@camunda/ccma-shared-types 5.0.0 → 7.0.0

package/dist/permissions/accounts.permissions.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/permissions/accounts.permissions.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type { Roles } from '../types/Roles.js'\n\nexport namespace AccountsPermissions {\n  export const READ_ALL = 'aara'\n  export const CREATE_ORG = 'aaco'\n  export const CHANGE_ORG_NAME = 'aacn'\n  export const DELETE_ORG = 'aado'\n  export const RESET_TOKEN_VERIFICATION = 'aart'\n  export const DELETE_USER = 'aadu'\n  export const DELETE_NOT_ACTIVATED_USER = 'aadn'\n  export const ADD_TO_ORG = 'aaao'\n  export const REMOVE_FROM_ORG = 'aaro'\n  export const SET_DEFAULT_ORG = 'aasd'\n  export const CANCEL_INVITE = 'aaci'\n  export const CHANGE_ROLE = 'aacr'\n  export const CHANGE_SAFE_ROLE = 'aacs'\n  export const EXTEND_TRIAL = 'aaet'\n  export const INVALIDATE_TOKEN = 'aait'\n  export const SALES_PLAN_CREATE = 'asc'\n  export const SALES_PLAN_MODIFY = 'asm'\n  export const SALES_PLAN_FORCE_MODIFY = 'asfm'\n  export const SALES_PLAN_SWITCH = 'ass'\n  export const SALES_PLAN_DELETE = 'asd'\n  export const SALES_PLAN_DELETE_AS_GOD = 'asdg'\n  export const SUPPORT_AGENT_REMOVE_AGENTS_FROM_ORG = 'asar'\n  export const SUPPORT_AGENT_SEE_ORG_MEMBERSHIPS = 'asas'\n  export const SUPPORT_AGENT_ADD_TO_ORG = 'asaa'\n  export const MODIFY_CLUSTER_PLAN_TYPE_RESERVATIONS = 'acpm'\n  export const M2M_SALESPLAN_GET = 'amsg'\n  export const M2M_SALESPLAN_SWITCH = 'amss'\n\n  // The routes of `api/admin/approvals` read `ConsolePermissions.M2M_CONTROL_APPROVALS`,\n  // the one m2m permission of control-backend for accounts and console.\n\n  export const ENTERPRISE_ORG_CONVERT = 'aeoc'\n\n  export const ENTERPRISE_ORG_MODIFY = 'aeom'\n\n  export const ENTERPRISE_ORG_MODIFY_START_DATE = 'aeos'\n\n  export const TRIAL_TO_IN_NEGOTIATION_CONVERT = 'atin'\n\n  export const EXTERNAL_M2M_GET_ORG_MEMBERS = 'amog'\n  export const EXTERNAL_M2M_SEARCH_ORGS = 'amos'\n  export const EXTERNAL_M2M_QA_ORG_CREATE = 'amqc'\n  export const EXTERNAL_M2M_OFFBOARD_CAMUNDI = 'amoc'\n\n  export const ORG_MAY_CHANGE_LIMITS = 'alc'\n  export const ORG_MAY_CHANGE_GENERATION_WHITELIST = 'algw'\n  export const ORG_CANCEL_PAID = 'aacp'\n\n  export const ADMIN_SQL = 'aasq'\n\n  export const ADMIN_AUTH0_CONNECTIONS_CREATE = 'aa0c'\n  export const ADMIN_AUTH0_CONNECTIONS_READ = 'aa0r'\n  export const ADMIN_AUTH0_CONNECTIONS_UPDATE = 'aa0u'\n  export const ADMIN_AUTH0_CONNECTIONS_DELETE = 'aa0d'\n  export const UNBLOCK_USER = 'aaub'\n\n  export const ADMIN_CHANGE_EMAIL = 'aace'\n  export const ADMIN_CHANGE_USER_NAME = 'aacu'\n\n  export const BOT = 'abot'\n\n  // OBACHT: NOT THIS ONE\n  export const MODELER_DELETE_USER = 'mdu'\n\n  export const GOD_CRON = 'gcr'\n  export const GOD_SIGNUP_SPAM_PATTERNS = 'gsp'\n  export const GOD_PURGE_USERS = 'gpu'\n  export const GOD_UPDATE_USER_METADATA = 'gum'\n\n  export const ADMIN_EARLY_ACCESS_FEATURES_READ = 'aaer'\n  export const ADMIN_EARLY_ACCESS_FEATURES_CREATE = 'aaec'\n  export const ADMIN_EARLY_ACCESS_FEATURES_DELETE = 'aaed'\n  export const ADMIN_EARLY_ACCESS_FEATURES_UPDATE = 'aaeu'\n  export const PDF_WATERMARK_READ = 'awmr'\n  export const PDF_WATERMARK_WRITE = 'awmw'\n  export const ROLE_SUPPORT_AGENT = 'support:agent'\n  export const FORCE_SALES_PLAN_ON_ORG = 'aafs'\n\n  export interface Features {\n    admin: {\n      readAll: boolean\n      createOrg: boolean\n      changeOrgName: boolean\n      deleteOrg: boolean\n      resetTokenVerification: boolean\n      deleteUser: boolean\n      deleteNotActivatedUser: boolean\n      addToOrg: boolean\n      removeFromOrg: boolean\n      setDefaultOrg: boolean\n      cancelInvite: boolean\n      changeRole: boolean\n      addSafeRole: boolean\n      deleteClusters: boolean\n      extendTrial: boolean\n      invalidateToken: boolean\n      cancelPaid: boolean\n      searchForOrgs: boolean\n      readAudit: boolean\n      modifyClusterPlanTypeReservations: boolean\n      mayChangeOrgLimits: boolean\n      mayChangeGenerationWhiteList: boolean\n      sql: boolean\n      modelerDeleteUser: boolean\n      unblockUser: boolean\n      god: {\n        triggerCrons: boolean\n        forceSalesPlanOnOrg: boolean\n        changeSignupSpamPatterns: boolean\n        purgeUsers: boolean\n        updateUserMetadata: boolean\n      }\n      bot: boolean\n      changeEmail: boolean\n      changeUserName: boolean\n    }\n    salesPlan: {\n      create: boolean\n      modify: boolean\n      forceModify: boolean\n      switch: boolean\n      delete: boolean\n      godDelete: boolean\n    }\n    enterprise: {\n      org: {\n        convert: boolean\n        modify: boolean\n        modifyStartDate: boolean\n      }\n    }\n    trial: {\n      convertToInNegotiation: boolean\n    }\n    supportAgent: {\n      removeAgentsFromOrg: boolean\n      seeOrgMemberships: boolean\n      addAgentsToOrg: boolean\n    }\n    m2m: {\n      salesplan: {\n        get: boolean\n        switch: boolean\n      }\n\n      fetchMigrationData: boolean\n      /** Every route of `api/admin/approvals`. See `M2M_CONTROL_APPROVALS`. */\n      approvals: boolean\n    }\n    externalM2m: {\n      org: {\n        members: {\n          get: boolean\n        }\n        search: boolean\n      }\n      qa: {\n        org: {\n          create: boolean\n        }\n      }\n      offboarding: {\n        camundi: boolean\n      }\n    }\n    auth0: {\n      connections: {\n        create: boolean\n        read: boolean\n        update: boolean\n        delete: boolean\n      }\n    }\n    notifications: {\n      global: {\n        read: boolean\n        delete: boolean\n        create: boolean\n      }\n    }\n    earlyAccessFeatures: {\n      read: boolean\n      create: boolean\n      delete: boolean\n      update: boolean\n    }\n    pdfWatermark: {\n      read: boolean\n      write: boolean\n    }\n  }\n\n  export function createEmptyFeatures(): Features {\n    return {\n      admin: {\n        readAll: false,\n        createOrg: false,\n        changeOrgName: false,\n        deleteOrg: false,\n        resetTokenVerification: false,\n        deleteUser: false,\n        deleteNotActivatedUser: false,\n        addToOrg: false,\n        removeFromOrg: false,\n        setDefaultOrg: false,\n        cancelInvite: false,\n        changeRole: false,\n        addSafeRole: false,\n        deleteClusters: false,\n        extendTrial: false,\n        invalidateToken: false,\n        cancelPaid: false,\n        searchForOrgs: false,\n        readAudit: false,\n        modifyClusterPlanTypeReservations: false,\n        mayChangeOrgLimits: false,\n        mayChangeGenerationWhiteList: false,\n        sql: false,\n        modelerDeleteUser: false,\n        unblockUser: false,\n        god: {\n          triggerCrons: false,\n          forceSalesPlanOnOrg: false,\n          changeSignupSpamPatterns: false,\n          purgeUsers: false,\n          updateUserMetadata: false,\n        },\n        bot: false,\n        changeEmail: false,\n        changeUserName: false,\n      },\n      salesPlan: {\n        create: false,\n        modify: false,\n        forceModify: false,\n        switch: false,\n        delete: false,\n        godDelete: false,\n      },\n      enterprise: {\n        org: { convert: false, modify: false, modifyStartDate: false },\n      },\n      trial: {\n        convertToInNegotiation: false,\n      },\n      supportAgent: {\n        removeAgentsFromOrg: false,\n        seeOrgMemberships: false,\n        addAgentsToOrg: false,\n      },\n      m2m: {\n        salesplan: {\n          get: false,\n          switch: false,\n        },\n        fetchMigrationData: false,\n        approvals: false,\n      },\n      externalM2m: {\n        org: {\n          members: {\n            get: false,\n          },\n          search: false,\n        },\n        // eslint-disable-next-line id-length\n        qa: {\n          org: {\n            create: false,\n          },\n        },\n        offboarding: {\n          camundi: false,\n        },\n      },\n      auth0: {\n        connections: {\n          create: false,\n          read: false,\n          update: false,\n          delete: false,\n        },\n      },\n      notifications: {\n        global: {\n          read: false,\n          delete: false,\n          create: false,\n        },\n      },\n      earlyAccessFeatures: {\n        read: false,\n        create: false,\n        delete: false,\n        update: false,\n      },\n      pdfWatermark: {\n        read: false,\n        write: false,\n      },\n    }\n  }\n\n  export const PermissionsAtAuth0: Array<{\n    value: string\n    description: string\n    initialRoles: Roles[]\n  }> = [\n    {\n      value: READ_ALL,\n      description: 'read access to all orgs and users',\n      initialRoles: [\n        'accounts:read',\n        'accounts:onboard',\n        'accounts:orgCreator',\n        'accounts:admin',\n        'accounts:editSalesPlans',\n        'console:admin',\n        'console:admin:readonly',\n        'support:agent',\n        'supersupport:agent',\n        'accounts:trialExtender',\n        'accounts:limitExtender',\n        'accounts:enterpriseAdmin',\n        'accounts:enterpriseOffboarding',\n        'console:C8ReleaseManager',\n        'console:C8UpdateEnforcer',\n        'accounts:addSafeRoles',\n        'accounts:consultingManager',\n        'accounts:earlyAccessEditor',\n      ],\n    },\n    {\n      value: CREATE_ORG,\n      description: 'can create organisations',\n      initialRoles: [\n        'accounts:onboard',\n        'accounts:orgCreator',\n        'accounts:admin',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: CHANGE_ORG_NAME,\n      description: 'can change name of organisations',\n      initialRoles: [\n        'accounts:admin',\n        'support:agent',\n        'supersupport:agent',\n        'accounts:onboard',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: DELETE_ORG,\n      description: 'can delete organisations',\n      initialRoles: ['accounts:admin'],\n    },\n    {\n      value: RESET_TOKEN_VERIFICATION,\n      description: 'can reset a verification token of a pending user',\n      initialRoles: [\n        'accounts:onboard',\n        'accounts:admin',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: DELETE_USER,\n      description: 'can delete users',\n      initialRoles: ['accounts:god'],\n    },\n    {\n      value: DELETE_NOT_ACTIVATED_USER,\n      description: 'can delete users that are not activated yet',\n      initialRoles: [\n        'accounts:onboard',\n        'accounts:admin',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: ADD_TO_ORG,\n      description: 'can add someone to an org',\n      initialRoles: [\n        'accounts:onboard',\n        'accounts:orgCreator',\n        'accounts:admin',\n        'accounts:enterpriseAdmin',\n        'supersupport:agent',\n      ],\n    },\n    {\n      value: REMOVE_FROM_ORG,\n      description: 'can remove someone from an org',\n      initialRoles: [\n        'accounts:admin',\n        'supersupport:agent',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: SET_DEFAULT_ORG,\n      description: 'can set an org as default for any user',\n      initialRoles: [\n        'support:agent',\n        'supersupport:agent',\n        'accounts:admin',\n        'accounts:enterpriseAdmin',\n        'accounts:onboard',\n      ],\n    },\n    {\n      value: CANCEL_INVITE,\n      description: 'can cancelpending invites',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:onboard',\n        'support:agent',\n        'supersupport:agent',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: CHANGE_ROLE,\n      description: 'can change the role of a user',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:onboard',\n        'accounts:enterpriseAdmin',\n        'supersupport:agent',\n      ],\n    },\n    {\n      value: EXTEND_TRIAL,\n      description: 'can extend the trial period of an organization',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:onboard',\n        'accounts:trialExtender',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: INVALIDATE_TOKEN,\n      description: 'can invalidate tokens in TokenIssuer',\n      initialRoles: ['accounts:admin'],\n    },\n    {\n      value: SALES_PLAN_CREATE,\n      description: 'can create a SalesPlan',\n      initialRoles: ['accounts:admin'],\n    },\n    {\n      value: SALES_PLAN_MODIFY,\n      description: 'can modify a SalesPlan',\n      initialRoles: ['accounts:admin', 'accounts:editSalesPlans'],\n    },\n    {\n      value: SALES_PLAN_FORCE_MODIFY,\n      description:\n        'can force modify a SalesPlan without caring about the orgs actual reservations/cluster usage',\n      initialRoles: [],\n    },\n    {\n      value: SALES_PLAN_SWITCH,\n      description: 'can switch an organization to another SalesPlan',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:enterpriseOffboarding',\n        'accounts:consultingManager',\n      ],\n    },\n    {\n      value: SALES_PLAN_DELETE,\n      description:\n        'can delete a SalesPlan if it is not used by any Organization',\n      initialRoles: ['accounts:admin'],\n    },\n\n    {\n      value: SALES_PLAN_DELETE_AS_GOD,\n      description: `can delete salesplans even if there is no replacement salesplan for this type. use with great caution`,\n      initialRoles: [],\n    },\n    {\n      value: SUPPORT_AGENT_REMOVE_AGENTS_FROM_ORG,\n      description: 'can remove support agents from organizations',\n      initialRoles: ['support:agent', 'supersupport:agent'],\n    },\n    {\n      value: SUPPORT_AGENT_SEE_ORG_MEMBERSHIPS,\n      description: 'can see all org memberships of support agents',\n      initialRoles: ['support:agent', 'supersupport:agent'],\n    },\n    {\n      value: SUPPORT_AGENT_ADD_TO_ORG,\n      description: 'can add users as support agent to an organization',\n      initialRoles: ['support:agent', 'supersupport:agent'],\n    },\n    {\n      value: MODIFY_CLUSTER_PLAN_TYPE_RESERVATIONS,\n      description: 'can modify cluster plan type reservations of an org',\n      initialRoles: [],\n    },\n    {\n      value: M2M_SALESPLAN_GET,\n      description: 'm2m can get salesplans',\n      initialRoles: [],\n    },\n    {\n      value: M2M_SALESPLAN_SWITCH,\n      description: 'm2m can switch salesplans',\n      initialRoles: [],\n    },\n    {\n      value: ENTERPRISE_ORG_CONVERT,\n      description: 'can convert orgs to enterprise plans',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:onboard',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: ENTERPRISE_ORG_MODIFY,\n      description:\n        'can modify value metrics and contract duration of enterprise orgs',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:enterpriseAdmin',\n        'accounts:enterpriseOffboarding',\n      ],\n    },\n    {\n      value: ENTERPRISE_ORG_MODIFY_START_DATE,\n      description: 'can modify start date of enterprise orgs',\n      initialRoles: [\n        'accounts:god',\n        'accounts:enterpriseOffboarding',\n        'accounts:admin',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: TRIAL_TO_IN_NEGOTIATION_CONVERT,\n      description: 'can convert trial orgs to in-negotiation plans',\n      initialRoles: ['accounts:admin', 'accounts:enterpriseAdmin'],\n    },\n    {\n      value: EXTERNAL_M2M_GET_ORG_MEMBERS,\n      description: 'external m2m can get all members of all orgs',\n      initialRoles: [],\n    },\n    {\n      value: EXTERNAL_M2M_QA_ORG_CREATE,\n      description:\n        'external m2m can create orgs, initially add users to org and assign sales plan',\n      initialRoles: [],\n    },\n    {\n      value: EXTERNAL_M2M_OFFBOARD_CAMUNDI,\n      description:\n        'external m2m can trigger offboarding process for Camunda employees',\n      initialRoles: ['accounts:god'],\n    },\n    {\n      value: EXTERNAL_M2M_SEARCH_ORGS,\n      description: 'external m2m can search organizations',\n      initialRoles: [],\n    },\n    {\n      value: ORG_MAY_CHANGE_LIMITS,\n      description: 'may change limits of an organization',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:enterpriseAdmin',\n        'accounts:limitExtender',\n      ],\n    },\n    {\n      value: ORG_MAY_CHANGE_GENERATION_WHITELIST,\n      description: 'may change the generation whitelist of an organization',\n      initialRoles: ['accounts:admin', 'accounts:clusterUpdates'],\n    },\n    {\n      value: ORG_CANCEL_PAID,\n      description: 'may terminate a running paid organisation',\n      initialRoles: ['accounts:admin', 'accounts:enterpriseOffboarding'],\n    },\n    {\n      value: ADMIN_SQL,\n      description: 'may query the DB',\n      initialRoles: ['accounts:god'],\n    },\n    {\n      value: ADMIN_AUTH0_CONNECTIONS_READ,\n      description: 'may read connections from auth0',\n      initialRoles: [\n        'accounts:read',\n        'accounts:orgCreator',\n        'support:agent',\n        'supersupport:agent',\n      ],\n    },\n    {\n      value: ADMIN_AUTH0_CONNECTIONS_CREATE,\n      description: 'may create new connections at auth0',\n      initialRoles: ['accounts:connections:create', 'accounts:god'],\n    },\n    {\n      value: ADMIN_AUTH0_CONNECTIONS_UPDATE,\n      description: 'may update connections at auth0',\n      initialRoles: ['accounts:connections:update', 'accounts:god'],\n    },\n    {\n      value: ADMIN_AUTH0_CONNECTIONS_DELETE,\n      description: 'may delete connections at auth0',\n      initialRoles: ['accounts:connections:delete', 'accounts:god'],\n    },\n    {\n      value: MODELER_DELETE_USER,\n      description: 'can delete a user within the modeler',\n      initialRoles: ['modeler:admin'],\n    },\n    {\n      value: UNBLOCK_USER,\n      description: 'can unblock a user',\n      initialRoles: ['accounts:admin'],\n    },\n    {\n      value: GOD_CRON,\n      description: 'can run cron jobs',\n      initialRoles: ['consoleTeam'],\n    },\n    {\n      value: GOD_SIGNUP_SPAM_PATTERNS,\n      description: 'can read and change signup spam patterns',\n      initialRoles: ['consoleTeam', 'accounts:god'],\n    },\n    {\n      value: GOD_PURGE_USERS,\n      description: 'can purge user records based on create date / name pattern',\n      initialRoles: ['consoleTeam', 'accounts:god'],\n    },\n    {\n      value: GOD_UPDATE_USER_METADATA,\n      description: 'can update auth0 user_metadata and app_metadata',\n      initialRoles: ['accounts:god'],\n    },\n    {\n      value: FORCE_SALES_PLAN_ON_ORG,\n      description: 'can force a sales plan on an org',\n      initialRoles: ['consoleTeam'],\n    },\n    {\n      value: CHANGE_SAFE_ROLE,\n      description: 'Can assign/unassign safe roles',\n      initialRoles: ['accounts:addSafeRoles', 'accounts:consultingManager'],\n    },\n    {\n      value: BOT,\n      description: 'Can execute bot commands',\n      initialRoles: [],\n    },\n    {\n      value: ADMIN_EARLY_ACCESS_FEATURES_READ,\n      description: 'may read Alpha Features',\n      initialRoles: [\n        'accounts:read',\n        'accounts:orgCreator',\n        'support:agent',\n        'supersupport:agent',\n        'accounts:admin',\n        'accounts:earlyAccessEditor',\n      ],\n    },\n    {\n      value: ADMIN_EARLY_ACCESS_FEATURES_CREATE,\n      description: 'may create new Alpha Features',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:god',\n        'accounts:earlyAccessEditor',\n      ],\n    },\n    {\n      value: ADMIN_EARLY_ACCESS_FEATURES_DELETE,\n      description: 'may delete Alpha Features',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:god',\n        'accounts:earlyAccessEditor',\n      ],\n    },\n    {\n      value: ADMIN_EARLY_ACCESS_FEATURES_UPDATE,\n      description: 'may delete Alpha Features',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:god',\n        'accounts:earlyAccessEditor',\n      ],\n    },\n    {\n      value: PDF_WATERMARK_READ,\n      description: 'may read PDF watermark projects and the audit log',\n      initialRoles: [\n        'accounts:pdfWatermarkReader',\n        'accounts:pdfWatermarkWriter',\n      ],\n    },\n    {\n      value: PDF_WATERMARK_WRITE,\n      description: 'may create, update and delete PDF watermark projects',\n      initialRoles: ['accounts:pdfWatermarkWriter'],\n    },\n    {\n      value: ADMIN_CHANGE_EMAIL,\n      description: 'can change the email of an user',\n      initialRoles: ['accounts:admin'],\n    },\n    {\n      value: ADMIN_CHANGE_USER_NAME,\n      description: 'can change the name of an user',\n      initialRoles: ['accounts:admin'],\n    },\n  ]\n}\n"],
-  "mappings": "AAQO,IAAU;AAAA,CAAV,CAAUA,yBAAV;AACE,EAAMA,qBAAA,WAAW;AACjB,EAAMA,qBAAA,aAAa;AACnB,EAAMA,qBAAA,kBAAkB;AACxB,EAAMA,qBAAA,aAAa;AACnB,EAAMA,qBAAA,2BAA2B;AACjC,EAAMA,qBAAA,cAAc;AACpB,EAAMA,qBAAA,4BAA4B;AAClC,EAAMA,qBAAA,aAAa;AACnB,EAAMA,qBAAA,kBAAkB;AACxB,EAAMA,qBAAA,kBAAkB;AACxB,EAAMA,qBAAA,gBAAgB;AACtB,EAAMA,qBAAA,cAAc;AACpB,EAAMA,qBAAA,mBAAmB;AACzB,EAAMA,qBAAA,eAAe;AACrB,EAAMA,qBAAA,mBAAmB;AACzB,EAAMA,qBAAA,oBAAoB;AAC1B,EAAMA,qBAAA,oBAAoB;AAC1B,EAAMA,qBAAA,0BAA0B;AAChC,EAAMA,qBAAA,oBAAoB;AAC1B,EAAMA,qBAAA,oBAAoB;AAC1B,EAAMA,qBAAA,2BAA2B;AACjC,EAAMA,qBAAA,uCAAuC;AAC7C,EAAMA,qBAAA,oCAAoC;AAC1C,EAAMA,qBAAA,2BAA2B;AACjC,EAAMA,qBAAA,wCAAwC;AAC9C,EAAMA,qBAAA,oBAAoB;AAC1B,EAAMA,qBAAA,uBAAuB;AAK7B,EAAMA,qBAAA,yBAAyB;AAE/B,EAAMA,qBAAA,wBAAwB;AAE9B,EAAMA,qBAAA,mCAAmC;AAEzC,EAAMA,qBAAA,kCAAkC;AAExC,EAAMA,qBAAA,+BAA+B;AACrC,EAAMA,qBAAA,2BAA2B;AACjC,EAAMA,qBAAA,6BAA6B;AACnC,EAAMA,qBAAA,gCAAgC;AAEtC,EAAMA,qBAAA,wBAAwB;AAC9B,EAAMA,qBAAA,sCAAsC;AAC5C,EAAMA,qBAAA,kBAAkB;AAExB,EAAMA,qBAAA,YAAY;AAElB,EAAMA,qBAAA,iCAAiC;AACvC,EAAMA,qBAAA,+BAA+B;AACrC,EAAMA,qBAAA,iCAAiC;AACvC,EAAMA,qBAAA,iCAAiC;AACvC,EAAMA,qBAAA,eAAe;AAErB,EAAMA,qBAAA,qBAAqB;AAC3B,EAAMA,qBAAA,yBAAyB;AAE/B,EAAMA,qBAAA,MAAM;AAGZ,EAAMA,qBAAA,sBAAsB;AAE5B,EAAMA,qBAAA,WAAW;AACjB,EAAMA,qBAAA,2BAA2B;AACjC,EAAMA,qBAAA,kBAAkB;AACxB,EAAMA,qBAAA,2BAA2B;AAEjC,EAAMA,qBAAA,mCAAmC;AACzC,EAAMA,qBAAA,qCAAqC;AAC3C,EAAMA,qBAAA,qCAAqC;AAC3C,EAAMA,qBAAA,qCAAqC;AAC3C,EAAMA,qBAAA,qBAAqB;AAC3B,EAAMA,qBAAA,sBAAsB;AAC5B,EAAMA,qBAAA,qBAAqB;AAC3B,EAAMA,qBAAA,0BAA0B;AAoHhC,WAAS,sBAAgC;AAC9C,WAAO;AAAA,MACL,OAAO;AAAA,QACL,SAAS;AAAA,QACT,WAAW;AAAA,QACX,eAAe;AAAA,QACf,WAAW;AAAA,QACX,wBAAwB;AAAA,QACxB,YAAY;AAAA,QACZ,wBAAwB;AAAA,QACxB,UAAU;AAAA,QACV,eAAe;AAAA,QACf,eAAe;AAAA,QACf,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,aAAa;AAAA,QACb,gBAAgB;AAAA,QAChB,aAAa;AAAA,QACb,iBAAiB;AAAA,QACjB,YAAY;AAAA,QACZ,eAAe;AAAA,QACf,WAAW;AAAA,QACX,mCAAmC;AAAA,QACnC,oBAAoB;AAAA,QACpB,8BAA8B;AAAA,QAC9B,KAAK;AAAA,QACL,mBAAmB;AAAA,QACnB,aAAa;AAAA,QACb,KAAK;AAAA,UACH,cAAc;AAAA,UACd,qBAAqB;AAAA,UACrB,0BAA0B;AAAA,UAC1B,YAAY;AAAA,UACZ,oBAAoB;AAAA,QACtB;AAAA,QACA,KAAK;AAAA,QACL,aAAa;AAAA,QACb,gBAAgB;AAAA,MAClB;AAAA,MACA,WAAW;AAAA,QACT,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,WAAW;AAAA,MACb;AAAA,MACA,YAAY;AAAA,QACV,KAAK,EAAE,SAAS,OAAO,QAAQ,OAAO,iBAAiB,MAAM;AAAA,MAC/D;AAAA,MACA,OAAO;AAAA,QACL,wBAAwB;AAAA,MAC1B;AAAA,MACA,cAAc;AAAA,QACZ,qBAAqB;AAAA,QACrB,mBAAmB;AAAA,QACnB,gBAAgB;AAAA,MAClB;AAAA,MACA,KAAK;AAAA,QACH,WAAW;AAAA,UACT,KAAK;AAAA,UACL,QAAQ;AAAA,QACV;AAAA,QACA,oBAAoB;AAAA,QACpB,WAAW;AAAA,MACb;AAAA,MACA,aAAa;AAAA,QACX,KAAK;AAAA,UACH,SAAS;AAAA,YACP,KAAK;AAAA,UACP;AAAA,UACA,QAAQ;AAAA,QACV;AAAA;AAAA,QAEA,IAAI;AAAA,UACF,KAAK;AAAA,YACH,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,QACA,aAAa;AAAA,UACX,SAAS;AAAA,QACX;AAAA,MACF;AAAA,MACA,OAAO;AAAA,QACL,aAAa;AAAA,UACX,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,eAAe;AAAA,QACb,QAAQ;AAAA,UACN,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,qBAAqB;AAAA,QACnB,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AAAA,MACA,cAAc;AAAA,QACZ,MAAM;AAAA,QACN,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AA7GO,EAAAA,qBAAS;AA+GT,EAAMA,qBAAA,qBAIR;AAAA,IACH;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,cAAc;AAAA,IAC/B;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,kBAAkB,yBAAyB;AAAA,IAC5D;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IAEA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,oBAAoB;AAAA,IACtD;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,oBAAoB;AAAA,IACtD;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,oBAAoB;AAAA,IACtD;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,kBAAkB,0BAA0B;AAAA,IAC7D;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC,cAAc;AAAA,IAC/B;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,kBAAkB,yBAAyB;AAAA,IAC5D;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,kBAAkB,gCAAgC;AAAA,IACnE;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,cAAc;AAAA,IAC/B;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,+BAA+B,cAAc;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,+BAA+B,cAAc;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,+BAA+B,cAAc;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,aAAa;AAAA,IAC9B;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe,cAAc;AAAA,IAC9C;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe,cAAc;AAAA,IAC9C;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,cAAc;AAAA,IAC/B;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,aAAa;AAAA,IAC9B;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,yBAAyB,4BAA4B;AAAA,IACtE;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,6BAA6B;AAAA,IAC9C;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,EACF;AAAA,GAxtBe;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type { Roles } from '../types/Roles.js'\n\nexport namespace AccountsPermissions {\n  export const READ_ALL = 'aara'\n  export const CREATE_ORG = 'aaco'\n  export const CHANGE_ORG_NAME = 'aacn'\n  export const DELETE_ORG = 'aado'\n  export const RESET_TOKEN_VERIFICATION = 'aart'\n  export const DELETE_USER = 'aadu'\n  export const DELETE_NOT_ACTIVATED_USER = 'aadn'\n  export const ADD_TO_ORG = 'aaao'\n  export const REMOVE_FROM_ORG = 'aaro'\n  export const SET_DEFAULT_ORG = 'aasd'\n  export const CANCEL_INVITE = 'aaci'\n  export const CHANGE_ROLE = 'aacr'\n  export const CHANGE_SAFE_ROLE = 'aacs'\n  export const EXTEND_TRIAL = 'aaet'\n  export const INVALIDATE_TOKEN = 'aait'\n  export const SALES_PLAN_CREATE = 'asc'\n  export const SALES_PLAN_MODIFY = 'asm'\n  export const SALES_PLAN_FORCE_MODIFY = 'asfm'\n  export const SALES_PLAN_SWITCH = 'ass'\n  export const SALES_PLAN_DELETE = 'asd'\n  export const SALES_PLAN_DELETE_AS_GOD = 'asdg'\n  export const SUPPORT_AGENT_REMOVE_AGENTS_FROM_ORG = 'asar'\n  export const SUPPORT_AGENT_SEE_ORG_MEMBERSHIPS = 'asas'\n  export const SUPPORT_AGENT_ADD_TO_ORG = 'asaa'\n  export const MODIFY_CLUSTER_PLAN_TYPE_RESERVATIONS = 'acpm'\n  export const M2M_SALESPLAN_GET = 'amsg'\n  export const M2M_SALESPLAN_SWITCH = 'amss'\n\n  // The routes of `api/admin/approvals` read `ConsolePermissions.M2M_CONTROL_APPROVALS`,\n  // the one m2m permission of control-backend for accounts and console.\n\n  export const ENTERPRISE_ORG_CONVERT = 'aeoc'\n\n  export const ENTERPRISE_ORG_MODIFY = 'aeom'\n\n  export const ENTERPRISE_ORG_MODIFY_START_DATE = 'aeos'\n\n  export const TRIAL_TO_IN_NEGOTIATION_CONVERT = 'atin'\n\n  export const EXTERNAL_M2M_GET_ORG_MEMBERS = 'amog'\n  export const EXTERNAL_M2M_SEARCH_ORGS = 'amos'\n  export const EXTERNAL_M2M_QA_ORG_CREATE = 'amqc'\n  export const EXTERNAL_M2M_OFFBOARD_CAMUNDI = 'amoc'\n\n  export const ORG_MAY_CHANGE_LIMITS = 'alc'\n  export const ORG_MAY_CHANGE_GENERATION_WHITELIST = 'algw'\n  export const ORG_CANCEL_PAID = 'aacp'\n\n  export const ADMIN_SQL = 'aasq'\n\n  export const ADMIN_AUTH0_CONNECTIONS_CREATE = 'aa0c'\n  export const ADMIN_AUTH0_CONNECTIONS_READ = 'aa0r'\n  export const ADMIN_AUTH0_CONNECTIONS_UPDATE = 'aa0u'\n  export const ADMIN_AUTH0_CONNECTIONS_DELETE = 'aa0d'\n  export const UNBLOCK_USER = 'aaub'\n\n  export const ADMIN_CHANGE_EMAIL = 'aace'\n  export const ADMIN_CHANGE_USER_NAME = 'aacu'\n\n  export const BOT = 'abot'\n\n  // OBACHT: NOT THIS ONE\n  export const MODELER_DELETE_USER = 'mdu'\n\n  export const GOD_CRON = 'gcr'\n  export const GOD_SIGNUP_SPAM_PATTERNS = 'gsp'\n  export const GOD_PURGE_USERS = 'gpu'\n  export const GOD_UPDATE_USER_METADATA = 'gum'\n\n  export const ADMIN_EARLY_ACCESS_FEATURES_READ = 'aaer'\n  export const ADMIN_EARLY_ACCESS_FEATURES_CREATE = 'aaec'\n  export const ADMIN_EARLY_ACCESS_FEATURES_DELETE = 'aaed'\n  export const ADMIN_EARLY_ACCESS_FEATURES_UPDATE = 'aaeu'\n  export const PDF_WATERMARK_READ = 'awmr'\n  export const PDF_WATERMARK_WRITE = 'awmw'\n  export const ROLE_SUPPORT_AGENT = 'support:agent'\n  export const FORCE_SALES_PLAN_ON_ORG = 'aafs'\n\n  /**\n   * May create, edit and delete a feature flag on the page of Camunda Control.\n   *\n   * A row of the table of control-backend is the value of the flag on its\n   * stage, and no approval stands in front of a write. Reading the rows takes\n   * `READ_ALL`. Do not reuse `acfo`: it still exists at Auth0 with the meaning\n   * of the reverted override design.\n   */\n  export const ADMIN_FEATURE_FLAGS_WRITE = 'aafw'\n\n  export interface Features {\n    admin: {\n      readAll: boolean\n      createOrg: boolean\n      changeOrgName: boolean\n      deleteOrg: boolean\n      resetTokenVerification: boolean\n      deleteUser: boolean\n      deleteNotActivatedUser: boolean\n      addToOrg: boolean\n      removeFromOrg: boolean\n      setDefaultOrg: boolean\n      cancelInvite: boolean\n      changeRole: boolean\n      addSafeRole: boolean\n      deleteClusters: boolean\n      extendTrial: boolean\n      invalidateToken: boolean\n      cancelPaid: boolean\n      searchForOrgs: boolean\n      readAudit: boolean\n      modifyClusterPlanTypeReservations: boolean\n      mayChangeOrgLimits: boolean\n      mayChangeGenerationWhiteList: boolean\n      sql: boolean\n      modelerDeleteUser: boolean\n      unblockUser: boolean\n      god: {\n        triggerCrons: boolean\n        forceSalesPlanOnOrg: boolean\n        changeSignupSpamPatterns: boolean\n        purgeUsers: boolean\n        updateUserMetadata: boolean\n      }\n      bot: boolean\n      changeEmail: boolean\n      changeUserName: boolean\n    }\n    salesPlan: {\n      create: boolean\n      modify: boolean\n      forceModify: boolean\n      switch: boolean\n      delete: boolean\n      godDelete: boolean\n    }\n    enterprise: {\n      org: {\n        convert: boolean\n        modify: boolean\n        modifyStartDate: boolean\n      }\n    }\n    trial: {\n      convertToInNegotiation: boolean\n    }\n    supportAgent: {\n      removeAgentsFromOrg: boolean\n      seeOrgMemberships: boolean\n      addAgentsToOrg: boolean\n    }\n    m2m: {\n      salesplan: {\n        get: boolean\n        switch: boolean\n      }\n\n      fetchMigrationData: boolean\n      /** Every route of `api/admin/approvals`. See `M2M_CONTROL_APPROVALS`. */\n      approvals: boolean\n    }\n    externalM2m: {\n      org: {\n        members: {\n          get: boolean\n        }\n        search: boolean\n      }\n      qa: {\n        org: {\n          create: boolean\n        }\n      }\n      offboarding: {\n        camundi: boolean\n      }\n    }\n    auth0: {\n      connections: {\n        create: boolean\n        read: boolean\n        update: boolean\n        delete: boolean\n      }\n    }\n    notifications: {\n      global: {\n        read: boolean\n        delete: boolean\n        create: boolean\n      }\n    }\n    earlyAccessFeatures: {\n      read: boolean\n      create: boolean\n      delete: boolean\n      update: boolean\n    }\n    pdfWatermark: {\n      read: boolean\n      write: boolean\n    }\n    featureFlags: {\n      write: boolean\n    }\n  }\n\n  export function createEmptyFeatures(): Features {\n    return {\n      admin: {\n        readAll: false,\n        createOrg: false,\n        changeOrgName: false,\n        deleteOrg: false,\n        resetTokenVerification: false,\n        deleteUser: false,\n        deleteNotActivatedUser: false,\n        addToOrg: false,\n        removeFromOrg: false,\n        setDefaultOrg: false,\n        cancelInvite: false,\n        changeRole: false,\n        addSafeRole: false,\n        deleteClusters: false,\n        extendTrial: false,\n        invalidateToken: false,\n        cancelPaid: false,\n        searchForOrgs: false,\n        readAudit: false,\n        modifyClusterPlanTypeReservations: false,\n        mayChangeOrgLimits: false,\n        mayChangeGenerationWhiteList: false,\n        sql: false,\n        modelerDeleteUser: false,\n        unblockUser: false,\n        god: {\n          triggerCrons: false,\n          forceSalesPlanOnOrg: false,\n          changeSignupSpamPatterns: false,\n          purgeUsers: false,\n          updateUserMetadata: false,\n        },\n        bot: false,\n        changeEmail: false,\n        changeUserName: false,\n      },\n      salesPlan: {\n        create: false,\n        modify: false,\n        forceModify: false,\n        switch: false,\n        delete: false,\n        godDelete: false,\n      },\n      enterprise: {\n        org: { convert: false, modify: false, modifyStartDate: false },\n      },\n      trial: {\n        convertToInNegotiation: false,\n      },\n      supportAgent: {\n        removeAgentsFromOrg: false,\n        seeOrgMemberships: false,\n        addAgentsToOrg: false,\n      },\n      m2m: {\n        salesplan: {\n          get: false,\n          switch: false,\n        },\n        fetchMigrationData: false,\n        approvals: false,\n      },\n      externalM2m: {\n        org: {\n          members: {\n            get: false,\n          },\n          search: false,\n        },\n        // eslint-disable-next-line id-length\n        qa: {\n          org: {\n            create: false,\n          },\n        },\n        offboarding: {\n          camundi: false,\n        },\n      },\n      auth0: {\n        connections: {\n          create: false,\n          read: false,\n          update: false,\n          delete: false,\n        },\n      },\n      notifications: {\n        global: {\n          read: false,\n          delete: false,\n          create: false,\n        },\n      },\n      earlyAccessFeatures: {\n        read: false,\n        create: false,\n        delete: false,\n        update: false,\n      },\n      pdfWatermark: {\n        read: false,\n        write: false,\n      },\n      featureFlags: {\n        write: false,\n      },\n    }\n  }\n\n  export const PermissionsAtAuth0: Array<{\n    value: string\n    description: string\n    initialRoles: Roles[]\n  }> = [\n    {\n      value: READ_ALL,\n      description: 'read access to all orgs and users',\n      initialRoles: [\n        'accounts:read',\n        'accounts:onboard',\n        'accounts:orgCreator',\n        'accounts:admin',\n        'accounts:editSalesPlans',\n        'console:admin',\n        'console:admin:readonly',\n        'support:agent',\n        'supersupport:agent',\n        'accounts:trialExtender',\n        'accounts:limitExtender',\n        'accounts:enterpriseAdmin',\n        'accounts:enterpriseOffboarding',\n        'console:C8ReleaseManager',\n        'console:C8UpdateEnforcer',\n        'accounts:addSafeRoles',\n        'accounts:consultingManager',\n        'accounts:earlyAccessEditor',\n      ],\n    },\n    {\n      value: CREATE_ORG,\n      description: 'can create organisations',\n      initialRoles: [\n        'accounts:onboard',\n        'accounts:orgCreator',\n        'accounts:admin',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: CHANGE_ORG_NAME,\n      description: 'can change name of organisations',\n      initialRoles: [\n        'accounts:admin',\n        'support:agent',\n        'supersupport:agent',\n        'accounts:onboard',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: DELETE_ORG,\n      description: 'can delete organisations',\n      initialRoles: ['accounts:admin'],\n    },\n    {\n      value: RESET_TOKEN_VERIFICATION,\n      description: 'can reset a verification token of a pending user',\n      initialRoles: [\n        'accounts:onboard',\n        'accounts:admin',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: DELETE_USER,\n      description: 'can delete users',\n      initialRoles: ['accounts:god'],\n    },\n    {\n      value: DELETE_NOT_ACTIVATED_USER,\n      description: 'can delete users that are not activated yet',\n      initialRoles: [\n        'accounts:onboard',\n        'accounts:admin',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: ADD_TO_ORG,\n      description: 'can add someone to an org',\n      initialRoles: [\n        'accounts:onboard',\n        'accounts:orgCreator',\n        'accounts:admin',\n        'accounts:enterpriseAdmin',\n        'supersupport:agent',\n      ],\n    },\n    {\n      value: REMOVE_FROM_ORG,\n      description: 'can remove someone from an org',\n      initialRoles: [\n        'accounts:admin',\n        'supersupport:agent',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: SET_DEFAULT_ORG,\n      description: 'can set an org as default for any user',\n      initialRoles: [\n        'support:agent',\n        'supersupport:agent',\n        'accounts:admin',\n        'accounts:enterpriseAdmin',\n        'accounts:onboard',\n      ],\n    },\n    {\n      value: CANCEL_INVITE,\n      description: 'can cancelpending invites',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:onboard',\n        'support:agent',\n        'supersupport:agent',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: CHANGE_ROLE,\n      description: 'can change the role of a user',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:onboard',\n        'accounts:enterpriseAdmin',\n        'supersupport:agent',\n      ],\n    },\n    {\n      value: EXTEND_TRIAL,\n      description: 'can extend the trial period of an organization',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:onboard',\n        'accounts:trialExtender',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: INVALIDATE_TOKEN,\n      description: 'can invalidate tokens in TokenIssuer',\n      initialRoles: ['accounts:admin'],\n    },\n    {\n      value: SALES_PLAN_CREATE,\n      description: 'can create a SalesPlan',\n      initialRoles: ['accounts:admin'],\n    },\n    {\n      value: SALES_PLAN_MODIFY,\n      description: 'can modify a SalesPlan',\n      initialRoles: ['accounts:admin', 'accounts:editSalesPlans'],\n    },\n    {\n      value: SALES_PLAN_FORCE_MODIFY,\n      description:\n        'can force modify a SalesPlan without caring about the orgs actual reservations/cluster usage',\n      initialRoles: [],\n    },\n    {\n      value: SALES_PLAN_SWITCH,\n      description: 'can switch an organization to another SalesPlan',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:enterpriseOffboarding',\n        'accounts:consultingManager',\n      ],\n    },\n    {\n      value: SALES_PLAN_DELETE,\n      description:\n        'can delete a SalesPlan if it is not used by any Organization',\n      initialRoles: ['accounts:admin'],\n    },\n\n    {\n      value: SALES_PLAN_DELETE_AS_GOD,\n      description: `can delete salesplans even if there is no replacement salesplan for this type. use with great caution`,\n      initialRoles: [],\n    },\n    {\n      value: SUPPORT_AGENT_REMOVE_AGENTS_FROM_ORG,\n      description: 'can remove support agents from organizations',\n      initialRoles: ['support:agent', 'supersupport:agent'],\n    },\n    {\n      value: SUPPORT_AGENT_SEE_ORG_MEMBERSHIPS,\n      description: 'can see all org memberships of support agents',\n      initialRoles: ['support:agent', 'supersupport:agent'],\n    },\n    {\n      value: SUPPORT_AGENT_ADD_TO_ORG,\n      description: 'can add users as support agent to an organization',\n      initialRoles: ['support:agent', 'supersupport:agent'],\n    },\n    {\n      value: MODIFY_CLUSTER_PLAN_TYPE_RESERVATIONS,\n      description: 'can modify cluster plan type reservations of an org',\n      initialRoles: [],\n    },\n    {\n      value: M2M_SALESPLAN_GET,\n      description: 'm2m can get salesplans',\n      initialRoles: [],\n    },\n    {\n      value: M2M_SALESPLAN_SWITCH,\n      description: 'm2m can switch salesplans',\n      initialRoles: [],\n    },\n    {\n      value: ENTERPRISE_ORG_CONVERT,\n      description: 'can convert orgs to enterprise plans',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:onboard',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: ENTERPRISE_ORG_MODIFY,\n      description:\n        'can modify value metrics and contract duration of enterprise orgs',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:enterpriseAdmin',\n        'accounts:enterpriseOffboarding',\n      ],\n    },\n    {\n      value: ENTERPRISE_ORG_MODIFY_START_DATE,\n      description: 'can modify start date of enterprise orgs',\n      initialRoles: [\n        'accounts:god',\n        'accounts:enterpriseOffboarding',\n        'accounts:admin',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: TRIAL_TO_IN_NEGOTIATION_CONVERT,\n      description: 'can convert trial orgs to in-negotiation plans',\n      initialRoles: ['accounts:admin', 'accounts:enterpriseAdmin'],\n    },\n    {\n      value: EXTERNAL_M2M_GET_ORG_MEMBERS,\n      description: 'external m2m can get all members of all orgs',\n      initialRoles: [],\n    },\n    {\n      value: EXTERNAL_M2M_QA_ORG_CREATE,\n      description:\n        'external m2m can create orgs, initially add users to org and assign sales plan',\n      initialRoles: [],\n    },\n    {\n      value: EXTERNAL_M2M_OFFBOARD_CAMUNDI,\n      description:\n        'external m2m can trigger offboarding process for Camunda employees',\n      initialRoles: ['accounts:god'],\n    },\n    {\n      value: EXTERNAL_M2M_SEARCH_ORGS,\n      description: 'external m2m can search organizations',\n      initialRoles: [],\n    },\n    {\n      value: ORG_MAY_CHANGE_LIMITS,\n      description: 'may change limits of an organization',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:enterpriseAdmin',\n        'accounts:limitExtender',\n      ],\n    },\n    {\n      value: ORG_MAY_CHANGE_GENERATION_WHITELIST,\n      description: 'may change the generation whitelist of an organization',\n      initialRoles: ['accounts:admin', 'accounts:clusterUpdates'],\n    },\n    {\n      value: ORG_CANCEL_PAID,\n      description: 'may terminate a running paid organisation',\n      initialRoles: ['accounts:admin', 'accounts:enterpriseOffboarding'],\n    },\n    {\n      value: ADMIN_SQL,\n      description: 'may query the DB',\n      initialRoles: ['accounts:god'],\n    },\n    {\n      value: ADMIN_AUTH0_CONNECTIONS_READ,\n      description: 'may read connections from auth0',\n      initialRoles: [\n        'accounts:read',\n        'accounts:orgCreator',\n        'support:agent',\n        'supersupport:agent',\n      ],\n    },\n    {\n      value: ADMIN_AUTH0_CONNECTIONS_CREATE,\n      description: 'may create new connections at auth0',\n      initialRoles: ['accounts:connections:create', 'accounts:god'],\n    },\n    {\n      value: ADMIN_AUTH0_CONNECTIONS_UPDATE,\n      description: 'may update connections at auth0',\n      initialRoles: ['accounts:connections:update', 'accounts:god'],\n    },\n    {\n      value: ADMIN_AUTH0_CONNECTIONS_DELETE,\n      description: 'may delete connections at auth0',\n      initialRoles: ['accounts:connections:delete', 'accounts:god'],\n    },\n    {\n      value: MODELER_DELETE_USER,\n      description: 'can delete a user within the modeler',\n      initialRoles: ['modeler:admin'],\n    },\n    {\n      value: UNBLOCK_USER,\n      description: 'can unblock a user',\n      initialRoles: ['accounts:admin'],\n    },\n    {\n      value: GOD_CRON,\n      description: 'can run cron jobs',\n      initialRoles: ['consoleTeam'],\n    },\n    {\n      value: GOD_SIGNUP_SPAM_PATTERNS,\n      description: 'can read and change signup spam patterns',\n      initialRoles: ['consoleTeam', 'accounts:god'],\n    },\n    {\n      value: GOD_PURGE_USERS,\n      description: 'can purge user records based on create date / name pattern',\n      initialRoles: ['consoleTeam', 'accounts:god'],\n    },\n    {\n      value: GOD_UPDATE_USER_METADATA,\n      description: 'can update auth0 user_metadata and app_metadata',\n      initialRoles: ['accounts:god'],\n    },\n    {\n      value: FORCE_SALES_PLAN_ON_ORG,\n      description: 'can force a sales plan on an org',\n      initialRoles: ['consoleTeam'],\n    },\n    {\n      value: CHANGE_SAFE_ROLE,\n      description: 'Can assign/unassign safe roles',\n      initialRoles: ['accounts:addSafeRoles', 'accounts:consultingManager'],\n    },\n    {\n      value: BOT,\n      description: 'Can execute bot commands',\n      initialRoles: [],\n    },\n    {\n      value: ADMIN_EARLY_ACCESS_FEATURES_READ,\n      description: 'may read Alpha Features',\n      initialRoles: [\n        'accounts:read',\n        'accounts:orgCreator',\n        'support:agent',\n        'supersupport:agent',\n        'accounts:admin',\n        'accounts:earlyAccessEditor',\n      ],\n    },\n    {\n      value: ADMIN_EARLY_ACCESS_FEATURES_CREATE,\n      description: 'may create new Alpha Features',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:god',\n        'accounts:earlyAccessEditor',\n      ],\n    },\n    {\n      value: ADMIN_EARLY_ACCESS_FEATURES_DELETE,\n      description: 'may delete Alpha Features',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:god',\n        'accounts:earlyAccessEditor',\n      ],\n    },\n    {\n      value: ADMIN_EARLY_ACCESS_FEATURES_UPDATE,\n      description: 'may delete Alpha Features',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:god',\n        'accounts:earlyAccessEditor',\n      ],\n    },\n    {\n      value: PDF_WATERMARK_READ,\n      description: 'may read PDF watermark projects and the audit log',\n      initialRoles: [\n        'accounts:pdfWatermarkReader',\n        'accounts:pdfWatermarkWriter',\n      ],\n    },\n    {\n      value: PDF_WATERMARK_WRITE,\n      description: 'may create, update and delete PDF watermark projects',\n      initialRoles: ['accounts:pdfWatermarkWriter'],\n    },\n    {\n      value: ADMIN_FEATURE_FLAGS_WRITE,\n      description:\n        'may create, edit and delete a feature flag in Camunda Control',\n      // `accounts:admin` is a ROLE, and control-backend checks permissions,\n      // thus the role gets a permission of its own.\n      initialRoles: ['accounts:admin'],\n    },\n    {\n      value: ADMIN_CHANGE_EMAIL,\n      description: 'can change the email of an user',\n      initialRoles: ['accounts:admin'],\n    },\n    {\n      value: ADMIN_CHANGE_USER_NAME,\n      description: 'can change the name of an user',\n      initialRoles: ['accounts:admin'],\n    },\n  ]\n}\n"],
+  "mappings": "AAQO,IAAU;AAAA,CAAV,CAAUA,yBAAV;AACE,EAAMA,qBAAA,WAAW;AACjB,EAAMA,qBAAA,aAAa;AACnB,EAAMA,qBAAA,kBAAkB;AACxB,EAAMA,qBAAA,aAAa;AACnB,EAAMA,qBAAA,2BAA2B;AACjC,EAAMA,qBAAA,cAAc;AACpB,EAAMA,qBAAA,4BAA4B;AAClC,EAAMA,qBAAA,aAAa;AACnB,EAAMA,qBAAA,kBAAkB;AACxB,EAAMA,qBAAA,kBAAkB;AACxB,EAAMA,qBAAA,gBAAgB;AACtB,EAAMA,qBAAA,cAAc;AACpB,EAAMA,qBAAA,mBAAmB;AACzB,EAAMA,qBAAA,eAAe;AACrB,EAAMA,qBAAA,mBAAmB;AACzB,EAAMA,qBAAA,oBAAoB;AAC1B,EAAMA,qBAAA,oBAAoB;AAC1B,EAAMA,qBAAA,0BAA0B;AAChC,EAAMA,qBAAA,oBAAoB;AAC1B,EAAMA,qBAAA,oBAAoB;AAC1B,EAAMA,qBAAA,2BAA2B;AACjC,EAAMA,qBAAA,uCAAuC;AAC7C,EAAMA,qBAAA,oCAAoC;AAC1C,EAAMA,qBAAA,2BAA2B;AACjC,EAAMA,qBAAA,wCAAwC;AAC9C,EAAMA,qBAAA,oBAAoB;AAC1B,EAAMA,qBAAA,uBAAuB;AAK7B,EAAMA,qBAAA,yBAAyB;AAE/B,EAAMA,qBAAA,wBAAwB;AAE9B,EAAMA,qBAAA,mCAAmC;AAEzC,EAAMA,qBAAA,kCAAkC;AAExC,EAAMA,qBAAA,+BAA+B;AACrC,EAAMA,qBAAA,2BAA2B;AACjC,EAAMA,qBAAA,6BAA6B;AACnC,EAAMA,qBAAA,gCAAgC;AAEtC,EAAMA,qBAAA,wBAAwB;AAC9B,EAAMA,qBAAA,sCAAsC;AAC5C,EAAMA,qBAAA,kBAAkB;AAExB,EAAMA,qBAAA,YAAY;AAElB,EAAMA,qBAAA,iCAAiC;AACvC,EAAMA,qBAAA,+BAA+B;AACrC,EAAMA,qBAAA,iCAAiC;AACvC,EAAMA,qBAAA,iCAAiC;AACvC,EAAMA,qBAAA,eAAe;AAErB,EAAMA,qBAAA,qBAAqB;AAC3B,EAAMA,qBAAA,yBAAyB;AAE/B,EAAMA,qBAAA,MAAM;AAGZ,EAAMA,qBAAA,sBAAsB;AAE5B,EAAMA,qBAAA,WAAW;AACjB,EAAMA,qBAAA,2BAA2B;AACjC,EAAMA,qBAAA,kBAAkB;AACxB,EAAMA,qBAAA,2BAA2B;AAEjC,EAAMA,qBAAA,mCAAmC;AACzC,EAAMA,qBAAA,qCAAqC;AAC3C,EAAMA,qBAAA,qCAAqC;AAC3C,EAAMA,qBAAA,qCAAqC;AAC3C,EAAMA,qBAAA,qBAAqB;AAC3B,EAAMA,qBAAA,sBAAsB;AAC5B,EAAMA,qBAAA,qBAAqB;AAC3B,EAAMA,qBAAA,0BAA0B;AAUhC,EAAMA,qBAAA,4BAA4B;AAuHlC,WAAS,sBAAgC;AAC9C,WAAO;AAAA,MACL,OAAO;AAAA,QACL,SAAS;AAAA,QACT,WAAW;AAAA,QACX,eAAe;AAAA,QACf,WAAW;AAAA,QACX,wBAAwB;AAAA,QACxB,YAAY;AAAA,QACZ,wBAAwB;AAAA,QACxB,UAAU;AAAA,QACV,eAAe;AAAA,QACf,eAAe;AAAA,QACf,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,aAAa;AAAA,QACb,gBAAgB;AAAA,QAChB,aAAa;AAAA,QACb,iBAAiB;AAAA,QACjB,YAAY;AAAA,QACZ,eAAe;AAAA,QACf,WAAW;AAAA,QACX,mCAAmC;AAAA,QACnC,oBAAoB;AAAA,QACpB,8BAA8B;AAAA,QAC9B,KAAK;AAAA,QACL,mBAAmB;AAAA,QACnB,aAAa;AAAA,QACb,KAAK;AAAA,UACH,cAAc;AAAA,UACd,qBAAqB;AAAA,UACrB,0BAA0B;AAAA,UAC1B,YAAY;AAAA,UACZ,oBAAoB;AAAA,QACtB;AAAA,QACA,KAAK;AAAA,QACL,aAAa;AAAA,QACb,gBAAgB;AAAA,MAClB;AAAA,MACA,WAAW;AAAA,QACT,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,WAAW;AAAA,MACb;AAAA,MACA,YAAY;AAAA,QACV,KAAK,EAAE,SAAS,OAAO,QAAQ,OAAO,iBAAiB,MAAM;AAAA,MAC/D;AAAA,MACA,OAAO;AAAA,QACL,wBAAwB;AAAA,MAC1B;AAAA,MACA,cAAc;AAAA,QACZ,qBAAqB;AAAA,QACrB,mBAAmB;AAAA,QACnB,gBAAgB;AAAA,MAClB;AAAA,MACA,KAAK;AAAA,QACH,WAAW;AAAA,UACT,KAAK;AAAA,UACL,QAAQ;AAAA,QACV;AAAA,QACA,oBAAoB;AAAA,QACpB,WAAW;AAAA,MACb;AAAA,MACA,aAAa;AAAA,QACX,KAAK;AAAA,UACH,SAAS;AAAA,YACP,KAAK;AAAA,UACP;AAAA,UACA,QAAQ;AAAA,QACV;AAAA;AAAA,QAEA,IAAI;AAAA,UACF,KAAK;AAAA,YACH,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,QACA,aAAa;AAAA,UACX,SAAS;AAAA,QACX;AAAA,MACF;AAAA,MACA,OAAO;AAAA,QACL,aAAa;AAAA,UACX,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,eAAe;AAAA,QACb,QAAQ;AAAA,UACN,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,qBAAqB;AAAA,QACnB,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AAAA,MACA,cAAc;AAAA,QACZ,MAAM;AAAA,QACN,OAAO;AAAA,MACT;AAAA,MACA,cAAc;AAAA,QACZ,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAhHO,EAAAA,qBAAS;AAkHT,EAAMA,qBAAA,qBAIR;AAAA,IACH;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,cAAc;AAAA,IAC/B;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,kBAAkB,yBAAyB;AAAA,IAC5D;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IAEA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,oBAAoB;AAAA,IACtD;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,oBAAoB;AAAA,IACtD;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,oBAAoB;AAAA,IACtD;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,kBAAkB,0BAA0B;AAAA,IAC7D;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC,cAAc;AAAA,IAC/B;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,kBAAkB,yBAAyB;AAAA,IAC5D;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,kBAAkB,gCAAgC;AAAA,IACnE;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,cAAc;AAAA,IAC/B;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,+BAA+B,cAAc;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,+BAA+B,cAAc;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,+BAA+B,cAAc;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,aAAa;AAAA,IAC9B;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe,cAAc;AAAA,IAC9C;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe,cAAc;AAAA,IAC9C;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,cAAc;AAAA,IAC/B;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,aAAa;AAAA,IAC9B;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,yBAAyB,4BAA4B;AAAA,IACtE;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,6BAA6B;AAAA,IAC9C;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aACE;AAAA;AAAA;AAAA,MAGF,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,EACF;AAAA,GAhvBe;",
   "names": ["AccountsPermissions"]
 }

package/dist/permissions/combo.js

@@ -181,6 +181,11 @@ function accountsUserFeaturesFromPermissions(permissions) {
     pdfWatermark: {
       read: permissions.includes(AccountsPermissions.PDF_WATERMARK_READ),
       write: permissions.includes(AccountsPermissions.PDF_WATERMARK_WRITE)
+    },
+    featureFlags: {
+      write: permissions.includes(
+        AccountsPermissions.ADMIN_FEATURE_FLAGS_WRITE
+      )
     }
   };
   return newFeatures;

package/dist/permissions/combo.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/permissions/combo.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { AccountsPermissions } from './accounts.permissions.js'\nimport { AuditLoggerPermissions } from './auditlogger.permissions.js'\nimport { ConsolePermissions } from './console.permissions.js'\nimport { NotificationPermissions } from './notification.permissions.js'\n\nexport function accountsUserFeaturesFromPermissions(permissions: string[]) {\n  const newFeatures: AccountsPermissions.Features = {\n    admin: {\n      readAll: permissions.includes(AccountsPermissions.READ_ALL),\n      createOrg: permissions.includes(AccountsPermissions.CREATE_ORG),\n      changeOrgName: permissions.includes(AccountsPermissions.CHANGE_ORG_NAME),\n\n      deleteOrg: permissions.includes(AccountsPermissions.DELETE_ORG),\n      resetTokenVerification: permissions.includes(\n        AccountsPermissions.RESET_TOKEN_VERIFICATION,\n      ),\n      deleteUser: permissions.includes(AccountsPermissions.DELETE_USER),\n      deleteNotActivatedUser: permissions.includes(\n        AccountsPermissions.DELETE_NOT_ACTIVATED_USER,\n      ),\n      addToOrg: permissions.includes(AccountsPermissions.ADD_TO_ORG),\n      removeFromOrg: permissions.includes(AccountsPermissions.REMOVE_FROM_ORG),\n      setDefaultOrg: permissions.includes(AccountsPermissions.SET_DEFAULT_ORG),\n      cancelInvite: permissions.includes(AccountsPermissions.CANCEL_INVITE),\n      changeRole: permissions.includes(AccountsPermissions.CHANGE_ROLE),\n      addSafeRole: permissions.includes(AccountsPermissions.CHANGE_SAFE_ROLE),\n      deleteClusters: permissions.includes(\n        ConsolePermissions.CLUSTERS_DELETE_CLUSTER,\n      ),\n      extendTrial: permissions.includes(AccountsPermissions.EXTEND_TRIAL),\n      invalidateToken: permissions.includes(\n        AccountsPermissions.INVALIDATE_TOKEN,\n      ),\n      cancelPaid: permissions.includes(AccountsPermissions.ORG_CANCEL_PAID),\n      searchForOrgs: permissions.includes(\n        ConsolePermissions.CLUSTER_PLAN_SEE_ALL,\n      ),\n      readAudit: permissions.includes(AuditLoggerPermissions.READ),\n      modifyClusterPlanTypeReservations: permissions.includes(\n        AccountsPermissions.MODIFY_CLUSTER_PLAN_TYPE_RESERVATIONS,\n      ),\n      mayChangeOrgLimits: permissions.includes(\n        AccountsPermissions.ORG_MAY_CHANGE_LIMITS,\n      ),\n      mayChangeGenerationWhiteList: permissions.includes(\n        AccountsPermissions.ORG_MAY_CHANGE_GENERATION_WHITELIST,\n      ),\n      sql: permissions.includes(AccountsPermissions.ADMIN_SQL),\n      modelerDeleteUser: permissions.includes(\n        AccountsPermissions.MODELER_DELETE_USER,\n      ),\n      unblockUser: permissions.includes(AccountsPermissions.UNBLOCK_USER),\n      god: {\n        triggerCrons: permissions.includes(AccountsPermissions.GOD_CRON),\n        forceSalesPlanOnOrg: permissions.includes(\n          AccountsPermissions.FORCE_SALES_PLAN_ON_ORG,\n        ),\n        changeSignupSpamPatterns: permissions.includes(\n          AccountsPermissions.GOD_SIGNUP_SPAM_PATTERNS,\n        ),\n        purgeUsers: permissions.includes(AccountsPermissions.GOD_PURGE_USERS),\n        updateUserMetadata: permissions.includes(\n          AccountsPermissions.GOD_UPDATE_USER_METADATA,\n        ),\n      },\n      bot: permissions.includes(AccountsPermissions.BOT),\n      changeEmail: permissions.includes(AccountsPermissions.ADMIN_CHANGE_EMAIL),\n      changeUserName: permissions.includes(\n        AccountsPermissions.ADMIN_CHANGE_USER_NAME,\n      ),\n    },\n    salesPlan: {\n      create: permissions.includes(AccountsPermissions.SALES_PLAN_CREATE),\n      modify: permissions.includes(AccountsPermissions.SALES_PLAN_MODIFY),\n      forceModify: permissions.includes(\n        AccountsPermissions.SALES_PLAN_FORCE_MODIFY,\n      ),\n      switch: permissions.includes(AccountsPermissions.SALES_PLAN_SWITCH),\n      delete: permissions.includes(AccountsPermissions.SALES_PLAN_DELETE),\n      godDelete: permissions.includes(\n        AccountsPermissions.SALES_PLAN_DELETE_AS_GOD,\n      ),\n    },\n    enterprise: {\n      org: {\n        convert: permissions.includes(\n          AccountsPermissions.ENTERPRISE_ORG_CONVERT,\n        ),\n        modify: permissions.includes(AccountsPermissions.ENTERPRISE_ORG_MODIFY),\n        modifyStartDate: permissions.includes(\n          AccountsPermissions.ENTERPRISE_ORG_MODIFY_START_DATE,\n        ),\n      },\n    },\n    trial: {\n      convertToInNegotiation: permissions.includes(\n        AccountsPermissions.TRIAL_TO_IN_NEGOTIATION_CONVERT,\n      ),\n    },\n    supportAgent: {\n      removeAgentsFromOrg: permissions.includes(\n        AccountsPermissions.SUPPORT_AGENT_REMOVE_AGENTS_FROM_ORG,\n      ),\n      seeOrgMemberships: permissions.includes(\n        AccountsPermissions.SUPPORT_AGENT_SEE_ORG_MEMBERSHIPS,\n      ),\n      addAgentsToOrg: permissions.includes(\n        AccountsPermissions.SUPPORT_AGENT_ADD_TO_ORG,\n      ),\n    },\n    m2m: {\n      salesplan: {\n        get: permissions.includes(AccountsPermissions.M2M_SALESPLAN_GET),\n        switch: permissions.includes(AccountsPermissions.M2M_SALESPLAN_SWITCH),\n      },\n      fetchMigrationData: permissions.includes(\n        ConsolePermissions.M2M_FETCH_MIGRATION_DATA,\n      ),\n      approvals: permissions.includes(ConsolePermissions.M2M_CONTROL_APPROVALS),\n    },\n    externalM2m: {\n      org: {\n        members: {\n          get: permissions.includes(\n            AccountsPermissions.EXTERNAL_M2M_GET_ORG_MEMBERS,\n          ),\n        },\n        search: permissions.includes(\n          AccountsPermissions.EXTERNAL_M2M_SEARCH_ORGS,\n        ),\n      },\n      // eslint-disable-next-line id-length\n      qa: {\n        org: {\n          create: permissions.includes(\n            AccountsPermissions.EXTERNAL_M2M_QA_ORG_CREATE,\n          ),\n        },\n      },\n      offboarding: {\n        camundi: permissions.includes(\n          AccountsPermissions.EXTERNAL_M2M_OFFBOARD_CAMUNDI,\n        ),\n      },\n    },\n    auth0: {\n      connections: {\n        create: permissions.includes(\n          AccountsPermissions.ADMIN_AUTH0_CONNECTIONS_CREATE,\n        ),\n        read: permissions.includes(\n          AccountsPermissions.ADMIN_AUTH0_CONNECTIONS_READ,\n        ),\n        update: permissions.includes(\n          AccountsPermissions.ADMIN_AUTH0_CONNECTIONS_UPDATE,\n        ),\n        delete: permissions.includes(\n          AccountsPermissions.ADMIN_AUTH0_CONNECTIONS_DELETE,\n        ),\n      },\n    },\n    notifications: {\n      global: {\n        read: permissions.includes(NotificationPermissions.READ_GLOBAL),\n        delete: permissions.includes(NotificationPermissions.DELETE_GLOBAL),\n        create: permissions.includes(NotificationPermissions.CREATE_GLOBAL),\n      },\n    },\n    earlyAccessFeatures: {\n      read: permissions.includes(\n        AccountsPermissions.ADMIN_EARLY_ACCESS_FEATURES_READ,\n      ),\n      create: permissions.includes(\n        AccountsPermissions.ADMIN_EARLY_ACCESS_FEATURES_CREATE,\n      ),\n      delete: permissions.includes(\n        AccountsPermissions.ADMIN_EARLY_ACCESS_FEATURES_DELETE,\n      ),\n      update: permissions.includes(\n        AccountsPermissions.ADMIN_EARLY_ACCESS_FEATURES_UPDATE,\n      ),\n    },\n    pdfWatermark: {\n      read: permissions.includes(AccountsPermissions.PDF_WATERMARK_READ),\n      write: permissions.includes(AccountsPermissions.PDF_WATERMARK_WRITE),\n    },\n  }\n  return newFeatures\n}\n\nexport function consoleUserFeaturesFromPermissions(permissions: string[]) {\n  const newFeatures: ConsolePermissions.Features = {\n    apiClient: {\n      read: permissions.includes(ConsolePermissions.APICLIENT_READ),\n      delete: permissions.includes(ConsolePermissions.APICLIENT_DELETE),\n    },\n    multiCluster: {\n      admin: permissions.includes(ConsolePermissions.MULTICLUSTER_ADMIN),\n    },\n    multiGen: {\n      admin: {\n        see: permissions.includes(\n          ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN_SEE,\n        ),\n        modify: permissions.includes(\n          ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN,\n        ),\n        patchExistingChannel: permissions.includes(\n          ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN_PATCH_EXISTING_CHANNEL,\n        ),\n        migrate: permissions.includes(\n          ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN_MIGRATE,\n        ),\n        deleteAllClustersOfGeneration: permissions.includes(\n          ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN_DELETE_ALL_CLUSTERS,\n        ),\n      },\n      releaseTrain: {\n        publish: permissions.includes(ConsolePermissions.RELEASE_TRAIN_PUBLISH),\n      },\n    },\n    clusters: {\n      canReadAllClusterInfo: permissions.includes(\n        ConsolePermissions.CLUSTERS_READALLCLUSTERINFO,\n      ),\n      canDeleteAllClusters: permissions.includes(\n        ConsolePermissions.CLUSTERS_DELETE_CLUSTER,\n      ),\n      canMoveToOtherOrg: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_MOVE_TO_OTHER_ORG,\n      ),\n      createOnBehalf: permissions.includes(\n        ConsolePermissions.CLUSTER_CREATE_ON_BEHALF,\n      ),\n      canSendToSleep: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_SEND_TO_SLEEP,\n      ),\n      canCreateInternalBackup: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_CREATE_INTERNAL_BACKUP,\n      ),\n      canUpdateClusterPlanType: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_UPDATE_CLUSTERPLANTYPE,\n      ),\n      canOverrideEnvVars: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_OVERRIDE_ENV_VARS,\n      ),\n      canCreateModificationConfig: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_CREATE_MODIFICATION_CONFIG,\n      ),\n      canUpgradeGeneration: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_UPDATE_GENERATION,\n      ),\n      canUpgradeGenerationYolo: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_UPDATE_GENERATION_YOLO,\n      ),\n      canUpdateOptionalTelemetry: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_UPDATE_OPTIONAL_TELEMETRY,\n      ),\n    },\n    clusterPlan: {\n      seeAll: permissions.includes(ConsolePermissions.CLUSTER_PLAN_SEE_ALL),\n      create: permissions.includes(ConsolePermissions.CLUSTER_PLAN_CREATE),\n      delete: permissions.includes(ConsolePermissions.CLUSTER_PLAN_DELETE),\n      type: {\n        create: permissions.includes(\n          ConsolePermissions.CLUSTER_PLAN_TYPE_CREATE,\n        ),\n        modify: permissions.includes(\n          ConsolePermissions.CLUSTER_PLAN_TYPE_MODIFY,\n        ),\n        delete: permissions.includes(\n          ConsolePermissions.CLUSTER_PLAN_TYPE_DELETE,\n        ),\n        forceDelete: permissions.includes(\n          ConsolePermissions.CLUSTER_PLAN_TYPE_FORCE_DELETE,\n        ),\n      },\n      migrate: permissions.includes(ConsolePermissions.CLUSTER_PLAN_MIGRATE),\n      deleteAllClustersOfPlan: permissions.includes(\n        ConsolePermissions.CLUSTER_PLAN_CAN_DELETE_ALL_CLUSTERS_OF_PLAN,\n      ),\n      modify: permissions.includes(ConsolePermissions.CLUSTER_PLAN_CAN_MODIFY),\n    },\n    features: {\n      newHome: permissions.includes(ConsolePermissions.FEATURE_NEW_HOME),\n      templatePicker: permissions.includes(\n        ConsolePermissions.FEATURE_TEMPLATE_PICKER,\n      ),\n      userSettings: permissions.includes(ConsolePermissions.USER_SETTINGS),\n      debug: permissions.includes(ConsolePermissions.DEBUG),\n    },\n    m2m: {\n      updateCrd: permissions.includes(ConsolePermissions.M2M_UPDATE_CRD),\n      signup: permissions.includes(ConsolePermissions.M2M_SIGNUP),\n      triggerAlert: permissions.includes(ConsolePermissions.M2M_TRIGGER_ALERT),\n      deleteOrgClusters: permissions.includes(\n        ConsolePermissions.M2M_DELETE_ORG_CLUSTERS,\n      ),\n      updateOrgClusters: permissions.includes(\n        ConsolePermissions.M2M_UPDATE_ORG_CLUSTERS,\n      ),\n      addUsageMetrics: permissions.includes(\n        ConsolePermissions.M2M_ADD_CLUSTER_USAGE_METRICS,\n      ),\n      sendSseEvent: permissions.includes(ConsolePermissions.M2M_SEND_SSE_EVENT),\n      external: {\n        internalClient: permissions.includes(\n          ConsolePermissions.M2M_EXTERNAL_INTERNAL_CLIENT,\n        ),\n      },\n      fetchMigrationData: permissions.includes(\n        ConsolePermissions.M2M_FETCH_MIGRATION_DATA,\n      ),\n      manageGenerationUpgradePath: permissions.includes(\n        ConsolePermissions.M2M_MANAGE_GENERATION_UPGRADE_PATH,\n      ),\n      approvals: permissions.includes(ConsolePermissions.M2M_CONTROL_APPROVALS),\n    },\n  }\n  return newFeatures\n}\n\n/**\n * Flattens a feature tree into the dotted keys of the Control session.\n *\n * `buildSession` in accounts-backend writes the session with exactly this\n * shape, under the prefixes `` (accounts), `console` and `notifications`.\n */\nfunction flattenFeatureBooleans(\n  value: unknown,\n  prefix = '',\n): Record<string, boolean> {\n  const out: Record<string, boolean> = {}\n  if (!value || typeof value !== 'object') {\n    return out\n  }\n  for (const [key, entry] of Object.entries(value as Record<string, unknown>)) {\n    const flatKey = prefix ? `${prefix}.${key}` : key\n    if (typeof entry === 'boolean') {\n      out[flatKey] = entry\n    } else if (entry && typeof entry === 'object') {\n      Object.assign(out, flattenFeatureBooleans(entry, flatKey))\n    }\n  }\n  return out\n}\n\n/**\n * The session keys that ONE raw Auth0 permission turns on.\n *\n * The Control session holds a flat record of feature booleans, such as\n * `admin.extendTrial` and `console.clusters.canUpgradeGenerationYolo`. An\n * approval use case names the raw Auth0 short code instead, such as `aaet`,\n * because that is what the token carries and what a backend compares.\n *\n * This function bridges the two, and it bridges them by RUNNING the same\n * mappers that build the session. A hand-written table of code to key would be\n * a third copy of the permission model, and a code that gained a key would\n * silently stop gating anything in the browser.\n *\n * It answers an array, because one code can turn on more than one key. An\n * unknown code answers an empty array, and the caller decides what that means.\n *\n * The answer is CACHED, because the work is three feature trees and a flatten\n * of each one. `ApprovalActorView.has` of the browser runs this, and the rules\n * call `has` for every row of the queue: a page of 2000 requests turned one\n * cheap question into thousands of tree builds. The answer of a code never\n * changes inside one bundle, so the cache needs no invalidation, and the keys\n * are the permission codes of the use cases, which is a short list.\n *\n * The answer is `readonly`, and frozen, because every caller of one code gets\n * the SAME array: a caller that sorted or pushed in place would change what\n * the next reader of that code sees.\n */\nconst keysByPermissionCode = new Map<string, readonly string[]>()\n\nexport function sessionPermissionKeysFor(\n  permissionCode: string,\n): readonly string[] {\n  const cached = keysByPermissionCode.get(permissionCode)\n  if (cached) {\n    return cached\n  }\n  const answer = Object.freeze(buildSessionPermissionKeys(permissionCode))\n  keysByPermissionCode.set(permissionCode, answer)\n  return answer\n}\n\nfunction buildSessionPermissionKeys(permissionCode: string): string[] {\n  const trees: [unknown, string][] = [\n    [accountsUserFeaturesFromPermissions([permissionCode]), ''],\n    [consoleUserFeaturesFromPermissions([permissionCode]), 'console'],\n    [\n      NotificationPermissions.userFeaturesFromPermissions([permissionCode]),\n      'notifications',\n    ],\n  ]\n  const keys: string[] = []\n  for (const [tree, prefix] of trees) {\n    for (const [key, on] of Object.entries(\n      flattenFeatureBooleans(tree, prefix),\n    )) {\n      if (on) {\n        keys.push(key)\n      }\n    }\n  }\n  return keys\n}\n\n/**\n * Reports whether a Control session holds one raw Auth0 permission.\n *\n * It is what `ApprovalActorView.has` runs in the browser. An unknown code\n * answers false: a permission that nothing maps is a permission that nobody\n * holds, and the alternative would open a button that the backend refuses.\n */\nexport function sessionHasPermission(\n  sessionPermissions: Record<string, boolean>,\n  permissionCode: string,\n): boolean {\n  return sessionPermissionKeysFor(permissionCode).some(\n    (key) => sessionPermissions[key] === true,\n  )\n}\n"],
-  "mappings": "AAMA,SAAS,2BAA2B;AACpC,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,+BAA+B;AAEjC,SAAS,oCAAoC,aAAuB;AACzE,QAAM,cAA4C;AAAA,IAChD,OAAO;AAAA,MACL,SAAS,YAAY,SAAS,oBAAoB,QAAQ;AAAA,MAC1D,WAAW,YAAY,SAAS,oBAAoB,UAAU;AAAA,MAC9D,eAAe,YAAY,SAAS,oBAAoB,eAAe;AAAA,MAEvE,WAAW,YAAY,SAAS,oBAAoB,UAAU;AAAA,MAC9D,wBAAwB,YAAY;AAAA,QAClC,oBAAoB;AAAA,MACtB;AAAA,MACA,YAAY,YAAY,SAAS,oBAAoB,WAAW;AAAA,MAChE,wBAAwB,YAAY;AAAA,QAClC,oBAAoB;AAAA,MACtB;AAAA,MACA,UAAU,YAAY,SAAS,oBAAoB,UAAU;AAAA,MAC7D,eAAe,YAAY,SAAS,oBAAoB,eAAe;AAAA,MACvE,eAAe,YAAY,SAAS,oBAAoB,eAAe;AAAA,MACvE,cAAc,YAAY,SAAS,oBAAoB,aAAa;AAAA,MACpE,YAAY,YAAY,SAAS,oBAAoB,WAAW;AAAA,MAChE,aAAa,YAAY,SAAS,oBAAoB,gBAAgB;AAAA,MACtE,gBAAgB,YAAY;AAAA,QAC1B,mBAAmB;AAAA,MACrB;AAAA,MACA,aAAa,YAAY,SAAS,oBAAoB,YAAY;AAAA,MAClE,iBAAiB,YAAY;AAAA,QAC3B,oBAAoB;AAAA,MACtB;AAAA,MACA,YAAY,YAAY,SAAS,oBAAoB,eAAe;AAAA,MACpE,eAAe,YAAY;AAAA,QACzB,mBAAmB;AAAA,MACrB;AAAA,MACA,WAAW,YAAY,SAAS,uBAAuB,IAAI;AAAA,MAC3D,mCAAmC,YAAY;AAAA,QAC7C,oBAAoB;AAAA,MACtB;AAAA,MACA,oBAAoB,YAAY;AAAA,QAC9B,oBAAoB;AAAA,MACtB;AAAA,MACA,8BAA8B,YAAY;AAAA,QACxC,oBAAoB;AAAA,MACtB;AAAA,MACA,KAAK,YAAY,SAAS,oBAAoB,SAAS;AAAA,MACvD,mBAAmB,YAAY;AAAA,QAC7B,oBAAoB;AAAA,MACtB;AAAA,MACA,aAAa,YAAY,SAAS,oBAAoB,YAAY;AAAA,MAClE,KAAK;AAAA,QACH,cAAc,YAAY,SAAS,oBAAoB,QAAQ;AAAA,QAC/D,qBAAqB,YAAY;AAAA,UAC/B,oBAAoB;AAAA,QACtB;AAAA,QACA,0BAA0B,YAAY;AAAA,UACpC,oBAAoB;AAAA,QACtB;AAAA,QACA,YAAY,YAAY,SAAS,oBAAoB,eAAe;AAAA,QACpE,oBAAoB,YAAY;AAAA,UAC9B,oBAAoB;AAAA,QACtB;AAAA,MACF;AAAA,MACA,KAAK,YAAY,SAAS,oBAAoB,GAAG;AAAA,MACjD,aAAa,YAAY,SAAS,oBAAoB,kBAAkB;AAAA,MACxE,gBAAgB,YAAY;AAAA,QAC1B,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,IACA,WAAW;AAAA,MACT,QAAQ,YAAY,SAAS,oBAAoB,iBAAiB;AAAA,MAClE,QAAQ,YAAY,SAAS,oBAAoB,iBAAiB;AAAA,MAClE,aAAa,YAAY;AAAA,QACvB,oBAAoB;AAAA,MACtB;AAAA,MACA,QAAQ,YAAY,SAAS,oBAAoB,iBAAiB;AAAA,MAClE,QAAQ,YAAY,SAAS,oBAAoB,iBAAiB;AAAA,MAClE,WAAW,YAAY;AAAA,QACrB,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,IACA,YAAY;AAAA,MACV,KAAK;AAAA,QACH,SAAS,YAAY;AAAA,UACnB,oBAAoB;AAAA,QACtB;AAAA,QACA,QAAQ,YAAY,SAAS,oBAAoB,qBAAqB;AAAA,QACtE,iBAAiB,YAAY;AAAA,UAC3B,oBAAoB;AAAA,QACtB;AAAA,MACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL,wBAAwB,YAAY;AAAA,QAClC,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,qBAAqB,YAAY;AAAA,QAC/B,oBAAoB;AAAA,MACtB;AAAA,MACA,mBAAmB,YAAY;AAAA,QAC7B,oBAAoB;AAAA,MACtB;AAAA,MACA,gBAAgB,YAAY;AAAA,QAC1B,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,WAAW;AAAA,QACT,KAAK,YAAY,SAAS,oBAAoB,iBAAiB;AAAA,QAC/D,QAAQ,YAAY,SAAS,oBAAoB,oBAAoB;AAAA,MACvE;AAAA,MACA,oBAAoB,YAAY;AAAA,QAC9B,mBAAmB;AAAA,MACrB;AAAA,MACA,WAAW,YAAY,SAAS,mBAAmB,qBAAqB;AAAA,IAC1E;AAAA,IACA,aAAa;AAAA,MACX,KAAK;AAAA,QACH,SAAS;AAAA,UACP,KAAK,YAAY;AAAA,YACf,oBAAoB;AAAA,UACtB;AAAA,QACF;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,oBAAoB;AAAA,QACtB;AAAA,MACF;AAAA;AAAA,MAEA,IAAI;AAAA,QACF,KAAK;AAAA,UACH,QAAQ,YAAY;AAAA,YAClB,oBAAoB;AAAA,UACtB;AAAA,QACF;AAAA,MACF;AAAA,MACA,aAAa;AAAA,QACX,SAAS,YAAY;AAAA,UACnB,oBAAoB;AAAA,QACtB;AAAA,MACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL,aAAa;AAAA,QACX,QAAQ,YAAY;AAAA,UAClB,oBAAoB;AAAA,QACtB;AAAA,QACA,MAAM,YAAY;AAAA,UAChB,oBAAoB;AAAA,QACtB;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,oBAAoB;AAAA,QACtB;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,oBAAoB;AAAA,QACtB;AAAA,MACF;AAAA,IACF;AAAA,IACA,eAAe;AAAA,MACb,QAAQ;AAAA,QACN,MAAM,YAAY,SAAS,wBAAwB,WAAW;AAAA,QAC9D,QAAQ,YAAY,SAAS,wBAAwB,aAAa;AAAA,QAClE,QAAQ,YAAY,SAAS,wBAAwB,aAAa;AAAA,MACpE;AAAA,IACF;AAAA,IACA,qBAAqB;AAAA,MACnB,MAAM,YAAY;AAAA,QAChB,oBAAoB;AAAA,MACtB;AAAA,MACA,QAAQ,YAAY;AAAA,QAClB,oBAAoB;AAAA,MACtB;AAAA,MACA,QAAQ,YAAY;AAAA,QAClB,oBAAoB;AAAA,MACtB;AAAA,MACA,QAAQ,YAAY;AAAA,QAClB,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,MAAM,YAAY,SAAS,oBAAoB,kBAAkB;AAAA,MACjE,OAAO,YAAY,SAAS,oBAAoB,mBAAmB;AAAA,IACrE;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,mCAAmC,aAAuB;AACxE,QAAM,cAA2C;AAAA,IAC/C,WAAW;AAAA,MACT,MAAM,YAAY,SAAS,mBAAmB,cAAc;AAAA,MAC5D,QAAQ,YAAY,SAAS,mBAAmB,gBAAgB;AAAA,IAClE;AAAA,IACA,cAAc;AAAA,MACZ,OAAO,YAAY,SAAS,mBAAmB,kBAAkB;AAAA,IACnE;AAAA,IACA,UAAU;AAAA,MACR,OAAO;AAAA,QACL,KAAK,YAAY;AAAA,UACf,mBAAmB;AAAA,QACrB;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,mBAAmB;AAAA,QACrB;AAAA,QACA,sBAAsB,YAAY;AAAA,UAChC,mBAAmB;AAAA,QACrB;AAAA,QACA,SAAS,YAAY;AAAA,UACnB,mBAAmB;AAAA,QACrB;AAAA,QACA,+BAA+B,YAAY;AAAA,UACzC,mBAAmB;AAAA,QACrB;AAAA,MACF;AAAA,MACA,cAAc;AAAA,QACZ,SAAS,YAAY,SAAS,mBAAmB,qBAAqB;AAAA,MACxE;AAAA,IACF;AAAA,IACA,UAAU;AAAA,MACR,uBAAuB,YAAY;AAAA,QACjC,mBAAmB;AAAA,MACrB;AAAA,MACA,sBAAsB,YAAY;AAAA,QAChC,mBAAmB;AAAA,MACrB;AAAA,MACA,mBAAmB,YAAY;AAAA,QAC7B,mBAAmB;AAAA,MACrB;AAAA,MACA,gBAAgB,YAAY;AAAA,QAC1B,mBAAmB;AAAA,MACrB;AAAA,MACA,gBAAgB,YAAY;AAAA,QAC1B,mBAAmB;AAAA,MACrB;AAAA,MACA,yBAAyB,YAAY;AAAA,QACnC,mBAAmB;AAAA,MACrB;AAAA,MACA,0BAA0B,YAAY;AAAA,QACpC,mBAAmB;AAAA,MACrB;AAAA,MACA,oBAAoB,YAAY;AAAA,QAC9B,mBAAmB;AAAA,MACrB;AAAA,MACA,6BAA6B,YAAY;AAAA,QACvC,mBAAmB;AAAA,MACrB;AAAA,MACA,sBAAsB,YAAY;AAAA,QAChC,mBAAmB;AAAA,MACrB;AAAA,MACA,0BAA0B,YAAY;AAAA,QACpC,mBAAmB;AAAA,MACrB;AAAA,MACA,4BAA4B,YAAY;AAAA,QACtC,mBAAmB;AAAA,MACrB;AAAA,IACF;AAAA,IACA,aAAa;AAAA,MACX,QAAQ,YAAY,SAAS,mBAAmB,oBAAoB;AAAA,MACpE,QAAQ,YAAY,SAAS,mBAAmB,mBAAmB;AAAA,MACnE,QAAQ,YAAY,SAAS,mBAAmB,mBAAmB;AAAA,MACnE,MAAM;AAAA,QACJ,QAAQ,YAAY;AAAA,UAClB,mBAAmB;AAAA,QACrB;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,mBAAmB;AAAA,QACrB;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,mBAAmB;AAAA,QACrB;AAAA,QACA,aAAa,YAAY;AAAA,UACvB,mBAAmB;AAAA,QACrB;AAAA,MACF;AAAA,MACA,SAAS,YAAY,SAAS,mBAAmB,oBAAoB;AAAA,MACrE,yBAAyB,YAAY;AAAA,QACnC,mBAAmB;AAAA,MACrB;AAAA,MACA,QAAQ,YAAY,SAAS,mBAAmB,uBAAuB;AAAA,IACzE;AAAA,IACA,UAAU;AAAA,MACR,SAAS,YAAY,SAAS,mBAAmB,gBAAgB;AAAA,MACjE,gBAAgB,YAAY;AAAA,QAC1B,mBAAmB;AAAA,MACrB;AAAA,MACA,cAAc,YAAY,SAAS,mBAAmB,aAAa;AAAA,MACnE,OAAO,YAAY,SAAS,mBAAmB,KAAK;AAAA,IACtD;AAAA,IACA,KAAK;AAAA,MACH,WAAW,YAAY,SAAS,mBAAmB,cAAc;AAAA,MACjE,QAAQ,YAAY,SAAS,mBAAmB,UAAU;AAAA,MAC1D,cAAc,YAAY,SAAS,mBAAmB,iBAAiB;AAAA,MACvE,mBAAmB,YAAY;AAAA,QAC7B,mBAAmB;AAAA,MACrB;AAAA,MACA,mBAAmB,YAAY;AAAA,QAC7B,mBAAmB;AAAA,MACrB;AAAA,MACA,iBAAiB,YAAY;AAAA,QAC3B,mBAAmB;AAAA,MACrB;AAAA,MACA,cAAc,YAAY,SAAS,mBAAmB,kBAAkB;AAAA,MACxE,UAAU;AAAA,QACR,gBAAgB,YAAY;AAAA,UAC1B,mBAAmB;AAAA,QACrB;AAAA,MACF;AAAA,MACA,oBAAoB,YAAY;AAAA,QAC9B,mBAAmB;AAAA,MACrB;AAAA,MACA,6BAA6B,YAAY;AAAA,QACvC,mBAAmB;AAAA,MACrB;AAAA,MACA,WAAW,YAAY,SAAS,mBAAmB,qBAAqB;AAAA,IAC1E;AAAA,EACF;AACA,SAAO;AACT;AAQA,SAAS,uBACP,OACA,SAAS,IACgB;AACzB,QAAM,MAA+B,CAAC;AACtC,MAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,WAAO;AAAA,EACT;AACA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAgC,GAAG;AAC3E,UAAM,UAAU,SAAS,GAAG,MAAM,IAAI,GAAG,KAAK;AAC9C,QAAI,OAAO,UAAU,WAAW;AAC9B,UAAI,OAAO,IAAI;AAAA,IACjB,WAAW,SAAS,OAAO,UAAU,UAAU;AAC7C,aAAO,OAAO,KAAK,uBAAuB,OAAO,OAAO,CAAC;AAAA,IAC3D;AAAA,EACF;AACA,SAAO;AACT;AA6BA,MAAM,uBAAuB,oBAAI,IAA+B;AAEzD,SAAS,yBACd,gBACmB;AACnB,QAAM,SAAS,qBAAqB,IAAI,cAAc;AACtD,MAAI,QAAQ;AACV,WAAO;AAAA,EACT;AACA,QAAM,SAAS,OAAO,OAAO,2BAA2B,cAAc,CAAC;AACvE,uBAAqB,IAAI,gBAAgB,MAAM;AAC/C,SAAO;AACT;AAEA,SAAS,2BAA2B,gBAAkC;AACpE,QAAM,QAA6B;AAAA,IACjC,CAAC,oCAAoC,CAAC,cAAc,CAAC,GAAG,EAAE;AAAA,IAC1D,CAAC,mCAAmC,CAAC,cAAc,CAAC,GAAG,SAAS;AAAA,IAChE;AAAA,MACE,wBAAwB,4BAA4B,CAAC,cAAc,CAAC;AAAA,MACpE;AAAA,IACF;AAAA,EACF;AACA,QAAM,OAAiB,CAAC;AACxB,aAAW,CAAC,MAAM,MAAM,KAAK,OAAO;AAClC,eAAW,CAAC,KAAK,EAAE,KAAK,OAAO;AAAA,MAC7B,uBAAuB,MAAM,MAAM;AAAA,IACrC,GAAG;AACD,UAAI,IAAI;AACN,aAAK,KAAK,GAAG;AAAA,MACf;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AASO,SAAS,qBACd,oBACA,gBACS;AACT,SAAO,yBAAyB,cAAc,EAAE;AAAA,IAC9C,CAAC,QAAQ,mBAAmB,GAAG,MAAM;AAAA,EACvC;AACF;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { AccountsPermissions } from './accounts.permissions.js'\nimport { AuditLoggerPermissions } from './auditlogger.permissions.js'\nimport { ConsolePermissions } from './console.permissions.js'\nimport { NotificationPermissions } from './notification.permissions.js'\n\nexport function accountsUserFeaturesFromPermissions(permissions: string[]) {\n  const newFeatures: AccountsPermissions.Features = {\n    admin: {\n      readAll: permissions.includes(AccountsPermissions.READ_ALL),\n      createOrg: permissions.includes(AccountsPermissions.CREATE_ORG),\n      changeOrgName: permissions.includes(AccountsPermissions.CHANGE_ORG_NAME),\n\n      deleteOrg: permissions.includes(AccountsPermissions.DELETE_ORG),\n      resetTokenVerification: permissions.includes(\n        AccountsPermissions.RESET_TOKEN_VERIFICATION,\n      ),\n      deleteUser: permissions.includes(AccountsPermissions.DELETE_USER),\n      deleteNotActivatedUser: permissions.includes(\n        AccountsPermissions.DELETE_NOT_ACTIVATED_USER,\n      ),\n      addToOrg: permissions.includes(AccountsPermissions.ADD_TO_ORG),\n      removeFromOrg: permissions.includes(AccountsPermissions.REMOVE_FROM_ORG),\n      setDefaultOrg: permissions.includes(AccountsPermissions.SET_DEFAULT_ORG),\n      cancelInvite: permissions.includes(AccountsPermissions.CANCEL_INVITE),\n      changeRole: permissions.includes(AccountsPermissions.CHANGE_ROLE),\n      addSafeRole: permissions.includes(AccountsPermissions.CHANGE_SAFE_ROLE),\n      deleteClusters: permissions.includes(\n        ConsolePermissions.CLUSTERS_DELETE_CLUSTER,\n      ),\n      extendTrial: permissions.includes(AccountsPermissions.EXTEND_TRIAL),\n      invalidateToken: permissions.includes(\n        AccountsPermissions.INVALIDATE_TOKEN,\n      ),\n      cancelPaid: permissions.includes(AccountsPermissions.ORG_CANCEL_PAID),\n      searchForOrgs: permissions.includes(\n        ConsolePermissions.CLUSTER_PLAN_SEE_ALL,\n      ),\n      readAudit: permissions.includes(AuditLoggerPermissions.READ),\n      modifyClusterPlanTypeReservations: permissions.includes(\n        AccountsPermissions.MODIFY_CLUSTER_PLAN_TYPE_RESERVATIONS,\n      ),\n      mayChangeOrgLimits: permissions.includes(\n        AccountsPermissions.ORG_MAY_CHANGE_LIMITS,\n      ),\n      mayChangeGenerationWhiteList: permissions.includes(\n        AccountsPermissions.ORG_MAY_CHANGE_GENERATION_WHITELIST,\n      ),\n      sql: permissions.includes(AccountsPermissions.ADMIN_SQL),\n      modelerDeleteUser: permissions.includes(\n        AccountsPermissions.MODELER_DELETE_USER,\n      ),\n      unblockUser: permissions.includes(AccountsPermissions.UNBLOCK_USER),\n      god: {\n        triggerCrons: permissions.includes(AccountsPermissions.GOD_CRON),\n        forceSalesPlanOnOrg: permissions.includes(\n          AccountsPermissions.FORCE_SALES_PLAN_ON_ORG,\n        ),\n        changeSignupSpamPatterns: permissions.includes(\n          AccountsPermissions.GOD_SIGNUP_SPAM_PATTERNS,\n        ),\n        purgeUsers: permissions.includes(AccountsPermissions.GOD_PURGE_USERS),\n        updateUserMetadata: permissions.includes(\n          AccountsPermissions.GOD_UPDATE_USER_METADATA,\n        ),\n      },\n      bot: permissions.includes(AccountsPermissions.BOT),\n      changeEmail: permissions.includes(AccountsPermissions.ADMIN_CHANGE_EMAIL),\n      changeUserName: permissions.includes(\n        AccountsPermissions.ADMIN_CHANGE_USER_NAME,\n      ),\n    },\n    salesPlan: {\n      create: permissions.includes(AccountsPermissions.SALES_PLAN_CREATE),\n      modify: permissions.includes(AccountsPermissions.SALES_PLAN_MODIFY),\n      forceModify: permissions.includes(\n        AccountsPermissions.SALES_PLAN_FORCE_MODIFY,\n      ),\n      switch: permissions.includes(AccountsPermissions.SALES_PLAN_SWITCH),\n      delete: permissions.includes(AccountsPermissions.SALES_PLAN_DELETE),\n      godDelete: permissions.includes(\n        AccountsPermissions.SALES_PLAN_DELETE_AS_GOD,\n      ),\n    },\n    enterprise: {\n      org: {\n        convert: permissions.includes(\n          AccountsPermissions.ENTERPRISE_ORG_CONVERT,\n        ),\n        modify: permissions.includes(AccountsPermissions.ENTERPRISE_ORG_MODIFY),\n        modifyStartDate: permissions.includes(\n          AccountsPermissions.ENTERPRISE_ORG_MODIFY_START_DATE,\n        ),\n      },\n    },\n    trial: {\n      convertToInNegotiation: permissions.includes(\n        AccountsPermissions.TRIAL_TO_IN_NEGOTIATION_CONVERT,\n      ),\n    },\n    supportAgent: {\n      removeAgentsFromOrg: permissions.includes(\n        AccountsPermissions.SUPPORT_AGENT_REMOVE_AGENTS_FROM_ORG,\n      ),\n      seeOrgMemberships: permissions.includes(\n        AccountsPermissions.SUPPORT_AGENT_SEE_ORG_MEMBERSHIPS,\n      ),\n      addAgentsToOrg: permissions.includes(\n        AccountsPermissions.SUPPORT_AGENT_ADD_TO_ORG,\n      ),\n    },\n    m2m: {\n      salesplan: {\n        get: permissions.includes(AccountsPermissions.M2M_SALESPLAN_GET),\n        switch: permissions.includes(AccountsPermissions.M2M_SALESPLAN_SWITCH),\n      },\n      fetchMigrationData: permissions.includes(\n        ConsolePermissions.M2M_FETCH_MIGRATION_DATA,\n      ),\n      approvals: permissions.includes(ConsolePermissions.M2M_CONTROL_APPROVALS),\n    },\n    externalM2m: {\n      org: {\n        members: {\n          get: permissions.includes(\n            AccountsPermissions.EXTERNAL_M2M_GET_ORG_MEMBERS,\n          ),\n        },\n        search: permissions.includes(\n          AccountsPermissions.EXTERNAL_M2M_SEARCH_ORGS,\n        ),\n      },\n      // eslint-disable-next-line id-length\n      qa: {\n        org: {\n          create: permissions.includes(\n            AccountsPermissions.EXTERNAL_M2M_QA_ORG_CREATE,\n          ),\n        },\n      },\n      offboarding: {\n        camundi: permissions.includes(\n          AccountsPermissions.EXTERNAL_M2M_OFFBOARD_CAMUNDI,\n        ),\n      },\n    },\n    auth0: {\n      connections: {\n        create: permissions.includes(\n          AccountsPermissions.ADMIN_AUTH0_CONNECTIONS_CREATE,\n        ),\n        read: permissions.includes(\n          AccountsPermissions.ADMIN_AUTH0_CONNECTIONS_READ,\n        ),\n        update: permissions.includes(\n          AccountsPermissions.ADMIN_AUTH0_CONNECTIONS_UPDATE,\n        ),\n        delete: permissions.includes(\n          AccountsPermissions.ADMIN_AUTH0_CONNECTIONS_DELETE,\n        ),\n      },\n    },\n    notifications: {\n      global: {\n        read: permissions.includes(NotificationPermissions.READ_GLOBAL),\n        delete: permissions.includes(NotificationPermissions.DELETE_GLOBAL),\n        create: permissions.includes(NotificationPermissions.CREATE_GLOBAL),\n      },\n    },\n    earlyAccessFeatures: {\n      read: permissions.includes(\n        AccountsPermissions.ADMIN_EARLY_ACCESS_FEATURES_READ,\n      ),\n      create: permissions.includes(\n        AccountsPermissions.ADMIN_EARLY_ACCESS_FEATURES_CREATE,\n      ),\n      delete: permissions.includes(\n        AccountsPermissions.ADMIN_EARLY_ACCESS_FEATURES_DELETE,\n      ),\n      update: permissions.includes(\n        AccountsPermissions.ADMIN_EARLY_ACCESS_FEATURES_UPDATE,\n      ),\n    },\n    pdfWatermark: {\n      read: permissions.includes(AccountsPermissions.PDF_WATERMARK_READ),\n      write: permissions.includes(AccountsPermissions.PDF_WATERMARK_WRITE),\n    },\n    featureFlags: {\n      write: permissions.includes(\n        AccountsPermissions.ADMIN_FEATURE_FLAGS_WRITE,\n      ),\n    },\n  }\n  return newFeatures\n}\n\nexport function consoleUserFeaturesFromPermissions(permissions: string[]) {\n  const newFeatures: ConsolePermissions.Features = {\n    apiClient: {\n      read: permissions.includes(ConsolePermissions.APICLIENT_READ),\n      delete: permissions.includes(ConsolePermissions.APICLIENT_DELETE),\n    },\n    multiCluster: {\n      admin: permissions.includes(ConsolePermissions.MULTICLUSTER_ADMIN),\n    },\n    multiGen: {\n      admin: {\n        see: permissions.includes(\n          ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN_SEE,\n        ),\n        modify: permissions.includes(\n          ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN,\n        ),\n        patchExistingChannel: permissions.includes(\n          ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN_PATCH_EXISTING_CHANNEL,\n        ),\n        migrate: permissions.includes(\n          ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN_MIGRATE,\n        ),\n        deleteAllClustersOfGeneration: permissions.includes(\n          ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN_DELETE_ALL_CLUSTERS,\n        ),\n      },\n      releaseTrain: {\n        publish: permissions.includes(ConsolePermissions.RELEASE_TRAIN_PUBLISH),\n      },\n    },\n    clusters: {\n      canReadAllClusterInfo: permissions.includes(\n        ConsolePermissions.CLUSTERS_READALLCLUSTERINFO,\n      ),\n      canDeleteAllClusters: permissions.includes(\n        ConsolePermissions.CLUSTERS_DELETE_CLUSTER,\n      ),\n      canMoveToOtherOrg: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_MOVE_TO_OTHER_ORG,\n      ),\n      createOnBehalf: permissions.includes(\n        ConsolePermissions.CLUSTER_CREATE_ON_BEHALF,\n      ),\n      canSendToSleep: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_SEND_TO_SLEEP,\n      ),\n      canCreateInternalBackup: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_CREATE_INTERNAL_BACKUP,\n      ),\n      canUpdateClusterPlanType: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_UPDATE_CLUSTERPLANTYPE,\n      ),\n      canOverrideEnvVars: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_OVERRIDE_ENV_VARS,\n      ),\n      canCreateModificationConfig: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_CREATE_MODIFICATION_CONFIG,\n      ),\n      canUpgradeGeneration: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_UPDATE_GENERATION,\n      ),\n      canUpgradeGenerationYolo: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_UPDATE_GENERATION_YOLO,\n      ),\n      canUpdateOptionalTelemetry: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_UPDATE_OPTIONAL_TELEMETRY,\n      ),\n    },\n    clusterPlan: {\n      seeAll: permissions.includes(ConsolePermissions.CLUSTER_PLAN_SEE_ALL),\n      create: permissions.includes(ConsolePermissions.CLUSTER_PLAN_CREATE),\n      delete: permissions.includes(ConsolePermissions.CLUSTER_PLAN_DELETE),\n      type: {\n        create: permissions.includes(\n          ConsolePermissions.CLUSTER_PLAN_TYPE_CREATE,\n        ),\n        modify: permissions.includes(\n          ConsolePermissions.CLUSTER_PLAN_TYPE_MODIFY,\n        ),\n        delete: permissions.includes(\n          ConsolePermissions.CLUSTER_PLAN_TYPE_DELETE,\n        ),\n        forceDelete: permissions.includes(\n          ConsolePermissions.CLUSTER_PLAN_TYPE_FORCE_DELETE,\n        ),\n      },\n      migrate: permissions.includes(ConsolePermissions.CLUSTER_PLAN_MIGRATE),\n      deleteAllClustersOfPlan: permissions.includes(\n        ConsolePermissions.CLUSTER_PLAN_CAN_DELETE_ALL_CLUSTERS_OF_PLAN,\n      ),\n      modify: permissions.includes(ConsolePermissions.CLUSTER_PLAN_CAN_MODIFY),\n    },\n    features: {\n      newHome: permissions.includes(ConsolePermissions.FEATURE_NEW_HOME),\n      templatePicker: permissions.includes(\n        ConsolePermissions.FEATURE_TEMPLATE_PICKER,\n      ),\n      userSettings: permissions.includes(ConsolePermissions.USER_SETTINGS),\n      debug: permissions.includes(ConsolePermissions.DEBUG),\n    },\n    m2m: {\n      updateCrd: permissions.includes(ConsolePermissions.M2M_UPDATE_CRD),\n      signup: permissions.includes(ConsolePermissions.M2M_SIGNUP),\n      triggerAlert: permissions.includes(ConsolePermissions.M2M_TRIGGER_ALERT),\n      deleteOrgClusters: permissions.includes(\n        ConsolePermissions.M2M_DELETE_ORG_CLUSTERS,\n      ),\n      updateOrgClusters: permissions.includes(\n        ConsolePermissions.M2M_UPDATE_ORG_CLUSTERS,\n      ),\n      addUsageMetrics: permissions.includes(\n        ConsolePermissions.M2M_ADD_CLUSTER_USAGE_METRICS,\n      ),\n      sendSseEvent: permissions.includes(ConsolePermissions.M2M_SEND_SSE_EVENT),\n      external: {\n        internalClient: permissions.includes(\n          ConsolePermissions.M2M_EXTERNAL_INTERNAL_CLIENT,\n        ),\n      },\n      fetchMigrationData: permissions.includes(\n        ConsolePermissions.M2M_FETCH_MIGRATION_DATA,\n      ),\n      manageGenerationUpgradePath: permissions.includes(\n        ConsolePermissions.M2M_MANAGE_GENERATION_UPGRADE_PATH,\n      ),\n      approvals: permissions.includes(ConsolePermissions.M2M_CONTROL_APPROVALS),\n    },\n  }\n  return newFeatures\n}\n\n/**\n * Flattens a feature tree into the dotted keys of the Control session.\n *\n * `buildSession` in accounts-backend writes the session with exactly this\n * shape, under the prefixes `` (accounts), `console` and `notifications`.\n */\nfunction flattenFeatureBooleans(\n  value: unknown,\n  prefix = '',\n): Record<string, boolean> {\n  const out: Record<string, boolean> = {}\n  if (!value || typeof value !== 'object') {\n    return out\n  }\n  for (const [key, entry] of Object.entries(value as Record<string, unknown>)) {\n    const flatKey = prefix ? `${prefix}.${key}` : key\n    if (typeof entry === 'boolean') {\n      out[flatKey] = entry\n    } else if (entry && typeof entry === 'object') {\n      Object.assign(out, flattenFeatureBooleans(entry, flatKey))\n    }\n  }\n  return out\n}\n\n/**\n * The session keys that ONE raw Auth0 permission turns on.\n *\n * The Control session holds a flat record of feature booleans, such as\n * `admin.extendTrial` and `console.clusters.canUpgradeGenerationYolo`. An\n * approval use case names the raw Auth0 short code instead, such as `aaet`,\n * because that is what the token carries and what a backend compares.\n *\n * This function bridges the two, and it bridges them by RUNNING the same\n * mappers that build the session. A hand-written table of code to key would be\n * a third copy of the permission model, and a code that gained a key would\n * silently stop gating anything in the browser.\n *\n * It answers an array, because one code can turn on more than one key. An\n * unknown code answers an empty array, and the caller decides what that means.\n *\n * The answer is CACHED, because the work is three feature trees and a flatten\n * of each one. `ApprovalActorView.has` of the browser runs this, and the rules\n * call `has` for every row of the queue: a page of 2000 requests turned one\n * cheap question into thousands of tree builds. The answer of a code never\n * changes inside one bundle, so the cache needs no invalidation, and the keys\n * are the permission codes of the use cases, which is a short list.\n *\n * The answer is `readonly`, and frozen, because every caller of one code gets\n * the SAME array: a caller that sorted or pushed in place would change what\n * the next reader of that code sees.\n */\nconst keysByPermissionCode = new Map<string, readonly string[]>()\n\nexport function sessionPermissionKeysFor(\n  permissionCode: string,\n): readonly string[] {\n  const cached = keysByPermissionCode.get(permissionCode)\n  if (cached) {\n    return cached\n  }\n  const answer = Object.freeze(buildSessionPermissionKeys(permissionCode))\n  keysByPermissionCode.set(permissionCode, answer)\n  return answer\n}\n\nfunction buildSessionPermissionKeys(permissionCode: string): string[] {\n  const trees: [unknown, string][] = [\n    [accountsUserFeaturesFromPermissions([permissionCode]), ''],\n    [consoleUserFeaturesFromPermissions([permissionCode]), 'console'],\n    [\n      NotificationPermissions.userFeaturesFromPermissions([permissionCode]),\n      'notifications',\n    ],\n  ]\n  const keys: string[] = []\n  for (const [tree, prefix] of trees) {\n    for (const [key, on] of Object.entries(\n      flattenFeatureBooleans(tree, prefix),\n    )) {\n      if (on) {\n        keys.push(key)\n      }\n    }\n  }\n  return keys\n}\n\n/**\n * Reports whether a Control session holds one raw Auth0 permission.\n *\n * It is what `ApprovalActorView.has` runs in the browser. An unknown code\n * answers false: a permission that nothing maps is a permission that nobody\n * holds, and the alternative would open a button that the backend refuses.\n */\nexport function sessionHasPermission(\n  sessionPermissions: Record<string, boolean>,\n  permissionCode: string,\n): boolean {\n  return sessionPermissionKeysFor(permissionCode).some(\n    (key) => sessionPermissions[key] === true,\n  )\n}\n"],
+  "mappings": "AAMA,SAAS,2BAA2B;AACpC,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,+BAA+B;AAEjC,SAAS,oCAAoC,aAAuB;AACzE,QAAM,cAA4C;AAAA,IAChD,OAAO;AAAA,MACL,SAAS,YAAY,SAAS,oBAAoB,QAAQ;AAAA,MAC1D,WAAW,YAAY,SAAS,oBAAoB,UAAU;AAAA,MAC9D,eAAe,YAAY,SAAS,oBAAoB,eAAe;AAAA,MAEvE,WAAW,YAAY,SAAS,oBAAoB,UAAU;AAAA,MAC9D,wBAAwB,YAAY;AAAA,QAClC,oBAAoB;AAAA,MACtB;AAAA,MACA,YAAY,YAAY,SAAS,oBAAoB,WAAW;AAAA,MAChE,wBAAwB,YAAY;AAAA,QAClC,oBAAoB;AAAA,MACtB;AAAA,MACA,UAAU,YAAY,SAAS,oBAAoB,UAAU;AAAA,MAC7D,eAAe,YAAY,SAAS,oBAAoB,eAAe;AAAA,MACvE,eAAe,YAAY,SAAS,oBAAoB,eAAe;AAAA,MACvE,cAAc,YAAY,SAAS,oBAAoB,aAAa;AAAA,MACpE,YAAY,YAAY,SAAS,oBAAoB,WAAW;AAAA,MAChE,aAAa,YAAY,SAAS,oBAAoB,gBAAgB;AAAA,MACtE,gBAAgB,YAAY;AAAA,QAC1B,mBAAmB;AAAA,MACrB;AAAA,MACA,aAAa,YAAY,SAAS,oBAAoB,YAAY;AAAA,MAClE,iBAAiB,YAAY;AAAA,QAC3B,oBAAoB;AAAA,MACtB;AAAA,MACA,YAAY,YAAY,SAAS,oBAAoB,eAAe;AAAA,MACpE,eAAe,YAAY;AAAA,QACzB,mBAAmB;AAAA,MACrB;AAAA,MACA,WAAW,YAAY,SAAS,uBAAuB,IAAI;AAAA,MAC3D,mCAAmC,YAAY;AAAA,QAC7C,oBAAoB;AAAA,MACtB;AAAA,MACA,oBAAoB,YAAY;AAAA,QAC9B,oBAAoB;AAAA,MACtB;AAAA,MACA,8BAA8B,YAAY;AAAA,QACxC,oBAAoB;AAAA,MACtB;AAAA,MACA,KAAK,YAAY,SAAS,oBAAoB,SAAS;AAAA,MACvD,mBAAmB,YAAY;AAAA,QAC7B,oBAAoB;AAAA,MACtB;AAAA,MACA,aAAa,YAAY,SAAS,oBAAoB,YAAY;AAAA,MAClE,KAAK;AAAA,QACH,cAAc,YAAY,SAAS,oBAAoB,QAAQ;AAAA,QAC/D,qBAAqB,YAAY;AAAA,UAC/B,oBAAoB;AAAA,QACtB;AAAA,QACA,0BAA0B,YAAY;AAAA,UACpC,oBAAoB;AAAA,QACtB;AAAA,QACA,YAAY,YAAY,SAAS,oBAAoB,eAAe;AAAA,QACpE,oBAAoB,YAAY;AAAA,UAC9B,oBAAoB;AAAA,QACtB;AAAA,MACF;AAAA,MACA,KAAK,YAAY,SAAS,oBAAoB,GAAG;AAAA,MACjD,aAAa,YAAY,SAAS,oBAAoB,kBAAkB;AAAA,MACxE,gBAAgB,YAAY;AAAA,QAC1B,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,IACA,WAAW;AAAA,MACT,QAAQ,YAAY,SAAS,oBAAoB,iBAAiB;AAAA,MAClE,QAAQ,YAAY,SAAS,oBAAoB,iBAAiB;AAAA,MAClE,aAAa,YAAY;AAAA,QACvB,oBAAoB;AAAA,MACtB;AAAA,MACA,QAAQ,YAAY,SAAS,oBAAoB,iBAAiB;AAAA,MAClE,QAAQ,YAAY,SAAS,oBAAoB,iBAAiB;AAAA,MAClE,WAAW,YAAY;AAAA,QACrB,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,IACA,YAAY;AAAA,MACV,KAAK;AAAA,QACH,SAAS,YAAY;AAAA,UACnB,oBAAoB;AAAA,QACtB;AAAA,QACA,QAAQ,YAAY,SAAS,oBAAoB,qBAAqB;AAAA,QACtE,iBAAiB,YAAY;AAAA,UAC3B,oBAAoB;AAAA,QACtB;AAAA,MACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL,wBAAwB,YAAY;AAAA,QAClC,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,qBAAqB,YAAY;AAAA,QAC/B,oBAAoB;AAAA,MACtB;AAAA,MACA,mBAAmB,YAAY;AAAA,QAC7B,oBAAoB;AAAA,MACtB;AAAA,MACA,gBAAgB,YAAY;AAAA,QAC1B,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,WAAW;AAAA,QACT,KAAK,YAAY,SAAS,oBAAoB,iBAAiB;AAAA,QAC/D,QAAQ,YAAY,SAAS,oBAAoB,oBAAoB;AAAA,MACvE;AAAA,MACA,oBAAoB,YAAY;AAAA,QAC9B,mBAAmB;AAAA,MACrB;AAAA,MACA,WAAW,YAAY,SAAS,mBAAmB,qBAAqB;AAAA,IAC1E;AAAA,IACA,aAAa;AAAA,MACX,KAAK;AAAA,QACH,SAAS;AAAA,UACP,KAAK,YAAY;AAAA,YACf,oBAAoB;AAAA,UACtB;AAAA,QACF;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,oBAAoB;AAAA,QACtB;AAAA,MACF;AAAA;AAAA,MAEA,IAAI;AAAA,QACF,KAAK;AAAA,UACH,QAAQ,YAAY;AAAA,YAClB,oBAAoB;AAAA,UACtB;AAAA,QACF;AAAA,MACF;AAAA,MACA,aAAa;AAAA,QACX,SAAS,YAAY;AAAA,UACnB,oBAAoB;AAAA,QACtB;AAAA,MACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL,aAAa;AAAA,QACX,QAAQ,YAAY;AAAA,UAClB,oBAAoB;AAAA,QACtB;AAAA,QACA,MAAM,YAAY;AAAA,UAChB,oBAAoB;AAAA,QACtB;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,oBAAoB;AAAA,QACtB;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,oBAAoB;AAAA,QACtB;AAAA,MACF;AAAA,IACF;AAAA,IACA,eAAe;AAAA,MACb,QAAQ;AAAA,QACN,MAAM,YAAY,SAAS,wBAAwB,WAAW;AAAA,QAC9D,QAAQ,YAAY,SAAS,wBAAwB,aAAa;AAAA,QAClE,QAAQ,YAAY,SAAS,wBAAwB,aAAa;AAAA,MACpE;AAAA,IACF;AAAA,IACA,qBAAqB;AAAA,MACnB,MAAM,YAAY;AAAA,QAChB,oBAAoB;AAAA,MACtB;AAAA,MACA,QAAQ,YAAY;AAAA,QAClB,oBAAoB;AAAA,MACtB;AAAA,MACA,QAAQ,YAAY;AAAA,QAClB,oBAAoB;AAAA,MACtB;AAAA,MACA,QAAQ,YAAY;AAAA,QAClB,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,MAAM,YAAY,SAAS,oBAAoB,kBAAkB;AAAA,MACjE,OAAO,YAAY,SAAS,oBAAoB,mBAAmB;AAAA,IACrE;AAAA,IACA,cAAc;AAAA,MACZ,OAAO,YAAY;AAAA,QACjB,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,mCAAmC,aAAuB;AACxE,QAAM,cAA2C;AAAA,IAC/C,WAAW;AAAA,MACT,MAAM,YAAY,SAAS,mBAAmB,cAAc;AAAA,MAC5D,QAAQ,YAAY,SAAS,mBAAmB,gBAAgB;AAAA,IAClE;AAAA,IACA,cAAc;AAAA,MACZ,OAAO,YAAY,SAAS,mBAAmB,kBAAkB;AAAA,IACnE;AAAA,IACA,UAAU;AAAA,MACR,OAAO;AAAA,QACL,KAAK,YAAY;AAAA,UACf,mBAAmB;AAAA,QACrB;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,mBAAmB;AAAA,QACrB;AAAA,QACA,sBAAsB,YAAY;AAAA,UAChC,mBAAmB;AAAA,QACrB;AAAA,QACA,SAAS,YAAY;AAAA,UACnB,mBAAmB;AAAA,QACrB;AAAA,QACA,+BAA+B,YAAY;AAAA,UACzC,mBAAmB;AAAA,QACrB;AAAA,MACF;AAAA,MACA,cAAc;AAAA,QACZ,SAAS,YAAY,SAAS,mBAAmB,qBAAqB;AAAA,MACxE;AAAA,IACF;AAAA,IACA,UAAU;AAAA,MACR,uBAAuB,YAAY;AAAA,QACjC,mBAAmB;AAAA,MACrB;AAAA,MACA,sBAAsB,YAAY;AAAA,QAChC,mBAAmB;AAAA,MACrB;AAAA,MACA,mBAAmB,YAAY;AAAA,QAC7B,mBAAmB;AAAA,MACrB;AAAA,MACA,gBAAgB,YAAY;AAAA,QAC1B,mBAAmB;AAAA,MACrB;AAAA,MACA,gBAAgB,YAAY;AAAA,QAC1B,mBAAmB;AAAA,MACrB;AAAA,MACA,yBAAyB,YAAY;AAAA,QACnC,mBAAmB;AAAA,MACrB;AAAA,MACA,0BAA0B,YAAY;AAAA,QACpC,mBAAmB;AAAA,MACrB;AAAA,MACA,oBAAoB,YAAY;AAAA,QAC9B,mBAAmB;AAAA,MACrB;AAAA,MACA,6BAA6B,YAAY;AAAA,QACvC,mBAAmB;AAAA,MACrB;AAAA,MACA,sBAAsB,YAAY;AAAA,QAChC,mBAAmB;AAAA,MACrB;AAAA,MACA,0BAA0B,YAAY;AAAA,QACpC,mBAAmB;AAAA,MACrB;AAAA,MACA,4BAA4B,YAAY;AAAA,QACtC,mBAAmB;AAAA,MACrB;AAAA,IACF;AAAA,IACA,aAAa;AAAA,MACX,QAAQ,YAAY,SAAS,mBAAmB,oBAAoB;AAAA,MACpE,QAAQ,YAAY,SAAS,mBAAmB,mBAAmB;AAAA,MACnE,QAAQ,YAAY,SAAS,mBAAmB,mBAAmB;AAAA,MACnE,MAAM;AAAA,QACJ,QAAQ,YAAY;AAAA,UAClB,mBAAmB;AAAA,QACrB;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,mBAAmB;AAAA,QACrB;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,mBAAmB;AAAA,QACrB;AAAA,QACA,aAAa,YAAY;AAAA,UACvB,mBAAmB;AAAA,QACrB;AAAA,MACF;AAAA,MACA,SAAS,YAAY,SAAS,mBAAmB,oBAAoB;AAAA,MACrE,yBAAyB,YAAY;AAAA,QACnC,mBAAmB;AAAA,MACrB;AAAA,MACA,QAAQ,YAAY,SAAS,mBAAmB,uBAAuB;AAAA,IACzE;AAAA,IACA,UAAU;AAAA,MACR,SAAS,YAAY,SAAS,mBAAmB,gBAAgB;AAAA,MACjE,gBAAgB,YAAY;AAAA,QAC1B,mBAAmB;AAAA,MACrB;AAAA,MACA,cAAc,YAAY,SAAS,mBAAmB,aAAa;AAAA,MACnE,OAAO,YAAY,SAAS,mBAAmB,KAAK;AAAA,IACtD;AAAA,IACA,KAAK;AAAA,MACH,WAAW,YAAY,SAAS,mBAAmB,cAAc;AAAA,MACjE,QAAQ,YAAY,SAAS,mBAAmB,UAAU;AAAA,MAC1D,cAAc,YAAY,SAAS,mBAAmB,iBAAiB;AAAA,MACvE,mBAAmB,YAAY;AAAA,QAC7B,mBAAmB;AAAA,MACrB;AAAA,MACA,mBAAmB,YAAY;AAAA,QAC7B,mBAAmB;AAAA,MACrB;AAAA,MACA,iBAAiB,YAAY;AAAA,QAC3B,mBAAmB;AAAA,MACrB;AAAA,MACA,cAAc,YAAY,SAAS,mBAAmB,kBAAkB;AAAA,MACxE,UAAU;AAAA,QACR,gBAAgB,YAAY;AAAA,UAC1B,mBAAmB;AAAA,QACrB;AAAA,MACF;AAAA,MACA,oBAAoB,YAAY;AAAA,QAC9B,mBAAmB;AAAA,MACrB;AAAA,MACA,6BAA6B,YAAY;AAAA,QACvC,mBAAmB;AAAA,MACrB;AAAA,MACA,WAAW,YAAY,SAAS,mBAAmB,qBAAqB;AAAA,IAC1E;AAAA,EACF;AACA,SAAO;AACT;AAQA,SAAS,uBACP,OACA,SAAS,IACgB;AACzB,QAAM,MAA+B,CAAC;AACtC,MAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,WAAO;AAAA,EACT;AACA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAgC,GAAG;AAC3E,UAAM,UAAU,SAAS,GAAG,MAAM,IAAI,GAAG,KAAK;AAC9C,QAAI,OAAO,UAAU,WAAW;AAC9B,UAAI,OAAO,IAAI;AAAA,IACjB,WAAW,SAAS,OAAO,UAAU,UAAU;AAC7C,aAAO,OAAO,KAAK,uBAAuB,OAAO,OAAO,CAAC;AAAA,IAC3D;AAAA,EACF;AACA,SAAO;AACT;AA6BA,MAAM,uBAAuB,oBAAI,IAA+B;AAEzD,SAAS,yBACd,gBACmB;AACnB,QAAM,SAAS,qBAAqB,IAAI,cAAc;AACtD,MAAI,QAAQ;AACV,WAAO;AAAA,EACT;AACA,QAAM,SAAS,OAAO,OAAO,2BAA2B,cAAc,CAAC;AACvE,uBAAqB,IAAI,gBAAgB,MAAM;AAC/C,SAAO;AACT;AAEA,SAAS,2BAA2B,gBAAkC;AACpE,QAAM,QAA6B;AAAA,IACjC,CAAC,oCAAoC,CAAC,cAAc,CAAC,GAAG,EAAE;AAAA,IAC1D,CAAC,mCAAmC,CAAC,cAAc,CAAC,GAAG,SAAS;AAAA,IAChE;AAAA,MACE,wBAAwB,4BAA4B,CAAC,cAAc,CAAC;AAAA,MACpE;AAAA,IACF;AAAA,EACF;AACA,QAAM,OAAiB,CAAC;AACxB,aAAW,CAAC,MAAM,MAAM,KAAK,OAAO;AAClC,eAAW,CAAC,KAAK,EAAE,KAAK,OAAO;AAAA,MAC7B,uBAAuB,MAAM,MAAM;AAAA,IACrC,GAAG;AACD,UAAI,IAAI;AACN,aAAK,KAAK,GAAG;AAAA,MACf;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AASO,SAAS,qBACd,oBACA,gBACS;AACT,SAAO,yBAAyB,cAAc,EAAE;AAAA,IAC9C,CAAC,QAAQ,mBAAmB,GAAG,MAAM;AAAA,EACvC;AACF;",
   "names": []
 }

package/dist/search/compiler.d.ts

@@ -1,4 +1,13 @@
 import { type QueryNode } from './ast.js';
+/**
+ * The SQL that the compiler writes.
+ *
+ * - `postgres`: `ILIKE`, `:name` parameters (TypeORM), and an id set as one
+ *   separated string.
+ * - `bigquery`: `LOWER(x) LIKE LOWER(@name)`, `@name` parameters, and an id set
+ *   as one array parameter.
+ */
+export type SqlDialect = 'postgres' | 'bigquery';
 /** SQL binding for one searchable field (values live backend-side, not in the FE). */
 export type FieldBinding = {
     kind: 'string';
@@ -19,6 +28,13 @@ export type FieldBinding = {
 } | {
     kind: 'date';
     column: string;
+    /**
+     * The type of the column, for the `bigquery` dialect only. BigQuery does
+     * not compare a DATE with a TIMESTAMP, so the compiler casts the
+     * parameter to this type. A `date` column compares by UTC day. The
+     * default is `timestamp`. Postgres does not read this field.
+     */
+    columnType?: 'timestamp' | 'date';
 } | {
     kind: 'computed';
     /** Column the resolved id set is matched against (e.g. `c.uuid`). */
@@ -33,6 +49,8 @@ export interface CompileContext {
     defaultFields: readonly string[];
     /** Unique-per-call-site parameter prefix (avoids clashing with other params). */
     paramPrefix: string;
+    /** The default is `postgres`. */
+    dialect?: SqlDialect;
 }
 export interface CompiledQuery {
     sql: string;
@@ -71,3 +89,5 @@ export declare const joinIdSet: (ids: readonly string[]) => string;
  * substring value is wrapped in `%…%`.
  */
 export declare const likeArgument: (value: string, match: "substring" | "exact") => string;
+/** Closest field name within edit distance 3, for "did you mean…" hints. */
+export declare const closestField: (input: string, candidates: readonly string[]) => string | undefined;

package/dist/search/compiler.js

@@ -4,6 +4,12 @@ import {
 class Compiler {
   constructor(ctx) {
     this.ctx = ctx;
+    this.dialect = ctx.dialect ?? "postgres";
+    if (this.dialect === "bigquery" && !BIGQUERY_PARAMETER_PREFIX.test(ctx.paramPrefix)) {
+      throw new Error(
+        `Search misconfigured: "${ctx.paramPrefix}" is not a valid BigQuery parameter prefix.`
+      );
+    }
     this.lookup = new Map(
       Object.entries(ctx.bindings).map(([field, binding]) => [
         field.toLowerCase(),
@@ -16,6 +22,7 @@ class Compiler {
   counter = 0;
   /** Lowercased field name → { canonical, binding }, for case-insensitive lookup. */
   lookup;
+  dialect;
   compile(node) {
     return { sql: this.node(node), params: this.params };
   }
@@ -26,7 +33,7 @@ class Compiler {
       case "or":
         return `(${this.node(node.left)} OR ${this.node(node.right)})`;
       case "not":
-        return `(NOT ${this.node(node.child)})`;
+        return this.dialect === "bigquery" ? `(NOT IFNULL(${this.node(node.child)}, FALSE))` : `(NOT ${this.node(node.child)})`;
       case "term":
         return this.term(node);
       case "range":
@@ -65,8 +72,10 @@ class Compiler {
     }
     const lowerOp = node.lowerInclusive ? ">=" : ">";
     const upperOp = node.upperInclusive ? "<=" : "<";
-    const lower = this.bind(this.parseDate(canonical, node.lower));
-    const upper = this.bind(this.parseDate(canonical, node.upper));
+    const lowerDate = this.parseDate(canonical, node.lower);
+    const upperDate = this.parseDate(canonical, node.upper);
+    const lower = this.bindDate(binding, lowerDate, lowerDate);
+    const upper = this.bindDate(binding, upperDate, upperDate);
     return `(${binding.column} ${lowerOp} ${lower} AND ${binding.column} ${upperOp} ${upper})`;
   }
   // --- field kinds ----------------------------------------------------------
@@ -79,20 +88,37 @@ class Compiler {
         );
       }
       const { column, cast } = entry.binding;
-      const target = cast ? `CAST(${column} AS TEXT)` : column;
-      return `${target} ILIKE ${this.bind(likeArgument(value, "substring"))}`;
+      return this.like(
+        this.textTarget(column, cast),
+        likeArgument(value, "substring")
+      );
     });
     return clauses.length === 1 ? clauses[0] : `(${clauses.join(" OR ")})`;
   }
   stringMatch(binding, value) {
-    const target = binding.cast ? `CAST(${binding.column} AS TEXT)` : binding.column;
-    return `${target} ILIKE ${this.bind(likeArgument(value, binding.match))}`;
+    return this.like(
+      this.textTarget(binding.column, binding.cast),
+      likeArgument(value, binding.match)
+    );
+  }
+  textTarget(column, cast) {
+    if (!cast) {
+      return column;
+    }
+    return this.dialect === "bigquery" ? `CAST(${column} AS STRING)` : `CAST(${column} AS TEXT)`;
+  }
+  /** Case-insensitive LIKE. BigQuery has no ILIKE. */
+  like(target, argument) {
+    return this.dialect === "bigquery" ? `LOWER(${target}) LIKE LOWER(${this.bind(argument)})` : `${target} ILIKE ${this.bind(argument)}`;
   }
   computedMatch(binding, value) {
     const ids = binding.resolve(value);
     if (ids.length === 0) {
       return "1 = 0";
     }
+    if (this.dialect === "bigquery") {
+      return `${binding.idColumn} IN UNNEST(${this.bind([...ids])})`;
+    }
     return idSetPredicate(binding.idColumn, this.bindName(joinIdSet(ids)));
   }
   dateTerm(binding, canonical, operator, value) {
@@ -106,10 +132,18 @@ class Compiler {
         )
       );
       const nextDay = new Date(startDay.getTime() + 24 * 60 * 60 * 1e3);
-      return `(${binding.column} >= ${this.bind(startDay.toISOString())} AND ${binding.column} < ${this.bind(nextDay.toISOString())})`;
+      return `(${binding.column} >= ${this.bindDate(binding, startDay, startDay.toISOString())} AND ${binding.column} < ${this.bindDate(binding, nextDay, nextDay.toISOString())})`;
+    }
+    const bound = this.parseDate(canonical, value);
+    return `${binding.column} ${operator} ${this.bindDate(binding, bound, bound.toISOString())}`;
+  }
+  /** `postgresValue` is the parameter that the `postgres` dialect binds. */
+  bindDate(binding, value, postgresValue) {
+    if (this.dialect !== "bigquery") {
+      return this.bind(postgresValue);
     }
-    const bound = this.parseDate(canonical, value).toISOString();
-    return `${binding.column} ${operator} ${this.bind(bound)}`;
+    const iso = value.toISOString();
+    return binding.columnType === "date" ? `CAST(${this.bind(iso.slice(0, 10))} AS DATE)` : `CAST(${this.bind(iso)} AS TIMESTAMP)`;
   }
   // --- validation helpers ---------------------------------------------------
   resolveField(field) {
@@ -165,9 +199,11 @@ class Compiler {
     return name;
   }
   bind(value) {
-    return `:${this.bindName(value)}`;
+    const marker = this.dialect === "bigquery" ? "@" : ":";
+    return `${marker}${this.bindName(value)}`;
   }
 }
+const BIGQUERY_PARAMETER_PREFIX = /^[A-Za-z_]\w*$/;
 const compileQuery = (node, ctx) => new Compiler(ctx).compile(node);
 const ID_SET_SEPARATOR = ",";
 const idSetPredicate = (column, parameter) => `${column} = ANY(string_to_array(:${parameter}, '${ID_SET_SEPARATOR}'))`;
@@ -218,6 +254,7 @@ const editDistance = (left, right) => {
   return dist[rows - 1][cols - 1];
 };
 export {
+  closestField,
   compileQuery,
   idSetPredicate,
   joinIdSet,

package/dist/search/compiler.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/search/compiler.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport {\n  LuceneQueryError,\n  type QueryNode,\n  type RangeNode,\n  type SearchTermOperator,\n  type TermNode,\n} from './ast.js'\n\n// ============================================================================\n// AST \u2192 parameterized SQL compiler.\n//\n// Entity-agnostic: the backend supplies a per-field {@link FieldBinding} map (the\n// SQL columns / computed resolvers stay backend-side), and this turns a parsed\n// query into a single parameterized SQL string for `qb.andWhere(sql, params)`.\n// Field names are whitelisted against the bindings; every value is a bound\n// parameter; wildcards are escaped \u2014 so a query can never inject SQL.\n// ============================================================================\n\n/** SQL binding for one searchable field (values live backend-side, not in the FE). */\nexport type FieldBinding =\n  | {\n      kind: 'string'\n      /** SQL column expression, e.g. `c.name` or `planType.name`. */\n      column: string\n      /** Cast the column to text before matching (uuid columns). */\n      cast?: boolean\n      /** `substring` \u2192 ILIKE %v%; `exact` \u2192 case-insensitive equality. */\n      match: 'substring' | 'exact'\n    }\n  | { kind: 'boolean'; column: string }\n  /** Presence/absence of a nullable column (e.g. active-modification FK). */\n  | { kind: 'nullable'; column: string }\n  | { kind: 'date'; column: string }\n  | {\n      kind: 'computed'\n      /** Column the resolved id set is matched against (e.g. `c.uuid`). */\n      idColumn: string\n      /** Resolve an equality value to matching ids (in-memory / config). */\n      resolve: (value: string) => string[]\n    }\n\nexport interface CompileContext {\n  /** Field name \u2192 SQL binding. Keys are the whitelisted, canonical field names. */\n  bindings: Record<string, FieldBinding>\n  /** Fields a bare term ORs over (must be `string` bindings); always substring. */\n  defaultFields: readonly string[]\n  /** Unique-per-call-site parameter prefix (avoids clashing with other params). */\n  paramPrefix: string\n}\n\nexport interface CompiledQuery {\n  sql: string\n  params: Record<string, unknown>\n}\n\nclass Compiler {\n  private readonly params: Record<string, unknown> = {}\n  private counter = 0\n  /** Lowercased field name \u2192 { canonical, binding }, for case-insensitive lookup. */\n  private readonly lookup: Map<\n    string,\n    { canonical: string; binding: FieldBinding }\n  >\n\n  constructor(private readonly ctx: CompileContext) {\n    this.lookup = new Map(\n      Object.entries(ctx.bindings).map(([field, binding]) => [\n        field.toLowerCase(),\n        { canonical: field, binding },\n      ]),\n    )\n  }\n\n  compile(node: QueryNode): CompiledQuery {\n    return { sql: this.node(node), params: this.params }\n  }\n\n  private node(node: QueryNode): string {\n    switch (node.kind) {\n      case 'and':\n        return `(${this.node(node.left)} AND ${this.node(node.right)})`\n      case 'or':\n        return `(${this.node(node.left)} OR ${this.node(node.right)})`\n      case 'not':\n        return `(NOT ${this.node(node.child)})`\n      case 'term':\n        return this.term(node)\n      case 'range':\n        return this.range(node)\n    }\n  }\n\n  private term(node: TermNode): string {\n    if (node.field === undefined) {\n      return this.bareTerm(node.value)\n    }\n    const { canonical, binding } = this.resolveField(node.field)\n    switch (binding.kind) {\n      case 'string':\n        this.requireMatchOperator(canonical, node.operator)\n        return this.stringMatch(binding, node.value)\n      case 'boolean':\n        this.requireMatchOperator(canonical, node.operator)\n        return `${binding.column} = ${this.bind(this.parseBoolean(canonical, node.value))}`\n      case 'nullable':\n        this.requireMatchOperator(canonical, node.operator)\n        return this.parseBoolean(canonical, node.value)\n          ? `${binding.column} IS NOT NULL`\n          : `${binding.column} IS NULL`\n      case 'computed':\n        this.requireMatchOperator(canonical, node.operator)\n        return this.computedMatch(binding, node.value)\n      case 'date':\n        return this.dateTerm(binding, canonical, node.operator, node.value)\n    }\n  }\n\n  private range(node: RangeNode): string {\n    const { canonical, binding } = this.resolveField(node.field)\n    if (binding.kind !== 'date') {\n      throw new LuceneQueryError(\n        `Field \"${canonical}\" does not support ranges.`,\n        'bad-operator',\n      )\n    }\n    const lowerOp = node.lowerInclusive ? '>=' : '>'\n    const upperOp = node.upperInclusive ? '<=' : '<'\n    const lower = this.bind(this.parseDate(canonical, node.lower))\n    const upper = this.bind(this.parseDate(canonical, node.upper))\n    return `(${binding.column} ${lowerOp} ${lower} AND ${binding.column} ${upperOp} ${upper})`\n  }\n\n  // --- field kinds ----------------------------------------------------------\n\n  private bareTerm(value: string): string {\n    const clauses = this.ctx.defaultFields.map((field) => {\n      const entry = this.lookup.get(field.toLowerCase())\n      if (!entry || entry.binding.kind !== 'string') {\n        // A server-side registry/binding bug, not a bad query \u2014 throw a plain\n        // Error so the routers surface it as a 5xx, never a 400.\n        throw new Error(\n          `Search misconfigured: default field \"${field}\" must be a string binding.`,\n        )\n      }\n      const { column, cast } = entry.binding\n      const target = cast ? `CAST(${column} AS TEXT)` : column\n      return `${target} ILIKE ${this.bind(likeArgument(value, 'substring'))}`\n    })\n    return clauses.length === 1 ? clauses[0] : `(${clauses.join(' OR ')})`\n  }\n\n  private stringMatch(\n    binding: Extract<FieldBinding, { kind: 'string' }>,\n    value: string,\n  ): string {\n    const target = binding.cast\n      ? `CAST(${binding.column} AS TEXT)`\n      : binding.column\n    return `${target} ILIKE ${this.bind(likeArgument(value, binding.match))}`\n  }\n\n  private computedMatch(\n    binding: Extract<FieldBinding, { kind: 'computed' }>,\n    value: string,\n  ): string {\n    const ids = binding.resolve(value)\n    if (ids.length === 0) {\n      // No entity matches this value \u2014 a guaranteed-false predicate (a\n      // surrounding NOT correctly flips it to all-rows).\n      return '1 = 0'\n    }\n    // One parameter, not one for each id. `status:healthy` resolves to the\n    // whole healthy fleet, thus the set follows the size of the fleet.\n    return idSetPredicate(binding.idColumn, this.bindName(joinIdSet(ids)))\n  }\n\n  private dateTerm(\n    binding: Extract<FieldBinding, { kind: 'date' }>,\n    canonical: string,\n    operator: SearchTermOperator,\n    value: string,\n  ): string {\n    if (operator === ':') {\n      // Equality on a date means \"that calendar day\" (UTC): [day, nextDay).\n      const start = this.parseDate(canonical, value)\n      const startDay = new Date(\n        Date.UTC(\n          start.getUTCFullYear(),\n          start.getUTCMonth(),\n          start.getUTCDate(),\n        ),\n      )\n      const nextDay = new Date(startDay.getTime() + 24 * 60 * 60 * 1000)\n      return `(${binding.column} >= ${this.bind(startDay.toISOString())} AND ${binding.column} < ${this.bind(nextDay.toISOString())})`\n    }\n    const bound = this.parseDate(canonical, value).toISOString()\n    return `${binding.column} ${operator} ${this.bind(bound)}`\n  }\n\n  // --- validation helpers ---------------------------------------------------\n\n  private resolveField(field: string): {\n    canonical: string\n    binding: FieldBinding\n  } {\n    const entry = this.lookup.get(field.toLowerCase())\n    if (!entry) {\n      const suggestion = closestField(\n        field,\n        [...this.lookup.values()].map((value) => value.canonical),\n      )\n      throw new LuceneQueryError(\n        `Unknown field \"${field}\".${suggestion ? ` Did you mean \"${suggestion}\"?` : ''}`,\n        'unknown-field',\n        suggestion,\n      )\n    }\n    return entry\n  }\n\n  private requireMatchOperator(\n    field: string,\n    operator: SearchTermOperator,\n  ): void {\n    if (operator !== ':') {\n      throw new LuceneQueryError(\n        `Field \"${field}\" supports only \"field:value\", not \"${operator}\".`,\n        'bad-operator',\n      )\n    }\n  }\n\n  private parseBoolean(field: string, value: string): boolean {\n    const normalized = value.trim().toLowerCase()\n    if (normalized === 'true') {\n      return true\n    }\n    if (normalized === 'false') {\n      return false\n    }\n    throw new LuceneQueryError(\n      `Field \"${field}\" expects true or false, got \"${value}\".`,\n      'bad-value',\n    )\n  }\n\n  private parseDate(field: string, value: string): Date {\n    const parsed = new Date(value)\n    if (Number.isNaN(parsed.getTime())) {\n      throw new LuceneQueryError(\n        `Field \"${field}\" expects a date (e.g. 2024-01-31), got \"${value}\".`,\n        'bad-value',\n      )\n    }\n    return parsed\n  }\n\n  /** Register a value and give back its parameter name, with no marker. */\n  private bindName(value: unknown): string {\n    const name = `${this.ctx.paramPrefix}_${this.counter++}`\n    this.params[name] = value\n    return name\n  }\n\n  private bind(value: unknown): string {\n    return `:${this.bindName(value)}`\n  }\n}\n\n/** Compile a parsed query into a single parameterized SQL fragment. */\nexport const compileQuery = (\n  node: QueryNode,\n  ctx: CompileContext,\n): CompiledQuery => new Compiler(ctx).compile(node)\n\nconst ID_SET_SEPARATOR = ','\n\n/**\n * Match `column` against an id set that arrives as ONE parameter.\n *\n * `IN (:...ids)` expands to one bind parameter, and one literal in the\n * statement, for each id. A dimension that does not live in SQL resolves to an\n * id set, and such a set follows the size of the fleet: the prod cluster fleet\n * is more than 1000. Both the statement text and the parameter count would\n * grow with it, and Postgres would plan the statement again at every size.\n *\n * Postgres splits the string here, thus the statement text is constant.\n * `= ANY(...)` can still use an index on the column.\n */\nexport const idSetPredicate = (column: string, parameter: string): string =>\n  `${column} = ANY(string_to_array(:${parameter}, '${ID_SET_SEPARATOR}'))`\n\n/**\n * The id set as one separated string, for {@link idSetPredicate}.\n *\n * The value is a bind parameter, thus it cannot change the statement. But an\n * id that holds the separator would become two ids, thus such an id is\n * dropped. The id columns are text columns, so this stays a guard and not an\n * assumption.\n *\n * An empty string gives an empty array in Postgres. Thus the match finds\n * nothing, which is correct for an empty set.\n */\nexport const joinIdSet = (ids: readonly string[]): string =>\n  ids.filter((id) => !id.includes(ID_SET_SEPARATOR)).join(ID_SET_SEPARATOR)\n\n/**\n * Turn a user value into an ILIKE argument: SQL wildcards (`%`, `_`, `\\`) are\n * escaped to literals, then the user's `*`/`?` become `%`/`_`; a plain\n * substring value is wrapped in `%\u2026%`.\n */\nexport const likeArgument = (\n  value: string,\n  match: 'substring' | 'exact',\n): string => {\n  const escaped = value.replace(/([\\\\%_])/g, '\\\\$1')\n  if (/[*?]/.test(value)) {\n    return escaped.replace(/\\*/g, '%').replace(/\\?/g, '_')\n  }\n  return match === 'substring' ? `%${escaped}%` : escaped\n}\n\n/** Closest field name within edit distance 3, for \"did you mean\u2026\" hints. */\nconst closestField = (\n  input: string,\n  candidates: readonly string[],\n): string | undefined => {\n  const needle = input.toLowerCase()\n  let best: string | undefined\n  let bestDistance = Number.POSITIVE_INFINITY\n  for (const candidate of candidates) {\n    const distance = editDistance(needle, candidate.toLowerCase())\n    if (distance < bestDistance) {\n      bestDistance = distance\n      best = candidate\n    }\n  }\n  return bestDistance <= 3 ? best : undefined\n}\n\n/** Standard Levenshtein distance. */\nconst editDistance = (left: string, right: string): number => {\n  const rows = left.length + 1\n  const cols = right.length + 1\n  const dist = Array.from({ length: rows }, () =>\n    new Array<number>(cols).fill(0),\n  )\n  for (let row = 0; row < rows; row += 1) {\n    dist[row][0] = row\n  }\n  for (let col = 0; col < cols; col += 1) {\n    dist[0][col] = col\n  }\n  for (let row = 1; row < rows; row += 1) {\n    for (let col = 1; col < cols; col += 1) {\n      const cost = left[row - 1] === right[col - 1] ? 0 : 1\n      dist[row][col] = Math.min(\n        dist[row - 1][col] + 1,\n        dist[row][col - 1] + 1,\n        dist[row - 1][col - 1] + cost,\n      )\n    }\n  }\n  return dist[rows - 1][cols - 1]\n}\n"],
-  "mappings": "AAMA;AAAA,EACE;AAAA,OAKK;AAiDP,MAAM,SAAS;AAAA,EASb,YAA6B,KAAqB;AAArB;AAC3B,SAAK,SAAS,IAAI;AAAA,MAChB,OAAO,QAAQ,IAAI,QAAQ,EAAE,IAAI,CAAC,CAAC,OAAO,OAAO,MAAM;AAAA,QACrD,MAAM,YAAY;AAAA,QAClB,EAAE,WAAW,OAAO,QAAQ;AAAA,MAC9B,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAP6B;AAAA,EARZ,SAAkC,CAAC;AAAA,EAC5C,UAAU;AAAA;AAAA,EAED;AAAA,EAcjB,QAAQ,MAAgC;AACtC,WAAO,EAAE,KAAK,KAAK,KAAK,IAAI,GAAG,QAAQ,KAAK,OAAO;AAAA,EACrD;AAAA,EAEQ,KAAK,MAAyB;AACpC,YAAQ,KAAK,MAAM;AAAA,MACjB,KAAK;AACH,eAAO,IAAI,KAAK,KAAK,KAAK,IAAI,CAAC,QAAQ,KAAK,KAAK,KAAK,KAAK,CAAC;AAAA,MAC9D,KAAK;AACH,eAAO,IAAI,KAAK,KAAK,KAAK,IAAI,CAAC,OAAO,KAAK,KAAK,KAAK,KAAK,CAAC;AAAA,MAC7D,KAAK;AACH,eAAO,QAAQ,KAAK,KAAK,KAAK,KAAK,CAAC;AAAA,MACtC,KAAK;AACH,eAAO,KAAK,KAAK,IAAI;AAAA,MACvB,KAAK;AACH,eAAO,KAAK,MAAM,IAAI;AAAA,IAC1B;AAAA,EACF;AAAA,EAEQ,KAAK,MAAwB;AACnC,QAAI,KAAK,UAAU,QAAW;AAC5B,aAAO,KAAK,SAAS,KAAK,KAAK;AAAA,IACjC;AACA,UAAM,EAAE,WAAW,QAAQ,IAAI,KAAK,aAAa,KAAK,KAAK;AAC3D,YAAQ,QAAQ,MAAM;AAAA,MACpB,KAAK;AACH,aAAK,qBAAqB,WAAW,KAAK,QAAQ;AAClD,eAAO,KAAK,YAAY,SAAS,KAAK,KAAK;AAAA,MAC7C,KAAK;AACH,aAAK,qBAAqB,WAAW,KAAK,QAAQ;AAClD,eAAO,GAAG,QAAQ,MAAM,MAAM,KAAK,KAAK,KAAK,aAAa,WAAW,KAAK,KAAK,CAAC,CAAC;AAAA,MACnF,KAAK;AACH,aAAK,qBAAqB,WAAW,KAAK,QAAQ;AAClD,eAAO,KAAK,aAAa,WAAW,KAAK,KAAK,IAC1C,GAAG,QAAQ,MAAM,iBACjB,GAAG,QAAQ,MAAM;AAAA,MACvB,KAAK;AACH,aAAK,qBAAqB,WAAW,KAAK,QAAQ;AAClD,eAAO,KAAK,cAAc,SAAS,KAAK,KAAK;AAAA,MAC/C,KAAK;AACH,eAAO,KAAK,SAAS,SAAS,WAAW,KAAK,UAAU,KAAK,KAAK;AAAA,IACtE;AAAA,EACF;AAAA,EAEQ,MAAM,MAAyB;AACrC,UAAM,EAAE,WAAW,QAAQ,IAAI,KAAK,aAAa,KAAK,KAAK;AAC3D,QAAI,QAAQ,SAAS,QAAQ;AAC3B,YAAM,IAAI;AAAA,QACR,UAAU,SAAS;AAAA,QACnB;AAAA,MACF;AAAA,IACF;AACA,UAAM,UAAU,KAAK,iBAAiB,OAAO;AAC7C,UAAM,UAAU,KAAK,iBAAiB,OAAO;AAC7C,UAAM,QAAQ,KAAK,KAAK,KAAK,UAAU,WAAW,KAAK,KAAK,CAAC;AAC7D,UAAM,QAAQ,KAAK,KAAK,KAAK,UAAU,WAAW,KAAK,KAAK,CAAC;AAC7D,WAAO,IAAI,QAAQ,MAAM,IAAI,OAAO,IAAI,KAAK,QAAQ,QAAQ,MAAM,IAAI,OAAO,IAAI,KAAK;AAAA,EACzF;AAAA;AAAA,EAIQ,SAAS,OAAuB;AACtC,UAAM,UAAU,KAAK,IAAI,cAAc,IAAI,CAAC,UAAU;AACpD,YAAM,QAAQ,KAAK,OAAO,IAAI,MAAM,YAAY,CAAC;AACjD,UAAI,CAAC,SAAS,MAAM,QAAQ,SAAS,UAAU;AAG7C,cAAM,IAAI;AAAA,UACR,wCAAwC,KAAK;AAAA,QAC/C;AAAA,MACF;AACA,YAAM,EAAE,QAAQ,KAAK,IAAI,MAAM;AAC/B,YAAM,SAAS,OAAO,QAAQ,MAAM,cAAc;AAClD,aAAO,GAAG,MAAM,UAAU,KAAK,KAAK,aAAa,OAAO,WAAW,CAAC,CAAC;AAAA,IACvE,CAAC;AACD,WAAO,QAAQ,WAAW,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,KAAK,MAAM,CAAC;AAAA,EACrE;AAAA,EAEQ,YACN,SACA,OACQ;AACR,UAAM,SAAS,QAAQ,OACnB,QAAQ,QAAQ,MAAM,cACtB,QAAQ;AACZ,WAAO,GAAG,MAAM,UAAU,KAAK,KAAK,aAAa,OAAO,QAAQ,KAAK,CAAC,CAAC;AAAA,EACzE;AAAA,EAEQ,cACN,SACA,OACQ;AACR,UAAM,MAAM,QAAQ,QAAQ,KAAK;AACjC,QAAI,IAAI,WAAW,GAAG;AAGpB,aAAO;AAAA,IACT;AAGA,WAAO,eAAe,QAAQ,UAAU,KAAK,SAAS,UAAU,GAAG,CAAC,CAAC;AAAA,EACvE;AAAA,EAEQ,SACN,SACA,WACA,UACA,OACQ;AACR,QAAI,aAAa,KAAK;AAEpB,YAAM,QAAQ,KAAK,UAAU,WAAW,KAAK;AAC7C,YAAM,WAAW,IAAI;AAAA,QACnB,KAAK;AAAA,UACH,MAAM,eAAe;AAAA,UACrB,MAAM,YAAY;AAAA,UAClB,MAAM,WAAW;AAAA,QACnB;AAAA,MACF;AACA,YAAM,UAAU,IAAI,KAAK,SAAS,QAAQ,IAAI,KAAK,KAAK,KAAK,GAAI;AACjE,aAAO,IAAI,QAAQ,MAAM,OAAO,KAAK,KAAK,SAAS,YAAY,CAAC,CAAC,QAAQ,QAAQ,MAAM,MAAM,KAAK,KAAK,QAAQ,YAAY,CAAC,CAAC;AAAA,IAC/H;AACA,UAAM,QAAQ,KAAK,UAAU,WAAW,KAAK,EAAE,YAAY;AAC3D,WAAO,GAAG,QAAQ,MAAM,IAAI,QAAQ,IAAI,KAAK,KAAK,KAAK,CAAC;AAAA,EAC1D;AAAA;AAAA,EAIQ,aAAa,OAGnB;AACA,UAAM,QAAQ,KAAK,OAAO,IAAI,MAAM,YAAY,CAAC;AACjD,QAAI,CAAC,OAAO;AACV,YAAM,aAAa;AAAA,QACjB;AAAA,QACA,CAAC,GAAG,KAAK,OAAO,OAAO,CAAC,EAAE,IAAI,CAAC,UAAU,MAAM,SAAS;AAAA,MAC1D;AACA,YAAM,IAAI;AAAA,QACR,kBAAkB,KAAK,KAAK,aAAa,kBAAkB,UAAU,OAAO,EAAE;AAAA,QAC9E;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,qBACN,OACA,UACM;AACN,QAAI,aAAa,KAAK;AACpB,YAAM,IAAI;AAAA,QACR,UAAU,KAAK,uCAAuC,QAAQ;AAAA,QAC9D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,aAAa,OAAe,OAAwB;AAC1D,UAAM,aAAa,MAAM,KAAK,EAAE,YAAY;AAC5C,QAAI,eAAe,QAAQ;AACzB,aAAO;AAAA,IACT;AACA,QAAI,eAAe,SAAS;AAC1B,aAAO;AAAA,IACT;AACA,UAAM,IAAI;AAAA,MACR,UAAU,KAAK,iCAAiC,KAAK;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,UAAU,OAAe,OAAqB;AACpD,UAAM,SAAS,IAAI,KAAK,KAAK;AAC7B,QAAI,OAAO,MAAM,OAAO,QAAQ,CAAC,GAAG;AAClC,YAAM,IAAI;AAAA,QACR,UAAU,KAAK,4CAA4C,KAAK;AAAA,QAChE;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGQ,SAAS,OAAwB;AACvC,UAAM,OAAO,GAAG,KAAK,IAAI,WAAW,IAAI,KAAK,SAAS;AACtD,SAAK,OAAO,IAAI,IAAI;AACpB,WAAO;AAAA,EACT;AAAA,EAEQ,KAAK,OAAwB;AACnC,WAAO,IAAI,KAAK,SAAS,KAAK,CAAC;AAAA,EACjC;AACF;AAGO,MAAM,eAAe,CAC1B,MACA,QACkB,IAAI,SAAS,GAAG,EAAE,QAAQ,IAAI;AAElD,MAAM,mBAAmB;AAclB,MAAM,iBAAiB,CAAC,QAAgB,cAC7C,GAAG,MAAM,2BAA2B,SAAS,MAAM,gBAAgB;AAa9D,MAAM,YAAY,CAAC,QACxB,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,gBAAgB,CAAC,EAAE,KAAK,gBAAgB;AAOnE,MAAM,eAAe,CAC1B,OACA,UACW;AACX,QAAM,UAAU,MAAM,QAAQ,aAAa,MAAM;AACjD,MAAI,OAAO,KAAK,KAAK,GAAG;AACtB,WAAO,QAAQ,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG;AAAA,EACvD;AACA,SAAO,UAAU,cAAc,IAAI,OAAO,MAAM;AAClD;AAGA,MAAM,eAAe,CACnB,OACA,eACuB;AACvB,QAAM,SAAS,MAAM,YAAY;AACjC,MAAI;AACJ,MAAI,eAAe,OAAO;AAC1B,aAAW,aAAa,YAAY;AAClC,UAAM,WAAW,aAAa,QAAQ,UAAU,YAAY,CAAC;AAC7D,QAAI,WAAW,cAAc;AAC3B,qBAAe;AACf,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO,gBAAgB,IAAI,OAAO;AACpC;AAGA,MAAM,eAAe,CAAC,MAAc,UAA0B;AAC5D,QAAM,OAAO,KAAK,SAAS;AAC3B,QAAM,OAAO,MAAM,SAAS;AAC5B,QAAM,OAAO,MAAM;AAAA,IAAK,EAAE,QAAQ,KAAK;AAAA,IAAG,MACxC,IAAI,MAAc,IAAI,EAAE,KAAK,CAAC;AAAA,EAChC;AACA,WAAS,MAAM,GAAG,MAAM,MAAM,OAAO,GAAG;AACtC,SAAK,GAAG,EAAE,CAAC,IAAI;AAAA,EACjB;AACA,WAAS,MAAM,GAAG,MAAM,MAAM,OAAO,GAAG;AACtC,SAAK,CAAC,EAAE,GAAG,IAAI;AAAA,EACjB;AACA,WAAS,MAAM,GAAG,MAAM,MAAM,OAAO,GAAG;AACtC,aAAS,MAAM,GAAG,MAAM,MAAM,OAAO,GAAG;AACtC,YAAM,OAAO,KAAK,MAAM,CAAC,MAAM,MAAM,MAAM,CAAC,IAAI,IAAI;AACpD,WAAK,GAAG,EAAE,GAAG,IAAI,KAAK;AAAA,QACpB,KAAK,MAAM,CAAC,EAAE,GAAG,IAAI;AAAA,QACrB,KAAK,GAAG,EAAE,MAAM,CAAC,IAAI;AAAA,QACrB,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI;AAAA,MAC3B;AAAA,IACF;AAAA,EACF;AACA,SAAO,KAAK,OAAO,CAAC,EAAE,OAAO,CAAC;AAChC;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport {\n  LuceneQueryError,\n  type QueryNode,\n  type RangeNode,\n  type SearchTermOperator,\n  type TermNode,\n} from './ast.js'\n\n// ============================================================================\n// AST \u2192 parameterized SQL compiler.\n//\n// Entity-agnostic: the backend supplies a per-field {@link FieldBinding} map (the\n// SQL columns / computed resolvers stay backend-side), and this turns a parsed\n// query into a single parameterized SQL string for `qb.andWhere(sql, params)`.\n// Field names are whitelisted against the bindings; every value is a bound\n// parameter; wildcards are escaped \u2014 so a query can never inject SQL.\n//\n// The `bigquery` dialect writes the same predicates for BigQuery (HDP), with\n// `@name` parameters for `createQueryJob({ params })`.\n// ============================================================================\n\n/**\n * The SQL that the compiler writes.\n *\n * - `postgres`: `ILIKE`, `:name` parameters (TypeORM), and an id set as one\n *   separated string.\n * - `bigquery`: `LOWER(x) LIKE LOWER(@name)`, `@name` parameters, and an id set\n *   as one array parameter.\n */\nexport type SqlDialect = 'postgres' | 'bigquery'\n\n/** SQL binding for one searchable field (values live backend-side, not in the FE). */\nexport type FieldBinding =\n  | {\n      kind: 'string'\n      /** SQL column expression, e.g. `c.name` or `planType.name`. */\n      column: string\n      /** Cast the column to text before matching (uuid columns). */\n      cast?: boolean\n      /** `substring` \u2192 ILIKE %v%; `exact` \u2192 case-insensitive equality. */\n      match: 'substring' | 'exact'\n    }\n  | { kind: 'boolean'; column: string }\n  /** Presence/absence of a nullable column (e.g. active-modification FK). */\n  | { kind: 'nullable'; column: string }\n  | {\n      kind: 'date'\n      column: string\n      /**\n       * The type of the column, for the `bigquery` dialect only. BigQuery does\n       * not compare a DATE with a TIMESTAMP, so the compiler casts the\n       * parameter to this type. A `date` column compares by UTC day. The\n       * default is `timestamp`. Postgres does not read this field.\n       */\n      columnType?: 'timestamp' | 'date'\n    }\n  | {\n      kind: 'computed'\n      /** Column the resolved id set is matched against (e.g. `c.uuid`). */\n      idColumn: string\n      /** Resolve an equality value to matching ids (in-memory / config). */\n      resolve: (value: string) => string[]\n    }\n\nexport interface CompileContext {\n  /** Field name \u2192 SQL binding. Keys are the whitelisted, canonical field names. */\n  bindings: Record<string, FieldBinding>\n  /** Fields a bare term ORs over (must be `string` bindings); always substring. */\n  defaultFields: readonly string[]\n  /** Unique-per-call-site parameter prefix (avoids clashing with other params). */\n  paramPrefix: string\n  /** The default is `postgres`. */\n  dialect?: SqlDialect\n}\n\nexport interface CompiledQuery {\n  sql: string\n  params: Record<string, unknown>\n}\n\nclass Compiler {\n  private readonly params: Record<string, unknown> = {}\n  private counter = 0\n  /** Lowercased field name \u2192 { canonical, binding }, for case-insensitive lookup. */\n  private readonly lookup: Map<\n    string,\n    { canonical: string; binding: FieldBinding }\n  >\n\n  private readonly dialect: SqlDialect\n\n  constructor(private readonly ctx: CompileContext) {\n    this.dialect = ctx.dialect ?? 'postgres'\n    if (\n      this.dialect === 'bigquery' &&\n      !BIGQUERY_PARAMETER_PREFIX.test(ctx.paramPrefix)\n    ) {\n      // A server-side bug, not a bad query: BigQuery refuses the name.\n      throw new Error(\n        `Search misconfigured: \"${ctx.paramPrefix}\" is not a valid BigQuery parameter prefix.`,\n      )\n    }\n    this.lookup = new Map(\n      Object.entries(ctx.bindings).map(([field, binding]) => [\n        field.toLowerCase(),\n        { canonical: field, binding },\n      ]),\n    )\n  }\n\n  compile(node: QueryNode): CompiledQuery {\n    return { sql: this.node(node), params: this.params }\n  }\n\n  private node(node: QueryNode): string {\n    switch (node.kind) {\n      case 'and':\n        return `(${this.node(node.left)} AND ${this.node(node.right)})`\n      case 'or':\n        return `(${this.node(node.left)} OR ${this.node(node.right)})`\n      case 'not':\n        // In BigQuery, a predicate on a NULL column is NULL, and `NOT NULL`\n        // drops the row. `NOT env:production` must keep a row with no env.\n        return this.dialect === 'bigquery'\n          ? `(NOT IFNULL(${this.node(node.child)}, FALSE))`\n          : `(NOT ${this.node(node.child)})`\n      case 'term':\n        return this.term(node)\n      case 'range':\n        return this.range(node)\n    }\n  }\n\n  private term(node: TermNode): string {\n    if (node.field === undefined) {\n      return this.bareTerm(node.value)\n    }\n    const { canonical, binding } = this.resolveField(node.field)\n    switch (binding.kind) {\n      case 'string':\n        this.requireMatchOperator(canonical, node.operator)\n        return this.stringMatch(binding, node.value)\n      case 'boolean':\n        this.requireMatchOperator(canonical, node.operator)\n        return `${binding.column} = ${this.bind(this.parseBoolean(canonical, node.value))}`\n      case 'nullable':\n        this.requireMatchOperator(canonical, node.operator)\n        return this.parseBoolean(canonical, node.value)\n          ? `${binding.column} IS NOT NULL`\n          : `${binding.column} IS NULL`\n      case 'computed':\n        this.requireMatchOperator(canonical, node.operator)\n        return this.computedMatch(binding, node.value)\n      case 'date':\n        return this.dateTerm(binding, canonical, node.operator, node.value)\n    }\n  }\n\n  private range(node: RangeNode): string {\n    const { canonical, binding } = this.resolveField(node.field)\n    if (binding.kind !== 'date') {\n      throw new LuceneQueryError(\n        `Field \"${canonical}\" does not support ranges.`,\n        'bad-operator',\n      )\n    }\n    const lowerOp = node.lowerInclusive ? '>=' : '>'\n    const upperOp = node.upperInclusive ? '<=' : '<'\n    const lowerDate = this.parseDate(canonical, node.lower)\n    const upperDate = this.parseDate(canonical, node.upper)\n    // Postgres gets the Date object here, and an ISO string on a term.\n    const lower = this.bindDate(binding, lowerDate, lowerDate)\n    const upper = this.bindDate(binding, upperDate, upperDate)\n    return `(${binding.column} ${lowerOp} ${lower} AND ${binding.column} ${upperOp} ${upper})`\n  }\n\n  // --- field kinds ----------------------------------------------------------\n\n  private bareTerm(value: string): string {\n    const clauses = this.ctx.defaultFields.map((field) => {\n      const entry = this.lookup.get(field.toLowerCase())\n      if (!entry || entry.binding.kind !== 'string') {\n        // A server-side registry/binding bug, not a bad query \u2014 throw a plain\n        // Error so the routers surface it as a 5xx, never a 400.\n        throw new Error(\n          `Search misconfigured: default field \"${field}\" must be a string binding.`,\n        )\n      }\n      const { column, cast } = entry.binding\n      return this.like(\n        this.textTarget(column, cast),\n        likeArgument(value, 'substring'),\n      )\n    })\n    return clauses.length === 1 ? clauses[0] : `(${clauses.join(' OR ')})`\n  }\n\n  private stringMatch(\n    binding: Extract<FieldBinding, { kind: 'string' }>,\n    value: string,\n  ): string {\n    return this.like(\n      this.textTarget(binding.column, binding.cast),\n      likeArgument(value, binding.match),\n    )\n  }\n\n  private textTarget(column: string, cast: boolean | undefined): string {\n    if (!cast) {\n      return column\n    }\n    return this.dialect === 'bigquery'\n      ? `CAST(${column} AS STRING)`\n      : `CAST(${column} AS TEXT)`\n  }\n\n  /** Case-insensitive LIKE. BigQuery has no ILIKE. */\n  private like(target: string, argument: string): string {\n    return this.dialect === 'bigquery'\n      ? `LOWER(${target}) LIKE LOWER(${this.bind(argument)})`\n      : `${target} ILIKE ${this.bind(argument)}`\n  }\n\n  private computedMatch(\n    binding: Extract<FieldBinding, { kind: 'computed' }>,\n    value: string,\n  ): string {\n    const ids = binding.resolve(value)\n    if (ids.length === 0) {\n      // No entity matches this value \u2014 a guaranteed-false predicate (a\n      // surrounding NOT correctly flips it to all-rows).\n      return '1 = 0'\n    }\n    // One parameter, not one for each id. `status:healthy` resolves to the\n    // whole healthy fleet, thus the set follows the size of the fleet.\n    if (this.dialect === 'bigquery') {\n      return `${binding.idColumn} IN UNNEST(${this.bind([...ids])})`\n    }\n    return idSetPredicate(binding.idColumn, this.bindName(joinIdSet(ids)))\n  }\n\n  private dateTerm(\n    binding: Extract<FieldBinding, { kind: 'date' }>,\n    canonical: string,\n    operator: SearchTermOperator,\n    value: string,\n  ): string {\n    if (operator === ':') {\n      // Equality on a date means \"that calendar day\" (UTC): [day, nextDay).\n      const start = this.parseDate(canonical, value)\n      const startDay = new Date(\n        Date.UTC(\n          start.getUTCFullYear(),\n          start.getUTCMonth(),\n          start.getUTCDate(),\n        ),\n      )\n      const nextDay = new Date(startDay.getTime() + 24 * 60 * 60 * 1000)\n      return `(${binding.column} >= ${this.bindDate(binding, startDay, startDay.toISOString())} AND ${binding.column} < ${this.bindDate(binding, nextDay, nextDay.toISOString())})`\n    }\n    const bound = this.parseDate(canonical, value)\n    return `${binding.column} ${operator} ${this.bindDate(binding, bound, bound.toISOString())}`\n  }\n\n  /** `postgresValue` is the parameter that the `postgres` dialect binds. */\n  private bindDate(\n    binding: Extract<FieldBinding, { kind: 'date' }>,\n    value: Date,\n    postgresValue: Date | string,\n  ): string {\n    if (this.dialect !== 'bigquery') {\n      return this.bind(postgresValue)\n    }\n    const iso = value.toISOString()\n    // A string parameter, cast in the statement: the client would send a JS\n    // Date as a TIMESTAMP, which a DATE column cannot compare with.\n    return binding.columnType === 'date'\n      ? `CAST(${this.bind(iso.slice(0, 10))} AS DATE)`\n      : `CAST(${this.bind(iso)} AS TIMESTAMP)`\n  }\n\n  // --- validation helpers ---------------------------------------------------\n\n  private resolveField(field: string): {\n    canonical: string\n    binding: FieldBinding\n  } {\n    const entry = this.lookup.get(field.toLowerCase())\n    if (!entry) {\n      const suggestion = closestField(\n        field,\n        [...this.lookup.values()].map((value) => value.canonical),\n      )\n      throw new LuceneQueryError(\n        `Unknown field \"${field}\".${suggestion ? ` Did you mean \"${suggestion}\"?` : ''}`,\n        'unknown-field',\n        suggestion,\n      )\n    }\n    return entry\n  }\n\n  private requireMatchOperator(\n    field: string,\n    operator: SearchTermOperator,\n  ): void {\n    if (operator !== ':') {\n      throw new LuceneQueryError(\n        `Field \"${field}\" supports only \"field:value\", not \"${operator}\".`,\n        'bad-operator',\n      )\n    }\n  }\n\n  private parseBoolean(field: string, value: string): boolean {\n    const normalized = value.trim().toLowerCase()\n    if (normalized === 'true') {\n      return true\n    }\n    if (normalized === 'false') {\n      return false\n    }\n    throw new LuceneQueryError(\n      `Field \"${field}\" expects true or false, got \"${value}\".`,\n      'bad-value',\n    )\n  }\n\n  private parseDate(field: string, value: string): Date {\n    const parsed = new Date(value)\n    if (Number.isNaN(parsed.getTime())) {\n      throw new LuceneQueryError(\n        `Field \"${field}\" expects a date (e.g. 2024-01-31), got \"${value}\".`,\n        'bad-value',\n      )\n    }\n    return parsed\n  }\n\n  /** Register a value and give back its parameter name, with no marker. */\n  private bindName(value: unknown): string {\n    const name = `${this.ctx.paramPrefix}_${this.counter++}`\n    this.params[name] = value\n    return name\n  }\n\n  private bind(value: unknown): string {\n    const marker = this.dialect === 'bigquery' ? '@' : ':'\n    return `${marker}${this.bindName(value)}`\n  }\n}\n\n/** BigQuery takes letters, digits and underscores, and no digit first. */\nconst BIGQUERY_PARAMETER_PREFIX = /^[A-Za-z_]\\w*$/\n\n/** Compile a parsed query into a single parameterized SQL fragment. */\nexport const compileQuery = (\n  node: QueryNode,\n  ctx: CompileContext,\n): CompiledQuery => new Compiler(ctx).compile(node)\n\nconst ID_SET_SEPARATOR = ','\n\n/**\n * Match `column` against an id set that arrives as ONE parameter.\n *\n * `IN (:...ids)` expands to one bind parameter, and one literal in the\n * statement, for each id. A dimension that does not live in SQL resolves to an\n * id set, and such a set follows the size of the fleet: the prod cluster fleet\n * is more than 1000. Both the statement text and the parameter count would\n * grow with it, and Postgres would plan the statement again at every size.\n *\n * Postgres splits the string here, thus the statement text is constant.\n * `= ANY(...)` can still use an index on the column.\n */\nexport const idSetPredicate = (column: string, parameter: string): string =>\n  `${column} = ANY(string_to_array(:${parameter}, '${ID_SET_SEPARATOR}'))`\n\n/**\n * The id set as one separated string, for {@link idSetPredicate}.\n *\n * The value is a bind parameter, thus it cannot change the statement. But an\n * id that holds the separator would become two ids, thus such an id is\n * dropped. The id columns are text columns, so this stays a guard and not an\n * assumption.\n *\n * An empty string gives an empty array in Postgres. Thus the match finds\n * nothing, which is correct for an empty set.\n */\nexport const joinIdSet = (ids: readonly string[]): string =>\n  ids.filter((id) => !id.includes(ID_SET_SEPARATOR)).join(ID_SET_SEPARATOR)\n\n/**\n * Turn a user value into an ILIKE argument: SQL wildcards (`%`, `_`, `\\`) are\n * escaped to literals, then the user's `*`/`?` become `%`/`_`; a plain\n * substring value is wrapped in `%\u2026%`.\n */\nexport const likeArgument = (\n  value: string,\n  match: 'substring' | 'exact',\n): string => {\n  const escaped = value.replace(/([\\\\%_])/g, '\\\\$1')\n  if (/[*?]/.test(value)) {\n    return escaped.replace(/\\*/g, '%').replace(/\\?/g, '_')\n  }\n  return match === 'substring' ? `%${escaped}%` : escaped\n}\n\n/** Closest field name within edit distance 3, for \"did you mean\u2026\" hints. */\nexport const closestField = (\n  input: string,\n  candidates: readonly string[],\n): string | undefined => {\n  const needle = input.toLowerCase()\n  let best: string | undefined\n  let bestDistance = Number.POSITIVE_INFINITY\n  for (const candidate of candidates) {\n    const distance = editDistance(needle, candidate.toLowerCase())\n    if (distance < bestDistance) {\n      bestDistance = distance\n      best = candidate\n    }\n  }\n  return bestDistance <= 3 ? best : undefined\n}\n\n/** Standard Levenshtein distance. */\nconst editDistance = (left: string, right: string): number => {\n  const rows = left.length + 1\n  const cols = right.length + 1\n  const dist = Array.from({ length: rows }, () =>\n    new Array<number>(cols).fill(0),\n  )\n  for (let row = 0; row < rows; row += 1) {\n    dist[row][0] = row\n  }\n  for (let col = 0; col < cols; col += 1) {\n    dist[0][col] = col\n  }\n  for (let row = 1; row < rows; row += 1) {\n    for (let col = 1; col < cols; col += 1) {\n      const cost = left[row - 1] === right[col - 1] ? 0 : 1\n      dist[row][col] = Math.min(\n        dist[row - 1][col] + 1,\n        dist[row][col - 1] + 1,\n        dist[row - 1][col - 1] + cost,\n      )\n    }\n  }\n  return dist[rows - 1][cols - 1]\n}\n"],
+  "mappings": "AAMA;AAAA,EACE;AAAA,OAKK;AA0EP,MAAM,SAAS;AAAA,EAWb,YAA6B,KAAqB;AAArB;AAC3B,SAAK,UAAU,IAAI,WAAW;AAC9B,QACE,KAAK,YAAY,cACjB,CAAC,0BAA0B,KAAK,IAAI,WAAW,GAC/C;AAEA,YAAM,IAAI;AAAA,QACR,0BAA0B,IAAI,WAAW;AAAA,MAC3C;AAAA,IACF;AACA,SAAK,SAAS,IAAI;AAAA,MAChB,OAAO,QAAQ,IAAI,QAAQ,EAAE,IAAI,CAAC,CAAC,OAAO,OAAO,MAAM;AAAA,QACrD,MAAM,YAAY;AAAA,QAClB,EAAE,WAAW,OAAO,QAAQ;AAAA,MAC9B,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAjB6B;AAAA,EAVZ,SAAkC,CAAC;AAAA,EAC5C,UAAU;AAAA;AAAA,EAED;AAAA,EAKA;AAAA,EAqBjB,QAAQ,MAAgC;AACtC,WAAO,EAAE,KAAK,KAAK,KAAK,IAAI,GAAG,QAAQ,KAAK,OAAO;AAAA,EACrD;AAAA,EAEQ,KAAK,MAAyB;AACpC,YAAQ,KAAK,MAAM;AAAA,MACjB,KAAK;AACH,eAAO,IAAI,KAAK,KAAK,KAAK,IAAI,CAAC,QAAQ,KAAK,KAAK,KAAK,KAAK,CAAC;AAAA,MAC9D,KAAK;AACH,eAAO,IAAI,KAAK,KAAK,KAAK,IAAI,CAAC,OAAO,KAAK,KAAK,KAAK,KAAK,CAAC;AAAA,MAC7D,KAAK;AAGH,eAAO,KAAK,YAAY,aACpB,eAAe,KAAK,KAAK,KAAK,KAAK,CAAC,cACpC,QAAQ,KAAK,KAAK,KAAK,KAAK,CAAC;AAAA,MACnC,KAAK;AACH,eAAO,KAAK,KAAK,IAAI;AAAA,MACvB,KAAK;AACH,eAAO,KAAK,MAAM,IAAI;AAAA,IAC1B;AAAA,EACF;AAAA,EAEQ,KAAK,MAAwB;AACnC,QAAI,KAAK,UAAU,QAAW;AAC5B,aAAO,KAAK,SAAS,KAAK,KAAK;AAAA,IACjC;AACA,UAAM,EAAE,WAAW,QAAQ,IAAI,KAAK,aAAa,KAAK,KAAK;AAC3D,YAAQ,QAAQ,MAAM;AAAA,MACpB,KAAK;AACH,aAAK,qBAAqB,WAAW,KAAK,QAAQ;AAClD,eAAO,KAAK,YAAY,SAAS,KAAK,KAAK;AAAA,MAC7C,KAAK;AACH,aAAK,qBAAqB,WAAW,KAAK,QAAQ;AAClD,eAAO,GAAG,QAAQ,MAAM,MAAM,KAAK,KAAK,KAAK,aAAa,WAAW,KAAK,KAAK,CAAC,CAAC;AAAA,MACnF,KAAK;AACH,aAAK,qBAAqB,WAAW,KAAK,QAAQ;AAClD,eAAO,KAAK,aAAa,WAAW,KAAK,KAAK,IAC1C,GAAG,QAAQ,MAAM,iBACjB,GAAG,QAAQ,MAAM;AAAA,MACvB,KAAK;AACH,aAAK,qBAAqB,WAAW,KAAK,QAAQ;AAClD,eAAO,KAAK,cAAc,SAAS,KAAK,KAAK;AAAA,MAC/C,KAAK;AACH,eAAO,KAAK,SAAS,SAAS,WAAW,KAAK,UAAU,KAAK,KAAK;AAAA,IACtE;AAAA,EACF;AAAA,EAEQ,MAAM,MAAyB;AACrC,UAAM,EAAE,WAAW,QAAQ,IAAI,KAAK,aAAa,KAAK,KAAK;AAC3D,QAAI,QAAQ,SAAS,QAAQ;AAC3B,YAAM,IAAI;AAAA,QACR,UAAU,SAAS;AAAA,QACnB;AAAA,MACF;AAAA,IACF;AACA,UAAM,UAAU,KAAK,iBAAiB,OAAO;AAC7C,UAAM,UAAU,KAAK,iBAAiB,OAAO;AAC7C,UAAM,YAAY,KAAK,UAAU,WAAW,KAAK,KAAK;AACtD,UAAM,YAAY,KAAK,UAAU,WAAW,KAAK,KAAK;AAEtD,UAAM,QAAQ,KAAK,SAAS,SAAS,WAAW,SAAS;AACzD,UAAM,QAAQ,KAAK,SAAS,SAAS,WAAW,SAAS;AACzD,WAAO,IAAI,QAAQ,MAAM,IAAI,OAAO,IAAI,KAAK,QAAQ,QAAQ,MAAM,IAAI,OAAO,IAAI,KAAK;AAAA,EACzF;AAAA;AAAA,EAIQ,SAAS,OAAuB;AACtC,UAAM,UAAU,KAAK,IAAI,cAAc,IAAI,CAAC,UAAU;AACpD,YAAM,QAAQ,KAAK,OAAO,IAAI,MAAM,YAAY,CAAC;AACjD,UAAI,CAAC,SAAS,MAAM,QAAQ,SAAS,UAAU;AAG7C,cAAM,IAAI;AAAA,UACR,wCAAwC,KAAK;AAAA,QAC/C;AAAA,MACF;AACA,YAAM,EAAE,QAAQ,KAAK,IAAI,MAAM;AAC/B,aAAO,KAAK;AAAA,QACV,KAAK,WAAW,QAAQ,IAAI;AAAA,QAC5B,aAAa,OAAO,WAAW;AAAA,MACjC;AAAA,IACF,CAAC;AACD,WAAO,QAAQ,WAAW,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,KAAK,MAAM,CAAC;AAAA,EACrE;AAAA,EAEQ,YACN,SACA,OACQ;AACR,WAAO,KAAK;AAAA,MACV,KAAK,WAAW,QAAQ,QAAQ,QAAQ,IAAI;AAAA,MAC5C,aAAa,OAAO,QAAQ,KAAK;AAAA,IACnC;AAAA,EACF;AAAA,EAEQ,WAAW,QAAgB,MAAmC;AACpE,QAAI,CAAC,MAAM;AACT,aAAO;AAAA,IACT;AACA,WAAO,KAAK,YAAY,aACpB,QAAQ,MAAM,gBACd,QAAQ,MAAM;AAAA,EACpB;AAAA;AAAA,EAGQ,KAAK,QAAgB,UAA0B;AACrD,WAAO,KAAK,YAAY,aACpB,SAAS,MAAM,gBAAgB,KAAK,KAAK,QAAQ,CAAC,MAClD,GAAG,MAAM,UAAU,KAAK,KAAK,QAAQ,CAAC;AAAA,EAC5C;AAAA,EAEQ,cACN,SACA,OACQ;AACR,UAAM,MAAM,QAAQ,QAAQ,KAAK;AACjC,QAAI,IAAI,WAAW,GAAG;AAGpB,aAAO;AAAA,IACT;AAGA,QAAI,KAAK,YAAY,YAAY;AAC/B,aAAO,GAAG,QAAQ,QAAQ,cAAc,KAAK,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;AAAA,IAC7D;AACA,WAAO,eAAe,QAAQ,UAAU,KAAK,SAAS,UAAU,GAAG,CAAC,CAAC;AAAA,EACvE;AAAA,EAEQ,SACN,SACA,WACA,UACA,OACQ;AACR,QAAI,aAAa,KAAK;AAEpB,YAAM,QAAQ,KAAK,UAAU,WAAW,KAAK;AAC7C,YAAM,WAAW,IAAI;AAAA,QACnB,KAAK;AAAA,UACH,MAAM,eAAe;AAAA,UACrB,MAAM,YAAY;AAAA,UAClB,MAAM,WAAW;AAAA,QACnB;AAAA,MACF;AACA,YAAM,UAAU,IAAI,KAAK,SAAS,QAAQ,IAAI,KAAK,KAAK,KAAK,GAAI;AACjE,aAAO,IAAI,QAAQ,MAAM,OAAO,KAAK,SAAS,SAAS,UAAU,SAAS,YAAY,CAAC,CAAC,QAAQ,QAAQ,MAAM,MAAM,KAAK,SAAS,SAAS,SAAS,QAAQ,YAAY,CAAC,CAAC;AAAA,IAC5K;AACA,UAAM,QAAQ,KAAK,UAAU,WAAW,KAAK;AAC7C,WAAO,GAAG,QAAQ,MAAM,IAAI,QAAQ,IAAI,KAAK,SAAS,SAAS,OAAO,MAAM,YAAY,CAAC,CAAC;AAAA,EAC5F;AAAA;AAAA,EAGQ,SACN,SACA,OACA,eACQ;AACR,QAAI,KAAK,YAAY,YAAY;AAC/B,aAAO,KAAK,KAAK,aAAa;AAAA,IAChC;AACA,UAAM,MAAM,MAAM,YAAY;AAG9B,WAAO,QAAQ,eAAe,SAC1B,QAAQ,KAAK,KAAK,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC,cACnC,QAAQ,KAAK,KAAK,GAAG,CAAC;AAAA,EAC5B;AAAA;AAAA,EAIQ,aAAa,OAGnB;AACA,UAAM,QAAQ,KAAK,OAAO,IAAI,MAAM,YAAY,CAAC;AACjD,QAAI,CAAC,OAAO;AACV,YAAM,aAAa;AAAA,QACjB;AAAA,QACA,CAAC,GAAG,KAAK,OAAO,OAAO,CAAC,EAAE,IAAI,CAAC,UAAU,MAAM,SAAS;AAAA,MAC1D;AACA,YAAM,IAAI;AAAA,QACR,kBAAkB,KAAK,KAAK,aAAa,kBAAkB,UAAU,OAAO,EAAE;AAAA,QAC9E;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,qBACN,OACA,UACM;AACN,QAAI,aAAa,KAAK;AACpB,YAAM,IAAI;AAAA,QACR,UAAU,KAAK,uCAAuC,QAAQ;AAAA,QAC9D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,aAAa,OAAe,OAAwB;AAC1D,UAAM,aAAa,MAAM,KAAK,EAAE,YAAY;AAC5C,QAAI,eAAe,QAAQ;AACzB,aAAO;AAAA,IACT;AACA,QAAI,eAAe,SAAS;AAC1B,aAAO;AAAA,IACT;AACA,UAAM,IAAI;AAAA,MACR,UAAU,KAAK,iCAAiC,KAAK;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,UAAU,OAAe,OAAqB;AACpD,UAAM,SAAS,IAAI,KAAK,KAAK;AAC7B,QAAI,OAAO,MAAM,OAAO,QAAQ,CAAC,GAAG;AAClC,YAAM,IAAI;AAAA,QACR,UAAU,KAAK,4CAA4C,KAAK;AAAA,QAChE;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGQ,SAAS,OAAwB;AACvC,UAAM,OAAO,GAAG,KAAK,IAAI,WAAW,IAAI,KAAK,SAAS;AACtD,SAAK,OAAO,IAAI,IAAI;AACpB,WAAO;AAAA,EACT;AAAA,EAEQ,KAAK,OAAwB;AACnC,UAAM,SAAS,KAAK,YAAY,aAAa,MAAM;AACnD,WAAO,GAAG,MAAM,GAAG,KAAK,SAAS,KAAK,CAAC;AAAA,EACzC;AACF;AAGA,MAAM,4BAA4B;AAG3B,MAAM,eAAe,CAC1B,MACA,QACkB,IAAI,SAAS,GAAG,EAAE,QAAQ,IAAI;AAElD,MAAM,mBAAmB;AAclB,MAAM,iBAAiB,CAAC,QAAgB,cAC7C,GAAG,MAAM,2BAA2B,SAAS,MAAM,gBAAgB;AAa9D,MAAM,YAAY,CAAC,QACxB,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,gBAAgB,CAAC,EAAE,KAAK,gBAAgB;AAOnE,MAAM,eAAe,CAC1B,OACA,UACW;AACX,QAAM,UAAU,MAAM,QAAQ,aAAa,MAAM;AACjD,MAAI,OAAO,KAAK,KAAK,GAAG;AACtB,WAAO,QAAQ,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG;AAAA,EACvD;AACA,SAAO,UAAU,cAAc,IAAI,OAAO,MAAM;AAClD;AAGO,MAAM,eAAe,CAC1B,OACA,eACuB;AACvB,QAAM,SAAS,MAAM,YAAY;AACjC,MAAI;AACJ,MAAI,eAAe,OAAO;AAC1B,aAAW,aAAa,YAAY;AAClC,UAAM,WAAW,aAAa,QAAQ,UAAU,YAAY,CAAC;AAC7D,QAAI,WAAW,cAAc;AAC3B,qBAAe;AACf,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO,gBAAgB,IAAI,OAAO;AACpC;AAGA,MAAM,eAAe,CAAC,MAAc,UAA0B;AAC5D,QAAM,OAAO,KAAK,SAAS;AAC3B,QAAM,OAAO,MAAM,SAAS;AAC5B,QAAM,OAAO,MAAM;AAAA,IAAK,EAAE,QAAQ,KAAK;AAAA,IAAG,MACxC,IAAI,MAAc,IAAI,EAAE,KAAK,CAAC;AAAA,EAChC;AACA,WAAS,MAAM,GAAG,MAAM,MAAM,OAAO,GAAG;AACtC,SAAK,GAAG,EAAE,CAAC,IAAI;AAAA,EACjB;AACA,WAAS,MAAM,GAAG,MAAM,MAAM,OAAO,GAAG;AACtC,SAAK,CAAC,EAAE,GAAG,IAAI;AAAA,EACjB;AACA,WAAS,MAAM,GAAG,MAAM,MAAM,OAAO,GAAG;AACtC,aAAS,MAAM,GAAG,MAAM,MAAM,OAAO,GAAG;AACtC,YAAM,OAAO,KAAK,MAAM,CAAC,MAAM,MAAM,MAAM,CAAC,IAAI,IAAI;AACpD,WAAK,GAAG,EAAE,GAAG,IAAI,KAAK;AAAA,QACpB,KAAK,MAAM,CAAC,EAAE,GAAG,IAAI;AAAA,QACrB,KAAK,GAAG,EAAE,MAAM,CAAC,IAAI;AAAA,QACrB,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI;AAAA,MAC3B;AAAA,IACF;AAAA,EACF;AACA,SAAO,KAAK,OAAO,CAAC,EAAE,OAAO,CAAC;AAChC;",
   "names": []
 }

package/dist/search/index.d.ts

@@ -1,6 +1,6 @@
 export { type AndNode, isLuceneQueryError, LuceneQueryError, type NotNode, type OrNode, type QueryNode, type RangeNode, type SearchTermOperator, type TermNode, } from './ast.js';
 export { CLUSTER_DEFAULT_SEARCH_FIELDS, CLUSTER_SEARCH_FIELDS, } from './cluster-search-fields.js';
-export { type CompileContext, type CompiledQuery, compileQuery, type FieldBinding, idSetPredicate, joinIdSet, likeArgument, } from './compiler.js';
+export { type CompileContext, type CompiledQuery, compileQuery, type FieldBinding, idSetPredicate, joinIdSet, likeArgument, type SqlDialect, } from './compiler.js';
 export { findSearchField, type SearchFieldCapability, type SearchFieldSpec, type SearchFieldType, } from './fields.js';
 export { ORG_DEFAULT_SEARCH_FIELDS, ORGANIZATION_SEARCH_FIELDS, } from './organization-search-fields.js';
 export { parseLuceneQuery } from './parser.js';

package/dist/search/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/search/index.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nexport {\n  type AndNode,\n  isLuceneQueryError,\n  LuceneQueryError,\n  type NotNode,\n  type OrNode,\n  type QueryNode,\n  type RangeNode,\n  type SearchTermOperator,\n  type TermNode,\n} from './ast.js'\nexport {\n  CLUSTER_DEFAULT_SEARCH_FIELDS,\n  CLUSTER_SEARCH_FIELDS,\n} from './cluster-search-fields.js'\nexport {\n  type CompileContext,\n  type CompiledQuery,\n  compileQuery,\n  type FieldBinding,\n  idSetPredicate,\n  joinIdSet,\n  likeArgument,\n} from './compiler.js'\nexport {\n  findSearchField,\n  type SearchFieldCapability,\n  type SearchFieldSpec,\n  type SearchFieldType,\n} from './fields.js'\nexport {\n  ORG_DEFAULT_SEARCH_FIELDS,\n  ORGANIZATION_SEARCH_FIELDS,\n} from './organization-search-fields.js'\nexport { parseLuceneQuery } from './parser.js'\n"],
-  "mappings": "AAMA;AAAA,EAEE;AAAA,EACA;AAAA,OAOK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EAGE;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,OAIK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,wBAAwB;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nexport {\n  type AndNode,\n  isLuceneQueryError,\n  LuceneQueryError,\n  type NotNode,\n  type OrNode,\n  type QueryNode,\n  type RangeNode,\n  type SearchTermOperator,\n  type TermNode,\n} from './ast.js'\nexport {\n  CLUSTER_DEFAULT_SEARCH_FIELDS,\n  CLUSTER_SEARCH_FIELDS,\n} from './cluster-search-fields.js'\nexport {\n  type CompileContext,\n  type CompiledQuery,\n  compileQuery,\n  type FieldBinding,\n  idSetPredicate,\n  joinIdSet,\n  likeArgument,\n  type SqlDialect,\n} from './compiler.js'\nexport {\n  findSearchField,\n  type SearchFieldCapability,\n  type SearchFieldSpec,\n  type SearchFieldType,\n} from './fields.js'\nexport {\n  ORG_DEFAULT_SEARCH_FIELDS,\n  ORGANIZATION_SEARCH_FIELDS,\n} from './organization-search-fields.js'\nexport { parseLuceneQuery } from './parser.js'\n"],
+  "mappings": "AAMA;AAAA,EAEE;AAAA,EACA;AAAA,OAOK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EAGE;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,OAIK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,wBAAwB;",
   "names": []
 }