@camunda/ccma-shared-types 2.0.0 → 4.0.0

package/dist/permissions/combo.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/permissions/combo.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { AccountsPermissions } from './accounts.permissions.js'\nimport { AuditLoggerPermissions } from './auditlogger.permissions.js'\nimport { ConsolePermissions } from './console.permissions.js'\nimport { NotificationPermissions } from './notification.permissions.js'\n\nexport function accountsUserFeaturesFromPermissions(permissions: string[]) {\n  const newFeatures: AccountsPermissions.Features = {\n    admin: {\n      readAll: permissions.includes(AccountsPermissions.READ_ALL),\n      createOrg: permissions.includes(AccountsPermissions.CREATE_ORG),\n      changeOrgName: permissions.includes(AccountsPermissions.CHANGE_ORG_NAME),\n\n      deleteOrg: permissions.includes(AccountsPermissions.DELETE_ORG),\n      resetTokenVerification: permissions.includes(\n        AccountsPermissions.RESET_TOKEN_VERIFICATION,\n      ),\n      deleteUser: permissions.includes(AccountsPermissions.DELETE_USER),\n      deleteNotActivatedUser: permissions.includes(\n        AccountsPermissions.DELETE_NOT_ACTIVATED_USER,\n      ),\n      addToOrg: permissions.includes(AccountsPermissions.ADD_TO_ORG),\n      removeFromOrg: permissions.includes(AccountsPermissions.REMOVE_FROM_ORG),\n      setDefaultOrg: permissions.includes(AccountsPermissions.SET_DEFAULT_ORG),\n      cancelInvite: permissions.includes(AccountsPermissions.CANCEL_INVITE),\n      changeRole: permissions.includes(AccountsPermissions.CHANGE_ROLE),\n      addSafeRole: permissions.includes(AccountsPermissions.CHANGE_SAFE_ROLE),\n      deleteClusters: permissions.includes(\n        ConsolePermissions.CLUSTERS_DELETE_CLUSTER,\n      ),\n      extendTrial: permissions.includes(AccountsPermissions.EXTEND_TRIAL),\n      invalidateToken: permissions.includes(\n        AccountsPermissions.INVALIDATE_TOKEN,\n      ),\n      cancelPaid: permissions.includes(AccountsPermissions.ORG_CANCEL_PAID),\n      searchForOrgs: permissions.includes(\n        ConsolePermissions.CLUSTER_PLAN_SEE_ALL,\n      ),\n      readAudit: permissions.includes(AuditLoggerPermissions.READ),\n      modifyClusterPlanTypeReservations: permissions.includes(\n        AccountsPermissions.MODIFY_CLUSTER_PLAN_TYPE_RESERVATIONS,\n      ),\n      mayChangeOrgLimits: permissions.includes(\n        AccountsPermissions.ORG_MAY_CHANGE_LIMITS,\n      ),\n      mayChangeGenerationWhiteList: permissions.includes(\n        AccountsPermissions.ORG_MAY_CHANGE_GENERATION_WHITELIST,\n      ),\n      sql: permissions.includes(AccountsPermissions.ADMIN_SQL),\n      modelerDeleteUser: permissions.includes(\n        AccountsPermissions.MODELER_DELETE_USER,\n      ),\n      unblockUser: permissions.includes(AccountsPermissions.UNBLOCK_USER),\n      god: {\n        triggerCrons: permissions.includes(AccountsPermissions.GOD_CRON),\n        forceSalesPlanOnOrg: permissions.includes(\n          AccountsPermissions.FORCE_SALES_PLAN_ON_ORG,\n        ),\n        changeSignupSpamPatterns: permissions.includes(\n          AccountsPermissions.GOD_SIGNUP_SPAM_PATTERNS,\n        ),\n        purgeUsers: permissions.includes(AccountsPermissions.GOD_PURGE_USERS),\n        updateUserMetadata: permissions.includes(\n          AccountsPermissions.GOD_UPDATE_USER_METADATA,\n        ),\n      },\n      bot: permissions.includes(AccountsPermissions.BOT),\n      changeEmail: permissions.includes(AccountsPermissions.ADMIN_CHANGE_EMAIL),\n      changeUserName: permissions.includes(\n        AccountsPermissions.ADMIN_CHANGE_USER_NAME,\n      ),\n    },\n    salesPlan: {\n      create: permissions.includes(AccountsPermissions.SALES_PLAN_CREATE),\n      modify: permissions.includes(AccountsPermissions.SALES_PLAN_MODIFY),\n      forceModify: permissions.includes(\n        AccountsPermissions.SALES_PLAN_FORCE_MODIFY,\n      ),\n      switch: permissions.includes(AccountsPermissions.SALES_PLAN_SWITCH),\n      delete: permissions.includes(AccountsPermissions.SALES_PLAN_DELETE),\n      godDelete: permissions.includes(\n        AccountsPermissions.SALES_PLAN_DELETE_AS_GOD,\n      ),\n    },\n    enterprise: {\n      org: {\n        convert: permissions.includes(\n          AccountsPermissions.ENTERPRISE_ORG_CONVERT,\n        ),\n        modify: permissions.includes(AccountsPermissions.ENTERPRISE_ORG_MODIFY),\n        modifyStartDate: permissions.includes(\n          AccountsPermissions.ENTERPRISE_ORG_MODIFY_START_DATE,\n        ),\n      },\n    },\n    trial: {\n      convertToInNegotiation: permissions.includes(\n        AccountsPermissions.TRIAL_TO_IN_NEGOTIATION_CONVERT,\n      ),\n    },\n    supportAgent: {\n      removeAgentsFromOrg: permissions.includes(\n        AccountsPermissions.SUPPORT_AGENT_REMOVE_AGENTS_FROM_ORG,\n      ),\n      seeOrgMemberships: permissions.includes(\n        AccountsPermissions.SUPPORT_AGENT_SEE_ORG_MEMBERSHIPS,\n      ),\n      addAgentsToOrg: permissions.includes(\n        AccountsPermissions.SUPPORT_AGENT_ADD_TO_ORG,\n      ),\n    },\n    m2m: {\n      salesplan: {\n        get: permissions.includes(AccountsPermissions.M2M_SALESPLAN_GET),\n        switch: permissions.includes(AccountsPermissions.M2M_SALESPLAN_SWITCH),\n      },\n      fetchMigrationData: permissions.includes(\n        ConsolePermissions.M2M_FETCH_MIGRATION_DATA,\n      ),\n    },\n    externalM2m: {\n      org: {\n        members: {\n          get: permissions.includes(\n            AccountsPermissions.EXTERNAL_M2M_GET_ORG_MEMBERS,\n          ),\n        },\n        search: permissions.includes(\n          AccountsPermissions.EXTERNAL_M2M_SEARCH_ORGS,\n        ),\n      },\n      // eslint-disable-next-line id-length\n      qa: {\n        org: {\n          create: permissions.includes(\n            AccountsPermissions.EXTERNAL_M2M_QA_ORG_CREATE,\n          ),\n        },\n      },\n      offboarding: {\n        camundi: permissions.includes(\n          AccountsPermissions.EXTERNAL_M2M_OFFBOARD_CAMUNDI,\n        ),\n      },\n    },\n    auth0: {\n      connections: {\n        create: permissions.includes(\n          AccountsPermissions.ADMIN_AUTH0_CONNECTIONS_CREATE,\n        ),\n        read: permissions.includes(\n          AccountsPermissions.ADMIN_AUTH0_CONNECTIONS_READ,\n        ),\n        update: permissions.includes(\n          AccountsPermissions.ADMIN_AUTH0_CONNECTIONS_UPDATE,\n        ),\n        delete: permissions.includes(\n          AccountsPermissions.ADMIN_AUTH0_CONNECTIONS_DELETE,\n        ),\n      },\n    },\n    notifications: {\n      global: {\n        read: permissions.includes(NotificationPermissions.READ_GLOBAL),\n        delete: permissions.includes(NotificationPermissions.DELETE_GLOBAL),\n        create: permissions.includes(NotificationPermissions.CREATE_GLOBAL),\n      },\n    },\n    earlyAccessFeatures: {\n      read: permissions.includes(\n        AccountsPermissions.ADMIN_EARLY_ACCESS_FEATURES_READ,\n      ),\n      create: permissions.includes(\n        AccountsPermissions.ADMIN_EARLY_ACCESS_FEATURES_CREATE,\n      ),\n      delete: permissions.includes(\n        AccountsPermissions.ADMIN_EARLY_ACCESS_FEATURES_DELETE,\n      ),\n      update: permissions.includes(\n        AccountsPermissions.ADMIN_EARLY_ACCESS_FEATURES_UPDATE,\n      ),\n    },\n    pdfWatermark: {\n      read: permissions.includes(AccountsPermissions.PDF_WATERMARK_READ),\n      write: permissions.includes(AccountsPermissions.PDF_WATERMARK_WRITE),\n    },\n  }\n  return newFeatures\n}\n\nexport function consoleUserFeaturesFromPermissions(permissions: string[]) {\n  const newFeatures: ConsolePermissions.Features = {\n    apiClient: {\n      read: permissions.includes(ConsolePermissions.APICLIENT_READ),\n      delete: permissions.includes(ConsolePermissions.APICLIENT_DELETE),\n    },\n    multiCluster: {\n      admin: permissions.includes(ConsolePermissions.MULTICLUSTER_ADMIN),\n    },\n    multiGen: {\n      admin: {\n        see: permissions.includes(\n          ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN_SEE,\n        ),\n        modify: permissions.includes(\n          ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN,\n        ),\n        patchExistingChannel: permissions.includes(\n          ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN_PATCH_EXISTING_CHANNEL,\n        ),\n        migrate: permissions.includes(\n          ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN_MIGRATE,\n        ),\n        deleteAllClustersOfGeneration: permissions.includes(\n          ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN_DELETE_ALL_CLUSTERS,\n        ),\n      },\n      releaseTrain: {\n        publish: permissions.includes(ConsolePermissions.RELEASE_TRAIN_PUBLISH),\n      },\n    },\n    clusters: {\n      canReadAllClusterInfo: permissions.includes(\n        ConsolePermissions.CLUSTERS_READALLCLUSTERINFO,\n      ),\n      canDeleteAllClusters: permissions.includes(\n        ConsolePermissions.CLUSTERS_DELETE_CLUSTER,\n      ),\n      canMoveToOtherOrg: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_MOVE_TO_OTHER_ORG,\n      ),\n      createOnBehalf: permissions.includes(\n        ConsolePermissions.CLUSTER_CREATE_ON_BEHALF,\n      ),\n      canSendToSleep: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_SEND_TO_SLEEP,\n      ),\n      canCreateInternalBackup: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_CREATE_INTERNAL_BACKUP,\n      ),\n      canUpdateClusterPlanType: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_UPDATE_CLUSTERPLANTYPE,\n      ),\n      canOverrideEnvVars: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_OVERRIDE_ENV_VARS,\n      ),\n      canCreateModificationConfig: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_CREATE_MODIFICATION_CONFIG,\n      ),\n      canUpgradeGeneration: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_UPDATE_GENERATION,\n      ),\n      canUpgradeGenerationYolo: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_UPDATE_GENERATION_YOLO,\n      ),\n      canUpdateOptionalTelemetry: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_UPDATE_OPTIONAL_TELEMETRY,\n      ),\n    },\n    clusterPlan: {\n      seeAll: permissions.includes(ConsolePermissions.CLUSTER_PLAN_SEE_ALL),\n      create: permissions.includes(ConsolePermissions.CLUSTER_PLAN_CREATE),\n      delete: permissions.includes(ConsolePermissions.CLUSTER_PLAN_DELETE),\n      type: {\n        create: permissions.includes(\n          ConsolePermissions.CLUSTER_PLAN_TYPE_CREATE,\n        ),\n        modify: permissions.includes(\n          ConsolePermissions.CLUSTER_PLAN_TYPE_MODIFY,\n        ),\n        delete: permissions.includes(\n          ConsolePermissions.CLUSTER_PLAN_TYPE_DELETE,\n        ),\n        forceDelete: permissions.includes(\n          ConsolePermissions.CLUSTER_PLAN_TYPE_FORCE_DELETE,\n        ),\n      },\n      migrate: permissions.includes(ConsolePermissions.CLUSTER_PLAN_MIGRATE),\n      deleteAllClustersOfPlan: permissions.includes(\n        ConsolePermissions.CLUSTER_PLAN_CAN_DELETE_ALL_CLUSTERS_OF_PLAN,\n      ),\n      modify: permissions.includes(ConsolePermissions.CLUSTER_PLAN_CAN_MODIFY),\n    },\n    features: {\n      newHome: permissions.includes(ConsolePermissions.FEATURE_NEW_HOME),\n      templatePicker: permissions.includes(\n        ConsolePermissions.FEATURE_TEMPLATE_PICKER,\n      ),\n      userSettings: permissions.includes(ConsolePermissions.USER_SETTINGS),\n      debug: permissions.includes(ConsolePermissions.DEBUG),\n    },\n    m2m: {\n      updateCrd: permissions.includes(ConsolePermissions.M2M_UPDATE_CRD),\n      signup: permissions.includes(ConsolePermissions.M2M_SIGNUP),\n      triggerAlert: permissions.includes(ConsolePermissions.M2M_TRIGGER_ALERT),\n      deleteOrgClusters: permissions.includes(\n        ConsolePermissions.M2M_DELETE_ORG_CLUSTERS,\n      ),\n      updateOrgClusters: permissions.includes(\n        ConsolePermissions.M2M_UPDATE_ORG_CLUSTERS,\n      ),\n      addUsageMetrics: permissions.includes(\n        ConsolePermissions.M2M_ADD_CLUSTER_USAGE_METRICS,\n      ),\n      sendSseEvent: permissions.includes(ConsolePermissions.M2M_SEND_SSE_EVENT),\n      external: {\n        internalClient: permissions.includes(\n          ConsolePermissions.M2M_EXTERNAL_INTERNAL_CLIENT,\n        ),\n      },\n      fetchMigrationData: permissions.includes(\n        ConsolePermissions.M2M_FETCH_MIGRATION_DATA,\n      ),\n      manageGenerationUpgradePath: permissions.includes(\n        ConsolePermissions.M2M_MANAGE_GENERATION_UPGRADE_PATH,\n      ),\n    },\n  }\n  return newFeatures\n}\n"],
-  "mappings": "AAMA,SAAS,2BAA2B;AACpC,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,+BAA+B;AAEjC,SAAS,oCAAoC,aAAuB;AACzE,QAAM,cAA4C;AAAA,IAChD,OAAO;AAAA,MACL,SAAS,YAAY,SAAS,oBAAoB,QAAQ;AAAA,MAC1D,WAAW,YAAY,SAAS,oBAAoB,UAAU;AAAA,MAC9D,eAAe,YAAY,SAAS,oBAAoB,eAAe;AAAA,MAEvE,WAAW,YAAY,SAAS,oBAAoB,UAAU;AAAA,MAC9D,wBAAwB,YAAY;AAAA,QAClC,oBAAoB;AAAA,MACtB;AAAA,MACA,YAAY,YAAY,SAAS,oBAAoB,WAAW;AAAA,MAChE,wBAAwB,YAAY;AAAA,QAClC,oBAAoB;AAAA,MACtB;AAAA,MACA,UAAU,YAAY,SAAS,oBAAoB,UAAU;AAAA,MAC7D,eAAe,YAAY,SAAS,oBAAoB,eAAe;AAAA,MACvE,eAAe,YAAY,SAAS,oBAAoB,eAAe;AAAA,MACvE,cAAc,YAAY,SAAS,oBAAoB,aAAa;AAAA,MACpE,YAAY,YAAY,SAAS,oBAAoB,WAAW;AAAA,MAChE,aAAa,YAAY,SAAS,oBAAoB,gBAAgB;AAAA,MACtE,gBAAgB,YAAY;AAAA,QAC1B,mBAAmB;AAAA,MACrB;AAAA,MACA,aAAa,YAAY,SAAS,oBAAoB,YAAY;AAAA,MAClE,iBAAiB,YAAY;AAAA,QAC3B,oBAAoB;AAAA,MACtB;AAAA,MACA,YAAY,YAAY,SAAS,oBAAoB,eAAe;AAAA,MACpE,eAAe,YAAY;AAAA,QACzB,mBAAmB;AAAA,MACrB;AAAA,MACA,WAAW,YAAY,SAAS,uBAAuB,IAAI;AAAA,MAC3D,mCAAmC,YAAY;AAAA,QAC7C,oBAAoB;AAAA,MACtB;AAAA,MACA,oBAAoB,YAAY;AAAA,QAC9B,oBAAoB;AAAA,MACtB;AAAA,MACA,8BAA8B,YAAY;AAAA,QACxC,oBAAoB;AAAA,MACtB;AAAA,MACA,KAAK,YAAY,SAAS,oBAAoB,SAAS;AAAA,MACvD,mBAAmB,YAAY;AAAA,QAC7B,oBAAoB;AAAA,MACtB;AAAA,MACA,aAAa,YAAY,SAAS,oBAAoB,YAAY;AAAA,MAClE,KAAK;AAAA,QACH,cAAc,YAAY,SAAS,oBAAoB,QAAQ;AAAA,QAC/D,qBAAqB,YAAY;AAAA,UAC/B,oBAAoB;AAAA,QACtB;AAAA,QACA,0BAA0B,YAAY;AAAA,UACpC,oBAAoB;AAAA,QACtB;AAAA,QACA,YAAY,YAAY,SAAS,oBAAoB,eAAe;AAAA,QACpE,oBAAoB,YAAY;AAAA,UAC9B,oBAAoB;AAAA,QACtB;AAAA,MACF;AAAA,MACA,KAAK,YAAY,SAAS,oBAAoB,GAAG;AAAA,MACjD,aAAa,YAAY,SAAS,oBAAoB,kBAAkB;AAAA,MACxE,gBAAgB,YAAY;AAAA,QAC1B,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,IACA,WAAW;AAAA,MACT,QAAQ,YAAY,SAAS,oBAAoB,iBAAiB;AAAA,MAClE,QAAQ,YAAY,SAAS,oBAAoB,iBAAiB;AAAA,MAClE,aAAa,YAAY;AAAA,QACvB,oBAAoB;AAAA,MACtB;AAAA,MACA,QAAQ,YAAY,SAAS,oBAAoB,iBAAiB;AAAA,MAClE,QAAQ,YAAY,SAAS,oBAAoB,iBAAiB;AAAA,MAClE,WAAW,YAAY;AAAA,QACrB,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,IACA,YAAY;AAAA,MACV,KAAK;AAAA,QACH,SAAS,YAAY;AAAA,UACnB,oBAAoB;AAAA,QACtB;AAAA,QACA,QAAQ,YAAY,SAAS,oBAAoB,qBAAqB;AAAA,QACtE,iBAAiB,YAAY;AAAA,UAC3B,oBAAoB;AAAA,QACtB;AAAA,MACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL,wBAAwB,YAAY;AAAA,QAClC,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,qBAAqB,YAAY;AAAA,QAC/B,oBAAoB;AAAA,MACtB;AAAA,MACA,mBAAmB,YAAY;AAAA,QAC7B,oBAAoB;AAAA,MACtB;AAAA,MACA,gBAAgB,YAAY;AAAA,QAC1B,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,WAAW;AAAA,QACT,KAAK,YAAY,SAAS,oBAAoB,iBAAiB;AAAA,QAC/D,QAAQ,YAAY,SAAS,oBAAoB,oBAAoB;AAAA,MACvE;AAAA,MACA,oBAAoB,YAAY;AAAA,QAC9B,mBAAmB;AAAA,MACrB;AAAA,IACF;AAAA,IACA,aAAa;AAAA,MACX,KAAK;AAAA,QACH,SAAS;AAAA,UACP,KAAK,YAAY;AAAA,YACf,oBAAoB;AAAA,UACtB;AAAA,QACF;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,oBAAoB;AAAA,QACtB;AAAA,MACF;AAAA;AAAA,MAEA,IAAI;AAAA,QACF,KAAK;AAAA,UACH,QAAQ,YAAY;AAAA,YAClB,oBAAoB;AAAA,UACtB;AAAA,QACF;AAAA,MACF;AAAA,MACA,aAAa;AAAA,QACX,SAAS,YAAY;AAAA,UACnB,oBAAoB;AAAA,QACtB;AAAA,MACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL,aAAa;AAAA,QACX,QAAQ,YAAY;AAAA,UAClB,oBAAoB;AAAA,QACtB;AAAA,QACA,MAAM,YAAY;AAAA,UAChB,oBAAoB;AAAA,QACtB;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,oBAAoB;AAAA,QACtB;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,oBAAoB;AAAA,QACtB;AAAA,MACF;AAAA,IACF;AAAA,IACA,eAAe;AAAA,MACb,QAAQ;AAAA,QACN,MAAM,YAAY,SAAS,wBAAwB,WAAW;AAAA,QAC9D,QAAQ,YAAY,SAAS,wBAAwB,aAAa;AAAA,QAClE,QAAQ,YAAY,SAAS,wBAAwB,aAAa;AAAA,MACpE;AAAA,IACF;AAAA,IACA,qBAAqB;AAAA,MACnB,MAAM,YAAY;AAAA,QAChB,oBAAoB;AAAA,MACtB;AAAA,MACA,QAAQ,YAAY;AAAA,QAClB,oBAAoB;AAAA,MACtB;AAAA,MACA,QAAQ,YAAY;AAAA,QAClB,oBAAoB;AAAA,MACtB;AAAA,MACA,QAAQ,YAAY;AAAA,QAClB,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,MAAM,YAAY,SAAS,oBAAoB,kBAAkB;AAAA,MACjE,OAAO,YAAY,SAAS,oBAAoB,mBAAmB;AAAA,IACrE;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,mCAAmC,aAAuB;AACxE,QAAM,cAA2C;AAAA,IAC/C,WAAW;AAAA,MACT,MAAM,YAAY,SAAS,mBAAmB,cAAc;AAAA,MAC5D,QAAQ,YAAY,SAAS,mBAAmB,gBAAgB;AAAA,IAClE;AAAA,IACA,cAAc;AAAA,MACZ,OAAO,YAAY,SAAS,mBAAmB,kBAAkB;AAAA,IACnE;AAAA,IACA,UAAU;AAAA,MACR,OAAO;AAAA,QACL,KAAK,YAAY;AAAA,UACf,mBAAmB;AAAA,QACrB;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,mBAAmB;AAAA,QACrB;AAAA,QACA,sBAAsB,YAAY;AAAA,UAChC,mBAAmB;AAAA,QACrB;AAAA,QACA,SAAS,YAAY;AAAA,UACnB,mBAAmB;AAAA,QACrB;AAAA,QACA,+BAA+B,YAAY;AAAA,UACzC,mBAAmB;AAAA,QACrB;AAAA,MACF;AAAA,MACA,cAAc;AAAA,QACZ,SAAS,YAAY,SAAS,mBAAmB,qBAAqB;AAAA,MACxE;AAAA,IACF;AAAA,IACA,UAAU;AAAA,MACR,uBAAuB,YAAY;AAAA,QACjC,mBAAmB;AAAA,MACrB;AAAA,MACA,sBAAsB,YAAY;AAAA,QAChC,mBAAmB;AAAA,MACrB;AAAA,MACA,mBAAmB,YAAY;AAAA,QAC7B,mBAAmB;AAAA,MACrB;AAAA,MACA,gBAAgB,YAAY;AAAA,QAC1B,mBAAmB;AAAA,MACrB;AAAA,MACA,gBAAgB,YAAY;AAAA,QAC1B,mBAAmB;AAAA,MACrB;AAAA,MACA,yBAAyB,YAAY;AAAA,QACnC,mBAAmB;AAAA,MACrB;AAAA,MACA,0BAA0B,YAAY;AAAA,QACpC,mBAAmB;AAAA,MACrB;AAAA,MACA,oBAAoB,YAAY;AAAA,QAC9B,mBAAmB;AAAA,MACrB;AAAA,MACA,6BAA6B,YAAY;AAAA,QACvC,mBAAmB;AAAA,MACrB;AAAA,MACA,sBAAsB,YAAY;AAAA,QAChC,mBAAmB;AAAA,MACrB;AAAA,MACA,0BAA0B,YAAY;AAAA,QACpC,mBAAmB;AAAA,MACrB;AAAA,MACA,4BAA4B,YAAY;AAAA,QACtC,mBAAmB;AAAA,MACrB;AAAA,IACF;AAAA,IACA,aAAa;AAAA,MACX,QAAQ,YAAY,SAAS,mBAAmB,oBAAoB;AAAA,MACpE,QAAQ,YAAY,SAAS,mBAAmB,mBAAmB;AAAA,MACnE,QAAQ,YAAY,SAAS,mBAAmB,mBAAmB;AAAA,MACnE,MAAM;AAAA,QACJ,QAAQ,YAAY;AAAA,UAClB,mBAAmB;AAAA,QACrB;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,mBAAmB;AAAA,QACrB;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,mBAAmB;AAAA,QACrB;AAAA,QACA,aAAa,YAAY;AAAA,UACvB,mBAAmB;AAAA,QACrB;AAAA,MACF;AAAA,MACA,SAAS,YAAY,SAAS,mBAAmB,oBAAoB;AAAA,MACrE,yBAAyB,YAAY;AAAA,QACnC,mBAAmB;AAAA,MACrB;AAAA,MACA,QAAQ,YAAY,SAAS,mBAAmB,uBAAuB;AAAA,IACzE;AAAA,IACA,UAAU;AAAA,MACR,SAAS,YAAY,SAAS,mBAAmB,gBAAgB;AAAA,MACjE,gBAAgB,YAAY;AAAA,QAC1B,mBAAmB;AAAA,MACrB;AAAA,MACA,cAAc,YAAY,SAAS,mBAAmB,aAAa;AAAA,MACnE,OAAO,YAAY,SAAS,mBAAmB,KAAK;AAAA,IACtD;AAAA,IACA,KAAK;AAAA,MACH,WAAW,YAAY,SAAS,mBAAmB,cAAc;AAAA,MACjE,QAAQ,YAAY,SAAS,mBAAmB,UAAU;AAAA,MAC1D,cAAc,YAAY,SAAS,mBAAmB,iBAAiB;AAAA,MACvE,mBAAmB,YAAY;AAAA,QAC7B,mBAAmB;AAAA,MACrB;AAAA,MACA,mBAAmB,YAAY;AAAA,QAC7B,mBAAmB;AAAA,MACrB;AAAA,MACA,iBAAiB,YAAY;AAAA,QAC3B,mBAAmB;AAAA,MACrB;AAAA,MACA,cAAc,YAAY,SAAS,mBAAmB,kBAAkB;AAAA,MACxE,UAAU;AAAA,QACR,gBAAgB,YAAY;AAAA,UAC1B,mBAAmB;AAAA,QACrB;AAAA,MACF;AAAA,MACA,oBAAoB,YAAY;AAAA,QAC9B,mBAAmB;AAAA,MACrB;AAAA,MACA,6BAA6B,YAAY;AAAA,QACvC,mBAAmB;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { AccountsPermissions } from './accounts.permissions.js'\nimport { AuditLoggerPermissions } from './auditlogger.permissions.js'\nimport { ConsolePermissions } from './console.permissions.js'\nimport { NotificationPermissions } from './notification.permissions.js'\n\nexport function accountsUserFeaturesFromPermissions(permissions: string[]) {\n  const newFeatures: AccountsPermissions.Features = {\n    admin: {\n      readAll: permissions.includes(AccountsPermissions.READ_ALL),\n      createOrg: permissions.includes(AccountsPermissions.CREATE_ORG),\n      changeOrgName: permissions.includes(AccountsPermissions.CHANGE_ORG_NAME),\n\n      deleteOrg: permissions.includes(AccountsPermissions.DELETE_ORG),\n      resetTokenVerification: permissions.includes(\n        AccountsPermissions.RESET_TOKEN_VERIFICATION,\n      ),\n      deleteUser: permissions.includes(AccountsPermissions.DELETE_USER),\n      deleteNotActivatedUser: permissions.includes(\n        AccountsPermissions.DELETE_NOT_ACTIVATED_USER,\n      ),\n      addToOrg: permissions.includes(AccountsPermissions.ADD_TO_ORG),\n      removeFromOrg: permissions.includes(AccountsPermissions.REMOVE_FROM_ORG),\n      setDefaultOrg: permissions.includes(AccountsPermissions.SET_DEFAULT_ORG),\n      cancelInvite: permissions.includes(AccountsPermissions.CANCEL_INVITE),\n      changeRole: permissions.includes(AccountsPermissions.CHANGE_ROLE),\n      addSafeRole: permissions.includes(AccountsPermissions.CHANGE_SAFE_ROLE),\n      deleteClusters: permissions.includes(\n        ConsolePermissions.CLUSTERS_DELETE_CLUSTER,\n      ),\n      extendTrial: permissions.includes(AccountsPermissions.EXTEND_TRIAL),\n      invalidateToken: permissions.includes(\n        AccountsPermissions.INVALIDATE_TOKEN,\n      ),\n      cancelPaid: permissions.includes(AccountsPermissions.ORG_CANCEL_PAID),\n      searchForOrgs: permissions.includes(\n        ConsolePermissions.CLUSTER_PLAN_SEE_ALL,\n      ),\n      readAudit: permissions.includes(AuditLoggerPermissions.READ),\n      modifyClusterPlanTypeReservations: permissions.includes(\n        AccountsPermissions.MODIFY_CLUSTER_PLAN_TYPE_RESERVATIONS,\n      ),\n      mayChangeOrgLimits: permissions.includes(\n        AccountsPermissions.ORG_MAY_CHANGE_LIMITS,\n      ),\n      mayChangeGenerationWhiteList: permissions.includes(\n        AccountsPermissions.ORG_MAY_CHANGE_GENERATION_WHITELIST,\n      ),\n      sql: permissions.includes(AccountsPermissions.ADMIN_SQL),\n      modelerDeleteUser: permissions.includes(\n        AccountsPermissions.MODELER_DELETE_USER,\n      ),\n      unblockUser: permissions.includes(AccountsPermissions.UNBLOCK_USER),\n      god: {\n        triggerCrons: permissions.includes(AccountsPermissions.GOD_CRON),\n        forceSalesPlanOnOrg: permissions.includes(\n          AccountsPermissions.FORCE_SALES_PLAN_ON_ORG,\n        ),\n        changeSignupSpamPatterns: permissions.includes(\n          AccountsPermissions.GOD_SIGNUP_SPAM_PATTERNS,\n        ),\n        purgeUsers: permissions.includes(AccountsPermissions.GOD_PURGE_USERS),\n        updateUserMetadata: permissions.includes(\n          AccountsPermissions.GOD_UPDATE_USER_METADATA,\n        ),\n      },\n      bot: permissions.includes(AccountsPermissions.BOT),\n      changeEmail: permissions.includes(AccountsPermissions.ADMIN_CHANGE_EMAIL),\n      changeUserName: permissions.includes(\n        AccountsPermissions.ADMIN_CHANGE_USER_NAME,\n      ),\n    },\n    salesPlan: {\n      create: permissions.includes(AccountsPermissions.SALES_PLAN_CREATE),\n      modify: permissions.includes(AccountsPermissions.SALES_PLAN_MODIFY),\n      forceModify: permissions.includes(\n        AccountsPermissions.SALES_PLAN_FORCE_MODIFY,\n      ),\n      switch: permissions.includes(AccountsPermissions.SALES_PLAN_SWITCH),\n      delete: permissions.includes(AccountsPermissions.SALES_PLAN_DELETE),\n      godDelete: permissions.includes(\n        AccountsPermissions.SALES_PLAN_DELETE_AS_GOD,\n      ),\n    },\n    enterprise: {\n      org: {\n        convert: permissions.includes(\n          AccountsPermissions.ENTERPRISE_ORG_CONVERT,\n        ),\n        modify: permissions.includes(AccountsPermissions.ENTERPRISE_ORG_MODIFY),\n        modifyStartDate: permissions.includes(\n          AccountsPermissions.ENTERPRISE_ORG_MODIFY_START_DATE,\n        ),\n      },\n    },\n    trial: {\n      convertToInNegotiation: permissions.includes(\n        AccountsPermissions.TRIAL_TO_IN_NEGOTIATION_CONVERT,\n      ),\n    },\n    supportAgent: {\n      removeAgentsFromOrg: permissions.includes(\n        AccountsPermissions.SUPPORT_AGENT_REMOVE_AGENTS_FROM_ORG,\n      ),\n      seeOrgMemberships: permissions.includes(\n        AccountsPermissions.SUPPORT_AGENT_SEE_ORG_MEMBERSHIPS,\n      ),\n      addAgentsToOrg: permissions.includes(\n        AccountsPermissions.SUPPORT_AGENT_ADD_TO_ORG,\n      ),\n    },\n    m2m: {\n      salesplan: {\n        get: permissions.includes(AccountsPermissions.M2M_SALESPLAN_GET),\n        switch: permissions.includes(AccountsPermissions.M2M_SALESPLAN_SWITCH),\n      },\n      fetchMigrationData: permissions.includes(\n        ConsolePermissions.M2M_FETCH_MIGRATION_DATA,\n      ),\n      approvals: permissions.includes(ConsolePermissions.M2M_CONTROL_APPROVALS),\n    },\n    externalM2m: {\n      org: {\n        members: {\n          get: permissions.includes(\n            AccountsPermissions.EXTERNAL_M2M_GET_ORG_MEMBERS,\n          ),\n        },\n        search: permissions.includes(\n          AccountsPermissions.EXTERNAL_M2M_SEARCH_ORGS,\n        ),\n      },\n      // eslint-disable-next-line id-length\n      qa: {\n        org: {\n          create: permissions.includes(\n            AccountsPermissions.EXTERNAL_M2M_QA_ORG_CREATE,\n          ),\n        },\n      },\n      offboarding: {\n        camundi: permissions.includes(\n          AccountsPermissions.EXTERNAL_M2M_OFFBOARD_CAMUNDI,\n        ),\n      },\n    },\n    auth0: {\n      connections: {\n        create: permissions.includes(\n          AccountsPermissions.ADMIN_AUTH0_CONNECTIONS_CREATE,\n        ),\n        read: permissions.includes(\n          AccountsPermissions.ADMIN_AUTH0_CONNECTIONS_READ,\n        ),\n        update: permissions.includes(\n          AccountsPermissions.ADMIN_AUTH0_CONNECTIONS_UPDATE,\n        ),\n        delete: permissions.includes(\n          AccountsPermissions.ADMIN_AUTH0_CONNECTIONS_DELETE,\n        ),\n      },\n    },\n    notifications: {\n      global: {\n        read: permissions.includes(NotificationPermissions.READ_GLOBAL),\n        delete: permissions.includes(NotificationPermissions.DELETE_GLOBAL),\n        create: permissions.includes(NotificationPermissions.CREATE_GLOBAL),\n      },\n    },\n    earlyAccessFeatures: {\n      read: permissions.includes(\n        AccountsPermissions.ADMIN_EARLY_ACCESS_FEATURES_READ,\n      ),\n      create: permissions.includes(\n        AccountsPermissions.ADMIN_EARLY_ACCESS_FEATURES_CREATE,\n      ),\n      delete: permissions.includes(\n        AccountsPermissions.ADMIN_EARLY_ACCESS_FEATURES_DELETE,\n      ),\n      update: permissions.includes(\n        AccountsPermissions.ADMIN_EARLY_ACCESS_FEATURES_UPDATE,\n      ),\n    },\n    pdfWatermark: {\n      read: permissions.includes(AccountsPermissions.PDF_WATERMARK_READ),\n      write: permissions.includes(AccountsPermissions.PDF_WATERMARK_WRITE),\n    },\n    featureFlags: {\n      override: permissions.includes(AccountsPermissions.CONTROL_FLAG_OVERRIDE),\n      overrideProd: permissions.includes(\n        AccountsPermissions.CONTROL_FLAG_OVERRIDE_PROD,\n      ),\n    },\n  }\n  return newFeatures\n}\n\nexport function consoleUserFeaturesFromPermissions(permissions: string[]) {\n  const newFeatures: ConsolePermissions.Features = {\n    apiClient: {\n      read: permissions.includes(ConsolePermissions.APICLIENT_READ),\n      delete: permissions.includes(ConsolePermissions.APICLIENT_DELETE),\n    },\n    multiCluster: {\n      admin: permissions.includes(ConsolePermissions.MULTICLUSTER_ADMIN),\n    },\n    multiGen: {\n      admin: {\n        see: permissions.includes(\n          ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN_SEE,\n        ),\n        modify: permissions.includes(\n          ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN,\n        ),\n        patchExistingChannel: permissions.includes(\n          ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN_PATCH_EXISTING_CHANNEL,\n        ),\n        migrate: permissions.includes(\n          ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN_MIGRATE,\n        ),\n        deleteAllClustersOfGeneration: permissions.includes(\n          ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN_DELETE_ALL_CLUSTERS,\n        ),\n      },\n      releaseTrain: {\n        publish: permissions.includes(ConsolePermissions.RELEASE_TRAIN_PUBLISH),\n      },\n    },\n    clusters: {\n      canReadAllClusterInfo: permissions.includes(\n        ConsolePermissions.CLUSTERS_READALLCLUSTERINFO,\n      ),\n      canDeleteAllClusters: permissions.includes(\n        ConsolePermissions.CLUSTERS_DELETE_CLUSTER,\n      ),\n      canMoveToOtherOrg: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_MOVE_TO_OTHER_ORG,\n      ),\n      createOnBehalf: permissions.includes(\n        ConsolePermissions.CLUSTER_CREATE_ON_BEHALF,\n      ),\n      canSendToSleep: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_SEND_TO_SLEEP,\n      ),\n      canCreateInternalBackup: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_CREATE_INTERNAL_BACKUP,\n      ),\n      canUpdateClusterPlanType: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_UPDATE_CLUSTERPLANTYPE,\n      ),\n      canOverrideEnvVars: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_OVERRIDE_ENV_VARS,\n      ),\n      canCreateModificationConfig: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_CREATE_MODIFICATION_CONFIG,\n      ),\n      canUpgradeGeneration: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_UPDATE_GENERATION,\n      ),\n      canUpgradeGenerationYolo: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_UPDATE_GENERATION_YOLO,\n      ),\n      canUpdateOptionalTelemetry: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_UPDATE_OPTIONAL_TELEMETRY,\n      ),\n    },\n    clusterPlan: {\n      seeAll: permissions.includes(ConsolePermissions.CLUSTER_PLAN_SEE_ALL),\n      create: permissions.includes(ConsolePermissions.CLUSTER_PLAN_CREATE),\n      delete: permissions.includes(ConsolePermissions.CLUSTER_PLAN_DELETE),\n      type: {\n        create: permissions.includes(\n          ConsolePermissions.CLUSTER_PLAN_TYPE_CREATE,\n        ),\n        modify: permissions.includes(\n          ConsolePermissions.CLUSTER_PLAN_TYPE_MODIFY,\n        ),\n        delete: permissions.includes(\n          ConsolePermissions.CLUSTER_PLAN_TYPE_DELETE,\n        ),\n        forceDelete: permissions.includes(\n          ConsolePermissions.CLUSTER_PLAN_TYPE_FORCE_DELETE,\n        ),\n      },\n      migrate: permissions.includes(ConsolePermissions.CLUSTER_PLAN_MIGRATE),\n      deleteAllClustersOfPlan: permissions.includes(\n        ConsolePermissions.CLUSTER_PLAN_CAN_DELETE_ALL_CLUSTERS_OF_PLAN,\n      ),\n      modify: permissions.includes(ConsolePermissions.CLUSTER_PLAN_CAN_MODIFY),\n    },\n    features: {\n      newHome: permissions.includes(ConsolePermissions.FEATURE_NEW_HOME),\n      templatePicker: permissions.includes(\n        ConsolePermissions.FEATURE_TEMPLATE_PICKER,\n      ),\n      userSettings: permissions.includes(ConsolePermissions.USER_SETTINGS),\n      debug: permissions.includes(ConsolePermissions.DEBUG),\n    },\n    m2m: {\n      updateCrd: permissions.includes(ConsolePermissions.M2M_UPDATE_CRD),\n      signup: permissions.includes(ConsolePermissions.M2M_SIGNUP),\n      triggerAlert: permissions.includes(ConsolePermissions.M2M_TRIGGER_ALERT),\n      deleteOrgClusters: permissions.includes(\n        ConsolePermissions.M2M_DELETE_ORG_CLUSTERS,\n      ),\n      updateOrgClusters: permissions.includes(\n        ConsolePermissions.M2M_UPDATE_ORG_CLUSTERS,\n      ),\n      addUsageMetrics: permissions.includes(\n        ConsolePermissions.M2M_ADD_CLUSTER_USAGE_METRICS,\n      ),\n      sendSseEvent: permissions.includes(ConsolePermissions.M2M_SEND_SSE_EVENT),\n      external: {\n        internalClient: permissions.includes(\n          ConsolePermissions.M2M_EXTERNAL_INTERNAL_CLIENT,\n        ),\n      },\n      fetchMigrationData: permissions.includes(\n        ConsolePermissions.M2M_FETCH_MIGRATION_DATA,\n      ),\n      manageGenerationUpgradePath: permissions.includes(\n        ConsolePermissions.M2M_MANAGE_GENERATION_UPGRADE_PATH,\n      ),\n      approvals: permissions.includes(ConsolePermissions.M2M_CONTROL_APPROVALS),\n    },\n  }\n  return newFeatures\n}\n\n/**\n * Flattens a feature tree into the dotted keys of the Control session.\n *\n * `buildSession` in accounts-backend writes the session with exactly this\n * shape, under the prefixes `` (accounts), `console` and `notifications`.\n */\nfunction flattenFeatureBooleans(\n  value: unknown,\n  prefix = '',\n): Record<string, boolean> {\n  const out: Record<string, boolean> = {}\n  if (!value || typeof value !== 'object') {\n    return out\n  }\n  for (const [key, entry] of Object.entries(value as Record<string, unknown>)) {\n    const flatKey = prefix ? `${prefix}.${key}` : key\n    if (typeof entry === 'boolean') {\n      out[flatKey] = entry\n    } else if (entry && typeof entry === 'object') {\n      Object.assign(out, flattenFeatureBooleans(entry, flatKey))\n    }\n  }\n  return out\n}\n\n/**\n * The session keys that ONE raw Auth0 permission turns on.\n *\n * The Control session holds a flat record of feature booleans, such as\n * `admin.extendTrial` and `console.clusters.canUpgradeGenerationYolo`. An\n * approval use case names the raw Auth0 short code instead, such as `aaet`,\n * because that is what the token carries and what a backend compares.\n *\n * This function bridges the two, and it bridges them by RUNNING the same\n * mappers that build the session. A hand-written table of code to key would be\n * a third copy of the permission model, and a code that gained a key would\n * silently stop gating anything in the browser.\n *\n * It answers an array, because one code can turn on more than one key. An\n * unknown code answers an empty array, and the caller decides what that means.\n *\n * The answer is CACHED, because the work is three feature trees and a flatten\n * of each one. `ApprovalActorView.has` of the browser runs this, and the rules\n * call `has` for every row of the queue: a page of 2000 requests turned one\n * cheap question into thousands of tree builds. The answer of a code never\n * changes inside one bundle, so the cache needs no invalidation, and the keys\n * are the permission codes of the use cases, which is a short list.\n *\n * The answer is `readonly`, and frozen, because every caller of one code gets\n * the SAME array: a caller that sorted or pushed in place would change what\n * the next reader of that code sees.\n */\nconst keysByPermissionCode = new Map<string, readonly string[]>()\n\nexport function sessionPermissionKeysFor(\n  permissionCode: string,\n): readonly string[] {\n  const cached = keysByPermissionCode.get(permissionCode)\n  if (cached) {\n    return cached\n  }\n  const answer = Object.freeze(buildSessionPermissionKeys(permissionCode))\n  keysByPermissionCode.set(permissionCode, answer)\n  return answer\n}\n\nfunction buildSessionPermissionKeys(permissionCode: string): string[] {\n  const trees: [unknown, string][] = [\n    [accountsUserFeaturesFromPermissions([permissionCode]), ''],\n    [consoleUserFeaturesFromPermissions([permissionCode]), 'console'],\n    [\n      NotificationPermissions.userFeaturesFromPermissions([permissionCode]),\n      'notifications',\n    ],\n  ]\n  const keys: string[] = []\n  for (const [tree, prefix] of trees) {\n    for (const [key, on] of Object.entries(\n      flattenFeatureBooleans(tree, prefix),\n    )) {\n      if (on) {\n        keys.push(key)\n      }\n    }\n  }\n  return keys\n}\n\n/**\n * Reports whether a Control session holds one raw Auth0 permission.\n *\n * It is what `ApprovalActorView.has` runs in the browser. An unknown code\n * answers false: a permission that nothing maps is a permission that nobody\n * holds, and the alternative would open a button that the backend refuses.\n */\nexport function sessionHasPermission(\n  sessionPermissions: Record<string, boolean>,\n  permissionCode: string,\n): boolean {\n  return sessionPermissionKeysFor(permissionCode).some(\n    (key) => sessionPermissions[key] === true,\n  )\n}\n"],
+  "mappings": "AAMA,SAAS,2BAA2B;AACpC,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,+BAA+B;AAEjC,SAAS,oCAAoC,aAAuB;AACzE,QAAM,cAA4C;AAAA,IAChD,OAAO;AAAA,MACL,SAAS,YAAY,SAAS,oBAAoB,QAAQ;AAAA,MAC1D,WAAW,YAAY,SAAS,oBAAoB,UAAU;AAAA,MAC9D,eAAe,YAAY,SAAS,oBAAoB,eAAe;AAAA,MAEvE,WAAW,YAAY,SAAS,oBAAoB,UAAU;AAAA,MAC9D,wBAAwB,YAAY;AAAA,QAClC,oBAAoB;AAAA,MACtB;AAAA,MACA,YAAY,YAAY,SAAS,oBAAoB,WAAW;AAAA,MAChE,wBAAwB,YAAY;AAAA,QAClC,oBAAoB;AAAA,MACtB;AAAA,MACA,UAAU,YAAY,SAAS,oBAAoB,UAAU;AAAA,MAC7D,eAAe,YAAY,SAAS,oBAAoB,eAAe;AAAA,MACvE,eAAe,YAAY,SAAS,oBAAoB,eAAe;AAAA,MACvE,cAAc,YAAY,SAAS,oBAAoB,aAAa;AAAA,MACpE,YAAY,YAAY,SAAS,oBAAoB,WAAW;AAAA,MAChE,aAAa,YAAY,SAAS,oBAAoB,gBAAgB;AAAA,MACtE,gBAAgB,YAAY;AAAA,QAC1B,mBAAmB;AAAA,MACrB;AAAA,MACA,aAAa,YAAY,SAAS,oBAAoB,YAAY;AAAA,MAClE,iBAAiB,YAAY;AAAA,QAC3B,oBAAoB;AAAA,MACtB;AAAA,MACA,YAAY,YAAY,SAAS,oBAAoB,eAAe;AAAA,MACpE,eAAe,YAAY;AAAA,QACzB,mBAAmB;AAAA,MACrB;AAAA,MACA,WAAW,YAAY,SAAS,uBAAuB,IAAI;AAAA,MAC3D,mCAAmC,YAAY;AAAA,QAC7C,oBAAoB;AAAA,MACtB;AAAA,MACA,oBAAoB,YAAY;AAAA,QAC9B,oBAAoB;AAAA,MACtB;AAAA,MACA,8BAA8B,YAAY;AAAA,QACxC,oBAAoB;AAAA,MACtB;AAAA,MACA,KAAK,YAAY,SAAS,oBAAoB,SAAS;AAAA,MACvD,mBAAmB,YAAY;AAAA,QAC7B,oBAAoB;AAAA,MACtB;AAAA,MACA,aAAa,YAAY,SAAS,oBAAoB,YAAY;AAAA,MAClE,KAAK;AAAA,QACH,cAAc,YAAY,SAAS,oBAAoB,QAAQ;AAAA,QAC/D,qBAAqB,YAAY;AAAA,UAC/B,oBAAoB;AAAA,QACtB;AAAA,QACA,0BAA0B,YAAY;AAAA,UACpC,oBAAoB;AAAA,QACtB;AAAA,QACA,YAAY,YAAY,SAAS,oBAAoB,eAAe;AAAA,QACpE,oBAAoB,YAAY;AAAA,UAC9B,oBAAoB;AAAA,QACtB;AAAA,MACF;AAAA,MACA,KAAK,YAAY,SAAS,oBAAoB,GAAG;AAAA,MACjD,aAAa,YAAY,SAAS,oBAAoB,kBAAkB;AAAA,MACxE,gBAAgB,YAAY;AAAA,QAC1B,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,IACA,WAAW;AAAA,MACT,QAAQ,YAAY,SAAS,oBAAoB,iBAAiB;AAAA,MAClE,QAAQ,YAAY,SAAS,oBAAoB,iBAAiB;AAAA,MAClE,aAAa,YAAY;AAAA,QACvB,oBAAoB;AAAA,MACtB;AAAA,MACA,QAAQ,YAAY,SAAS,oBAAoB,iBAAiB;AAAA,MAClE,QAAQ,YAAY,SAAS,oBAAoB,iBAAiB;AAAA,MAClE,WAAW,YAAY;AAAA,QACrB,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,IACA,YAAY;AAAA,MACV,KAAK;AAAA,QACH,SAAS,YAAY;AAAA,UACnB,oBAAoB;AAAA,QACtB;AAAA,QACA,QAAQ,YAAY,SAAS,oBAAoB,qBAAqB;AAAA,QACtE,iBAAiB,YAAY;AAAA,UAC3B,oBAAoB;AAAA,QACtB;AAAA,MACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL,wBAAwB,YAAY;AAAA,QAClC,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,qBAAqB,YAAY;AAAA,QAC/B,oBAAoB;AAAA,MACtB;AAAA,MACA,mBAAmB,YAAY;AAAA,QAC7B,oBAAoB;AAAA,MACtB;AAAA,MACA,gBAAgB,YAAY;AAAA,QAC1B,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,WAAW;AAAA,QACT,KAAK,YAAY,SAAS,oBAAoB,iBAAiB;AAAA,QAC/D,QAAQ,YAAY,SAAS,oBAAoB,oBAAoB;AAAA,MACvE;AAAA,MACA,oBAAoB,YAAY;AAAA,QAC9B,mBAAmB;AAAA,MACrB;AAAA,MACA,WAAW,YAAY,SAAS,mBAAmB,qBAAqB;AAAA,IAC1E;AAAA,IACA,aAAa;AAAA,MACX,KAAK;AAAA,QACH,SAAS;AAAA,UACP,KAAK,YAAY;AAAA,YACf,oBAAoB;AAAA,UACtB;AAAA,QACF;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,oBAAoB;AAAA,QACtB;AAAA,MACF;AAAA;AAAA,MAEA,IAAI;AAAA,QACF,KAAK;AAAA,UACH,QAAQ,YAAY;AAAA,YAClB,oBAAoB;AAAA,UACtB;AAAA,QACF;AAAA,MACF;AAAA,MACA,aAAa;AAAA,QACX,SAAS,YAAY;AAAA,UACnB,oBAAoB;AAAA,QACtB;AAAA,MACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL,aAAa;AAAA,QACX,QAAQ,YAAY;AAAA,UAClB,oBAAoB;AAAA,QACtB;AAAA,QACA,MAAM,YAAY;AAAA,UAChB,oBAAoB;AAAA,QACtB;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,oBAAoB;AAAA,QACtB;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,oBAAoB;AAAA,QACtB;AAAA,MACF;AAAA,IACF;AAAA,IACA,eAAe;AAAA,MACb,QAAQ;AAAA,QACN,MAAM,YAAY,SAAS,wBAAwB,WAAW;AAAA,QAC9D,QAAQ,YAAY,SAAS,wBAAwB,aAAa;AAAA,QAClE,QAAQ,YAAY,SAAS,wBAAwB,aAAa;AAAA,MACpE;AAAA,IACF;AAAA,IACA,qBAAqB;AAAA,MACnB,MAAM,YAAY;AAAA,QAChB,oBAAoB;AAAA,MACtB;AAAA,MACA,QAAQ,YAAY;AAAA,QAClB,oBAAoB;AAAA,MACtB;AAAA,MACA,QAAQ,YAAY;AAAA,QAClB,oBAAoB;AAAA,MACtB;AAAA,MACA,QAAQ,YAAY;AAAA,QAClB,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,MAAM,YAAY,SAAS,oBAAoB,kBAAkB;AAAA,MACjE,OAAO,YAAY,SAAS,oBAAoB,mBAAmB;AAAA,IACrE;AAAA,IACA,cAAc;AAAA,MACZ,UAAU,YAAY,SAAS,oBAAoB,qBAAqB;AAAA,MACxE,cAAc,YAAY;AAAA,QACxB,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,mCAAmC,aAAuB;AACxE,QAAM,cAA2C;AAAA,IAC/C,WAAW;AAAA,MACT,MAAM,YAAY,SAAS,mBAAmB,cAAc;AAAA,MAC5D,QAAQ,YAAY,SAAS,mBAAmB,gBAAgB;AAAA,IAClE;AAAA,IACA,cAAc;AAAA,MACZ,OAAO,YAAY,SAAS,mBAAmB,kBAAkB;AAAA,IACnE;AAAA,IACA,UAAU;AAAA,MACR,OAAO;AAAA,QACL,KAAK,YAAY;AAAA,UACf,mBAAmB;AAAA,QACrB;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,mBAAmB;AAAA,QACrB;AAAA,QACA,sBAAsB,YAAY;AAAA,UAChC,mBAAmB;AAAA,QACrB;AAAA,QACA,SAAS,YAAY;AAAA,UACnB,mBAAmB;AAAA,QACrB;AAAA,QACA,+BAA+B,YAAY;AAAA,UACzC,mBAAmB;AAAA,QACrB;AAAA,MACF;AAAA,MACA,cAAc;AAAA,QACZ,SAAS,YAAY,SAAS,mBAAmB,qBAAqB;AAAA,MACxE;AAAA,IACF;AAAA,IACA,UAAU;AAAA,MACR,uBAAuB,YAAY;AAAA,QACjC,mBAAmB;AAAA,MACrB;AAAA,MACA,sBAAsB,YAAY;AAAA,QAChC,mBAAmB;AAAA,MACrB;AAAA,MACA,mBAAmB,YAAY;AAAA,QAC7B,mBAAmB;AAAA,MACrB;AAAA,MACA,gBAAgB,YAAY;AAAA,QAC1B,mBAAmB;AAAA,MACrB;AAAA,MACA,gBAAgB,YAAY;AAAA,QAC1B,mBAAmB;AAAA,MACrB;AAAA,MACA,yBAAyB,YAAY;AAAA,QACnC,mBAAmB;AAAA,MACrB;AAAA,MACA,0BAA0B,YAAY;AAAA,QACpC,mBAAmB;AAAA,MACrB;AAAA,MACA,oBAAoB,YAAY;AAAA,QAC9B,mBAAmB;AAAA,MACrB;AAAA,MACA,6BAA6B,YAAY;AAAA,QACvC,mBAAmB;AAAA,MACrB;AAAA,MACA,sBAAsB,YAAY;AAAA,QAChC,mBAAmB;AAAA,MACrB;AAAA,MACA,0BAA0B,YAAY;AAAA,QACpC,mBAAmB;AAAA,MACrB;AAAA,MACA,4BAA4B,YAAY;AAAA,QACtC,mBAAmB;AAAA,MACrB;AAAA,IACF;AAAA,IACA,aAAa;AAAA,MACX,QAAQ,YAAY,SAAS,mBAAmB,oBAAoB;AAAA,MACpE,QAAQ,YAAY,SAAS,mBAAmB,mBAAmB;AAAA,MACnE,QAAQ,YAAY,SAAS,mBAAmB,mBAAmB;AAAA,MACnE,MAAM;AAAA,QACJ,QAAQ,YAAY;AAAA,UAClB,mBAAmB;AAAA,QACrB;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,mBAAmB;AAAA,QACrB;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,mBAAmB;AAAA,QACrB;AAAA,QACA,aAAa,YAAY;AAAA,UACvB,mBAAmB;AAAA,QACrB;AAAA,MACF;AAAA,MACA,SAAS,YAAY,SAAS,mBAAmB,oBAAoB;AAAA,MACrE,yBAAyB,YAAY;AAAA,QACnC,mBAAmB;AAAA,MACrB;AAAA,MACA,QAAQ,YAAY,SAAS,mBAAmB,uBAAuB;AAAA,IACzE;AAAA,IACA,UAAU;AAAA,MACR,SAAS,YAAY,SAAS,mBAAmB,gBAAgB;AAAA,MACjE,gBAAgB,YAAY;AAAA,QAC1B,mBAAmB;AAAA,MACrB;AAAA,MACA,cAAc,YAAY,SAAS,mBAAmB,aAAa;AAAA,MACnE,OAAO,YAAY,SAAS,mBAAmB,KAAK;AAAA,IACtD;AAAA,IACA,KAAK;AAAA,MACH,WAAW,YAAY,SAAS,mBAAmB,cAAc;AAAA,MACjE,QAAQ,YAAY,SAAS,mBAAmB,UAAU;AAAA,MAC1D,cAAc,YAAY,SAAS,mBAAmB,iBAAiB;AAAA,MACvE,mBAAmB,YAAY;AAAA,QAC7B,mBAAmB;AAAA,MACrB;AAAA,MACA,mBAAmB,YAAY;AAAA,QAC7B,mBAAmB;AAAA,MACrB;AAAA,MACA,iBAAiB,YAAY;AAAA,QAC3B,mBAAmB;AAAA,MACrB;AAAA,MACA,cAAc,YAAY,SAAS,mBAAmB,kBAAkB;AAAA,MACxE,UAAU;AAAA,QACR,gBAAgB,YAAY;AAAA,UAC1B,mBAAmB;AAAA,QACrB;AAAA,MACF;AAAA,MACA,oBAAoB,YAAY;AAAA,QAC9B,mBAAmB;AAAA,MACrB;AAAA,MACA,6BAA6B,YAAY;AAAA,QACvC,mBAAmB;AAAA,MACrB;AAAA,MACA,WAAW,YAAY,SAAS,mBAAmB,qBAAqB;AAAA,IAC1E;AAAA,EACF;AACA,SAAO;AACT;AAQA,SAAS,uBACP,OACA,SAAS,IACgB;AACzB,QAAM,MAA+B,CAAC;AACtC,MAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,WAAO;AAAA,EACT;AACA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAgC,GAAG;AAC3E,UAAM,UAAU,SAAS,GAAG,MAAM,IAAI,GAAG,KAAK;AAC9C,QAAI,OAAO,UAAU,WAAW;AAC9B,UAAI,OAAO,IAAI;AAAA,IACjB,WAAW,SAAS,OAAO,UAAU,UAAU;AAC7C,aAAO,OAAO,KAAK,uBAAuB,OAAO,OAAO,CAAC;AAAA,IAC3D;AAAA,EACF;AACA,SAAO;AACT;AA6BA,MAAM,uBAAuB,oBAAI,IAA+B;AAEzD,SAAS,yBACd,gBACmB;AACnB,QAAM,SAAS,qBAAqB,IAAI,cAAc;AACtD,MAAI,QAAQ;AACV,WAAO;AAAA,EACT;AACA,QAAM,SAAS,OAAO,OAAO,2BAA2B,cAAc,CAAC;AACvE,uBAAqB,IAAI,gBAAgB,MAAM;AAC/C,SAAO;AACT;AAEA,SAAS,2BAA2B,gBAAkC;AACpE,QAAM,QAA6B;AAAA,IACjC,CAAC,oCAAoC,CAAC,cAAc,CAAC,GAAG,EAAE;AAAA,IAC1D,CAAC,mCAAmC,CAAC,cAAc,CAAC,GAAG,SAAS;AAAA,IAChE;AAAA,MACE,wBAAwB,4BAA4B,CAAC,cAAc,CAAC;AAAA,MACpE;AAAA,IACF;AAAA,EACF;AACA,QAAM,OAAiB,CAAC;AACxB,aAAW,CAAC,MAAM,MAAM,KAAK,OAAO;AAClC,eAAW,CAAC,KAAK,EAAE,KAAK,OAAO;AAAA,MAC7B,uBAAuB,MAAM,MAAM;AAAA,IACrC,GAAG;AACD,UAAI,IAAI;AACN,aAAK,KAAK,GAAG;AAAA,MACf;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AASO,SAAS,qBACd,oBACA,gBACS;AACT,SAAO,yBAAyB,cAAc,EAAE;AAAA,IAC9C,CAAC,QAAQ,mBAAmB,GAAG,MAAM;AAAA,EACvC;AACF;",
   "names": []
 }

package/dist/permissions/console.permissions.d.ts

@@ -37,6 +37,36 @@ export declare namespace ConsolePermissions {
     const M2M_EXTERNAL_INTERNAL_CLIENT = "cmeic";
     const M2M_FETCH_MIGRATION_DATA = "cmfmd";
     const M2M_MANAGE_GENERATION_UPGRADE_PATH = "cmmgup";
+    /**
+     * The one m2m permission of control-backend. It opens every route of
+     * `api/admin/approvals` in accounts-backend and in console-backend, which
+     * control-backend calls when a four-eyes request has the approvals that it
+     * needs.
+     *
+     * One permission for all of them, by a decision of the team: one grant at
+     * Auth0 for the whole approval surface of control-backend. A route that
+     * reads it runs an action that people already approved, so the permission
+     * goes to the m2m application of control-backend and to no other client.
+     *
+     * It is NOT the permission that a Camundi needs. A person needs the
+     * permission of the action, such as `CLUSTERS_CAN_MOVE_TO_OTHER_ORG`, and
+     * control-backend asks for that one before it accepts an approval.
+     */
+    const M2M_CONTROL_APPROVALS = "ctam";
+    /**
+     * Stands in for the permission of EVERY approval use case of
+     * control-backend, for a person who tests the approval flow.
+     *
+     * A holder can open, approve, reject and run each use case, including one
+     * that a later change adds, with no grant of its own permission. The four-eyes
+     * rule still holds: nobody approves their own request.
+     *
+     * It is a permission of a PERSON. No machine route reads it, because a token
+     * that a Camundi can get must not run an action with no approval. It goes to
+     * no role at Auth0: a person with access to the tenant grants it by hand, and
+     * only on a stage where the approval flow is under test.
+     */
+    const APPROVALS_ALL_USE_CASES = "caauc";
     const CLUSTER_CREATE_ON_BEHALF = "cccob";
     const FEATURE_NEW_HOME = "cfnh";
     const FEATURE_TEMPLATE_PICKER = "cftp";
@@ -115,6 +145,8 @@ export declare namespace ConsolePermissions {
             };
             fetchMigrationData: boolean;
             manageGenerationUpgradePath: boolean;
+            /** Every route of `api/admin/approvals`. See `M2M_CONTROL_APPROVALS`. */
+            approvals: boolean;
         };
     }
     function createEmptyFeatures(): Features;

package/dist/permissions/console.permissions.js

@@ -41,6 +41,8 @@ var ConsolePermissions;
   ConsolePermissions2.M2M_EXTERNAL_INTERNAL_CLIENT = "cmeic";
   ConsolePermissions2.M2M_FETCH_MIGRATION_DATA = "cmfmd";
   ConsolePermissions2.M2M_MANAGE_GENERATION_UPGRADE_PATH = "cmmgup";
+  ConsolePermissions2.M2M_CONTROL_APPROVALS = "ctam";
+  ConsolePermissions2.APPROVALS_ALL_USE_CASES = "caauc";
   ConsolePermissions2.CLUSTER_CREATE_ON_BEHALF = "cccob";
   ConsolePermissions2.FEATURE_NEW_HOME = "cfnh";
   ConsolePermissions2.FEATURE_TEMPLATE_PICKER = "cftp";
@@ -117,7 +119,8 @@ var ConsolePermissions;
           internalClient: false
         },
         fetchMigrationData: false,
-        manageGenerationUpgradePath: false
+        manageGenerationUpgradePath: false,
+        approvals: false
       }
     };
   }
@@ -195,7 +198,11 @@ var ConsolePermissions;
     {
       value: ConsolePermissions2.CLUSTERS_CAN_MOVE_TO_OTHER_ORG,
       description: "can move a cluster to another org the user is part of",
-      initialRoles: ["console:admin"]
+      // CSMs, TAMs and consultants move a cluster to another org for a
+      // customer, thus the capability goes to `console:clusterMover`. The
+      // population that holds the role lives in the Camundi permission
+      // rules, not in the name of the role.
+      initialRoles: ["console:admin", "console:clusterMover"]
     },
     {
       value: ConsolePermissions2.CLUSTER_PLAN_SEE_ALL,
@@ -295,6 +302,21 @@ var ConsolePermissions;
       description: "allows to fetch internal clients",
       initialRoles: []
     },
+    // `initialRoles` is empty, and it must stay empty. A machine client holds
+    // a grant on its Auth0 application, and never a role. An entry here with a
+    // role would give the permission to every person in that role.
+    {
+      value: ConsolePermissions2.M2M_CONTROL_APPROVALS,
+      description: "m2m can run the approved actions of control-backend in accounts and console",
+      initialRoles: []
+    },
+    // No role, on purpose. This permission opens every approval use case, so
+    // a person with access to the tenant grants it by hand, for testing.
+    {
+      value: ConsolePermissions2.APPROVALS_ALL_USE_CASES,
+      description: "can open, approve, reject and run every approval use case of Control (for testing)",
+      initialRoles: []
+    },
     {
       value: ConsolePermissions2.M2M_FETCH_MIGRATION_DATA,
       description: "allows to fetch migration data",

package/dist/permissions/console.permissions.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/permissions/console.permissions.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type { Roles } from '../types/Roles.js'\n\nexport namespace ConsolePermissions {\n  export const MULTICLUSTER_ADMIN = 'cmca'\n\n  export const CHANNELS_AND_GENERATIONS_ADMIN_DELETE_ALL_CLUSTERS = 'cmgda'\n  export const CHANNELS_AND_GENERATIONS_ADMIN_SEE = 'cmgas'\n  export const CHANNELS_AND_GENERATIONS_ADMIN = 'cmga'\n  export const CHANNELS_AND_GENERATIONS_ADMIN_PATCH_EXISTING_CHANNEL = 'cmgap'\n  export const CHANNELS_AND_GENERATIONS_ADMIN_MIGRATE = 'cmgam'\n  export const CHANNELS_AND_GENERATIONS_MIGRATE = 'cmgm'\n  export const ALL_CHANNELS_AND_GENERATIONS: string[] = [\n    CHANNELS_AND_GENERATIONS_ADMIN_SEE,\n    CHANNELS_AND_GENERATIONS_ADMIN,\n    CHANNELS_AND_GENERATIONS_ADMIN_MIGRATE,\n  ]\n  export const CLUSTERS_READALLCLUSTERINFO = 'ccrai'\n  export const CLUSTERS_DELETE_CLUSTER = 'ccda'\n  export const CLUSTERS_CAN_MOVE_TO_OTHER_ORG = 'ccmoo'\n  export const CLUSTERS_CAN_SEND_TO_SLEEP = 'ccsts'\n  export const CLUSTERS_CAN_CREATE_INTERNAL_BACKUP = 'cccib'\n  export const CLUSTERS_CAN_UPDATE_CLUSTERPLANTYPE = 'ccucp'\n  export const CLUSTERS_CAN_UPDATE_GENERATION = 'ccug'\n  export const CLUSTERS_CAN_UPDATE_GENERATION_YOLO = 'ccugy'\n  export const CLUSTERS_CAN_UPDATE_OPTIONAL_TELEMETRY = 'ccuot'\n\n  export const CLUSTER_PLAN_SEE_ALL = 'ccpa'\n  export const CLUSTER_PLAN_CREATE = 'ccpc'\n  export const CLUSTER_PLAN_DELETE = 'ccpd'\n\n  export const CLUSTER_PLAN_TYPE_CREATE = 'cptc'\n  export const CLUSTER_PLAN_TYPE_MODIFY = 'cptm'\n  export const CLUSTER_PLAN_TYPE_DELETE = 'cptd'\n  export const CLUSTER_PLAN_TYPE_FORCE_DELETE = 'cptfd'\n\n  export const CLUSTER_PLAN_MIGRATE = 'ccpm'\n  export const CLUSTER_PLAN_CAN_DELETE_ALL_CLUSTERS_OF_PLAN = 'ccpda'\n  export const CLUSTER_PLAN_CAN_MODIFY = 'ccpmo'\n\n  export const M2M_UPDATE_CRD = 'cmuc'\n  export const M2M_SIGNUP = 'cms'\n  export const M2M_TRIGGER_ALERT = 'cmta'\n  export const M2M_DELETE_ORG_CLUSTERS = 'cmdoc'\n  export const M2M_UPDATE_ORG_CLUSTERS = 'cmuoc'\n  export const M2M_ADD_CLUSTER_USAGE_METRICS = 'cmacm'\n  export const M2M_SEND_SSE_EVENT = 'cmsse'\n  export const M2M_EXTERNAL_INTERNAL_CLIENT = 'cmeic'\n  export const M2M_FETCH_MIGRATION_DATA = 'cmfmd'\n  export const M2M_MANAGE_GENERATION_UPGRADE_PATH = 'cmmgup'\n  export const CLUSTER_CREATE_ON_BEHALF = 'cccob'\n  export const FEATURE_NEW_HOME = 'cfnh'\n  export const FEATURE_TEMPLATE_PICKER = 'cftp'\n  export const USER_SETTINGS = 'cus'\n  export const CLUSTERS_CAN_OVERRIDE_ENV_VARS = 'ccoev'\n  export const CLUSTERS_CAN_CREATE_MODIFICATION_CONFIG = 'ccccmc'\n\n  export const DEBUG = 'cdbg'\n  export const GOD_TRIGGER_CRONS = 'gtc'\n\n  export const RELEASE_TRAIN_PUBLISH = 'crtp'\n\n  export const APICLIENT_READ = 'capr'\n  export const APICLIENT_DELETE = 'capd'\n\n  export interface Features {\n    apiClient: {\n      read: boolean\n      delete: boolean\n    }\n    multiCluster: {\n      admin: boolean\n    }\n    multiGen: {\n      admin: {\n        see: boolean\n        modify: boolean\n        patchExistingChannel: boolean\n        migrate: boolean\n        deleteAllClustersOfGeneration: boolean\n      }\n      releaseTrain: {\n        publish: boolean\n      }\n    }\n    clusters: {\n      canReadAllClusterInfo: boolean\n      canDeleteAllClusters: boolean\n      canMoveToOtherOrg: boolean\n      createOnBehalf: boolean\n      canSendToSleep: boolean\n      canCreateInternalBackup: boolean\n      canUpdateClusterPlanType: boolean\n      canOverrideEnvVars: boolean\n      canCreateModificationConfig: boolean\n      canUpgradeGeneration: boolean\n      canUpgradeGenerationYolo: boolean\n      canUpdateOptionalTelemetry: boolean\n    }\n    clusterPlan: {\n      seeAll: boolean\n      create: boolean\n      delete: boolean\n      type: {\n        create: boolean\n        modify: boolean\n        delete: boolean\n        forceDelete: boolean\n      }\n      migrate: boolean\n      deleteAllClustersOfPlan: boolean\n      modify: boolean\n    }\n    features: {\n      newHome: boolean\n      templatePicker: boolean\n      userSettings: boolean\n      debug: boolean\n    }\n    m2m: {\n      updateCrd: boolean\n      signup: boolean\n      triggerAlert: boolean\n      deleteOrgClusters: boolean\n      updateOrgClusters: boolean\n      addUsageMetrics: boolean\n      sendSseEvent: boolean\n      external: {\n        internalClient: boolean\n      }\n      fetchMigrationData: boolean\n      manageGenerationUpgradePath: boolean\n    }\n  }\n\n  export function createEmptyFeatures(): Features {\n    return {\n      apiClient: {\n        read: false,\n        delete: false,\n      },\n      multiCluster: { admin: false },\n      multiGen: {\n        admin: {\n          migrate: false,\n          modify: false,\n          patchExistingChannel: false,\n          see: false,\n          deleteAllClustersOfGeneration: false,\n        },\n        releaseTrain: {\n          publish: false,\n        },\n      },\n      clusters: {\n        canReadAllClusterInfo: false,\n        canDeleteAllClusters: false,\n        canMoveToOtherOrg: false,\n        createOnBehalf: false,\n        canSendToSleep: false,\n        canCreateInternalBackup: false,\n        canUpdateClusterPlanType: false,\n        canOverrideEnvVars: false,\n        canCreateModificationConfig: false,\n        canUpgradeGeneration: false,\n        canUpgradeGenerationYolo: false,\n        canUpdateOptionalTelemetry: false,\n      },\n      clusterPlan: {\n        seeAll: false,\n        create: false,\n        delete: false,\n        type: {\n          create: false,\n          modify: false,\n          delete: false,\n          forceDelete: false,\n        },\n        migrate: false,\n        deleteAllClustersOfPlan: false,\n        modify: false,\n      },\n      features: {\n        newHome: false,\n        templatePicker: false,\n        userSettings: false,\n        debug: false,\n      },\n      m2m: {\n        updateCrd: false,\n        signup: false,\n        triggerAlert: false,\n        deleteOrgClusters: false,\n        updateOrgClusters: false,\n        addUsageMetrics: false,\n        sendSseEvent: false,\n        external: {\n          internalClient: false,\n        },\n        fetchMigrationData: false,\n        manageGenerationUpgradePath: false,\n      },\n    }\n  }\n\n  export const PermissionsAtAuth0: Array<{\n    value: string\n    description: string\n    initialRoles: Roles[]\n  }> = [\n    {\n      value: MULTICLUSTER_ADMIN,\n      description: 'can create and delete k8s clusters',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CHANNELS_AND_GENERATIONS_ADMIN_SEE,\n      description: 'can go to the admin section for MultiGen, but no touch!',\n      initialRoles: [\n        'console:admin',\n        'console:admin:readonly',\n        'support:agent',\n        'supersupport:agent',\n        'accounts:clusterUpdates',\n        'console:C8ReleaseManager',\n        'console:C8UpdateEnforcer',\n      ],\n    },\n    {\n      value: CHANNELS_AND_GENERATIONS_ADMIN,\n      description: 'can create channels, generations and combine them',\n      initialRoles: ['console:admin', 'console:C8ReleaseManager'],\n    },\n    {\n      value: CHANNELS_AND_GENERATIONS_ADMIN_PATCH_EXISTING_CHANNEL,\n      description: 'can modify existing channels and combine them',\n      initialRoles: [\n        'console:admin',\n        'accounts:clusterUpdates',\n        'console:C8ReleaseManager',\n      ],\n    },\n    {\n      value: CHANNELS_AND_GENERATIONS_ADMIN_MIGRATE,\n      description:\n        'can migrate clusters of generations to supported other generations',\n      initialRoles: ['console:admin', 'console:C8UpdateEnforcer'],\n    },\n    {\n      value: CHANNELS_AND_GENERATIONS_ADMIN_DELETE_ALL_CLUSTERS,\n      description: 'can delete all clusters of a generation',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CHANNELS_AND_GENERATIONS_MIGRATE,\n      description:\n        'can migrate owned clusters of generations to supported other generations',\n      initialRoles: [],\n    },\n    {\n      value: CLUSTERS_READALLCLUSTERINFO,\n      description: 'can read clusterInfo for all clusters',\n      initialRoles: [\n        'accounts:read',\n        'accounts:onboard',\n        'accounts:orgCreator',\n        'accounts:admin',\n        'accounts:editSalesPlans',\n        'console:admin:readonly',\n        'support:agent',\n        'supersupport:agent',\n        'console:admin',\n        'accounts:trialExtender',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: CLUSTERS_DELETE_CLUSTER,\n      description: 'can delete clusters in all orgs',\n      initialRoles: ['accounts:admin'],\n    },\n    {\n      value: CLUSTERS_CAN_MOVE_TO_OTHER_ORG,\n      description: 'can move a cluster to another org the user is part of',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CLUSTER_PLAN_SEE_ALL,\n      description: 'can see all ClusterPlans',\n      initialRoles: [\n        'console:admin',\n        'accounts:read',\n        'accounts:orgCreator',\n        'accounts:admin',\n        'console:admin:readonly',\n        'support:agent',\n        'supersupport:agent',\n        'accounts:onboard',\n        'accounts:editSalesPlans',\n        'accounts:trialExtender',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: CLUSTER_PLAN_CREATE,\n      description: 'can create ClusterPlans',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CLUSTER_PLAN_DELETE,\n      description: 'can delete ClusterPlans',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CLUSTER_PLAN_TYPE_CREATE,\n      description: 'can create ClusterPlanTypes',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CLUSTER_PLAN_TYPE_DELETE,\n      description: 'can delete ClusterPlanTypes',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CLUSTER_PLAN_TYPE_FORCE_DELETE,\n      description: 'can delete ClusterPlanTypes',\n      initialRoles: ['console:god'],\n    },\n    {\n      value: CLUSTER_PLAN_TYPE_MODIFY,\n      description: 'can modify ClusterPlanTypes',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CLUSTER_PLAN_MIGRATE,\n      description: 'can migrate Clusters from one plan to another',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CLUSTER_PLAN_CAN_DELETE_ALL_CLUSTERS_OF_PLAN,\n      description: 'can delete all clusters of a plan',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CLUSTER_CREATE_ON_BEHALF,\n      description:\n        'enables accounts to create clusters on signup (not a user permission)',\n      initialRoles: [],\n    },\n    {\n      value: M2M_SIGNUP,\n      description: 'allows to signal to Console new user signups',\n      initialRoles: [],\n    },\n    { value: M2M_UPDATE_CRD, description: 'may update crds', initialRoles: [] },\n    {\n      value: M2M_TRIGGER_ALERT,\n      description: 'allows Infra and Operate to trigger alerts',\n      initialRoles: [],\n    },\n    {\n      value: M2M_DELETE_ORG_CLUSTERS,\n      description:\n        'allows trigger console to delete all clusters of an Organization',\n      initialRoles: [],\n    },\n    {\n      value: M2M_UPDATE_ORG_CLUSTERS,\n      description: 'allows to update clusters of an Organization',\n      initialRoles: [],\n    },\n    {\n      value: M2M_ADD_CLUSTER_USAGE_METRICS,\n      description: 'allows to trigger update of value metrics',\n      initialRoles: [],\n    },\n    {\n      value: M2M_SEND_SSE_EVENT,\n      description: 'allows to trigger SSE events',\n      initialRoles: [],\n    },\n    {\n      value: M2M_EXTERNAL_INTERNAL_CLIENT,\n      description: 'allows to fetch internal clients',\n      initialRoles: [],\n    },\n    {\n      value: M2M_FETCH_MIGRATION_DATA,\n      description: 'allows to fetch migration data',\n      initialRoles: [],\n    },\n    {\n      value: M2M_MANAGE_GENERATION_UPGRADE_PATH,\n      description:\n        'allows to manage upgrade paths for generations via external API',\n      initialRoles: [],\n    },\n    {\n      value: FEATURE_NEW_HOME,\n      description: 'allows users to see new home',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: USER_SETTINGS,\n      description: 'allows users to see user settings',\n      initialRoles: ['console:admin', 'betatester:true'],\n    },\n    {\n      value: FEATURE_TEMPLATE_PICKER,\n      description: 'allows users to see template picker',\n      initialRoles: ['console:admin', 'betatester:true'],\n    },\n    {\n      value: CLUSTERS_CAN_SEND_TO_SLEEP,\n      description: 'may send a cluster to sleep and wake up',\n      initialRoles: [\n        'console:admin',\n        'accounts:admin',\n        'console:operationsEngineer',\n      ],\n    },\n    {\n      value: CLUSTERS_CAN_CREATE_INTERNAL_BACKUP,\n      description: 'may create and delete internal (incident) backups',\n      initialRoles: ['console:admin', 'console:operationsEngineer'],\n    },\n    {\n      value: DEBUG,\n      description: 'can see additional debugging tools',\n      initialRoles: ['console:admin:readonly', 'console:admin'],\n    },\n    {\n      value: CLUSTERS_CAN_OVERRIDE_ENV_VARS,\n      description:\n        'can set Env Vars on cluster level that override all ClusterPlan Env Vars',\n      initialRoles: ['console:admin', 'console:operationsEngineer'],\n    },\n    {\n      value: CLUSTERS_CAN_CREATE_MODIFICATION_CONFIG,\n      description: 'can create cluster modification configs',\n      initialRoles: ['console:admin', 'console:operationsEngineer'],\n    },\n    {\n      value: CLUSTERS_CAN_UPDATE_CLUSTERPLANTYPE,\n      description: 'can update clusterplantype of a running cluster',\n      initialRoles: [\n        'console:admin',\n        'accounts:onboard',\n        'console:operationsEngineer',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: CLUSTERS_CAN_UPDATE_GENERATION,\n      description: 'can update generation of a running cluster',\n      initialRoles: [\n        'console:admin',\n        'accounts:clusterUpdates',\n        'console:C8ReleaseManager',\n      ],\n    },\n    {\n      value: CLUSTERS_CAN_UPDATE_GENERATION_YOLO,\n      description:\n        'can update generation of a running cluster even if the generation is not reachable',\n      initialRoles: ['console:god'],\n    },\n    {\n      value: CLUSTERS_CAN_UPDATE_OPTIONAL_TELEMETRY,\n      description:\n        'can enable or disable optional product telemetry for a cluster',\n      // A customer asks their CSM or TAM to switch the category off, thus the\n      // capability goes to `console:optionalTelemetryManager`. The population\n      // that holds the role lives in the Camundi permission rules, not in the\n      // name of the role. The console team keeps the permission, to help when\n      // a change does not take effect.\n      initialRoles: ['console:admin', 'console:optionalTelemetryManager'],\n    },\n    {\n      value: CLUSTER_PLAN_CAN_MODIFY,\n      description: 'can trigger modifications of a clusterplan',\n      initialRoles: ['console:admin', 'console:clusterPlanManager'],\n    },\n    {\n      value: RELEASE_TRAIN_PUBLISH,\n      description: 'can publish new generations via the release train endpoint',\n      initialRoles: ['console:admin', 'console:C8ReleaseManager'],\n    },\n    {\n      value: APICLIENT_READ,\n      description: 'can read API Clients Names of Organizations',\n      initialRoles: ['accounts:read', 'accounts:orgCreator'],\n    },\n    {\n      value: APICLIENT_DELETE,\n      description: 'can read API Clients Names of Organizations',\n      initialRoles: ['accounts:god'],\n    },\n  ]\n}\n"],
-  "mappings": "AAQO,IAAU;AAAA,CAAV,CAAUA,wBAAV;AACE,EAAMA,oBAAA,qBAAqB;AAE3B,EAAMA,oBAAA,qDAAqD;AAC3D,EAAMA,oBAAA,qCAAqC;AAC3C,EAAMA,oBAAA,iCAAiC;AACvC,EAAMA,oBAAA,wDAAwD;AAC9D,EAAMA,oBAAA,yCAAyC;AAC/C,EAAMA,oBAAA,mCAAmC;AACzC,EAAMA,oBAAA,+BAAyC;AAAA,IACpDA,oBAAA;AAAA,IACAA,oBAAA;AAAA,IACAA,oBAAA;AAAA,EACF;AACO,EAAMA,oBAAA,8BAA8B;AACpC,EAAMA,oBAAA,0BAA0B;AAChC,EAAMA,oBAAA,iCAAiC;AACvC,EAAMA,oBAAA,6BAA6B;AACnC,EAAMA,oBAAA,sCAAsC;AAC5C,EAAMA,oBAAA,sCAAsC;AAC5C,EAAMA,oBAAA,iCAAiC;AACvC,EAAMA,oBAAA,sCAAsC;AAC5C,EAAMA,oBAAA,yCAAyC;AAE/C,EAAMA,oBAAA,uBAAuB;AAC7B,EAAMA,oBAAA,sBAAsB;AAC5B,EAAMA,oBAAA,sBAAsB;AAE5B,EAAMA,oBAAA,2BAA2B;AACjC,EAAMA,oBAAA,2BAA2B;AACjC,EAAMA,oBAAA,2BAA2B;AACjC,EAAMA,oBAAA,iCAAiC;AAEvC,EAAMA,oBAAA,uBAAuB;AAC7B,EAAMA,oBAAA,+CAA+C;AACrD,EAAMA,oBAAA,0BAA0B;AAEhC,EAAMA,oBAAA,iBAAiB;AACvB,EAAMA,oBAAA,aAAa;AACnB,EAAMA,oBAAA,oBAAoB;AAC1B,EAAMA,oBAAA,0BAA0B;AAChC,EAAMA,oBAAA,0BAA0B;AAChC,EAAMA,oBAAA,gCAAgC;AACtC,EAAMA,oBAAA,qBAAqB;AAC3B,EAAMA,oBAAA,+BAA+B;AACrC,EAAMA,oBAAA,2BAA2B;AACjC,EAAMA,oBAAA,qCAAqC;AAC3C,EAAMA,oBAAA,2BAA2B;AACjC,EAAMA,oBAAA,mBAAmB;AACzB,EAAMA,oBAAA,0BAA0B;AAChC,EAAMA,oBAAA,gBAAgB;AACtB,EAAMA,oBAAA,iCAAiC;AACvC,EAAMA,oBAAA,0CAA0C;AAEhD,EAAMA,oBAAA,QAAQ;AACd,EAAMA,oBAAA,oBAAoB;AAE1B,EAAMA,oBAAA,wBAAwB;AAE9B,EAAMA,oBAAA,iBAAiB;AACvB,EAAMA,oBAAA,mBAAmB;AAwEzB,WAAS,sBAAgC;AAC9C,WAAO;AAAA,MACL,WAAW;AAAA,QACT,MAAM;AAAA,QACN,QAAQ;AAAA,MACV;AAAA,MACA,cAAc,EAAE,OAAO,MAAM;AAAA,MAC7B,UAAU;AAAA,QACR,OAAO;AAAA,UACL,SAAS;AAAA,UACT,QAAQ;AAAA,UACR,sBAAsB;AAAA,UACtB,KAAK;AAAA,UACL,+BAA+B;AAAA,QACjC;AAAA,QACA,cAAc;AAAA,UACZ,SAAS;AAAA,QACX;AAAA,MACF;AAAA,MACA,UAAU;AAAA,QACR,uBAAuB;AAAA,QACvB,sBAAsB;AAAA,QACtB,mBAAmB;AAAA,QACnB,gBAAgB;AAAA,QAChB,gBAAgB;AAAA,QAChB,yBAAyB;AAAA,QACzB,0BAA0B;AAAA,QAC1B,oBAAoB;AAAA,QACpB,6BAA6B;AAAA,QAC7B,sBAAsB;AAAA,QACtB,0BAA0B;AAAA,QAC1B,4BAA4B;AAAA,MAC9B;AAAA,MACA,aAAa;AAAA,QACX,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,MAAM;AAAA,UACJ,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,aAAa;AAAA,QACf;AAAA,QACA,SAAS;AAAA,QACT,yBAAyB;AAAA,QACzB,QAAQ;AAAA,MACV;AAAA,MACA,UAAU;AAAA,QACR,SAAS;AAAA,QACT,gBAAgB;AAAA,QAChB,cAAc;AAAA,QACd,OAAO;AAAA,MACT;AAAA,MACA,KAAK;AAAA,QACH,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,mBAAmB;AAAA,QACnB,mBAAmB;AAAA,QACnB,iBAAiB;AAAA,QACjB,cAAc;AAAA,QACd,UAAU;AAAA,UACR,gBAAgB;AAAA,QAClB;AAAA,QACA,oBAAoB;AAAA,QACpB,6BAA6B;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AApEO,EAAAA,oBAAS;AAsET,EAAMA,oBAAA,qBAIR;AAAA,IACH;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,0BAA0B;AAAA,IAC5D;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC,iBAAiB,0BAA0B;AAAA,IAC5D;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,aAAa;AAAA,IAC9B;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA,EAAE,OAAOA,oBAAA,gBAAgB,aAAa,mBAAmB,cAAc,CAAC,EAAE;AAAA,IAC1E;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,iBAAiB;AAAA,IACnD;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,iBAAiB;AAAA,IACnD;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,4BAA4B;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,0BAA0B,eAAe;AAAA,IAC1D;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC,iBAAiB,4BAA4B;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,4BAA4B;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC,aAAa;AAAA,IAC9B;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMF,cAAc,CAAC,iBAAiB,kCAAkC;AAAA,IACpE;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,4BAA4B;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,0BAA0B;AAAA,IAC5D;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,qBAAqB;AAAA,IACvD;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,cAAc;AAAA,IAC/B;AAAA,EACF;AAAA,GA/ee;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type { Roles } from '../types/Roles.js'\n\nexport namespace ConsolePermissions {\n  export const MULTICLUSTER_ADMIN = 'cmca'\n\n  export const CHANNELS_AND_GENERATIONS_ADMIN_DELETE_ALL_CLUSTERS = 'cmgda'\n  export const CHANNELS_AND_GENERATIONS_ADMIN_SEE = 'cmgas'\n  export const CHANNELS_AND_GENERATIONS_ADMIN = 'cmga'\n  export const CHANNELS_AND_GENERATIONS_ADMIN_PATCH_EXISTING_CHANNEL = 'cmgap'\n  export const CHANNELS_AND_GENERATIONS_ADMIN_MIGRATE = 'cmgam'\n  export const CHANNELS_AND_GENERATIONS_MIGRATE = 'cmgm'\n  export const ALL_CHANNELS_AND_GENERATIONS: string[] = [\n    CHANNELS_AND_GENERATIONS_ADMIN_SEE,\n    CHANNELS_AND_GENERATIONS_ADMIN,\n    CHANNELS_AND_GENERATIONS_ADMIN_MIGRATE,\n  ]\n  export const CLUSTERS_READALLCLUSTERINFO = 'ccrai'\n  export const CLUSTERS_DELETE_CLUSTER = 'ccda'\n  export const CLUSTERS_CAN_MOVE_TO_OTHER_ORG = 'ccmoo'\n  export const CLUSTERS_CAN_SEND_TO_SLEEP = 'ccsts'\n  export const CLUSTERS_CAN_CREATE_INTERNAL_BACKUP = 'cccib'\n  export const CLUSTERS_CAN_UPDATE_CLUSTERPLANTYPE = 'ccucp'\n  export const CLUSTERS_CAN_UPDATE_GENERATION = 'ccug'\n  export const CLUSTERS_CAN_UPDATE_GENERATION_YOLO = 'ccugy'\n  export const CLUSTERS_CAN_UPDATE_OPTIONAL_TELEMETRY = 'ccuot'\n\n  export const CLUSTER_PLAN_SEE_ALL = 'ccpa'\n  export const CLUSTER_PLAN_CREATE = 'ccpc'\n  export const CLUSTER_PLAN_DELETE = 'ccpd'\n\n  export const CLUSTER_PLAN_TYPE_CREATE = 'cptc'\n  export const CLUSTER_PLAN_TYPE_MODIFY = 'cptm'\n  export const CLUSTER_PLAN_TYPE_DELETE = 'cptd'\n  export const CLUSTER_PLAN_TYPE_FORCE_DELETE = 'cptfd'\n\n  export const CLUSTER_PLAN_MIGRATE = 'ccpm'\n  export const CLUSTER_PLAN_CAN_DELETE_ALL_CLUSTERS_OF_PLAN = 'ccpda'\n  export const CLUSTER_PLAN_CAN_MODIFY = 'ccpmo'\n\n  export const M2M_UPDATE_CRD = 'cmuc'\n  export const M2M_SIGNUP = 'cms'\n  export const M2M_TRIGGER_ALERT = 'cmta'\n  export const M2M_DELETE_ORG_CLUSTERS = 'cmdoc'\n  export const M2M_UPDATE_ORG_CLUSTERS = 'cmuoc'\n  export const M2M_ADD_CLUSTER_USAGE_METRICS = 'cmacm'\n  export const M2M_SEND_SSE_EVENT = 'cmsse'\n  export const M2M_EXTERNAL_INTERNAL_CLIENT = 'cmeic'\n  export const M2M_FETCH_MIGRATION_DATA = 'cmfmd'\n  export const M2M_MANAGE_GENERATION_UPGRADE_PATH = 'cmmgup'\n\n  /**\n   * The one m2m permission of control-backend. It opens every route of\n   * `api/admin/approvals` in accounts-backend and in console-backend, which\n   * control-backend calls when a four-eyes request has the approvals that it\n   * needs.\n   *\n   * One permission for all of them, by a decision of the team: one grant at\n   * Auth0 for the whole approval surface of control-backend. A route that\n   * reads it runs an action that people already approved, so the permission\n   * goes to the m2m application of control-backend and to no other client.\n   *\n   * It is NOT the permission that a Camundi needs. A person needs the\n   * permission of the action, such as `CLUSTERS_CAN_MOVE_TO_OTHER_ORG`, and\n   * control-backend asks for that one before it accepts an approval.\n   */\n  export const M2M_CONTROL_APPROVALS = 'ctam'\n  /**\n   * Stands in for the permission of EVERY approval use case of\n   * control-backend, for a person who tests the approval flow.\n   *\n   * A holder can open, approve, reject and run each use case, including one\n   * that a later change adds, with no grant of its own permission. The four-eyes\n   * rule still holds: nobody approves their own request.\n   *\n   * It is a permission of a PERSON. No machine route reads it, because a token\n   * that a Camundi can get must not run an action with no approval. It goes to\n   * no role at Auth0: a person with access to the tenant grants it by hand, and\n   * only on a stage where the approval flow is under test.\n   */\n  export const APPROVALS_ALL_USE_CASES = 'caauc'\n  export const CLUSTER_CREATE_ON_BEHALF = 'cccob'\n  export const FEATURE_NEW_HOME = 'cfnh'\n  export const FEATURE_TEMPLATE_PICKER = 'cftp'\n  export const USER_SETTINGS = 'cus'\n  export const CLUSTERS_CAN_OVERRIDE_ENV_VARS = 'ccoev'\n  export const CLUSTERS_CAN_CREATE_MODIFICATION_CONFIG = 'ccccmc'\n\n  export const DEBUG = 'cdbg'\n  export const GOD_TRIGGER_CRONS = 'gtc'\n\n  export const RELEASE_TRAIN_PUBLISH = 'crtp'\n\n  export const APICLIENT_READ = 'capr'\n  export const APICLIENT_DELETE = 'capd'\n\n  export interface Features {\n    apiClient: {\n      read: boolean\n      delete: boolean\n    }\n    multiCluster: {\n      admin: boolean\n    }\n    multiGen: {\n      admin: {\n        see: boolean\n        modify: boolean\n        patchExistingChannel: boolean\n        migrate: boolean\n        deleteAllClustersOfGeneration: boolean\n      }\n      releaseTrain: {\n        publish: boolean\n      }\n    }\n    clusters: {\n      canReadAllClusterInfo: boolean\n      canDeleteAllClusters: boolean\n      canMoveToOtherOrg: boolean\n      createOnBehalf: boolean\n      canSendToSleep: boolean\n      canCreateInternalBackup: boolean\n      canUpdateClusterPlanType: boolean\n      canOverrideEnvVars: boolean\n      canCreateModificationConfig: boolean\n      canUpgradeGeneration: boolean\n      canUpgradeGenerationYolo: boolean\n      canUpdateOptionalTelemetry: boolean\n    }\n    clusterPlan: {\n      seeAll: boolean\n      create: boolean\n      delete: boolean\n      type: {\n        create: boolean\n        modify: boolean\n        delete: boolean\n        forceDelete: boolean\n      }\n      migrate: boolean\n      deleteAllClustersOfPlan: boolean\n      modify: boolean\n    }\n    features: {\n      newHome: boolean\n      templatePicker: boolean\n      userSettings: boolean\n      debug: boolean\n    }\n    m2m: {\n      updateCrd: boolean\n      signup: boolean\n      triggerAlert: boolean\n      deleteOrgClusters: boolean\n      updateOrgClusters: boolean\n      addUsageMetrics: boolean\n      sendSseEvent: boolean\n      external: {\n        internalClient: boolean\n      }\n      fetchMigrationData: boolean\n      manageGenerationUpgradePath: boolean\n      /** Every route of `api/admin/approvals`. See `M2M_CONTROL_APPROVALS`. */\n      approvals: boolean\n    }\n  }\n\n  export function createEmptyFeatures(): Features {\n    return {\n      apiClient: {\n        read: false,\n        delete: false,\n      },\n      multiCluster: { admin: false },\n      multiGen: {\n        admin: {\n          migrate: false,\n          modify: false,\n          patchExistingChannel: false,\n          see: false,\n          deleteAllClustersOfGeneration: false,\n        },\n        releaseTrain: {\n          publish: false,\n        },\n      },\n      clusters: {\n        canReadAllClusterInfo: false,\n        canDeleteAllClusters: false,\n        canMoveToOtherOrg: false,\n        createOnBehalf: false,\n        canSendToSleep: false,\n        canCreateInternalBackup: false,\n        canUpdateClusterPlanType: false,\n        canOverrideEnvVars: false,\n        canCreateModificationConfig: false,\n        canUpgradeGeneration: false,\n        canUpgradeGenerationYolo: false,\n        canUpdateOptionalTelemetry: false,\n      },\n      clusterPlan: {\n        seeAll: false,\n        create: false,\n        delete: false,\n        type: {\n          create: false,\n          modify: false,\n          delete: false,\n          forceDelete: false,\n        },\n        migrate: false,\n        deleteAllClustersOfPlan: false,\n        modify: false,\n      },\n      features: {\n        newHome: false,\n        templatePicker: false,\n        userSettings: false,\n        debug: false,\n      },\n      m2m: {\n        updateCrd: false,\n        signup: false,\n        triggerAlert: false,\n        deleteOrgClusters: false,\n        updateOrgClusters: false,\n        addUsageMetrics: false,\n        sendSseEvent: false,\n        external: {\n          internalClient: false,\n        },\n        fetchMigrationData: false,\n        manageGenerationUpgradePath: false,\n        approvals: false,\n      },\n    }\n  }\n\n  export const PermissionsAtAuth0: Array<{\n    value: string\n    description: string\n    initialRoles: Roles[]\n  }> = [\n    {\n      value: MULTICLUSTER_ADMIN,\n      description: 'can create and delete k8s clusters',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CHANNELS_AND_GENERATIONS_ADMIN_SEE,\n      description: 'can go to the admin section for MultiGen, but no touch!',\n      initialRoles: [\n        'console:admin',\n        'console:admin:readonly',\n        'support:agent',\n        'supersupport:agent',\n        'accounts:clusterUpdates',\n        'console:C8ReleaseManager',\n        'console:C8UpdateEnforcer',\n      ],\n    },\n    {\n      value: CHANNELS_AND_GENERATIONS_ADMIN,\n      description: 'can create channels, generations and combine them',\n      initialRoles: ['console:admin', 'console:C8ReleaseManager'],\n    },\n    {\n      value: CHANNELS_AND_GENERATIONS_ADMIN_PATCH_EXISTING_CHANNEL,\n      description: 'can modify existing channels and combine them',\n      initialRoles: [\n        'console:admin',\n        'accounts:clusterUpdates',\n        'console:C8ReleaseManager',\n      ],\n    },\n    {\n      value: CHANNELS_AND_GENERATIONS_ADMIN_MIGRATE,\n      description:\n        'can migrate clusters of generations to supported other generations',\n      initialRoles: ['console:admin', 'console:C8UpdateEnforcer'],\n    },\n    {\n      value: CHANNELS_AND_GENERATIONS_ADMIN_DELETE_ALL_CLUSTERS,\n      description: 'can delete all clusters of a generation',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CHANNELS_AND_GENERATIONS_MIGRATE,\n      description:\n        'can migrate owned clusters of generations to supported other generations',\n      initialRoles: [],\n    },\n    {\n      value: CLUSTERS_READALLCLUSTERINFO,\n      description: 'can read clusterInfo for all clusters',\n      initialRoles: [\n        'accounts:read',\n        'accounts:onboard',\n        'accounts:orgCreator',\n        'accounts:admin',\n        'accounts:editSalesPlans',\n        'console:admin:readonly',\n        'support:agent',\n        'supersupport:agent',\n        'console:admin',\n        'accounts:trialExtender',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: CLUSTERS_DELETE_CLUSTER,\n      description: 'can delete clusters in all orgs',\n      initialRoles: ['accounts:admin'],\n    },\n    {\n      value: CLUSTERS_CAN_MOVE_TO_OTHER_ORG,\n      description: 'can move a cluster to another org the user is part of',\n      // CSMs, TAMs and consultants move a cluster to another org for a\n      // customer, thus the capability goes to `console:clusterMover`. The\n      // population that holds the role lives in the Camundi permission\n      // rules, not in the name of the role.\n      initialRoles: ['console:admin', 'console:clusterMover'],\n    },\n    {\n      value: CLUSTER_PLAN_SEE_ALL,\n      description: 'can see all ClusterPlans',\n      initialRoles: [\n        'console:admin',\n        'accounts:read',\n        'accounts:orgCreator',\n        'accounts:admin',\n        'console:admin:readonly',\n        'support:agent',\n        'supersupport:agent',\n        'accounts:onboard',\n        'accounts:editSalesPlans',\n        'accounts:trialExtender',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: CLUSTER_PLAN_CREATE,\n      description: 'can create ClusterPlans',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CLUSTER_PLAN_DELETE,\n      description: 'can delete ClusterPlans',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CLUSTER_PLAN_TYPE_CREATE,\n      description: 'can create ClusterPlanTypes',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CLUSTER_PLAN_TYPE_DELETE,\n      description: 'can delete ClusterPlanTypes',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CLUSTER_PLAN_TYPE_FORCE_DELETE,\n      description: 'can delete ClusterPlanTypes',\n      initialRoles: ['console:god'],\n    },\n    {\n      value: CLUSTER_PLAN_TYPE_MODIFY,\n      description: 'can modify ClusterPlanTypes',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CLUSTER_PLAN_MIGRATE,\n      description: 'can migrate Clusters from one plan to another',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CLUSTER_PLAN_CAN_DELETE_ALL_CLUSTERS_OF_PLAN,\n      description: 'can delete all clusters of a plan',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CLUSTER_CREATE_ON_BEHALF,\n      description:\n        'enables accounts to create clusters on signup (not a user permission)',\n      initialRoles: [],\n    },\n    {\n      value: M2M_SIGNUP,\n      description: 'allows to signal to Console new user signups',\n      initialRoles: [],\n    },\n    { value: M2M_UPDATE_CRD, description: 'may update crds', initialRoles: [] },\n    {\n      value: M2M_TRIGGER_ALERT,\n      description: 'allows Infra and Operate to trigger alerts',\n      initialRoles: [],\n    },\n    {\n      value: M2M_DELETE_ORG_CLUSTERS,\n      description:\n        'allows trigger console to delete all clusters of an Organization',\n      initialRoles: [],\n    },\n    {\n      value: M2M_UPDATE_ORG_CLUSTERS,\n      description: 'allows to update clusters of an Organization',\n      initialRoles: [],\n    },\n    {\n      value: M2M_ADD_CLUSTER_USAGE_METRICS,\n      description: 'allows to trigger update of value metrics',\n      initialRoles: [],\n    },\n    {\n      value: M2M_SEND_SSE_EVENT,\n      description: 'allows to trigger SSE events',\n      initialRoles: [],\n    },\n    {\n      value: M2M_EXTERNAL_INTERNAL_CLIENT,\n      description: 'allows to fetch internal clients',\n      initialRoles: [],\n    },\n    // `initialRoles` is empty, and it must stay empty. A machine client holds\n    // a grant on its Auth0 application, and never a role. An entry here with a\n    // role would give the permission to every person in that role.\n    {\n      value: M2M_CONTROL_APPROVALS,\n      description:\n        'm2m can run the approved actions of control-backend in accounts and console',\n      initialRoles: [],\n    },\n    // No role, on purpose. This permission opens every approval use case, so\n    // a person with access to the tenant grants it by hand, for testing.\n    {\n      value: APPROVALS_ALL_USE_CASES,\n      description:\n        'can open, approve, reject and run every approval use case of Control (for testing)',\n      initialRoles: [],\n    },\n    {\n      value: M2M_FETCH_MIGRATION_DATA,\n      description: 'allows to fetch migration data',\n      initialRoles: [],\n    },\n    {\n      value: M2M_MANAGE_GENERATION_UPGRADE_PATH,\n      description:\n        'allows to manage upgrade paths for generations via external API',\n      initialRoles: [],\n    },\n    {\n      value: FEATURE_NEW_HOME,\n      description: 'allows users to see new home',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: USER_SETTINGS,\n      description: 'allows users to see user settings',\n      initialRoles: ['console:admin', 'betatester:true'],\n    },\n    {\n      value: FEATURE_TEMPLATE_PICKER,\n      description: 'allows users to see template picker',\n      initialRoles: ['console:admin', 'betatester:true'],\n    },\n    {\n      value: CLUSTERS_CAN_SEND_TO_SLEEP,\n      description: 'may send a cluster to sleep and wake up',\n      initialRoles: [\n        'console:admin',\n        'accounts:admin',\n        'console:operationsEngineer',\n      ],\n    },\n    {\n      value: CLUSTERS_CAN_CREATE_INTERNAL_BACKUP,\n      description: 'may create and delete internal (incident) backups',\n      initialRoles: ['console:admin', 'console:operationsEngineer'],\n    },\n    {\n      value: DEBUG,\n      description: 'can see additional debugging tools',\n      initialRoles: ['console:admin:readonly', 'console:admin'],\n    },\n    {\n      value: CLUSTERS_CAN_OVERRIDE_ENV_VARS,\n      description:\n        'can set Env Vars on cluster level that override all ClusterPlan Env Vars',\n      initialRoles: ['console:admin', 'console:operationsEngineer'],\n    },\n    {\n      value: CLUSTERS_CAN_CREATE_MODIFICATION_CONFIG,\n      description: 'can create cluster modification configs',\n      initialRoles: ['console:admin', 'console:operationsEngineer'],\n    },\n    {\n      value: CLUSTERS_CAN_UPDATE_CLUSTERPLANTYPE,\n      description: 'can update clusterplantype of a running cluster',\n      initialRoles: [\n        'console:admin',\n        'accounts:onboard',\n        'console:operationsEngineer',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: CLUSTERS_CAN_UPDATE_GENERATION,\n      description: 'can update generation of a running cluster',\n      initialRoles: [\n        'console:admin',\n        'accounts:clusterUpdates',\n        'console:C8ReleaseManager',\n      ],\n    },\n    {\n      value: CLUSTERS_CAN_UPDATE_GENERATION_YOLO,\n      description:\n        'can update generation of a running cluster even if the generation is not reachable',\n      initialRoles: ['console:god'],\n    },\n    {\n      value: CLUSTERS_CAN_UPDATE_OPTIONAL_TELEMETRY,\n      description:\n        'can enable or disable optional product telemetry for a cluster',\n      // A customer asks their CSM or TAM to switch the category off, thus the\n      // capability goes to `console:optionalTelemetryManager`. The population\n      // that holds the role lives in the Camundi permission rules, not in the\n      // name of the role. The console team keeps the permission, to help when\n      // a change does not take effect.\n      initialRoles: ['console:admin', 'console:optionalTelemetryManager'],\n    },\n    {\n      value: CLUSTER_PLAN_CAN_MODIFY,\n      description: 'can trigger modifications of a clusterplan',\n      initialRoles: ['console:admin', 'console:clusterPlanManager'],\n    },\n    {\n      value: RELEASE_TRAIN_PUBLISH,\n      description: 'can publish new generations via the release train endpoint',\n      initialRoles: ['console:admin', 'console:C8ReleaseManager'],\n    },\n    {\n      value: APICLIENT_READ,\n      description: 'can read API Clients Names of Organizations',\n      initialRoles: ['accounts:read', 'accounts:orgCreator'],\n    },\n    {\n      value: APICLIENT_DELETE,\n      description: 'can read API Clients Names of Organizations',\n      initialRoles: ['accounts:god'],\n    },\n  ]\n}\n"],
+  "mappings": "AAQO,IAAU;AAAA,CAAV,CAAUA,wBAAV;AACE,EAAMA,oBAAA,qBAAqB;AAE3B,EAAMA,oBAAA,qDAAqD;AAC3D,EAAMA,oBAAA,qCAAqC;AAC3C,EAAMA,oBAAA,iCAAiC;AACvC,EAAMA,oBAAA,wDAAwD;AAC9D,EAAMA,oBAAA,yCAAyC;AAC/C,EAAMA,oBAAA,mCAAmC;AACzC,EAAMA,oBAAA,+BAAyC;AAAA,IACpDA,oBAAA;AAAA,IACAA,oBAAA;AAAA,IACAA,oBAAA;AAAA,EACF;AACO,EAAMA,oBAAA,8BAA8B;AACpC,EAAMA,oBAAA,0BAA0B;AAChC,EAAMA,oBAAA,iCAAiC;AACvC,EAAMA,oBAAA,6BAA6B;AACnC,EAAMA,oBAAA,sCAAsC;AAC5C,EAAMA,oBAAA,sCAAsC;AAC5C,EAAMA,oBAAA,iCAAiC;AACvC,EAAMA,oBAAA,sCAAsC;AAC5C,EAAMA,oBAAA,yCAAyC;AAE/C,EAAMA,oBAAA,uBAAuB;AAC7B,EAAMA,oBAAA,sBAAsB;AAC5B,EAAMA,oBAAA,sBAAsB;AAE5B,EAAMA,oBAAA,2BAA2B;AACjC,EAAMA,oBAAA,2BAA2B;AACjC,EAAMA,oBAAA,2BAA2B;AACjC,EAAMA,oBAAA,iCAAiC;AAEvC,EAAMA,oBAAA,uBAAuB;AAC7B,EAAMA,oBAAA,+CAA+C;AACrD,EAAMA,oBAAA,0BAA0B;AAEhC,EAAMA,oBAAA,iBAAiB;AACvB,EAAMA,oBAAA,aAAa;AACnB,EAAMA,oBAAA,oBAAoB;AAC1B,EAAMA,oBAAA,0BAA0B;AAChC,EAAMA,oBAAA,0BAA0B;AAChC,EAAMA,oBAAA,gCAAgC;AACtC,EAAMA,oBAAA,qBAAqB;AAC3B,EAAMA,oBAAA,+BAA+B;AACrC,EAAMA,oBAAA,2BAA2B;AACjC,EAAMA,oBAAA,qCAAqC;AAiB3C,EAAMA,oBAAA,wBAAwB;AAc9B,EAAMA,oBAAA,0BAA0B;AAChC,EAAMA,oBAAA,2BAA2B;AACjC,EAAMA,oBAAA,mBAAmB;AACzB,EAAMA,oBAAA,0BAA0B;AAChC,EAAMA,oBAAA,gBAAgB;AACtB,EAAMA,oBAAA,iCAAiC;AACvC,EAAMA,oBAAA,0CAA0C;AAEhD,EAAMA,oBAAA,QAAQ;AACd,EAAMA,oBAAA,oBAAoB;AAE1B,EAAMA,oBAAA,wBAAwB;AAE9B,EAAMA,oBAAA,iBAAiB;AACvB,EAAMA,oBAAA,mBAAmB;AA0EzB,WAAS,sBAAgC;AAC9C,WAAO;AAAA,MACL,WAAW;AAAA,QACT,MAAM;AAAA,QACN,QAAQ;AAAA,MACV;AAAA,MACA,cAAc,EAAE,OAAO,MAAM;AAAA,MAC7B,UAAU;AAAA,QACR,OAAO;AAAA,UACL,SAAS;AAAA,UACT,QAAQ;AAAA,UACR,sBAAsB;AAAA,UACtB,KAAK;AAAA,UACL,+BAA+B;AAAA,QACjC;AAAA,QACA,cAAc;AAAA,UACZ,SAAS;AAAA,QACX;AAAA,MACF;AAAA,MACA,UAAU;AAAA,QACR,uBAAuB;AAAA,QACvB,sBAAsB;AAAA,QACtB,mBAAmB;AAAA,QACnB,gBAAgB;AAAA,QAChB,gBAAgB;AAAA,QAChB,yBAAyB;AAAA,QACzB,0BAA0B;AAAA,QAC1B,oBAAoB;AAAA,QACpB,6BAA6B;AAAA,QAC7B,sBAAsB;AAAA,QACtB,0BAA0B;AAAA,QAC1B,4BAA4B;AAAA,MAC9B;AAAA,MACA,aAAa;AAAA,QACX,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,MAAM;AAAA,UACJ,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,aAAa;AAAA,QACf;AAAA,QACA,SAAS;AAAA,QACT,yBAAyB;AAAA,QACzB,QAAQ;AAAA,MACV;AAAA,MACA,UAAU;AAAA,QACR,SAAS;AAAA,QACT,gBAAgB;AAAA,QAChB,cAAc;AAAA,QACd,OAAO;AAAA,MACT;AAAA,MACA,KAAK;AAAA,QACH,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,mBAAmB;AAAA,QACnB,mBAAmB;AAAA,QACnB,iBAAiB;AAAA,QACjB,cAAc;AAAA,QACd,UAAU;AAAA,UACR,gBAAgB;AAAA,QAClB;AAAA,QACA,oBAAoB;AAAA,QACpB,6BAA6B;AAAA,QAC7B,WAAW;AAAA,MACb;AAAA,IACF;AAAA,EACF;AArEO,EAAAA,oBAAS;AAuET,EAAMA,oBAAA,qBAIR;AAAA,IACH;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,0BAA0B;AAAA,IAC5D;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC,iBAAiB,0BAA0B;AAAA,IAC5D;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA,MAKb,cAAc,CAAC,iBAAiB,sBAAsB;AAAA,IACxD;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,aAAa;AAAA,IAC9B;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA,EAAE,OAAOA,oBAAA,gBAAgB,aAAa,mBAAmB,cAAc,CAAC,EAAE;AAAA,IAC1E;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA;AAAA;AAAA;AAAA,IAIA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA;AAAA;AAAA,IAGA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,iBAAiB;AAAA,IACnD;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,iBAAiB;AAAA,IACnD;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,4BAA4B;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,0BAA0B,eAAe;AAAA,IAC1D;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC,iBAAiB,4BAA4B;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,4BAA4B;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC,aAAa;AAAA,IAC9B;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMF,cAAc,CAAC,iBAAiB,kCAAkC;AAAA,IACpE;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,4BAA4B;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,0BAA0B;AAAA,IAC5D;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,qBAAqB;AAAA,IACvD;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,cAAc;AAAA,IAC/B;AAAA,EACF;AAAA,GAtiBe;",
   "names": ["ConsolePermissions"]
 }

package/dist/types/Roles.d.ts

@@ -1,5 +1,5 @@
 export type AccountRoles = 'accounts:read' | 'accounts:onboard' | 'accounts:orgCreator' | 'accounts:enterpriseAdmin' | 'accounts:enterpriseOffboarding' | 'accounts:admin' | 'accounts:god' | 'accounts:editSalesPlans' | 'support:agent' | 'supersupport:agent' | 'accounts:trialExtender' | 'accounts:limitExtender' | 'accounts:connections:create' | 'accounts:connections:update' | 'accounts:connections:delete' | 'accounts:clusterUpdates' | 'accounts:notifications:global' | 'accounts:addSafeRoles' | 'accounts:consultingManager' | 'accounts:earlyAccessEditor' | 'accounts:pdfWatermarkReader' | 'accounts:pdfWatermarkWriter';
-export type ConsoleRoles = 'console:admin' | 'betatester:true' | 'console:admin:readonly' | 'console:god' | 'consoleTeam' | 'console:operationsEngineer' | 'console:C8ReleaseManager' | 'console:C8UpdateEnforcer' | 'console:clusterPlanManager' | 'console:optionalTelemetryManager';
+export type ConsoleRoles = 'console:admin' | 'betatester:true' | 'console:admin:readonly' | 'console:god' | 'consoleTeam' | 'console:operationsEngineer' | 'console:C8ReleaseManager' | 'console:C8UpdateEnforcer' | 'console:clusterPlanManager' | 'console:optionalTelemetryManager' | 'console:clusterMover';
 export type ModelerRoles = 'modeler:admin';
 export type Roles = AccountRoles | ConsoleRoles | ModelerRoles;
 export declare const SAFE_ROLES: Roles[];

package/dist/types/Roles.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/types/Roles.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nexport type AccountRoles =\n  | 'accounts:read'\n  | 'accounts:onboard'\n  | 'accounts:orgCreator'\n  | 'accounts:enterpriseAdmin'\n  | 'accounts:enterpriseOffboarding'\n  | 'accounts:admin'\n  | 'accounts:god'\n  | 'accounts:editSalesPlans'\n  | 'support:agent'\n  | 'supersupport:agent'\n  | 'accounts:trialExtender'\n  | 'accounts:limitExtender'\n  | 'accounts:connections:create'\n  | 'accounts:connections:update'\n  | 'accounts:connections:delete'\n  | 'accounts:clusterUpdates'\n  | 'accounts:notifications:global'\n  | 'accounts:addSafeRoles'\n  | 'accounts:consultingManager'\n  | 'accounts:earlyAccessEditor'\n  | 'accounts:pdfWatermarkReader'\n  | 'accounts:pdfWatermarkWriter'\nexport type ConsoleRoles =\n  | 'console:admin'\n  | 'betatester:true'\n  | 'console:admin:readonly'\n  | 'console:god'\n  | 'consoleTeam'\n  | 'console:operationsEngineer'\n  | 'console:C8ReleaseManager'\n  | 'console:C8UpdateEnforcer'\n  | 'console:clusterPlanManager'\n  | 'console:optionalTelemetryManager'\nexport type ModelerRoles = 'modeler:admin'\nexport type Roles = AccountRoles | ConsoleRoles | ModelerRoles\nexport const SAFE_ROLES: Roles[] = [\n  'accounts:read',\n  'console:admin:readonly',\n  'accounts:trialExtender',\n]\n"],
-  "mappings": "AA0CO,MAAM,aAAsB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AACF;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nexport type AccountRoles =\n  | 'accounts:read'\n  | 'accounts:onboard'\n  | 'accounts:orgCreator'\n  | 'accounts:enterpriseAdmin'\n  | 'accounts:enterpriseOffboarding'\n  | 'accounts:admin'\n  | 'accounts:god'\n  | 'accounts:editSalesPlans'\n  | 'support:agent'\n  | 'supersupport:agent'\n  | 'accounts:trialExtender'\n  | 'accounts:limitExtender'\n  | 'accounts:connections:create'\n  | 'accounts:connections:update'\n  | 'accounts:connections:delete'\n  | 'accounts:clusterUpdates'\n  | 'accounts:notifications:global'\n  | 'accounts:addSafeRoles'\n  | 'accounts:consultingManager'\n  | 'accounts:earlyAccessEditor'\n  | 'accounts:pdfWatermarkReader'\n  | 'accounts:pdfWatermarkWriter'\nexport type ConsoleRoles =\n  | 'console:admin'\n  | 'betatester:true'\n  | 'console:admin:readonly'\n  | 'console:god'\n  | 'consoleTeam'\n  | 'console:operationsEngineer'\n  | 'console:C8ReleaseManager'\n  | 'console:C8UpdateEnforcer'\n  | 'console:clusterPlanManager'\n  | 'console:optionalTelemetryManager'\n  | 'console:clusterMover'\nexport type ModelerRoles = 'modeler:admin'\nexport type Roles = AccountRoles | ConsoleRoles | ModelerRoles\nexport const SAFE_ROLES: Roles[] = [\n  'accounts:read',\n  'console:admin:readonly',\n  'accounts:trialExtender',\n]\n"],
+  "mappings": "AA2CO,MAAM,aAAsB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AACF;",
   "names": []
 }

package/dist/utils/versionCheck.utils.d.ts

@@ -55,6 +55,15 @@ export declare const normalizeGenerationVersion: (version: string) => string;
  * hold tags such as `3.9.0-preview-1`, and a read of those must still work.
  */
 export declare const isValidGenerationImage: (image: string | undefined) => boolean;
+/**
+ * The message for an image that `isValidGenerationImage` refuses. The route
+ * and the controller both refuse an image, thus both read this function. One
+ * message keeps the two answers the same.
+ *
+ * The message names the field. A generation holds eight images, and a message
+ * without the field name makes a Camundi read all eight to find the bad one.
+ */
+export declare const generationImageErrorMessage: (field: string, image: unknown) => string;
 export declare enum VersionCheckOperator {
     LessThan = 0,
     LessThanOrEqual = 1,

package/dist/utils/versionCheck.utils.js

@@ -43,7 +43,7 @@ const normalizeGenerationVersion = (version) => {
 };
 const SNAPSHOT_TAG = /^(?:\d+(?:\.\d+)?-)?SNAPSHOT$/;
 const isValidGenerationImage = (image) => {
-  if (!image) {
+  if (!image || /\s/.test(image)) {
     return false;
   }
   const lastColon = image.lastIndexOf(":");
@@ -51,8 +51,12 @@ const isValidGenerationImage = (image) => {
     return false;
   }
   const tag = image.slice(lastColon + 1);
-  return SNAPSHOT_TAG.test(tag) || semver.valid(tag) !== null;
+  if (SNAPSHOT_TAG.test(tag)) {
+    return true;
+  }
+  return semver.valid(tag) === tag;
 };
+const generationImageErrorMessage = (field, image) => `${field} image "${image}" does not obey the tag grammar. Use repository:tag, and a tag such as 8.10.1, 8.10.0-alpha5 or 8.10-SNAPSHOT.`;
 const extractVersion = (possiblyVersionOrDockerPath) => {
   const raw = possiblyVersionOrDockerPath ?? "";
   if (semver.valid(raw)) {
@@ -225,6 +229,7 @@ const isSecretsFilterModeConfigurable = (zeebeVersion) => {
 export {
   VersionCheckOperator,
   checkVersion,
+  generationImageErrorMessage,
   isAppIntegrationsVersionSupported,
   isGenerationResumable,
   isSecretsFilterModeConfigurable,

package/dist/utils/versionCheck.utils.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/utils/versionCheck.utils.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport * as semver from 'semver'\nimport {\n  APP_INTEGRATIONS_89_STREAM_CONNECTOR_BRIDGE_MIN_VERSION,\n  APP_INTEGRATIONS_89_STREAM_MINOR,\n  APP_INTEGRATIONS_89_STREAM_ZEEBE_MIN_VERSION,\n  APP_INTEGRATIONS_MIN_VERSION,\n  RESUME_ALPHA_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_6_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_7_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_8_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_9_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_10_MIN_VERSION,\n} from '../constants/version-gates.const.js'\n\n/**\n * stripSecfixPostfix removes the `-secfix` postfix of a version.\n *\n * A security patch tags the images of a generation with the postfix\n * (`8.8.19-secfix`). Semver reads the postfix as a prerelease, which sorts\n * under the release it patches. A `>= 8.8.19` gate thus refuses a patched\n * build of 8.8.19 itself. The postfix holds no version information, so it\n * comes off before every comparison.\n *\n * Only the postfix comes off, not the whole prerelease. A patched alpha\n * (`8.10.0-alpha5-secfix`) stays an alpha, which the 8.10 floors and\n * `isGenerationResumable` both depend on.\n *\n * A surface that shows a version reads this helper too, because the postfix is\n * an internal build detail. One helper keeps the version a customer sees and\n * the version a gate compares on the same rule.\n */\nexport const stripSecfixPostfix = (version: string): string => {\n  // A search for the marker, and not a regular expression. `-secfix.*$` over\n  // the input of an exported function is a polynomial backtracking pattern,\n  // which code scanning rejects (CodeQL js/polynomial-redos).\n  const postfixStart = version.toLowerCase().indexOf('-secfix')\n  return postfixStart === -1 ? version : version.slice(0, postfixStart)\n}\n\n/**\n * The grammar of an image tag, as camunda/camunda-operator#6016 defines it.\n * `SNAPSHOT` keeps its own shape, thus the pattern does not cover it.\n *\n * A tag holds a version, and after the version it can hold one suffix:\n * - An alpha suffix (`-alpha5`, `-alpha1.1`) names a prerelease cohort.\n * - Every other suffix (`-rc1`, `-secfix`, `-hotfix1`) is a build detail of\n *   the release. The build has the content of the release, thus the suffix\n *   holds no version information.\n */\n// The lookahead needs a hyphen or the end of the tag after the alpha number.\n// Without it, an optional digit group lets the pattern match the `alpha`\n// prefix of a tag such as `alphatest1`. That tag is not an alpha, but the\n// pattern still matches it and drops the text after `alpha`.\n//\n// The digit group itself is not optional. The grammar names a cohort\n// `alphaN`, never bare `alpha`, so a bare `-alpha` suffix must fall to the\n// release, the same as every other suffix that is not a numbered cohort.\nconst ALPHA_PRERELEASE = /^alpha(\\d+(?:\\.\\d+)*)(?=$|-)/i\n\n/**\n * Gives an alpha identifier a dot before its number, thus semver compares the\n * number as a number. Without the dot semver compares `alpha10` and `alpha6`\n * as text, and `alpha10` sorts under `alpha6`.\n *\n * Text after the alpha number comes off, because the operator does not\n * support it. A patched alpha (`8.10.0-alpha5-secfix`) stays alpha5, which the\n * 8.10 floors and `isGenerationResumable` both depend on.\n *\n * A version that has no alpha comes back unchanged. A floor reads this\n * function alone, thus a floor keeps a prerelease that is not an alpha. The\n * sentinel `8.10.0-0` of `LINE_8_10_MIN_VERSION` needs that: it must sort\n * under every 8.10 prerelease, and a strip would make it the 8.10.0 release.\n */\nconst padAlphaIdentifier = (version: string): string => {\n  const parsed = semver.parse(version)\n  if (!parsed || parsed.prerelease.length === 0) {\n    return version\n  }\n  // The whole prerelease, not its first identifier. semver splits\n  // `alpha1.1` at the dot, and the fix number is the part after it.\n  const alpha = ALPHA_PRERELEASE.exec(parsed.prerelease.join('.'))\n  if (!alpha) {\n    return version\n  }\n  // The digit group is mandatory in `ALPHA_PRERELEASE`, thus `alpha[1]`\n  // always holds a value here.\n  const release = `${parsed.major}.${parsed.minor}.${parsed.patch}`\n  return `${release}-alpha.${alpha[1]}`\n}\n\n/**\n * Makes an image tag comparable with the rules of the operator. Two problems\n * need this, and both cost a support ticket (INC-8048):\n *\n * 1. semver sorts a prerelease UNDER its release, thus `8.8.19-hotfix1` fails\n *    a `>= 8.8.19` gate. The operator reads that build as 8.8.19, because the\n *    build holds the content of 8.8.19 plus a hotfix. Thus every suffix that\n *    is not an alpha comes off.\n * 2. semver compares an alpha identifier as text. `padAlphaIdentifier`\n *    corrects that.\n *\n * A `SNAPSHOT` tag comes back unchanged. `checkVersion` expands it, and only\n * when the caller asks for it with `trueForSnapshot`.\n *\n * Use this function for a tag, not for a floor. A floor is a boundary that we\n * write, thus it reads `padAlphaIdentifier` alone.\n */\nexport const normalizeGenerationVersion = (version: string): string => {\n  if (version.includes('SNAPSHOT')) {\n    return version\n  }\n  const parsed = semver.parse(version)\n  if (!parsed || parsed.prerelease.length === 0) {\n    return version\n  }\n  if (!ALPHA_PRERELEASE.test(parsed.prerelease.join('.'))) {\n    return `${parsed.major}.${parsed.minor}.${parsed.patch}`\n  }\n  return padAlphaIdentifier(version)\n}\n\n/**\n * The SNAPSHOT tags of the grammar. A SNAPSHOT build comes from the head of a\n * branch, thus it has no patch number, and sometimes no minor number.\n */\nconst SNAPSHOT_TAG = /^(?:\\d+(?:\\.\\d+)?-)?SNAPSHOT$/\n\n/**\n * Is this value an image that a generation can use? The value must have the\n * form `repository:tag`, and the tag must obey the grammar of the operator\n * (camunda/camunda-operator#6016).\n *\n * The tag is the text after the LAST colon, not the second colon-delimited\n * segment. A registry host can carry a port\n * (`registry.example.com:5000/zeebe:8.10.0`), and `secfixGenerationArtifacts.ts`\n * already rewrites images of that shape.\n *\n * The grammar permits a suffix after the version, and this function does not\n * limit the text of that suffix. Two reasons:\n * - A security patch tags an alpha `8.10.0-alpha5-secfix`. Such images are in\n *   production today, and the retag job makes more of them.\n * - The operator removes a suffix that it does not know, thus an unknown\n *   suffix is safe. `normalizeGenerationVersion` does the same.\n *\n * Use this function at creation only. Generations from before the grammar\n * hold tags such as `3.9.0-preview-1`, and a read of those must still work.\n */\nexport const isValidGenerationImage = (image: string | undefined): boolean => {\n  if (!image) {\n    return false\n  }\n  const lastColon = image.lastIndexOf(':')\n  // A colon at the start leaves an empty repository, thus `lastColon <= 0`\n  // rejects both no colon (`-1`) and an empty repository (`0`).\n  if (lastColon <= 0) {\n    return false\n  }\n  const tag = image.slice(lastColon + 1)\n  return SNAPSHOT_TAG.test(tag) || semver.valid(tag) !== null\n}\n\n/**\n * Takes the version out of a generation version field. The field holds either a\n * bare version (`8.10.0-alpha4`) or a docker path\n * (`camunda/zeebe:8.10.0-alpha4`, or `registry.example.com:5000/zeebe:8.10.0-alpha4`\n * for a registry with a port). A value that is neither comes back unchanged,\n * so the caller can still expand a `SNAPSHOT` tag.\n *\n * The version is the text after the LAST colon, not the second colon-delimited\n * segment \u2014 a registry port is also a colon-delimited segment, and comes\n * before the version, not after it.\n */\nconst extractVersion = (possiblyVersionOrDockerPath?: string): string => {\n  const raw = possiblyVersionOrDockerPath ?? ''\n  if (semver.valid(raw)) {\n    return normalizeGenerationVersion(raw)\n  }\n  const lastColon = raw.lastIndexOf(':')\n  if (lastColon !== -1) {\n    return normalizeGenerationVersion(raw.slice(lastColon + 1))\n  }\n  // bare version string not valid semver (e.g. '8.10-SNAPSHOT') \u2014 use as-is so SNAPSHOT expansion can handle it\n  return raw\n}\n\n// eslint-disable-next-line no-shadow\nexport enum VersionCheckOperator {\n  LessThan,\n  LessThanOrEqual,\n  GreaterThan,\n  GreaterThanOrEqual,\n  SameMajor,\n  SameMinor,\n}\n\nexport const checkVersion = (params: {\n  possiblyVersionOrDockerPath?: string\n  trueForSnapshot: boolean | 'compare'\n  operator: VersionCheckOperator\n  versionToCompareTo: string\n  trueOnInvalidVersion?: boolean\n}) => {\n  // quick exit: if the versionToCompareTo is\n  //   - `SNAPSHOT` there is not a lot we can compare here to, so we return false directly\n  //   - ends with `-SNAPSHOT` we ignore the `-SNAPSHOT` part for the comparison, guess a good matching semver compliant version and try to move on with the generated one in the code\n  if (params.versionToCompareTo === 'SNAPSHOT') {\n    return false\n  }\n  let versionToCompareTo = params.versionToCompareTo\n  if (versionToCompareTo.endsWith('-SNAPSHOT')) {\n    versionToCompareTo = versionToCompareTo.replace('-SNAPSHOT', '')\n    const parts = versionToCompareTo.split('.')\n    if (parts.length === 1) {\n      versionToCompareTo = `${parts[0]}.0.0`\n    } else if (parts.length === 2) {\n      versionToCompareTo = `${parts[0]}.${parts[1]}.0`\n    } else if (parts.length === 3) {\n      versionToCompareTo = `${parts[0]}.${parts[1]}.${parts[2]}`\n    }\n  }\n  versionToCompareTo = padAlphaIdentifier(versionToCompareTo)\n  if (!semver.valid(versionToCompareTo)) {\n    throw new Error('Invalid version to compare to')\n  }\n  let version: string = extractVersion(params.possiblyVersionOrDockerPath)\n  if (params.trueForSnapshot && version.includes('SNAPSHOT')) {\n    if (version === 'SNAPSHOT') {\n      // bare SNAPSHOT: `true` short-circuits here; `'compare'` falls through to invalid-version handling\n      if (params.trueForSnapshot !== 'compare') {\n        return true\n      }\n    } else {\n      version = version.replace('-SNAPSHOT', '')\n      if (version.split('.').length === 1) {\n        version = `${version}.99.99`\n      }\n      if (version.split('.').length === 2) {\n        version = `${version}.99`\n      }\n      if (version.split('.').length === 3) {\n        version = `${version.split('.')[0]}.${version.split('.')[1]}.99`\n      }\n    }\n  }\n\n  let parsedVersionToCompareTo: string = ''\n  if (semver.valid(versionToCompareTo ?? '')) {\n    parsedVersionToCompareTo = versionToCompareTo ?? ''\n  } else {\n    const versionSplit = versionToCompareTo?.split(':') ?? []\n    if (versionSplit.length > 1) {\n      parsedVersionToCompareTo = versionSplit[1]\n    }\n  }\n  if (params.trueForSnapshot && parsedVersionToCompareTo === 'SNAPSHOT') {\n    return true\n  }\n\n  if (!semver.valid(version)) {\n    return !!params.trueOnInvalidVersion\n  }\n\n  switch (params.operator) {\n    case VersionCheckOperator.LessThan:\n      return semver.lt(version, parsedVersionToCompareTo)\n    case VersionCheckOperator.LessThanOrEqual:\n      return semver.lte(version, parsedVersionToCompareTo)\n    case VersionCheckOperator.GreaterThan:\n      return semver.gt(version, parsedVersionToCompareTo)\n    case VersionCheckOperator.GreaterThanOrEqual:\n      return semver.gte(version, parsedVersionToCompareTo)\n    case VersionCheckOperator.SameMajor:\n      return semver.major(version) === semver.major(parsedVersionToCompareTo)\n    case VersionCheckOperator.SameMinor:\n      return (\n        semver.major(version) === semver.major(parsedVersionToCompareTo) &&\n        semver.minor(version) === semver.minor(parsedVersionToCompareTo)\n      )\n    default:\n      return false\n  }\n}\n\n/**\n * Can a suspended cluster on this generation resume? An alpha generation under\n * `RESUME_ALPHA_MIN_VERSION` answers false. Every other generation answers\n * true.\n *\n * The floor applies to alphas only, because they have no upgrade chain.\n * `RESUME_ALPHA_MIN_VERSION` gives the full reason. A release generation under\n * the floor, 8.9 for example, keeps its resume action.\n *\n * An alpha carries a prerelease tag that starts with `alpha`. The test reads\n * that tag, not the presence of a prerelease. A security patch tags a release\n * generation `8.9.0-secfix`, which semver also reads as a prerelease. That\n * generation is a release and keeps its upgrade chain, so it stays resumable.\n *\n * The c4 resume actions and the console-backend wake-up guards share this\n * function. The frontend keeps the action and disables it, the backend refuses\n * the request, and both must agree on the cohort. Two copies of one floor is\n * #9703.\n *\n * The answer is true for a version this function cannot read as an alpha:\n * - A `SNAPSHOT` tag is built from main, so it is never one of the old alphas.\n * - An empty or invalid version tells us nothing. A guess of false locks a\n *   customer out of a cluster that is good, so the safe answer is true.\n */\nexport const isGenerationResumable = (zeebeVersion?: string): boolean => {\n  const version = extractVersion(zeebeVersion)\n  const isAlpha = (semver.prerelease(version) ?? []).some(\n    (part) =>\n      typeof part === 'string' && part.toLowerCase().startsWith('alpha'),\n  )\n  if (!semver.valid(version) || !isAlpha) {\n    return true\n  }\n  return checkVersion({\n    possiblyVersionOrDockerPath: zeebeVersion,\n    trueForSnapshot: true,\n    operator: VersionCheckOperator.GreaterThanOrEqual,\n    versionToCompareTo: RESUME_ALPHA_MIN_VERSION,\n  })\n}\n\n/**\n * Version gate for the App Integrations exporter toggle (#8536). Shared by the\n * c4 settings tile and the console-backend update guard so both stay in\n * lockstep \u2014 the fix landed as patches on the 8.9 stream (zeebe >=8.9.14 AND\n * connectorBridge >=8.9.7), everything from 8.10.0-alpha4 on already carries\n * both fixes. A plain zeebe >=8.9.14 check would wrongly match\n * 8.10.0-alpha1/2/3, which predate the fix.\n */\nexport const isAppIntegrationsVersionSupported = (versions: {\n  zeebe?: string\n  connectorBridge?: string\n}): boolean => {\n  if (!versions.zeebe) {\n    return false\n  }\n  const isIn89Stream = checkVersion({\n    possiblyVersionOrDockerPath: versions.zeebe,\n    trueForSnapshot: 'compare',\n    operator: VersionCheckOperator.SameMinor,\n    versionToCompareTo: APP_INTEGRATIONS_89_STREAM_MINOR,\n  })\n  if (!isIn89Stream) {\n    return checkVersion({\n      possiblyVersionOrDockerPath: versions.zeebe,\n      trueForSnapshot: true,\n      operator: VersionCheckOperator.GreaterThanOrEqual,\n      versionToCompareTo: APP_INTEGRATIONS_MIN_VERSION,\n    })\n  }\n  return (\n    checkVersion({\n      possiblyVersionOrDockerPath: versions.zeebe,\n      trueForSnapshot: true,\n      operator: VersionCheckOperator.GreaterThanOrEqual,\n      versionToCompareTo: APP_INTEGRATIONS_89_STREAM_ZEEBE_MIN_VERSION,\n    }) &&\n    checkVersion({\n      possiblyVersionOrDockerPath: versions.connectorBridge,\n      trueForSnapshot: true,\n      operator: VersionCheckOperator.GreaterThanOrEqual,\n      versionToCompareTo:\n        APP_INTEGRATIONS_89_STREAM_CONNECTOR_BRIDGE_MIN_VERSION,\n    })\n  )\n}\n\n/**\n * Version gate for the secrets filter mode setting on Connectors\n * (`CAMUNDA_CONNECTOR_SECRETRESOLVER_SECRETFILTER_MODE`). Each 8.x line got the\n * fix on a different patch, so a single floor across all lines is wrong: it\n * would open the setting on an early patch of a newer line, or close it on a\n * late patch of an older line. This picks the zeebe minor line first, then\n * applies that line's own floor.\n *\n * On the 8.6 to 8.9 lines, each floor is the patch where the shipped default\n * became STRICT. Below its floor a line either has no setting at all, or has it\n * with the DISABLED default, so the toggle stays hidden and never shows a mode\n * the cluster does not use.\n *\n * Above the 8.9 line, one floor covers everything: 8.10.0-alpha6 and all later\n * versions, 8.11 included. That floor has a second reason, which\n * SECRETS_FILTER_MODE_8_10_MIN_VERSION gives: on 8.10.0-alpha5 a mode other\n * than STRICT crashes the Connectors runtime at startup.\n *\n * Shared by the c4 settings tile and the console-backend update guard so\n * both stay in lockstep.\n */\nexport const isSecretsFilterModeConfigurable = (\n  zeebeVersion: string | undefined,\n): boolean => {\n  if (!zeebeVersion) {\n    return false\n  }\n  const lineFloors = [\n    SECRETS_FILTER_MODE_8_6_MIN_VERSION,\n    SECRETS_FILTER_MODE_8_7_MIN_VERSION,\n    SECRETS_FILTER_MODE_8_8_MIN_VERSION,\n    SECRETS_FILTER_MODE_8_9_MIN_VERSION,\n  ]\n  for (const floor of lineFloors) {\n    const isOnThisLine = checkVersion({\n      possiblyVersionOrDockerPath: zeebeVersion,\n      trueForSnapshot: 'compare',\n      operator: VersionCheckOperator.SameMinor,\n      versionToCompareTo: floor,\n    })\n    if (isOnThisLine) {\n      return checkVersion({\n        possiblyVersionOrDockerPath: zeebeVersion,\n        trueForSnapshot: true,\n        operator: VersionCheckOperator.GreaterThanOrEqual,\n        versionToCompareTo: floor,\n      })\n    }\n  }\n  // Not on the 8.6-8.9 lines: either older than 8.6, which never had the\n  // setting, or 8.10 and above, which all share the 8.10 floor.\n  return checkVersion({\n    possiblyVersionOrDockerPath: zeebeVersion,\n    trueForSnapshot: true,\n    operator: VersionCheckOperator.GreaterThanOrEqual,\n    versionToCompareTo: SECRETS_FILTER_MODE_8_10_MIN_VERSION,\n  })\n}\n"],
-  "mappings": "AAMA,YAAY,YAAY;AACxB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAmBA,MAAM,qBAAqB,CAAC,YAA4B;AAI7D,QAAM,eAAe,QAAQ,YAAY,EAAE,QAAQ,SAAS;AAC5D,SAAO,iBAAiB,KAAK,UAAU,QAAQ,MAAM,GAAG,YAAY;AACtE;AAoBA,MAAM,mBAAmB;AAgBzB,MAAM,qBAAqB,CAAC,YAA4B;AACtD,QAAM,SAAS,OAAO,MAAM,OAAO;AACnC,MAAI,CAAC,UAAU,OAAO,WAAW,WAAW,GAAG;AAC7C,WAAO;AAAA,EACT;AAGA,QAAM,QAAQ,iBAAiB,KAAK,OAAO,WAAW,KAAK,GAAG,CAAC;AAC/D,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AAGA,QAAM,UAAU,GAAG,OAAO,KAAK,IAAI,OAAO,KAAK,IAAI,OAAO,KAAK;AAC/D,SAAO,GAAG,OAAO,UAAU,MAAM,CAAC,CAAC;AACrC;AAmBO,MAAM,6BAA6B,CAAC,YAA4B;AACrE,MAAI,QAAQ,SAAS,UAAU,GAAG;AAChC,WAAO;AAAA,EACT;AACA,QAAM,SAAS,OAAO,MAAM,OAAO;AACnC,MAAI,CAAC,UAAU,OAAO,WAAW,WAAW,GAAG;AAC7C,WAAO;AAAA,EACT;AACA,MAAI,CAAC,iBAAiB,KAAK,OAAO,WAAW,KAAK,GAAG,CAAC,GAAG;AACvD,WAAO,GAAG,OAAO,KAAK,IAAI,OAAO,KAAK,IAAI,OAAO,KAAK;AAAA,EACxD;AACA,SAAO,mBAAmB,OAAO;AACnC;AAMA,MAAM,eAAe;AAsBd,MAAM,yBAAyB,CAAC,UAAuC;AAC5E,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,QAAM,YAAY,MAAM,YAAY,GAAG;AAGvC,MAAI,aAAa,GAAG;AAClB,WAAO;AAAA,EACT;AACA,QAAM,MAAM,MAAM,MAAM,YAAY,CAAC;AACrC,SAAO,aAAa,KAAK,GAAG,KAAK,OAAO,MAAM,GAAG,MAAM;AACzD;AAaA,MAAM,iBAAiB,CAAC,gCAAiD;AACvE,QAAM,MAAM,+BAA+B;AAC3C,MAAI,OAAO,MAAM,GAAG,GAAG;AACrB,WAAO,2BAA2B,GAAG;AAAA,EACvC;AACA,QAAM,YAAY,IAAI,YAAY,GAAG;AACrC,MAAI,cAAc,IAAI;AACpB,WAAO,2BAA2B,IAAI,MAAM,YAAY,CAAC,CAAC;AAAA,EAC5D;AAEA,SAAO;AACT;AAGO,IAAK,uBAAL,kBAAKA,0BAAL;AACL,EAAAA,4CAAA;AACA,EAAAA,4CAAA;AACA,EAAAA,4CAAA;AACA,EAAAA,4CAAA;AACA,EAAAA,4CAAA;AACA,EAAAA,4CAAA;AANU,SAAAA;AAAA,GAAA;AASL,MAAM,eAAe,CAAC,WAMvB;AAIJ,MAAI,OAAO,uBAAuB,YAAY;AAC5C,WAAO;AAAA,EACT;AACA,MAAI,qBAAqB,OAAO;AAChC,MAAI,mBAAmB,SAAS,WAAW,GAAG;AAC5C,yBAAqB,mBAAmB,QAAQ,aAAa,EAAE;AAC/D,UAAM,QAAQ,mBAAmB,MAAM,GAAG;AAC1C,QAAI,MAAM,WAAW,GAAG;AACtB,2BAAqB,GAAG,MAAM,CAAC,CAAC;AAAA,IAClC,WAAW,MAAM,WAAW,GAAG;AAC7B,2BAAqB,GAAG,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC;AAAA,IAC9C,WAAW,MAAM,WAAW,GAAG;AAC7B,2BAAqB,GAAG,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC;AAAA,IAC1D;AAAA,EACF;AACA,uBAAqB,mBAAmB,kBAAkB;AAC1D,MAAI,CAAC,OAAO,MAAM,kBAAkB,GAAG;AACrC,UAAM,IAAI,MAAM,+BAA+B;AAAA,EACjD;AACA,MAAI,UAAkB,eAAe,OAAO,2BAA2B;AACvE,MAAI,OAAO,mBAAmB,QAAQ,SAAS,UAAU,GAAG;AAC1D,QAAI,YAAY,YAAY;AAE1B,UAAI,OAAO,oBAAoB,WAAW;AACxC,eAAO;AAAA,MACT;AAAA,IACF,OAAO;AACL,gBAAU,QAAQ,QAAQ,aAAa,EAAE;AACzC,UAAI,QAAQ,MAAM,GAAG,EAAE,WAAW,GAAG;AACnC,kBAAU,GAAG,OAAO;AAAA,MACtB;AACA,UAAI,QAAQ,MAAM,GAAG,EAAE,WAAW,GAAG;AACnC,kBAAU,GAAG,OAAO;AAAA,MACtB;AACA,UAAI,QAAQ,MAAM,GAAG,EAAE,WAAW,GAAG;AACnC,kBAAU,GAAG,QAAQ,MAAM,GAAG,EAAE,CAAC,CAAC,IAAI,QAAQ,MAAM,GAAG,EAAE,CAAC,CAAC;AAAA,MAC7D;AAAA,IACF;AAAA,EACF;AAEA,MAAI,2BAAmC;AACvC,MAAI,OAAO,MAAM,sBAAsB,EAAE,GAAG;AAC1C,+BAA2B,sBAAsB;AAAA,EACnD,OAAO;AACL,UAAM,eAAe,oBAAoB,MAAM,GAAG,KAAK,CAAC;AACxD,QAAI,aAAa,SAAS,GAAG;AAC3B,iCAA2B,aAAa,CAAC;AAAA,IAC3C;AAAA,EACF;AACA,MAAI,OAAO,mBAAmB,6BAA6B,YAAY;AACrE,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,OAAO,MAAM,OAAO,GAAG;AAC1B,WAAO,CAAC,CAAC,OAAO;AAAA,EAClB;AAEA,UAAQ,OAAO,UAAU;AAAA,IACvB,KAAK;AACH,aAAO,OAAO,GAAG,SAAS,wBAAwB;AAAA,IACpD,KAAK;AACH,aAAO,OAAO,IAAI,SAAS,wBAAwB;AAAA,IACrD,KAAK;AACH,aAAO,OAAO,GAAG,SAAS,wBAAwB;AAAA,IACpD,KAAK;AACH,aAAO,OAAO,IAAI,SAAS,wBAAwB;AAAA,IACrD,KAAK;AACH,aAAO,OAAO,MAAM,OAAO,MAAM,OAAO,MAAM,wBAAwB;AAAA,IACxE,KAAK;AACH,aACE,OAAO,MAAM,OAAO,MAAM,OAAO,MAAM,wBAAwB,KAC/D,OAAO,MAAM,OAAO,MAAM,OAAO,MAAM,wBAAwB;AAAA,IAEnE;AACE,aAAO;AAAA,EACX;AACF;AA0BO,MAAM,wBAAwB,CAAC,iBAAmC;AACvE,QAAM,UAAU,eAAe,YAAY;AAC3C,QAAM,WAAW,OAAO,WAAW,OAAO,KAAK,CAAC,GAAG;AAAA,IACjD,CAAC,SACC,OAAO,SAAS,YAAY,KAAK,YAAY,EAAE,WAAW,OAAO;AAAA,EACrE;AACA,MAAI,CAAC,OAAO,MAAM,OAAO,KAAK,CAAC,SAAS;AACtC,WAAO;AAAA,EACT;AACA,SAAO,aAAa;AAAA,IAClB,6BAA6B;AAAA,IAC7B,iBAAiB;AAAA,IACjB,UAAU;AAAA,IACV,oBAAoB;AAAA,EACtB,CAAC;AACH;AAUO,MAAM,oCAAoC,CAAC,aAGnC;AACb,MAAI,CAAC,SAAS,OAAO;AACnB,WAAO;AAAA,EACT;AACA,QAAM,eAAe,aAAa;AAAA,IAChC,6BAA6B,SAAS;AAAA,IACtC,iBAAiB;AAAA,IACjB,UAAU;AAAA,IACV,oBAAoB;AAAA,EACtB,CAAC;AACD,MAAI,CAAC,cAAc;AACjB,WAAO,aAAa;AAAA,MAClB,6BAA6B,SAAS;AAAA,MACtC,iBAAiB;AAAA,MACjB,UAAU;AAAA,MACV,oBAAoB;AAAA,IACtB,CAAC;AAAA,EACH;AACA,SACE,aAAa;AAAA,IACX,6BAA6B,SAAS;AAAA,IACtC,iBAAiB;AAAA,IACjB,UAAU;AAAA,IACV,oBAAoB;AAAA,EACtB,CAAC,KACD,aAAa;AAAA,IACX,6BAA6B,SAAS;AAAA,IACtC,iBAAiB;AAAA,IACjB,UAAU;AAAA,IACV,oBACE;AAAA,EACJ,CAAC;AAEL;AAuBO,MAAM,kCAAkC,CAC7C,iBACY;AACZ,MAAI,CAAC,cAAc;AACjB,WAAO;AAAA,EACT;AACA,QAAM,aAAa;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,aAAW,SAAS,YAAY;AAC9B,UAAM,eAAe,aAAa;AAAA,MAChC,6BAA6B;AAAA,MAC7B,iBAAiB;AAAA,MACjB,UAAU;AAAA,MACV,oBAAoB;AAAA,IACtB,CAAC;AACD,QAAI,cAAc;AAChB,aAAO,aAAa;AAAA,QAClB,6BAA6B;AAAA,QAC7B,iBAAiB;AAAA,QACjB,UAAU;AAAA,QACV,oBAAoB;AAAA,MACtB,CAAC;AAAA,IACH;AAAA,EACF;AAGA,SAAO,aAAa;AAAA,IAClB,6BAA6B;AAAA,IAC7B,iBAAiB;AAAA,IACjB,UAAU;AAAA,IACV,oBAAoB;AAAA,EACtB,CAAC;AACH;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport * as semver from 'semver'\nimport {\n  APP_INTEGRATIONS_89_STREAM_CONNECTOR_BRIDGE_MIN_VERSION,\n  APP_INTEGRATIONS_89_STREAM_MINOR,\n  APP_INTEGRATIONS_89_STREAM_ZEEBE_MIN_VERSION,\n  APP_INTEGRATIONS_MIN_VERSION,\n  RESUME_ALPHA_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_6_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_7_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_8_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_9_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_10_MIN_VERSION,\n} from '../constants/version-gates.const.js'\n\n/**\n * stripSecfixPostfix removes the `-secfix` postfix of a version.\n *\n * A security patch tags the images of a generation with the postfix\n * (`8.8.19-secfix`). Semver reads the postfix as a prerelease, which sorts\n * under the release it patches. A `>= 8.8.19` gate thus refuses a patched\n * build of 8.8.19 itself. The postfix holds no version information, so it\n * comes off before every comparison.\n *\n * Only the postfix comes off, not the whole prerelease. A patched alpha\n * (`8.10.0-alpha5-secfix`) stays an alpha, which the 8.10 floors and\n * `isGenerationResumable` both depend on.\n *\n * A surface that shows a version reads this helper too, because the postfix is\n * an internal build detail. One helper keeps the version a customer sees and\n * the version a gate compares on the same rule.\n */\nexport const stripSecfixPostfix = (version: string): string => {\n  // A search for the marker, and not a regular expression. `-secfix.*$` over\n  // the input of an exported function is a polynomial backtracking pattern,\n  // which code scanning rejects (CodeQL js/polynomial-redos).\n  const postfixStart = version.toLowerCase().indexOf('-secfix')\n  return postfixStart === -1 ? version : version.slice(0, postfixStart)\n}\n\n/**\n * The grammar of an image tag, as camunda/camunda-operator#6016 defines it.\n * `SNAPSHOT` keeps its own shape, thus the pattern does not cover it.\n *\n * A tag holds a version, and after the version it can hold one suffix:\n * - An alpha suffix (`-alpha5`, `-alpha1.1`) names a prerelease cohort.\n * - Every other suffix (`-rc1`, `-secfix`, `-hotfix1`) is a build detail of\n *   the release. The build has the content of the release, thus the suffix\n *   holds no version information.\n */\n// The lookahead needs a hyphen or the end of the tag after the alpha number.\n// Without it, an optional digit group lets the pattern match the `alpha`\n// prefix of a tag such as `alphatest1`. That tag is not an alpha, but the\n// pattern still matches it and drops the text after `alpha`.\n//\n// The digit group itself is not optional. The grammar names a cohort\n// `alphaN`, never bare `alpha`, so a bare `-alpha` suffix must fall to the\n// release, the same as every other suffix that is not a numbered cohort.\nconst ALPHA_PRERELEASE = /^alpha(\\d+(?:\\.\\d+)*)(?=$|-)/i\n\n/**\n * Gives an alpha identifier a dot before its number, thus semver compares the\n * number as a number. Without the dot semver compares `alpha10` and `alpha6`\n * as text, and `alpha10` sorts under `alpha6`.\n *\n * Text after the alpha number comes off, because the operator does not\n * support it. A patched alpha (`8.10.0-alpha5-secfix`) stays alpha5, which the\n * 8.10 floors and `isGenerationResumable` both depend on.\n *\n * A version that has no alpha comes back unchanged. A floor reads this\n * function alone, thus a floor keeps a prerelease that is not an alpha. The\n * sentinel `8.10.0-0` of `LINE_8_10_MIN_VERSION` needs that: it must sort\n * under every 8.10 prerelease, and a strip would make it the 8.10.0 release.\n */\nconst padAlphaIdentifier = (version: string): string => {\n  const parsed = semver.parse(version)\n  if (!parsed || parsed.prerelease.length === 0) {\n    return version\n  }\n  // The whole prerelease, not its first identifier. semver splits\n  // `alpha1.1` at the dot, and the fix number is the part after it.\n  const alpha = ALPHA_PRERELEASE.exec(parsed.prerelease.join('.'))\n  if (!alpha) {\n    return version\n  }\n  // The digit group is mandatory in `ALPHA_PRERELEASE`, thus `alpha[1]`\n  // always holds a value here.\n  const release = `${parsed.major}.${parsed.minor}.${parsed.patch}`\n  return `${release}-alpha.${alpha[1]}`\n}\n\n/**\n * Makes an image tag comparable with the rules of the operator. Two problems\n * need this, and both cost a support ticket (INC-8048):\n *\n * 1. semver sorts a prerelease UNDER its release, thus `8.8.19-hotfix1` fails\n *    a `>= 8.8.19` gate. The operator reads that build as 8.8.19, because the\n *    build holds the content of 8.8.19 plus a hotfix. Thus every suffix that\n *    is not an alpha comes off.\n * 2. semver compares an alpha identifier as text. `padAlphaIdentifier`\n *    corrects that.\n *\n * A `SNAPSHOT` tag comes back unchanged. `checkVersion` expands it, and only\n * when the caller asks for it with `trueForSnapshot`.\n *\n * Use this function for a tag, not for a floor. A floor is a boundary that we\n * write, thus it reads `padAlphaIdentifier` alone.\n */\nexport const normalizeGenerationVersion = (version: string): string => {\n  if (version.includes('SNAPSHOT')) {\n    return version\n  }\n  const parsed = semver.parse(version)\n  if (!parsed || parsed.prerelease.length === 0) {\n    return version\n  }\n  if (!ALPHA_PRERELEASE.test(parsed.prerelease.join('.'))) {\n    return `${parsed.major}.${parsed.minor}.${parsed.patch}`\n  }\n  return padAlphaIdentifier(version)\n}\n\n/**\n * The SNAPSHOT tags of the grammar. A SNAPSHOT build comes from the head of a\n * branch, thus it has no patch number, and sometimes no minor number.\n */\nconst SNAPSHOT_TAG = /^(?:\\d+(?:\\.\\d+)?-)?SNAPSHOT$/\n\n/**\n * Is this value an image that a generation can use? The value must have the\n * form `repository:tag`, and the tag must obey the grammar of the operator\n * (camunda/camunda-operator#6016).\n *\n * The tag is the text after the LAST colon, not the second colon-delimited\n * segment. A registry host can carry a port\n * (`registry.example.com:5000/zeebe:8.10.0`), and `secfixGenerationArtifacts.ts`\n * already rewrites images of that shape.\n *\n * The grammar permits a suffix after the version, and this function does not\n * limit the text of that suffix. Two reasons:\n * - A security patch tags an alpha `8.10.0-alpha5-secfix`. Such images are in\n *   production today, and the retag job makes more of them.\n * - The operator removes a suffix that it does not know, thus an unknown\n *   suffix is safe. `normalizeGenerationVersion` does the same.\n *\n * Use this function at creation only. Generations from before the grammar\n * hold tags such as `3.9.0-preview-1`, and a read of those must still work.\n */\nexport const isValidGenerationImage = (image: string | undefined): boolean => {\n  // An image reference holds no space. `semver.valid` removes the space\n  // around a version, thus ` camunda/zeebe:8.10.1 ` would pass. The record\n  // then keeps the space, and the pull of that image fails.\n  if (!image || /\\s/.test(image)) {\n    return false\n  }\n  const lastColon = image.lastIndexOf(':')\n  // A colon at the start leaves an empty repository, thus `lastColon <= 0`\n  // rejects both no colon (`-1`) and an empty repository (`0`).\n  if (lastColon <= 0) {\n    return false\n  }\n  const tag = image.slice(lastColon + 1)\n  if (SNAPSHOT_TAG.test(tag)) {\n    return true\n  }\n  // The tag must already have the canonical form. `semver.valid` also reads\n  // a loose form and gives back the canonical one, thus a test against\n  // `null` accepts `v8.10.1` and `8.10.1+build7`. The grammar has neither,\n  // and a docker tag permits no `+`.\n  return semver.valid(tag) === tag\n}\n\n/**\n * The message for an image that `isValidGenerationImage` refuses. The route\n * and the controller both refuse an image, thus both read this function. One\n * message keeps the two answers the same.\n *\n * The message names the field. A generation holds eight images, and a message\n * without the field name makes a Camundi read all eight to find the bad one.\n */\nexport const generationImageErrorMessage = (\n  field: string,\n  image: unknown,\n): string =>\n  `${field} image \"${image}\" does not obey the tag grammar. Use repository:tag, and a tag such as 8.10.1, 8.10.0-alpha5 or 8.10-SNAPSHOT.`\n\n/**\n * Takes the version out of a generation version field. The field holds either a\n * bare version (`8.10.0-alpha4`) or a docker path\n * (`camunda/zeebe:8.10.0-alpha4`, or `registry.example.com:5000/zeebe:8.10.0-alpha4`\n * for a registry with a port). A value that is neither comes back unchanged,\n * so the caller can still expand a `SNAPSHOT` tag.\n *\n * The version is the text after the LAST colon, not the second colon-delimited\n * segment \u2014 a registry port is also a colon-delimited segment, and comes\n * before the version, not after it.\n */\nconst extractVersion = (possiblyVersionOrDockerPath?: string): string => {\n  const raw = possiblyVersionOrDockerPath ?? ''\n  if (semver.valid(raw)) {\n    return normalizeGenerationVersion(raw)\n  }\n  const lastColon = raw.lastIndexOf(':')\n  if (lastColon !== -1) {\n    return normalizeGenerationVersion(raw.slice(lastColon + 1))\n  }\n  // bare version string not valid semver (e.g. '8.10-SNAPSHOT') \u2014 use as-is so SNAPSHOT expansion can handle it\n  return raw\n}\n\n// eslint-disable-next-line no-shadow\nexport enum VersionCheckOperator {\n  LessThan,\n  LessThanOrEqual,\n  GreaterThan,\n  GreaterThanOrEqual,\n  SameMajor,\n  SameMinor,\n}\n\nexport const checkVersion = (params: {\n  possiblyVersionOrDockerPath?: string\n  trueForSnapshot: boolean | 'compare'\n  operator: VersionCheckOperator\n  versionToCompareTo: string\n  trueOnInvalidVersion?: boolean\n}) => {\n  // quick exit: if the versionToCompareTo is\n  //   - `SNAPSHOT` there is not a lot we can compare here to, so we return false directly\n  //   - ends with `-SNAPSHOT` we ignore the `-SNAPSHOT` part for the comparison, guess a good matching semver compliant version and try to move on with the generated one in the code\n  if (params.versionToCompareTo === 'SNAPSHOT') {\n    return false\n  }\n  let versionToCompareTo = params.versionToCompareTo\n  if (versionToCompareTo.endsWith('-SNAPSHOT')) {\n    versionToCompareTo = versionToCompareTo.replace('-SNAPSHOT', '')\n    const parts = versionToCompareTo.split('.')\n    if (parts.length === 1) {\n      versionToCompareTo = `${parts[0]}.0.0`\n    } else if (parts.length === 2) {\n      versionToCompareTo = `${parts[0]}.${parts[1]}.0`\n    } else if (parts.length === 3) {\n      versionToCompareTo = `${parts[0]}.${parts[1]}.${parts[2]}`\n    }\n  }\n  versionToCompareTo = padAlphaIdentifier(versionToCompareTo)\n  if (!semver.valid(versionToCompareTo)) {\n    throw new Error('Invalid version to compare to')\n  }\n  let version: string = extractVersion(params.possiblyVersionOrDockerPath)\n  if (params.trueForSnapshot && version.includes('SNAPSHOT')) {\n    if (version === 'SNAPSHOT') {\n      // bare SNAPSHOT: `true` short-circuits here; `'compare'` falls through to invalid-version handling\n      if (params.trueForSnapshot !== 'compare') {\n        return true\n      }\n    } else {\n      version = version.replace('-SNAPSHOT', '')\n      if (version.split('.').length === 1) {\n        version = `${version}.99.99`\n      }\n      if (version.split('.').length === 2) {\n        version = `${version}.99`\n      }\n      if (version.split('.').length === 3) {\n        version = `${version.split('.')[0]}.${version.split('.')[1]}.99`\n      }\n    }\n  }\n\n  let parsedVersionToCompareTo: string = ''\n  if (semver.valid(versionToCompareTo ?? '')) {\n    parsedVersionToCompareTo = versionToCompareTo ?? ''\n  } else {\n    const versionSplit = versionToCompareTo?.split(':') ?? []\n    if (versionSplit.length > 1) {\n      parsedVersionToCompareTo = versionSplit[1]\n    }\n  }\n  if (params.trueForSnapshot && parsedVersionToCompareTo === 'SNAPSHOT') {\n    return true\n  }\n\n  if (!semver.valid(version)) {\n    return !!params.trueOnInvalidVersion\n  }\n\n  switch (params.operator) {\n    case VersionCheckOperator.LessThan:\n      return semver.lt(version, parsedVersionToCompareTo)\n    case VersionCheckOperator.LessThanOrEqual:\n      return semver.lte(version, parsedVersionToCompareTo)\n    case VersionCheckOperator.GreaterThan:\n      return semver.gt(version, parsedVersionToCompareTo)\n    case VersionCheckOperator.GreaterThanOrEqual:\n      return semver.gte(version, parsedVersionToCompareTo)\n    case VersionCheckOperator.SameMajor:\n      return semver.major(version) === semver.major(parsedVersionToCompareTo)\n    case VersionCheckOperator.SameMinor:\n      return (\n        semver.major(version) === semver.major(parsedVersionToCompareTo) &&\n        semver.minor(version) === semver.minor(parsedVersionToCompareTo)\n      )\n    default:\n      return false\n  }\n}\n\n/**\n * Can a suspended cluster on this generation resume? An alpha generation under\n * `RESUME_ALPHA_MIN_VERSION` answers false. Every other generation answers\n * true.\n *\n * The floor applies to alphas only, because they have no upgrade chain.\n * `RESUME_ALPHA_MIN_VERSION` gives the full reason. A release generation under\n * the floor, 8.9 for example, keeps its resume action.\n *\n * An alpha carries a prerelease tag that starts with `alpha`. The test reads\n * that tag, not the presence of a prerelease. A security patch tags a release\n * generation `8.9.0-secfix`, which semver also reads as a prerelease. That\n * generation is a release and keeps its upgrade chain, so it stays resumable.\n *\n * The c4 resume actions and the console-backend wake-up guards share this\n * function. The frontend keeps the action and disables it, the backend refuses\n * the request, and both must agree on the cohort. Two copies of one floor is\n * #9703.\n *\n * The answer is true for a version this function cannot read as an alpha:\n * - A `SNAPSHOT` tag is built from main, so it is never one of the old alphas.\n * - An empty or invalid version tells us nothing. A guess of false locks a\n *   customer out of a cluster that is good, so the safe answer is true.\n */\nexport const isGenerationResumable = (zeebeVersion?: string): boolean => {\n  const version = extractVersion(zeebeVersion)\n  const isAlpha = (semver.prerelease(version) ?? []).some(\n    (part) =>\n      typeof part === 'string' && part.toLowerCase().startsWith('alpha'),\n  )\n  if (!semver.valid(version) || !isAlpha) {\n    return true\n  }\n  return checkVersion({\n    possiblyVersionOrDockerPath: zeebeVersion,\n    trueForSnapshot: true,\n    operator: VersionCheckOperator.GreaterThanOrEqual,\n    versionToCompareTo: RESUME_ALPHA_MIN_VERSION,\n  })\n}\n\n/**\n * Version gate for the App Integrations exporter toggle (#8536). Shared by the\n * c4 settings tile and the console-backend update guard so both stay in\n * lockstep \u2014 the fix landed as patches on the 8.9 stream (zeebe >=8.9.14 AND\n * connectorBridge >=8.9.7), everything from 8.10.0-alpha4 on already carries\n * both fixes. A plain zeebe >=8.9.14 check would wrongly match\n * 8.10.0-alpha1/2/3, which predate the fix.\n */\nexport const isAppIntegrationsVersionSupported = (versions: {\n  zeebe?: string\n  connectorBridge?: string\n}): boolean => {\n  if (!versions.zeebe) {\n    return false\n  }\n  const isIn89Stream = checkVersion({\n    possiblyVersionOrDockerPath: versions.zeebe,\n    trueForSnapshot: 'compare',\n    operator: VersionCheckOperator.SameMinor,\n    versionToCompareTo: APP_INTEGRATIONS_89_STREAM_MINOR,\n  })\n  if (!isIn89Stream) {\n    return checkVersion({\n      possiblyVersionOrDockerPath: versions.zeebe,\n      trueForSnapshot: true,\n      operator: VersionCheckOperator.GreaterThanOrEqual,\n      versionToCompareTo: APP_INTEGRATIONS_MIN_VERSION,\n    })\n  }\n  return (\n    checkVersion({\n      possiblyVersionOrDockerPath: versions.zeebe,\n      trueForSnapshot: true,\n      operator: VersionCheckOperator.GreaterThanOrEqual,\n      versionToCompareTo: APP_INTEGRATIONS_89_STREAM_ZEEBE_MIN_VERSION,\n    }) &&\n    checkVersion({\n      possiblyVersionOrDockerPath: versions.connectorBridge,\n      trueForSnapshot: true,\n      operator: VersionCheckOperator.GreaterThanOrEqual,\n      versionToCompareTo:\n        APP_INTEGRATIONS_89_STREAM_CONNECTOR_BRIDGE_MIN_VERSION,\n    })\n  )\n}\n\n/**\n * Version gate for the secrets filter mode setting on Connectors\n * (`CAMUNDA_CONNECTOR_SECRETRESOLVER_SECRETFILTER_MODE`). Each 8.x line got the\n * fix on a different patch, so a single floor across all lines is wrong: it\n * would open the setting on an early patch of a newer line, or close it on a\n * late patch of an older line. This picks the zeebe minor line first, then\n * applies that line's own floor.\n *\n * On the 8.6 to 8.9 lines, each floor is the patch where the shipped default\n * became STRICT. Below its floor a line either has no setting at all, or has it\n * with the DISABLED default, so the toggle stays hidden and never shows a mode\n * the cluster does not use.\n *\n * Above the 8.9 line, one floor covers everything: 8.10.0-alpha6 and all later\n * versions, 8.11 included. That floor has a second reason, which\n * SECRETS_FILTER_MODE_8_10_MIN_VERSION gives: on 8.10.0-alpha5 a mode other\n * than STRICT crashes the Connectors runtime at startup.\n *\n * Shared by the c4 settings tile and the console-backend update guard so\n * both stay in lockstep.\n */\nexport const isSecretsFilterModeConfigurable = (\n  zeebeVersion: string | undefined,\n): boolean => {\n  if (!zeebeVersion) {\n    return false\n  }\n  const lineFloors = [\n    SECRETS_FILTER_MODE_8_6_MIN_VERSION,\n    SECRETS_FILTER_MODE_8_7_MIN_VERSION,\n    SECRETS_FILTER_MODE_8_8_MIN_VERSION,\n    SECRETS_FILTER_MODE_8_9_MIN_VERSION,\n  ]\n  for (const floor of lineFloors) {\n    const isOnThisLine = checkVersion({\n      possiblyVersionOrDockerPath: zeebeVersion,\n      trueForSnapshot: 'compare',\n      operator: VersionCheckOperator.SameMinor,\n      versionToCompareTo: floor,\n    })\n    if (isOnThisLine) {\n      return checkVersion({\n        possiblyVersionOrDockerPath: zeebeVersion,\n        trueForSnapshot: true,\n        operator: VersionCheckOperator.GreaterThanOrEqual,\n        versionToCompareTo: floor,\n      })\n    }\n  }\n  // Not on the 8.6-8.9 lines: either older than 8.6, which never had the\n  // setting, or 8.10 and above, which all share the 8.10 floor.\n  return checkVersion({\n    possiblyVersionOrDockerPath: zeebeVersion,\n    trueForSnapshot: true,\n    operator: VersionCheckOperator.GreaterThanOrEqual,\n    versionToCompareTo: SECRETS_FILTER_MODE_8_10_MIN_VERSION,\n  })\n}\n"],
+  "mappings": "AAMA,YAAY,YAAY;AACxB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAmBA,MAAM,qBAAqB,CAAC,YAA4B;AAI7D,QAAM,eAAe,QAAQ,YAAY,EAAE,QAAQ,SAAS;AAC5D,SAAO,iBAAiB,KAAK,UAAU,QAAQ,MAAM,GAAG,YAAY;AACtE;AAoBA,MAAM,mBAAmB;AAgBzB,MAAM,qBAAqB,CAAC,YAA4B;AACtD,QAAM,SAAS,OAAO,MAAM,OAAO;AACnC,MAAI,CAAC,UAAU,OAAO,WAAW,WAAW,GAAG;AAC7C,WAAO;AAAA,EACT;AAGA,QAAM,QAAQ,iBAAiB,KAAK,OAAO,WAAW,KAAK,GAAG,CAAC;AAC/D,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AAGA,QAAM,UAAU,GAAG,OAAO,KAAK,IAAI,OAAO,KAAK,IAAI,OAAO,KAAK;AAC/D,SAAO,GAAG,OAAO,UAAU,MAAM,CAAC,CAAC;AACrC;AAmBO,MAAM,6BAA6B,CAAC,YAA4B;AACrE,MAAI,QAAQ,SAAS,UAAU,GAAG;AAChC,WAAO;AAAA,EACT;AACA,QAAM,SAAS,OAAO,MAAM,OAAO;AACnC,MAAI,CAAC,UAAU,OAAO,WAAW,WAAW,GAAG;AAC7C,WAAO;AAAA,EACT;AACA,MAAI,CAAC,iBAAiB,KAAK,OAAO,WAAW,KAAK,GAAG,CAAC,GAAG;AACvD,WAAO,GAAG,OAAO,KAAK,IAAI,OAAO,KAAK,IAAI,OAAO,KAAK;AAAA,EACxD;AACA,SAAO,mBAAmB,OAAO;AACnC;AAMA,MAAM,eAAe;AAsBd,MAAM,yBAAyB,CAAC,UAAuC;AAI5E,MAAI,CAAC,SAAS,KAAK,KAAK,KAAK,GAAG;AAC9B,WAAO;AAAA,EACT;AACA,QAAM,YAAY,MAAM,YAAY,GAAG;AAGvC,MAAI,aAAa,GAAG;AAClB,WAAO;AAAA,EACT;AACA,QAAM,MAAM,MAAM,MAAM,YAAY,CAAC;AACrC,MAAI,aAAa,KAAK,GAAG,GAAG;AAC1B,WAAO;AAAA,EACT;AAKA,SAAO,OAAO,MAAM,GAAG,MAAM;AAC/B;AAUO,MAAM,8BAA8B,CACzC,OACA,UAEA,GAAG,KAAK,WAAW,KAAK;AAa1B,MAAM,iBAAiB,CAAC,gCAAiD;AACvE,QAAM,MAAM,+BAA+B;AAC3C,MAAI,OAAO,MAAM,GAAG,GAAG;AACrB,WAAO,2BAA2B,GAAG;AAAA,EACvC;AACA,QAAM,YAAY,IAAI,YAAY,GAAG;AACrC,MAAI,cAAc,IAAI;AACpB,WAAO,2BAA2B,IAAI,MAAM,YAAY,CAAC,CAAC;AAAA,EAC5D;AAEA,SAAO;AACT;AAGO,IAAK,uBAAL,kBAAKA,0BAAL;AACL,EAAAA,4CAAA;AACA,EAAAA,4CAAA;AACA,EAAAA,4CAAA;AACA,EAAAA,4CAAA;AACA,EAAAA,4CAAA;AACA,EAAAA,4CAAA;AANU,SAAAA;AAAA,GAAA;AASL,MAAM,eAAe,CAAC,WAMvB;AAIJ,MAAI,OAAO,uBAAuB,YAAY;AAC5C,WAAO;AAAA,EACT;AACA,MAAI,qBAAqB,OAAO;AAChC,MAAI,mBAAmB,SAAS,WAAW,GAAG;AAC5C,yBAAqB,mBAAmB,QAAQ,aAAa,EAAE;AAC/D,UAAM,QAAQ,mBAAmB,MAAM,GAAG;AAC1C,QAAI,MAAM,WAAW,GAAG;AACtB,2BAAqB,GAAG,MAAM,CAAC,CAAC;AAAA,IAClC,WAAW,MAAM,WAAW,GAAG;AAC7B,2BAAqB,GAAG,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC;AAAA,IAC9C,WAAW,MAAM,WAAW,GAAG;AAC7B,2BAAqB,GAAG,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC;AAAA,IAC1D;AAAA,EACF;AACA,uBAAqB,mBAAmB,kBAAkB;AAC1D,MAAI,CAAC,OAAO,MAAM,kBAAkB,GAAG;AACrC,UAAM,IAAI,MAAM,+BAA+B;AAAA,EACjD;AACA,MAAI,UAAkB,eAAe,OAAO,2BAA2B;AACvE,MAAI,OAAO,mBAAmB,QAAQ,SAAS,UAAU,GAAG;AAC1D,QAAI,YAAY,YAAY;AAE1B,UAAI,OAAO,oBAAoB,WAAW;AACxC,eAAO;AAAA,MACT;AAAA,IACF,OAAO;AACL,gBAAU,QAAQ,QAAQ,aAAa,EAAE;AACzC,UAAI,QAAQ,MAAM,GAAG,EAAE,WAAW,GAAG;AACnC,kBAAU,GAAG,OAAO;AAAA,MACtB;AACA,UAAI,QAAQ,MAAM,GAAG,EAAE,WAAW,GAAG;AACnC,kBAAU,GAAG,OAAO;AAAA,MACtB;AACA,UAAI,QAAQ,MAAM,GAAG,EAAE,WAAW,GAAG;AACnC,kBAAU,GAAG,QAAQ,MAAM,GAAG,EAAE,CAAC,CAAC,IAAI,QAAQ,MAAM,GAAG,EAAE,CAAC,CAAC;AAAA,MAC7D;AAAA,IACF;AAAA,EACF;AAEA,MAAI,2BAAmC;AACvC,MAAI,OAAO,MAAM,sBAAsB,EAAE,GAAG;AAC1C,+BAA2B,sBAAsB;AAAA,EACnD,OAAO;AACL,UAAM,eAAe,oBAAoB,MAAM,GAAG,KAAK,CAAC;AACxD,QAAI,aAAa,SAAS,GAAG;AAC3B,iCAA2B,aAAa,CAAC;AAAA,IAC3C;AAAA,EACF;AACA,MAAI,OAAO,mBAAmB,6BAA6B,YAAY;AACrE,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,OAAO,MAAM,OAAO,GAAG;AAC1B,WAAO,CAAC,CAAC,OAAO;AAAA,EAClB;AAEA,UAAQ,OAAO,UAAU;AAAA,IACvB,KAAK;AACH,aAAO,OAAO,GAAG,SAAS,wBAAwB;AAAA,IACpD,KAAK;AACH,aAAO,OAAO,IAAI,SAAS,wBAAwB;AAAA,IACrD,KAAK;AACH,aAAO,OAAO,GAAG,SAAS,wBAAwB;AAAA,IACpD,KAAK;AACH,aAAO,OAAO,IAAI,SAAS,wBAAwB;AAAA,IACrD,KAAK;AACH,aAAO,OAAO,MAAM,OAAO,MAAM,OAAO,MAAM,wBAAwB;AAAA,IACxE,KAAK;AACH,aACE,OAAO,MAAM,OAAO,MAAM,OAAO,MAAM,wBAAwB,KAC/D,OAAO,MAAM,OAAO,MAAM,OAAO,MAAM,wBAAwB;AAAA,IAEnE;AACE,aAAO;AAAA,EACX;AACF;AA0BO,MAAM,wBAAwB,CAAC,iBAAmC;AACvE,QAAM,UAAU,eAAe,YAAY;AAC3C,QAAM,WAAW,OAAO,WAAW,OAAO,KAAK,CAAC,GAAG;AAAA,IACjD,CAAC,SACC,OAAO,SAAS,YAAY,KAAK,YAAY,EAAE,WAAW,OAAO;AAAA,EACrE;AACA,MAAI,CAAC,OAAO,MAAM,OAAO,KAAK,CAAC,SAAS;AACtC,WAAO;AAAA,EACT;AACA,SAAO,aAAa;AAAA,IAClB,6BAA6B;AAAA,IAC7B,iBAAiB;AAAA,IACjB,UAAU;AAAA,IACV,oBAAoB;AAAA,EACtB,CAAC;AACH;AAUO,MAAM,oCAAoC,CAAC,aAGnC;AACb,MAAI,CAAC,SAAS,OAAO;AACnB,WAAO;AAAA,EACT;AACA,QAAM,eAAe,aAAa;AAAA,IAChC,6BAA6B,SAAS;AAAA,IACtC,iBAAiB;AAAA,IACjB,UAAU;AAAA,IACV,oBAAoB;AAAA,EACtB,CAAC;AACD,MAAI,CAAC,cAAc;AACjB,WAAO,aAAa;AAAA,MAClB,6BAA6B,SAAS;AAAA,MACtC,iBAAiB;AAAA,MACjB,UAAU;AAAA,MACV,oBAAoB;AAAA,IACtB,CAAC;AAAA,EACH;AACA,SACE,aAAa;AAAA,IACX,6BAA6B,SAAS;AAAA,IACtC,iBAAiB;AAAA,IACjB,UAAU;AAAA,IACV,oBAAoB;AAAA,EACtB,CAAC,KACD,aAAa;AAAA,IACX,6BAA6B,SAAS;AAAA,IACtC,iBAAiB;AAAA,IACjB,UAAU;AAAA,IACV,oBACE;AAAA,EACJ,CAAC;AAEL;AAuBO,MAAM,kCAAkC,CAC7C,iBACY;AACZ,MAAI,CAAC,cAAc;AACjB,WAAO;AAAA,EACT;AACA,QAAM,aAAa;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,aAAW,SAAS,YAAY;AAC9B,UAAM,eAAe,aAAa;AAAA,MAChC,6BAA6B;AAAA,MAC7B,iBAAiB;AAAA,MACjB,UAAU;AAAA,MACV,oBAAoB;AAAA,IACtB,CAAC;AACD,QAAI,cAAc;AAChB,aAAO,aAAa;AAAA,QAClB,6BAA6B;AAAA,QAC7B,iBAAiB;AAAA,QACjB,UAAU;AAAA,QACV,oBAAoB;AAAA,MACtB,CAAC;AAAA,IACH;AAAA,EACF;AAGA,SAAO,aAAa;AAAA,IAClB,6BAA6B;AAAA,IAC7B,iBAAiB;AAAA,IACjB,UAAU;AAAA,IACV,oBAAoB;AAAA,EACtB,CAAC;AACH;",
   "names": ["VersionCheckOperator"]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camunda/ccma-shared-types",
-  "version": "2.0.0",
+  "version": "4.0.0",
   "description": "Shared TypeScript types for Camunda Cloud Management Apps",
   "bugs": {
     "url": "https://github.com/camunda/camunda-cloud-management-apps/issues"

package/dist/constants/failoverRegionPairs.const.d.ts

@@ -1,36 +0,0 @@
-/**
- * Region pairs supported for cross-region failover (#9120). Failover is only
- * offered for dual-region clusters whose primary and secondary regions form
- * one of these reverse-region pairs — cluster creation must be supported in
- * both directions. Both directions of each pair are listed.
- *
- * This is the base set, enabled on every stage.
- *
- * Shared between console-backend (FailoverRouter guard) and c4 (hiding the
- * failover action for unsupported pairs).
- */
-export declare const SUPPORTED_FAILOVER_REGION_PAIRS: ReadonlySet<string>;
-/**
- * GCP's prod dual-region pair. Stathis confirmed it in the same Slack thread
- * as `GCP_FAILOVER_REGION_PAIRS` (#9816).
- *
- * `isSupportedFailoverRegionPair` reads this set on the 'prod' stage. Two
- * changes made this safe: GCP clusters have no BYOK option, so the AWS-only
- * key-policy screen never shows for a GCP cluster; and the operator
- * clone-role logic added a GCP branch in #9835.
- *
- * This set does not control customer access on its own. Two independent
- * gates still apply: the `failover` feature flag, which allows only
- * Camunda's internal org in prod, and the `failover` plan limit, which the
- * org must also have enabled. This set only tells the backend and c4 which
- * region pairs to treat as failover-capable.
- */
-export declare const GCP_FAILOVER_REGION_PAIRS_PROD: ReadonlySet<string>;
-/**
- * `stage` mirrors the featureflags `onlyDev` and `onlyPreprod` gates. The EU
- * test pairs unlock only on 'local' and 'dev'. The GCP test pair also unlocks
- * on 'int', because dev has no GCP failover test cluster. The GCP prod pair
- * unlocks only on 'prod'. When you omit stage, the function allows the base
- * set only.
- */
-export declare function isSupportedFailoverRegionPair(regionA: string | undefined, regionB: string | undefined, stage?: string): boolean;