPermission` the flag lifts nothing.\n   *\n   * `cluster-ttl-deletion` sets it. The request exists for the record: the\n   * list, the entity pages and the audit trail show each deletion.\n   */\n  openedBySystem?: boolean\n}\n"],
+  "mappings": "AA8BO,MAAM,wBAAwB;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAmBO,MAAM,yBAAyB;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAUO,MAAM,6BAA6B;AAcnC,MAAM,yBAAyB;AAU/B,MAAM,uBAAuB;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOO,MAAM,wBAGT,EAAE,MAAM,aAAa,OAAO,OAAO;AAShC,MAAM,6BAA6B;AAUnC,MAAM,oBAAoB;AAS1B,MAAM,6BAA6B;AAOnC,MAAM,2BAA2B;AAGjC,MAAM,2BAA2B;AAoBjC,MAAM,6BAA6B;AAqJnC,MAAM,+BAA+B;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AA4CO,MAAM,mCAAmC;AAUzC,MAAM,wBAAwB,CAAC,WAAW,OAAO,MAAM;AAgCvD,MAAM,wBAAwB;AA8B9B,SAAS,iBACd,UACoB;AACpB,MAAI,CAAC,YAAY,SAAS,SAAS,GAAG;AACpC,WAAO;AAAA,EACT;AACA,SAAO,KAAK,IAAI,GAAG,SAAS,OAAO,SAAS,KAAK;AACnD;AASO,SAAS,aAAa,KAAqB,KAAoB;AACpE,MAAI,IAAI,WAAW,aAAa;AAC9B,WAAO;AAAA,EACT;AACA,QAAM,WAAW,IAAI,UAAU,aAAa,IAAI;AAChD,MAAI,CAAC,UAAU;AACb,WAAO;AAAA,EACT;AACA,SAAO,IAAI,QAAQ,IAAI,IAAI,KAAK,QAAQ,EAAE,QAAQ,IAAI;AACxD;",
   "names": []
 }

package/dist/dtos/ApprovalSummaryNames.dto.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The body of `POST api/admin/approvals/summary-names` of console-backend.
+ *
+ * control-backend sends it when a request opens. The summary of a request
+ * then shows the names that console holds, and never a name that the person
+ * who asked typed.
+ */
+export interface ApprovalSummaryNamesRequest {
+    /** At most `CLUSTER_BULK_OPERATION_MAX_CLUSTERS` ids. */
+    clusterIds: string[];
+    /** At most `GENERATION_VERSIONS_MAX_GENERATIONS` ids. */
+    generationIds: string[];
+}
+/**
+ * The answer of `POST api/admin/approvals/summary-names`. An id that console
+ * does not know is not in the answer.
+ */
+export interface ApprovalSummaryNamesResult {
+    clusters: {
+        id: string;
+        name: string;
+    }[];
+    /** `clusterCount` is the number of clusters that run the generation now. */
+    generations: {
+        id: string;
+        name: string;
+        clusterCount: number;
+    }[];
+}
+/**
+ * The answer of `GET api/admin/approvals/organizations/:orgId/name` of
+ * accounts-backend.
+ */
+export interface ApprovalOrganizationNameResult {
+    id: string;
+    name: string;
+}