@camunda/ccma-shared-types 2.0.0 → 3.0.0

package/dist/dtos/ApprovalJob.dto.d.ts

@@ -19,6 +19,44 @@
  */
 export declare const APPROVAL_JOB_STATUSES: readonly ["pending", "approved", "executing", "executed", "failed", "rejected", "withdrawn", "expired"];
 export type ApprovalJobStatus = (typeof APPROVAL_JOB_STATUSES)[number];
+/**
+ * The states in which the action of a request is still COMING.
+ *
+ * `pending` waits for approvals, `approved` waits for a person to press the
+ * button, and `executing` is running now. Each of them can still change the
+ * world, so two requests for one target must not be in these states together.
+ * `dedupeKey` reads this set for that reason.
+ *
+ * `failed` is NOT here, although a person can run a failed request again. A
+ * failed request runs only when a person presses the button, and that person
+ * sees the row. Blocking a new request on a failed one would also trap the
+ * key: `canWithdraw` accepts `pending` alone, so nobody could close it.
+ *
+ * `executed`, `rejected`, `withdrawn` and `expired` are the end of a request.
+ */
+export declare const APPROVAL_LIVE_STATUSES: readonly ["pending", "approved", "executing"];
+/**
+ * How many requests one page of the list holds when the caller asks for no
+ * number.
+ *
+ * The list is a work queue that a Camundi reads, so the page is large: a
+ * person wants the whole queue and not ten rows at a time. What the number is
+ * for is the ceiling below.
+ */
+export declare const APPROVAL_PAGE_SIZE_DEFAULT = 500;
+/**
+ * The largest page that the service builds, and the largest that a caller may
+ * ask for. The API answers 400 above it.
+ *
+ * The list had no limit at all. One authenticated caller could then make the
+ * service read the whole table into memory, serialize it, and do it again, so
+ * the cost of a request grew with the age of the service and with nothing that
+ * the caller had to pay for. A ceiling turns that into a fixed cost.
+ *
+ * It is HERE and not only in the service, because the view must know it: a
+ * page that asked for more would get a 400 instead of rows.
+ */
+export declare const APPROVAL_PAGE_SIZE_MAX = 2000;
 /**
  * What happens when a request reaches its threshold.
  *
@@ -26,6 +64,22 @@ export type ApprovalJobStatus = (typeof APPROVAL_JOB_STATUSES)[number];
  * `approved` and waits for a person to run it.
  */
 export type ApprovalExecutionMode = 'auto' | 'explicit';
+/**
+ * WHERE the action runs. It is a separate question from who starts it.
+ *
+ * - `inline` runs the action inside the call that started it, and the answer
+ *   already carries the outcome. Right for one call to another service.
+ * - `background` answers as soon as the request is claimed, and the action
+ *   runs on. It reports into `ApprovalJobDto.progress`, and the row is the
+ *   only place that holds the progress, so a reload and a second person read
+ *   the same numbers. A pod that stops loses the run, and the reconciler of
+ *   control-backend recovers the row.
+ *
+ * An action over thousands of targets MUST be `background`. `inline` would
+ * hold one HTTP request for the whole run, and the ingress, the load balancer
+ * and the browser each have their own deadline before it finishes.
+ */
+export type ApprovalActionMode = 'inline' | 'background';
 /**
  * A person, as an approval request records them.
  *
@@ -41,24 +95,168 @@ export interface ApprovalAck extends ApprovalActor {
     /** An ISO timestamp. It is in a json column, so it is a string, not a Date. */
     date: string;
 }
+/**
+ * What one value of a summary field is.
+ *
+ * `text` is what a person reads. `id` is what a link points at, and it is
+ * absent when the kind names no entity. The two are separate because the text
+ * is a COPY that the request keeps: an organization that gets a new name after
+ * the request was opened must still read as the organization that the person
+ * chose.
+ */
+export interface ApprovalSummaryValue {
+    text: string;
+    id?: string;
+}
+/**
+ * How a reader must render one field of a summary.
+ *
+ * `org`, `cluster` and `user` name an entity, so a reader can link to it and
+ * can resolve a fresh name. The others are plain: `date` is an ISO timestamp,
+ * and `code` is a value that must keep its characters, such as a json fragment.
+ */
+export declare const APPROVAL_SUMMARY_FIELD_KINDS: readonly ["text", "number", "boolean", "date", "org", "cluster", "user", "code"];
+export type ApprovalSummaryFieldKind = (typeof APPROVAL_SUMMARY_FIELD_KINDS)[number];
+/**
+ * One labelled field of the payload of a request.
+ *
+ * This is what makes ONE view able to show EVERY use case. The payload of a
+ * request is an object of anything, so a generic view can only print it as
+ * json. The use case turns it into labelled fields here, and the view renders
+ * a field by its kind: it links an `org`, it formats a `date`, and it lists
+ * 300 clusters as 300 links.
+ *
+ * `values` is always an array. A field that holds one value holds an array of
+ * one, so a reader needs no branch for "one or many".
+ */
+export interface ApprovalSummaryField {
+    label: string;
+    kind: ApprovalSummaryFieldKind;
+    values: ApprovalSummaryValue[];
+}
+/**
+ * How long a run may go quiet before a reader calls it stalled.
+ *
+ * The pod that runs an action writes its progress and renews its lease on one
+ * timer, so a healthy run touches the row well inside this window. A row that
+ * is `executing` and older than this held a pod that stopped, and the
+ * reconciler of control-backend is on its way to it.
+ *
+ * It lives here, and not in the config of the service, because a READER needs
+ * it: the browser must decide what to show without a second call, and a number
+ * that only the backend knew would make the two disagree. `ACTION_LEASE_MS` in
+ * `config/index.ts` is held below this on purpose.
+ */
+export declare const APPROVAL_RUN_STALE_MS = 120000;
+/**
+ * What an action reports while it runs.
+ *
+ * This is what makes a long action watchable. Every field is in the DATABASE
+ * and not in the answer to the call that started the run, so three readers see
+ * the same thing: the person who pressed the button, the same person after a
+ * reload, and a second person who opens the request.
+ *
+ * `total` can be 0 while an action counts its targets, and it stays 0 for an
+ * action that cannot count them. A reader must then show that it runs, and no
+ * percentage.
+ */
+export interface ApprovalProgress {
+    /** Targets in total. 0 means the action did not say. */
+    total: number;
+    /** Targets finished, whatever the outcome of each one. */
+    done: number;
+    /** Targets that finished with an error. Part of `done`. */
+    failed: number;
+    /** One short line for a person, such as the step that runs now. */
+    note?: string;
+    /** An ISO timestamp: when the run started. */
+    startedAt: string;
+    /** An ISO timestamp: when the run last wrote anything. */
+    updatedAt: string;
+}
+/** The share of the work that is finished, or `undefined` with no total. */
+export declare function progressFraction(progress: ApprovalProgress | undefined): number | undefined;
+/**
+ * Reports whether a running request went quiet.
+ *
+ * True means that the pod which held the run stopped, or lost the row. It does
+ * NOT mean that the action failed: the reconciler either runs it again, or it
+ * writes `failed` so that a person can. See `APPROVAL_RUN_STALE_MS`.
+ */
+export declare function isRunStalled(job: ApprovalJobDto, now: Date): boolean;
 /** One approval request, as the API returns it. */
 export interface ApprovalJobDto {
     id: string;
     type: string;
     dedupeKey?: string;
     payload: Record<string, unknown>;
+    /**
+     * The payload as labelled fields. See `ApprovalSummaryField`.
+     *
+     * The use case builds it when the request is opened AND every time the
+     * request is read, so a field that a later version of the use case adds
+     * appears on a request that is already open.
+     */
+    summary: ApprovalSummaryField[];
+    /** Why the person opened the request. Some use cases demand one. */
+    reason?: string;
     createdBy: ApprovalActor;
     acks: ApprovalAck[];
-    /** Copied from the use case, so a reader can render "1 of 2". */
+    /**
+     * How many approvals THIS request needs.
+     *
+     * It is on the request and not only on the use case, because the person who
+     * opens one can ask for more than the floor of the use case. A bulk
+     * operation over 3000 clusters is the same action as one over 3, and it can
+     * still deserve a third pair of eyes. `ApprovalUseCaseDto.minAcks` is the
+     * floor that a caller cannot go below.
+     */
     requiredAcks: number;
+    /**
+     * What a person must hold to approve, reject or run THIS request.
+     *
+     * It is on the request and not only on the use case, because a payload can
+     * raise the guard: a generation update with `yoloForceUpdate` needs the yolo
+     * permission on top of the base one, and the same use case without the flag
+     * does not. The set is computed ONE time, when the request is opened, so it
+     * is also the record of what the request was guarded by.
+     *
+     * A person needs EVERY permission in the set, not one of them.
+     */
+    requiredPermissions: string[];
     executionMode: ApprovalExecutionMode;
+    actionMode: ApprovalActionMode;
     status: ApprovalJobStatus;
     closedBy?: ApprovalActor;
     closedReason?: string;
     /** An ISO timestamp. */
     expiresAt: string;
+    /**
+     * An ISO timestamp: when the current run took the request.
+     *
+     * It is set every time a run starts, so a run that the reconciler starts
+     * again moves it. `attempts` says how many runs there were.
+     */
+    executingSince?: string;
+    /** How many times a run started. A recovery raises it. */
+    attempts: number;
+    /**
+     * What the action reports while it runs. See `ApprovalProgress`.
+     *
+     * It stays on the row after the run, so the record of a finished run says
+     * how many targets it touched and how many refused.
+     */
+    progress?: ApprovalProgress;
     executedAt?: string;
     executionError?: string;
+    /**
+     * What the action reported when it ran.
+     *
+     * The shape belongs to the use case. An action over many targets puts the
+     * result of each target here, which is the difference between "it failed"
+     * and "it did 2998 of 3000, and these two refused".
+     */
+    executionResult?: Record<string, unknown>;
     createdAt: string;
     updatedAt: string;
 }
@@ -73,11 +271,67 @@ export interface ApprovalUseCaseDto {
     type: string;
     /** A short name for a person to read. */
     label: string;
-    requiredAcks: number;
+    /** One sentence: what the action does, and what it cannot undo. */
+    description: string;
+    /** The approvals a new request asks for when the caller names no number. */
+    defaultAcks: number;
+    /**
+     * The floor. A caller can ask for more approvals, never for fewer.
+     *
+     * It is a separate number from `defaultAcks` because the two answer
+     * different questions: the default is what the form offers, and the floor is
+     * what the service refuses to go below.
+     */
+    minAcks: number;
     ttlDays: number;
     executionMode: ApprovalExecutionMode;
-    /** The permission that acknowledge, reject and run all need. */
+    /** See `ApprovalActionMode`. An action over many targets is `background`. */
+    actionMode: ApprovalActionMode;
+    /**
+     * True when a run that was interrupted can start again by itself.
+     *
+     * It is a promise about the ACTION, and the reconciler reads it. Set it only
+     * when the action can run a second time over the same payload and do no harm
+     * twice: it must read what the first run already finished, out of
+     * `ApprovalJobDto.executionResult`, and skip it.
+     *
+     * False, the default, is the safe answer. An interrupted run then lands in
+     * `failed`, which a person can run again from the detail page, and a person
+     * decides whether running it twice is safe.
+     */
+    resumable: boolean;
+    /**
+     * The permission that every request of this use case needs to approve,
+     * reject or run. A payload can add more. See
+     * `ApprovalJobDto.requiredPermissions`, which is the effective set.
+     *
+     * It is also the permission to SEE a request of this use case, because a
+     * person who cannot act on one has no reason to read it. The person who
+     * opened a request always sees that request.
+     */
     requiredPermission: string;
-    /** The permission to open a request. Absent means any signed-in user. */
+    /**
+     * The permission to open a request. Absent means any signed-in Camundi.
+     *
+     * Set it when the pool that can ASK must be as small as the pool that can
+     * approve. Leave it absent when the approvals alone are the guard, and the
+     * proposal is not.
+     */
     createPermission?: string;
+    /** True when a request cannot be opened without a reason. */
+    reasonRequired: boolean;
+    /**
+     * True when the ACTION needs the email address of the person who asked.
+     *
+     * A token can carry no address, and the row then stores
+     * `UNKNOWN_ACTOR_EMAIL`. An action that sends that placeholder to another
+     * service asks it to find a user that does not exist, so the request can
+     * only fail — and it fails at the END, after other people spent their
+     * approvals on it. A use case that carries the creator into its call sets
+     * this, and `canCreate` then refuses such a caller at the start.
+     *
+     * `extend-trial` is one: accounts makes the creator the actor of the
+     * extension, through `onBehalfOf`.
+     */
+    creatorEmailRequired?: boolean;
 }

package/dist/dtos/ApprovalJob.dto.js

@@ -8,7 +8,48 @@ const APPROVAL_JOB_STATUSES = [
   "withdrawn",
   "expired"
 ];
+const APPROVAL_LIVE_STATUSES = [
+  "pending",
+  "approved",
+  "executing"
+];
+const APPROVAL_PAGE_SIZE_DEFAULT = 500;
+const APPROVAL_PAGE_SIZE_MAX = 2e3;
+const APPROVAL_SUMMARY_FIELD_KINDS = [
+  "text",
+  "number",
+  "boolean",
+  "date",
+  "org",
+  "cluster",
+  "user",
+  "code"
+];
+const APPROVAL_RUN_STALE_MS = 12e4;
+function progressFraction(progress) {
+  if (!progress || progress.total <= 0) {
+    return void 0;
+  }
+  return Math.min(1, progress.done / progress.total);
+}
+function isRunStalled(job, now) {
+  if (job.status !== "executing") {
+    return false;
+  }
+  const lastSign = job.progress?.updatedAt ?? job.executingSince;
+  if (!lastSign) {
+    return false;
+  }
+  return now.getTime() - new Date(lastSign).getTime() > APPROVAL_RUN_STALE_MS;
+}
 export {
-  APPROVAL_JOB_STATUSES
+  APPROVAL_JOB_STATUSES,
+  APPROVAL_LIVE_STATUSES,
+  APPROVAL_PAGE_SIZE_DEFAULT,
+  APPROVAL_PAGE_SIZE_MAX,
+  APPROVAL_RUN_STALE_MS,
+  APPROVAL_SUMMARY_FIELD_KINDS,
+  isRunStalled,
+  progressFraction
 };
 //# sourceMappingURL=ApprovalJob.dto.js.map

package/dist/dtos/ApprovalJob.dto.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/dtos/ApprovalJob.dto.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/**\n * The wire types of the generic approval mechanism.\n *\n * This file holds no logic and no dependency, because three consumers read it:\n * control-backend, control-frontend and cloudbot. The rules that read these\n * types are in `../approvals/policy.js`, and they are pure for the same reason.\n */\n\n/**\n * Every state that an approval request can hold.\n *\n * A `const` tuple, not an enum, so it is both the union type and the list that\n * validates a status filter at run time.\n *\n * The path of a request: `pending` until it reaches the threshold. Then\n * `executing` (automatic mode) or `approved` (explicit mode, which waits for a\n * person to press the button). `executed` or `failed` after the action ran. A\n * request that never reaches the threshold ends `rejected`, `withdrawn` or\n * `expired`.\n */\nexport const APPROVAL_JOB_STATUSES = [\n  'pending',\n  'approved',\n  'executing',\n  'executed',\n  'failed',\n  'rejected',\n  'withdrawn',\n  'expired',\n] as const\n\nexport type ApprovalJobStatus = (typeof APPROVAL_JOB_STATUSES)[number]\n\n/**\n * What happens when a request reaches its threshold.\n *\n * `auto` runs the action immediately. `explicit` holds the request at\n * `approved` and waits for a person to run it.\n */\nexport type ApprovalExecutionMode = 'auto' | 'explicit'\n\n/**\n * A person, as an approval request records them.\n *\n * Both keys are kept. The machine then never has to choose one identity key,\n * which is what split the earlier acknowledgement flows: some held an email and\n * some held a user id, and the two could not be compared.\n */\nexport interface ApprovalActor {\n  userId: string\n  email: string\n}\n\nexport interface ApprovalAck extends ApprovalActor {\n  /** An ISO timestamp. It is in a json column, so it is a string, not a Date. */\n  date: string\n}\n\n/** One approval request, as the API returns it. */\nexport interface ApprovalJobDto {\n  id: string\n  type: string\n  dedupeKey?: string\n  payload: Record<string, unknown>\n  createdBy: ApprovalActor\n  acks: ApprovalAck[]\n  /** Copied from the use case, so a reader can render \"1 of 2\". */\n  requiredAcks: number\n  executionMode: ApprovalExecutionMode\n  status: ApprovalJobStatus\n  closedBy?: ApprovalActor\n  closedReason?: string\n  /** An ISO timestamp. */\n  expiresAt: string\n  executedAt?: string\n  executionError?: string\n  createdAt: string\n  updatedAt: string\n}\n\n/**\n * What a use case is, as the API reports it.\n *\n * The frontend needs `requiredPermission` to run the same rule as the backend.\n * PR #9301 kept this registry a second time, by hand, in the frontend. A\n * registry that the server owns means a new use case needs no frontend deploy.\n */\nexport interface ApprovalUseCaseDto {\n  type: string\n  /** A short name for a person to read. */\n  label: string\n  requiredAcks: number\n  ttlDays: number\n  executionMode: ApprovalExecutionMode\n  /** The permission that acknowledge, reject and run all need. */\n  requiredPermission: string\n  /** The permission to open a request. Absent means any signed-in user. */\n  createPermission?: string\n}\n"],
-  "mappings": "AA0BO,MAAM,wBAAwB;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/**\n * The wire types of the generic approval mechanism.\n *\n * This file holds no logic and no dependency, because three consumers read it:\n * control-backend, control-frontend and cloudbot. The rules that read these\n * types are in `../approvals/policy.js`, and they are pure for the same reason.\n */\n\n/**\n * Every state that an approval request can hold.\n *\n * A `const` tuple, not an enum, so it is both the union type and the list that\n * validates a status filter at run time.\n *\n * The path of a request: `pending` until it reaches the threshold. Then\n * `executing` (automatic mode) or `approved` (explicit mode, which waits for a\n * person to press the button). `executed` or `failed` after the action ran. A\n * request that never reaches the threshold ends `rejected`, `withdrawn` or\n * `expired`.\n */\nexport const APPROVAL_JOB_STATUSES = [\n  'pending',\n  'approved',\n  'executing',\n  'executed',\n  'failed',\n  'rejected',\n  'withdrawn',\n  'expired',\n] as const\n\nexport type ApprovalJobStatus = (typeof APPROVAL_JOB_STATUSES)[number]\n\n/**\n * The states in which the action of a request is still COMING.\n *\n * `pending` waits for approvals, `approved` waits for a person to press the\n * button, and `executing` is running now. Each of them can still change the\n * world, so two requests for one target must not be in these states together.\n * `dedupeKey` reads this set for that reason.\n *\n * `failed` is NOT here, although a person can run a failed request again. A\n * failed request runs only when a person presses the button, and that person\n * sees the row. Blocking a new request on a failed one would also trap the\n * key: `canWithdraw` accepts `pending` alone, so nobody could close it.\n *\n * `executed`, `rejected`, `withdrawn` and `expired` are the end of a request.\n */\nexport const APPROVAL_LIVE_STATUSES = [\n  'pending',\n  'approved',\n  'executing',\n] as const satisfies readonly ApprovalJobStatus[]\n\n/**\n * How many requests one page of the list holds when the caller asks for no\n * number.\n *\n * The list is a work queue that a Camundi reads, so the page is large: a\n * person wants the whole queue and not ten rows at a time. What the number is\n * for is the ceiling below.\n */\nexport const APPROVAL_PAGE_SIZE_DEFAULT = 500\n\n/**\n * The largest page that the service builds, and the largest that a caller may\n * ask for. The API answers 400 above it.\n *\n * The list had no limit at all. One authenticated caller could then make the\n * service read the whole table into memory, serialize it, and do it again, so\n * the cost of a request grew with the age of the service and with nothing that\n * the caller had to pay for. A ceiling turns that into a fixed cost.\n *\n * It is HERE and not only in the service, because the view must know it: a\n * page that asked for more would get a 400 instead of rows.\n */\nexport const APPROVAL_PAGE_SIZE_MAX = 2000\n\n/**\n * What happens when a request reaches its threshold.\n *\n * `auto` runs the action immediately. `explicit` holds the request at\n * `approved` and waits for a person to run it.\n */\nexport type ApprovalExecutionMode = 'auto' | 'explicit'\n\n/**\n * WHERE the action runs. It is a separate question from who starts it.\n *\n * - `inline` runs the action inside the call that started it, and the answer\n *   already carries the outcome. Right for one call to another service.\n * - `background` answers as soon as the request is claimed, and the action\n *   runs on. It reports into `ApprovalJobDto.progress`, and the row is the\n *   only place that holds the progress, so a reload and a second person read\n *   the same numbers. A pod that stops loses the run, and the reconciler of\n *   control-backend recovers the row.\n *\n * An action over thousands of targets MUST be `background`. `inline` would\n * hold one HTTP request for the whole run, and the ingress, the load balancer\n * and the browser each have their own deadline before it finishes.\n */\nexport type ApprovalActionMode = 'inline' | 'background'\n\n/**\n * A person, as an approval request records them.\n *\n * Both keys are kept. The machine then never has to choose one identity key,\n * which is what split the earlier acknowledgement flows: some held an email and\n * some held a user id, and the two could not be compared.\n */\nexport interface ApprovalActor {\n  userId: string\n  email: string\n}\n\nexport interface ApprovalAck extends ApprovalActor {\n  /** An ISO timestamp. It is in a json column, so it is a string, not a Date. */\n  date: string\n}\n\n/**\n * What one value of a summary field is.\n *\n * `text` is what a person reads. `id` is what a link points at, and it is\n * absent when the kind names no entity. The two are separate because the text\n * is a COPY that the request keeps: an organization that gets a new name after\n * the request was opened must still read as the organization that the person\n * chose.\n */\nexport interface ApprovalSummaryValue {\n  text: string\n  id?: string\n}\n\n/**\n * How a reader must render one field of a summary.\n *\n * `org`, `cluster` and `user` name an entity, so a reader can link to it and\n * can resolve a fresh name. The others are plain: `date` is an ISO timestamp,\n * and `code` is a value that must keep its characters, such as a json fragment.\n */\nexport const APPROVAL_SUMMARY_FIELD_KINDS = [\n  'text',\n  'number',\n  'boolean',\n  'date',\n  'org',\n  'cluster',\n  'user',\n  'code',\n] as const\n\nexport type ApprovalSummaryFieldKind =\n  (typeof APPROVAL_SUMMARY_FIELD_KINDS)[number]\n\n/**\n * One labelled field of the payload of a request.\n *\n * This is what makes ONE view able to show EVERY use case. The payload of a\n * request is an object of anything, so a generic view can only print it as\n * json. The use case turns it into labelled fields here, and the view renders\n * a field by its kind: it links an `org`, it formats a `date`, and it lists\n * 300 clusters as 300 links.\n *\n * `values` is always an array. A field that holds one value holds an array of\n * one, so a reader needs no branch for \"one or many\".\n */\nexport interface ApprovalSummaryField {\n  label: string\n  kind: ApprovalSummaryFieldKind\n  values: ApprovalSummaryValue[]\n}\n\n/**\n * How long a run may go quiet before a reader calls it stalled.\n *\n * The pod that runs an action writes its progress and renews its lease on one\n * timer, so a healthy run touches the row well inside this window. A row that\n * is `executing` and older than this held a pod that stopped, and the\n * reconciler of control-backend is on its way to it.\n *\n * It lives here, and not in the config of the service, because a READER needs\n * it: the browser must decide what to show without a second call, and a number\n * that only the backend knew would make the two disagree. `ACTION_LEASE_MS` in\n * `config/index.ts` is held below this on purpose.\n */\nexport const APPROVAL_RUN_STALE_MS = 120_000\n\n/**\n * What an action reports while it runs.\n *\n * This is what makes a long action watchable. Every field is in the DATABASE\n * and not in the answer to the call that started the run, so three readers see\n * the same thing: the person who pressed the button, the same person after a\n * reload, and a second person who opens the request.\n *\n * `total` can be 0 while an action counts its targets, and it stays 0 for an\n * action that cannot count them. A reader must then show that it runs, and no\n * percentage.\n */\nexport interface ApprovalProgress {\n  /** Targets in total. 0 means the action did not say. */\n  total: number\n  /** Targets finished, whatever the outcome of each one. */\n  done: number\n  /** Targets that finished with an error. Part of `done`. */\n  failed: number\n  /** One short line for a person, such as the step that runs now. */\n  note?: string\n  /** An ISO timestamp: when the run started. */\n  startedAt: string\n  /** An ISO timestamp: when the run last wrote anything. */\n  updatedAt: string\n}\n\n/** The share of the work that is finished, or `undefined` with no total. */\nexport function progressFraction(\n  progress: ApprovalProgress | undefined,\n): number | undefined {\n  if (!progress || progress.total <= 0) {\n    return undefined\n  }\n  return Math.min(1, progress.done / progress.total)\n}\n\n/**\n * Reports whether a running request went quiet.\n *\n * True means that the pod which held the run stopped, or lost the row. It does\n * NOT mean that the action failed: the reconciler either runs it again, or it\n * writes `failed` so that a person can. See `APPROVAL_RUN_STALE_MS`.\n */\nexport function isRunStalled(job: ApprovalJobDto, now: Date): boolean {\n  if (job.status !== 'executing') {\n    return false\n  }\n  const lastSign = job.progress?.updatedAt ?? job.executingSince\n  if (!lastSign) {\n    return false\n  }\n  return now.getTime() - new Date(lastSign).getTime() > APPROVAL_RUN_STALE_MS\n}\n\n/** One approval request, as the API returns it. */\nexport interface ApprovalJobDto {\n  id: string\n  type: string\n  dedupeKey?: string\n  payload: Record<string, unknown>\n  /**\n   * The payload as labelled fields. See `ApprovalSummaryField`.\n   *\n   * The use case builds it when the request is opened AND every time the\n   * request is read, so a field that a later version of the use case adds\n   * appears on a request that is already open.\n   */\n  summary: ApprovalSummaryField[]\n  /** Why the person opened the request. Some use cases demand one. */\n  reason?: string\n  createdBy: ApprovalActor\n  acks: ApprovalAck[]\n  /**\n   * How many approvals THIS request needs.\n   *\n   * It is on the request and not only on the use case, because the person who\n   * opens one can ask for more than the floor of the use case. A bulk\n   * operation over 3000 clusters is the same action as one over 3, and it can\n   * still deserve a third pair of eyes. `ApprovalUseCaseDto.minAcks` is the\n   * floor that a caller cannot go below.\n   */\n  requiredAcks: number\n  /**\n   * What a person must hold to approve, reject or run THIS request.\n   *\n   * It is on the request and not only on the use case, because a payload can\n   * raise the guard: a generation update with `yoloForceUpdate` needs the yolo\n   * permission on top of the base one, and the same use case without the flag\n   * does not. The set is computed ONE time, when the request is opened, so it\n   * is also the record of what the request was guarded by.\n   *\n   * A person needs EVERY permission in the set, not one of them.\n   */\n  requiredPermissions: string[]\n  executionMode: ApprovalExecutionMode\n  actionMode: ApprovalActionMode\n  status: ApprovalJobStatus\n  closedBy?: ApprovalActor\n  closedReason?: string\n  /** An ISO timestamp. */\n  expiresAt: string\n  /**\n   * An ISO timestamp: when the current run took the request.\n   *\n   * It is set every time a run starts, so a run that the reconciler starts\n   * again moves it. `attempts` says how many runs there were.\n   */\n  executingSince?: string\n  /** How many times a run started. A recovery raises it. */\n  attempts: number\n  /**\n   * What the action reports while it runs. See `ApprovalProgress`.\n   *\n   * It stays on the row after the run, so the record of a finished run says\n   * how many targets it touched and how many refused.\n   */\n  progress?: ApprovalProgress\n  executedAt?: string\n  executionError?: string\n  /**\n   * What the action reported when it ran.\n   *\n   * The shape belongs to the use case. An action over many targets puts the\n   * result of each target here, which is the difference between \"it failed\"\n   * and \"it did 2998 of 3000, and these two refused\".\n   */\n  executionResult?: Record<string, unknown>\n  createdAt: string\n  updatedAt: string\n}\n\n/**\n * What a use case is, as the API reports it.\n *\n * The frontend needs `requiredPermission` to run the same rule as the backend.\n * PR #9301 kept this registry a second time, by hand, in the frontend. A\n * registry that the server owns means a new use case needs no frontend deploy.\n */\nexport interface ApprovalUseCaseDto {\n  type: string\n  /** A short name for a person to read. */\n  label: string\n  /** One sentence: what the action does, and what it cannot undo. */\n  description: string\n  /** The approvals a new request asks for when the caller names no number. */\n  defaultAcks: number\n  /**\n   * The floor. A caller can ask for more approvals, never for fewer.\n   *\n   * It is a separate number from `defaultAcks` because the two answer\n   * different questions: the default is what the form offers, and the floor is\n   * what the service refuses to go below.\n   */\n  minAcks: number\n  ttlDays: number\n  executionMode: ApprovalExecutionMode\n  /** See `ApprovalActionMode`. An action over many targets is `background`. */\n  actionMode: ApprovalActionMode\n  /**\n   * True when a run that was interrupted can start again by itself.\n   *\n   * It is a promise about the ACTION, and the reconciler reads it. Set it only\n   * when the action can run a second time over the same payload and do no harm\n   * twice: it must read what the first run already finished, out of\n   * `ApprovalJobDto.executionResult`, and skip it.\n   *\n   * False, the default, is the safe answer. An interrupted run then lands in\n   * `failed`, which a person can run again from the detail page, and a person\n   * decides whether running it twice is safe.\n   */\n  resumable: boolean\n  /**\n   * The permission that every request of this use case needs to approve,\n   * reject or run. A payload can add more. See\n   * `ApprovalJobDto.requiredPermissions`, which is the effective set.\n   *\n   * It is also the permission to SEE a request of this use case, because a\n   * person who cannot act on one has no reason to read it. The person who\n   * opened a request always sees that request.\n   */\n  requiredPermission: string\n  /**\n   * The permission to open a request. Absent means any signed-in Camundi.\n   *\n   * Set it when the pool that can ASK must be as small as the pool that can\n   * approve. Leave it absent when the approvals alone are the guard, and the\n   * proposal is not.\n   */\n  createPermission?: string\n  /** True when a request cannot be opened without a reason. */\n  reasonRequired: boolean\n  /**\n   * True when the ACTION needs the email address of the person who asked.\n   *\n   * A token can carry no address, and the row then stores\n   * `UNKNOWN_ACTOR_EMAIL`. An action that sends that placeholder to another\n   * service asks it to find a user that does not exist, so the request can\n   * only fail \u2014 and it fails at the END, after other people spent their\n   * approvals on it. A use case that carries the creator into its call sets\n   * this, and `canCreate` then refuses such a caller at the start.\n   *\n   * `extend-trial` is one: accounts makes the creator the actor of the\n   * extension, through `onBehalfOf`.\n   */\n  creatorEmailRequired?: boolean\n}\n"],
+  "mappings": "AA0BO,MAAM,wBAAwB;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAmBO,MAAM,yBAAyB;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AACF;AAUO,MAAM,6BAA6B;AAcnC,MAAM,yBAAyB;AAiE/B,MAAM,+BAA+B;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAoCO,MAAM,wBAAwB;AA8B9B,SAAS,iBACd,UACoB;AACpB,MAAI,CAAC,YAAY,SAAS,SAAS,GAAG;AACpC,WAAO;AAAA,EACT;AACA,SAAO,KAAK,IAAI,GAAG,SAAS,OAAO,SAAS,KAAK;AACnD;AASO,SAAS,aAAa,KAAqB,KAAoB;AACpE,MAAI,IAAI,WAAW,aAAa;AAC9B,WAAO;AAAA,EACT;AACA,QAAM,WAAW,IAAI,UAAU,aAAa,IAAI;AAChD,MAAI,CAAC,UAAU;AACb,WAAO;AAAA,EACT;AACA,SAAO,IAAI,QAAQ,IAAI,IAAI,KAAK,QAAQ,EAAE,QAAQ,IAAI;AACxD;",
   "names": []
 }

package/dist/dtos/ClusterOwnerMove.dto.d.ts

@@ -0,0 +1,81 @@
+/**
+ * What a move of a cluster to another organization did not repair. The move
+ * keeps going when a warning occurs. A Camundi reads the warnings and decides.
+ */
+export interface MoveClusterWarnings {
+    /**
+     * The plan type of the cluster, when the sales plan of the target
+     * organization does not configure it. The cluster keeps running and stays
+     * manageable. That organization cannot create another cluster of this plan
+     * type and cannot duplicate this one, because only a POST route mounts
+     * `validPlanTypeValidator`. `id` supports a search of a support case.
+     * `name` is what the dialog shows.
+     */
+    planTypeNotConfigured?: {
+        id: string;
+        name: string;
+    };
+    /** True when the cluster holds an external IdP configuration. */
+    externalIdp: boolean;
+    /**
+     * The k8s objects of the cluster that carry the organization in a label:
+     * Backup, BackupSchedule, ExternalMonitoring, and PrivateConnectivity
+     * custom resources. The move patches each one's `orgId` label before it
+     * writes the database row for a backup. `failed` lists each object whose
+     * label patch failed, with its kind and name. For a failed Backup, a watch
+     * reconnect can write the old organization into its database row again. A
+     * Camundi must patch a failed label by hand.
+     *
+     * A cluster does not always have every kind of object. A cluster with no
+     * monitoring, or no private connectivity, counts as nothing for that kind,
+     * the same way a cluster with no backup counts as nothing.
+     */
+    orgLabels: {
+        patched: number;
+        failed: {
+            kind: string;
+            name: string;
+            error: string;
+        }[];
+    };
+    alertSubscriptions: {
+        kept: {
+            report: string;
+            target: string;
+        }[];
+        deleted: {
+            target: string;
+        }[];
+        failed: {
+            target: string;
+            error: string;
+        }[];
+        /**
+         * True when console could not read the subscriptions of the cluster. The
+         * three lists are then empty, and empty is not proof that the cluster holds
+         * no subscription. A Camundi must look at the subscriptions by hand.
+         */
+        readFailed: boolean;
+        /**
+         * True when console read the subscriptions but could not read the members
+         * of the target organization, thus it could not check who still belongs to
+         * it. Every subscription is then kept. A person outside the target
+         * organization can still get alerts for this cluster. A Camundi must check
+         * the membership by hand.
+         */
+        membershipCheckFailed: boolean;
+    };
+}
+export interface MoveClusterOwnerResult {
+    clusterId: string;
+    fromOrgId: string;
+    toOrgId: string;
+    warnings: MoveClusterWarnings;
+    /**
+     * True when the cluster already belonged to `toOrgId` before this request.
+     * The request repaired the k8s org labels and the `Backup.orgId` rows, and
+     * it moved nothing else. It ran no guard, no owner write, no audit entry,
+     * and no alert-subscription prune.
+     */
+    ownerUnchanged: boolean;
+}

package/dist/dtos/ClusterOwnerMove.dto.js

@@ -0,0 +1 @@
+//# sourceMappingURL=ClusterOwnerMove.dto.js.map

package/dist/dtos/ClusterOwnerMove.dto.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": [],
+  "sourcesContent": [],
+  "mappings": "",
+  "names": []
+}

package/dist/dtos/FeatureFlags.dto.d.ts

@@ -36,7 +36,7 @@ export interface Features {
     };
     control: {
         frontendTelemetry: boolean;
-        sendToExpiredTrialApproval: boolean;
+        approvals: boolean;
     };
     accounts: {
         moveClusterOrg: boolean;

package/dist/dtos/Generations.dto.d.ts

@@ -10,8 +10,25 @@ export interface GenerationDto {
     updatedBy: string;
     updated: Date;
     isUnsupportedStarting?: Date;
+    /**
+     * Archived generations stay in the database for the cluster audit history,
+     * but nothing offers them: pickers, filter facets, cluster creation and the
+     * upgrade readers all leave them out. Do not treat an archived generation
+     * as a normal upgrade option. The stored upgrade edges are unchanged, so an
+     * explicit upgrade by uuid over an existing edge still runs.
+     */
+    isArchived?: boolean;
     isBespoke?: boolean;
 }
+/**
+ * Drop archived generations from a picker list. Uuids in `keep` stay in the
+ * result even when archived, so a selection made before archiving does not
+ * vanish from the control that shows it.
+ */
+export declare function activeGenerations<T extends {
+    uuid: string;
+    isArchived?: boolean;
+}>(generations: T[], keep?: Iterable<string>): T[];
 export interface GenerationWithClusterCountDto extends GenerationDto {
     clusterCount: number;
 }

package/dist/dtos/Generations.dto.js

@@ -1,5 +1,11 @@
 import semver from "semver";
 import { stripSecfixPostfix } from "../utils/versionCheck.utils.js";
+function activeGenerations(generations, keep = []) {
+  const keepSet = new Set(keep);
+  return generations.filter(
+    (generation) => generation.isArchived !== true || keepSet.has(generation.uuid)
+  );
+}
 const secfixRank = (version) => version === stripSecfixPostfix(version) ? 0 : 1;
 function sortGenerationBySemverOfZeebe(generationA, generationB) {
   const versionAvalid = generationA.versions?.zeebe !== void 0 && semver.valid(generationA.versions.zeebe.split(":")[1]) !== null;
@@ -57,6 +63,7 @@ const compareGenerationNamesNewestFirst = (nameA, nameB) => {
   return suffixB.localeCompare(suffixA, void 0, collation);
 };
 export {
+  activeGenerations,
   compareGenerationNamesNewestFirst,
   sortGenerationBySemverOfZeebe
 };

package/dist/dtos/Generations.dto.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/dtos/Generations.dto.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport semver from 'semver'\nimport type { ZeebeClusterVersionsDto } from '../types/C8ClusterComponentVersions.type.js'\nimport { stripSecfixPostfix } from '../utils/versionCheck.utils.js'\n\nexport interface GenerationDto {\n  name: string\n  uuid: string\n  versions: ZeebeClusterVersionsDto\n  upgradeableFrom: GenerationDto[]\n  createdBy: string\n  createdByName?: string\n  created: Date\n  updatedBy: string\n  updated: Date\n  isUnsupportedStarting?: Date\n  isBespoke?: boolean\n}\n\nexport interface GenerationWithClusterCountDto extends GenerationDto {\n  clusterCount: number\n}\n\nexport interface UpgradableGenerationsDto {\n  preferred: GenerationDto | null\n  options: GenerationDto[]\n}\n\nconst secfixRank = (version: string): number =>\n  version === stripSecfixPostfix(version) ? 0 : 1\n\nexport function sortGenerationBySemverOfZeebe(\n  generationA: { name: string; versions?: { zeebe: string } },\n  generationB: { name: string; versions?: { zeebe: string } },\n) {\n  // magic sorting algorithm\n  // uses the generation version of zeebe for comparison\n  // if version invalid: use localeCompare\n\n  const versionAvalid: boolean =\n    generationA.versions?.zeebe !== undefined &&\n    semver.valid(generationA.versions.zeebe.split(':')[1]) !== null\n  const versionBvalid: boolean =\n    generationB.versions?.zeebe !== undefined &&\n    semver.valid(generationB.versions.zeebe.split(':')[1]) !== null\n\n  if (versionAvalid && versionBvalid) {\n    const zeebeA = generationA.versions!.zeebe.split(':')[1]\n    const zeebeB = generationB.versions!.zeebe.split(':')[1]\n    const byVersion = semver.compare(\n      stripSecfixPostfix(zeebeB),\n      stripSecfixPostfix(zeebeA),\n    )\n    if (byVersion !== 0) {\n      return byVersion\n    }\n    // Both builds carry the same Camunda version here, so only the postfix\n    // separates them. A secfix build holds that version plus a security patch,\n    // thus it is the newer of the two and takes the higher rank.\n    const bySecfix = secfixRank(zeebeB) - secfixRank(zeebeA)\n    if (bySecfix !== 0) {\n      return bySecfix\n    }\n    // Same image on both (8.9+gen5 and 8.9+gen6 both run 8.9.5). The name is\n    // the only order left, so a picker does not show them in input order.\n    return compareGenerationNamesNewestFirst(generationA.name, generationB.name)\n  } else if (versionAvalid) {\n    return -1\n  } else if (versionBvalid) {\n    return 1\n  } else {\n    return compareGenerationNamesNewestFirst(generationA.name, generationB.name)\n  }\n}\n\n/** The text before the first digit: \"Camunda \" for \"Camunda 8.9+gen20\". */\nconst productPrefix = (name: string): string => {\n  const firstDigit = name.search(/\\d/)\n  return firstDigit === -1 ? name : name.slice(0, firstDigit)\n}\n\n/**\n * Splits a name at the first dash after the version: \"Camunda 8.10.0-alpha1\"\n * gives [\"Camunda 8.10.0\", \"alpha1\"]. A name without a dash gives an empty\n * suffix.\n */\nconst splitPrerelease = (name: string): [base: string, suffix: string] => {\n  const dash = name.indexOf('-', name.search(/\\d/))\n  return dash === -1 ? [name, ''] : [name.slice(0, dash), name.slice(dash + 1)]\n}\n\n/**\n * Orders generation names by product, then newest first within a product, by\n * numeric collation: `8.10` comes before `8.9`, and `gen10` before `gen9`.\n * Products stay in alphabetic order, so the Camunda generations come before\n * the older Zeebe ones. A release comes before its prereleases, so\n * `8.10.0` is above `8.10.0-alpha1`. For a list that has no zeebe image to\n * compare, such as a filter facet. When the image is known, use\n * `sortGenerationBySemverOfZeebe`.\n */\nexport const compareGenerationNamesNewestFirst = (\n  nameA: string,\n  nameB: string,\n): number => {\n  const collation = { numeric: true, sensitivity: 'base' } as const\n  const byProduct = productPrefix(nameA).localeCompare(\n    productPrefix(nameB),\n    undefined,\n    collation,\n  )\n  if (byProduct !== 0) {\n    return byProduct\n  }\n  const [baseA, suffixA] = splitPrerelease(nameA)\n  const [baseB, suffixB] = splitPrerelease(nameB)\n  const byBase = baseB.localeCompare(baseA, undefined, collation)\n  if (byBase !== 0) {\n    return byBase\n  }\n  if (suffixA === '' || suffixB === '') {\n    return suffixA === suffixB ? 0 : suffixA === '' ? -1 : 1\n  }\n  return suffixB.localeCompare(suffixA, undefined, collation)\n}\n"],
-  "mappings": "AAMA,OAAO,YAAY;AAEnB,SAAS,0BAA0B;AAyBnC,MAAM,aAAa,CAAC,YAClB,YAAY,mBAAmB,OAAO,IAAI,IAAI;AAEzC,SAAS,8BACd,aACA,aACA;AAKA,QAAM,gBACJ,YAAY,UAAU,UAAU,UAChC,OAAO,MAAM,YAAY,SAAS,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,MAAM;AAC7D,QAAM,gBACJ,YAAY,UAAU,UAAU,UAChC,OAAO,MAAM,YAAY,SAAS,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,MAAM;AAE7D,MAAI,iBAAiB,eAAe;AAClC,UAAM,SAAS,YAAY,SAAU,MAAM,MAAM,GAAG,EAAE,CAAC;AACvD,UAAM,SAAS,YAAY,SAAU,MAAM,MAAM,GAAG,EAAE,CAAC;AACvD,UAAM,YAAY,OAAO;AAAA,MACvB,mBAAmB,MAAM;AAAA,MACzB,mBAAmB,MAAM;AAAA,IAC3B;AACA,QAAI,cAAc,GAAG;AACnB,aAAO;AAAA,IACT;AAIA,UAAM,WAAW,WAAW,MAAM,IAAI,WAAW,MAAM;AACvD,QAAI,aAAa,GAAG;AAClB,aAAO;AAAA,IACT;AAGA,WAAO,kCAAkC,YAAY,MAAM,YAAY,IAAI;AAAA,EAC7E,WAAW,eAAe;AACxB,WAAO;AAAA,EACT,WAAW,eAAe;AACxB,WAAO;AAAA,EACT,OAAO;AACL,WAAO,kCAAkC,YAAY,MAAM,YAAY,IAAI;AAAA,EAC7E;AACF;AAGA,MAAM,gBAAgB,CAAC,SAAyB;AAC9C,QAAM,aAAa,KAAK,OAAO,IAAI;AACnC,SAAO,eAAe,KAAK,OAAO,KAAK,MAAM,GAAG,UAAU;AAC5D;AAOA,MAAM,kBAAkB,CAAC,SAAiD;AACxE,QAAM,OAAO,KAAK,QAAQ,KAAK,KAAK,OAAO,IAAI,CAAC;AAChD,SAAO,SAAS,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,MAAM,GAAG,IAAI,GAAG,KAAK,MAAM,OAAO,CAAC,CAAC;AAC9E;AAWO,MAAM,oCAAoC,CAC/C,OACA,UACW;AACX,QAAM,YAAY,EAAE,SAAS,MAAM,aAAa,OAAO;AACvD,QAAM,YAAY,cAAc,KAAK,EAAE;AAAA,IACrC,cAAc,KAAK;AAAA,IACnB;AAAA,IACA;AAAA,EACF;AACA,MAAI,cAAc,GAAG;AACnB,WAAO;AAAA,EACT;AACA,QAAM,CAAC,OAAO,OAAO,IAAI,gBAAgB,KAAK;AAC9C,QAAM,CAAC,OAAO,OAAO,IAAI,gBAAgB,KAAK;AAC9C,QAAM,SAAS,MAAM,cAAc,OAAO,QAAW,SAAS;AAC9D,MAAI,WAAW,GAAG;AAChB,WAAO;AAAA,EACT;AACA,MAAI,YAAY,MAAM,YAAY,IAAI;AACpC,WAAO,YAAY,UAAU,IAAI,YAAY,KAAK,KAAK;AAAA,EACzD;AACA,SAAO,QAAQ,cAAc,SAAS,QAAW,SAAS;AAC5D;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport semver from 'semver'\nimport type { ZeebeClusterVersionsDto } from '../types/C8ClusterComponentVersions.type.js'\nimport { stripSecfixPostfix } from '../utils/versionCheck.utils.js'\n\nexport interface GenerationDto {\n  name: string\n  uuid: string\n  versions: ZeebeClusterVersionsDto\n  upgradeableFrom: GenerationDto[]\n  createdBy: string\n  createdByName?: string\n  created: Date\n  updatedBy: string\n  updated: Date\n  isUnsupportedStarting?: Date\n  /**\n   * Archived generations stay in the database for the cluster audit history,\n   * but nothing offers them: pickers, filter facets, cluster creation and the\n   * upgrade readers all leave them out. Do not treat an archived generation\n   * as a normal upgrade option. The stored upgrade edges are unchanged, so an\n   * explicit upgrade by uuid over an existing edge still runs.\n   */\n  isArchived?: boolean\n  isBespoke?: boolean\n}\n\n/**\n * Drop archived generations from a picker list. Uuids in `keep` stay in the\n * result even when archived, so a selection made before archiving does not\n * vanish from the control that shows it.\n */\nexport function activeGenerations<\n  T extends { uuid: string; isArchived?: boolean },\n>(generations: T[], keep: Iterable<string> = []): T[] {\n  const keepSet = new Set(keep)\n  return generations.filter(\n    (generation) =>\n      generation.isArchived !== true || keepSet.has(generation.uuid),\n  )\n}\n\nexport interface GenerationWithClusterCountDto extends GenerationDto {\n  clusterCount: number\n}\n\nexport interface UpgradableGenerationsDto {\n  preferred: GenerationDto | null\n  options: GenerationDto[]\n}\n\nconst secfixRank = (version: string): number =>\n  version === stripSecfixPostfix(version) ? 0 : 1\n\nexport function sortGenerationBySemverOfZeebe(\n  generationA: { name: string; versions?: { zeebe: string } },\n  generationB: { name: string; versions?: { zeebe: string } },\n) {\n  // magic sorting algorithm\n  // uses the generation version of zeebe for comparison\n  // if version invalid: use localeCompare\n\n  const versionAvalid: boolean =\n    generationA.versions?.zeebe !== undefined &&\n    semver.valid(generationA.versions.zeebe.split(':')[1]) !== null\n  const versionBvalid: boolean =\n    generationB.versions?.zeebe !== undefined &&\n    semver.valid(generationB.versions.zeebe.split(':')[1]) !== null\n\n  if (versionAvalid && versionBvalid) {\n    const zeebeA = generationA.versions!.zeebe.split(':')[1]\n    const zeebeB = generationB.versions!.zeebe.split(':')[1]\n    const byVersion = semver.compare(\n      stripSecfixPostfix(zeebeB),\n      stripSecfixPostfix(zeebeA),\n    )\n    if (byVersion !== 0) {\n      return byVersion\n    }\n    // Both builds carry the same Camunda version here, so only the postfix\n    // separates them. A secfix build holds that version plus a security patch,\n    // thus it is the newer of the two and takes the higher rank.\n    const bySecfix = secfixRank(zeebeB) - secfixRank(zeebeA)\n    if (bySecfix !== 0) {\n      return bySecfix\n    }\n    // Same image on both (8.9+gen5 and 8.9+gen6 both run 8.9.5). The name is\n    // the only order left, so a picker does not show them in input order.\n    return compareGenerationNamesNewestFirst(generationA.name, generationB.name)\n  } else if (versionAvalid) {\n    return -1\n  } else if (versionBvalid) {\n    return 1\n  } else {\n    return compareGenerationNamesNewestFirst(generationA.name, generationB.name)\n  }\n}\n\n/** The text before the first digit: \"Camunda \" for \"Camunda 8.9+gen20\". */\nconst productPrefix = (name: string): string => {\n  const firstDigit = name.search(/\\d/)\n  return firstDigit === -1 ? name : name.slice(0, firstDigit)\n}\n\n/**\n * Splits a name at the first dash after the version: \"Camunda 8.10.0-alpha1\"\n * gives [\"Camunda 8.10.0\", \"alpha1\"]. A name without a dash gives an empty\n * suffix.\n */\nconst splitPrerelease = (name: string): [base: string, suffix: string] => {\n  const dash = name.indexOf('-', name.search(/\\d/))\n  return dash === -1 ? [name, ''] : [name.slice(0, dash), name.slice(dash + 1)]\n}\n\n/**\n * Orders generation names by product, then newest first within a product, by\n * numeric collation: `8.10` comes before `8.9`, and `gen10` before `gen9`.\n * Products stay in alphabetic order, so the Camunda generations come before\n * the older Zeebe ones. A release comes before its prereleases, so\n * `8.10.0` is above `8.10.0-alpha1`. For a list that has no zeebe image to\n * compare, such as a filter facet. When the image is known, use\n * `sortGenerationBySemverOfZeebe`.\n */\nexport const compareGenerationNamesNewestFirst = (\n  nameA: string,\n  nameB: string,\n): number => {\n  const collation = { numeric: true, sensitivity: 'base' } as const\n  const byProduct = productPrefix(nameA).localeCompare(\n    productPrefix(nameB),\n    undefined,\n    collation,\n  )\n  if (byProduct !== 0) {\n    return byProduct\n  }\n  const [baseA, suffixA] = splitPrerelease(nameA)\n  const [baseB, suffixB] = splitPrerelease(nameB)\n  const byBase = baseB.localeCompare(baseA, undefined, collation)\n  if (byBase !== 0) {\n    return byBase\n  }\n  if (suffixA === '' || suffixB === '') {\n    return suffixA === suffixB ? 0 : suffixA === '' ? -1 : 1\n  }\n  return suffixB.localeCompare(suffixA, undefined, collation)\n}\n"],
+  "mappings": "AAMA,OAAO,YAAY;AAEnB,SAAS,0BAA0B;AA6B5B,SAAS,kBAEd,aAAkB,OAAyB,CAAC,GAAQ;AACpD,QAAM,UAAU,IAAI,IAAI,IAAI;AAC5B,SAAO,YAAY;AAAA,IACjB,CAAC,eACC,WAAW,eAAe,QAAQ,QAAQ,IAAI,WAAW,IAAI;AAAA,EACjE;AACF;AAWA,MAAM,aAAa,CAAC,YAClB,YAAY,mBAAmB,OAAO,IAAI,IAAI;AAEzC,SAAS,8BACd,aACA,aACA;AAKA,QAAM,gBACJ,YAAY,UAAU,UAAU,UAChC,OAAO,MAAM,YAAY,SAAS,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,MAAM;AAC7D,QAAM,gBACJ,YAAY,UAAU,UAAU,UAChC,OAAO,MAAM,YAAY,SAAS,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,MAAM;AAE7D,MAAI,iBAAiB,eAAe;AAClC,UAAM,SAAS,YAAY,SAAU,MAAM,MAAM,GAAG,EAAE,CAAC;AACvD,UAAM,SAAS,YAAY,SAAU,MAAM,MAAM,GAAG,EAAE,CAAC;AACvD,UAAM,YAAY,OAAO;AAAA,MACvB,mBAAmB,MAAM;AAAA,MACzB,mBAAmB,MAAM;AAAA,IAC3B;AACA,QAAI,cAAc,GAAG;AACnB,aAAO;AAAA,IACT;AAIA,UAAM,WAAW,WAAW,MAAM,IAAI,WAAW,MAAM;AACvD,QAAI,aAAa,GAAG;AAClB,aAAO;AAAA,IACT;AAGA,WAAO,kCAAkC,YAAY,MAAM,YAAY,IAAI;AAAA,EAC7E,WAAW,eAAe;AACxB,WAAO;AAAA,EACT,WAAW,eAAe;AACxB,WAAO;AAAA,EACT,OAAO;AACL,WAAO,kCAAkC,YAAY,MAAM,YAAY,IAAI;AAAA,EAC7E;AACF;AAGA,MAAM,gBAAgB,CAAC,SAAyB;AAC9C,QAAM,aAAa,KAAK,OAAO,IAAI;AACnC,SAAO,eAAe,KAAK,OAAO,KAAK,MAAM,GAAG,UAAU;AAC5D;AAOA,MAAM,kBAAkB,CAAC,SAAiD;AACxE,QAAM,OAAO,KAAK,QAAQ,KAAK,KAAK,OAAO,IAAI,CAAC;AAChD,SAAO,SAAS,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,MAAM,GAAG,IAAI,GAAG,KAAK,MAAM,OAAO,CAAC,CAAC;AAC9E;AAWO,MAAM,oCAAoC,CAC/C,OACA,UACW;AACX,QAAM,YAAY,EAAE,SAAS,MAAM,aAAa,OAAO;AACvD,QAAM,YAAY,cAAc,KAAK,EAAE;AAAA,IACrC,cAAc,KAAK;AAAA,IACnB;AAAA,IACA;AAAA,EACF;AACA,MAAI,cAAc,GAAG;AACnB,WAAO;AAAA,EACT;AACA,QAAM,CAAC,OAAO,OAAO,IAAI,gBAAgB,KAAK;AAC9C,QAAM,CAAC,OAAO,OAAO,IAAI,gBAAgB,KAAK;AAC9C,QAAM,SAAS,MAAM,cAAc,OAAO,QAAW,SAAS;AAC9D,MAAI,WAAW,GAAG;AAChB,WAAO;AAAA,EACT;AACA,MAAI,YAAY,MAAM,YAAY,IAAI;AACpC,WAAO,YAAY,UAAU,IAAI,YAAY,KAAK,KAAK;AAAA,EACzD;AACA,SAAO,QAAQ,cAAc,SAAS,QAAW,SAAS;AAC5D;",
   "names": []
 }

package/dist/dtos/Generations.dto.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/dtos/ReleaseTrainSanity.dto.d.ts

@@ -22,6 +22,12 @@ export type SanityFix = {
     generationName: string;
     /** When set, the delete must not be offered as selectable (e.g. clusters still run it). */
     blockedReason?: string;
+} | {
+    type: 'archive-generation';
+    generationUuid: string;
+    generationName: string;
+    /** When set, the archive must not be offered as selectable (e.g. it is still an upgrade target). */
+    blockedReason?: string;
 };
 export interface SanityViolation {
     ruleId: string;

package/dist/enums/SystemAuditEntity.enum.d.ts

@@ -27,6 +27,7 @@ export declare enum SystemAuditEntityAttribute {
     GENERATION_UPGRADEABLE_TO = "Upgradeable To",
     GENERATION_SUPPORTED_UNTIL = "Supported Until",
     GENERATION_BESPOKE = "Bespoke",
+    GENERATION_ARCHIVED = "Archived",
     CHANNEL_NAME = "Name",
     CHANNEL_DESCRIPTION = "Description",
     CHANNEL_DEFAULT_GENERATION = "Default Generation",

package/dist/enums/SystemAuditEntity.enum.js

@@ -21,6 +21,7 @@ var SystemAuditEntityAttribute = /* @__PURE__ */ ((SystemAuditEntityAttribute2)
   SystemAuditEntityAttribute2["GENERATION_UPGRADEABLE_TO"] = "Upgradeable To";
   SystemAuditEntityAttribute2["GENERATION_SUPPORTED_UNTIL"] = "Supported Until";
   SystemAuditEntityAttribute2["GENERATION_BESPOKE"] = "Bespoke";
+  SystemAuditEntityAttribute2["GENERATION_ARCHIVED"] = "Archived";
   SystemAuditEntityAttribute2["CHANNEL_NAME"] = "Name";
   SystemAuditEntityAttribute2["CHANNEL_DESCRIPTION"] = "Description";
   SystemAuditEntityAttribute2["CHANNEL_DEFAULT_GENERATION"] = "Default Generation";