@camunda/ccma-shared-types 12.8.0 → 12.9.0

package/dist/approvals/approval-rules.d.ts

@@ -132,6 +132,10 @@ export declare const APPROVAL_RULES: {
     readonly "change-generation-versions": {
         readonly prod: 2;
     };
+    readonly "change-org-reservations": {
+        readonly prod: 2;
+        readonly testStages: 1;
+    };
     readonly "cluster-bulk-generation-update": {
         readonly prod: 2;
         readonly testStages: 1;

package/dist/approvals/approval-rules.js

@@ -42,6 +42,10 @@ const APPROVAL_RULES = {
   [T.moveClusterOrg]: { prod: 2 },
   [T.editGeneration]: { prod: 2 },
   [T.changeGenerationVersions]: { prod: 2 },
+  // A reservation is a commercial commitment that the customer pays for, and
+  // the force path skips every check of the sales plan. Four eyes on prod.
+  // On the test stages a holder does it alone, as the direct route did.
+  [T.changeOrgReservations]: { prod: 2, testStages: 1 },
   // One decision changes many clusters. A deletion cannot be undone, so it
   // needs six eyes on prod. On the test stages, the opener runs every other
   // type alone: the console team rolls out generations there with no second

package/dist/approvals/approval-rules.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/approvals/approval-rules.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type { Stage } from '../constants/misc.const.js'\nimport {\n  type ApprovalUseCaseType,\n  APPROVAL_USE_CASE_TYPES as T,\n} from './use-cases.const.js'\n\n/**\n * The approvals of one type of request.\n *\n * The count is the number of approvals from holders of the run permissions of\n * the request (`requiredPermissions`). The opener counts too: when the opener\n * holds every run permission, the request gets the approval of the opener\n * when it is created. The opener cannot approve the request by hand\n * (`canAcknowledge`).\n */\nexport interface ApprovalRule {\n  /** The approvals on prod. */\n  prod: number\n  /** The approvals on int, and on dev and local unless `dev` is set. When it is not set, `prod` applies. */\n  testStages?: number\n  /** The approvals on dev and local. When it is not set, `testStages` applies. */\n  dev?: number\n}\n\n/**\n * How many approvals each type of request needs. This table is the one source\n * of that number, for control-backend, control-frontend, and the routes of\n * accounts and console that run an approved action.\n *\n * - **0**: no approval. Only a holder, or a person whom the use case opens the\n *   request to, can open it.\n * - **1**: a holder does the action alone. The request of a holder runs when\n *   it is created. The request of a person who is not a holder waits for one\n *   holder.\n * - **2**: four eyes. The request of a holder waits for one other holder. The\n *   request of a person who is not a holder waits for two holders.\n * - **3**: six eyes on prod.\n *\n * Before #10483 a use case counted only the approvals of people other than\n * the opener. Thus an old count and a count of this table are not the same\n * unit.\n */\nexport const APPROVAL_RULES = {\n  // No approval. A use case that is open to every Camundi, or that only a\n  // system opens.\n  [T.clusterTtlDeletion]: { prod: 0 },\n  [T.createPersonalOrganisation]: { prod: 0 },\n  [T.createCustomHardwareSizing]: { prod: 0 },\n  [T.removeCustomHardwareSizing]: { prod: 0 },\n  [T.createCustomGeneration]: { prod: 0 },\n  [T.removeCustomGeneration]: { prod: 0 },\n  [T.selfServiceClusterModification]: { prod: 0 },\n  // Only the run of a grant opens it, as the system, and it runs by itself at\n  // the end of the grant. Ending a grant takes power away.\n  [T.revokeApprovalOverride]: { prod: 0 },\n\n  // A holder does it alone. Before #10483 a holder did these actions in\n  // accounts-frontend or console-frontend with no second person.\n  [T.extendTrial]: { prod: 1 },\n  [T.changeOrgLimits]: { prod: 1 },\n  [T.llmBudgetTopUp]: { prod: 1 },\n  [T.changeSalesPlan]: { prod: 1 },\n  [T.requestInNegotiation]: { prod: 1 },\n  [T.onboardToEnterprise]: { prod: 1 },\n  [T.automatedEnterpriseOnboarding]: { prod: 1 },\n  [T.changeClusterPlanType]: { prod: 1 },\n  [T.deleteInternalBackup]: { prod: 1 },\n  [T.releaseTrainPublish]: { prod: 1 },\n  [T.releaseTrainRollback]: { prod: 1 },\n\n  // Four eyes. The action removes data or access, changes a person, moves a\n  // cluster to another customer, or restarts every cluster of a generation.\n  [T.changePlatformRoles]: { prod: 2 },\n  [T.changeUserEmail]: { prod: 2 },\n  [T.deleteUser]: { prod: 2 },\n  [T.removeOrgMember]: { prod: 2 },\n  [T.purgeUsers]: { prod: 2 },\n  [T.updateUserMetadata]: { prod: 2 },\n  [T.deleteOrganization]: { prod: 2 },\n  [T.sendToExpiredTrial]: { prod: 2 },\n  [T.deleteSsoConnection]: { prod: 2 },\n  [T.deleteApiClient]: { prod: 2 },\n  [T.moveClusterOrg]: { prod: 2 },\n  [T.editGeneration]: { prod: 2 },\n  [T.changeGenerationVersions]: { prod: 2 },\n\n  // One decision changes many clusters. A deletion cannot be undone, so it\n  // needs six eyes on prod. On the test stages, the opener runs every other\n  // type alone: the console team rolls out generations there with no second\n  // person.\n  [T.clusterBulkGenerationUpdate]: { prod: 2, testStages: 1 },\n  [T.clusterBulkPlanUpdate]: { prod: 2, testStages: 1 },\n  [T.clusterBulkPlanTypeUpdate]: { prod: 2, testStages: 1 },\n  [T.clusterBulkSleepWakeup]: { prod: 2, testStages: 1 },\n  [T.clusterBulkSpecUpdate]: { prod: 2, testStages: 1 },\n  [T.clusterBulkDeletion]: { prod: 3, testStages: 2 },\n  [T.deleteClusterCorpses]: { prod: 3, testStages: 2 },\n  [T.forceDeleteClusterPlanType]: { prod: 3, testStages: 2 },\n  // The contract of an enterprise customer sets what the customer pays for.\n  // On prod the opener and one other holder. On the test stages a holder\n  // changes a test contract alone.\n  [T.changeEnterpriseContract]: { prod: 2, testStages: 1 },\n  // A shorter retention limit deletes the old data of every cluster of the\n  // plan type.\n  [T.changePlanTypeRetentionLimits]: { prod: 3, testStages: 2 },\n\n  // A generation upgrade of one cluster that skips the upgrade graph\n  // (`--yolo`) or the upgrade gate. The gate keeps an upgrade from a cluster\n  // that has not finished its last migration, so a forced upgrade on prod\n  // needs the opener and one other holder. On the test stages the opener\n  // runs it alone.\n  [T.forceGenerationUpgrade]: { prod: 2, testStages: 1 },\n  // The deletion of the managed LLM tenant removes the key and the spend\n  // history, and nothing brings them back. Four eyes on prod. On the test\n  // stages the opener does it alone, as the direct route did before.\n  [T.deleteManagedLlmTenant]: { prod: 2, testStages: 1 },\n\n  // A flag of prod turns a feature on or off for every customer.\n  [T.changeFeatureFlag]: { prod: 3, testStages: 2 },\n  // Turning a flag off lowers the risk, thus it needs fewer approvals than a\n  // change. On prod the opener with `aafw` gives one, and one other holder\n  // gives the second. On int the opener with `aafw` does it alone. On dev\n  // and local no approval is needed: opening the request runs it.\n  [T.disableFeatureFlag]: { prod: 2, testStages: 1, dev: 0 },\n\n  // The licensing model sets which value metrics an enterprise customer pays\n  // for. On prod the opener and one other holder. On the test stages a holder\n  // changes a test organization alone.\n  [T.changeLicensingModel]: { prod: 2, testStages: 1 },\n\n  // A grant lets one Camundi run many requests with no second person. The\n  // opener and one other holder, on every stage. The grantee approves\n  // neither by hand nor when they open it, thus a grant for oneself needs\n  // two other holders. The console team has three people, so a third\n  // approval would block a grant for oneself.\n  [T.grantApprovalOverride]: { prod: 2 },\n} as const satisfies Record<ApprovalUseCaseType, ApprovalRule>\n\n/** The types whose count on the test stages is not the count on prod. */\nexport type StageDependentApprovalType = {\n  [K in ApprovalUseCaseType]: (typeof APPROVAL_RULES)[K] extends {\n    testStages: number\n  }\n    ? K\n    : (typeof APPROVAL_RULES)[K] extends { dev: number }\n      ? K\n      : never\n}[ApprovalUseCaseType]\n\n/** The approvals that a request of `type` needs on `stage`. */\nexport function approvalsRequiredFor(\n  type: ApprovalUseCaseType,\n  stage: Stage,\n): number {\n  const rule: ApprovalRule = APPROVAL_RULES[type]\n  if (stage === 'prod') {\n    return rule.prod\n  }\n  const testStages = rule.testStages ?? rule.prod\n  return stage === 'int' ? testStages : (rule.dev ?? testStages)\n}\n"],
-  "mappings": "AAOA;AAAA,EAEE,2BAA2B;AAAA,OACtB;AAsCA,MAAM,iBAAiB;AAAA;AAAA;AAAA,EAG5B,CAAC,EAAE,kBAAkB,GAAG,EAAE,MAAM,EAAE;AAAA,EAClC,CAAC,EAAE,0BAA0B,GAAG,EAAE,MAAM,EAAE;AAAA,EAC1C,CAAC,EAAE,0BAA0B,GAAG,EAAE,MAAM,EAAE;AAAA,EAC1C,CAAC,EAAE,0BAA0B,GAAG,EAAE,MAAM,EAAE;AAAA,EAC1C,CAAC,EAAE,sBAAsB,GAAG,EAAE,MAAM,EAAE;AAAA,EACtC,CAAC,EAAE,sBAAsB,GAAG,EAAE,MAAM,EAAE;AAAA,EACtC,CAAC,EAAE,8BAA8B,GAAG,EAAE,MAAM,EAAE;AAAA;AAAA;AAAA,EAG9C,CAAC,EAAE,sBAAsB,GAAG,EAAE,MAAM,EAAE;AAAA;AAAA;AAAA,EAItC,CAAC,EAAE,WAAW,GAAG,EAAE,MAAM,EAAE;AAAA,EAC3B,CAAC,EAAE,eAAe,GAAG,EAAE,MAAM,EAAE;AAAA,EAC/B,CAAC,EAAE,cAAc,GAAG,EAAE,MAAM,EAAE;AAAA,EAC9B,CAAC,EAAE,eAAe,GAAG,EAAE,MAAM,EAAE;AAAA,EAC/B,CAAC,EAAE,oBAAoB,GAAG,EAAE,MAAM,EAAE;AAAA,EACpC,CAAC,EAAE,mBAAmB,GAAG,EAAE,MAAM,EAAE;AAAA,EACnC,CAAC,EAAE,6BAA6B,GAAG,EAAE,MAAM,EAAE;AAAA,EAC7C,CAAC,EAAE,qBAAqB,GAAG,EAAE,MAAM,EAAE;AAAA,EACrC,CAAC,EAAE,oBAAoB,GAAG,EAAE,MAAM,EAAE;AAAA,EACpC,CAAC,EAAE,mBAAmB,GAAG,EAAE,MAAM,EAAE;AAAA,EACnC,CAAC,EAAE,oBAAoB,GAAG,EAAE,MAAM,EAAE;AAAA;AAAA;AAAA,EAIpC,CAAC,EAAE,mBAAmB,GAAG,EAAE,MAAM,EAAE;AAAA,EACnC,CAAC,EAAE,eAAe,GAAG,EAAE,MAAM,EAAE;AAAA,EAC/B,CAAC,EAAE,UAAU,GAAG,EAAE,MAAM,EAAE;AAAA,EAC1B,CAAC,EAAE,eAAe,GAAG,EAAE,MAAM,EAAE;AAAA,EAC/B,CAAC,EAAE,UAAU,GAAG,EAAE,MAAM,EAAE;AAAA,EAC1B,CAAC,EAAE,kBAAkB,GAAG,EAAE,MAAM,EAAE;AAAA,EAClC,CAAC,EAAE,kBAAkB,GAAG,EAAE,MAAM,EAAE;AAAA,EAClC,CAAC,EAAE,kBAAkB,GAAG,EAAE,MAAM,EAAE;AAAA,EAClC,CAAC,EAAE,mBAAmB,GAAG,EAAE,MAAM,EAAE;AAAA,EACnC,CAAC,EAAE,eAAe,GAAG,EAAE,MAAM,EAAE;AAAA,EAC/B,CAAC,EAAE,cAAc,GAAG,EAAE,MAAM,EAAE;AAAA,EAC9B,CAAC,EAAE,cAAc,GAAG,EAAE,MAAM,EAAE;AAAA,EAC9B,CAAC,EAAE,wBAAwB,GAAG,EAAE,MAAM,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMxC,CAAC,EAAE,2BAA2B,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA,EAC1D,CAAC,EAAE,qBAAqB,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA,EACpD,CAAC,EAAE,yBAAyB,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA,EACxD,CAAC,EAAE,sBAAsB,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA,EACrD,CAAC,EAAE,qBAAqB,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA,EACpD,CAAC,EAAE,mBAAmB,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA,EAClD,CAAC,EAAE,oBAAoB,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA,EACnD,CAAC,EAAE,0BAA0B,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA;AAAA;AAAA;AAAA,EAIzD,CAAC,EAAE,wBAAwB,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA;AAAA;AAAA,EAGvD,CAAC,EAAE,6BAA6B,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO5D,CAAC,EAAE,sBAAsB,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA;AAAA;AAAA;AAAA,EAIrD,CAAC,EAAE,sBAAsB,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA;AAAA,EAGrD,CAAC,EAAE,iBAAiB,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA,EAKhD,CAAC,EAAE,kBAAkB,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,KAAK,EAAE;AAAA;AAAA;AAAA;AAAA,EAKzD,CAAC,EAAE,oBAAoB,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOnD,CAAC,EAAE,qBAAqB,GAAG,EAAE,MAAM,EAAE;AACvC;AAcO,SAAS,qBACd,MACA,OACQ;AACR,QAAM,OAAqB,eAAe,IAAI;AAC9C,MAAI,UAAU,QAAQ;AACpB,WAAO,KAAK;AAAA,EACd;AACA,QAAM,aAAa,KAAK,cAAc,KAAK;AAC3C,SAAO,UAAU,QAAQ,aAAc,KAAK,OAAO;AACrD;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type { Stage } from '../constants/misc.const.js'\nimport {\n  type ApprovalUseCaseType,\n  APPROVAL_USE_CASE_TYPES as T,\n} from './use-cases.const.js'\n\n/**\n * The approvals of one type of request.\n *\n * The count is the number of approvals from holders of the run permissions of\n * the request (`requiredPermissions`). The opener counts too: when the opener\n * holds every run permission, the request gets the approval of the opener\n * when it is created. The opener cannot approve the request by hand\n * (`canAcknowledge`).\n */\nexport interface ApprovalRule {\n  /** The approvals on prod. */\n  prod: number\n  /** The approvals on int, and on dev and local unless `dev` is set. When it is not set, `prod` applies. */\n  testStages?: number\n  /** The approvals on dev and local. When it is not set, `testStages` applies. */\n  dev?: number\n}\n\n/**\n * How many approvals each type of request needs. This table is the one source\n * of that number, for control-backend, control-frontend, and the routes of\n * accounts and console that run an approved action.\n *\n * - **0**: no approval. Only a holder, or a person whom the use case opens the\n *   request to, can open it.\n * - **1**: a holder does the action alone. The request of a holder runs when\n *   it is created. The request of a person who is not a holder waits for one\n *   holder.\n * - **2**: four eyes. The request of a holder waits for one other holder. The\n *   request of a person who is not a holder waits for two holders.\n * - **3**: six eyes on prod.\n *\n * Before #10483 a use case counted only the approvals of people other than\n * the opener. Thus an old count and a count of this table are not the same\n * unit.\n */\nexport const APPROVAL_RULES = {\n  // No approval. A use case that is open to every Camundi, or that only a\n  // system opens.\n  [T.clusterTtlDeletion]: { prod: 0 },\n  [T.createPersonalOrganisation]: { prod: 0 },\n  [T.createCustomHardwareSizing]: { prod: 0 },\n  [T.removeCustomHardwareSizing]: { prod: 0 },\n  [T.createCustomGeneration]: { prod: 0 },\n  [T.removeCustomGeneration]: { prod: 0 },\n  [T.selfServiceClusterModification]: { prod: 0 },\n  // Only the run of a grant opens it, as the system, and it runs by itself at\n  // the end of the grant. Ending a grant takes power away.\n  [T.revokeApprovalOverride]: { prod: 0 },\n\n  // A holder does it alone. Before #10483 a holder did these actions in\n  // accounts-frontend or console-frontend with no second person.\n  [T.extendTrial]: { prod: 1 },\n  [T.changeOrgLimits]: { prod: 1 },\n  [T.llmBudgetTopUp]: { prod: 1 },\n  [T.changeSalesPlan]: { prod: 1 },\n  [T.requestInNegotiation]: { prod: 1 },\n  [T.onboardToEnterprise]: { prod: 1 },\n  [T.automatedEnterpriseOnboarding]: { prod: 1 },\n  [T.changeClusterPlanType]: { prod: 1 },\n  [T.deleteInternalBackup]: { prod: 1 },\n  [T.releaseTrainPublish]: { prod: 1 },\n  [T.releaseTrainRollback]: { prod: 1 },\n\n  // Four eyes. The action removes data or access, changes a person, moves a\n  // cluster to another customer, or restarts every cluster of a generation.\n  [T.changePlatformRoles]: { prod: 2 },\n  [T.changeUserEmail]: { prod: 2 },\n  [T.deleteUser]: { prod: 2 },\n  [T.removeOrgMember]: { prod: 2 },\n  [T.purgeUsers]: { prod: 2 },\n  [T.updateUserMetadata]: { prod: 2 },\n  [T.deleteOrganization]: { prod: 2 },\n  [T.sendToExpiredTrial]: { prod: 2 },\n  [T.deleteSsoConnection]: { prod: 2 },\n  [T.deleteApiClient]: { prod: 2 },\n  [T.moveClusterOrg]: { prod: 2 },\n  [T.editGeneration]: { prod: 2 },\n  [T.changeGenerationVersions]: { prod: 2 },\n\n  // A reservation is a commercial commitment that the customer pays for, and\n  // the force path skips every check of the sales plan. Four eyes on prod.\n  // On the test stages a holder does it alone, as the direct route did.\n  [T.changeOrgReservations]: { prod: 2, testStages: 1 },\n\n  // One decision changes many clusters. A deletion cannot be undone, so it\n  // needs six eyes on prod. On the test stages, the opener runs every other\n  // type alone: the console team rolls out generations there with no second\n  // person.\n  [T.clusterBulkGenerationUpdate]: { prod: 2, testStages: 1 },\n  [T.clusterBulkPlanUpdate]: { prod: 2, testStages: 1 },\n  [T.clusterBulkPlanTypeUpdate]: { prod: 2, testStages: 1 },\n  [T.clusterBulkSleepWakeup]: { prod: 2, testStages: 1 },\n  [T.clusterBulkSpecUpdate]: { prod: 2, testStages: 1 },\n  [T.clusterBulkDeletion]: { prod: 3, testStages: 2 },\n  [T.deleteClusterCorpses]: { prod: 3, testStages: 2 },\n  [T.forceDeleteClusterPlanType]: { prod: 3, testStages: 2 },\n  // The contract of an enterprise customer sets what the customer pays for.\n  // On prod the opener and one other holder. On the test stages a holder\n  // changes a test contract alone.\n  [T.changeEnterpriseContract]: { prod: 2, testStages: 1 },\n  // A shorter retention limit deletes the old data of every cluster of the\n  // plan type.\n  [T.changePlanTypeRetentionLimits]: { prod: 3, testStages: 2 },\n\n  // A generation upgrade of one cluster that skips the upgrade graph\n  // (`--yolo`) or the upgrade gate. The gate keeps an upgrade from a cluster\n  // that has not finished its last migration, so a forced upgrade on prod\n  // needs the opener and one other holder. On the test stages the opener\n  // runs it alone.\n  [T.forceGenerationUpgrade]: { prod: 2, testStages: 1 },\n  // The deletion of the managed LLM tenant removes the key and the spend\n  // history, and nothing brings them back. Four eyes on prod. On the test\n  // stages the opener does it alone, as the direct route did before.\n  [T.deleteManagedLlmTenant]: { prod: 2, testStages: 1 },\n\n  // A flag of prod turns a feature on or off for every customer.\n  [T.changeFeatureFlag]: { prod: 3, testStages: 2 },\n  // Turning a flag off lowers the risk, thus it needs fewer approvals than a\n  // change. On prod the opener with `aafw` gives one, and one other holder\n  // gives the second. On int the opener with `aafw` does it alone. On dev\n  // and local no approval is needed: opening the request runs it.\n  [T.disableFeatureFlag]: { prod: 2, testStages: 1, dev: 0 },\n\n  // The licensing model sets which value metrics an enterprise customer pays\n  // for. On prod the opener and one other holder. On the test stages a holder\n  // changes a test organization alone.\n  [T.changeLicensingModel]: { prod: 2, testStages: 1 },\n\n  // A grant lets one Camundi run many requests with no second person. The\n  // opener and one other holder, on every stage. The grantee approves\n  // neither by hand nor when they open it, thus a grant for oneself needs\n  // two other holders. The console team has three people, so a third\n  // approval would block a grant for oneself.\n  [T.grantApprovalOverride]: { prod: 2 },\n} as const satisfies Record<ApprovalUseCaseType, ApprovalRule>\n\n/** The types whose count on the test stages is not the count on prod. */\nexport type StageDependentApprovalType = {\n  [K in ApprovalUseCaseType]: (typeof APPROVAL_RULES)[K] extends {\n    testStages: number\n  }\n    ? K\n    : (typeof APPROVAL_RULES)[K] extends { dev: number }\n      ? K\n      : never\n}[ApprovalUseCaseType]\n\n/** The approvals that a request of `type` needs on `stage`. */\nexport function approvalsRequiredFor(\n  type: ApprovalUseCaseType,\n  stage: Stage,\n): number {\n  const rule: ApprovalRule = APPROVAL_RULES[type]\n  if (stage === 'prod') {\n    return rule.prod\n  }\n  const testStages = rule.testStages ?? rule.prod\n  return stage === 'int' ? testStages : (rule.dev ?? testStages)\n}\n"],
+  "mappings": "AAOA;AAAA,EAEE,2BAA2B;AAAA,OACtB;AAsCA,MAAM,iBAAiB;AAAA;AAAA;AAAA,EAG5B,CAAC,EAAE,kBAAkB,GAAG,EAAE,MAAM,EAAE;AAAA,EAClC,CAAC,EAAE,0BAA0B,GAAG,EAAE,MAAM,EAAE;AAAA,EAC1C,CAAC,EAAE,0BAA0B,GAAG,EAAE,MAAM,EAAE;AAAA,EAC1C,CAAC,EAAE,0BAA0B,GAAG,EAAE,MAAM,EAAE;AAAA,EAC1C,CAAC,EAAE,sBAAsB,GAAG,EAAE,MAAM,EAAE;AAAA,EACtC,CAAC,EAAE,sBAAsB,GAAG,EAAE,MAAM,EAAE;AAAA,EACtC,CAAC,EAAE,8BAA8B,GAAG,EAAE,MAAM,EAAE;AAAA;AAAA;AAAA,EAG9C,CAAC,EAAE,sBAAsB,GAAG,EAAE,MAAM,EAAE;AAAA;AAAA;AAAA,EAItC,CAAC,EAAE,WAAW,GAAG,EAAE,MAAM,EAAE;AAAA,EAC3B,CAAC,EAAE,eAAe,GAAG,EAAE,MAAM,EAAE;AAAA,EAC/B,CAAC,EAAE,cAAc,GAAG,EAAE,MAAM,EAAE;AAAA,EAC9B,CAAC,EAAE,eAAe,GAAG,EAAE,MAAM,EAAE;AAAA,EAC/B,CAAC,EAAE,oBAAoB,GAAG,EAAE,MAAM,EAAE;AAAA,EACpC,CAAC,EAAE,mBAAmB,GAAG,EAAE,MAAM,EAAE;AAAA,EACnC,CAAC,EAAE,6BAA6B,GAAG,EAAE,MAAM,EAAE;AAAA,EAC7C,CAAC,EAAE,qBAAqB,GAAG,EAAE,MAAM,EAAE;AAAA,EACrC,CAAC,EAAE,oBAAoB,GAAG,EAAE,MAAM,EAAE;AAAA,EACpC,CAAC,EAAE,mBAAmB,GAAG,EAAE,MAAM,EAAE;AAAA,EACnC,CAAC,EAAE,oBAAoB,GAAG,EAAE,MAAM,EAAE;AAAA;AAAA;AAAA,EAIpC,CAAC,EAAE,mBAAmB,GAAG,EAAE,MAAM,EAAE;AAAA,EACnC,CAAC,EAAE,eAAe,GAAG,EAAE,MAAM,EAAE;AAAA,EAC/B,CAAC,EAAE,UAAU,GAAG,EAAE,MAAM,EAAE;AAAA,EAC1B,CAAC,EAAE,eAAe,GAAG,EAAE,MAAM,EAAE;AAAA,EAC/B,CAAC,EAAE,UAAU,GAAG,EAAE,MAAM,EAAE;AAAA,EAC1B,CAAC,EAAE,kBAAkB,GAAG,EAAE,MAAM,EAAE;AAAA,EAClC,CAAC,EAAE,kBAAkB,GAAG,EAAE,MAAM,EAAE;AAAA,EAClC,CAAC,EAAE,kBAAkB,GAAG,EAAE,MAAM,EAAE;AAAA,EAClC,CAAC,EAAE,mBAAmB,GAAG,EAAE,MAAM,EAAE;AAAA,EACnC,CAAC,EAAE,eAAe,GAAG,EAAE,MAAM,EAAE;AAAA,EAC/B,CAAC,EAAE,cAAc,GAAG,EAAE,MAAM,EAAE;AAAA,EAC9B,CAAC,EAAE,cAAc,GAAG,EAAE,MAAM,EAAE;AAAA,EAC9B,CAAC,EAAE,wBAAwB,GAAG,EAAE,MAAM,EAAE;AAAA;AAAA;AAAA;AAAA,EAKxC,CAAC,EAAE,qBAAqB,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMpD,CAAC,EAAE,2BAA2B,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA,EAC1D,CAAC,EAAE,qBAAqB,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA,EACpD,CAAC,EAAE,yBAAyB,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA,EACxD,CAAC,EAAE,sBAAsB,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA,EACrD,CAAC,EAAE,qBAAqB,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA,EACpD,CAAC,EAAE,mBAAmB,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA,EAClD,CAAC,EAAE,oBAAoB,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA,EACnD,CAAC,EAAE,0BAA0B,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA;AAAA;AAAA;AAAA,EAIzD,CAAC,EAAE,wBAAwB,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA;AAAA;AAAA,EAGvD,CAAC,EAAE,6BAA6B,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO5D,CAAC,EAAE,sBAAsB,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA;AAAA;AAAA;AAAA,EAIrD,CAAC,EAAE,sBAAsB,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA;AAAA,EAGrD,CAAC,EAAE,iBAAiB,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA,EAKhD,CAAC,EAAE,kBAAkB,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,KAAK,EAAE;AAAA;AAAA;AAAA;AAAA,EAKzD,CAAC,EAAE,oBAAoB,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOnD,CAAC,EAAE,qBAAqB,GAAG,EAAE,MAAM,EAAE;AACvC;AAcO,SAAS,qBACd,MACA,OACQ;AACR,QAAM,OAAqB,eAAe,IAAI;AAC9C,MAAI,UAAU,QAAQ;AACpB,WAAO,KAAK;AAAA,EACd;AACA,QAAM,aAAa,KAAK,cAAc,KAAK;AAC3C,SAAO,UAAU,QAAQ,aAAc,KAAK,OAAO;AACrD;",
   "names": []
 }

package/dist/approvals/use-cases.const.d.ts

@@ -26,6 +26,7 @@ export declare const APPROVAL_USE_CASE_TYPES: {
     readonly changePlatformRoles: "change-platform-roles";
     readonly deleteInternalBackup: "delete-internal-backup";
     readonly changeOrgLimits: "change-org-limits";
+    readonly changeOrgReservations: "change-org-reservations";
     readonly deleteSsoConnection: "delete-sso-connection";
     readonly changeSalesPlan: "change-sales-plan";
     readonly llmBudgetTopUp: "llm-budget-top-up";
@@ -210,6 +211,13 @@ export declare const ENTERPRISE_ONBOARDING_METRIC_MAX = 1000000000000;
  * carry a count that the plan refuses.
  */
 export declare const ENTERPRISE_ONBOARDING_RESERVATION_MAX = 20;
+/**
+ * The most clusters of one plan type that a change-org-reservations request
+ * reserves. The approval route of accounts-ng has the same bound.
+ * `PATCH /api/salesplans/reserved` has no bound. A request with `force`
+ * skips the maximum of the sales plan, thus this bound is its only bound.
+ */
+export declare const ORG_RESERVATION_MAX = 1000;
 /**
  * Whether a string is a calendar day, `YYYY-MM-DD`, that exists.
  *

package/dist/approvals/use-cases.const.js

@@ -16,6 +16,11 @@ const APPROVAL_USE_CASE_TYPES = {
   changePlatformRoles: "change-platform-roles",
   deleteInternalBackup: "delete-internal-backup",
   changeOrgLimits: "change-org-limits",
+  // The cluster reservations of one organization, behind
+  // `control.camundiApprovalFlow`. It is not the enterprise contract: a
+  // reservation change and a contract change are two requests. See
+  // `change-org-reservations.ts` in control-backend.
+  changeOrgReservations: "change-org-reservations",
   deleteSsoConnection: "delete-sso-connection",
   changeSalesPlan: "change-sales-plan",
   llmBudgetTopUp: "llm-budget-top-up",
@@ -162,6 +167,7 @@ const ENTERPRISE_ONBOARDING_TERM_MIN_MONTHS = 1;
 const ENTERPRISE_ONBOARDING_TERM_MAX_MONTHS = 60;
 const ENTERPRISE_ONBOARDING_METRIC_MAX = 1e12;
 const ENTERPRISE_ONBOARDING_RESERVATION_MAX = 20;
+const ORG_RESERVATION_MAX = 1e3;
 const isCalendarDay = (value) => /^\d{4}-\d{2}-\d{2}$/.test(value) && !Number.isNaN(Date.parse(value)) && new Date(value).toISOString().startsWith(value);
 const enterpriseContractChangePermissions = (changesStartDate) => changesStartDate ? [
   AccountsPermissions.ENTERPRISE_ORG_MODIFY,
@@ -193,6 +199,7 @@ export {
   GENERATION_VERSION_VALUE_MAX_LENGTH,
   LLM_BUDGET_TOP_UP_THRESHOLD,
   ORG_LIMIT_TEXT_MAX_LENGTH,
+  ORG_RESERVATION_MAX,
   PERSONAL_ORGANIZATION_MAX_PER_REQUESTER,
   PERSONAL_ORGANIZATION_NAME_MAX_LENGTH,
   PERSONAL_ORGANIZATION_NAME_MIN_LENGTH,

package/dist/approvals/use-cases.const.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/approvals/use-cases.const.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { AccountsPermissions } from '../permissions/accounts.permissions.js'\n\n/**\n * The names and the value ranges of the registered use cases.\n *\n * control-backend owns the registry, and a frontend reads it at run time\n * (`GET /api/approvals/use-cases`). Two things cannot wait for that answer:\n *\n * - **The identifier**, because a caller must NAME a use case to find it in the\n *   registry, and to open a request of it.\n * - **The range of a payload field**, because a form holds the value before any\n *   call goes out.\n *\n * Both live here, so the schema of the service and the form of the browser can\n * never hold different numbers.\n */\n\n/** The identifier of each use case, on the wire and in the table. */\nexport const APPROVAL_USE_CASE_TYPES = {\n  sendToExpiredTrial: 'send-to-expired-trial',\n  extendTrial: 'extend-trial',\n  moveClusterOrg: 'move-cluster-org',\n  // One use case for each type of a cluster bulk operation. The types need\n  // different permissions and different approval counts, and a use case holds\n  // one of each. See `cluster-bulk-operation.ts` beside this file.\n  clusterBulkGenerationUpdate: 'cluster-bulk-generation-update',\n  clusterBulkPlanUpdate: 'cluster-bulk-plan-update',\n  clusterBulkPlanTypeUpdate: 'cluster-bulk-plan-type-update',\n  clusterBulkSleepWakeup: 'cluster-bulk-sleep-wakeup',\n  clusterBulkDeletion: 'cluster-bulk-deletion',\n  clusterBulkSpecUpdate: 'cluster-bulk-spec-update',\n  // The second group, behind `control.camundiApprovalFlow`.\n  changePlatformRoles: 'change-platform-roles',\n  deleteInternalBackup: 'delete-internal-backup',\n  changeOrgLimits: 'change-org-limits',\n  deleteSsoConnection: 'delete-sso-connection',\n  changeSalesPlan: 'change-sales-plan',\n  llmBudgetTopUp: 'llm-budget-top-up',\n  requestInNegotiation: 'request-in-negotiation',\n  removeOrgMember: 'remove-org-member',\n  // The third group, behind `control.camundiApprovalFlow`.\n  deleteOrganization: 'delete-organization',\n  deleteUser: 'delete-user',\n  changeUserEmail: 'change-user-email',\n  purgeUsers: 'purge-users',\n  updateUserMetadata: 'update-user-metadata',\n  // A change of the feature flag table, on a stage where\n  // `isFeatureFlagApprovalRequired` is true.\n  changeFeatureFlag: 'change-feature-flag',\n  // Turns one flag off, and nothing else. A rollback needs fewer approvals\n  // than a change.\n  disableFeatureFlag: 'disable-feature-flag',\n  // The publish and the rollback of a release-train generation. See\n  // `release-train.ts` beside this file.\n  releaseTrainPublish: 'release-train-publish',\n  releaseTrainRollback: 'release-train-rollback',\n  // Open to every Camundi, and it needs no approval on any stage.\n  createPersonalOrganisation: 'create-personal-organisation',\n  // Open to every Camundi, runs on dev only, and needs no approval. The two\n  // use cases of custom hardware sizing.\n  createCustomHardwareSizing: 'create-custom-hardware-sizing',\n  removeCustomHardwareSizing: 'remove-custom-hardware-sizing',\n  // The mutable versions of one or more generations, behind\n  // `control.camundiApprovalFlow`. Console restarts every cluster of\n  // each generation, which is why the write needs a second Camundi.\n  changeGenerationVersions: 'change-generation-versions',\n  // The name and the env vars of one generation, behind\n  // `control.camundiApprovalFlow`. Console sends a new spec to every cluster of\n  // the generation, which is why the write needs a second Camundi.\n  editGeneration: 'edit-generation',\n  // A new enterprise customer: a production and a development organization\n  // in one step, behind `control.camundiApprovalFlow`. See\n  // `automated-enterprise-onboarding.ts` in control-backend.\n  automatedEnterpriseOnboarding: 'automated-enterprise-onboarding',\n  // Open to every Camundi, runs on dev only, and needs no approval. The two\n  // use cases of custom generations.\n  createCustomGeneration: 'create-custom-generation',\n  removeCustomGeneration: 'remove-custom-generation',\n  // Open to org owners, runs on dev only, and needs no approval. It applies\n  // or deactivates a cluster modification config of one cluster.\n  selfServiceClusterModification: 'self-service-cluster-modification',\n  // The enterprise onboarding of one organization, behind\n  // `control.camundiApprovalFlow`: the contract, the plan type of\n  // each cluster, and the reservations, in one request.\n  onboardToEnterprise: 'onboard-to-enterprise',\n  // The term, the start date and the included value metrics of the contract\n  // of one enterprise organization, behind `control.camundiApprovalFlow`. See\n  // `change-enterprise-contract.ts` in control-backend.\n  changeEnterpriseContract: 'change-enterprise-contract',\n  // The plan type and the hardware packages of ONE cluster, behind\n  // `control.camundiApprovalFlow`. The bulk plan type update beside it also\n  // checks the reservations and moves the cluster plan, but each cluster\n  // keeps its packages there. This one can change the packages, and it has a\n  // stale guard. See `change-cluster-plan-type.ts` in control-backend.\n  changeClusterPlanType: 'change-cluster-plan-type',\n  // The deletion of one cluster whose TTL ran out. Only the delete cron of\n  // console-backend opens it, and it needs no approval. It is a record of the\n  // deletion. See `cluster-ttl-deletion.ts` in control-backend.\n  clusterTtlDeletion: 'cluster-ttl-deletion',\n  // The deletion of the DB corpses or of the Kubernetes corpses that console\n  // finds, behind `control.camundiApprovalFlow`. See\n  // `delete-cluster-corpses.ts` in control-backend.\n  deleteClusterCorpses: 'delete-cluster-corpses',\n  // The force delete of a cluster plan type and of every cluster on it,\n  // behind `control.camundiApprovalFlow`. See\n  // `force-delete-cluster-plan-type.ts` in control-backend.\n  forceDeleteClusterPlanType: 'force-delete-cluster-plan-type',\n  // A change of the data retention limits of a cluster plan type, which\n  // console sends to every cluster of the type. Behind\n  // `control.camundiApprovalFlow`. See\n  // `change-plan-type-retention-limits.ts` in control-backend.\n  changePlanTypeRetentionLimits: 'change-plan-type-retention-limits',\n  // The generation upgrade of one cluster with `--yolo` or with the upgrade\n  // gate ignored, behind `control.camundiApprovalFlow`. A plain upgrade stays\n  // a direct call. See `force-generation-upgrade.ts` in control-backend.\n  forceGenerationUpgrade: 'force-generation-upgrade',\n  // The deletion of one Console API client of an organization. See\n  // `delete-api-client.ts` in control-backend.\n  deleteApiClient: 'delete-api-client',\n  // The licensing model of one enterprise organization, behind\n  // `control.camundiApprovalFlow`. See `change-licensing-model.ts` in\n  // control-backend.\n  changeLicensingModel: 'change-licensing-model',\n  // A time-limited grant that lets one Camundi run a pending request with no\n  // approval, and the scheduled request that ends it. Behind\n  // `control.approvalOverride`. See `approval-override.ts` in control-backend.\n  grantApprovalOverride: 'grant-approval-override',\n  revokeApprovalOverride: 'revoke-approval-override',\n  // The deletion of the managed LLM tenant of one organization: the tenant,\n  // the key and the spend history. Behind `control.camundiApprovalFlow`. See\n  // `delete-managed-llm-tenant.ts` in control-backend.\n  deleteManagedLlmTenant: 'delete-managed-llm-tenant',\n} as const\n\n/** The longest approval override grant, in hours: 14 days. */\nexport const APPROVAL_OVERRIDE_MAX_HOURS = 14 * 24\n\n/** The duration that the form of control-frontend offers first: one day. */\nexport const APPROVAL_OVERRIDE_DEFAULT_HOURS = 24\n\n/**\n * The use cases that an approval override grant can NOT run.\n *\n * Every other use case is overridable. These change who holds a permission,\n * the override mechanism itself, the feature flags of a stage, the address\n * that a person signs in with, or delete customer data, a backup, a sign-in\n * path, or a whole fleet of clusters. None of them is an emergency that one\n * Camundi must fix alone.\n *\n * The list fails open: a use case that is not here IS overridable. Thus a new\n * use case that deletes or that changes access must be added here. Its route\n * in accounts-backend or console-backend then refuses `overriddenBy` by\n * itself: `approvalActorSchemaFor` of their `AdminApprovalsRouter.ts` reads\n * this list.\n */\nexport const APPROVAL_OVERRIDE_DENYLIST: readonly string[] = [\n  APPROVAL_USE_CASE_TYPES.changePlatformRoles,\n  APPROVAL_USE_CASE_TYPES.grantApprovalOverride,\n  APPROVAL_USE_CASE_TYPES.revokeApprovalOverride,\n  APPROVAL_USE_CASE_TYPES.changeFeatureFlag,\n  APPROVAL_USE_CASE_TYPES.disableFeatureFlag,\n  APPROVAL_USE_CASE_TYPES.purgeUsers,\n  APPROVAL_USE_CASE_TYPES.deleteUser,\n  APPROVAL_USE_CASE_TYPES.deleteOrganization,\n  APPROVAL_USE_CASE_TYPES.clusterBulkDeletion,\n  APPROVAL_USE_CASE_TYPES.forceDeleteClusterPlanType,\n  APPROVAL_USE_CASE_TYPES.releaseTrainPublish,\n  APPROVAL_USE_CASE_TYPES.releaseTrainRollback,\n  APPROVAL_USE_CASE_TYPES.deleteSsoConnection,\n  APPROVAL_USE_CASE_TYPES.changeUserEmail,\n  APPROVAL_USE_CASE_TYPES.deleteInternalBackup,\n  APPROVAL_USE_CASE_TYPES.deleteApiClient,\n  APPROVAL_USE_CASE_TYPES.removeOrgMember,\n  APPROVAL_USE_CASE_TYPES.deleteManagedLlmTenant,\n]\n\n/** isApprovalOverridable reports whether a grant can run a request of this type. */\nexport const isApprovalOverridable = (type: string): boolean =>\n  !APPROVAL_OVERRIDE_DENYLIST.includes(type)\n\n/**\n * The most personal organizations that one Camundi can request.\n *\n * The request runs with no approval, so this cap is the only guard against a\n * loop that creates organizations without end. It counts the requests that a\n * Camundi opened, and a person who needs more asks a Camundi who holds\n * `AccountsPermissions.CREATE_ORG`.\n */\nexport const PERSONAL_ORGANIZATION_MAX_PER_REQUESTER = 10\n\n/** The shortest and longest name of a personal organization. */\nexport const PERSONAL_ORGANIZATION_NAME_MIN_LENGTH = 3\nexport const PERSONAL_ORGANIZATION_NAME_MAX_LENGTH = 100\n\nexport type ApprovalUseCaseType =\n  (typeof APPROVAL_USE_CASE_TYPES)[keyof typeof APPROVAL_USE_CASE_TYPES]\n\n/**\n * The shortest extension that accounts-backend accepts.\n *\n * `POST /:orgId/extendtrial` refuses a date that is less than 14 days away\n * when the body carries `onBehalfOf`, and it measures those 14 days when the\n * CALL arrives. The floor here is 15 and not 14, for two reasons:\n *\n * - The two clocks are not the same instant. Accounts builds its own \"14 days\n *   from now\" a few milliseconds after control-backend builds the date, so a\n *   date of exactly 14 days is already in the past for the comparison.\n * - Accounts counts with `setDate`, which is calendar arithmetic. A change of\n *   the daylight saving time moves its limit by an hour.\n */\nexport const EXTEND_TRIAL_MIN_DAYS = 15\n\n/**\n * The longest extension that accounts-backend accepts.\n *\n * The same route refuses a date more than 62 days away. 61 keeps the same\n * margin as the floor above.\n */\nexport const EXTEND_TRIAL_MAX_DAYS = 61\n\n/**\n * The most roles that one change-platform-roles request adds, or removes.\n *\n * The form of control-frontend offers every platform role, and a person who\n * gives a Camundi a new position rarely changes more than a few. A request with\n * more roles than this is a request that nobody reads before they approve it.\n */\nexport const PLATFORM_ROLE_CHANGE_MAX_ROLES = 10\n\n/**\n * The longest text value that one change-org-limits request writes.\n *\n * A text limit holds a short value, such as a list of regions. The bound keeps\n * a request readable for the person who approves it.\n */\nexport const ORG_LIMIT_TEXT_MAX_LENGTH = 2000\n\n/**\n * LLM_BUDGET_TOP_UP_THRESHOLD is the share of the budget that the spend of a\n * managed LLM key must reach before a top-up is the normal case.\n *\n * A request below it is still possible, but the person who asks must confirm\n * it, and the request says so to the approver. Accounts refuses a top-up\n * below it that does not carry that confirmation.\n */\nexport const LLM_BUDGET_TOP_UP_THRESHOLD = 0.9\n\n/**\n * isLlmSpendBelowTopUpThreshold reports whether a top-up of a managed LLM key\n * needs the explicit confirmation of `LLM_BUDGET_TOP_UP_THRESHOLD`.\n */\nexport const isLlmSpendBelowTopUpThreshold = (\n  spend: number,\n  maxBudget: number,\n): boolean => spend < maxBudget * LLM_BUDGET_TOP_UP_THRESHOLD\n\n/**\n * The most users that one purge-users request deletes.\n *\n * The God Mode purge deletes one user after the other, and Auth0 limits how\n * fast that goes. A list longer than this is also a list that no approver\n * reads before they agree.\n */\nexport const PURGE_USERS_MAX_USERS = 1000\n\n/**\n * What a person must hold to open or to approve a purge-users request.\n *\n * The purge route of accounts, `DELETE /api/users/:userId/purge`, needs both\n * of the caller. The approval route of accounts checks both of the person who\n * asked, when control-backend sends `purge: true`. The use case of\n * control-backend returns this list from `permissionsFor`, and the form passes\n * it to `canCreate`, so the button and the server never disagree.\n */\nexport const PURGE_USERS_REQUIRED_PERMISSIONS: readonly string[] = [\n  AccountsPermissions.GOD_PURGE_USERS,\n  AccountsPermissions.DELETE_USER,\n]\n\n/**\n * What a person must hold to open or to approve a remove-org-member request,\n * with or without a new owner. CS holds it through the Camundi permission\n * rules. Accounts checks the same list for the person who asked.\n */\nexport const REMOVE_ORG_MEMBER_REQUIRED_PERMISSIONS: readonly string[] = [\n  AccountsPermissions.REMOVE_FROM_ORG_WITH_APPROVAL,\n]\n\n/**\n * The largest metadata object that one update-user-metadata request writes,\n * in characters of its JSON text.\n *\n * This is a bound of the product, and not the limit of Auth0, which is far\n * larger. The approvers read the whole object before they agree, and an\n * object that is longer than this is an object that nobody reads.\n */\nexport const USER_METADATA_MAX_LENGTH = 16_000\n\n/**\n * The largest metadata object that a request carries as the object that the\n * person who asked READ.\n *\n * It is larger than `USER_METADATA_MAX_LENGTH`, so a user whose metadata grew\n * past that bound can still get an edit that makes it smaller. It still has a\n * bound, because the request keeps the copy in its row.\n */\nexport const USER_METADATA_EXPECTED_MAX_LENGTH = 500_000\n\n/**\n * The bounds of an automated-enterprise-onboarding request.\n *\n * The accounts wizard holds the first four, and the schema of control-backend\n * and the form of control-frontend read them here, so the form never sends\n * what the service refuses.\n */\nexport const ENTERPRISE_ONBOARDING_NAME_MAX_LENGTH = 50\nexport const ENTERPRISE_ONBOARDING_SFDC_ID_MAX_LENGTH = 50\nexport const ENTERPRISE_ONBOARDING_TERM_MIN_MONTHS = 1\nexport const ENTERPRISE_ONBOARDING_TERM_MAX_MONTHS = 60\n/** The most of one value metric that a contract includes. */\nexport const ENTERPRISE_ONBOARDING_METRIC_MAX = 1_000_000_000_000\n/**\n * The most clusters of one plan type that an onboarding reserves: the cap of\n * the accounts wizard. Accounts checks the limit of the plan only when it\n * reserves, after it created the two organizations, so the request must not\n * carry a count that the plan refuses.\n */\nexport const ENTERPRISE_ONBOARDING_RESERVATION_MAX = 20\n\n/**\n * Whether a string is a calendar day, `YYYY-MM-DD`, that exists.\n *\n * The shape alone is not enough: `Date` rolls `2026-02-30` to March 2 with\n * no error, and `2026-13-45` becomes an invalid date that a database refuses\n * only at the write. A request carries the day for days before it runs, so\n * the check is at the open, and in the form.\n */\nexport const isCalendarDay = (value: string): boolean =>\n  /^\\d{4}-\\d{2}-\\d{2}$/.test(value) &&\n  !Number.isNaN(Date.parse(value)) &&\n  new Date(value).toISOString().startsWith(value)\n\n/**\n * What a person must hold to open or to approve a change-enterprise-contract\n * request.\n *\n * `PATCH /:orgId/enterprise` of accounts needs `ENTERPRISE_ORG_MODIFY`, and\n * also `ENTERPRISE_ORG_MODIFY_START_DATE` for a new start date. The approval\n * route of accounts checks the same list for the person who asked. The use\n * case of control-backend returns this list from `permissionsFor`, and the\n * form passes it to `canCreate`, so the button and the server never disagree.\n */\nexport const enterpriseContractChangePermissions = (\n  changesStartDate: boolean,\n): string[] =>\n  changesStartDate\n    ? [\n        AccountsPermissions.ENTERPRISE_ORG_MODIFY,\n        AccountsPermissions.ENTERPRISE_ORG_MODIFY_START_DATE,\n      ]\n    : [AccountsPermissions.ENTERPRISE_ORG_MODIFY]\n\n/** The longest email address that a change-user-email request carries. */\nexport const APPROVAL_EMAIL_MAX_LENGTH = 320\n\n/**\n * The email addresses that a change-user-email request accepts.\n *\n * It is the email pattern of zod 4.6. The pattern is here, so the schema of\n * control-backend and the form of control-frontend accept the same addresses,\n * and a form never sends an address that the service refuses.\n */\nexport const APPROVAL_EMAIL_PATTERN =\n  // biome-ignore lint/complexity/noUselessEscapeInRegex: the same source as zod, character for character\n  /^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$/\n\n/**\n * The most generations that one change-generation-versions request changes.\n *\n * Each generation restarts every cluster on it. A request over more\n * generations than this is a request that no approver reads to the end.\n *\n * The two bounds of this use case also keep a request under the body limit\n * of control-backend (1 MiB, `server-options.ts` of the shared Fastify\n * layer): 20 generations, each with the expected value of the 2 image\n * versions of 2000 characters, is 80 000 characters before the rest of the\n * payload.\n */\nexport const GENERATION_VERSIONS_MAX_GENERATIONS = 20\n\n/**\n * The longest value of one mutable version of a generation.\n *\n * An image reference is short, and only the two image versions go through\n * the use case (`GENERATION_IMAGE_VERSION_KEYS`). The bound keeps a request\n * readable for the approver. See `GENERATION_VERSIONS_MAX_GENERATIONS` for\n * the sum.\n */\nexport const GENERATION_VERSION_VALUE_MAX_LENGTH = 2000\n"],
-  "mappings": "AAMA,SAAS,2BAA2B;AAkB7B,MAAM,0BAA0B;AAAA,EACrC,oBAAoB;AAAA,EACpB,aAAa;AAAA,EACb,gBAAgB;AAAA;AAAA;AAAA;AAAA,EAIhB,6BAA6B;AAAA,EAC7B,uBAAuB;AAAA,EACvB,2BAA2B;AAAA,EAC3B,wBAAwB;AAAA,EACxB,qBAAqB;AAAA,EACrB,uBAAuB;AAAA;AAAA,EAEvB,qBAAqB;AAAA,EACrB,sBAAsB;AAAA,EACtB,iBAAiB;AAAA,EACjB,qBAAqB;AAAA,EACrB,iBAAiB;AAAA,EACjB,gBAAgB;AAAA,EAChB,sBAAsB;AAAA,EACtB,iBAAiB;AAAA;AAAA,EAEjB,oBAAoB;AAAA,EACpB,YAAY;AAAA,EACZ,iBAAiB;AAAA,EACjB,YAAY;AAAA,EACZ,oBAAoB;AAAA;AAAA;AAAA,EAGpB,mBAAmB;AAAA;AAAA;AAAA,EAGnB,oBAAoB;AAAA;AAAA;AAAA,EAGpB,qBAAqB;AAAA,EACrB,sBAAsB;AAAA;AAAA,EAEtB,4BAA4B;AAAA;AAAA;AAAA,EAG5B,4BAA4B;AAAA,EAC5B,4BAA4B;AAAA;AAAA;AAAA;AAAA,EAI5B,0BAA0B;AAAA;AAAA;AAAA;AAAA,EAI1B,gBAAgB;AAAA;AAAA;AAAA;AAAA,EAIhB,+BAA+B;AAAA;AAAA;AAAA,EAG/B,wBAAwB;AAAA,EACxB,wBAAwB;AAAA;AAAA;AAAA,EAGxB,gCAAgC;AAAA;AAAA;AAAA;AAAA,EAIhC,qBAAqB;AAAA;AAAA;AAAA;AAAA,EAIrB,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM1B,uBAAuB;AAAA;AAAA;AAAA;AAAA,EAIvB,oBAAoB;AAAA;AAAA;AAAA;AAAA,EAIpB,sBAAsB;AAAA;AAAA;AAAA;AAAA,EAItB,4BAA4B;AAAA;AAAA;AAAA;AAAA;AAAA,EAK5B,+BAA+B;AAAA;AAAA;AAAA;AAAA,EAI/B,wBAAwB;AAAA;AAAA;AAAA,EAGxB,iBAAiB;AAAA;AAAA;AAAA;AAAA,EAIjB,sBAAsB;AAAA;AAAA;AAAA;AAAA,EAItB,uBAAuB;AAAA,EACvB,wBAAwB;AAAA;AAAA;AAAA;AAAA,EAIxB,wBAAwB;AAC1B;AAGO,MAAM,8BAA8B,KAAK;AAGzC,MAAM,kCAAkC;AAiBxC,MAAM,6BAAgD;AAAA,EAC3D,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,wBAAwB;AAC1B;AAGO,MAAM,wBAAwB,CAAC,SACpC,CAAC,2BAA2B,SAAS,IAAI;AAUpC,MAAM,0CAA0C;AAGhD,MAAM,wCAAwC;AAC9C,MAAM,wCAAwC;AAkB9C,MAAM,wBAAwB;AAQ9B,MAAM,wBAAwB;AAS9B,MAAM,iCAAiC;AAQvC,MAAM,4BAA4B;AAUlC,MAAM,8BAA8B;AAMpC,MAAM,gCAAgC,CAC3C,OACA,cACY,QAAQ,YAAY;AAS3B,MAAM,wBAAwB;AAW9B,MAAM,mCAAsD;AAAA,EACjE,oBAAoB;AAAA,EACpB,oBAAoB;AACtB;AAOO,MAAM,yCAA4D;AAAA,EACvE,oBAAoB;AACtB;AAUO,MAAM,2BAA2B;AAUjC,MAAM,oCAAoC;AAS1C,MAAM,wCAAwC;AAC9C,MAAM,2CAA2C;AACjD,MAAM,wCAAwC;AAC9C,MAAM,wCAAwC;AAE9C,MAAM,mCAAmC;AAOzC,MAAM,wCAAwC;AAU9C,MAAM,gBAAgB,CAAC,UAC5B,sBAAsB,KAAK,KAAK,KAChC,CAAC,OAAO,MAAM,KAAK,MAAM,KAAK,CAAC,KAC/B,IAAI,KAAK,KAAK,EAAE,YAAY,EAAE,WAAW,KAAK;AAYzC,MAAM,sCAAsC,CACjD,qBAEA,mBACI;AAAA,EACE,oBAAoB;AAAA,EACpB,oBAAoB;AACtB,IACA,CAAC,oBAAoB,qBAAqB;AAGzC,MAAM,4BAA4B;AASlC,MAAM;AAAA;AAAA,EAEX;AAAA;AAcK,MAAM,sCAAsC;AAU5C,MAAM,sCAAsC;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { AccountsPermissions } from '../permissions/accounts.permissions.js'\n\n/**\n * The names and the value ranges of the registered use cases.\n *\n * control-backend owns the registry, and a frontend reads it at run time\n * (`GET /api/approvals/use-cases`). Two things cannot wait for that answer:\n *\n * - **The identifier**, because a caller must NAME a use case to find it in the\n *   registry, and to open a request of it.\n * - **The range of a payload field**, because a form holds the value before any\n *   call goes out.\n *\n * Both live here, so the schema of the service and the form of the browser can\n * never hold different numbers.\n */\n\n/** The identifier of each use case, on the wire and in the table. */\nexport const APPROVAL_USE_CASE_TYPES = {\n  sendToExpiredTrial: 'send-to-expired-trial',\n  extendTrial: 'extend-trial',\n  moveClusterOrg: 'move-cluster-org',\n  // One use case for each type of a cluster bulk operation. The types need\n  // different permissions and different approval counts, and a use case holds\n  // one of each. See `cluster-bulk-operation.ts` beside this file.\n  clusterBulkGenerationUpdate: 'cluster-bulk-generation-update',\n  clusterBulkPlanUpdate: 'cluster-bulk-plan-update',\n  clusterBulkPlanTypeUpdate: 'cluster-bulk-plan-type-update',\n  clusterBulkSleepWakeup: 'cluster-bulk-sleep-wakeup',\n  clusterBulkDeletion: 'cluster-bulk-deletion',\n  clusterBulkSpecUpdate: 'cluster-bulk-spec-update',\n  // The second group, behind `control.camundiApprovalFlow`.\n  changePlatformRoles: 'change-platform-roles',\n  deleteInternalBackup: 'delete-internal-backup',\n  changeOrgLimits: 'change-org-limits',\n  // The cluster reservations of one organization, behind\n  // `control.camundiApprovalFlow`. It is not the enterprise contract: a\n  // reservation change and a contract change are two requests. See\n  // `change-org-reservations.ts` in control-backend.\n  changeOrgReservations: 'change-org-reservations',\n  deleteSsoConnection: 'delete-sso-connection',\n  changeSalesPlan: 'change-sales-plan',\n  llmBudgetTopUp: 'llm-budget-top-up',\n  requestInNegotiation: 'request-in-negotiation',\n  removeOrgMember: 'remove-org-member',\n  // The third group, behind `control.camundiApprovalFlow`.\n  deleteOrganization: 'delete-organization',\n  deleteUser: 'delete-user',\n  changeUserEmail: 'change-user-email',\n  purgeUsers: 'purge-users',\n  updateUserMetadata: 'update-user-metadata',\n  // A change of the feature flag table, on a stage where\n  // `isFeatureFlagApprovalRequired` is true.\n  changeFeatureFlag: 'change-feature-flag',\n  // Turns one flag off, and nothing else. A rollback needs fewer approvals\n  // than a change.\n  disableFeatureFlag: 'disable-feature-flag',\n  // The publish and the rollback of a release-train generation. See\n  // `release-train.ts` beside this file.\n  releaseTrainPublish: 'release-train-publish',\n  releaseTrainRollback: 'release-train-rollback',\n  // Open to every Camundi, and it needs no approval on any stage.\n  createPersonalOrganisation: 'create-personal-organisation',\n  // Open to every Camundi, runs on dev only, and needs no approval. The two\n  // use cases of custom hardware sizing.\n  createCustomHardwareSizing: 'create-custom-hardware-sizing',\n  removeCustomHardwareSizing: 'remove-custom-hardware-sizing',\n  // The mutable versions of one or more generations, behind\n  // `control.camundiApprovalFlow`. Console restarts every cluster of\n  // each generation, which is why the write needs a second Camundi.\n  changeGenerationVersions: 'change-generation-versions',\n  // The name and the env vars of one generation, behind\n  // `control.camundiApprovalFlow`. Console sends a new spec to every cluster of\n  // the generation, which is why the write needs a second Camundi.\n  editGeneration: 'edit-generation',\n  // A new enterprise customer: a production and a development organization\n  // in one step, behind `control.camundiApprovalFlow`. See\n  // `automated-enterprise-onboarding.ts` in control-backend.\n  automatedEnterpriseOnboarding: 'automated-enterprise-onboarding',\n  // Open to every Camundi, runs on dev only, and needs no approval. The two\n  // use cases of custom generations.\n  createCustomGeneration: 'create-custom-generation',\n  removeCustomGeneration: 'remove-custom-generation',\n  // Open to org owners, runs on dev only, and needs no approval. It applies\n  // or deactivates a cluster modification config of one cluster.\n  selfServiceClusterModification: 'self-service-cluster-modification',\n  // The enterprise onboarding of one organization, behind\n  // `control.camundiApprovalFlow`: the contract, the plan type of\n  // each cluster, and the reservations, in one request.\n  onboardToEnterprise: 'onboard-to-enterprise',\n  // The term, the start date and the included value metrics of the contract\n  // of one enterprise organization, behind `control.camundiApprovalFlow`. See\n  // `change-enterprise-contract.ts` in control-backend.\n  changeEnterpriseContract: 'change-enterprise-contract',\n  // The plan type and the hardware packages of ONE cluster, behind\n  // `control.camundiApprovalFlow`. The bulk plan type update beside it also\n  // checks the reservations and moves the cluster plan, but each cluster\n  // keeps its packages there. This one can change the packages, and it has a\n  // stale guard. See `change-cluster-plan-type.ts` in control-backend.\n  changeClusterPlanType: 'change-cluster-plan-type',\n  // The deletion of one cluster whose TTL ran out. Only the delete cron of\n  // console-backend opens it, and it needs no approval. It is a record of the\n  // deletion. See `cluster-ttl-deletion.ts` in control-backend.\n  clusterTtlDeletion: 'cluster-ttl-deletion',\n  // The deletion of the DB corpses or of the Kubernetes corpses that console\n  // finds, behind `control.camundiApprovalFlow`. See\n  // `delete-cluster-corpses.ts` in control-backend.\n  deleteClusterCorpses: 'delete-cluster-corpses',\n  // The force delete of a cluster plan type and of every cluster on it,\n  // behind `control.camundiApprovalFlow`. See\n  // `force-delete-cluster-plan-type.ts` in control-backend.\n  forceDeleteClusterPlanType: 'force-delete-cluster-plan-type',\n  // A change of the data retention limits of a cluster plan type, which\n  // console sends to every cluster of the type. Behind\n  // `control.camundiApprovalFlow`. See\n  // `change-plan-type-retention-limits.ts` in control-backend.\n  changePlanTypeRetentionLimits: 'change-plan-type-retention-limits',\n  // The generation upgrade of one cluster with `--yolo` or with the upgrade\n  // gate ignored, behind `control.camundiApprovalFlow`. A plain upgrade stays\n  // a direct call. See `force-generation-upgrade.ts` in control-backend.\n  forceGenerationUpgrade: 'force-generation-upgrade',\n  // The deletion of one Console API client of an organization. See\n  // `delete-api-client.ts` in control-backend.\n  deleteApiClient: 'delete-api-client',\n  // The licensing model of one enterprise organization, behind\n  // `control.camundiApprovalFlow`. See `change-licensing-model.ts` in\n  // control-backend.\n  changeLicensingModel: 'change-licensing-model',\n  // A time-limited grant that lets one Camundi run a pending request with no\n  // approval, and the scheduled request that ends it. Behind\n  // `control.approvalOverride`. See `approval-override.ts` in control-backend.\n  grantApprovalOverride: 'grant-approval-override',\n  revokeApprovalOverride: 'revoke-approval-override',\n  // The deletion of the managed LLM tenant of one organization: the tenant,\n  // the key and the spend history. Behind `control.camundiApprovalFlow`. See\n  // `delete-managed-llm-tenant.ts` in control-backend.\n  deleteManagedLlmTenant: 'delete-managed-llm-tenant',\n} as const\n\n/** The longest approval override grant, in hours: 14 days. */\nexport const APPROVAL_OVERRIDE_MAX_HOURS = 14 * 24\n\n/** The duration that the form of control-frontend offers first: one day. */\nexport const APPROVAL_OVERRIDE_DEFAULT_HOURS = 24\n\n/**\n * The use cases that an approval override grant can NOT run.\n *\n * Every other use case is overridable. These change who holds a permission,\n * the override mechanism itself, the feature flags of a stage, the address\n * that a person signs in with, or delete customer data, a backup, a sign-in\n * path, or a whole fleet of clusters. None of them is an emergency that one\n * Camundi must fix alone.\n *\n * The list fails open: a use case that is not here IS overridable. Thus a new\n * use case that deletes or that changes access must be added here. Its route\n * in accounts-backend or console-backend then refuses `overriddenBy` by\n * itself: `approvalActorSchemaFor` of their `AdminApprovalsRouter.ts` reads\n * this list.\n */\nexport const APPROVAL_OVERRIDE_DENYLIST: readonly string[] = [\n  APPROVAL_USE_CASE_TYPES.changePlatformRoles,\n  APPROVAL_USE_CASE_TYPES.grantApprovalOverride,\n  APPROVAL_USE_CASE_TYPES.revokeApprovalOverride,\n  APPROVAL_USE_CASE_TYPES.changeFeatureFlag,\n  APPROVAL_USE_CASE_TYPES.disableFeatureFlag,\n  APPROVAL_USE_CASE_TYPES.purgeUsers,\n  APPROVAL_USE_CASE_TYPES.deleteUser,\n  APPROVAL_USE_CASE_TYPES.deleteOrganization,\n  APPROVAL_USE_CASE_TYPES.clusterBulkDeletion,\n  APPROVAL_USE_CASE_TYPES.forceDeleteClusterPlanType,\n  APPROVAL_USE_CASE_TYPES.releaseTrainPublish,\n  APPROVAL_USE_CASE_TYPES.releaseTrainRollback,\n  APPROVAL_USE_CASE_TYPES.deleteSsoConnection,\n  APPROVAL_USE_CASE_TYPES.changeUserEmail,\n  APPROVAL_USE_CASE_TYPES.deleteInternalBackup,\n  APPROVAL_USE_CASE_TYPES.deleteApiClient,\n  APPROVAL_USE_CASE_TYPES.removeOrgMember,\n  APPROVAL_USE_CASE_TYPES.deleteManagedLlmTenant,\n]\n\n/** isApprovalOverridable reports whether a grant can run a request of this type. */\nexport const isApprovalOverridable = (type: string): boolean =>\n  !APPROVAL_OVERRIDE_DENYLIST.includes(type)\n\n/**\n * The most personal organizations that one Camundi can request.\n *\n * The request runs with no approval, so this cap is the only guard against a\n * loop that creates organizations without end. It counts the requests that a\n * Camundi opened, and a person who needs more asks a Camundi who holds\n * `AccountsPermissions.CREATE_ORG`.\n */\nexport const PERSONAL_ORGANIZATION_MAX_PER_REQUESTER = 10\n\n/** The shortest and longest name of a personal organization. */\nexport const PERSONAL_ORGANIZATION_NAME_MIN_LENGTH = 3\nexport const PERSONAL_ORGANIZATION_NAME_MAX_LENGTH = 100\n\nexport type ApprovalUseCaseType =\n  (typeof APPROVAL_USE_CASE_TYPES)[keyof typeof APPROVAL_USE_CASE_TYPES]\n\n/**\n * The shortest extension that accounts-backend accepts.\n *\n * `POST /:orgId/extendtrial` refuses a date that is less than 14 days away\n * when the body carries `onBehalfOf`, and it measures those 14 days when the\n * CALL arrives. The floor here is 15 and not 14, for two reasons:\n *\n * - The two clocks are not the same instant. Accounts builds its own \"14 days\n *   from now\" a few milliseconds after control-backend builds the date, so a\n *   date of exactly 14 days is already in the past for the comparison.\n * - Accounts counts with `setDate`, which is calendar arithmetic. A change of\n *   the daylight saving time moves its limit by an hour.\n */\nexport const EXTEND_TRIAL_MIN_DAYS = 15\n\n/**\n * The longest extension that accounts-backend accepts.\n *\n * The same route refuses a date more than 62 days away. 61 keeps the same\n * margin as the floor above.\n */\nexport const EXTEND_TRIAL_MAX_DAYS = 61\n\n/**\n * The most roles that one change-platform-roles request adds, or removes.\n *\n * The form of control-frontend offers every platform role, and a person who\n * gives a Camundi a new position rarely changes more than a few. A request with\n * more roles than this is a request that nobody reads before they approve it.\n */\nexport const PLATFORM_ROLE_CHANGE_MAX_ROLES = 10\n\n/**\n * The longest text value that one change-org-limits request writes.\n *\n * A text limit holds a short value, such as a list of regions. The bound keeps\n * a request readable for the person who approves it.\n */\nexport const ORG_LIMIT_TEXT_MAX_LENGTH = 2000\n\n/**\n * LLM_BUDGET_TOP_UP_THRESHOLD is the share of the budget that the spend of a\n * managed LLM key must reach before a top-up is the normal case.\n *\n * A request below it is still possible, but the person who asks must confirm\n * it, and the request says so to the approver. Accounts refuses a top-up\n * below it that does not carry that confirmation.\n */\nexport const LLM_BUDGET_TOP_UP_THRESHOLD = 0.9\n\n/**\n * isLlmSpendBelowTopUpThreshold reports whether a top-up of a managed LLM key\n * needs the explicit confirmation of `LLM_BUDGET_TOP_UP_THRESHOLD`.\n */\nexport const isLlmSpendBelowTopUpThreshold = (\n  spend: number,\n  maxBudget: number,\n): boolean => spend < maxBudget * LLM_BUDGET_TOP_UP_THRESHOLD\n\n/**\n * The most users that one purge-users request deletes.\n *\n * The God Mode purge deletes one user after the other, and Auth0 limits how\n * fast that goes. A list longer than this is also a list that no approver\n * reads before they agree.\n */\nexport const PURGE_USERS_MAX_USERS = 1000\n\n/**\n * What a person must hold to open or to approve a purge-users request.\n *\n * The purge route of accounts, `DELETE /api/users/:userId/purge`, needs both\n * of the caller. The approval route of accounts checks both of the person who\n * asked, when control-backend sends `purge: true`. The use case of\n * control-backend returns this list from `permissionsFor`, and the form passes\n * it to `canCreate`, so the button and the server never disagree.\n */\nexport const PURGE_USERS_REQUIRED_PERMISSIONS: readonly string[] = [\n  AccountsPermissions.GOD_PURGE_USERS,\n  AccountsPermissions.DELETE_USER,\n]\n\n/**\n * What a person must hold to open or to approve a remove-org-member request,\n * with or without a new owner. CS holds it through the Camundi permission\n * rules. Accounts checks the same list for the person who asked.\n */\nexport const REMOVE_ORG_MEMBER_REQUIRED_PERMISSIONS: readonly string[] = [\n  AccountsPermissions.REMOVE_FROM_ORG_WITH_APPROVAL,\n]\n\n/**\n * The largest metadata object that one update-user-metadata request writes,\n * in characters of its JSON text.\n *\n * This is a bound of the product, and not the limit of Auth0, which is far\n * larger. The approvers read the whole object before they agree, and an\n * object that is longer than this is an object that nobody reads.\n */\nexport const USER_METADATA_MAX_LENGTH = 16_000\n\n/**\n * The largest metadata object that a request carries as the object that the\n * person who asked READ.\n *\n * It is larger than `USER_METADATA_MAX_LENGTH`, so a user whose metadata grew\n * past that bound can still get an edit that makes it smaller. It still has a\n * bound, because the request keeps the copy in its row.\n */\nexport const USER_METADATA_EXPECTED_MAX_LENGTH = 500_000\n\n/**\n * The bounds of an automated-enterprise-onboarding request.\n *\n * The accounts wizard holds the first four, and the schema of control-backend\n * and the form of control-frontend read them here, so the form never sends\n * what the service refuses.\n */\nexport const ENTERPRISE_ONBOARDING_NAME_MAX_LENGTH = 50\nexport const ENTERPRISE_ONBOARDING_SFDC_ID_MAX_LENGTH = 50\nexport const ENTERPRISE_ONBOARDING_TERM_MIN_MONTHS = 1\nexport const ENTERPRISE_ONBOARDING_TERM_MAX_MONTHS = 60\n/** The most of one value metric that a contract includes. */\nexport const ENTERPRISE_ONBOARDING_METRIC_MAX = 1_000_000_000_000\n/**\n * The most clusters of one plan type that an onboarding reserves: the cap of\n * the accounts wizard. Accounts checks the limit of the plan only when it\n * reserves, after it created the two organizations, so the request must not\n * carry a count that the plan refuses.\n */\nexport const ENTERPRISE_ONBOARDING_RESERVATION_MAX = 20\n\n/**\n * The most clusters of one plan type that a change-org-reservations request\n * reserves. The approval route of accounts-ng has the same bound.\n * `PATCH /api/salesplans/reserved` has no bound. A request with `force`\n * skips the maximum of the sales plan, thus this bound is its only bound.\n */\nexport const ORG_RESERVATION_MAX = 1000\n\n/**\n * Whether a string is a calendar day, `YYYY-MM-DD`, that exists.\n *\n * The shape alone is not enough: `Date` rolls `2026-02-30` to March 2 with\n * no error, and `2026-13-45` becomes an invalid date that a database refuses\n * only at the write. A request carries the day for days before it runs, so\n * the check is at the open, and in the form.\n */\nexport const isCalendarDay = (value: string): boolean =>\n  /^\\d{4}-\\d{2}-\\d{2}$/.test(value) &&\n  !Number.isNaN(Date.parse(value)) &&\n  new Date(value).toISOString().startsWith(value)\n\n/**\n * What a person must hold to open or to approve a change-enterprise-contract\n * request.\n *\n * `PATCH /:orgId/enterprise` of accounts needs `ENTERPRISE_ORG_MODIFY`, and\n * also `ENTERPRISE_ORG_MODIFY_START_DATE` for a new start date. The approval\n * route of accounts checks the same list for the person who asked. The use\n * case of control-backend returns this list from `permissionsFor`, and the\n * form passes it to `canCreate`, so the button and the server never disagree.\n */\nexport const enterpriseContractChangePermissions = (\n  changesStartDate: boolean,\n): string[] =>\n  changesStartDate\n    ? [\n        AccountsPermissions.ENTERPRISE_ORG_MODIFY,\n        AccountsPermissions.ENTERPRISE_ORG_MODIFY_START_DATE,\n      ]\n    : [AccountsPermissions.ENTERPRISE_ORG_MODIFY]\n\n/** The longest email address that a change-user-email request carries. */\nexport const APPROVAL_EMAIL_MAX_LENGTH = 320\n\n/**\n * The email addresses that a change-user-email request accepts.\n *\n * It is the email pattern of zod 4.6. The pattern is here, so the schema of\n * control-backend and the form of control-frontend accept the same addresses,\n * and a form never sends an address that the service refuses.\n */\nexport const APPROVAL_EMAIL_PATTERN =\n  // biome-ignore lint/complexity/noUselessEscapeInRegex: the same source as zod, character for character\n  /^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$/\n\n/**\n * The most generations that one change-generation-versions request changes.\n *\n * Each generation restarts every cluster on it. A request over more\n * generations than this is a request that no approver reads to the end.\n *\n * The two bounds of this use case also keep a request under the body limit\n * of control-backend (1 MiB, `server-options.ts` of the shared Fastify\n * layer): 20 generations, each with the expected value of the 2 image\n * versions of 2000 characters, is 80 000 characters before the rest of the\n * payload.\n */\nexport const GENERATION_VERSIONS_MAX_GENERATIONS = 20\n\n/**\n * The longest value of one mutable version of a generation.\n *\n * An image reference is short, and only the two image versions go through\n * the use case (`GENERATION_IMAGE_VERSION_KEYS`). The bound keeps a request\n * readable for the approver. See `GENERATION_VERSIONS_MAX_GENERATIONS` for\n * the sum.\n */\nexport const GENERATION_VERSION_VALUE_MAX_LENGTH = 2000\n"],
+  "mappings": "AAMA,SAAS,2BAA2B;AAkB7B,MAAM,0BAA0B;AAAA,EACrC,oBAAoB;AAAA,EACpB,aAAa;AAAA,EACb,gBAAgB;AAAA;AAAA;AAAA;AAAA,EAIhB,6BAA6B;AAAA,EAC7B,uBAAuB;AAAA,EACvB,2BAA2B;AAAA,EAC3B,wBAAwB;AAAA,EACxB,qBAAqB;AAAA,EACrB,uBAAuB;AAAA;AAAA,EAEvB,qBAAqB;AAAA,EACrB,sBAAsB;AAAA,EACtB,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA,EAKjB,uBAAuB;AAAA,EACvB,qBAAqB;AAAA,EACrB,iBAAiB;AAAA,EACjB,gBAAgB;AAAA,EAChB,sBAAsB;AAAA,EACtB,iBAAiB;AAAA;AAAA,EAEjB,oBAAoB;AAAA,EACpB,YAAY;AAAA,EACZ,iBAAiB;AAAA,EACjB,YAAY;AAAA,EACZ,oBAAoB;AAAA;AAAA;AAAA,EAGpB,mBAAmB;AAAA;AAAA;AAAA,EAGnB,oBAAoB;AAAA;AAAA;AAAA,EAGpB,qBAAqB;AAAA,EACrB,sBAAsB;AAAA;AAAA,EAEtB,4BAA4B;AAAA;AAAA;AAAA,EAG5B,4BAA4B;AAAA,EAC5B,4BAA4B;AAAA;AAAA;AAAA;AAAA,EAI5B,0BAA0B;AAAA;AAAA;AAAA;AAAA,EAI1B,gBAAgB;AAAA;AAAA;AAAA;AAAA,EAIhB,+BAA+B;AAAA;AAAA;AAAA,EAG/B,wBAAwB;AAAA,EACxB,wBAAwB;AAAA;AAAA;AAAA,EAGxB,gCAAgC;AAAA;AAAA;AAAA;AAAA,EAIhC,qBAAqB;AAAA;AAAA;AAAA;AAAA,EAIrB,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM1B,uBAAuB;AAAA;AAAA;AAAA;AAAA,EAIvB,oBAAoB;AAAA;AAAA;AAAA;AAAA,EAIpB,sBAAsB;AAAA;AAAA;AAAA;AAAA,EAItB,4BAA4B;AAAA;AAAA;AAAA;AAAA;AAAA,EAK5B,+BAA+B;AAAA;AAAA;AAAA;AAAA,EAI/B,wBAAwB;AAAA;AAAA;AAAA,EAGxB,iBAAiB;AAAA;AAAA;AAAA;AAAA,EAIjB,sBAAsB;AAAA;AAAA;AAAA;AAAA,EAItB,uBAAuB;AAAA,EACvB,wBAAwB;AAAA;AAAA;AAAA;AAAA,EAIxB,wBAAwB;AAC1B;AAGO,MAAM,8BAA8B,KAAK;AAGzC,MAAM,kCAAkC;AAiBxC,MAAM,6BAAgD;AAAA,EAC3D,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,wBAAwB;AAC1B;AAGO,MAAM,wBAAwB,CAAC,SACpC,CAAC,2BAA2B,SAAS,IAAI;AAUpC,MAAM,0CAA0C;AAGhD,MAAM,wCAAwC;AAC9C,MAAM,wCAAwC;AAkB9C,MAAM,wBAAwB;AAQ9B,MAAM,wBAAwB;AAS9B,MAAM,iCAAiC;AAQvC,MAAM,4BAA4B;AAUlC,MAAM,8BAA8B;AAMpC,MAAM,gCAAgC,CAC3C,OACA,cACY,QAAQ,YAAY;AAS3B,MAAM,wBAAwB;AAW9B,MAAM,mCAAsD;AAAA,EACjE,oBAAoB;AAAA,EACpB,oBAAoB;AACtB;AAOO,MAAM,yCAA4D;AAAA,EACvE,oBAAoB;AACtB;AAUO,MAAM,2BAA2B;AAUjC,MAAM,oCAAoC;AAS1C,MAAM,wCAAwC;AAC9C,MAAM,2CAA2C;AACjD,MAAM,wCAAwC;AAC9C,MAAM,wCAAwC;AAE9C,MAAM,mCAAmC;AAOzC,MAAM,wCAAwC;AAQ9C,MAAM,sBAAsB;AAU5B,MAAM,gBAAgB,CAAC,UAC5B,sBAAsB,KAAK,KAAK,KAChC,CAAC,OAAO,MAAM,KAAK,MAAM,KAAK,CAAC,KAC/B,IAAI,KAAK,KAAK,EAAE,YAAY,EAAE,WAAW,KAAK;AAYzC,MAAM,sCAAsC,CACjD,qBAEA,mBACI;AAAA,EACE,oBAAoB;AAAA,EACpB,oBAAoB;AACtB,IACA,CAAC,oBAAoB,qBAAqB;AAGzC,MAAM,4BAA4B;AASlC,MAAM;AAAA;AAAA,EAEX;AAAA;AAcK,MAAM,sCAAsC;AAU5C,MAAM,sCAAsC;",
   "names": []
 }

package/dist/dtos/FleetStats.dto.d.ts

@@ -0,0 +1,22 @@
+/**
+ * One row of `GET /api/fleet-stats` of control-backend: the count of one
+ * entity on one day, for one value of one dimension. The description of that
+ * route in the OpenAPI document of control-backend holds the rules of a row.
+ */
+export interface FleetStatRowDto {
+    /** `YYYY-MM-DD`, UTC. */
+    snapshotDate: string;
+    source: string;
+    entity: string;
+    dimension: string;
+    dimensionValue: string;
+    count: number;
+    /** Only the `hostingCost` rows have it: the cost in USD. */
+    sumValue?: number;
+}
+/** One page of `GET /api/fleet-stats` of control-backend. */
+export interface FleetStatsPageDto {
+    rows: FleetStatRowDto[];
+    /** True when the range holds more rows than this page. */
+    hasMore: boolean;
+}

package/dist/dtos/FleetStats.dto.js

@@ -0,0 +1 @@
+//# sourceMappingURL=FleetStats.dto.js.map

package/dist/dtos/FleetStats.dto.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": [],
+  "sourcesContent": [],
+  "mappings": "",
+  "names": []
+}

package/dist/index.d.ts

@@ -36,7 +36,7 @@ export type { ApprovalActorView, ApprovalDecision, ApprovalDenialCode, } from '.
 export { approvalPermissionCheck, canAcknowledge, canCreate, canExecute, canOverride, canReject, canRunOverridden, canView, canWithdraw, createPermissionsOf, EXECUTE_WINDOW_DAYS, effectiveStatus, hasActorEmail, hasEveryPermission, hasFailedRun, isExpired, isOverrideGrantActive, isRunWindowClosed, isSameActor, isSameActorEmail, needsReason, OVERRIDE_GRANT_ENDED_MESSAGE, opensWithOwnApproval, overrideGranteeOf, remainingAcks, requiredPermissionsOf, resolveRequiredAcks, runWindowEnd, } from './approvals/policy.js';
 export type { ReleaseTrainAutoUpgradeCandidates, ReleaseTrainPublishPayload, ReleaseTrainRollbackPayload, } from './approvals/release-train.js';
 export type { ApprovalUseCaseType } from './approvals/use-cases.const.js';
-export { APPROVAL_EMAIL_MAX_LENGTH, APPROVAL_EMAIL_PATTERN, APPROVAL_OVERRIDE_DEFAULT_HOURS, APPROVAL_OVERRIDE_DENYLIST, APPROVAL_OVERRIDE_MAX_HOURS, APPROVAL_USE_CASE_TYPES, ENTERPRISE_ONBOARDING_METRIC_MAX, ENTERPRISE_ONBOARDING_NAME_MAX_LENGTH, ENTERPRISE_ONBOARDING_RESERVATION_MAX, ENTERPRISE_ONBOARDING_SFDC_ID_MAX_LENGTH, ENTERPRISE_ONBOARDING_TERM_MAX_MONTHS, ENTERPRISE_ONBOARDING_TERM_MIN_MONTHS, EXTEND_TRIAL_MAX_DAYS, EXTEND_TRIAL_MIN_DAYS, enterpriseContractChangePermissions, GENERATION_VERSION_VALUE_MAX_LENGTH, GENERATION_VERSIONS_MAX_GENERATIONS, isApprovalOverridable, isCalendarDay, isLlmSpendBelowTopUpThreshold, LLM_BUDGET_TOP_UP_THRESHOLD, ORG_LIMIT_TEXT_MAX_LENGTH, PERSONAL_ORGANIZATION_MAX_PER_REQUESTER, PERSONAL_ORGANIZATION_NAME_MAX_LENGTH, PERSONAL_ORGANIZATION_NAME_MIN_LENGTH, PLATFORM_ROLE_CHANGE_MAX_ROLES, PURGE_USERS_MAX_USERS, PURGE_USERS_REQUIRED_PERMISSIONS, REMOVE_ORG_MEMBER_REQUIRED_PERMISSIONS, USER_METADATA_EXPECTED_MAX_LENGTH, USER_METADATA_MAX_LENGTH, } from './approvals/use-cases.const.js';
+export { APPROVAL_EMAIL_MAX_LENGTH, APPROVAL_EMAIL_PATTERN, APPROVAL_OVERRIDE_DEFAULT_HOURS, APPROVAL_OVERRIDE_DENYLIST, APPROVAL_OVERRIDE_MAX_HOURS, APPROVAL_USE_CASE_TYPES, ENTERPRISE_ONBOARDING_METRIC_MAX, ENTERPRISE_ONBOARDING_NAME_MAX_LENGTH, ENTERPRISE_ONBOARDING_RESERVATION_MAX, ENTERPRISE_ONBOARDING_SFDC_ID_MAX_LENGTH, ENTERPRISE_ONBOARDING_TERM_MAX_MONTHS, ENTERPRISE_ONBOARDING_TERM_MIN_MONTHS, EXTEND_TRIAL_MAX_DAYS, EXTEND_TRIAL_MIN_DAYS, enterpriseContractChangePermissions, GENERATION_VERSION_VALUE_MAX_LENGTH, GENERATION_VERSIONS_MAX_GENERATIONS, isApprovalOverridable, isCalendarDay, isLlmSpendBelowTopUpThreshold, LLM_BUDGET_TOP_UP_THRESHOLD, ORG_LIMIT_TEXT_MAX_LENGTH, ORG_RESERVATION_MAX, PERSONAL_ORGANIZATION_MAX_PER_REQUESTER, PERSONAL_ORGANIZATION_NAME_MAX_LENGTH, PERSONAL_ORGANIZATION_NAME_MIN_LENGTH, PLATFORM_ROLE_CHANGE_MAX_ROLES, PURGE_USERS_MAX_USERS, PURGE_USERS_REQUIRED_PERMISSIONS, REMOVE_ORG_MEMBER_REQUIRED_PERMISSIONS, USER_METADATA_EXPECTED_MAX_LENGTH, USER_METADATA_MAX_LENGTH, } from './approvals/use-cases.const.js';
 export { CHART_DAY_GRAIN_MAX_DAYS, CHART_FILTER_MAX_LENGTH, CHART_GRAIN_DEFAULT, CHART_GRAINS, CHART_ID_MAX_LENGTH, CHART_METRICS, CHART_OTHER_SERIES_KEY, CHART_QUERY_MAX_LENGTH, CHART_TOP_DEFAULT, CHART_TOP_MAX, CHART_UNKNOWN_SERIES_KEY, CHART_WINDOW_AMOUNT_MAX, CHART_WINDOW_DEFAULT, CHART_WINDOW_UNITS, type ChartDimensionSpec, type ChartGrain, type ChartMetricSpec, type ChartPoint, type ChartQueryCheck, ChartQueryError, type ChartQueryErrorKind, type ChartQueryOptions, type ChartResult, type ChartSeries, type ChartSpec, type ChartUnit, type ChartWindow, type ChartWindowUnit, chartBucketStart, chartToday, chartWindowRange, findChartDimension, findChartMetric, formatChartSpec, isChartQueryError, parseChartQuery, readChartSpec, validateChartSpec, } from './charts/index.js';
 export { DASHBOARD_TILE_DEFAULT_SIZE, dashboardDefinitionBytes, dashboardDefinitionFits, dashboardTileDefaultSize, emptyDashboardDefinition, isSafeDashboardLink, placeNewTile, placeNewTiles, tilesOverlap, toStoredDashboardDefinition, upgradeDashboardDefinition, } from './dashboards/definition.js';
 export type { ActiveUsersDto } from './dtos/ActiveUsers.dto.js';
@@ -72,6 +72,7 @@ export { DASHBOARD_CHART_RENDERS, DASHBOARD_CLUSTER_CARDS, DASHBOARD_DEFINITION_
 export type { EarlyAccessFeatureDto } from './dtos/EarlyAccessFeature.dto.js';
 export type { CamundaWebApp, CamundaWebAppWithZeebe, ExternalClickwrapConfigDto, ExternalClusterDto, ExternalOrganizationDto, } from './dtos/ExternalWebapp.dto.js';
 export type { CreateFeatureFlagDto, FeatureFlagAnswer, FeatureFlagDto, FeatureFlagListDto, UpdateFeatureFlagDto, } from './dtos/FeatureFlags.dto.js';
+export type { FleetStatRowDto, FleetStatsPageDto, } from './dtos/FleetStats.dto.js';
 export type { ClusterGenerationStateDto, ForceGenerationUpgradeResult, } from './dtos/ForceGenerationUpgrade.dto.js';
 export { activeGenerations, compareGenerationNamesNewestFirst, type GenerationDto, type GenerationWithClusterCountDto, sortGenerationBySemverOfZeebe, type UpgradableGenerationsDto, } from './dtos/Generations.dto.js';
 export type { ChangeGenerationVersionsResult } from './dtos/GenerationVersionsChange.dto.js';

package/dist/index.js

@@ -259,6 +259,7 @@ import {
   isLlmSpendBelowTopUpThreshold,
   LLM_BUDGET_TOP_UP_THRESHOLD,
   ORG_LIMIT_TEXT_MAX_LENGTH,
+  ORG_RESERVATION_MAX,
   PERSONAL_ORGANIZATION_MAX_PER_REQUESTER,
   PERSONAL_ORGANIZATION_NAME_MAX_LENGTH,
   PERSONAL_ORGANIZATION_NAME_MIN_LENGTH,
@@ -938,6 +939,7 @@ export {
   ORGANIZATION_SEARCH_FIELDS,
   ORG_DEFAULT_SEARCH_FIELDS,
   ORG_LIMIT_TEXT_MAX_LENGTH,
+  ORG_RESERVATION_MAX,
   OVERRIDE_GRANT_ENDED_MESSAGE,
   ObjectMergeUtils,
   OrganizationPermissionsDescriptions,

package/dist/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/index.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n// ============================================================================\n// Constants (runtime values)\n// ============================================================================\n\nexport {\n  ACTIVITY_RETENTION_CHOICES,\n  ACTIVITY_RETENTION_DEFAULT_MONTHS,\n  ACTIVITY_RETENTION_FLAG,\n  ACTIVITY_RETENTION_KEEP_FOREVER,\n  ACTIVITY_RETENTION_SYNC_CHUNK,\n  type ActivityRetentionMonths,\n  activityRetentionCutoff,\n  activityRetentionLabel,\n  isActivityRetentionMonths,\n  isLimitedActivityRetention,\n} from './constants/activity-retention.const.js'\nexport {\n  CUSTOM_GENERATION_MAX_PER_REQUESTER,\n  CUSTOM_GENERATION_MAX_UPGRADEABLE_FROM,\n  CUSTOM_GENERATION_NAME_MAX_LENGTH,\n  CUSTOM_GENERATION_NAME_MIN_LENGTH,\n  checkNewGenerationVersions,\n  isCustomGenerationStage,\n} from './constants/custom-generation.const.js'\nexport {\n  CUSTOM_HARDWARE_SIZING_BROKER_TOTAL_CAPS,\n  CUSTOM_HARDWARE_SIZING_COUNT_CAPS,\n  CUSTOM_HARDWARE_SIZING_ELASTICSEARCH_TOTAL_CAPS,\n  CUSTOM_HARDWARE_SIZING_MAX_AUTO_RESIZE_INCREASE_GI,\n  CUSTOM_HARDWARE_SIZING_MAX_PLAN_JSON_LENGTH,\n  CUSTOM_HARDWARE_SIZING_MAX_PLANS_PER_REQUESTER,\n  CUSTOM_HARDWARE_SIZING_NAME_MAX_LENGTH,\n  CUSTOM_HARDWARE_SIZING_NAME_MIN_LENGTH,\n  CUSTOM_HARDWARE_SIZING_REPLICA_SET_TOTAL_CAPS,\n  CUSTOM_HARDWARE_SIZING_RESOURCE_CAPS,\n  checkCustomHardwareSizing,\n  isCustomHardwareSizingStage,\n  parseKubernetesQuantity,\n} from './constants/custom-hardware-sizing.const.js'\nexport {\n  APPROVAL_ENTRY_HEADER,\n  CAMUNDI_APPROVAL_FLOW_FLAG,\n  DIRECT_ROUTE_LOCK_HEADERS,\n  DIRECT_ROUTE_LOCKED,\n  directRouteLockHeaders,\n  ERROR_CODE_HEADER,\n} from './constants/direct-route-lock.const.js'\nexport { DAY, HOUR, MINUTE, SECOND, WEEK } from './constants/duration.const.js'\nexport type { Stage } from './constants/misc.const.js'\nexport {\n  CAMUNDA_CLAIMS_NAMESPACE,\n  CONSOLE_API_USER_ID,\n  countBulkOperationAcks,\n  FIRSTNAME_LASTNAME_MAX_LENGTH,\n  HOTBACKUP_MIN_CREATE_PERIOD,\n  MAX_HARDWARE_PACKAGE_COUNT,\n  MAX_LENGTH_CLUSTER_NAME,\n  MIGRATION_BACKUP_ID_LABEL_PREFIX,\n  MINIMUM_EYEPAIRS,\n  MINIMUM_EYEPAIRS_BY_BULK_OPERATION_TYPE,\n  minimumBulkOperationAcks,\n  minimumBulkOperationEyes,\n  missingBulkOperationAcks,\n  NAMES_OF_ENTERPRISE_SALESPLANS_WITH_SLEEPING_CLUSTERS,\n  requiredBulkOperationAcks,\n  SECRETS_MAX_LENGTH,\n  STARTING_PRICE_PER_MONTH_IN_EURO,\n  TEMPORARY_CLUSTER_NAME,\n  UNKNOWN_ACTOR_EMAIL,\n} from './constants/misc.const.js'\nexport {\n  getGatewayPropertyHint,\n  getGatewayPropertyPath,\n  isAffectedByStreamlinedDeployment,\n  isPre89AffectedPath,\n  PRE89_AFFECTED_PATHS,\n  PRE89_AFFECTED_PROPERTY_PREFIXES,\n  PRE89_GATEWAY_PROPERTY_PATHS,\n  PRE89_GATEWAY_RESOURCE_PREFIXES,\n} from './constants/pre89EnvVarMapping.const.js'\nexport { PRIVATE_LINK_REGIONS } from './constants/privateLinkRegions.const.js'\nexport { SECURE_CONNECTIVITY_ALLOWED_ENTRIES_LIMIT } from './constants/secureConnectivity.const.js'\nexport { isSelfServiceClusterModificationStage } from './constants/self-service-cluster-modification.const.js'\nexport type {\n  TrialExtensionSurveyAnswer,\n  TrialExtensionSurveyQuestion,\n} from './constants/trialExtensionSurvey.const.js'\nexport { TRIAL_EXTENSION_SURVEY_QUESTIONS } from './constants/trialExtensionSurvey.const.js'\nexport {\n  V2_BODY_IDS_MAX,\n  V2_FILTER_IDS_MAX,\n  V2_MAX_PAGE_LIMIT,\n} from './constants/v2-list.const.js'\nexport {\n  ADMIN_APP_RENAME_MIN_VERSION,\n  APP_INTEGRATIONS_89_STREAM_CONNECTOR_BRIDGE_MIN_VERSION,\n  APP_INTEGRATIONS_89_STREAM_MINOR,\n  APP_INTEGRATIONS_89_STREAM_ZEEBE_MIN_VERSION,\n  APP_INTEGRATIONS_MIN_VERSION,\n  AUDIT_LOG_TAB_MIN_VERSION,\n  AUTHORIZATION_TOGGLE_MIN_VERSION,\n  AWS_ONLY_GENERATION_MIN_VERSION,\n  BUSINESS_ID_UNIQUENESS_MIN_VERSION,\n  BYOIDP_MIN_VERSION,\n  CLUSTER_SECRETS_LABEL_MIN_VERSION,\n  CLUSTER_STATISTICS_CONFIG_MIN_VERSION,\n  CONNECTOR_MANAGEMENT_METRICS_MIN_VERSION,\n  CONNECTOR_SECRET_SYNC_MIN_VERSION,\n  CONNECTORS_MANAGEMENT_LINK_MIN_VERSION,\n  ENFORCE_GROUPS_TASKLIST_V2_HIDDEN_MIN_VERSION,\n  ENFORCE_GROUPS_TOGGLE_MIN_VERSION,\n  GATEWAY_SPEC_8_9_MIN_VERSION,\n  HOT_BACKUP_MIN_VERSION,\n  IDENTITY_AUTHORIZATION_MIN_VERSION,\n  IDENTITY_AUTHORIZATION_NOTICE_MAX_VERSION,\n  IDENTITY_MANAGEMENT_MIN_VERSION,\n  INTERNAL_CONNECTORS_MANAGEMENT_MIN_VERSION,\n  JOB_DASHBOARD_MIN_VERSION,\n  LINE_8_9_MIN_VERSION,\n  LINE_8_10_MIN_VERSION,\n  MCP_MIN_VERSION,\n  MULTI_TENANCY_TOGGLE_MIN_VERSION,\n  NEW_CLUSTER_ROLES_MIN_VERSION,\n  OPTIMIZE_DEFAULT_ON_MIN_VERSION,\n  OPTIMIZE_FILTERING_MIN_VERSION,\n  OPTIONAL_TELEMETRY_MIN_VERSION,\n  RESOURCE_BASED_AUTHORIZATIONS_MIN_VERSION,\n  REST_API_URL_TRANSFORM_MIN_VERSION,\n  REST_API_V2_MIN_VERSION,\n  RESUME_ALPHA_MIN_VERSION,\n  SECRET_SOURCE_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_6_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_7_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_8_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_9_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_10_MIN_VERSION,\n  SESSION_CONFIG_MIN_VERSION,\n  SWAGGER_MIN_VERSION,\n  SWAGGER_URL_8_9_MIN_VERSION,\n  TASKLIST_MODE_TOGGLE_MIN_VERSION,\n  TASKLIST_UPGRADE_BANNER_MIN_VERSION,\n  TASKLIST_V2_AUTO_ENABLE_FROM_MINOR,\n  TASKLIST_V2_AUTO_ENABLE_TO_MINOR,\n  TASKLIST_V2_DEFAULT_ON_MIN_VERSION,\n  TASKLIST_V2_SETTING_MAX_VERSION,\n  TASKLIST_V2_UPGRADE_MIN_VERSION,\n  TASKLIST_V2_UPGRADE_TARGET_MIN_VERSION,\n  UPGRADE_READINESS_MIN_VERSION,\n  ZEEBE_REST_URL_MIN_VERSION,\n} from './constants/version-gates.const.js'\n\n// ============================================================================\n// DTOs - Types (interfaces and type aliases)\n// ============================================================================\n\n// Agent tokens - the read-only machine credentials of ccmacli. control-backend\n// stores them, and token-issuer, console-backend and accounts-backend read the\n// same claim and permission sets.\nexport type {\n  AgentAccess,\n  AgentClaim,\n  AgentGrantCreated,\n  AgentGrantRefusal,\n  AgentGrantRefusalReason,\n  AgentStatusResponse,\n  AgentToken,\n  AgentTokenAdmin,\n  AgentTokenCreated,\n  AgentTokenExpiryDays,\n  AgentTokenKind,\n  AgentTokenStatus,\n  AgentVerifyResponse,\n  CreateAgentGrantDto,\n  CreateAgentTokenDto,\n  ExtendAgentTokenDto,\n  RedeemAgentGrantDto,\n} from './agent-tokens/agent-tokens.js'\nexport {\n  AGENT_CLAIM,\n  AGENT_CLIENT_ID_PREFIX,\n  AGENT_ERROR,\n  AGENT_GRANT_TTL_MS,\n  AGENT_GRANTS_PER_HOUR_MAX,\n  AGENT_READ_PERMISSIONS,\n  AGENT_SLACK_CHANNEL_PATTERN,\n  AGENT_SLACK_GRANTS_FEATURE_FLAG,\n  AGENT_TOKEN_EXPIRY_DAYS,\n  AGENT_TOKEN_NAME_MAX,\n  AGENT_TOKEN_STATUSES,\n  AGENT_TOKENS_ACTIVE_MAX,\n  AGENT_TOKENS_FEATURE_FLAG,\n  agentReadPermissionUnion,\n  parseAgentClaim,\n} from './agent-tokens/agent-tokens.js'\n// Annotations - the notes and the tags that a Camundi attaches to a fleet\n// entity. The wire types and the rules are pure and browser-safe, so\n// control-backend and control-frontend run the same code.\nexport type {\n  AnnotationActorView,\n  AnnotationDecision,\n  AnnotationDenialCode,\n} from './annotations/policy.js'\nexport {\n  ANNOTATION_DENIAL_MESSAGES,\n  canEditNote,\n  canRemove,\n  checkNoteBody,\n  checkTagName,\n  isAuthor,\n} from './annotations/policy.js'\nexport type {\n  ApprovalRule,\n  StageDependentApprovalType,\n} from './approvals/approval-rules.js'\nexport {\n  APPROVAL_RULES,\n  approvalsRequiredFor,\n} from './approvals/approval-rules.js'\nexport type {\n  ChangePlanTypeRetentionLimitsResult,\n  ClusterPlanTypeLimitsDto,\n  PlanTypeRetentionLimitKey,\n} from './approvals/change-plan-type-retention-limits.js'\nexport {\n  isRetentionLimitInBounds,\n  PLAN_TYPE_RETENTION_LIMIT_KEY_LIST,\n  PLAN_TYPE_RETENTION_LIMIT_KEYS,\n  retentionLimitsOf,\n  sameRetentionLimits,\n} from './approvals/change-plan-type-retention-limits.js'\nexport type {\n  ClusterBulkClusterResultDto,\n  ClusterBulkFinalStatus,\n  ClusterBulkGenerationUpdateSettings,\n  ClusterBulkOperationPayloadDto,\n  ClusterBulkOperationRule,\n  ClusterBulkPlanTypeUpdateSettings,\n  ClusterBulkPlanUpdateSettings,\n  ClusterBulkSettingsByType,\n  ClusterBulkSleepWakeupSettings,\n  ClusterBulkStepRequestDto,\n  ClusterBulkStepResultDto,\n  ClusterBulkTargetDto,\n} from './approvals/cluster-bulk-operation.js'\nexport {\n  CLUSTER_BULK_OPERATION_CLUSTER_NAME_MAX_LENGTH,\n  CLUSTER_BULK_OPERATION_MAX_CLUSTERS,\n  CLUSTER_BULK_OPERATION_NAME_MAX_LENGTH,\n  CLUSTER_BULK_OPERATION_RULES,\n  CLUSTER_BULK_OPERATION_TYPES,\n  CLUSTER_BULK_SLEEPING_CLUSTER_DELAY_MS,\n  clusterBulkOperationTypeOf,\n  clusterBulkParameterOf,\n  clusterBulkRequiredPermissions,\n  clusterBulkResultOf,\n  isClusterBulkYolo,\n} from './approvals/cluster-bulk-operation.js'\nexport type {\n  ClusterCorpseDto,\n  ClusterCorpseKind,\n  ClusterCorpsesDto,\n  DeleteClusterCorpseResult,\n} from './approvals/delete-cluster-corpses.js'\nexport {\n  CLUSTER_CORPSE_KINDS,\n  CLUSTER_CORPSE_MIN_AGE_MS,\n  DELETE_CLUSTER_CORPSES_MAX,\n} from './approvals/delete-cluster-corpses.js'\nexport {\n  DNS_SUBDOMAIN_MAX_LENGTH,\n  isDnsSubdomain,\n} from './approvals/dns-subdomain.js'\nexport type { EditGenerationResult } from './approvals/edit-generation.js'\nexport {\n  EDIT_GENERATION_ENV_VARS_MAX_LENGTH,\n  EDIT_GENERATION_EXPECTED_MAX_LENGTH,\n  EDIT_GENERATION_NAME_MAX_LENGTH,\n} from './approvals/edit-generation.js'\nexport type { ApprovalExpectedChange } from './approvals/expected-value.js'\nexport {\n  isSameApprovalValue,\n  staleApprovalKeys,\n} from './approvals/expected-value.js'\nexport type {\n  ClusterPlanTypeClusterDto,\n  ClusterPlanTypeClustersDto,\n  ForceDeleteClusterPlanTypeStepResult,\n} from './approvals/force-delete-cluster-plan-type.js'\nexport { FORCE_DELETE_CLUSTER_PLAN_TYPE_MAX_CLUSTERS } from './approvals/force-delete-cluster-plan-type.js'\nexport type {\n  ApprovalActorView,\n  ApprovalDecision,\n  ApprovalDenialCode,\n} from './approvals/policy.js'\nexport {\n  approvalPermissionCheck,\n  canAcknowledge,\n  canCreate,\n  canExecute,\n  canOverride,\n  canReject,\n  canRunOverridden,\n  canView,\n  canWithdraw,\n  createPermissionsOf,\n  EXECUTE_WINDOW_DAYS,\n  effectiveStatus,\n  hasActorEmail,\n  hasEveryPermission,\n  hasFailedRun,\n  isExpired,\n  isOverrideGrantActive,\n  isRunWindowClosed,\n  isSameActor,\n  isSameActorEmail,\n  needsReason,\n  OVERRIDE_GRANT_ENDED_MESSAGE,\n  opensWithOwnApproval,\n  overrideGranteeOf,\n  remainingAcks,\n  requiredPermissionsOf,\n  resolveRequiredAcks,\n  runWindowEnd,\n} from './approvals/policy.js'\nexport type {\n  ReleaseTrainAutoUpgradeCandidates,\n  ReleaseTrainPublishPayload,\n  ReleaseTrainRollbackPayload,\n} from './approvals/release-train.js'\nexport type { ApprovalUseCaseType } from './approvals/use-cases.const.js'\nexport {\n  APPROVAL_EMAIL_MAX_LENGTH,\n  APPROVAL_EMAIL_PATTERN,\n  APPROVAL_OVERRIDE_DEFAULT_HOURS,\n  APPROVAL_OVERRIDE_DENYLIST,\n  APPROVAL_OVERRIDE_MAX_HOURS,\n  APPROVAL_USE_CASE_TYPES,\n  ENTERPRISE_ONBOARDING_METRIC_MAX,\n  ENTERPRISE_ONBOARDING_NAME_MAX_LENGTH,\n  ENTERPRISE_ONBOARDING_RESERVATION_MAX,\n  ENTERPRISE_ONBOARDING_SFDC_ID_MAX_LENGTH,\n  ENTERPRISE_ONBOARDING_TERM_MAX_MONTHS,\n  ENTERPRISE_ONBOARDING_TERM_MIN_MONTHS,\n  EXTEND_TRIAL_MAX_DAYS,\n  EXTEND_TRIAL_MIN_DAYS,\n  enterpriseContractChangePermissions,\n  GENERATION_VERSION_VALUE_MAX_LENGTH,\n  GENERATION_VERSIONS_MAX_GENERATIONS,\n  isApprovalOverridable,\n  isCalendarDay,\n  isLlmSpendBelowTopUpThreshold,\n  LLM_BUDGET_TOP_UP_THRESHOLD,\n  ORG_LIMIT_TEXT_MAX_LENGTH,\n  PERSONAL_ORGANIZATION_MAX_PER_REQUESTER,\n  PERSONAL_ORGANIZATION_NAME_MAX_LENGTH,\n  PERSONAL_ORGANIZATION_NAME_MIN_LENGTH,\n  PLATFORM_ROLE_CHANGE_MAX_ROLES,\n  PURGE_USERS_MAX_USERS,\n  PURGE_USERS_REQUIRED_PERMISSIONS,\n  REMOVE_ORG_MEMBER_REQUIRED_PERMISSIONS,\n  USER_METADATA_EXPECTED_MAX_LENGTH,\n  USER_METADATA_MAX_LENGTH,\n} from './approvals/use-cases.const.js'\n// The chart query of a dashboard tile (catalogue, language, result).\nexport {\n  CHART_DAY_GRAIN_MAX_DAYS,\n  CHART_FILTER_MAX_LENGTH,\n  CHART_GRAIN_DEFAULT,\n  CHART_GRAINS,\n  CHART_ID_MAX_LENGTH,\n  CHART_METRICS,\n  CHART_OTHER_SERIES_KEY,\n  CHART_QUERY_MAX_LENGTH,\n  CHART_TOP_DEFAULT,\n  CHART_TOP_MAX,\n  CHART_UNKNOWN_SERIES_KEY,\n  CHART_WINDOW_AMOUNT_MAX,\n  CHART_WINDOW_DEFAULT,\n  CHART_WINDOW_UNITS,\n  type ChartDimensionSpec,\n  type ChartGrain,\n  type ChartMetricSpec,\n  type ChartPoint,\n  type ChartQueryCheck,\n  ChartQueryError,\n  type ChartQueryErrorKind,\n  type ChartQueryOptions,\n  type ChartResult,\n  type ChartSeries,\n  type ChartSpec,\n  type ChartUnit,\n  type ChartWindow,\n  type ChartWindowUnit,\n  chartBucketStart,\n  chartToday,\n  chartWindowRange,\n  findChartDimension,\n  findChartMetric,\n  formatChartSpec,\n  isChartQueryError,\n  parseChartQuery,\n  readChartSpec,\n  validateChartSpec,\n} from './charts/index.js'\n// Dashboards - the tiles of a dashboard hold filters and never data. The\n// wire types and the placement rules are pure, so control-backend and\n// control-frontend run the same code.\nexport {\n  DASHBOARD_TILE_DEFAULT_SIZE,\n  dashboardDefinitionBytes,\n  dashboardDefinitionFits,\n  dashboardTileDefaultSize,\n  emptyDashboardDefinition,\n  isSafeDashboardLink,\n  placeNewTile,\n  placeNewTiles,\n  tilesOverlap,\n  toStoredDashboardDefinition,\n  upgradeDashboardDefinition,\n} from './dashboards/definition.js'\nexport type { ActiveUsersDto } from './dtos/ActiveUsers.dto.js'\nexport type {\n  ALERT_SUBSCRIPTION_REPORT_TYPES,\n  ALERT_SUBSCRIPTION_TYPES,\n  AlertSubscriptionDto,\n  AlertSubscriptionEntryDto,\n  AlertSubscriptionWebhookAuth,\n  CheckFailedReason,\n} from './dtos/AlertSubscription.dto.js'\n// DTOs - Values (constants)\nexport {\n  FORBIDDEN_HOSTNAMES_FOR_WEBHOOK_ALERTS,\n  HMAC_HEADER_POSITION,\n  HMAC_SUPPORTED_ALGORITHM,\n} from './dtos/AlertSubscription.dto.js'\nexport type {\n  AnnotationActor,\n  AnnotationDto,\n  AnnotationEntityKind,\n  AnnotationKind,\n  AnnotationLookupDto,\n  AnnotationLookupEntryDto,\n  AnnotationTagDto,\n  EntityAnnotationsDto,\n} from './dtos/Annotation.dto.js'\nexport {\n  ANNOTATION_BODY_MAX,\n  ANNOTATION_ENTITY_KIND_LABELS,\n  ANNOTATION_ENTITY_KINDS,\n  ANNOTATION_ENTITY_MAX,\n  ANNOTATION_KINDS,\n  ANNOTATION_LOOKUP_MAX_ENTITIES,\n  ANNOTATION_LOOKUP_TAGS_MAX,\n  ANNOTATION_PAGE_SIZE_DEFAULT,\n  ANNOTATION_PAGE_SIZE_MAX,\n  ANNOTATION_SEARCH_MAX_LENGTH,\n  ANNOTATION_TAG_NAME_MAX,\n  normalizeTagName,\n} from './dtos/Annotation.dto.js'\nexport type { ApiClientStatsDto } from './dtos/ApiClientStats.dto.js'\n// Approvals - the wire types, and the rules that read them. Both are pure and\n// browser-safe, so control-backend, control-frontend and cloudbot run the same\n// code and cannot disagree.\nexport type {\n  ApprovalAck,\n  ApprovalActionMode,\n  ApprovalActor,\n  ApprovalEntityRef,\n  ApprovalEntityType,\n  ApprovalExecutionMode,\n  ApprovalJobDto,\n  ApprovalJobStatus,\n  ApprovalM2mActor,\n  ApprovalOverrideGrantDto,\n  ApprovalProgress,\n  ApprovalSortField,\n  ApprovalSortOrder,\n  ApprovalStatusCountsDto,\n  ApprovalSummaryField,\n  ApprovalSummaryFieldKind,\n  ApprovalSummaryValue,\n  ApprovalUseCaseDto,\n} from './dtos/ApprovalJob.dto.js'\nexport {\n  APPROVAL_ACKS_MAX,\n  APPROVAL_ENTITY_TYPES,\n  APPROVAL_JOB_STATUSES,\n  APPROVAL_LIST_SUMMARY_VALUES_MAX,\n  APPROVAL_LIVE_STATUSES,\n  APPROVAL_PAGE_SIZE_DEFAULT,\n  APPROVAL_PAGE_SIZE_MAX,\n  APPROVAL_PAYLOAD_ORG_FIELD,\n  APPROVAL_REASON_MAX_LENGTH,\n  APPROVAL_RUN_STALE_MS,\n  APPROVAL_SEARCH_MAX_LENGTH,\n  APPROVAL_SORT_DEFAULT,\n  APPROVAL_SORT_FIELDS,\n  APPROVAL_SUMMARY_FIELD_KINDS,\n  APPROVAL_TYPE_FILTER_MAX,\n  APPROVAL_TYPE_MAX_LENGTH,\n  isRunStalled,\n  progressFraction,\n} from './dtos/ApprovalJob.dto.js'\nexport type {\n  ApprovalOrganizationNameResult,\n  ApprovalSummaryNamesRequest,\n  ApprovalSummaryNamesResult,\n} from './dtos/ApprovalSummaryNames.dto.js'\nexport type { AuditDto } from './dtos/Audit.dto.js'\nexport type { Auth0ResourceServerDto } from './dtos/Auth0ResourceServer.dto.js'\nexport type { BackupDto } from './dtos/Backup.dto.js'\nexport type { BackupScheduleDto } from './dtos/BackupSchedule.dto.js'\nexport type { ByomClientDto, ByomStatus } from './dtos/ByomClient.dto.js'\nexport type {\n  ClusterCreationDefaultField,\n  ClusterCreationDefaultKey,\n  ClusterCreationDefaults,\n} from './dtos/ClusterCreationDefaults.dto.js'\nexport { CLUSTER_CREATION_DEFAULT_FIELDS } from './dtos/ClusterCreationDefaults.dto.js'\nexport type {\n  ClusterDeferredSpecChange,\n  DeferredSpecChangeType,\n} from './dtos/ClusterDeferredSpecChange.dto.js'\nexport type { ClusterIpWhitelistDto } from './dtos/ClusterIpWhitelist.dto.js'\nexport type {\n  MoveClusterOwnerResult,\n  MoveClusterWarnings,\n} from './dtos/ClusterOwnerMove.dto.js'\nexport type { ClusterPlanDto } from './dtos/ClusterPlan.dto.js'\nexport type { ClusterPlanTypeDto } from './dtos/ClusterPlanType.dto.js'\nexport type {\n  ChangeClusterPlanTypeResult,\n  ClusterModificationConfigRef,\n  ClusterPlanTypeChangeRefusal,\n  ClusterPlanTypeStateDto,\n} from './dtos/ClusterPlanTypeChange.dto.js'\nexport {\n  CLUSTER_PLAN_TYPE_CHANGE_REFUSALS,\n  clusterPlanTypeChangeRefusalOf,\n} from './dtos/ClusterPlanTypeChange.dto.js'\nexport type {\n  ClusterSpecChange,\n  ClusterSpecChangeActor,\n  ClusterSpecHistory,\n} from './dtos/ClusterSpecHistory.dto.js'\nexport type {\n  CommonClusterDto,\n  ExternalIdpConfig,\n  OptimizeFilteringConfig,\n  OptimizeFilteringIncludeExclude,\n  OptimizeFilteringPatch,\n  SecretsFilterMode,\n  ZeebeRebalancingSetting,\n} from './dtos/CommonCluster.dto.js'\nexport type { ConsoleClusterDto } from './dtos/ConsoleCluster.dto.js'\nexport type {\n  ClusterActivityBucket,\n  ClusterActivityTile,\n  ClusterActivityV2Dto,\n  ClusterActivityV2Response,\n  ClusterByClientV2Dto,\n  ClusterDatacenterOptionV2Dto,\n  ClusterDetailV2Dto,\n  ClusterFacetsV2Dto,\n  ClusterListItemV2Dto,\n  ClusterLiveStateV2Dto,\n  ClusterLiveStateV2Entry,\n  ClusterModificationState,\n  ClusterParameterOptionV2Dto,\n  ClusterParametersV2Dto,\n  ClusterTtlFilter,\n  ControlResolvedPermissions,\n  ControlSessionDto,\n  ControlSessionUser,\n  CursorPage,\n  CursorParams,\n  ListClustersV2Params,\n  ListOrganizationsV2Params,\n  ListOrgMembersV2Params,\n  OrgDetailV2Dto,\n  OrgListItemV2Dto,\n  OrgMemberV2Dto,\n  OrgSummaryV2Dto,\n} from './dtos/ControlV2.dto.js'\nexport { CLUSTER_MODIFICATION_STATES } from './dtos/ControlV2.dto.js'\nexport type {\n  DashboardActor,\n  DashboardAnnotationsQuery,\n  DashboardAnnotationsTile,\n  DashboardAnnotationsTileV1,\n  DashboardCatalogue,\n  DashboardCatalogueChartMetric,\n  DashboardCatalogueSearchField,\n  DashboardChartQuery,\n  DashboardChartRender,\n  DashboardChartTile,\n  DashboardChartTileV3,\n  DashboardClusterCard,\n  DashboardClusterDetailQuery,\n  DashboardClusterDetailTile,\n  DashboardClusterDetailTileV2,\n  DashboardDefinition,\n  DashboardDefinitionV1,\n  DashboardDefinitionV2,\n  DashboardDefinitionV3,\n  DashboardDto,\n  DashboardFleetQuery,\n  DashboardFleetQueryTile,\n  DashboardFleetQueryTileV1,\n  DashboardHeadingTile,\n  DashboardHeadingTileV2,\n  DashboardLinkTile,\n  DashboardLinkTileV2,\n  DashboardListDto,\n  DashboardNewTile,\n  DashboardNoteTile,\n  DashboardNoteTileV2,\n  DashboardOrgCard,\n  DashboardOrgDetailQuery,\n  DashboardOrgDetailTile,\n  DashboardOrgDetailTileV2,\n  DashboardSummaryDto,\n  DashboardTile,\n  DashboardTileKind,\n  DashboardTileLayout,\n  DashboardTileV1,\n  DashboardTileV2,\n  DashboardTileV3,\n  StoredDashboardDefinition,\n} from './dtos/Dashboard.dto.js'\nexport {\n  DASHBOARD_CHART_RENDERS,\n  DASHBOARD_CLUSTER_CARDS,\n  DASHBOARD_DEFINITION_BYTES_MAX,\n  DASHBOARD_DEFINITION_VERSION,\n  DASHBOARD_ENTITY_ID_MAX,\n  DASHBOARD_GRID_COLUMNS,\n  DASHBOARD_GRID_ROWS_MAX,\n  DASHBOARD_LINK_URL_MAX,\n  DASHBOARD_NOTE_MAX,\n  DASHBOARD_ORG_CARDS,\n  DASHBOARD_PAGE_SIZE_DEFAULT,\n  DASHBOARD_PAGE_SIZE_MAX,\n  DASHBOARD_TILE_KINDS,\n  DASHBOARD_TILE_ROWS_MAX,\n  DASHBOARD_TILES_MAX,\n  DASHBOARD_TITLE_MAX,\n} from './dtos/Dashboard.dto.js'\nexport type { EarlyAccessFeatureDto } from './dtos/EarlyAccessFeature.dto.js'\nexport type {\n  CamundaWebApp,\n  CamundaWebAppWithZeebe,\n  ExternalClickwrapConfigDto,\n  ExternalClusterDto,\n  ExternalOrganizationDto,\n} from './dtos/ExternalWebapp.dto.js'\nexport type {\n  CreateFeatureFlagDto,\n  FeatureFlagAnswer,\n  FeatureFlagDto,\n  FeatureFlagListDto,\n  UpdateFeatureFlagDto,\n} from './dtos/FeatureFlags.dto.js'\nexport type {\n  ClusterGenerationStateDto,\n  ForceGenerationUpgradeResult,\n} from './dtos/ForceGenerationUpgrade.dto.js'\n// Functions\nexport {\n  activeGenerations,\n  compareGenerationNamesNewestFirst,\n  type GenerationDto,\n  type GenerationWithClusterCountDto,\n  sortGenerationBySemverOfZeebe,\n  type UpgradableGenerationsDto,\n} from './dtos/Generations.dto.js'\nexport type { ChangeGenerationVersionsResult } from './dtos/GenerationVersionsChange.dto.js'\n// Namespace (type-only - contains only interfaces)\nexport type { Hdp } from './dtos/Hdp.dto.js'\nexport type {\n  K8sBackupConfig,\n  K8sConfig,\n  K8sConfigLegacyFormat,\n  K8sContext,\n  K8sContextDto,\n} from './dtos/K8sContext.dto.js'\nexport type {\n  M2mTokenCountDto,\n  M2mTokenCountsDto,\n} from './dtos/M2mTokenCount.dto.js'\nexport type { MetaDto } from './dtos/Meta.dto.js'\nexport type {\n  AutoJoinAssignment,\n  LicensingModelType,\n  LlmProviderName,\n  OrganizationDto,\n  OrganizationMetadata,\n  OrgOwner,\n  OrgWithNameAndSalesPlan,\n} from './dtos/Organization.dto.js'\nexport {\n  LICENSING_MODEL_DISPLAY_NAMES,\n  VALID_LICENSING_MODELS,\n} from './dtos/Organization.dto.js'\nexport type { OrganizationMemberDto } from './dtos/OrganizationMember.dto.js'\nexport type { OrganizationToSalesPlanDto } from './dtos/OrganizationToSalesPlan.dto.js'\nexport type {\n  DryRunSanityDiff,\n  ReleaseTrainPreview,\n  ReleaseTrainSanityReport,\n  SanityFix,\n  SanityRuleInfo,\n  SanitySeverity,\n  SanityViolation,\n} from './dtos/ReleaseTrainSanity.dto.js'\nexport type { RestoreDto, RestoreState } from './dtos/Restore.dto.js'\n// SalesPlan.dto - Types\nexport type {\n  ClusterLimits,\n  ConsumptionDataItem,\n  Limits,\n  SalesPlanDto,\n  SalesPlanMetadata,\n} from './dtos/SalesPlan.dto.js'\n// SalesPlan.dto - Values (constants and functions)\nexport {\n  allClusterBasedLimits,\n  allSalesPlanLimits,\n  clusterPlanWhiteListIds,\n  deprecatedLimit,\n  generationWhiteListIds,\n  isLimitKeyEnabled,\n  isLimitOfferedOnStage,\n  isUnlockedClusterPlansStage,\n  MAX_CLUSTER_CLIENTS_DEFAULT,\n  MAX_CLUSTER_CLIENTS_DEV,\n  RETENTION_LIMIT_DEFAULT,\n  RETENTION_LIMIT_MAXIMUM,\n  RETENTION_LIMIT_MINIMUM,\n  unusedClusterBasedLimits,\n  unusedSalesPlanLimits,\n} from './dtos/SalesPlan.dto.js'\nexport type { SecureConnectivityDto } from './dtos/SecureConnectivity.dto.js'\nexport type { SignupDto } from './dtos/Signup.dto.js'\nexport type {\n  StorybookConfig,\n  StorybookConfigBackup,\n  StorybookConfigChannel,\n  StorybookConfigDatacenter,\n  StorybookConfigGeneration,\n} from './dtos/StorybookConfig.dto.js'\nexport type { SystemAuditDto } from './dtos/SystemAudit.dto.js'\nexport type {\n  UpgradeReadinessDto,\n  UpgradeReadinessSource,\n  UpgradeReadinessState,\n} from './dtos/UpgradeReadiness.dto.js'\n// UsageAlert.dto - Types\nexport type { UsageAlertDto } from './dtos/UsageAlert.dto.js'\n// UsageAlert.dto - Values (enum and constants)\nexport {\n  UsageAlertInitValues,\n  UsageAlertMetric,\n  UsageAlertThresholdLimits,\n} from './dtos/UsageAlert.dto.js'\nexport type { UserMetaDataDto } from './dtos/UserMetaData.dto.js'\n// Lucene-style table search (parser + AST \u2192 SQL compiler + field registries).\nexport {\n  type AndNode,\n  CLUSTER_DEFAULT_SEARCH_FIELDS,\n  CLUSTER_SEARCH_FIELDS,\n  CLUSTER_TTL_SEARCH_FIELDS,\n  type CompileContext,\n  type CompiledQuery,\n  clusterSearchFieldsForStage,\n  compileQuery,\n  type FieldBinding,\n  findSearchField,\n  idSetPredicate,\n  isLuceneQueryError,\n  joinIdSet,\n  LuceneQueryError,\n  likeArgument,\n  type NotNode,\n  ORG_DEFAULT_SEARCH_FIELDS,\n  ORGANIZATION_SEARCH_FIELDS,\n  type OrNode,\n  parseLuceneQuery,\n  type QueryNode,\n  type RangeNode,\n  type SearchFieldCapability,\n  type SearchFieldSpec,\n  type SearchFieldType,\n  type SearchTermOperator,\n  type SqlDialect,\n  type TermNode,\n} from './search/index.js'\nexport { upgradeGateReason } from './utils/upgradeGateReason.utils.js'\n\n// ============================================================================\n// Enums (runtime values)\n// ============================================================================\n\nexport {\n  AlertSubscriptionReportType,\n  AlertSubscriptionType,\n} from './enums/AlertSubscription.enum.js'\nexport { AuditEntity, AuditEntityAttribute } from './enums/AuditEntity.enum.js'\nexport { AuditService } from './enums/AuditService.enum.js'\nexport { BackupStatus } from './enums/BackupStatus.enum.js'\nexport {\n  ClusterBulkOperationStatus,\n  ClusterBulkOperationType,\n} from './enums/ClusterBulkOperation.enum.js'\nexport { ClusterClientPermission } from './enums/ClusterClientPermissions.enum.js'\nexport { ClusterEncryptionKey } from './enums/ClusterEncryptionKey.enum.js'\nexport { ClusterStatus } from './enums/ClusterStatus.enum.js'\nexport { ConsoleAPIClientPermission } from './enums/ConsoleApiClientPermission.enum.js'\nexport { ErrorType } from './enums/ErrorType.enum.js'\nexport type {\n  AssignableOrganizationRoleType,\n  OrganizationRoleType,\n  UnassignableOrganizationRoleType,\n} from './enums/OrganizationRole.enum.js'\nexport {\n  AssignableOrganizationRole,\n  LegacyHeldOrganizationRole,\n  OrganizationRole,\n  UnassignableOrganizationRole,\n} from './enums/OrganizationRole.enum.js'\nexport { SseEntity, SseType } from './enums/Sse.enum.js'\nexport {\n  SystemAuditEntity,\n  SystemAuditEntityAttribute,\n} from './enums/SystemAuditEntity.enum.js'\n\n// ============================================================================\n// Permissions - Namespaces (runtime values)\n// ============================================================================\n\nexport { AccountsPermissions } from './permissions/accounts.permissions.js'\nexport { AlertDistributorPermissions } from './permissions/alert-distributor.permissions.js'\nexport { AuditLoggerPermissions } from './permissions/auditlogger.permissions.js'\nexport {\n  accountsUserFeaturesFromPermissions,\n  consoleUserFeaturesFromPermissions,\n  sessionHasPermission,\n  sessionPermissionKeysFor,\n} from './permissions/combo.js'\nexport { ConsolePermissions } from './permissions/console.permissions.js'\nexport { NotificationPermissions } from './permissions/notification.permissions.js'\n// profile.permissions - Types\nexport type { OnboardConfig } from './permissions/profile.permissions.js'\n// profile.permissions - Values (constants)\n// NOTE: the `allowed` email lists (CLOUD_TEAM_EMAILS, SRE_TEAM_EMAILS, etc.)\n// intentionally live in the private `@camunda-cloud/shared-backend` package\n// instead of here, since this package is published publicly to npm.\nexport { PROFILES } from './permissions/profile.permissions.js'\nexport {\n  ALL_PERMISSIONS_AT_AUTH0,\n  expandRolesToPermissions,\n} from './permissions/roleExpansion.utils.js'\n\n// ============================================================================\n// Types - Type-only exports (interfaces and type aliases)\n// ============================================================================\n\nexport type { AuditData } from './types/AuditData.type.js'\n// AutoSleep.type - Types\nexport type {\n  ActivitySleepEligibilityOptions,\n  SleepCronEligibilityOptions,\n} from './types/AutoSleep.type.js'\n// AutoSleep.type - Values (constants and functions)\nexport {\n  INTERNAL_LOW_HARDWARE_PLAN_NAME,\n  isActivitySleepEligible,\n  isClusterTagEligibleForSleepCron,\n  isSalesPlanEligibleForSleepCron,\n  isSleepCronEligible,\n  SLEEP_CRON_ELIGIBLE_TAGS,\n} from './types/AutoSleep.type.js'\nexport type {\n  BotContext,\n  BotOptions,\n  BotRequest,\n  GetUserDetailsResponse,\n  ListRolesForUserResponse,\n  UpdateUserRolesRequest,\n  UpdateUserRolesResponse,\n  UserContext,\n  UserDetails,\n} from './types/Bot.types.js'\n// BulkOperation.type - Types\nexport type {\n  BulkClusterDeletionContent,\n  BulkClusterDeletionItem,\n  BulkClusterGenerationUpdateItem,\n  BulkClusterPlanTypeUpdateContent,\n  BulkClusterPlanTypeUpdateItem,\n  BulkClusterPlanUpdateContent,\n  BulkClusterPlanUpdateItem,\n  BulkGenerationUpdateContent,\n  GenericBulkClusterOperationContent,\n  GenericBulkOperationContent,\n  GenericClusterBulkOperationItem,\n} from './types/BulkOperation.type.js'\n// BulkOperation.type - Functions (type guards)\nexport {\n  isBulkClusterDeletionItem,\n  isBulkClusterPlanTypeUpdateItem,\n  isBulkClusterPlanUpdateItem,\n  isIsBulkClusterGenerationUpdateIten,\n} from './types/BulkOperation.type.js'\n// C8ClusterComponentVersions.type - Types\nexport type {\n  GenerationEnvVarsDto,\n  GenerationEnvVarsKey,\n  GenerationImageVersionsDto,\n  ImmutableZeebeClusterVersionsDto,\n  MutableZeebeClusterVersionsDto,\n  ZeebeClusterVersionsDto,\n} from './types/C8ClusterComponentVersions.type.js'\n// C8ClusterComponentVersions.type - Values (constants)\nexport {\n  AllThings,\n  GENERATION_ENV_VARS_KEYS,\n  GENERATION_IMAGE_VERSION_KEYS,\n  ImmutableThings,\n  MutableThings,\n} from './types/C8ClusterComponentVersions.type.js'\n// CamundaClusterLabels.type - Types\nexport type {\n  CamundaClusterStage,\n  CamundaClusterStageLabel,\n  ClusterLabels,\n} from './types/CamundaClusterLabels.type.js'\n// CamundaClusterLabels.type - Values (constants)\nexport {\n  ALLOWED_CAMUNDA_LABELS,\n  StageClusterLabels,\n} from './types/CamundaClusterLabels.type.js'\n// Chargebee.type - Types\nexport type { SubscriptionItem } from './types/Chargebee.type.js'\n// Chargebee.type - Values (enums)\nexport { ConsumptionData, ConsumptionDataType } from './types/Chargebee.type.js'\n// ClusterBulkOperation.type - Types\nexport type {\n  ClusterBulkOperationAck,\n  ClusterBulkOperationClusterDto,\n  ClusterBulkOperationContent,\n  ClusterBulkOperationDto,\n  ClusterBulkOperationGenerationUpdateParameter,\n  ClusterBulkOperationParameter,\n  ClusterBulkOperationPlanTypeUpdateParameter,\n  ClusterBulkOperationPlanUpdateParameter,\n  ClusterBulkOperationPostContent,\n  ClusterSleepWakeupParameter,\n} from './types/ClusterBulkOperation.type.js'\nexport type {\n  ClusterModificationConfigDto,\n  ClusterModificationDto,\n} from './types/ClusterModification.type.js'\n// ClusterPlanFields.type - Values (field spec and type guard)\nexport {\n  CLUSTER_PLAN_FIELDS,\n  type ClusterPlanFieldSpec,\n  type ClusterPlanFieldTree,\n  isClusterPlanFieldSpec,\n} from './types/ClusterPlanFields.type.js'\nexport type {\n  ClusterPlanModificationAck,\n  ClusterPlanModificationConfig,\n  ClusterPlanModificationDto,\n} from './types/ClusterPlanModification.type.js'\n// ClusterPlanTypeAvailabilityClass.type - Values (enum and function)\nexport {\n  ClusterPlanTypeAvailabilityClass,\n  hasNoAvailabilityClass,\n  sortByAvailabilityClasses,\n} from './types/ClusterPlanTypeAvailabilityClass.type.js'\n// ClusterPlanTypeCategory.type - Values (enum and functions)\nexport {\n  ClusterPlanTypeCategory,\n  hasAvailabilityClass,\n  sortByClusterPlanTypeCategory,\n} from './types/ClusterPlanTypeCategory.type.js'\nexport type { ClusterPlanTypesToConfig } from './types/ClusterPlanTypesToConfig.type.js'\nexport type { ClusterPlanTypesToReserved } from './types/ClusterPlanTypesToReserved.type.js'\nexport type {\n  ClusterTtlDeletionPayload,\n  ClusterTtlDeletionResult,\n  ClusterTtlDto,\n  ClusterTtlDuration,\n  ClusterTtlOption,\n  ClusterTtlUnlimited,\n  UpdateClusterTtlBody,\n} from './types/ClusterTtl.type.js'\nexport {\n  CLUSTER_TTL_BACKFILL_REASON,\n  CLUSTER_TTL_DURATION_MS,\n  CLUSTER_TTL_DURATIONS,\n  CLUSTER_TTL_FEATURE_FLAG,\n  CLUSTER_TTL_OPTIONS,\n  CLUSTER_TTL_UNLIMITED_LINK_MAX_LENGTH,\n  CLUSTER_TTL_UNLIMITED_REASON_MAX_LENGTH,\n  clusterTtlExpiresAt,\n  DEFAULT_CLUSTER_TTL_OPTION,\n  extendClusterTtl,\n  isClusterTtlDuration,\n  isClusterTtlOption,\n  isClusterTtlStage,\n  isHttpUrl,\n  isPastClusterTtl,\n  validateClusterTtlUnlimited,\n} from './types/ClusterTtl.type.js'\nexport type {\n  ClusterUsageDataRequest,\n  ClusterUsageMetadataDto,\n  ClusterUsageMetricsAddRequestByMetricHeap,\n  ClusterUsageMetricsData,\n  ClusterUsageMetricsFilter,\n  ClusterUsageOrgStartDate,\n} from './types/ClusterUsageMetrics.type.js'\n// Dashboard.types - Types\nexport type {\n  DashboardConfig,\n  DashboardMappingItem,\n  DashboardMappingTarget,\n  DashboardResultPrimitive,\n  DashboardResultRow,\n  EngineeringOperationsDashboardResponse,\n} from './types/Dashboard.types.js'\nexport type { EnterpriseIncludingValueMetrics } from './types/EnterpriseIncludingValueMetrics.type.js'\nexport type {\n  HdpTenantUsageBreakdown,\n  HdpTenantUsagePerClusterPoint,\n  HdpTenantUsagePoint,\n} from './types/HdpTenantUsage.type.js'\n// hdp.types - Types (interfaces)\nexport type {\n  AlertSubscription as HdpAlertSubscription,\n  ByomClient as HdpByomClient,\n  Channel as HdpChannel,\n  Cluster as HdpCluster,\n  ClusterBackup as HdpClusterBackup,\n  ClusterBackupSchedule as HdpClusterBackupSchedule,\n  ClusterBulkOperation as HdpClusterBulkOperation,\n  ClusterClient as HdpClusterClient,\n  ClusterModification as HdpClusterModification,\n  ClusterPlan as HdpClusterPlan,\n  ClusterPlanType as HdpClusterPlanType,\n  ConnectorSecret as HdpConnectorSecret,\n  ConsoleApiClient as HdpConsoleApiClient,\n  Datacenter as HdpDatacenter,\n  Generation as HdpGeneration,\n  HdpBackendChangeEvent,\n  HdpClusterModificationConfig,\n  HdpDisk,\n  HdpEntity,\n  HdpPrometheusDataCapacityDataPoint,\n  Invite as HdpInvite,\n  LlmSpend as HdpLlmSpend,\n  Organization as HdpOrganization,\n  SecureConnectivity as HdpSecureConnectivity,\n  SystemAudit as HdpSystemAudit,\n  TelemetryData as HdpTelemetryData,\n  UsageAlert as HdpUsageAlert,\n  User as HdpUser,\n  UserLogin as HdpUserLogin,\n} from './types/hdp.types.js'\n// hdp.types - Values (enums)\nexport {\n  AlertSubscriptionReportType as HdpAlertSubscriptionReportType,\n  AlertSubscriptionType as HdpAlertSubscriptionType,\n  HDP_DISKS,\n} from './types/hdp.types.js'\n// notification.type - Types\nexport type {\n  GlobalNotification,\n  NotificationDto,\n  NotificationMeta,\n  NotificationOptions,\n  NotificationPermission,\n  NotificationSource,\n  NotificationState,\n  NotificationType,\n  OrgNotification,\n  UserNotification,\n  UserOrgNotification,\n} from './types/notification.type.js'\n// notification.type - Values (enums and constants)\nexport {\n  NotificationPermissionValues,\n  NotificationSourceEnum,\n  NotificationStateEnum,\n  NotificationTypeEnum,\n} from './types/notification.type.js'\n// OrganizationPermission.type - Types\nexport type {\n  CreateReadUpdateDelete,\n  OrganizationPermissions,\n} from './types/OrganizationPermission.type.js'\n// OrganizationPermission.type - Values (constants)\nexport {\n  OrganizationPermissionsDescriptions,\n  PermissionsForOrganizationRole,\n} from './types/OrganizationPermission.type.js'\nexport {\n  getPreprodClusterTtlHours,\n  isPastPreprodClusterTtl,\n  isPreprodClusterTtlStage,\n  parseNumericLimit,\n} from './types/PreprodClusterTtl.type.js'\n// Roles.js - Types\nexport type {\n  AccountRoles,\n  ConsoleRoles,\n  ModelerRoles,\n  Roles,\n} from './types/Roles.js'\n// Roles.js - Values (constants)\nexport { SAFE_ROLES } from './types/Roles.js'\n// SalesPlanType.type - Types\nexport type {\n  DisplayedSalesPlan,\n  RevisitedSalesPlanName,\n} from './types/SalesPlanType.type.js'\n// SalesPlanType.type - Values (enums and functions)\nexport {\n  AnalyticsSalesPlanType,\n  getAnalyticsSalesPlanFromOrgSalesPlan,\n  getDisplayedSalesPlan,\n  getRevisitedSalesPlanName,\n  OPTIMIZE_DISABLED_PLAN_TYPES,\n  SalesPlanType,\n  USAGE_SALES_PLAN_TYPES,\n} from './types/SalesPlanType.type.js'\n// SpamDetection.type - Types\nexport type { SpamDetectionPatterns } from './types/SpamDetection.type.js'\n// SpamDetection.type - Values (constants)\nexport { TEERGRUBE_PATTERNS } from './types/SpamDetection.type.js'\nexport type {\n  AlertSubscriptionSseEvent,\n  BackupSseEvent,\n  ClusterClientSseEvent,\n  ClusterSseEvent,\n  ConnectorSecretsSseEvent,\n  ConsoleApiClientSseEvent,\n  ConsoleSseEvent,\n  MonitoringSseEvent,\n  SecureConnectivitySseEvent,\n  SseClusterPayload,\n  SseMonitoringPayload,\n  SseSecureConnectivityPayload,\n} from './types/SseEvent.type.js'\n// Namespace (type-only - contains only interfaces)\nexport type { AccountsStats } from './types/Stats.types.js'\n// Survey.type - Types\nexport type { Persona, SurveyDto } from './types/Survey.type.js'\n// Survey.type - Values (enum)\nexport { FeedbackType } from './types/Survey.type.js'\n// SuspendStrategy.type - Types\nexport type {\n  GetSuspendStrategyOptions,\n  SuspendStrategy,\n} from './types/SuspendStrategy.type.js'\n// SuspendStrategy.type - Values (function)\nexport { getSuspendStrategy } from './types/SuspendStrategy.type.js'\nexport type { SystemAuditData } from './types/SystemAuditData.type.js'\n\n// Namespace (runtime value)\nexport { Telemetry } from './types/Telemetry.type.js'\n\n// TrialManagement.types - Types\nexport type {\n  ExtensionListItem,\n  ExtensionListResponse,\n  OrgTrialDetail,\n  TrialExtensionSource,\n  TrialManagementStats,\n} from './types/TrialManagement.types.js'\n\n// User.type - Types\nexport type {\n  AccountsData,\n  AppMetadata,\n  BasicUser,\n  BlockedFor,\n  Identity,\n  OrgMembership,\n  User,\n  UserMetadata,\n  UserRequest,\n} from './types/User.type.js'\n\n// User.type - Values (enum)\nexport { UserMetadataEvent } from './types/User.type.js'\n\nexport type {\n  UniqueTaskUser,\n  ValueMetrics,\n  ValueMetricsPerYearMonth,\n} from './types/ValueMetrics.type.js'\n\n// ============================================================================\n// Utils - Classes (runtime values)\n// ============================================================================\n\nexport {\n  CLOUD_PROVIDER_ORDER,\n  getCloudProviderLabel,\n  getCloudProviderRank,\n} from './utils/cloudProvider.utils.js'\nexport {\n  type ConnectivityStatus,\n  deriveConnectivityMessage,\n  deriveConnectivityStatus,\n} from './utils/connectivityStatus.utils.js'\nexport type {\n  CronScheduleValidationFailure,\n  CronScheduleValidationResult,\n  CronScheduleValidationSuccess,\n} from './utils/cronSchedule.utils.js'\nexport {\n  BACKUP_SCHEDULE_MIN_INTERVAL_MINUTES,\n  validateCronSchedule,\n} from './utils/cronSchedule.utils.js'\nexport {\n  canonicalPlan,\n  canonicalPlanKey,\n  canonicalPlanModifications,\n} from './utils/elasticsearchPlanPath.utils.js'\nexport {\n  deriveEncryptionStatus,\n  type EncryptionStatus,\n  isEncryptionStatus,\n} from './utils/encryptionStatus.utils.js'\n// enterprise-connection.utils - Types\nexport type { EnterpriseConnectionOrganizationAssignment } from './utils/enterprise-connection.utils.js'\n// enterprise-connection.utils - Values (functions)\nexport {\n  enterpriseConnectionMetadataToOrganizationAssignments,\n  organizationAssignmentsToEnterpriseConnectionMetadata,\n} from './utils/enterprise-connection.utils.js'\nexport {\n  addMonthsClamped,\n  DEFAULT_ENTERPRISE_DURATION_IN_MONTHS,\n  diffInWholeMonths,\n  type EnterpriseTermWindow,\n  getCurrentEnterpriseTerm,\n  peakWithinTerm,\n  toUtcDayStartMs,\n} from './utils/enterpriseTerm.utils.js'\nexport type { EnvVarEntry } from './utils/envVars.js'\nexport { parseEnvVars, serializeEnvVars } from './utils/envVars.js'\nexport {\n  deriveFailoverKeyPolicyPrincipals,\n  type FailoverKeyPolicyPrincipals,\n} from './utils/failoverKeyPolicy.utils.js'\nexport type {\n  JvmOptionsModificationKey,\n  ParsedJvmOption,\n} from './utils/jvmOptions.js'\nexport {\n  addsEnvVarsOverrideValue,\n  isJvmOptionsModificationKey,\n  isUnderJvmSpec,\n  isValidJvmOptionsPlanValue,\n  JVM_OPTION_MAX_LENGTH,\n  JVM_OPTION_PATTERN,\n  JVM_OPTIONS_MAX_ITEMS,\n  JVM_OPTIONS_MODIFICATION_KEYS,\n  JVM_OPTIONS_TARGETS,\n  joinJvmOptions,\n  jvmOptionsOfPlanValue,\n  parseJvmOption,\n  requiresEnvVarsOverride,\n  splitJvmOptions,\n  validateJvmOptions,\n  validateJvmOptionsPlanValue,\n  validateJvmOptionsValue,\n} from './utils/jvmOptions.js'\nexport {\n  KMS_ARN,\n  KMS_MRK_ARN,\n  type KmsArnValidationError,\n  type ParsedKmsArn,\n  parseKmsArn,\n  validateKmsArnForRegion,\n} from './utils/kmsArn.utils.js'\nexport { validateLabels } from './utils/labelValidator.utils.js'\nexport { ObjectMergeUtils } from './utils/objectMerge.utils.js'\nexport { getAtPath } from './utils/objectPath.utils.js'\nexport {\n  computeOrgStartDate,\n  type OrgStartDateInput,\n} from './utils/orgStartDate.utils.js'\nexport {\n  getPermissionsByRoles,\n  getUserPermissionsForOrg,\n} from './utils/orgs/OrgHelper.js'\n\n// PasswordPolicy - Types\nexport type {\n  PasswordPolicyRequest,\n  PasswordPolicyResult,\n} from './utils/PasswordPolicy.js'\n\n// PasswordPolicy - Values (constants and function)\nexport {\n  MAXLENGTH as PASSWORD_POLICY_MAXLENGTH,\n  MINLENGTH as PASSWORD_POLICY_MINLENGTH,\n  passwordPolicyCheck,\n} from './utils/PasswordPolicy.js'\nexport { isQaUserEmail, qaUserEmail } from './utils/qa-user.utils.js'\nexport {\n  deriveSecondaryStorageStatus,\n  type SecondaryStorageStatus,\n} from './utils/secondaryStorageStatus.utils.js'\nexport {\n  allSettledResultsCounts,\n  getFulfilledPromises,\n  getRejectedPromises,\n  getSettledSummary,\n} from './utils/settledPromises.util.js'\nexport {\n  isValidAwsArn,\n  isValidCIDR,\n  isValidCIDRList,\n  isValidClientName,\n  isValidHostname,\n  isValidPrivateLinkRegion,\n  normalizeCIDRList,\n} from './utils/string-validation.utils.js'\nexport {\n  extractCamundaUserEmail,\n  guessName,\n  isCamundaUserId,\n} from './utils/user.utils.js'\n\n// versionCheck.utils - Values (enum and function)\nexport {\n  checkVersion,\n  generationImageErrorMessage,\n  isAppIntegrationsVersionSupported,\n  isGenerationResumable,\n  isSecretsFilterModeConfigurable,\n  isValidGenerationImage,\n  normalizeGenerationVersion,\n  stripSecfixPostfix,\n  VersionCheckOperator,\n} from './utils/versionCheck.utils.js'\nexport type { ZeebeRebalancingValidationErrors } from './utils/zeebeRebalancing.utils.js'\nexport {\n  validateZeebeRebalancing,\n  ZEEBE_REBALANCING_FEATURE_FLAG,\n} from './utils/zeebeRebalancing.utils.js'\n\n// ============================================================================\n// Config - Configuration files and types\n// ============================================================================\n\nexport { default as CAMUNDI_PERMISSION_RULES } from './config/camundi-permission-rules.js'\nexport type { CamundiPermissionRules } from './config/camundi-permission-rules.types.js'\n\nexport {\n  augmentCamundiPermissions,\n  getApplicableRolesForEmployee,\n  HIBOB_CACHE_KEY,\n  HIBOB_CACHE_NAMESPACE,\n  isManager,\n} from './utils/camundiPermissionAugmenter.utils.js'\n"],
-  "mappings": "AAUA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,KAAK,MAAM,QAAQ,QAAQ,YAAY;AAEhD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,4BAA4B;AACrC,SAAS,iDAAiD;AAC1D,SAAS,6CAA6C;AAKtD,SAAS,wCAAwC;AACjD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA4BP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AASP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAKP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAMP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAeP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAOP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAMP,SAAS,mDAAmD;AAM5D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAOP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAMA;AAAA,EASA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAIP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAWP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAWP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAyBP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAgBP,SAAS,uCAAuC;AAkBhD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AA6CP,SAAS,mCAAmC;AA8C5C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAqBP;AAAA,EACE;AAAA,EACA;AAAA,EAGA;AAAA,OAEK;AAyBP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAsBP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAmBP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EAEA;AAAA,OASK;AACP,SAAS,yBAAyB;AAMlC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,aAAa,4BAA4B;AAClD,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,+BAA+B;AACxC,SAAS,4BAA4B;AACrC,SAAS,qBAAqB;AAC9B,SAAS,kCAAkC;AAC3C,SAAS,iBAAiB;AAM1B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,WAAW,eAAe;AACnC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAMP,SAAS,2BAA2B;AACpC,SAAS,mCAAmC;AAC5C,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B;AACnC,SAAS,+BAA+B;AAOxC,SAAS,gBAAgB;AACzB;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAaP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA2BP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAWP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAQP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAIP,SAAS,iBAAiB,2BAA2B;AAmBrD;AAAA,EACE;AAAA,EAGA;AAAA,OACK;AAOP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAYP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAyDP;AAAA,EACiC,+BAA/BA;AAAA,EACyB,yBAAzBC;AAAA,EACA;AAAA,OACK;AAgBP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAOP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AASP,SAAS,kBAAkB;AAO3B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAIP,SAAS,0BAA0B;AAoBnC,SAAS,oBAAoB;AAO7B,SAAS,0BAA0B;AAInC,SAAS,iBAAiB;AAyB1B,SAAS,yBAAyB;AAYlC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EAEE;AAAA,EACA;AAAA,OACK;AAMP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EAEA;AAAA,OACK;AAIP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,cAAc,wBAAwB;AAC/C;AAAA,EACE;AAAA,OAEK;AAKP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB;AAC/B,SAAS,wBAAwB;AACjC,SAAS,iBAAiB;AAC1B;AAAA,EACE;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AASP;AAAA,EACe;AAAA,EACA;AAAA,EACb;AAAA,OACK;AACP,SAAS,eAAe,mBAAmB;AAC3C;AAAA,EACE;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAMP,SAAoB,WAAXC,gBAA2C;AAGpD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n// ============================================================================\n// Constants (runtime values)\n// ============================================================================\n\nexport {\n  ACTIVITY_RETENTION_CHOICES,\n  ACTIVITY_RETENTION_DEFAULT_MONTHS,\n  ACTIVITY_RETENTION_FLAG,\n  ACTIVITY_RETENTION_KEEP_FOREVER,\n  ACTIVITY_RETENTION_SYNC_CHUNK,\n  type ActivityRetentionMonths,\n  activityRetentionCutoff,\n  activityRetentionLabel,\n  isActivityRetentionMonths,\n  isLimitedActivityRetention,\n} from './constants/activity-retention.const.js'\nexport {\n  CUSTOM_GENERATION_MAX_PER_REQUESTER,\n  CUSTOM_GENERATION_MAX_UPGRADEABLE_FROM,\n  CUSTOM_GENERATION_NAME_MAX_LENGTH,\n  CUSTOM_GENERATION_NAME_MIN_LENGTH,\n  checkNewGenerationVersions,\n  isCustomGenerationStage,\n} from './constants/custom-generation.const.js'\nexport {\n  CUSTOM_HARDWARE_SIZING_BROKER_TOTAL_CAPS,\n  CUSTOM_HARDWARE_SIZING_COUNT_CAPS,\n  CUSTOM_HARDWARE_SIZING_ELASTICSEARCH_TOTAL_CAPS,\n  CUSTOM_HARDWARE_SIZING_MAX_AUTO_RESIZE_INCREASE_GI,\n  CUSTOM_HARDWARE_SIZING_MAX_PLAN_JSON_LENGTH,\n  CUSTOM_HARDWARE_SIZING_MAX_PLANS_PER_REQUESTER,\n  CUSTOM_HARDWARE_SIZING_NAME_MAX_LENGTH,\n  CUSTOM_HARDWARE_SIZING_NAME_MIN_LENGTH,\n  CUSTOM_HARDWARE_SIZING_REPLICA_SET_TOTAL_CAPS,\n  CUSTOM_HARDWARE_SIZING_RESOURCE_CAPS,\n  checkCustomHardwareSizing,\n  isCustomHardwareSizingStage,\n  parseKubernetesQuantity,\n} from './constants/custom-hardware-sizing.const.js'\nexport {\n  APPROVAL_ENTRY_HEADER,\n  CAMUNDI_APPROVAL_FLOW_FLAG,\n  DIRECT_ROUTE_LOCK_HEADERS,\n  DIRECT_ROUTE_LOCKED,\n  directRouteLockHeaders,\n  ERROR_CODE_HEADER,\n} from './constants/direct-route-lock.const.js'\nexport { DAY, HOUR, MINUTE, SECOND, WEEK } from './constants/duration.const.js'\nexport type { Stage } from './constants/misc.const.js'\nexport {\n  CAMUNDA_CLAIMS_NAMESPACE,\n  CONSOLE_API_USER_ID,\n  countBulkOperationAcks,\n  FIRSTNAME_LASTNAME_MAX_LENGTH,\n  HOTBACKUP_MIN_CREATE_PERIOD,\n  MAX_HARDWARE_PACKAGE_COUNT,\n  MAX_LENGTH_CLUSTER_NAME,\n  MIGRATION_BACKUP_ID_LABEL_PREFIX,\n  MINIMUM_EYEPAIRS,\n  MINIMUM_EYEPAIRS_BY_BULK_OPERATION_TYPE,\n  minimumBulkOperationAcks,\n  minimumBulkOperationEyes,\n  missingBulkOperationAcks,\n  NAMES_OF_ENTERPRISE_SALESPLANS_WITH_SLEEPING_CLUSTERS,\n  requiredBulkOperationAcks,\n  SECRETS_MAX_LENGTH,\n  STARTING_PRICE_PER_MONTH_IN_EURO,\n  TEMPORARY_CLUSTER_NAME,\n  UNKNOWN_ACTOR_EMAIL,\n} from './constants/misc.const.js'\nexport {\n  getGatewayPropertyHint,\n  getGatewayPropertyPath,\n  isAffectedByStreamlinedDeployment,\n  isPre89AffectedPath,\n  PRE89_AFFECTED_PATHS,\n  PRE89_AFFECTED_PROPERTY_PREFIXES,\n  PRE89_GATEWAY_PROPERTY_PATHS,\n  PRE89_GATEWAY_RESOURCE_PREFIXES,\n} from './constants/pre89EnvVarMapping.const.js'\nexport { PRIVATE_LINK_REGIONS } from './constants/privateLinkRegions.const.js'\nexport { SECURE_CONNECTIVITY_ALLOWED_ENTRIES_LIMIT } from './constants/secureConnectivity.const.js'\nexport { isSelfServiceClusterModificationStage } from './constants/self-service-cluster-modification.const.js'\nexport type {\n  TrialExtensionSurveyAnswer,\n  TrialExtensionSurveyQuestion,\n} from './constants/trialExtensionSurvey.const.js'\nexport { TRIAL_EXTENSION_SURVEY_QUESTIONS } from './constants/trialExtensionSurvey.const.js'\nexport {\n  V2_BODY_IDS_MAX,\n  V2_FILTER_IDS_MAX,\n  V2_MAX_PAGE_LIMIT,\n} from './constants/v2-list.const.js'\nexport {\n  ADMIN_APP_RENAME_MIN_VERSION,\n  APP_INTEGRATIONS_89_STREAM_CONNECTOR_BRIDGE_MIN_VERSION,\n  APP_INTEGRATIONS_89_STREAM_MINOR,\n  APP_INTEGRATIONS_89_STREAM_ZEEBE_MIN_VERSION,\n  APP_INTEGRATIONS_MIN_VERSION,\n  AUDIT_LOG_TAB_MIN_VERSION,\n  AUTHORIZATION_TOGGLE_MIN_VERSION,\n  AWS_ONLY_GENERATION_MIN_VERSION,\n  BUSINESS_ID_UNIQUENESS_MIN_VERSION,\n  BYOIDP_MIN_VERSION,\n  CLUSTER_SECRETS_LABEL_MIN_VERSION,\n  CLUSTER_STATISTICS_CONFIG_MIN_VERSION,\n  CONNECTOR_MANAGEMENT_METRICS_MIN_VERSION,\n  CONNECTOR_SECRET_SYNC_MIN_VERSION,\n  CONNECTORS_MANAGEMENT_LINK_MIN_VERSION,\n  ENFORCE_GROUPS_TASKLIST_V2_HIDDEN_MIN_VERSION,\n  ENFORCE_GROUPS_TOGGLE_MIN_VERSION,\n  GATEWAY_SPEC_8_9_MIN_VERSION,\n  HOT_BACKUP_MIN_VERSION,\n  IDENTITY_AUTHORIZATION_MIN_VERSION,\n  IDENTITY_AUTHORIZATION_NOTICE_MAX_VERSION,\n  IDENTITY_MANAGEMENT_MIN_VERSION,\n  INTERNAL_CONNECTORS_MANAGEMENT_MIN_VERSION,\n  JOB_DASHBOARD_MIN_VERSION,\n  LINE_8_9_MIN_VERSION,\n  LINE_8_10_MIN_VERSION,\n  MCP_MIN_VERSION,\n  MULTI_TENANCY_TOGGLE_MIN_VERSION,\n  NEW_CLUSTER_ROLES_MIN_VERSION,\n  OPTIMIZE_DEFAULT_ON_MIN_VERSION,\n  OPTIMIZE_FILTERING_MIN_VERSION,\n  OPTIONAL_TELEMETRY_MIN_VERSION,\n  RESOURCE_BASED_AUTHORIZATIONS_MIN_VERSION,\n  REST_API_URL_TRANSFORM_MIN_VERSION,\n  REST_API_V2_MIN_VERSION,\n  RESUME_ALPHA_MIN_VERSION,\n  SECRET_SOURCE_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_6_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_7_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_8_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_9_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_10_MIN_VERSION,\n  SESSION_CONFIG_MIN_VERSION,\n  SWAGGER_MIN_VERSION,\n  SWAGGER_URL_8_9_MIN_VERSION,\n  TASKLIST_MODE_TOGGLE_MIN_VERSION,\n  TASKLIST_UPGRADE_BANNER_MIN_VERSION,\n  TASKLIST_V2_AUTO_ENABLE_FROM_MINOR,\n  TASKLIST_V2_AUTO_ENABLE_TO_MINOR,\n  TASKLIST_V2_DEFAULT_ON_MIN_VERSION,\n  TASKLIST_V2_SETTING_MAX_VERSION,\n  TASKLIST_V2_UPGRADE_MIN_VERSION,\n  TASKLIST_V2_UPGRADE_TARGET_MIN_VERSION,\n  UPGRADE_READINESS_MIN_VERSION,\n  ZEEBE_REST_URL_MIN_VERSION,\n} from './constants/version-gates.const.js'\n\n// ============================================================================\n// DTOs - Types (interfaces and type aliases)\n// ============================================================================\n\n// Agent tokens - the read-only machine credentials of ccmacli. control-backend\n// stores them, and token-issuer, console-backend and accounts-backend read the\n// same claim and permission sets.\nexport type {\n  AgentAccess,\n  AgentClaim,\n  AgentGrantCreated,\n  AgentGrantRefusal,\n  AgentGrantRefusalReason,\n  AgentStatusResponse,\n  AgentToken,\n  AgentTokenAdmin,\n  AgentTokenCreated,\n  AgentTokenExpiryDays,\n  AgentTokenKind,\n  AgentTokenStatus,\n  AgentVerifyResponse,\n  CreateAgentGrantDto,\n  CreateAgentTokenDto,\n  ExtendAgentTokenDto,\n  RedeemAgentGrantDto,\n} from './agent-tokens/agent-tokens.js'\nexport {\n  AGENT_CLAIM,\n  AGENT_CLIENT_ID_PREFIX,\n  AGENT_ERROR,\n  AGENT_GRANT_TTL_MS,\n  AGENT_GRANTS_PER_HOUR_MAX,\n  AGENT_READ_PERMISSIONS,\n  AGENT_SLACK_CHANNEL_PATTERN,\n  AGENT_SLACK_GRANTS_FEATURE_FLAG,\n  AGENT_TOKEN_EXPIRY_DAYS,\n  AGENT_TOKEN_NAME_MAX,\n  AGENT_TOKEN_STATUSES,\n  AGENT_TOKENS_ACTIVE_MAX,\n  AGENT_TOKENS_FEATURE_FLAG,\n  agentReadPermissionUnion,\n  parseAgentClaim,\n} from './agent-tokens/agent-tokens.js'\n// Annotations - the notes and the tags that a Camundi attaches to a fleet\n// entity. The wire types and the rules are pure and browser-safe, so\n// control-backend and control-frontend run the same code.\nexport type {\n  AnnotationActorView,\n  AnnotationDecision,\n  AnnotationDenialCode,\n} from './annotations/policy.js'\nexport {\n  ANNOTATION_DENIAL_MESSAGES,\n  canEditNote,\n  canRemove,\n  checkNoteBody,\n  checkTagName,\n  isAuthor,\n} from './annotations/policy.js'\nexport type {\n  ApprovalRule,\n  StageDependentApprovalType,\n} from './approvals/approval-rules.js'\nexport {\n  APPROVAL_RULES,\n  approvalsRequiredFor,\n} from './approvals/approval-rules.js'\nexport type {\n  ChangePlanTypeRetentionLimitsResult,\n  ClusterPlanTypeLimitsDto,\n  PlanTypeRetentionLimitKey,\n} from './approvals/change-plan-type-retention-limits.js'\nexport {\n  isRetentionLimitInBounds,\n  PLAN_TYPE_RETENTION_LIMIT_KEY_LIST,\n  PLAN_TYPE_RETENTION_LIMIT_KEYS,\n  retentionLimitsOf,\n  sameRetentionLimits,\n} from './approvals/change-plan-type-retention-limits.js'\nexport type {\n  ClusterBulkClusterResultDto,\n  ClusterBulkFinalStatus,\n  ClusterBulkGenerationUpdateSettings,\n  ClusterBulkOperationPayloadDto,\n  ClusterBulkOperationRule,\n  ClusterBulkPlanTypeUpdateSettings,\n  ClusterBulkPlanUpdateSettings,\n  ClusterBulkSettingsByType,\n  ClusterBulkSleepWakeupSettings,\n  ClusterBulkStepRequestDto,\n  ClusterBulkStepResultDto,\n  ClusterBulkTargetDto,\n} from './approvals/cluster-bulk-operation.js'\nexport {\n  CLUSTER_BULK_OPERATION_CLUSTER_NAME_MAX_LENGTH,\n  CLUSTER_BULK_OPERATION_MAX_CLUSTERS,\n  CLUSTER_BULK_OPERATION_NAME_MAX_LENGTH,\n  CLUSTER_BULK_OPERATION_RULES,\n  CLUSTER_BULK_OPERATION_TYPES,\n  CLUSTER_BULK_SLEEPING_CLUSTER_DELAY_MS,\n  clusterBulkOperationTypeOf,\n  clusterBulkParameterOf,\n  clusterBulkRequiredPermissions,\n  clusterBulkResultOf,\n  isClusterBulkYolo,\n} from './approvals/cluster-bulk-operation.js'\nexport type {\n  ClusterCorpseDto,\n  ClusterCorpseKind,\n  ClusterCorpsesDto,\n  DeleteClusterCorpseResult,\n} from './approvals/delete-cluster-corpses.js'\nexport {\n  CLUSTER_CORPSE_KINDS,\n  CLUSTER_CORPSE_MIN_AGE_MS,\n  DELETE_CLUSTER_CORPSES_MAX,\n} from './approvals/delete-cluster-corpses.js'\nexport {\n  DNS_SUBDOMAIN_MAX_LENGTH,\n  isDnsSubdomain,\n} from './approvals/dns-subdomain.js'\nexport type { EditGenerationResult } from './approvals/edit-generation.js'\nexport {\n  EDIT_GENERATION_ENV_VARS_MAX_LENGTH,\n  EDIT_GENERATION_EXPECTED_MAX_LENGTH,\n  EDIT_GENERATION_NAME_MAX_LENGTH,\n} from './approvals/edit-generation.js'\nexport type { ApprovalExpectedChange } from './approvals/expected-value.js'\nexport {\n  isSameApprovalValue,\n  staleApprovalKeys,\n} from './approvals/expected-value.js'\nexport type {\n  ClusterPlanTypeClusterDto,\n  ClusterPlanTypeClustersDto,\n  ForceDeleteClusterPlanTypeStepResult,\n} from './approvals/force-delete-cluster-plan-type.js'\nexport { FORCE_DELETE_CLUSTER_PLAN_TYPE_MAX_CLUSTERS } from './approvals/force-delete-cluster-plan-type.js'\nexport type {\n  ApprovalActorView,\n  ApprovalDecision,\n  ApprovalDenialCode,\n} from './approvals/policy.js'\nexport {\n  approvalPermissionCheck,\n  canAcknowledge,\n  canCreate,\n  canExecute,\n  canOverride,\n  canReject,\n  canRunOverridden,\n  canView,\n  canWithdraw,\n  createPermissionsOf,\n  EXECUTE_WINDOW_DAYS,\n  effectiveStatus,\n  hasActorEmail,\n  hasEveryPermission,\n  hasFailedRun,\n  isExpired,\n  isOverrideGrantActive,\n  isRunWindowClosed,\n  isSameActor,\n  isSameActorEmail,\n  needsReason,\n  OVERRIDE_GRANT_ENDED_MESSAGE,\n  opensWithOwnApproval,\n  overrideGranteeOf,\n  remainingAcks,\n  requiredPermissionsOf,\n  resolveRequiredAcks,\n  runWindowEnd,\n} from './approvals/policy.js'\nexport type {\n  ReleaseTrainAutoUpgradeCandidates,\n  ReleaseTrainPublishPayload,\n  ReleaseTrainRollbackPayload,\n} from './approvals/release-train.js'\nexport type { ApprovalUseCaseType } from './approvals/use-cases.const.js'\nexport {\n  APPROVAL_EMAIL_MAX_LENGTH,\n  APPROVAL_EMAIL_PATTERN,\n  APPROVAL_OVERRIDE_DEFAULT_HOURS,\n  APPROVAL_OVERRIDE_DENYLIST,\n  APPROVAL_OVERRIDE_MAX_HOURS,\n  APPROVAL_USE_CASE_TYPES,\n  ENTERPRISE_ONBOARDING_METRIC_MAX,\n  ENTERPRISE_ONBOARDING_NAME_MAX_LENGTH,\n  ENTERPRISE_ONBOARDING_RESERVATION_MAX,\n  ENTERPRISE_ONBOARDING_SFDC_ID_MAX_LENGTH,\n  ENTERPRISE_ONBOARDING_TERM_MAX_MONTHS,\n  ENTERPRISE_ONBOARDING_TERM_MIN_MONTHS,\n  EXTEND_TRIAL_MAX_DAYS,\n  EXTEND_TRIAL_MIN_DAYS,\n  enterpriseContractChangePermissions,\n  GENERATION_VERSION_VALUE_MAX_LENGTH,\n  GENERATION_VERSIONS_MAX_GENERATIONS,\n  isApprovalOverridable,\n  isCalendarDay,\n  isLlmSpendBelowTopUpThreshold,\n  LLM_BUDGET_TOP_UP_THRESHOLD,\n  ORG_LIMIT_TEXT_MAX_LENGTH,\n  ORG_RESERVATION_MAX,\n  PERSONAL_ORGANIZATION_MAX_PER_REQUESTER,\n  PERSONAL_ORGANIZATION_NAME_MAX_LENGTH,\n  PERSONAL_ORGANIZATION_NAME_MIN_LENGTH,\n  PLATFORM_ROLE_CHANGE_MAX_ROLES,\n  PURGE_USERS_MAX_USERS,\n  PURGE_USERS_REQUIRED_PERMISSIONS,\n  REMOVE_ORG_MEMBER_REQUIRED_PERMISSIONS,\n  USER_METADATA_EXPECTED_MAX_LENGTH,\n  USER_METADATA_MAX_LENGTH,\n} from './approvals/use-cases.const.js'\n// The chart query of a dashboard tile (catalogue, language, result).\nexport {\n  CHART_DAY_GRAIN_MAX_DAYS,\n  CHART_FILTER_MAX_LENGTH,\n  CHART_GRAIN_DEFAULT,\n  CHART_GRAINS,\n  CHART_ID_MAX_LENGTH,\n  CHART_METRICS,\n  CHART_OTHER_SERIES_KEY,\n  CHART_QUERY_MAX_LENGTH,\n  CHART_TOP_DEFAULT,\n  CHART_TOP_MAX,\n  CHART_UNKNOWN_SERIES_KEY,\n  CHART_WINDOW_AMOUNT_MAX,\n  CHART_WINDOW_DEFAULT,\n  CHART_WINDOW_UNITS,\n  type ChartDimensionSpec,\n  type ChartGrain,\n  type ChartMetricSpec,\n  type ChartPoint,\n  type ChartQueryCheck,\n  ChartQueryError,\n  type ChartQueryErrorKind,\n  type ChartQueryOptions,\n  type ChartResult,\n  type ChartSeries,\n  type ChartSpec,\n  type ChartUnit,\n  type ChartWindow,\n  type ChartWindowUnit,\n  chartBucketStart,\n  chartToday,\n  chartWindowRange,\n  findChartDimension,\n  findChartMetric,\n  formatChartSpec,\n  isChartQueryError,\n  parseChartQuery,\n  readChartSpec,\n  validateChartSpec,\n} from './charts/index.js'\n// Dashboards - the tiles of a dashboard hold filters and never data. The\n// wire types and the placement rules are pure, so control-backend and\n// control-frontend run the same code.\nexport {\n  DASHBOARD_TILE_DEFAULT_SIZE,\n  dashboardDefinitionBytes,\n  dashboardDefinitionFits,\n  dashboardTileDefaultSize,\n  emptyDashboardDefinition,\n  isSafeDashboardLink,\n  placeNewTile,\n  placeNewTiles,\n  tilesOverlap,\n  toStoredDashboardDefinition,\n  upgradeDashboardDefinition,\n} from './dashboards/definition.js'\nexport type { ActiveUsersDto } from './dtos/ActiveUsers.dto.js'\nexport type {\n  ALERT_SUBSCRIPTION_REPORT_TYPES,\n  ALERT_SUBSCRIPTION_TYPES,\n  AlertSubscriptionDto,\n  AlertSubscriptionEntryDto,\n  AlertSubscriptionWebhookAuth,\n  CheckFailedReason,\n} from './dtos/AlertSubscription.dto.js'\n// DTOs - Values (constants)\nexport {\n  FORBIDDEN_HOSTNAMES_FOR_WEBHOOK_ALERTS,\n  HMAC_HEADER_POSITION,\n  HMAC_SUPPORTED_ALGORITHM,\n} from './dtos/AlertSubscription.dto.js'\nexport type {\n  AnnotationActor,\n  AnnotationDto,\n  AnnotationEntityKind,\n  AnnotationKind,\n  AnnotationLookupDto,\n  AnnotationLookupEntryDto,\n  AnnotationTagDto,\n  EntityAnnotationsDto,\n} from './dtos/Annotation.dto.js'\nexport {\n  ANNOTATION_BODY_MAX,\n  ANNOTATION_ENTITY_KIND_LABELS,\n  ANNOTATION_ENTITY_KINDS,\n  ANNOTATION_ENTITY_MAX,\n  ANNOTATION_KINDS,\n  ANNOTATION_LOOKUP_MAX_ENTITIES,\n  ANNOTATION_LOOKUP_TAGS_MAX,\n  ANNOTATION_PAGE_SIZE_DEFAULT,\n  ANNOTATION_PAGE_SIZE_MAX,\n  ANNOTATION_SEARCH_MAX_LENGTH,\n  ANNOTATION_TAG_NAME_MAX,\n  normalizeTagName,\n} from './dtos/Annotation.dto.js'\nexport type { ApiClientStatsDto } from './dtos/ApiClientStats.dto.js'\n// Approvals - the wire types, and the rules that read them. Both are pure and\n// browser-safe, so control-backend, control-frontend and cloudbot run the same\n// code and cannot disagree.\nexport type {\n  ApprovalAck,\n  ApprovalActionMode,\n  ApprovalActor,\n  ApprovalEntityRef,\n  ApprovalEntityType,\n  ApprovalExecutionMode,\n  ApprovalJobDto,\n  ApprovalJobStatus,\n  ApprovalM2mActor,\n  ApprovalOverrideGrantDto,\n  ApprovalProgress,\n  ApprovalSortField,\n  ApprovalSortOrder,\n  ApprovalStatusCountsDto,\n  ApprovalSummaryField,\n  ApprovalSummaryFieldKind,\n  ApprovalSummaryValue,\n  ApprovalUseCaseDto,\n} from './dtos/ApprovalJob.dto.js'\nexport {\n  APPROVAL_ACKS_MAX,\n  APPROVAL_ENTITY_TYPES,\n  APPROVAL_JOB_STATUSES,\n  APPROVAL_LIST_SUMMARY_VALUES_MAX,\n  APPROVAL_LIVE_STATUSES,\n  APPROVAL_PAGE_SIZE_DEFAULT,\n  APPROVAL_PAGE_SIZE_MAX,\n  APPROVAL_PAYLOAD_ORG_FIELD,\n  APPROVAL_REASON_MAX_LENGTH,\n  APPROVAL_RUN_STALE_MS,\n  APPROVAL_SEARCH_MAX_LENGTH,\n  APPROVAL_SORT_DEFAULT,\n  APPROVAL_SORT_FIELDS,\n  APPROVAL_SUMMARY_FIELD_KINDS,\n  APPROVAL_TYPE_FILTER_MAX,\n  APPROVAL_TYPE_MAX_LENGTH,\n  isRunStalled,\n  progressFraction,\n} from './dtos/ApprovalJob.dto.js'\nexport type {\n  ApprovalOrganizationNameResult,\n  ApprovalSummaryNamesRequest,\n  ApprovalSummaryNamesResult,\n} from './dtos/ApprovalSummaryNames.dto.js'\nexport type { AuditDto } from './dtos/Audit.dto.js'\nexport type { Auth0ResourceServerDto } from './dtos/Auth0ResourceServer.dto.js'\nexport type { BackupDto } from './dtos/Backup.dto.js'\nexport type { BackupScheduleDto } from './dtos/BackupSchedule.dto.js'\nexport type { ByomClientDto, ByomStatus } from './dtos/ByomClient.dto.js'\nexport type {\n  ClusterCreationDefaultField,\n  ClusterCreationDefaultKey,\n  ClusterCreationDefaults,\n} from './dtos/ClusterCreationDefaults.dto.js'\nexport { CLUSTER_CREATION_DEFAULT_FIELDS } from './dtos/ClusterCreationDefaults.dto.js'\nexport type {\n  ClusterDeferredSpecChange,\n  DeferredSpecChangeType,\n} from './dtos/ClusterDeferredSpecChange.dto.js'\nexport type { ClusterIpWhitelistDto } from './dtos/ClusterIpWhitelist.dto.js'\nexport type {\n  MoveClusterOwnerResult,\n  MoveClusterWarnings,\n} from './dtos/ClusterOwnerMove.dto.js'\nexport type { ClusterPlanDto } from './dtos/ClusterPlan.dto.js'\nexport type { ClusterPlanTypeDto } from './dtos/ClusterPlanType.dto.js'\nexport type {\n  ChangeClusterPlanTypeResult,\n  ClusterModificationConfigRef,\n  ClusterPlanTypeChangeRefusal,\n  ClusterPlanTypeStateDto,\n} from './dtos/ClusterPlanTypeChange.dto.js'\nexport {\n  CLUSTER_PLAN_TYPE_CHANGE_REFUSALS,\n  clusterPlanTypeChangeRefusalOf,\n} from './dtos/ClusterPlanTypeChange.dto.js'\nexport type {\n  ClusterSpecChange,\n  ClusterSpecChangeActor,\n  ClusterSpecHistory,\n} from './dtos/ClusterSpecHistory.dto.js'\nexport type {\n  CommonClusterDto,\n  ExternalIdpConfig,\n  OptimizeFilteringConfig,\n  OptimizeFilteringIncludeExclude,\n  OptimizeFilteringPatch,\n  SecretsFilterMode,\n  ZeebeRebalancingSetting,\n} from './dtos/CommonCluster.dto.js'\nexport type { ConsoleClusterDto } from './dtos/ConsoleCluster.dto.js'\nexport type {\n  ClusterActivityBucket,\n  ClusterActivityTile,\n  ClusterActivityV2Dto,\n  ClusterActivityV2Response,\n  ClusterByClientV2Dto,\n  ClusterDatacenterOptionV2Dto,\n  ClusterDetailV2Dto,\n  ClusterFacetsV2Dto,\n  ClusterListItemV2Dto,\n  ClusterLiveStateV2Dto,\n  ClusterLiveStateV2Entry,\n  ClusterModificationState,\n  ClusterParameterOptionV2Dto,\n  ClusterParametersV2Dto,\n  ClusterTtlFilter,\n  ControlResolvedPermissions,\n  ControlSessionDto,\n  ControlSessionUser,\n  CursorPage,\n  CursorParams,\n  ListClustersV2Params,\n  ListOrganizationsV2Params,\n  ListOrgMembersV2Params,\n  OrgDetailV2Dto,\n  OrgListItemV2Dto,\n  OrgMemberV2Dto,\n  OrgSummaryV2Dto,\n} from './dtos/ControlV2.dto.js'\nexport { CLUSTER_MODIFICATION_STATES } from './dtos/ControlV2.dto.js'\nexport type {\n  DashboardActor,\n  DashboardAnnotationsQuery,\n  DashboardAnnotationsTile,\n  DashboardAnnotationsTileV1,\n  DashboardCatalogue,\n  DashboardCatalogueChartMetric,\n  DashboardCatalogueSearchField,\n  DashboardChartQuery,\n  DashboardChartRender,\n  DashboardChartTile,\n  DashboardChartTileV3,\n  DashboardClusterCard,\n  DashboardClusterDetailQuery,\n  DashboardClusterDetailTile,\n  DashboardClusterDetailTileV2,\n  DashboardDefinition,\n  DashboardDefinitionV1,\n  DashboardDefinitionV2,\n  DashboardDefinitionV3,\n  DashboardDto,\n  DashboardFleetQuery,\n  DashboardFleetQueryTile,\n  DashboardFleetQueryTileV1,\n  DashboardHeadingTile,\n  DashboardHeadingTileV2,\n  DashboardLinkTile,\n  DashboardLinkTileV2,\n  DashboardListDto,\n  DashboardNewTile,\n  DashboardNoteTile,\n  DashboardNoteTileV2,\n  DashboardOrgCard,\n  DashboardOrgDetailQuery,\n  DashboardOrgDetailTile,\n  DashboardOrgDetailTileV2,\n  DashboardSummaryDto,\n  DashboardTile,\n  DashboardTileKind,\n  DashboardTileLayout,\n  DashboardTileV1,\n  DashboardTileV2,\n  DashboardTileV3,\n  StoredDashboardDefinition,\n} from './dtos/Dashboard.dto.js'\nexport {\n  DASHBOARD_CHART_RENDERS,\n  DASHBOARD_CLUSTER_CARDS,\n  DASHBOARD_DEFINITION_BYTES_MAX,\n  DASHBOARD_DEFINITION_VERSION,\n  DASHBOARD_ENTITY_ID_MAX,\n  DASHBOARD_GRID_COLUMNS,\n  DASHBOARD_GRID_ROWS_MAX,\n  DASHBOARD_LINK_URL_MAX,\n  DASHBOARD_NOTE_MAX,\n  DASHBOARD_ORG_CARDS,\n  DASHBOARD_PAGE_SIZE_DEFAULT,\n  DASHBOARD_PAGE_SIZE_MAX,\n  DASHBOARD_TILE_KINDS,\n  DASHBOARD_TILE_ROWS_MAX,\n  DASHBOARD_TILES_MAX,\n  DASHBOARD_TITLE_MAX,\n} from './dtos/Dashboard.dto.js'\nexport type { EarlyAccessFeatureDto } from './dtos/EarlyAccessFeature.dto.js'\nexport type {\n  CamundaWebApp,\n  CamundaWebAppWithZeebe,\n  ExternalClickwrapConfigDto,\n  ExternalClusterDto,\n  ExternalOrganizationDto,\n} from './dtos/ExternalWebapp.dto.js'\nexport type {\n  CreateFeatureFlagDto,\n  FeatureFlagAnswer,\n  FeatureFlagDto,\n  FeatureFlagListDto,\n  UpdateFeatureFlagDto,\n} from './dtos/FeatureFlags.dto.js'\nexport type {\n  FleetStatRowDto,\n  FleetStatsPageDto,\n} from './dtos/FleetStats.dto.js'\nexport type {\n  ClusterGenerationStateDto,\n  ForceGenerationUpgradeResult,\n} from './dtos/ForceGenerationUpgrade.dto.js'\n// Functions\nexport {\n  activeGenerations,\n  compareGenerationNamesNewestFirst,\n  type GenerationDto,\n  type GenerationWithClusterCountDto,\n  sortGenerationBySemverOfZeebe,\n  type UpgradableGenerationsDto,\n} from './dtos/Generations.dto.js'\nexport type { ChangeGenerationVersionsResult } from './dtos/GenerationVersionsChange.dto.js'\n// Namespace (type-only - contains only interfaces)\nexport type { Hdp } from './dtos/Hdp.dto.js'\nexport type {\n  K8sBackupConfig,\n  K8sConfig,\n  K8sConfigLegacyFormat,\n  K8sContext,\n  K8sContextDto,\n} from './dtos/K8sContext.dto.js'\nexport type {\n  M2mTokenCountDto,\n  M2mTokenCountsDto,\n} from './dtos/M2mTokenCount.dto.js'\nexport type { MetaDto } from './dtos/Meta.dto.js'\nexport type {\n  AutoJoinAssignment,\n  LicensingModelType,\n  LlmProviderName,\n  OrganizationDto,\n  OrganizationMetadata,\n  OrgOwner,\n  OrgWithNameAndSalesPlan,\n} from './dtos/Organization.dto.js'\nexport {\n  LICENSING_MODEL_DISPLAY_NAMES,\n  VALID_LICENSING_MODELS,\n} from './dtos/Organization.dto.js'\nexport type { OrganizationMemberDto } from './dtos/OrganizationMember.dto.js'\nexport type { OrganizationToSalesPlanDto } from './dtos/OrganizationToSalesPlan.dto.js'\nexport type {\n  DryRunSanityDiff,\n  ReleaseTrainPreview,\n  ReleaseTrainSanityReport,\n  SanityFix,\n  SanityRuleInfo,\n  SanitySeverity,\n  SanityViolation,\n} from './dtos/ReleaseTrainSanity.dto.js'\nexport type { RestoreDto, RestoreState } from './dtos/Restore.dto.js'\n// SalesPlan.dto - Types\nexport type {\n  ClusterLimits,\n  ConsumptionDataItem,\n  Limits,\n  SalesPlanDto,\n  SalesPlanMetadata,\n} from './dtos/SalesPlan.dto.js'\n// SalesPlan.dto - Values (constants and functions)\nexport {\n  allClusterBasedLimits,\n  allSalesPlanLimits,\n  clusterPlanWhiteListIds,\n  deprecatedLimit,\n  generationWhiteListIds,\n  isLimitKeyEnabled,\n  isLimitOfferedOnStage,\n  isUnlockedClusterPlansStage,\n  MAX_CLUSTER_CLIENTS_DEFAULT,\n  MAX_CLUSTER_CLIENTS_DEV,\n  RETENTION_LIMIT_DEFAULT,\n  RETENTION_LIMIT_MAXIMUM,\n  RETENTION_LIMIT_MINIMUM,\n  unusedClusterBasedLimits,\n  unusedSalesPlanLimits,\n} from './dtos/SalesPlan.dto.js'\nexport type { SecureConnectivityDto } from './dtos/SecureConnectivity.dto.js'\nexport type { SignupDto } from './dtos/Signup.dto.js'\nexport type {\n  StorybookConfig,\n  StorybookConfigBackup,\n  StorybookConfigChannel,\n  StorybookConfigDatacenter,\n  StorybookConfigGeneration,\n} from './dtos/StorybookConfig.dto.js'\nexport type { SystemAuditDto } from './dtos/SystemAudit.dto.js'\nexport type {\n  UpgradeReadinessDto,\n  UpgradeReadinessSource,\n  UpgradeReadinessState,\n} from './dtos/UpgradeReadiness.dto.js'\n// UsageAlert.dto - Types\nexport type { UsageAlertDto } from './dtos/UsageAlert.dto.js'\n// UsageAlert.dto - Values (enum and constants)\nexport {\n  UsageAlertInitValues,\n  UsageAlertMetric,\n  UsageAlertThresholdLimits,\n} from './dtos/UsageAlert.dto.js'\nexport type { UserMetaDataDto } from './dtos/UserMetaData.dto.js'\n// Lucene-style table search (parser + AST \u2192 SQL compiler + field registries).\nexport {\n  type AndNode,\n  CLUSTER_DEFAULT_SEARCH_FIELDS,\n  CLUSTER_SEARCH_FIELDS,\n  CLUSTER_TTL_SEARCH_FIELDS,\n  type CompileContext,\n  type CompiledQuery,\n  clusterSearchFieldsForStage,\n  compileQuery,\n  type FieldBinding,\n  findSearchField,\n  idSetPredicate,\n  isLuceneQueryError,\n  joinIdSet,\n  LuceneQueryError,\n  likeArgument,\n  type NotNode,\n  ORG_DEFAULT_SEARCH_FIELDS,\n  ORGANIZATION_SEARCH_FIELDS,\n  type OrNode,\n  parseLuceneQuery,\n  type QueryNode,\n  type RangeNode,\n  type SearchFieldCapability,\n  type SearchFieldSpec,\n  type SearchFieldType,\n  type SearchTermOperator,\n  type SqlDialect,\n  type TermNode,\n} from './search/index.js'\nexport { upgradeGateReason } from './utils/upgradeGateReason.utils.js'\n\n// ============================================================================\n// Enums (runtime values)\n// ============================================================================\n\nexport {\n  AlertSubscriptionReportType,\n  AlertSubscriptionType,\n} from './enums/AlertSubscription.enum.js'\nexport { AuditEntity, AuditEntityAttribute } from './enums/AuditEntity.enum.js'\nexport { AuditService } from './enums/AuditService.enum.js'\nexport { BackupStatus } from './enums/BackupStatus.enum.js'\nexport {\n  ClusterBulkOperationStatus,\n  ClusterBulkOperationType,\n} from './enums/ClusterBulkOperation.enum.js'\nexport { ClusterClientPermission } from './enums/ClusterClientPermissions.enum.js'\nexport { ClusterEncryptionKey } from './enums/ClusterEncryptionKey.enum.js'\nexport { ClusterStatus } from './enums/ClusterStatus.enum.js'\nexport { ConsoleAPIClientPermission } from './enums/ConsoleApiClientPermission.enum.js'\nexport { ErrorType } from './enums/ErrorType.enum.js'\nexport type {\n  AssignableOrganizationRoleType,\n  OrganizationRoleType,\n  UnassignableOrganizationRoleType,\n} from './enums/OrganizationRole.enum.js'\nexport {\n  AssignableOrganizationRole,\n  LegacyHeldOrganizationRole,\n  OrganizationRole,\n  UnassignableOrganizationRole,\n} from './enums/OrganizationRole.enum.js'\nexport { SseEntity, SseType } from './enums/Sse.enum.js'\nexport {\n  SystemAuditEntity,\n  SystemAuditEntityAttribute,\n} from './enums/SystemAuditEntity.enum.js'\n\n// ============================================================================\n// Permissions - Namespaces (runtime values)\n// ============================================================================\n\nexport { AccountsPermissions } from './permissions/accounts.permissions.js'\nexport { AlertDistributorPermissions } from './permissions/alert-distributor.permissions.js'\nexport { AuditLoggerPermissions } from './permissions/auditlogger.permissions.js'\nexport {\n  accountsUserFeaturesFromPermissions,\n  consoleUserFeaturesFromPermissions,\n  sessionHasPermission,\n  sessionPermissionKeysFor,\n} from './permissions/combo.js'\nexport { ConsolePermissions } from './permissions/console.permissions.js'\nexport { NotificationPermissions } from './permissions/notification.permissions.js'\n// profile.permissions - Types\nexport type { OnboardConfig } from './permissions/profile.permissions.js'\n// profile.permissions - Values (constants)\n// NOTE: the `allowed` email lists (CLOUD_TEAM_EMAILS, SRE_TEAM_EMAILS, etc.)\n// intentionally live in the private `@camunda-cloud/shared-backend` package\n// instead of here, since this package is published publicly to npm.\nexport { PROFILES } from './permissions/profile.permissions.js'\nexport {\n  ALL_PERMISSIONS_AT_AUTH0,\n  expandRolesToPermissions,\n} from './permissions/roleExpansion.utils.js'\n\n// ============================================================================\n// Types - Type-only exports (interfaces and type aliases)\n// ============================================================================\n\nexport type { AuditData } from './types/AuditData.type.js'\n// AutoSleep.type - Types\nexport type {\n  ActivitySleepEligibilityOptions,\n  SleepCronEligibilityOptions,\n} from './types/AutoSleep.type.js'\n// AutoSleep.type - Values (constants and functions)\nexport {\n  INTERNAL_LOW_HARDWARE_PLAN_NAME,\n  isActivitySleepEligible,\n  isClusterTagEligibleForSleepCron,\n  isSalesPlanEligibleForSleepCron,\n  isSleepCronEligible,\n  SLEEP_CRON_ELIGIBLE_TAGS,\n} from './types/AutoSleep.type.js'\nexport type {\n  BotContext,\n  BotOptions,\n  BotRequest,\n  GetUserDetailsResponse,\n  ListRolesForUserResponse,\n  UpdateUserRolesRequest,\n  UpdateUserRolesResponse,\n  UserContext,\n  UserDetails,\n} from './types/Bot.types.js'\n// BulkOperation.type - Types\nexport type {\n  BulkClusterDeletionContent,\n  BulkClusterDeletionItem,\n  BulkClusterGenerationUpdateItem,\n  BulkClusterPlanTypeUpdateContent,\n  BulkClusterPlanTypeUpdateItem,\n  BulkClusterPlanUpdateContent,\n  BulkClusterPlanUpdateItem,\n  BulkGenerationUpdateContent,\n  GenericBulkClusterOperationContent,\n  GenericBulkOperationContent,\n  GenericClusterBulkOperationItem,\n} from './types/BulkOperation.type.js'\n// BulkOperation.type - Functions (type guards)\nexport {\n  isBulkClusterDeletionItem,\n  isBulkClusterPlanTypeUpdateItem,\n  isBulkClusterPlanUpdateItem,\n  isIsBulkClusterGenerationUpdateIten,\n} from './types/BulkOperation.type.js'\n// C8ClusterComponentVersions.type - Types\nexport type {\n  GenerationEnvVarsDto,\n  GenerationEnvVarsKey,\n  GenerationImageVersionsDto,\n  ImmutableZeebeClusterVersionsDto,\n  MutableZeebeClusterVersionsDto,\n  ZeebeClusterVersionsDto,\n} from './types/C8ClusterComponentVersions.type.js'\n// C8ClusterComponentVersions.type - Values (constants)\nexport {\n  AllThings,\n  GENERATION_ENV_VARS_KEYS,\n  GENERATION_IMAGE_VERSION_KEYS,\n  ImmutableThings,\n  MutableThings,\n} from './types/C8ClusterComponentVersions.type.js'\n// CamundaClusterLabels.type - Types\nexport type {\n  CamundaClusterStage,\n  CamundaClusterStageLabel,\n  ClusterLabels,\n} from './types/CamundaClusterLabels.type.js'\n// CamundaClusterLabels.type - Values (constants)\nexport {\n  ALLOWED_CAMUNDA_LABELS,\n  StageClusterLabels,\n} from './types/CamundaClusterLabels.type.js'\n// Chargebee.type - Types\nexport type { SubscriptionItem } from './types/Chargebee.type.js'\n// Chargebee.type - Values (enums)\nexport { ConsumptionData, ConsumptionDataType } from './types/Chargebee.type.js'\n// ClusterBulkOperation.type - Types\nexport type {\n  ClusterBulkOperationAck,\n  ClusterBulkOperationClusterDto,\n  ClusterBulkOperationContent,\n  ClusterBulkOperationDto,\n  ClusterBulkOperationGenerationUpdateParameter,\n  ClusterBulkOperationParameter,\n  ClusterBulkOperationPlanTypeUpdateParameter,\n  ClusterBulkOperationPlanUpdateParameter,\n  ClusterBulkOperationPostContent,\n  ClusterSleepWakeupParameter,\n} from './types/ClusterBulkOperation.type.js'\nexport type {\n  ClusterModificationConfigDto,\n  ClusterModificationDto,\n} from './types/ClusterModification.type.js'\n// ClusterPlanFields.type - Values (field spec and type guard)\nexport {\n  CLUSTER_PLAN_FIELDS,\n  type ClusterPlanFieldSpec,\n  type ClusterPlanFieldTree,\n  isClusterPlanFieldSpec,\n} from './types/ClusterPlanFields.type.js'\nexport type {\n  ClusterPlanModificationAck,\n  ClusterPlanModificationConfig,\n  ClusterPlanModificationDto,\n} from './types/ClusterPlanModification.type.js'\n// ClusterPlanTypeAvailabilityClass.type - Values (enum and function)\nexport {\n  ClusterPlanTypeAvailabilityClass,\n  hasNoAvailabilityClass,\n  sortByAvailabilityClasses,\n} from './types/ClusterPlanTypeAvailabilityClass.type.js'\n// ClusterPlanTypeCategory.type - Values (enum and functions)\nexport {\n  ClusterPlanTypeCategory,\n  hasAvailabilityClass,\n  sortByClusterPlanTypeCategory,\n} from './types/ClusterPlanTypeCategory.type.js'\nexport type { ClusterPlanTypesToConfig } from './types/ClusterPlanTypesToConfig.type.js'\nexport type { ClusterPlanTypesToReserved } from './types/ClusterPlanTypesToReserved.type.js'\nexport type {\n  ClusterTtlDeletionPayload,\n  ClusterTtlDeletionResult,\n  ClusterTtlDto,\n  ClusterTtlDuration,\n  ClusterTtlOption,\n  ClusterTtlUnlimited,\n  UpdateClusterTtlBody,\n} from './types/ClusterTtl.type.js'\nexport {\n  CLUSTER_TTL_BACKFILL_REASON,\n  CLUSTER_TTL_DURATION_MS,\n  CLUSTER_TTL_DURATIONS,\n  CLUSTER_TTL_FEATURE_FLAG,\n  CLUSTER_TTL_OPTIONS,\n  CLUSTER_TTL_UNLIMITED_LINK_MAX_LENGTH,\n  CLUSTER_TTL_UNLIMITED_REASON_MAX_LENGTH,\n  clusterTtlExpiresAt,\n  DEFAULT_CLUSTER_TTL_OPTION,\n  extendClusterTtl,\n  isClusterTtlDuration,\n  isClusterTtlOption,\n  isClusterTtlStage,\n  isHttpUrl,\n  isPastClusterTtl,\n  validateClusterTtlUnlimited,\n} from './types/ClusterTtl.type.js'\nexport type {\n  ClusterUsageDataRequest,\n  ClusterUsageMetadataDto,\n  ClusterUsageMetricsAddRequestByMetricHeap,\n  ClusterUsageMetricsData,\n  ClusterUsageMetricsFilter,\n  ClusterUsageOrgStartDate,\n} from './types/ClusterUsageMetrics.type.js'\n// Dashboard.types - Types\nexport type {\n  DashboardConfig,\n  DashboardMappingItem,\n  DashboardMappingTarget,\n  DashboardResultPrimitive,\n  DashboardResultRow,\n  EngineeringOperationsDashboardResponse,\n} from './types/Dashboard.types.js'\nexport type { EnterpriseIncludingValueMetrics } from './types/EnterpriseIncludingValueMetrics.type.js'\nexport type {\n  HdpTenantUsageBreakdown,\n  HdpTenantUsagePerClusterPoint,\n  HdpTenantUsagePoint,\n} from './types/HdpTenantUsage.type.js'\n// hdp.types - Types (interfaces)\nexport type {\n  AlertSubscription as HdpAlertSubscription,\n  ByomClient as HdpByomClient,\n  Channel as HdpChannel,\n  Cluster as HdpCluster,\n  ClusterBackup as HdpClusterBackup,\n  ClusterBackupSchedule as HdpClusterBackupSchedule,\n  ClusterBulkOperation as HdpClusterBulkOperation,\n  ClusterClient as HdpClusterClient,\n  ClusterModification as HdpClusterModification,\n  ClusterPlan as HdpClusterPlan,\n  ClusterPlanType as HdpClusterPlanType,\n  ConnectorSecret as HdpConnectorSecret,\n  ConsoleApiClient as HdpConsoleApiClient,\n  Datacenter as HdpDatacenter,\n  Generation as HdpGeneration,\n  HdpBackendChangeEvent,\n  HdpClusterModificationConfig,\n  HdpDisk,\n  HdpEntity,\n  HdpPrometheusDataCapacityDataPoint,\n  Invite as HdpInvite,\n  LlmSpend as HdpLlmSpend,\n  Organization as HdpOrganization,\n  SecureConnectivity as HdpSecureConnectivity,\n  SystemAudit as HdpSystemAudit,\n  TelemetryData as HdpTelemetryData,\n  UsageAlert as HdpUsageAlert,\n  User as HdpUser,\n  UserLogin as HdpUserLogin,\n} from './types/hdp.types.js'\n// hdp.types - Values (enums)\nexport {\n  AlertSubscriptionReportType as HdpAlertSubscriptionReportType,\n  AlertSubscriptionType as HdpAlertSubscriptionType,\n  HDP_DISKS,\n} from './types/hdp.types.js'\n// notification.type - Types\nexport type {\n  GlobalNotification,\n  NotificationDto,\n  NotificationMeta,\n  NotificationOptions,\n  NotificationPermission,\n  NotificationSource,\n  NotificationState,\n  NotificationType,\n  OrgNotification,\n  UserNotification,\n  UserOrgNotification,\n} from './types/notification.type.js'\n// notification.type - Values (enums and constants)\nexport {\n  NotificationPermissionValues,\n  NotificationSourceEnum,\n  NotificationStateEnum,\n  NotificationTypeEnum,\n} from './types/notification.type.js'\n// OrganizationPermission.type - Types\nexport type {\n  CreateReadUpdateDelete,\n  OrganizationPermissions,\n} from './types/OrganizationPermission.type.js'\n// OrganizationPermission.type - Values (constants)\nexport {\n  OrganizationPermissionsDescriptions,\n  PermissionsForOrganizationRole,\n} from './types/OrganizationPermission.type.js'\nexport {\n  getPreprodClusterTtlHours,\n  isPastPreprodClusterTtl,\n  isPreprodClusterTtlStage,\n  parseNumericLimit,\n} from './types/PreprodClusterTtl.type.js'\n// Roles.js - Types\nexport type {\n  AccountRoles,\n  ConsoleRoles,\n  ModelerRoles,\n  Roles,\n} from './types/Roles.js'\n// Roles.js - Values (constants)\nexport { SAFE_ROLES } from './types/Roles.js'\n// SalesPlanType.type - Types\nexport type {\n  DisplayedSalesPlan,\n  RevisitedSalesPlanName,\n} from './types/SalesPlanType.type.js'\n// SalesPlanType.type - Values (enums and functions)\nexport {\n  AnalyticsSalesPlanType,\n  getAnalyticsSalesPlanFromOrgSalesPlan,\n  getDisplayedSalesPlan,\n  getRevisitedSalesPlanName,\n  OPTIMIZE_DISABLED_PLAN_TYPES,\n  SalesPlanType,\n  USAGE_SALES_PLAN_TYPES,\n} from './types/SalesPlanType.type.js'\n// SpamDetection.type - Types\nexport type { SpamDetectionPatterns } from './types/SpamDetection.type.js'\n// SpamDetection.type - Values (constants)\nexport { TEERGRUBE_PATTERNS } from './types/SpamDetection.type.js'\nexport type {\n  AlertSubscriptionSseEvent,\n  BackupSseEvent,\n  ClusterClientSseEvent,\n  ClusterSseEvent,\n  ConnectorSecretsSseEvent,\n  ConsoleApiClientSseEvent,\n  ConsoleSseEvent,\n  MonitoringSseEvent,\n  SecureConnectivitySseEvent,\n  SseClusterPayload,\n  SseMonitoringPayload,\n  SseSecureConnectivityPayload,\n} from './types/SseEvent.type.js'\n// Namespace (type-only - contains only interfaces)\nexport type { AccountsStats } from './types/Stats.types.js'\n// Survey.type - Types\nexport type { Persona, SurveyDto } from './types/Survey.type.js'\n// Survey.type - Values (enum)\nexport { FeedbackType } from './types/Survey.type.js'\n// SuspendStrategy.type - Types\nexport type {\n  GetSuspendStrategyOptions,\n  SuspendStrategy,\n} from './types/SuspendStrategy.type.js'\n// SuspendStrategy.type - Values (function)\nexport { getSuspendStrategy } from './types/SuspendStrategy.type.js'\nexport type { SystemAuditData } from './types/SystemAuditData.type.js'\n\n// Namespace (runtime value)\nexport { Telemetry } from './types/Telemetry.type.js'\n\n// TrialManagement.types - Types\nexport type {\n  ExtensionListItem,\n  ExtensionListResponse,\n  OrgTrialDetail,\n  TrialExtensionSource,\n  TrialManagementStats,\n} from './types/TrialManagement.types.js'\n\n// User.type - Types\nexport type {\n  AccountsData,\n  AppMetadata,\n  BasicUser,\n  BlockedFor,\n  Identity,\n  OrgMembership,\n  User,\n  UserMetadata,\n  UserRequest,\n} from './types/User.type.js'\n\n// User.type - Values (enum)\nexport { UserMetadataEvent } from './types/User.type.js'\n\nexport type {\n  UniqueTaskUser,\n  ValueMetrics,\n  ValueMetricsPerYearMonth,\n} from './types/ValueMetrics.type.js'\n\n// ============================================================================\n// Utils - Classes (runtime values)\n// ============================================================================\n\nexport {\n  CLOUD_PROVIDER_ORDER,\n  getCloudProviderLabel,\n  getCloudProviderRank,\n} from './utils/cloudProvider.utils.js'\nexport {\n  type ConnectivityStatus,\n  deriveConnectivityMessage,\n  deriveConnectivityStatus,\n} from './utils/connectivityStatus.utils.js'\nexport type {\n  CronScheduleValidationFailure,\n  CronScheduleValidationResult,\n  CronScheduleValidationSuccess,\n} from './utils/cronSchedule.utils.js'\nexport {\n  BACKUP_SCHEDULE_MIN_INTERVAL_MINUTES,\n  validateCronSchedule,\n} from './utils/cronSchedule.utils.js'\nexport {\n  canonicalPlan,\n  canonicalPlanKey,\n  canonicalPlanModifications,\n} from './utils/elasticsearchPlanPath.utils.js'\nexport {\n  deriveEncryptionStatus,\n  type EncryptionStatus,\n  isEncryptionStatus,\n} from './utils/encryptionStatus.utils.js'\n// enterprise-connection.utils - Types\nexport type { EnterpriseConnectionOrganizationAssignment } from './utils/enterprise-connection.utils.js'\n// enterprise-connection.utils - Values (functions)\nexport {\n  enterpriseConnectionMetadataToOrganizationAssignments,\n  organizationAssignmentsToEnterpriseConnectionMetadata,\n} from './utils/enterprise-connection.utils.js'\nexport {\n  addMonthsClamped,\n  DEFAULT_ENTERPRISE_DURATION_IN_MONTHS,\n  diffInWholeMonths,\n  type EnterpriseTermWindow,\n  getCurrentEnterpriseTerm,\n  peakWithinTerm,\n  toUtcDayStartMs,\n} from './utils/enterpriseTerm.utils.js'\nexport type { EnvVarEntry } from './utils/envVars.js'\nexport { parseEnvVars, serializeEnvVars } from './utils/envVars.js'\nexport {\n  deriveFailoverKeyPolicyPrincipals,\n  type FailoverKeyPolicyPrincipals,\n} from './utils/failoverKeyPolicy.utils.js'\nexport type {\n  JvmOptionsModificationKey,\n  ParsedJvmOption,\n} from './utils/jvmOptions.js'\nexport {\n  addsEnvVarsOverrideValue,\n  isJvmOptionsModificationKey,\n  isUnderJvmSpec,\n  isValidJvmOptionsPlanValue,\n  JVM_OPTION_MAX_LENGTH,\n  JVM_OPTION_PATTERN,\n  JVM_OPTIONS_MAX_ITEMS,\n  JVM_OPTIONS_MODIFICATION_KEYS,\n  JVM_OPTIONS_TARGETS,\n  joinJvmOptions,\n  jvmOptionsOfPlanValue,\n  parseJvmOption,\n  requiresEnvVarsOverride,\n  splitJvmOptions,\n  validateJvmOptions,\n  validateJvmOptionsPlanValue,\n  validateJvmOptionsValue,\n} from './utils/jvmOptions.js'\nexport {\n  KMS_ARN,\n  KMS_MRK_ARN,\n  type KmsArnValidationError,\n  type ParsedKmsArn,\n  parseKmsArn,\n  validateKmsArnForRegion,\n} from './utils/kmsArn.utils.js'\nexport { validateLabels } from './utils/labelValidator.utils.js'\nexport { ObjectMergeUtils } from './utils/objectMerge.utils.js'\nexport { getAtPath } from './utils/objectPath.utils.js'\nexport {\n  computeOrgStartDate,\n  type OrgStartDateInput,\n} from './utils/orgStartDate.utils.js'\nexport {\n  getPermissionsByRoles,\n  getUserPermissionsForOrg,\n} from './utils/orgs/OrgHelper.js'\n\n// PasswordPolicy - Types\nexport type {\n  PasswordPolicyRequest,\n  PasswordPolicyResult,\n} from './utils/PasswordPolicy.js'\n\n// PasswordPolicy - Values (constants and function)\nexport {\n  MAXLENGTH as PASSWORD_POLICY_MAXLENGTH,\n  MINLENGTH as PASSWORD_POLICY_MINLENGTH,\n  passwordPolicyCheck,\n} from './utils/PasswordPolicy.js'\nexport { isQaUserEmail, qaUserEmail } from './utils/qa-user.utils.js'\nexport {\n  deriveSecondaryStorageStatus,\n  type SecondaryStorageStatus,\n} from './utils/secondaryStorageStatus.utils.js'\nexport {\n  allSettledResultsCounts,\n  getFulfilledPromises,\n  getRejectedPromises,\n  getSettledSummary,\n} from './utils/settledPromises.util.js'\nexport {\n  isValidAwsArn,\n  isValidCIDR,\n  isValidCIDRList,\n  isValidClientName,\n  isValidHostname,\n  isValidPrivateLinkRegion,\n  normalizeCIDRList,\n} from './utils/string-validation.utils.js'\nexport {\n  extractCamundaUserEmail,\n  guessName,\n  isCamundaUserId,\n} from './utils/user.utils.js'\n\n// versionCheck.utils - Values (enum and function)\nexport {\n  checkVersion,\n  generationImageErrorMessage,\n  isAppIntegrationsVersionSupported,\n  isGenerationResumable,\n  isSecretsFilterModeConfigurable,\n  isValidGenerationImage,\n  normalizeGenerationVersion,\n  stripSecfixPostfix,\n  VersionCheckOperator,\n} from './utils/versionCheck.utils.js'\nexport type { ZeebeRebalancingValidationErrors } from './utils/zeebeRebalancing.utils.js'\nexport {\n  validateZeebeRebalancing,\n  ZEEBE_REBALANCING_FEATURE_FLAG,\n} from './utils/zeebeRebalancing.utils.js'\n\n// ============================================================================\n// Config - Configuration files and types\n// ============================================================================\n\nexport { default as CAMUNDI_PERMISSION_RULES } from './config/camundi-permission-rules.js'\nexport type { CamundiPermissionRules } from './config/camundi-permission-rules.types.js'\n\nexport {\n  augmentCamundiPermissions,\n  getApplicableRolesForEmployee,\n  HIBOB_CACHE_KEY,\n  HIBOB_CACHE_NAMESPACE,\n  isManager,\n} from './utils/camundiPermissionAugmenter.utils.js'\n"],
+  "mappings": "AAUA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,KAAK,MAAM,QAAQ,QAAQ,YAAY;AAEhD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,4BAA4B;AACrC,SAAS,iDAAiD;AAC1D,SAAS,6CAA6C;AAKtD,SAAS,wCAAwC;AACjD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA4BP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AASP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAKP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAMP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAeP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAOP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAMP,SAAS,mDAAmD;AAM5D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAOP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAMA;AAAA,EASA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAIP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAWP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAWP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAyBP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAgBP,SAAS,uCAAuC;AAkBhD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AA6CP,SAAS,mCAAmC;AA8C5C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAyBP;AAAA,EACE;AAAA,EACA;AAAA,EAGA;AAAA,OAEK;AAyBP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAsBP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAmBP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EAEA;AAAA,OASK;AACP,SAAS,yBAAyB;AAMlC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,aAAa,4BAA4B;AAClD,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,+BAA+B;AACxC,SAAS,4BAA4B;AACrC,SAAS,qBAAqB;AAC9B,SAAS,kCAAkC;AAC3C,SAAS,iBAAiB;AAM1B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,WAAW,eAAe;AACnC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAMP,SAAS,2BAA2B;AACpC,SAAS,mCAAmC;AAC5C,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B;AACnC,SAAS,+BAA+B;AAOxC,SAAS,gBAAgB;AACzB;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAaP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA2BP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAWP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAQP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAIP,SAAS,iBAAiB,2BAA2B;AAmBrD;AAAA,EACE;AAAA,EAGA;AAAA,OACK;AAOP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAYP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAyDP;AAAA,EACiC,+BAA/BA;AAAA,EACyB,yBAAzBC;AAAA,EACA;AAAA,OACK;AAgBP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAOP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AASP,SAAS,kBAAkB;AAO3B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAIP,SAAS,0BAA0B;AAoBnC,SAAS,oBAAoB;AAO7B,SAAS,0BAA0B;AAInC,SAAS,iBAAiB;AAyB1B,SAAS,yBAAyB;AAYlC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EAEE;AAAA,EACA;AAAA,OACK;AAMP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EAEA;AAAA,OACK;AAIP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,cAAc,wBAAwB;AAC/C;AAAA,EACE;AAAA,OAEK;AAKP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB;AAC/B,SAAS,wBAAwB;AACjC,SAAS,iBAAiB;AAC1B;AAAA,EACE;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AASP;AAAA,EACe;AAAA,EACA;AAAA,EACb;AAAA,OACK;AACP,SAAS,eAAe,mBAAmB;AAC3C;AAAA,EACE;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAMP,SAAoB,WAAXC,gBAA2C;AAGpD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;",
   "names": ["AlertSubscriptionReportType", "AlertSubscriptionType", "default"]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camunda/ccma-shared-types",
-  "version": "12.8.0",
+  "version": "12.9.0",
   "description": "Shared TypeScript types for Camunda Cloud Management Apps",
   "bugs": {
     "url": "https://github.com/camunda/camunda-cloud-management-apps/issues"