@camunda/ccma-shared-types 7.3.0 → 7.5.0

package/dist/constants/custom-hardware-sizing.const.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/constants/custom-hardware-sizing.const.ts"],
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { canonicalPlan } from '../utils/elasticsearchPlanPath.utils.js'\n\n/**\n * Custom hardware sizing: a cluster plan that a Camundi creates for an\n * organization of their own, with no admin permission. The approval use cases\n * `create-custom-hardware-sizing` and `remove-custom-hardware-sizing` run\n * on dev only, and the limits in this file keep one plan from asking for a\n * machine park.\n *\n * Every cap below is 10 times the largest value in the cluster plans of prod\n * (dump of 2026-10-01, 27 plans). The cap for storage is 10 times the largest\n * value of a plan that is NOT a load test: `Cisco XXL Year 1` and\n * `G3-M (adapted for Cisco load test)` ask for 10 TB on purpose, and a cap\n * from them would be 100 TB.\n */\n\n/** The stage where custom hardware sizing runs. */\nexport const isCustomHardwareSizingStage = (stage: string): boolean =>\n  stage === 'dev'\n\n/**\n * The most plans that one Camundi can own through custom hardware sizing.\n *\n * The count is the number of plans the Camundi created. A plan that the\n * Camundi deleted does not count.\n */\nexport const CUSTOM_HARDWARE_SIZING_MAX_PLANS_PER_REQUESTER = 10\n\n/** The shortest and longest name of a custom hardware sizing plan. */\nexport const CUSTOM_HARDWARE_SIZING_NAME_MIN_LENGTH = 3\nexport const CUSTOM_HARDWARE_SIZING_NAME_MAX_LENGTH = 100\n\n/**\n * The longest plan, as JSON text. The largest plan of prod is about 6000\n * characters. The cap stops a request that carries a huge object.\n */\nexport const CUSTOM_HARDWARE_SIZING_MAX_PLAN_JSON_LENGTH = 50_000\n\n/** One cap for a resource of one kind of component. `gi` is gibibytes. */\ninterface ResourceCaps {\n  cpu: number\n  memoryGi: number\n  storageGi: number\n}\n\n/**\n * Caps for the requests and the limits of one component.\n *\n * `other` is every component that is not the Zeebe broker or Elasticsearch:\n * Operate, Tasklist, Optimize, the gateways, Identity and the others. The\n * largest of them in prod is Operate, with 6 CPU and 30 GiB.\n *\n * Prod maximum, before the factor of 10:\n * - broker: 16 CPU, 50 GiB, 500 GiB of storage (no load test)\n * - Elasticsearch: 30 CPU, 100 GiB, 3000 GiB of storage (no load test)\n * - other: 6 CPU, 30 GiB, no storage\n */\nexport const CUSTOM_HARDWARE_SIZING_RESOURCE_CAPS = {\n  broker: { cpu: 160, memoryGi: 500, storageGi: 5000 },\n  elasticsearch: { cpu: 300, memoryGi: 1000, storageGi: 30_000 },\n  other: { cpu: 60, memoryGi: 300, storageGi: 5000 },\n} as const satisfies Record<string, ResourceCaps>\n\n/** Caps for the count fields of a plan. Prod maximum is in the comments. */\nexport const CUSTOM_HARDWARE_SIZING_COUNT_CAPS = {\n  // 7\n  clusterSize: 70,\n  // 50\n  partitionsCount: 500,\n  // 3\n  replicationFactor: 30,\n  // 5\n  nodesCount: 50,\n  // `replicas` of any component. 3.\n  replicas: 30,\n} as const\n\n/** `zeebe.broker.storage.autoResizing.increase`. Prod maximum is 18 GiB. */\nexport const CUSTOM_HARDWARE_SIZING_MAX_AUTO_RESIZE_INCREASE_GI = 180\n\n/**\n * The caps over the whole broker set, which the caps for one broker do not\n * give. A plan with 70 brokers of 160 CPU passes every cap above, and it asks\n * for 11200 CPU. The prod maximum is 84 CPU (7 brokers, `Cisco XXL Year 1`),\n * 250 GiB of memory (5 brokers, `GLS HA`) and 2500 GiB of storage (5 brokers,\n * `GLS HA`, no load test).\n */\nexport const CUSTOM_HARDWARE_SIZING_BROKER_TOTAL_CAPS = {\n  cpu: 840,\n  memoryGi: 2500,\n  storageGi: 25_000,\n} as const\n\n/**\n * The same, for the whole Elasticsearch node set. Ten times the prod maximum:\n * 90 CPU and 300 GiB of memory (3 nodes, `GLS HA`), and 10000 GiB of storage\n * (5 nodes, `CCL G3L HA`). The storage of one node is a claim of one volume,\n * so the total is the claim times the number of nodes.\n */\nexport const CUSTOM_HARDWARE_SIZING_ELASTICSEARCH_TOTAL_CAPS = {\n  cpu: 900,\n  memoryGi: 3000,\n  storageGi: 100_000,\n} as const\n\n/**\n * The same, for the pods of one component that has `replicas`, such as\n * Operate or the gateway. Ten times the prod maximum: 12 CPU (the gateway, 3\n * replicas of 4 CPU) and 60 GiB of memory (Operate, 2 replicas of 30 GiB). No\n * component of prod has storage in its pod resources, so the storage total is\n * the cap for one pod, 10 times over. The check counts a storage request of a\n * pod in `resources` against it.\n */\nexport const CUSTOM_HARDWARE_SIZING_REPLICA_SET_TOTAL_CAPS = {\n  cpu: 120,\n  memoryGi: 600,\n  storageGi: 50_000,\n} as const\n\nconst GIBIBYTE = 1024 ** 3\n\nconst QUANTITY_MULTIPLIERS: Record<string, number> = {\n  '': 1,\n  m: 1e-3,\n  k: 1e3,\n  M: 1e6,\n  G: 1e9,\n  T: 1e12,\n  P: 1e15,\n  Ki: 1024,\n  Mi: 1024 ** 2,\n  Gi: 1024 ** 3,\n  Ti: 1024 ** 4,\n  Pi: 1024 ** 5,\n}\n\nconst QUANTITY_PATTERN = /^([0-9]+(?:\\.[0-9]+)?)(m|k|M|G|T|P|Ki|Mi|Gi|Ti|Pi)?$/u\n\n/**\n * Reads a Kubernetes quantity such as `500m`, `2`, `4Gi` or `1G`, and returns\n * its value in base units: cores for a CPU, bytes for memory and storage.\n *\n * Returns `undefined` for a text that this function cannot read, so the\n * caller can refuse it. The exponent form (`1e3`) is not read on purpose.\n */\nexport function parseKubernetesQuantity(value: unknown): number | undefined {\n  if (typeof value === 'number') {\n    return Number.isFinite(value) && value >= 0 ? value : undefined\n  }\n  if (typeof value !== 'string') {\n    return undefined\n  }\n  const match = QUANTITY_PATTERN.exec(value)\n  if (!match) {\n    return undefined\n  }\n  return Number(match[1]) * (QUANTITY_MULTIPLIERS[match[2] ?? ''] ?? 1)\n}\n\ntype ComponentKind = keyof typeof CUSTOM_HARDWARE_SIZING_RESOURCE_CAPS\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n  typeof value === 'object' && value !== null && !Array.isArray(value)\n\nfunction componentOf(path: string[]): ComponentKind {\n  if (path[0] === 'zeebe' && path[1] === 'broker') {\n    return 'broker'\n  }\n  if (path[0] === 'elasticsearch') {\n    return 'elasticsearch'\n  }\n  return 'other'\n}\n\nfunction checkNumberCap(\n  violations: string[],\n  path: string[],\n  value: unknown,\n  cap: number,\n): void {\n  const name = path.join('.')\n  const parsed = parseKubernetesQuantity(value)\n  if (parsed === undefined) {\n    violations.push(`${name} is not a number that can be checked`)\n  } else if (parsed > cap) {\n    violations.push(`${name} is ${parsed}, and the most is ${cap}`)\n  }\n}\n\nfunction checkResource(\n  violations: string[],\n  path: string[],\n  value: unknown,\n  kind: 'cpu' | 'memory' | 'storage',\n): void {\n  const name = path.join('.')\n  const caps = CUSTOM_HARDWARE_SIZING_RESOURCE_CAPS[componentOf(path)]\n  const parsed = parseKubernetesQuantity(value)\n  if (parsed === undefined) {\n    violations.push(`${name} is not a quantity that can be checked`)\n    return\n  }\n  if (kind === 'cpu') {\n    if (parsed > caps.cpu) {\n      violations.push(`${name} is ${parsed} CPU, and the most is ${caps.cpu}`)\n    }\n    return\n  }\n  const cap = kind === 'memory' ? caps.memoryGi : caps.storageGi\n  if (parsed / GIBIBYTE > cap) {\n    violations.push(`${name} is over ${cap} GiB`)\n  }\n}\n\nfunction walk(violations: string[], node: unknown, path: string[]): void {\n  if (!isRecord(node)) {\n    return\n  }\n  for (const [key, value] of Object.entries(node)) {\n    // The shape check of console treats `null` like an absent key, so this\n    // check does too. A `null` has nothing to cap.\n    if (value === null || value === undefined) {\n      continue\n    }\n    const next = [...path, key]\n    const parent = path.at(-1)\n    const grandParent = path.at(-2)\n    if (\n      Object.hasOwn(CUSTOM_HARDWARE_SIZING_COUNT_CAPS, key) &&\n      !isRecord(value)\n    ) {\n      checkNumberCap(\n        violations,\n        next,\n        value,\n        CUSTOM_HARDWARE_SIZING_COUNT_CAPS[\n          key as keyof typeof CUSTOM_HARDWARE_SIZING_COUNT_CAPS\n        ],\n      )\n    } else if (\n      (parent === 'limits' || parent === 'requests') &&\n      grandParent === 'resources' &&\n      (key === 'cpu' || key === 'memory' || key === 'storage')\n    ) {\n      checkResource(violations, next, value, key)\n    } else if (\n      (parent === 'limits' || parent === 'requests') &&\n      grandParent === 'resources'\n    ) {\n      // Any other resource name (`ephemeral-storage`, a GPU) has no cap.\n      violations.push(`${next.join('.')} is not a resource that has a cap`)\n    } else if (key === 'persistentStorageCapacity') {\n      // The legacy size of the volume. The operator can still read it.\n      checkResource(violations, next, value, 'storage')\n    } else if (parent === 'autoResizing' && key === 'increase') {\n      // Only the step is capped. The disk itself stops at\n      // `storage.resources.limits.storage`: `Plan.type.ts` calls it \"the upper\n      // limit the pvc autoscaler can scale up to\", and the operator hands it\n      // to the autoscaler as the storage limit of the PVC. The caps for that\n      // field, for one node and for all nodes together, bound the size that a\n      // disk can reach. `threshold` has no effect on that size.\n      const parsed = parseKubernetesQuantity(value)\n      if (\n        parsed === undefined ||\n        parsed / GIBIBYTE > CUSTOM_HARDWARE_SIZING_MAX_AUTO_RESIZE_INCREASE_GI\n      ) {\n        violations.push(\n          `${next.join('.')} is not a quantity of at most ${CUSTOM_HARDWARE_SIZING_MAX_AUTO_RESIZE_INCREASE_GI} GiB`,\n        )\n      }\n    } else {\n      walk(violations, value, next)\n    }\n  }\n}\n\nconst larger = (\n  block: Record<string, unknown> | undefined,\n  key: string,\n): number | undefined => {\n  const values = [block?.limits, block?.requests].map((entry) =>\n    isRecord(entry) ? parseKubernetesQuantity(entry[key]) : undefined,\n  )\n  const known = values.filter((value) => value !== undefined)\n  return known.length > 0 ? Math.max(...known) : undefined\n}\n\n/**\n * Checks the whole node set of one component against its totals. The caps for\n * one node do not bound `count` nodes together.\n *\n * Kubernetes schedules on `requests`, and a plan can set only `requests`. The\n * total reads the larger of the two, so that neither one skips it. The legacy\n * `persistentStorageCapacity` counts as storage too.\n */\nfunction checkSetTotals(\n  violations: string[],\n  who: string,\n  count: unknown,\n  parts: {\n    resources: unknown\n    storageResources: unknown\n    legacyStorage: unknown\n  },\n  caps: { cpu: number; memoryGi: number; storageGi: number },\n): void {\n  const nodes = parseKubernetesQuantity(count)\n  if (nodes === undefined) {\n    return\n  }\n  const resources = isRecord(parts.resources) ? parts.resources : undefined\n  const storageResources = isRecord(parts.storageResources)\n    ? parts.storageResources\n    : undefined\n  const cpu = larger(resources, 'cpu')\n  if (cpu !== undefined && cpu * nodes > caps.cpu) {\n    violations.push(`${who} together ask for more than ${caps.cpu} CPU`)\n  }\n  const memory = larger(resources, 'memory')\n  if (memory !== undefined && (memory * nodes) / GIBIBYTE > caps.memoryGi) {\n    violations.push(\n      `${who} together ask for more than ${caps.memoryGi} GiB of memory`,\n    )\n  }\n  const disks = [\n    larger(storageResources, 'storage'),\n    parseKubernetesQuantity(parts.legacyStorage),\n  ].filter((value) => value !== undefined)\n  if (\n    disks.length > 0 &&\n    (Math.max(...disks) * nodes) / GIBIBYTE > caps.storageGi\n  ) {\n    violations.push(\n      `${who} together ask for more than ${caps.storageGi} GiB of storage`,\n    )\n  }\n}\n\n/**\n * Walks the plan for every component that has `replicas`, and checks its pods\n * together. The pod resources are in `resources`, or in `backend.resources`.\n * The brokers (`clusterSize`) and Elasticsearch (`nodesCount`) have their own\n * count and their own totals.\n */\nfunction checkReplicaSets(\n  violations: string[],\n  node: unknown,\n  path: string[],\n): void {\n  if (!isRecord(node)) {\n    return\n  }\n  if (\n    node.replicas !== undefined &&\n    node.replicas !== null &&\n    !isRecord(node.replicas)\n  ) {\n    const backend = isRecord(node.backend) ? node.backend : undefined\n    const podResources = node.resources ?? backend?.resources\n    checkSetTotals(\n      violations,\n      `the replicas of ${path.join('.') || 'the plan'}`,\n      node.replicas,\n      {\n        resources: podResources,\n        // The same block: a pod can ask for storage in its resources too.\n        storageResources: podResources,\n        legacyStorage: undefined,\n      },\n      CUSTOM_HARDWARE_SIZING_REPLICA_SET_TOTAL_CAPS,\n    )\n  }\n  for (const [key, value] of Object.entries(node)) {\n    checkReplicaSets(violations, value, [...path, key])\n  }\n}\n\nfunction checkNodeSetTotals(\n  violations: string[],\n  plan: Record<string, unknown>,\n): void {\n  const zeebe = isRecord(plan.zeebe) ? plan.zeebe : undefined\n  const broker = isRecord(zeebe?.broker) ? zeebe.broker : undefined\n  if (broker) {\n    const storage = isRecord(broker.storage) ? broker.storage : undefined\n    checkSetTotals(\n      violations,\n      'the brokers',\n      broker.clusterSize,\n      {\n        resources: broker.resources,\n        storageResources: storage?.resources,\n        legacyStorage: broker.persistentStorageCapacity,\n      },\n      CUSTOM_HARDWARE_SIZING_BROKER_TOTAL_CAPS,\n    )\n  }\n  checkReplicaSets(violations, plan, [])\n  const elasticsearch = isRecord(plan.elasticsearch)\n    ? plan.elasticsearch\n    : undefined\n  if (elasticsearch) {\n    const config = isRecord(elasticsearch.config)\n      ? elasticsearch.config\n      : undefined\n    const storage = isRecord(config?.storage) ? config.storage : undefined\n    checkSetTotals(\n      violations,\n      'the Elasticsearch nodes',\n      config?.nodesCount,\n      {\n        resources: elasticsearch.resources,\n        storageResources: storage?.resources,\n        legacyStorage: elasticsearch.persistentStorageCapacity,\n      },\n      CUSTOM_HARDWARE_SIZING_ELASTICSEARCH_TOTAL_CAPS,\n    )\n  }\n}\n\n/**\n * Checks a cluster plan against the caps of custom hardware sizing.\n *\n * Returns the list of violations, and an empty list when the plan is within\n * the caps. It checks the size only. The shape of the plan is the job of the\n * plan validator of console-backend.\n *\n * A value that this function cannot read is a violation too: a cap that the\n * plan can skip with a strange spelling is no cap.\n */\nexport function checkCustomHardwareSizing(plan: unknown): string[] {\n  if (!isRecord(plan)) {\n    return ['the plan is not an object']\n  }\n  if (\n    JSON.stringify(plan).length > CUSTOM_HARDWARE_SIZING_MAX_PLAN_JSON_LENGTH\n  ) {\n    return [\n      `the plan is longer than ${CUSTOM_HARDWARE_SIZING_MAX_PLAN_JSON_LENGTH} characters`,\n    ]\n  }\n  // `operate.elasticsearch` is the old place of the Elasticsearch block. The\n  // caps for Elasticsearch must read it as one place, so the plan is moved\n  // to the canonical form first.\n  const canonical = canonicalPlan(plan)\n  const violations: string[] = []\n  walk(violations, canonical, [])\n  checkNodeSetTotals(violations, canonical)\n  return violations\n}\n"],
+  "mappings": "AAMA,SAAS,qBAAqB;AAiBvB,MAAM,8BAA8B,CAAC,UAC1C,UAAU;AAQL,MAAM,iDAAiD;AAGvD,MAAM,yCAAyC;AAC/C,MAAM,yCAAyC;AAM/C,MAAM,8CAA8C;AAqBpD,MAAM,uCAAuC;AAAA,EAClD,QAAQ,EAAE,KAAK,KAAK,UAAU,KAAK,WAAW,IAAK;AAAA,EACnD,eAAe,EAAE,KAAK,KAAK,UAAU,KAAM,WAAW,IAAO;AAAA,EAC7D,OAAO,EAAE,KAAK,IAAI,UAAU,KAAK,WAAW,IAAK;AACnD;AAGO,MAAM,oCAAoC;AAAA;AAAA,EAE/C,aAAa;AAAA;AAAA,EAEb,iBAAiB;AAAA;AAAA,EAEjB,mBAAmB;AAAA;AAAA,EAEnB,YAAY;AAAA;AAAA,EAEZ,UAAU;AACZ;AAGO,MAAM,qDAAqD;AAS3D,MAAM,2CAA2C;AAAA,EACtD,KAAK;AAAA,EACL,UAAU;AAAA,EACV,WAAW;AACb;AAQO,MAAM,kDAAkD;AAAA,EAC7D,KAAK;AAAA,EACL,UAAU;AAAA,EACV,WAAW;AACb;AAUO,MAAM,gDAAgD;AAAA,EAC3D,KAAK;AAAA,EACL,UAAU;AAAA,EACV,WAAW;AACb;AAEA,MAAM,WAAW,QAAQ;AAEzB,MAAM,uBAA+C;AAAA,EACnD,IAAI;AAAA,EACJ,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,IAAI;AAAA,EACJ,IAAI,QAAQ;AAAA,EACZ,IAAI,QAAQ;AAAA,EACZ,IAAI,QAAQ;AAAA,EACZ,IAAI,QAAQ;AACd;AAEA,MAAM,mBAAmB;AASlB,SAAS,wBAAwB,OAAoC;AAC1E,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,OAAO,SAAS,KAAK,KAAK,SAAS,IAAI,QAAQ;AAAA,EACxD;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,iBAAiB,KAAK,KAAK;AACzC,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,SAAO,OAAO,MAAM,CAAC,CAAC,KAAK,qBAAqB,MAAM,CAAC,KAAK,EAAE,KAAK;AACrE;AAIA,MAAM,WAAW,CAAC,UAChB,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAErE,SAAS,YAAY,MAA+B;AAClD,MAAI,KAAK,CAAC,MAAM,WAAW,KAAK,CAAC,MAAM,UAAU;AAC/C,WAAO;AAAA,EACT;AACA,MAAI,KAAK,CAAC,MAAM,iBAAiB;AAC/B,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,eACP,YACA,MACA,OACA,KACM;AACN,QAAM,OAAO,KAAK,KAAK,GAAG;AAC1B,QAAM,SAAS,wBAAwB,KAAK;AAC5C,MAAI,WAAW,QAAW;AACxB,eAAW,KAAK,GAAG,IAAI,sCAAsC;AAAA,EAC/D,WAAW,SAAS,KAAK;AACvB,eAAW,KAAK,GAAG,IAAI,OAAO,MAAM,qBAAqB,GAAG,EAAE;AAAA,EAChE;AACF;AAEA,SAAS,cACP,YACA,MACA,OACA,MACM;AACN,QAAM,OAAO,KAAK,KAAK,GAAG;AAC1B,QAAM,OAAO,qCAAqC,YAAY,IAAI,CAAC;AACnE,QAAM,SAAS,wBAAwB,KAAK;AAC5C,MAAI,WAAW,QAAW;AACxB,eAAW,KAAK,GAAG,IAAI,wCAAwC;AAC/D;AAAA,EACF;AACA,MAAI,SAAS,OAAO;AAClB,QAAI,SAAS,KAAK,KAAK;AACrB,iBAAW,KAAK,GAAG,IAAI,OAAO,MAAM,yBAAyB,KAAK,GAAG,EAAE;AAAA,IACzE;AACA;AAAA,EACF;AACA,QAAM,MAAM,SAAS,WAAW,KAAK,WAAW,KAAK;AACrD,MAAI,SAAS,WAAW,KAAK;AAC3B,eAAW,KAAK,GAAG,IAAI,YAAY,GAAG,MAAM;AAAA,EAC9C;AACF;AAEA,SAAS,KAAK,YAAsB,MAAe,MAAsB;AACvE,MAAI,CAAC,SAAS,IAAI,GAAG;AACnB;AAAA,EACF;AACA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,GAAG;AAG/C,QAAI,UAAU,QAAQ,UAAU,QAAW;AACzC;AAAA,IACF;AACA,UAAM,OAAO,CAAC,GAAG,MAAM,GAAG;AAC1B,UAAM,SAAS,KAAK,GAAG,EAAE;AACzB,UAAM,cAAc,KAAK,GAAG,EAAE;AAC9B,QACE,OAAO,OAAO,mCAAmC,GAAG,KACpD,CAAC,SAAS,KAAK,GACf;AACA;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA,kCACE,GACF;AAAA,MACF;AAAA,IACF,YACG,WAAW,YAAY,WAAW,eACnC,gBAAgB,gBACf,QAAQ,SAAS,QAAQ,YAAY,QAAQ,YAC9C;AACA,oBAAc,YAAY,MAAM,OAAO,GAAG;AAAA,IAC5C,YACG,WAAW,YAAY,WAAW,eACnC,gBAAgB,aAChB;AAEA,iBAAW,KAAK,GAAG,KAAK,KAAK,GAAG,CAAC,mCAAmC;AAAA,IACtE,WAAW,QAAQ,6BAA6B;AAE9C,oBAAc,YAAY,MAAM,OAAO,SAAS;AAAA,IAClD,WAAW,WAAW,kBAAkB,QAAQ,YAAY;AAO1D,YAAM,SAAS,wBAAwB,KAAK;AAC5C,UACE,WAAW,UACX,SAAS,WAAW,oDACpB;AACA,mBAAW;AAAA,UACT,GAAG,KAAK,KAAK,GAAG,CAAC,iCAAiC,kDAAkD;AAAA,QACtG;AAAA,MACF;AAAA,IACF,OAAO;AACL,WAAK,YAAY,OAAO,IAAI;AAAA,IAC9B;AAAA,EACF;AACF;AAEA,MAAM,SAAS,CACb,OACA,QACuB;AACvB,QAAM,SAAS,CAAC,OAAO,QAAQ,OAAO,QAAQ,EAAE;AAAA,IAAI,CAAC,UACnD,SAAS,KAAK,IAAI,wBAAwB,MAAM,GAAG,CAAC,IAAI;AAAA,EAC1D;AACA,QAAM,QAAQ,OAAO,OAAO,CAAC,UAAU,UAAU,MAAS;AAC1D,SAAO,MAAM,SAAS,IAAI,KAAK,IAAI,GAAG,KAAK,IAAI;AACjD;AAUA,SAAS,eACP,YACA,KACA,OACA,OAKA,MACM;AACN,QAAM,QAAQ,wBAAwB,KAAK;AAC3C,MAAI,UAAU,QAAW;AACvB;AAAA,EACF;AACA,QAAM,YAAY,SAAS,MAAM,SAAS,IAAI,MAAM,YAAY;AAChE,QAAM,mBAAmB,SAAS,MAAM,gBAAgB,IACpD,MAAM,mBACN;AACJ,QAAM,MAAM,OAAO,WAAW,KAAK;AACnC,MAAI,QAAQ,UAAa,MAAM,QAAQ,KAAK,KAAK;AAC/C,eAAW,KAAK,GAAG,GAAG,+BAA+B,KAAK,GAAG,MAAM;AAAA,EACrE;AACA,QAAM,SAAS,OAAO,WAAW,QAAQ;AACzC,MAAI,WAAW,UAAc,SAAS,QAAS,WAAW,KAAK,UAAU;AACvE,eAAW;AAAA,MACT,GAAG,GAAG,+BAA+B,KAAK,QAAQ;AAAA,IACpD;AAAA,EACF;AACA,QAAM,QAAQ;AAAA,IACZ,OAAO,kBAAkB,SAAS;AAAA,IAClC,wBAAwB,MAAM,aAAa;AAAA,EAC7C,EAAE,OAAO,CAAC,UAAU,UAAU,MAAS;AACvC,MACE,MAAM,SAAS,KACd,KAAK,IAAI,GAAG,KAAK,IAAI,QAAS,WAAW,KAAK,WAC/C;AACA,eAAW;AAAA,MACT,GAAG,GAAG,+BAA+B,KAAK,SAAS;AAAA,IACrD;AAAA,EACF;AACF;AAQA,SAAS,iBACP,YACA,MACA,MACM;AACN,MAAI,CAAC,SAAS,IAAI,GAAG;AACnB;AAAA,EACF;AACA,MACE,KAAK,aAAa,UAClB,KAAK,aAAa,QAClB,CAAC,SAAS,KAAK,QAAQ,GACvB;AACA,UAAM,UAAU,SAAS,KAAK,OAAO,IAAI,KAAK,UAAU;AACxD,UAAM,eAAe,KAAK,aAAa,SAAS;AAChD;AAAA,MACE;AAAA,MACA,mBAAmB,KAAK,KAAK,GAAG,KAAK,UAAU;AAAA,MAC/C,KAAK;AAAA,MACL;AAAA,QACE,WAAW;AAAA;AAAA,QAEX,kBAAkB;AAAA,QAClB,eAAe;AAAA,MACjB;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,GAAG;AAC/C,qBAAiB,YAAY,OAAO,CAAC,GAAG,MAAM,GAAG,CAAC;AAAA,EACpD;AACF;AAEA,SAAS,mBACP,YACA,MACM;AACN,QAAM,QAAQ,SAAS,KAAK,KAAK,IAAI,KAAK,QAAQ;AAClD,QAAM,SAAS,SAAS,OAAO,MAAM,IAAI,MAAM,SAAS;AACxD,MAAI,QAAQ;AACV,UAAM,UAAU,SAAS,OAAO,OAAO,IAAI,OAAO,UAAU;AAC5D;AAAA,MACE;AAAA,MACA;AAAA,MACA,OAAO;AAAA,MACP;AAAA,QACE,WAAW,OAAO;AAAA,QAClB,kBAAkB,SAAS;AAAA,QAC3B,eAAe,OAAO;AAAA,MACxB;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,mBAAiB,YAAY,MAAM,CAAC,CAAC;AACrC,QAAM,gBAAgB,SAAS,KAAK,aAAa,IAC7C,KAAK,gBACL;AACJ,MAAI,eAAe;AACjB,UAAM,SAAS,SAAS,cAAc,MAAM,IACxC,cAAc,SACd;AACJ,UAAM,UAAU,SAAS,QAAQ,OAAO,IAAI,OAAO,UAAU;AAC7D;AAAA,MACE;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,QACE,WAAW,cAAc;AAAA,QACzB,kBAAkB,SAAS;AAAA,QAC3B,eAAe,cAAc;AAAA,MAC/B;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAYO,SAAS,0BAA0B,MAAyB;AACjE,MAAI,CAAC,SAAS,IAAI,GAAG;AACnB,WAAO,CAAC,2BAA2B;AAAA,EACrC;AACA,MACE,KAAK,UAAU,IAAI,EAAE,SAAS,6CAC9B;AACA,WAAO;AAAA,MACL,2BAA2B,2CAA2C;AAAA,IACxE;AAAA,EACF;AAIA,QAAM,YAAY,cAAc,IAAI;AACpC,QAAM,aAAuB,CAAC;AAC9B,OAAK,YAAY,WAAW,CAAC,CAAC;AAC9B,qBAAmB,YAAY,SAAS;AACxC,SAAO;AACT;",
+  "names": []
+}

package/dist/dtos/ApprovalJob.dto.d.ts

@@ -516,8 +516,8 @@ export interface ApprovalUseCaseDto {
      *   source, so that nobody can change what is not theirs. The action can
      *   touch an organization only when that check lets the person change it.
      *
-     * `create-personal-organisation` and the two use cases of customer hardware
-     * sizing set it. The two use cases of customer hardware sizing do the second
+     * `create-personal-organisation` and the two use cases of custom hardware
+     * sizing set it. The two use cases of custom hardware sizing do the second
      * check in two ways:
      *
      * - Creating a plan, and unlinking a plan from one organization, read the
@@ -527,4 +527,17 @@ export interface ApprovalUseCaseDto {
      *   of, in any role, and removes the plan from their lists.
      */
     openToEveryone?: boolean;
+    /**
+     * A use case with no approval that only a service of the fleet opens.
+     *
+     * The service holds `createPermission`, an m2m permission, and not
+     * `requiredPermission`. This flag lets that holder open and thus run a
+     * request with a floor of zero. `requiredPermission` then decides only who
+     * sees the requests and who can run a failed one again. Without a
+     * `createPermission` the flag lifts nothing.
+     *
+     * `cluster-ttl-deletion` sets it. The request exists for the record: the
+     * list, the entity pages and the audit trail show each deletion.
+     */
+    openedBySystem?: boolean;
 }

package/dist/dtos/ApprovalJob.dto.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/dtos/ApprovalJob.dto.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/**\n * The wire types of the generic approval mechanism.\n *\n * This file holds no logic and no dependency, because three consumers read it:\n * control-backend, control-frontend and cloudbot. The rules that read these\n * types are in `../approvals/policy.js`, and they are pure for the same reason.\n */\n\n/**\n * Every state that an approval request can hold.\n *\n * A `const` tuple, not an enum, so it is both the union type and the list that\n * validates a status filter at run time.\n *\n * The path of a request: `pending` until it reaches the threshold. Then\n * `executing` (automatic mode) or `approved` (explicit mode, which waits for a\n * person to press the button). `executed` or `failed` after the action ran. A\n * request that never reaches the threshold ends `rejected`, `withdrawn` or\n * `expired`.\n */\nexport const APPROVAL_JOB_STATUSES = [\n  'pending',\n  'approved',\n  'executing',\n  'executed',\n  'failed',\n  'rejected',\n  'withdrawn',\n  'expired',\n] as const\n\nexport type ApprovalJobStatus = (typeof APPROVAL_JOB_STATUSES)[number]\n\n/**\n * The states in which the action of a request is still COMING.\n *\n * `pending` waits for approvals, `approved` waits for a person to press the\n * button, and `executing` is running now. Each of them can still change the\n * world, so two requests for one target must not be in these states together.\n * `dedupeKey` reads this set for that reason.\n *\n * `failed` is NOT here, although a person can run a failed request again. A\n * failed request runs only when a person presses the button, and that person\n * sees the row. Blocking a new request on a failed one would also trap the\n * key: `canWithdraw` accepts `pending` alone, so nobody could close it.\n *\n * `executed`, `rejected`, `withdrawn` and `expired` are the end of a request.\n */\nexport const APPROVAL_LIVE_STATUSES = [\n  'pending',\n  'approved',\n  'executing',\n] as const satisfies readonly ApprovalJobStatus[]\n\n/**\n * How many requests one page of the list holds when the caller asks for no\n * number.\n *\n * The list is a work queue that a Camundi reads, so the page is large: a\n * person wants the whole queue and not ten rows at a time. What the number is\n * for is the ceiling below.\n */\nexport const APPROVAL_PAGE_SIZE_DEFAULT = 500\n\n/**\n * The largest page that the service builds, and the largest that a caller may\n * ask for. The API answers 400 above it.\n *\n * The list had no limit at all. One authenticated caller could then make the\n * service read the whole table into memory, serialize it, and do it again, so\n * the cost of a request grew with the age of the service and with nothing that\n * the caller had to pay for. A ceiling turns that into a fixed cost.\n *\n * It is HERE and not only in the service, because the view must know it: a\n * page that asked for more would get a 400 instead of rows.\n */\nexport const APPROVAL_PAGE_SIZE_MAX = 2000\n\n/**\n * The columns that the queue can be ordered by.\n *\n * A NAME and not an SQL expression: the repository maps each one, so a caller\n * can never name a column that this list does not hold. `status` orders by the\n * EFFECTIVE status, because a `pending` row whose time ran out reads as\n * `expired` everywhere else.\n */\nexport const APPROVAL_SORT_FIELDS = [\n  'createdAt',\n  'expiresAt',\n  'status',\n  'type',\n  'createdBy',\n] as const\n\nexport type ApprovalSortField = (typeof APPROVAL_SORT_FIELDS)[number]\n\nexport type ApprovalSortOrder = 'asc' | 'desc'\n\n/** The default order of the queue: the newest request first. */\nexport const APPROVAL_SORT_DEFAULT: {\n  sort: ApprovalSortField\n  order: ApprovalSortOrder\n} = { sort: 'createdAt', order: 'desc' }\n\n/**\n * The longest reason that a request, a rejection or a withdrawal accepts.\n *\n * ONE number, because three routes of control-backend hold it and three fields\n * of control-frontend must stop there. A field that let a person write more\n * than the schema accepts turns their sentence into a 400 after they wrote it.\n */\nexport const APPROVAL_REASON_MAX_LENGTH = 2000\n\n/**\n * The largest number of approvals that a caller can ask for.\n *\n * A request that asks for 400 approvals can never reach them, so it is a\n * request that only fills the table and expires. The ceiling turns that into a\n * 400 at the moment a person types it. It is HERE because the form of the\n * bulk operation must stop at the same number as the route.\n */\nexport const APPROVAL_ACKS_MAX = 10\n\n/**\n * The longest search text that the list accepts.\n *\n * A search runs `ILIKE` over the payload of every visible row, so the cost of\n * one call follows the length of the text. Nothing a person types to find a\n * request is near this.\n */\nexport const APPROVAL_SEARCH_MAX_LENGTH = 200\n\n/**\n * The payload field that names the organization a request acts on.\n *\n * It is a CONVENTION, and this constant is what makes the convention readable\n * from both sides. A use case whose action hits one organization puts the id of\n * that organization in this field, and `GET /api/approvals?orgId=\u2026` then finds\n * the request with no knowledge of the use case. The filter reads this one\n * field of the payload, so it matches the whole id and nothing else. The free\n * text search reads the payload as TEXT, which also matches an id that only\n * appears inside another field, and it cannot answer \"the requests of this\n * organization\".\n *\n * The organization page of control-frontend does NOT read this field. It asks\n * the entity-link filter (`entityType=org`), which reads a row that\n * `relatedEntities` of a use case writes \u2014 see `ApprovalEntityRef`. The summary\n * is separate again: the `org` field of a `summarize` result is what a READER\n * follows.\n */\nexport const APPROVAL_PAYLOAD_ORG_FIELD = 'orgId'\n\n/**\n * How many requests each status holds, for the filters of the queue.\n *\n * Every number answers the SAME question as the list beside it: the counts are\n * built with the visibility rule, the action filter and the search text of the\n * caller, and with the lazy expiry. A count that ignored one of those would\n * send a person to a filter that then shows nothing.\n */\nexport interface ApprovalStatusCountsDto {\n  /** Every request that matches, whatever its status. */\n  all: number\n  /** One number for each status. A status with no request is 0, never absent. */\n  byStatus: Record<ApprovalJobStatus, number>\n}\n\n/**\n * What happens when a request reaches its threshold.\n *\n * `auto` runs the action immediately. `explicit` holds the request at\n * `approved` and waits for a person to run it.\n */\nexport type ApprovalExecutionMode = 'auto' | 'explicit'\n\n/**\n * WHERE the action runs. It is a separate question from who starts it.\n *\n * - `inline` runs the action inside the call that started it, and the answer\n *   already carries the outcome. Right for one call to another service.\n * - `background` answers as soon as the request is claimed, and the action\n *   runs on. It reports into `ApprovalJobDto.progress`, and the row is the\n *   only place that holds the progress, so a reload and a second person read\n *   the same numbers. A pod that stops loses the run, and the reconciler of\n *   control-backend recovers the row.\n *\n * An action over thousands of targets MUST be `background`. `inline` would\n * hold one HTTP request for the whole run, and the ingress, the load balancer\n * and the browser each have their own deadline before it finishes.\n *\n * An `inline` action must not read `context.signal`. The runner trusts the\n * result of an `inline` action that returns after a drain, and it would count\n * a partial run as `executed`. An action that stops between targets is\n * `background`.\n */\nexport type ApprovalActionMode = 'inline' | 'background'\n\n/**\n * A person, as an approval request records them.\n *\n * Both keys are kept. The machine then never has to choose one identity key,\n * which is what split the earlier acknowledgement flows: some held an email and\n * some held a user id, and the two could not be compared.\n */\nexport interface ApprovalActor {\n  userId: string\n  email: string\n}\n\nexport interface ApprovalAck extends ApprovalActor {\n  /** An ISO timestamp. It is in a json column, so it is a string, not a Date. */\n  date: string\n}\n\n/**\n * Who asked for an action, and who agreed to it.\n *\n * Every route of `api/admin/approvals` takes this envelope, and control-backend\n * builds it from the request that it runs. The envelope exists because the\n * token cannot carry it: the call is machine to machine, so `sub` holds the id\n * of the Auth0 application and not a person. A service that reads the token\n * alone therefore writes \"control-backend\" into its audit record, which hides\n * the two Camundis that the whole mechanism exists to record.\n *\n * `approvedBy` is a list, because a use case can need more than one approval,\n * and the record must name all of them. It can also be EMPTY: how many\n * approvals an action needs is a number of the use case, and `move-cluster-org`\n * holds zero on purpose. The person in `requestedBy` is never in the list: the\n * four-eyes rule is that the person who asks is not the person who agrees, and\n * control-backend holds that rule.\n *\n * Each person carries both keys of `ApprovalActor`. The email is what a route\n * uses to ask Auth0 about the person, and the user id is what an audit record\n * holds, because every other record of the fleet holds an Auth0 `sub`.\n *\n * CAUTION: The envelope is a CLAIM of the caller, and not proof. A route that\n * acts on it must ask Auth0 again whether `requestedBy` may do the action.\n * That means the permission of the action. For a use case with\n * `openToEveryone`, it means that the person is a Camundi, because no\n * permission runs that action. `api/admin/approvals` in accounts-backend does\n * that. See the note on `M2M_CONTROL_APPROVALS`.\n */\nexport interface ApprovalM2mActor {\n  /** The id of the approval request, to join the records of both services. */\n  requestId: string\n  /** The Camundi who opened the request. */\n  requestedBy: ApprovalActor\n  /** The Camundis who approved it. Empty when the use case needs none. */\n  approvedBy: ApprovalActor[]\n}\n\n/**\n * What one value of a summary field is.\n *\n * `text` is what a person reads. `id` is what a link points at, and it is\n * absent when the kind names no entity. The two are separate because the text\n * is a COPY that the request keeps: an organization that gets a new name after\n * the request was opened must still read as the organization that the person\n * chose.\n */\nexport interface ApprovalSummaryValue {\n  text: string\n  id?: string\n}\n\n/**\n * How a reader must render one field of a summary.\n *\n * `org`, `cluster` and `user` name an entity, so a reader can link to it and\n * can resolve a fresh name. The others are plain: `date` is an ISO timestamp,\n * and `code` is a value that must keep its characters, such as a json fragment.\n */\nexport const APPROVAL_SUMMARY_FIELD_KINDS = [\n  'text',\n  'number',\n  'boolean',\n  'date',\n  'org',\n  'cluster',\n  'user',\n  'code',\n] as const\n\nexport type ApprovalSummaryFieldKind =\n  (typeof APPROVAL_SUMMARY_FIELD_KINDS)[number]\n\n/**\n * One labelled field of the payload of a request.\n *\n * This is what makes ONE view able to show EVERY use case. The payload of a\n * request is an object of anything, so a generic view can only print it as\n * json. The use case turns it into labelled fields here, and the view renders\n * a field by its kind: it links an `org`, it formats a `date`, and it lists\n * 300 clusters as 300 links.\n *\n * `values` is always an array. A field that holds one value holds an array of\n * one, so a reader needs no branch for \"one or many\".\n */\nexport interface ApprovalSummaryField {\n  label: string\n  kind: ApprovalSummaryFieldKind\n  values: ApprovalSummaryValue[]\n  /**\n   * The values that this request replaces, for a field that changes. A view\n   * shows them as removed beside `values` as added. A field with no\n   * `previous` is not a change.\n   */\n  previous?: ApprovalSummaryValue[]\n  /** The count of `previous`, when the list cut it. Like `total`, for `previous`. */\n  previousTotal?: number\n  /**\n   * How many values the field holds, when `values` holds only the first of\n   * them. The list route cuts every field to `APPROVAL_LIST_SUMMARY_VALUES_MAX`\n   * values. The detail route sends every value and no `total`.\n   */\n  total?: number\n}\n\n/**\n * How many values of one summary field a row of the list carries.\n *\n * A bulk operation names up to 3000 clusters in one field. A page of 100 such\n * rows would carry 300,000 values that no row shows. The view shows at most\n * 12 values of a field, so the list stops there, and `total` holds the count.\n */\nexport const APPROVAL_LIST_SUMMARY_VALUES_MAX = 12\n\n/**\n * The kinds of entity that an approval request can concern.\n *\n * These are the entities that a request is findable by: the org and cluster\n * detail pages ask \"which requests touch me\", and the answer reads a row for\n * each entity. It is a subset of `APPROVAL_SUMMARY_FIELD_KINDS` \u2014 the kinds that\n * name an entity \u2014 because only those carry an id that a page can match.\n */\nexport const APPROVAL_ENTITY_TYPES = ['cluster', 'org', 'user'] as const\n\nexport type ApprovalEntityType = (typeof APPROVAL_ENTITY_TYPES)[number]\n\n/**\n * One entity that an approval request concerns.\n *\n * A use case reports these from its payload, and the service writes one row for\n * each into `approval_job_entity`. That row is what makes a request findable by\n * an entity it touches, without a text search over the payload: a cluster-move\n * request names its cluster, its target organization AND its source\n * organization, so it shows on all three detail pages. The `summary` still\n * carries the words a reader sees; this carries only the ids a page matches.\n */\nexport interface ApprovalEntityRef {\n  type: ApprovalEntityType\n  id: string\n}\n\n/**\n * How long a run may go quiet before a reader calls it stalled.\n *\n * The pod that runs an action writes its progress and renews its lease on one\n * timer, so a healthy run touches the row well inside this window. A row that\n * is `executing` and older than this held a pod that stopped, and the\n * reconciler of control-backend is on its way to it.\n *\n * It lives here, and not in the config of the service, because a READER needs\n * it: the browser must decide what to show without a second call, and a number\n * that only the backend knew would make the two disagree. `ACTION_LEASE_MS` in\n * `config/index.ts` is held below this on purpose.\n */\nexport const APPROVAL_RUN_STALE_MS = 120_000\n\n/**\n * What an action reports while it runs.\n *\n * This is what makes a long action watchable. Every field is in the DATABASE\n * and not in the answer to the call that started the run, so three readers see\n * the same thing: the person who pressed the button, the same person after a\n * reload, and a second person who opens the request.\n *\n * `total` can be 0 while an action counts its targets, and it stays 0 for an\n * action that cannot count them. A reader must then show that it runs, and no\n * percentage.\n */\nexport interface ApprovalProgress {\n  /** Targets in total. 0 means the action did not say. */\n  total: number\n  /** Targets finished, whatever the outcome of each one. */\n  done: number\n  /** Targets that finished with an error. Part of `done`. */\n  failed: number\n  /** One short line for a person, such as the step that runs now. */\n  note?: string\n  /** An ISO timestamp: when the run started. */\n  startedAt: string\n  /** An ISO timestamp: when the run last wrote anything. */\n  updatedAt: string\n}\n\n/** The share of the work that is finished, or `undefined` with no total. */\nexport function progressFraction(\n  progress: ApprovalProgress | undefined,\n): number | undefined {\n  if (!progress || progress.total <= 0) {\n    return undefined\n  }\n  return Math.min(1, progress.done / progress.total)\n}\n\n/**\n * Reports whether a running request went quiet.\n *\n * True means that the pod which held the run stopped, or lost the row. It does\n * NOT mean that the action failed: the reconciler either runs it again, or it\n * writes `failed` so that a person can. See `APPROVAL_RUN_STALE_MS`.\n */\nexport function isRunStalled(job: ApprovalJobDto, now: Date): boolean {\n  if (job.status !== 'executing') {\n    return false\n  }\n  const lastSign = job.progress?.updatedAt ?? job.executingSince\n  if (!lastSign) {\n    return false\n  }\n  return now.getTime() - new Date(lastSign).getTime() > APPROVAL_RUN_STALE_MS\n}\n\n/** One approval request, as the API returns it. */\nexport interface ApprovalJobDto {\n  id: string\n  type: string\n  dedupeKey?: string\n  payload: Record<string, unknown>\n  /**\n   * The payload as labelled fields. See `ApprovalSummaryField`.\n   *\n   * The use case builds it when the request is opened AND every time the\n   * request is read, so a field that a later version of the use case adds\n   * appears on a request that is already open.\n   */\n  summary: ApprovalSummaryField[]\n  /** Why the person opened the request. Some use cases demand one. */\n  reason?: string\n  createdBy: ApprovalActor\n  acks: ApprovalAck[]\n  /**\n   * How many approvals THIS request needs.\n   *\n   * It is on the request and not only on the use case, because the person who\n   * opens one can ask for more than the floor of the use case. A bulk\n   * operation over 3000 clusters is the same action as one over 3, and it can\n   * still deserve a third pair of eyes. `ApprovalUseCaseDto.minAcks` is the\n   * floor that a caller cannot go below.\n   */\n  requiredAcks: number\n  /**\n   * What a person must hold to approve, reject or run THIS request.\n   *\n   * It is on the request and not only on the use case, because a payload can\n   * raise the guard: a generation update with `yoloForceUpdate` needs the yolo\n   * permission on top of the base one, and the same use case without the flag\n   * does not. The set is computed ONE time, when the request is opened, so it\n   * is also the record of what the request was guarded by.\n   *\n   * A person needs EVERY permission in the set, not one of them.\n   */\n  requiredPermissions: string[]\n  executionMode: ApprovalExecutionMode\n  actionMode: ApprovalActionMode\n  status: ApprovalJobStatus\n  closedBy?: ApprovalActor\n  closedReason?: string\n  /** An ISO timestamp. */\n  expiresAt: string\n  /**\n   * An ISO timestamp: when the current run took the request.\n   *\n   * It is set every time a run starts, so a run that the reconciler starts\n   * again moves it. `attempts` says how many runs there were.\n   */\n  executingSince?: string\n  /** How many times a run started. A recovery raises it. */\n  attempts: number\n  /**\n   * What the action reports while it runs. See `ApprovalProgress`.\n   *\n   * It stays on the row after the run, so the record of a finished run says\n   * how many targets it touched and how many refused.\n   */\n  progress?: ApprovalProgress\n  executedAt?: string\n  executionError?: string\n  /**\n   * What the action reported when it ran.\n   *\n   * The shape belongs to the use case. An action over many targets puts the\n   * result of each target here, which is the difference between \"it failed\"\n   * and \"it did 2998 of 3000, and these two refused\".\n   */\n  executionResult?: Record<string, unknown>\n  createdAt: string\n  updatedAt: string\n}\n\n/**\n * What a use case is, as the API reports it.\n *\n * The frontend needs `requiredPermission` to run the same rule as the backend.\n * PR #9301 kept this registry a second time, by hand, in the frontend. A\n * registry that the server owns means a new use case needs no frontend deploy.\n */\nexport interface ApprovalUseCaseDto {\n  type: string\n  /** A short name for a person to read. */\n  label: string\n  /** One sentence: what the action does, and what it cannot undo. */\n  description: string\n  /** The approvals a new request asks for when the caller names no number. */\n  defaultAcks: number\n  /**\n   * The floor. A caller can ask for more approvals, never for fewer.\n   *\n   * It is a separate number from `defaultAcks` because the two answer\n   * different questions: the default is what the form offers, and the floor is\n   * what the service refuses to go below.\n   */\n  minAcks: number\n  ttlDays: number\n  executionMode: ApprovalExecutionMode\n  /** See `ApprovalActionMode`. An action over many targets is `background`. */\n  actionMode: ApprovalActionMode\n  /**\n   * True when a run that was interrupted can start again by itself.\n   *\n   * It is a promise about the ACTION, and the reconciler reads it. Set it only\n   * when the action can run a second time over the same payload and do no harm\n   * twice: it must read what the first run already finished, out of\n   * `ApprovalJobDto.executionResult`, and skip it.\n   *\n   * False, the default, is the safe answer. An interrupted run then lands in\n   * `failed`, which a person can run again from the detail page, and a person\n   * decides whether running it twice is safe.\n   */\n  resumable: boolean\n  /**\n   * The permission that every request of this use case needs to approve,\n   * reject or run. A payload can add more. See\n   * `ApprovalJobDto.requiredPermissions`, which is the effective set.\n   *\n   * It is also the permission to SEE a request of this use case, because a\n   * person who cannot act on one has no reason to read it. The person who\n   * opened a request always sees that request.\n   *\n   * The one exception to \"or run\" is a use case with `openToEveryone`. It has\n   * no approval, so this permission only decides who sees the requests of\n   * other people. Any signed-in person can open and run such a request.\n   */\n  requiredPermission: string\n  /**\n   * The permission to open a request. Absent means any signed-in Camundi.\n   *\n   * Set it when the pool that can ASK must be as small as the pool that can\n   * approve. Leave it absent when the approvals alone are the guard, and the\n   * proposal is not.\n   */\n  createPermission?: string\n  /** True when a request cannot be opened without a reason. */\n  reasonRequired: boolean\n  /**\n   * True when the ACTION needs the email address of the person who asked.\n   *\n   * A token can carry no address, and the row then stores\n   * `UNKNOWN_ACTOR_EMAIL`. An action that sends that placeholder to another\n   * service asks it to find a user that does not exist, so the request can\n   * only fail \u2014 and it fails at the END, after other people spent their\n   * approvals on it. A use case that carries the creator into its call sets\n   * this, and `canCreate` then refuses such a caller at the start.\n   *\n   * `extend-trial` and `send-to-expired-trial` are two: both send the creator\n   * to accounts in an `ApprovalM2mActor`, and accounts reads the permissions\n   * of that person again before it acts.\n   *\n   * `move-cluster-org` does NOT set this. Its envelope reaches console, which\n   * reads the user id alone and needs no address.\n   */\n  creatorEmailRequired?: boolean\n  /**\n   * A use case with no approval that any signed-in person can open AND run.\n   *\n   * A request with a floor of zero runs when it is opened, so `canCreate`\n   * asks the person to hold `requiredPermission`. This flag lifts that one\n   * rule, for an action whose run needs no permission of the person. Set it\n   * only when two things hold:\n   *\n   * - Something else bounds how often a person can ask.\n   * - The service that runs the action authorizes the person again at its\n   *   source, so that nobody can change what is not theirs. The action can\n   *   touch an organization only when that check lets the person change it.\n   *\n   * `create-personal-organisation` and the two use cases of customer hardware\n   * sizing set it. The two use cases of customer hardware sizing do the second\n   * check in two ways:\n   *\n   * - Creating a plan, and unlinking a plan from one organization, read the\n   *   role of the person in that organization. Only an OWNER passes.\n   * - Deleting a plan reads no role. Console checks that the person created\n   *   the plan. Accounts reads the organizations that the person is a member\n   *   of, in any role, and removes the plan from their lists.\n   */\n  openToEveryone?: boolean\n}\n"],
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/**\n * The wire types of the generic approval mechanism.\n *\n * This file holds no logic and no dependency, because three consumers read it:\n * control-backend, control-frontend and cloudbot. The rules that read these\n * types are in `../approvals/policy.js`, and they are pure for the same reason.\n */\n\n/**\n * Every state that an approval request can hold.\n *\n * A `const` tuple, not an enum, so it is both the union type and the list that\n * validates a status filter at run time.\n *\n * The path of a request: `pending` until it reaches the threshold. Then\n * `executing` (automatic mode) or `approved` (explicit mode, which waits for a\n * person to press the button). `executed` or `failed` after the action ran. A\n * request that never reaches the threshold ends `rejected`, `withdrawn` or\n * `expired`.\n */\nexport const APPROVAL_JOB_STATUSES = [\n  'pending',\n  'approved',\n  'executing',\n  'executed',\n  'failed',\n  'rejected',\n  'withdrawn',\n  'expired',\n] as const\n\nexport type ApprovalJobStatus = (typeof APPROVAL_JOB_STATUSES)[number]\n\n/**\n * The states in which the action of a request is still COMING.\n *\n * `pending` waits for approvals, `approved` waits for a person to press the\n * button, and `executing` is running now. Each of them can still change the\n * world, so two requests for one target must not be in these states together.\n * `dedupeKey` reads this set for that reason.\n *\n * `failed` is NOT here, although a person can run a failed request again. A\n * failed request runs only when a person presses the button, and that person\n * sees the row. Blocking a new request on a failed one would also trap the\n * key: `canWithdraw` accepts `pending` alone, so nobody could close it.\n *\n * `executed`, `rejected`, `withdrawn` and `expired` are the end of a request.\n */\nexport const APPROVAL_LIVE_STATUSES = [\n  'pending',\n  'approved',\n  'executing',\n] as const satisfies readonly ApprovalJobStatus[]\n\n/**\n * How many requests one page of the list holds when the caller asks for no\n * number.\n *\n * The list is a work queue that a Camundi reads, so the page is large: a\n * person wants the whole queue and not ten rows at a time. What the number is\n * for is the ceiling below.\n */\nexport const APPROVAL_PAGE_SIZE_DEFAULT = 500\n\n/**\n * The largest page that the service builds, and the largest that a caller may\n * ask for. The API answers 400 above it.\n *\n * The list had no limit at all. One authenticated caller could then make the\n * service read the whole table into memory, serialize it, and do it again, so\n * the cost of a request grew with the age of the service and with nothing that\n * the caller had to pay for. A ceiling turns that into a fixed cost.\n *\n * It is HERE and not only in the service, because the view must know it: a\n * page that asked for more would get a 400 instead of rows.\n */\nexport const APPROVAL_PAGE_SIZE_MAX = 2000\n\n/**\n * The columns that the queue can be ordered by.\n *\n * A NAME and not an SQL expression: the repository maps each one, so a caller\n * can never name a column that this list does not hold. `status` orders by the\n * EFFECTIVE status, because a `pending` row whose time ran out reads as\n * `expired` everywhere else.\n */\nexport const APPROVAL_SORT_FIELDS = [\n  'createdAt',\n  'expiresAt',\n  'status',\n  'type',\n  'createdBy',\n] as const\n\nexport type ApprovalSortField = (typeof APPROVAL_SORT_FIELDS)[number]\n\nexport type ApprovalSortOrder = 'asc' | 'desc'\n\n/** The default order of the queue: the newest request first. */\nexport const APPROVAL_SORT_DEFAULT: {\n  sort: ApprovalSortField\n  order: ApprovalSortOrder\n} = { sort: 'createdAt', order: 'desc' }\n\n/**\n * The longest reason that a request, a rejection or a withdrawal accepts.\n *\n * ONE number, because three routes of control-backend hold it and three fields\n * of control-frontend must stop there. A field that let a person write more\n * than the schema accepts turns their sentence into a 400 after they wrote it.\n */\nexport const APPROVAL_REASON_MAX_LENGTH = 2000\n\n/**\n * The largest number of approvals that a caller can ask for.\n *\n * A request that asks for 400 approvals can never reach them, so it is a\n * request that only fills the table and expires. The ceiling turns that into a\n * 400 at the moment a person types it. It is HERE because the form of the\n * bulk operation must stop at the same number as the route.\n */\nexport const APPROVAL_ACKS_MAX = 10\n\n/**\n * The longest search text that the list accepts.\n *\n * A search runs `ILIKE` over the payload of every visible row, so the cost of\n * one call follows the length of the text. Nothing a person types to find a\n * request is near this.\n */\nexport const APPROVAL_SEARCH_MAX_LENGTH = 200\n\n/**\n * The payload field that names the organization a request acts on.\n *\n * It is a CONVENTION, and this constant is what makes the convention readable\n * from both sides. A use case whose action hits one organization puts the id of\n * that organization in this field, and `GET /api/approvals?orgId=\u2026` then finds\n * the request with no knowledge of the use case. The filter reads this one\n * field of the payload, so it matches the whole id and nothing else. The free\n * text search reads the payload as TEXT, which also matches an id that only\n * appears inside another field, and it cannot answer \"the requests of this\n * organization\".\n *\n * The organization page of control-frontend does NOT read this field. It asks\n * the entity-link filter (`entityType=org`), which reads a row that\n * `relatedEntities` of a use case writes \u2014 see `ApprovalEntityRef`. The summary\n * is separate again: the `org` field of a `summarize` result is what a READER\n * follows.\n */\nexport const APPROVAL_PAYLOAD_ORG_FIELD = 'orgId'\n\n/**\n * How many requests each status holds, for the filters of the queue.\n *\n * Every number answers the SAME question as the list beside it: the counts are\n * built with the visibility rule, the action filter and the search text of the\n * caller, and with the lazy expiry. A count that ignored one of those would\n * send a person to a filter that then shows nothing.\n */\nexport interface ApprovalStatusCountsDto {\n  /** Every request that matches, whatever its status. */\n  all: number\n  /** One number for each status. A status with no request is 0, never absent. */\n  byStatus: Record<ApprovalJobStatus, number>\n}\n\n/**\n * What happens when a request reaches its threshold.\n *\n * `auto` runs the action immediately. `explicit` holds the request at\n * `approved` and waits for a person to run it.\n */\nexport type ApprovalExecutionMode = 'auto' | 'explicit'\n\n/**\n * WHERE the action runs. It is a separate question from who starts it.\n *\n * - `inline` runs the action inside the call that started it, and the answer\n *   already carries the outcome. Right for one call to another service.\n * - `background` answers as soon as the request is claimed, and the action\n *   runs on. It reports into `ApprovalJobDto.progress`, and the row is the\n *   only place that holds the progress, so a reload and a second person read\n *   the same numbers. A pod that stops loses the run, and the reconciler of\n *   control-backend recovers the row.\n *\n * An action over thousands of targets MUST be `background`. `inline` would\n * hold one HTTP request for the whole run, and the ingress, the load balancer\n * and the browser each have their own deadline before it finishes.\n *\n * An `inline` action must not read `context.signal`. The runner trusts the\n * result of an `inline` action that returns after a drain, and it would count\n * a partial run as `executed`. An action that stops between targets is\n * `background`.\n */\nexport type ApprovalActionMode = 'inline' | 'background'\n\n/**\n * A person, as an approval request records them.\n *\n * Both keys are kept. The machine then never has to choose one identity key,\n * which is what split the earlier acknowledgement flows: some held an email and\n * some held a user id, and the two could not be compared.\n */\nexport interface ApprovalActor {\n  userId: string\n  email: string\n}\n\nexport interface ApprovalAck extends ApprovalActor {\n  /** An ISO timestamp. It is in a json column, so it is a string, not a Date. */\n  date: string\n}\n\n/**\n * Who asked for an action, and who agreed to it.\n *\n * Every route of `api/admin/approvals` takes this envelope, and control-backend\n * builds it from the request that it runs. The envelope exists because the\n * token cannot carry it: the call is machine to machine, so `sub` holds the id\n * of the Auth0 application and not a person. A service that reads the token\n * alone therefore writes \"control-backend\" into its audit record, which hides\n * the two Camundis that the whole mechanism exists to record.\n *\n * `approvedBy` is a list, because a use case can need more than one approval,\n * and the record must name all of them. It can also be EMPTY: how many\n * approvals an action needs is a number of the use case, and `move-cluster-org`\n * holds zero on purpose. The person in `requestedBy` is never in the list: the\n * four-eyes rule is that the person who asks is not the person who agrees, and\n * control-backend holds that rule.\n *\n * Each person carries both keys of `ApprovalActor`. The email is what a route\n * uses to ask Auth0 about the person, and the user id is what an audit record\n * holds, because every other record of the fleet holds an Auth0 `sub`.\n *\n * CAUTION: The envelope is a CLAIM of the caller, and not proof. A route that\n * acts on it must ask Auth0 again whether `requestedBy` may do the action.\n * That means the permission of the action. For a use case with\n * `openToEveryone`, it means that the person is a Camundi, because no\n * permission runs that action. `api/admin/approvals` in accounts-backend does\n * that. See the note on `M2M_CONTROL_APPROVALS`.\n */\nexport interface ApprovalM2mActor {\n  /** The id of the approval request, to join the records of both services. */\n  requestId: string\n  /** The Camundi who opened the request. */\n  requestedBy: ApprovalActor\n  /** The Camundis who approved it. Empty when the use case needs none. */\n  approvedBy: ApprovalActor[]\n}\n\n/**\n * What one value of a summary field is.\n *\n * `text` is what a person reads. `id` is what a link points at, and it is\n * absent when the kind names no entity. The two are separate because the text\n * is a COPY that the request keeps: an organization that gets a new name after\n * the request was opened must still read as the organization that the person\n * chose.\n */\nexport interface ApprovalSummaryValue {\n  text: string\n  id?: string\n}\n\n/**\n * How a reader must render one field of a summary.\n *\n * `org`, `cluster` and `user` name an entity, so a reader can link to it and\n * can resolve a fresh name. The others are plain: `date` is an ISO timestamp,\n * and `code` is a value that must keep its characters, such as a json fragment.\n */\nexport const APPROVAL_SUMMARY_FIELD_KINDS = [\n  'text',\n  'number',\n  'boolean',\n  'date',\n  'org',\n  'cluster',\n  'user',\n  'code',\n] as const\n\nexport type ApprovalSummaryFieldKind =\n  (typeof APPROVAL_SUMMARY_FIELD_KINDS)[number]\n\n/**\n * One labelled field of the payload of a request.\n *\n * This is what makes ONE view able to show EVERY use case. The payload of a\n * request is an object of anything, so a generic view can only print it as\n * json. The use case turns it into labelled fields here, and the view renders\n * a field by its kind: it links an `org`, it formats a `date`, and it lists\n * 300 clusters as 300 links.\n *\n * `values` is always an array. A field that holds one value holds an array of\n * one, so a reader needs no branch for \"one or many\".\n */\nexport interface ApprovalSummaryField {\n  label: string\n  kind: ApprovalSummaryFieldKind\n  values: ApprovalSummaryValue[]\n  /**\n   * The values that this request replaces, for a field that changes. A view\n   * shows them as removed beside `values` as added. A field with no\n   * `previous` is not a change.\n   */\n  previous?: ApprovalSummaryValue[]\n  /** The count of `previous`, when the list cut it. Like `total`, for `previous`. */\n  previousTotal?: number\n  /**\n   * How many values the field holds, when `values` holds only the first of\n   * them. The list route cuts every field to `APPROVAL_LIST_SUMMARY_VALUES_MAX`\n   * values. The detail route sends every value and no `total`.\n   */\n  total?: number\n}\n\n/**\n * How many values of one summary field a row of the list carries.\n *\n * A bulk operation names up to 3000 clusters in one field. A page of 100 such\n * rows would carry 300,000 values that no row shows. The view shows at most\n * 12 values of a field, so the list stops there, and `total` holds the count.\n */\nexport const APPROVAL_LIST_SUMMARY_VALUES_MAX = 12\n\n/**\n * The kinds of entity that an approval request can concern.\n *\n * These are the entities that a request is findable by: the org and cluster\n * detail pages ask \"which requests touch me\", and the answer reads a row for\n * each entity. It is a subset of `APPROVAL_SUMMARY_FIELD_KINDS` \u2014 the kinds that\n * name an entity \u2014 because only those carry an id that a page can match.\n */\nexport const APPROVAL_ENTITY_TYPES = ['cluster', 'org', 'user'] as const\n\nexport type ApprovalEntityType = (typeof APPROVAL_ENTITY_TYPES)[number]\n\n/**\n * One entity that an approval request concerns.\n *\n * A use case reports these from its payload, and the service writes one row for\n * each into `approval_job_entity`. That row is what makes a request findable by\n * an entity it touches, without a text search over the payload: a cluster-move\n * request names its cluster, its target organization AND its source\n * organization, so it shows on all three detail pages. The `summary` still\n * carries the words a reader sees; this carries only the ids a page matches.\n */\nexport interface ApprovalEntityRef {\n  type: ApprovalEntityType\n  id: string\n}\n\n/**\n * How long a run may go quiet before a reader calls it stalled.\n *\n * The pod that runs an action writes its progress and renews its lease on one\n * timer, so a healthy run touches the row well inside this window. A row that\n * is `executing` and older than this held a pod that stopped, and the\n * reconciler of control-backend is on its way to it.\n *\n * It lives here, and not in the config of the service, because a READER needs\n * it: the browser must decide what to show without a second call, and a number\n * that only the backend knew would make the two disagree. `ACTION_LEASE_MS` in\n * `config/index.ts` is held below this on purpose.\n */\nexport const APPROVAL_RUN_STALE_MS = 120_000\n\n/**\n * What an action reports while it runs.\n *\n * This is what makes a long action watchable. Every field is in the DATABASE\n * and not in the answer to the call that started the run, so three readers see\n * the same thing: the person who pressed the button, the same person after a\n * reload, and a second person who opens the request.\n *\n * `total` can be 0 while an action counts its targets, and it stays 0 for an\n * action that cannot count them. A reader must then show that it runs, and no\n * percentage.\n */\nexport interface ApprovalProgress {\n  /** Targets in total. 0 means the action did not say. */\n  total: number\n  /** Targets finished, whatever the outcome of each one. */\n  done: number\n  /** Targets that finished with an error. Part of `done`. */\n  failed: number\n  /** One short line for a person, such as the step that runs now. */\n  note?: string\n  /** An ISO timestamp: when the run started. */\n  startedAt: string\n  /** An ISO timestamp: when the run last wrote anything. */\n  updatedAt: string\n}\n\n/** The share of the work that is finished, or `undefined` with no total. */\nexport function progressFraction(\n  progress: ApprovalProgress | undefined,\n): number | undefined {\n  if (!progress || progress.total <= 0) {\n    return undefined\n  }\n  return Math.min(1, progress.done / progress.total)\n}\n\n/**\n * Reports whether a running request went quiet.\n *\n * True means that the pod which held the run stopped, or lost the row. It does\n * NOT mean that the action failed: the reconciler either runs it again, or it\n * writes `failed` so that a person can. See `APPROVAL_RUN_STALE_MS`.\n */\nexport function isRunStalled(job: ApprovalJobDto, now: Date): boolean {\n  if (job.status !== 'executing') {\n    return false\n  }\n  const lastSign = job.progress?.updatedAt ?? job.executingSince\n  if (!lastSign) {\n    return false\n  }\n  return now.getTime() - new Date(lastSign).getTime() > APPROVAL_RUN_STALE_MS\n}\n\n/** One approval request, as the API returns it. */\nexport interface ApprovalJobDto {\n  id: string\n  type: string\n  dedupeKey?: string\n  payload: Record<string, unknown>\n  /**\n   * The payload as labelled fields. See `ApprovalSummaryField`.\n   *\n   * The use case builds it when the request is opened AND every time the\n   * request is read, so a field that a later version of the use case adds\n   * appears on a request that is already open.\n   */\n  summary: ApprovalSummaryField[]\n  /** Why the person opened the request. Some use cases demand one. */\n  reason?: string\n  createdBy: ApprovalActor\n  acks: ApprovalAck[]\n  /**\n   * How many approvals THIS request needs.\n   *\n   * It is on the request and not only on the use case, because the person who\n   * opens one can ask for more than the floor of the use case. A bulk\n   * operation over 3000 clusters is the same action as one over 3, and it can\n   * still deserve a third pair of eyes. `ApprovalUseCaseDto.minAcks` is the\n   * floor that a caller cannot go below.\n   */\n  requiredAcks: number\n  /**\n   * What a person must hold to approve, reject or run THIS request.\n   *\n   * It is on the request and not only on the use case, because a payload can\n   * raise the guard: a generation update with `yoloForceUpdate` needs the yolo\n   * permission on top of the base one, and the same use case without the flag\n   * does not. The set is computed ONE time, when the request is opened, so it\n   * is also the record of what the request was guarded by.\n   *\n   * A person needs EVERY permission in the set, not one of them.\n   */\n  requiredPermissions: string[]\n  executionMode: ApprovalExecutionMode\n  actionMode: ApprovalActionMode\n  status: ApprovalJobStatus\n  closedBy?: ApprovalActor\n  closedReason?: string\n  /** An ISO timestamp. */\n  expiresAt: string\n  /**\n   * An ISO timestamp: when the current run took the request.\n   *\n   * It is set every time a run starts, so a run that the reconciler starts\n   * again moves it. `attempts` says how many runs there were.\n   */\n  executingSince?: string\n  /** How many times a run started. A recovery raises it. */\n  attempts: number\n  /**\n   * What the action reports while it runs. See `ApprovalProgress`.\n   *\n   * It stays on the row after the run, so the record of a finished run says\n   * how many targets it touched and how many refused.\n   */\n  progress?: ApprovalProgress\n  executedAt?: string\n  executionError?: string\n  /**\n   * What the action reported when it ran.\n   *\n   * The shape belongs to the use case. An action over many targets puts the\n   * result of each target here, which is the difference between \"it failed\"\n   * and \"it did 2998 of 3000, and these two refused\".\n   */\n  executionResult?: Record<string, unknown>\n  createdAt: string\n  updatedAt: string\n}\n\n/**\n * What a use case is, as the API reports it.\n *\n * The frontend needs `requiredPermission` to run the same rule as the backend.\n * PR #9301 kept this registry a second time, by hand, in the frontend. A\n * registry that the server owns means a new use case needs no frontend deploy.\n */\nexport interface ApprovalUseCaseDto {\n  type: string\n  /** A short name for a person to read. */\n  label: string\n  /** One sentence: what the action does, and what it cannot undo. */\n  description: string\n  /** The approvals a new request asks for when the caller names no number. */\n  defaultAcks: number\n  /**\n   * The floor. A caller can ask for more approvals, never for fewer.\n   *\n   * It is a separate number from `defaultAcks` because the two answer\n   * different questions: the default is what the form offers, and the floor is\n   * what the service refuses to go below.\n   */\n  minAcks: number\n  ttlDays: number\n  executionMode: ApprovalExecutionMode\n  /** See `ApprovalActionMode`. An action over many targets is `background`. */\n  actionMode: ApprovalActionMode\n  /**\n   * True when a run that was interrupted can start again by itself.\n   *\n   * It is a promise about the ACTION, and the reconciler reads it. Set it only\n   * when the action can run a second time over the same payload and do no harm\n   * twice: it must read what the first run already finished, out of\n   * `ApprovalJobDto.executionResult`, and skip it.\n   *\n   * False, the default, is the safe answer. An interrupted run then lands in\n   * `failed`, which a person can run again from the detail page, and a person\n   * decides whether running it twice is safe.\n   */\n  resumable: boolean\n  /**\n   * The permission that every request of this use case needs to approve,\n   * reject or run. A payload can add more. See\n   * `ApprovalJobDto.requiredPermissions`, which is the effective set.\n   *\n   * It is also the permission to SEE a request of this use case, because a\n   * person who cannot act on one has no reason to read it. The person who\n   * opened a request always sees that request.\n   *\n   * The one exception to \"or run\" is a use case with `openToEveryone`. It has\n   * no approval, so this permission only decides who sees the requests of\n   * other people. Any signed-in person can open and run such a request.\n   */\n  requiredPermission: string\n  /**\n   * The permission to open a request. Absent means any signed-in Camundi.\n   *\n   * Set it when the pool that can ASK must be as small as the pool that can\n   * approve. Leave it absent when the approvals alone are the guard, and the\n   * proposal is not.\n   */\n  createPermission?: string\n  /** True when a request cannot be opened without a reason. */\n  reasonRequired: boolean\n  /**\n   * True when the ACTION needs the email address of the person who asked.\n   *\n   * A token can carry no address, and the row then stores\n   * `UNKNOWN_ACTOR_EMAIL`. An action that sends that placeholder to another\n   * service asks it to find a user that does not exist, so the request can\n   * only fail \u2014 and it fails at the END, after other people spent their\n   * approvals on it. A use case that carries the creator into its call sets\n   * this, and `canCreate` then refuses such a caller at the start.\n   *\n   * `extend-trial` and `send-to-expired-trial` are two: both send the creator\n   * to accounts in an `ApprovalM2mActor`, and accounts reads the permissions\n   * of that person again before it acts.\n   *\n   * `move-cluster-org` does NOT set this. Its envelope reaches console, which\n   * reads the user id alone and needs no address.\n   */\n  creatorEmailRequired?: boolean\n  /**\n   * A use case with no approval that any signed-in person can open AND run.\n   *\n   * A request with a floor of zero runs when it is opened, so `canCreate`\n   * asks the person to hold `requiredPermission`. This flag lifts that one\n   * rule, for an action whose run needs no permission of the person. Set it\n   * only when two things hold:\n   *\n   * - Something else bounds how often a person can ask.\n   * - The service that runs the action authorizes the person again at its\n   *   source, so that nobody can change what is not theirs. The action can\n   *   touch an organization only when that check lets the person change it.\n   *\n   * `create-personal-organisation` and the two use cases of custom hardware\n   * sizing set it. The two use cases of custom hardware sizing do the second\n   * check in two ways:\n   *\n   * - Creating a plan, and unlinking a plan from one organization, read the\n   *   role of the person in that organization. Only an OWNER passes.\n   * - Deleting a plan reads no role. Console checks that the person created\n   *   the plan. Accounts reads the organizations that the person is a member\n   *   of, in any role, and removes the plan from their lists.\n   */\n  openToEveryone?: boolean\n  /**\n   * A use case with no approval that only a service of the fleet opens.\n   *\n   * The service holds `createPermission`, an m2m permission, and not\n   * `requiredPermission`. This flag lets that holder open and thus run a\n   * request with a floor of zero. `requiredPermission` then decides only who\n   * sees the requests and who can run a failed one again. Without a\n   * `createPermission` the flag lifts nothing.\n   *\n   * `cluster-ttl-deletion` sets it. The request exists for the record: the\n   * list, the entity pages and the audit trail show each deletion.\n   */\n  openedBySystem?: boolean\n}\n"],
   "mappings": "AA0BO,MAAM,wBAAwB;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAmBO,MAAM,yBAAyB;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AACF;AAUO,MAAM,6BAA6B;AAcnC,MAAM,yBAAyB;AAU/B,MAAM,uBAAuB;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOO,MAAM,wBAGT,EAAE,MAAM,aAAa,OAAO,OAAO;AAShC,MAAM,6BAA6B;AAUnC,MAAM,oBAAoB;AAS1B,MAAM,6BAA6B;AAoBnC,MAAM,6BAA6B;AA0HnC,MAAM,+BAA+B;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AA4CO,MAAM,mCAAmC;AAUzC,MAAM,wBAAwB,CAAC,WAAW,OAAO,MAAM;AAgCvD,MAAM,wBAAwB;AA8B9B,SAAS,iBACd,UACoB;AACpB,MAAI,CAAC,YAAY,SAAS,SAAS,GAAG;AACpC,WAAO;AAAA,EACT;AACA,SAAO,KAAK,IAAI,GAAG,SAAS,OAAO,SAAS,KAAK;AACnD;AASO,SAAS,aAAa,KAAqB,KAAoB;AACpE,MAAI,IAAI,WAAW,aAAa;AAC9B,WAAO;AAAA,EACT;AACA,QAAM,WAAW,IAAI,UAAU,aAAa,IAAI;AAChD,MAAI,CAAC,UAAU;AACb,WAAO;AAAA,EACT;AACA,SAAO,IAAI,QAAQ,IAAI,IAAI,KAAK,QAAQ,EAAE,QAAQ,IAAI;AACxD;",
   "names": []
 }

package/dist/dtos/SalesPlan.dto.d.ts

@@ -155,6 +155,11 @@ export declare function unusedSalesPlanLimits(limits: Limits, stage?: string): {
  * the type.
  */
 export declare function clusterPlanWhiteListIds(limits: Limits | undefined): string[];
+/**
+ * Returns the generation uuids of the `generationWhiteList` limit. A value
+ * that is not a string gives no ids.
+ */
+export declare function generationWhiteListIds(limits: Limits | undefined): string[];
 /**
  * Says if unlocked cluster plans work on a stage. They work on local, dev and
  * int. They never work on prod, and an unknown stage reads as off. This is a

package/dist/dtos/SalesPlan.dto.js

@@ -190,6 +190,13 @@ function clusterPlanWhiteListIds(limits) {
   }
   return value.split(",").map((id) => id.trim()).filter((id) => id.length > 0);
 }
+function generationWhiteListIds(limits) {
+  const value = limits?.generationWhiteList;
+  if (typeof value !== "string") {
+    return [];
+  }
+  return value.split(",").map((id) => id.trim()).filter((id) => id.length > 0);
+}
 function isUnlockedClusterPlansStage(stage) {
   return stage === "local" || stage === "dev" || stage === "int";
 }
@@ -206,6 +213,7 @@ export {
   allSalesPlanLimits,
   clusterPlanWhiteListIds,
   deprecatedLimit,
+  generationWhiteListIds,
   isLimitKeyEnabled,
   isLimitOfferedOnStage,
   isUnlockedClusterPlansStage,

package/dist/dtos/SalesPlan.dto.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/dtos/SalesPlan.dto.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type { ClusterPlanTypesToConfig } from '../types/ClusterPlanTypesToConfig.type.js'\nimport { isPreprodClusterTtlStage } from '../types/PreprodClusterTtl.type.js'\n\nexport interface SalesPlanDto {\n  uuid?: string\n  name: string\n  salesPlanType?: string\n  internal?: boolean\n  clusterPlanTypesToConfig: ClusterPlanTypesToConfig\n  metadata?: SalesPlanMetadata\n  version: number\n  orgs?: number\n}\n\nexport interface ConsumptionDataItem {\n  type: string\n  data: string\n  itemPriceId: string\n}\n\nexport interface SalesPlanMetadata {\n  description: string\n  limits?: Limits\n}\n\nexport interface ClusterLimits {\n  dataRetentionOperate?: number\n  dataRetentionTasklist?: number\n  dataRetentionOptimize?: number\n  unifiedDataRetention?: number\n}\n\nexport interface Limits extends ClusterLimits {\n  maxMembers?: number\n  hotBackup?: boolean\n  /**\n   * Overrides the operator's default retained count (3) for manual (on-demand)\n   * hot backups (ZeebeCluster spec.backup.retainedCount).\n   */\n  hotBackupManualRetainedCount?: number\n  /**\n   * Overrides the operator's default retained count (3) for scheduled hot\n   * backups (BackupSchedule spec.successfulBackupsHistoryLimit /\n   * failedBackupsHistoryLimit).\n   */\n  hotBackupScheduledRetainedCount?: number\n  ipWhiteList?: boolean\n  secureConnectivity?: boolean\n  failover?: boolean\n  allowedHostnamesForInvites?: string\n  regionWhiteList?: string\n  suppressDropDisks?: boolean\n  legacyStreams?: boolean\n  ignoreGracePeriod?: boolean\n  /**\n   * Maximum number of clients allowed per cluster.\n   * Overrides the stage-based default (MAX_CLUSTER_CLIENTS_DEV on dev,\n   * MAX_CLUSTER_CLIENTS_DEFAULT on int/prod).\n   */\n  maxClusterClients?: number\n  /**\n   * Comma-separated list of generation UUIDs that are unlocked for this org.\n   * These generations will be available for cluster creation even if they\n   * are not part of a channel's allowed generations. They are attached to\n   * the Stable channel with classification 'orgUnlocked'.\n   */\n  generationWhiteList?: string\n  /**\n   * Comma-separated list of cluster plan UUIDs that are unlocked for this org.\n   * On create, the caller can name one of them in `clusterPlanId`. The cluster\n   * then gets that plan instead of the active plan of its plan type. Read\n   * only on stages with unlocked cluster plans (local, dev and int).\n   */\n  clusterPlanWhiteList?: string\n  /**\n   * When true, users with only the Developer role cannot create clusters in this org.\n   * Users who also hold Member, Admin, Owner, or Operations Engineer are unaffected.\n   */\n  developerNoClusterCreate?: boolean\n  /**\n   * On dev and int only: the nightly delete cron deletes every cluster of the\n   * org that is older than this number of hours. It asks nobody. Because the\n   * cron runs once a day, a cluster can live up to 24 hours longer. We set it\n   * on our own test orgs, because a paused cluster keeps its disks and costs\n   * money. A sales plan can hold it too: an org copies the limits of its plan\n   * when it gets the plan, thus every later org of that plan gets it. An\n   * editor on prod does not offer it.\n   */\n  preprodClusterTtlHours?: number\n}\n\nexport const RETENTION_LIMIT_MINIMUM = {\n  operate: 5,\n  tasklist: 5,\n  optimize: 5,\n  unified: 5,\n}\nexport const RETENTION_LIMIT_MAXIMUM = {\n  operate: 365,\n  tasklist: 90,\n  optimize: 720,\n  unified: 365,\n}\nexport const RETENTION_LIMIT_DEFAULT = {\n  operate: 30,\n  tasklist: 30,\n  optimize: 180,\n  unified: 30,\n}\n\n/**\n * Default maximum number of clients per cluster on development stage.\n */\nexport const MAX_CLUSTER_CLIENTS_DEV = 10\n\n/**\n * Default maximum number of clients per cluster on integration and production stages.\n */\nexport const MAX_CLUSTER_CLIENTS_DEFAULT = 200\n\nexport function deprecatedLimit(key: string): string | undefined {\n  if (['dataRetentionOperate', 'dataRetentionTasklist'].includes(key)) {\n    return 'unifiedDataRetention'\n  }\n  return undefined\n}\n\nexport function allClusterBasedLimits(): {\n  key: string\n  type: 'number' | 'boolean' | 'string'\n  description: string\n  isClusterBasedLimit: boolean\n  validate?: (input: number) => boolean\n}[] {\n  return [\n    {\n      key: 'dataRetentionOperate',\n      type: 'number',\n      isClusterBasedLimit: true,\n      description: `Data retention in days for Operate. default = ${RETENTION_LIMIT_DEFAULT.operate}days. Min = ${RETENTION_LIMIT_MINIMUM.operate}days, Max = ${RETENTION_LIMIT_MAXIMUM.operate}days.`,\n      validate: (input) =>\n        Number.isInteger(input) &&\n        input >= RETENTION_LIMIT_MINIMUM.operate &&\n        input <= RETENTION_LIMIT_MAXIMUM.operate,\n    },\n    {\n      key: 'dataRetentionTasklist',\n      type: 'number',\n      isClusterBasedLimit: true,\n      description: `Data retention in days for Tasklist. default = ${RETENTION_LIMIT_DEFAULT.tasklist}days. Min = ${RETENTION_LIMIT_MINIMUM.tasklist}days, Max = ${RETENTION_LIMIT_MAXIMUM.tasklist}days.`,\n      validate: (input) =>\n        Number.isInteger(input) &&\n        input >= RETENTION_LIMIT_MINIMUM.tasklist &&\n        input <= RETENTION_LIMIT_MAXIMUM.tasklist,\n    },\n    {\n      key: 'dataRetentionOptimize',\n      type: 'number',\n      isClusterBasedLimit: true,\n      description: `Data retention in days for Optimize. default = ${RETENTION_LIMIT_DEFAULT.optimize}days. Min = ${RETENTION_LIMIT_MINIMUM.optimize}days, Max = ${RETENTION_LIMIT_MAXIMUM.optimize}days.`,\n      validate: (input) =>\n        Number.isInteger(input) &&\n        input >= RETENTION_LIMIT_MINIMUM.optimize &&\n        input <= RETENTION_LIMIT_MAXIMUM.optimize,\n    },\n    {\n      key: 'unifiedDataRetention',\n      type: 'number',\n      isClusterBasedLimit: true,\n      description: `Unified data retention in days for Zeebe broker. default = ${RETENTION_LIMIT_DEFAULT.unified}days. Min = ${RETENTION_LIMIT_MINIMUM.unified}days, Max = ${RETENTION_LIMIT_MAXIMUM.unified}days.`,\n      validate: (input) =>\n        Number.isInteger(input) &&\n        input >= RETENTION_LIMIT_MINIMUM.unified &&\n        input <= RETENTION_LIMIT_MAXIMUM.unified,\n    },\n  ]\n}\n\nexport function allSalesPlanLimits(): {\n  key: string\n  type: 'number' | 'boolean' | 'string'\n  description: string\n  isClusterBasedLimit: boolean\n  validate?: (input: number) => boolean\n  /** An editor on prod does not offer the limit, because only dev and int act on it. */\n  preprodOnly?: boolean\n}[] {\n  return [\n    {\n      key: 'maxMembers',\n      type: 'number',\n      description:\n        'used to limit the amount of collaborators within one organization. default = no limit',\n      isClusterBasedLimit: false,\n      validate: (input) => Number.isInteger(input) && input >= 0,\n    },\n    {\n      key: 'hotBackup',\n      type: 'boolean',\n      description:\n        'used to activate the hot backup functionality in organizations. default = not active',\n      isClusterBasedLimit: false,\n    },\n    {\n      key: 'hotBackupManualRetainedCount',\n      type: 'number',\n      description:\n        'overrides how many manual (on-demand) hot backups the operator retains before deleting the oldest. default = 3',\n      isClusterBasedLimit: false,\n      validate: (input) => Number.isInteger(input) && input >= 1,\n    },\n    {\n      key: 'hotBackupScheduledRetainedCount',\n      type: 'number',\n      description:\n        'overrides how many scheduled hot backups the operator retains before deleting the oldest. default = 3',\n      isClusterBasedLimit: false,\n      validate: (input) => Number.isInteger(input) && input >= 1,\n    },\n    {\n      key: 'ipWhiteList',\n      type: 'boolean',\n      description:\n        'used to activate the ipWhitelist feature in console. default = not active',\n      isClusterBasedLimit: false,\n    },\n    {\n      key: 'secureConnectivity',\n      type: 'boolean',\n      description:\n        'used to activate the secure connectivity feature in console. default = not active',\n      isClusterBasedLimit: false,\n    },\n    {\n      key: 'failover',\n      type: 'boolean',\n      description:\n        'used to activate the failover functionality for multi-region clusters. default = not active',\n      isClusterBasedLimit: false,\n    },\n    {\n      key: 'allowedHostnamesForInvites',\n      type: 'string',\n      description:\n        'allowed hostnames for invites - comma separated, default: every hostname is allowed',\n      isClusterBasedLimit: false,\n    },\n    {\n      key: 'regionWhiteList',\n      type: 'string',\n      description:\n        'allowed regions - comma separated, default: every region is allowed',\n      isClusterBasedLimit: false,\n    },\n    {\n      key: 'suppressDropDisks',\n      type: 'boolean',\n      description:\n        'used to not drop disks of sleeping clusters. default = not suppressed',\n      isClusterBasedLimit: false,\n    },\n    {\n      key: 'legacyStreams',\n      type: 'boolean',\n      description:\n        'used to allow organizations to use legacy minor streams (e.g. 8.5, 8.6) for cluster creation. default = not allowed',\n      isClusterBasedLimit: false,\n    },\n    {\n      key: 'ignoreGracePeriod',\n      type: 'boolean',\n      description:\n        'used to bypass the 24h grace period on cluster upgrades after a minor version bump. default = not active (grace period enforced)',\n      isClusterBasedLimit: false,\n    },\n    {\n      key: 'maxClusterClients',\n      type: 'number',\n      description: `maximum number of clients per cluster. default = ${MAX_CLUSTER_CLIENTS_DEFAULT} (${MAX_CLUSTER_CLIENTS_DEV} on dev). Can be overridden per org for special customers (e.g. OEM).`,\n      isClusterBasedLimit: false,\n      validate: (input) => Number.isInteger(input) && input >= 1,\n    },\n    {\n      key: 'generationWhiteList',\n      type: 'string',\n      description:\n        'unlocked generation UUIDs - comma separated. These generations will be available for cluster creation regardless of channel membership. Attached to the Stable channel.',\n      isClusterBasedLimit: false,\n    },\n    {\n      key: 'clusterPlanWhiteList',\n      type: 'string',\n      description:\n        'unlocked cluster plan UUIDs - comma separated. On create, a cluster can use one of these plans instead of the active plan of its plan type. The reservation still counts against the plan type. The limit has an effect only on dev and int.',\n      isClusterBasedLimit: false,\n    },\n    {\n      key: 'developerNoClusterCreate',\n      type: 'boolean',\n      description:\n        'when enabled, users with only the Developer role cannot create clusters in this org. Admins, Owners, Members, and Operations Engineers are unaffected.',\n      isClusterBasedLimit: false,\n    },\n    {\n      key: 'preprodClusterTtlHours',\n      type: 'number',\n      description:\n        'dev and int only: the nightly delete cron deletes every cluster of this org that is older than N hours, with no confirmation. On a sales plan, every org that gets the plan later gets the limit too. For our own test orgs. default = not active',\n      isClusterBasedLimit: false,\n      validate: (input) => Number.isInteger(input) && input >= 1,\n      preprodOnly: true,\n    },\n    ...allClusterBasedLimits(),\n  ]\n}\n\nexport function unusedClusterBasedLimits(limits: ClusterLimits): {\n  key: string\n  type: 'number' | 'boolean' | 'string'\n  description: string\n  isClusterBasedLimit: boolean\n}[] {\n  return allClusterBasedLimits().filter(\n    (current) =>\n      !(\n        Object.keys(limits).includes(current.key) &&\n        (limits as Record<string, unknown>)[current.key] !== null\n      ),\n  )\n}\n\n/**\n * Returns whether an editor on the stage offers the limit. A `preprodOnly`\n * limit is offered only on dev and int. Every other limit is offered on\n * every stage.\n */\nexport function isLimitOfferedOnStage(\n  limit: { preprodOnly?: boolean },\n  stage: string,\n): boolean {\n  return !limit.preprodOnly || isPreprodClusterTtlStage(stage)\n}\n\n/**\n * Returns the limits that `limits` does not set yet. With a `stage`, it also\n * leaves out the limits that the stage does not offer.\n */\nexport function unusedSalesPlanLimits(\n  limits: Limits,\n  stage?: string,\n): {\n  key: string\n  type: 'number' | 'boolean' | 'string'\n  description: string\n  isClusterBasedLimit: boolean\n}[] {\n  return allSalesPlanLimits().filter(\n    (current) =>\n      !(\n        Object.keys(limits).includes(current.key) &&\n        (limits as Record<string, unknown>)[current.key] !== null\n      ) &&\n      (stage === undefined || isLimitOfferedOnStage(current, stage)),\n  )\n}\n\n/**\n * Returns the cluster plan uuids of the `clusterPlanWhiteList` limit. A value\n * that is not a string gives no ids, because an old write path did not check\n * the type.\n */\nexport function clusterPlanWhiteListIds(limits: Limits | undefined): string[] {\n  const value: unknown = limits?.clusterPlanWhiteList\n  if (typeof value !== 'string') {\n    return []\n  }\n  return value\n    .split(',')\n    .map((id) => id.trim())\n    .filter((id) => id.length > 0)\n}\n\n/**\n * Says if unlocked cluster plans work on a stage. They work on local, dev and\n * int. They never work on prod, and an unknown stage reads as off. This is a\n * fixed rule of the stage, not a feature flag, so no row can turn it on for\n * prod.\n */\nexport function isUnlockedClusterPlansStage(stage?: string): boolean {\n  return stage === 'local' || stage === 'dev' || stage === 'int'\n}\n\n/**\n * Says if the unlocked cluster plans of the stage offer the limit key. When\n * they are off, `clusterPlanWhiteList` is hidden.\n */\nexport function isLimitKeyEnabled(\n  limitKey: string,\n  unlockedClusterPlans: boolean,\n): boolean {\n  return limitKey !== 'clusterPlanWhiteList' || unlockedClusterPlans\n}\n"],
-  "mappings": "AAOA,SAAS,gCAAgC;AA0FlC,MAAM,0BAA0B;AAAA,EACrC,SAAS;AAAA,EACT,UAAU;AAAA,EACV,UAAU;AAAA,EACV,SAAS;AACX;AACO,MAAM,0BAA0B;AAAA,EACrC,SAAS;AAAA,EACT,UAAU;AAAA,EACV,UAAU;AAAA,EACV,SAAS;AACX;AACO,MAAM,0BAA0B;AAAA,EACrC,SAAS;AAAA,EACT,UAAU;AAAA,EACV,UAAU;AAAA,EACV,SAAS;AACX;AAKO,MAAM,0BAA0B;AAKhC,MAAM,8BAA8B;AAEpC,SAAS,gBAAgB,KAAiC;AAC/D,MAAI,CAAC,wBAAwB,uBAAuB,EAAE,SAAS,GAAG,GAAG;AACnE,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,SAAS,wBAMZ;AACF,SAAO;AAAA,IACL;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,qBAAqB;AAAA,MACrB,aAAa,iDAAiD,wBAAwB,OAAO,eAAe,wBAAwB,OAAO,eAAe,wBAAwB,OAAO;AAAA,MACzL,UAAU,CAAC,UACT,OAAO,UAAU,KAAK,KACtB,SAAS,wBAAwB,WACjC,SAAS,wBAAwB;AAAA,IACrC;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,qBAAqB;AAAA,MACrB,aAAa,kDAAkD,wBAAwB,QAAQ,eAAe,wBAAwB,QAAQ,eAAe,wBAAwB,QAAQ;AAAA,MAC7L,UAAU,CAAC,UACT,OAAO,UAAU,KAAK,KACtB,SAAS,wBAAwB,YACjC,SAAS,wBAAwB;AAAA,IACrC;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,qBAAqB;AAAA,MACrB,aAAa,kDAAkD,wBAAwB,QAAQ,eAAe,wBAAwB,QAAQ,eAAe,wBAAwB,QAAQ;AAAA,MAC7L,UAAU,CAAC,UACT,OAAO,UAAU,KAAK,KACtB,SAAS,wBAAwB,YACjC,SAAS,wBAAwB;AAAA,IACrC;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,qBAAqB;AAAA,MACrB,aAAa,8DAA8D,wBAAwB,OAAO,eAAe,wBAAwB,OAAO,eAAe,wBAAwB,OAAO;AAAA,MACtM,UAAU,CAAC,UACT,OAAO,UAAU,KAAK,KACtB,SAAS,wBAAwB,WACjC,SAAS,wBAAwB;AAAA,IACrC;AAAA,EACF;AACF;AAEO,SAAS,qBAQZ;AACF,SAAO;AAAA,IACL;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aACE;AAAA,MACF,qBAAqB;AAAA,MACrB,UAAU,CAAC,UAAU,OAAO,UAAU,KAAK,KAAK,SAAS;AAAA,IAC3D;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aACE;AAAA,MACF,qBAAqB;AAAA,IACvB;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aACE;AAAA,MACF,qBAAqB;AAAA,MACrB,UAAU,CAAC,UAAU,OAAO,UAAU,KAAK,KAAK,SAAS;AAAA,IAC3D;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aACE;AAAA,MACF,qBAAqB;AAAA,MACrB,UAAU,CAAC,UAAU,OAAO,UAAU,KAAK,KAAK,SAAS;AAAA,IAC3D;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aACE;AAAA,MACF,qBAAqB;AAAA,IACvB;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aACE;AAAA,MACF,qBAAqB;AAAA,IACvB;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aACE;AAAA,MACF,qBAAqB;AAAA,IACvB;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aACE;AAAA,MACF,qBAAqB;AAAA,IACvB;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aACE;AAAA,MACF,qBAAqB;AAAA,IACvB;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aACE;AAAA,MACF,qBAAqB;AAAA,IACvB;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aACE;AAAA,MACF,qBAAqB;AAAA,IACvB;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aACE;AAAA,MACF,qBAAqB;AAAA,IACvB;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aAAa,oDAAoD,2BAA2B,KAAK,uBAAuB;AAAA,MACxH,qBAAqB;AAAA,MACrB,UAAU,CAAC,UAAU,OAAO,UAAU,KAAK,KAAK,SAAS;AAAA,IAC3D;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aACE;AAAA,MACF,qBAAqB;AAAA,IACvB;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aACE;AAAA,MACF,qBAAqB;AAAA,IACvB;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aACE;AAAA,MACF,qBAAqB;AAAA,IACvB;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aACE;AAAA,MACF,qBAAqB;AAAA,MACrB,UAAU,CAAC,UAAU,OAAO,UAAU,KAAK,KAAK,SAAS;AAAA,MACzD,aAAa;AAAA,IACf;AAAA,IACA,GAAG,sBAAsB;AAAA,EAC3B;AACF;AAEO,SAAS,yBAAyB,QAKrC;AACF,SAAO,sBAAsB,EAAE;AAAA,IAC7B,CAAC,YACC,EACE,OAAO,KAAK,MAAM,EAAE,SAAS,QAAQ,GAAG,KACvC,OAAmC,QAAQ,GAAG,MAAM;AAAA,EAE3D;AACF;AAOO,SAAS,sBACd,OACA,OACS;AACT,SAAO,CAAC,MAAM,eAAe,yBAAyB,KAAK;AAC7D;AAMO,SAAS,sBACd,QACA,OAME;AACF,SAAO,mBAAmB,EAAE;AAAA,IAC1B,CAAC,YACC,EACE,OAAO,KAAK,MAAM,EAAE,SAAS,QAAQ,GAAG,KACvC,OAAmC,QAAQ,GAAG,MAAM,UAEtD,UAAU,UAAa,sBAAsB,SAAS,KAAK;AAAA,EAChE;AACF;AAOO,SAAS,wBAAwB,QAAsC;AAC5E,QAAM,QAAiB,QAAQ;AAC/B,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,CAAC;AAAA,EACV;AACA,SAAO,MACJ,MAAM,GAAG,EACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,EACrB,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;AACjC;AAQO,SAAS,4BAA4B,OAAyB;AACnE,SAAO,UAAU,WAAW,UAAU,SAAS,UAAU;AAC3D;AAMO,SAAS,kBACd,UACA,sBACS;AACT,SAAO,aAAa,0BAA0B;AAChD;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type { ClusterPlanTypesToConfig } from '../types/ClusterPlanTypesToConfig.type.js'\nimport { isPreprodClusterTtlStage } from '../types/PreprodClusterTtl.type.js'\n\nexport interface SalesPlanDto {\n  uuid?: string\n  name: string\n  salesPlanType?: string\n  internal?: boolean\n  clusterPlanTypesToConfig: ClusterPlanTypesToConfig\n  metadata?: SalesPlanMetadata\n  version: number\n  orgs?: number\n}\n\nexport interface ConsumptionDataItem {\n  type: string\n  data: string\n  itemPriceId: string\n}\n\nexport interface SalesPlanMetadata {\n  description: string\n  limits?: Limits\n}\n\nexport interface ClusterLimits {\n  dataRetentionOperate?: number\n  dataRetentionTasklist?: number\n  dataRetentionOptimize?: number\n  unifiedDataRetention?: number\n}\n\nexport interface Limits extends ClusterLimits {\n  maxMembers?: number\n  hotBackup?: boolean\n  /**\n   * Overrides the operator's default retained count (3) for manual (on-demand)\n   * hot backups (ZeebeCluster spec.backup.retainedCount).\n   */\n  hotBackupManualRetainedCount?: number\n  /**\n   * Overrides the operator's default retained count (3) for scheduled hot\n   * backups (BackupSchedule spec.successfulBackupsHistoryLimit /\n   * failedBackupsHistoryLimit).\n   */\n  hotBackupScheduledRetainedCount?: number\n  ipWhiteList?: boolean\n  secureConnectivity?: boolean\n  failover?: boolean\n  allowedHostnamesForInvites?: string\n  regionWhiteList?: string\n  suppressDropDisks?: boolean\n  legacyStreams?: boolean\n  ignoreGracePeriod?: boolean\n  /**\n   * Maximum number of clients allowed per cluster.\n   * Overrides the stage-based default (MAX_CLUSTER_CLIENTS_DEV on dev,\n   * MAX_CLUSTER_CLIENTS_DEFAULT on int/prod).\n   */\n  maxClusterClients?: number\n  /**\n   * Comma-separated list of generation UUIDs that are unlocked for this org.\n   * These generations will be available for cluster creation even if they\n   * are not part of a channel's allowed generations. They are attached to\n   * the Stable channel with classification 'orgUnlocked'.\n   */\n  generationWhiteList?: string\n  /**\n   * Comma-separated list of cluster plan UUIDs that are unlocked for this org.\n   * On create, the caller can name one of them in `clusterPlanId`. The cluster\n   * then gets that plan instead of the active plan of its plan type. Read\n   * only on stages with unlocked cluster plans (local, dev and int).\n   */\n  clusterPlanWhiteList?: string\n  /**\n   * When true, users with only the Developer role cannot create clusters in this org.\n   * Users who also hold Member, Admin, Owner, or Operations Engineer are unaffected.\n   */\n  developerNoClusterCreate?: boolean\n  /**\n   * On dev and int only: the nightly delete cron deletes every cluster of the\n   * org that is older than this number of hours. It asks nobody. Because the\n   * cron runs once a day, a cluster can live up to 24 hours longer. We set it\n   * on our own test orgs, because a paused cluster keeps its disks and costs\n   * money. A sales plan can hold it too: an org copies the limits of its plan\n   * when it gets the plan, thus every later org of that plan gets it. An\n   * editor on prod does not offer it.\n   */\n  preprodClusterTtlHours?: number\n}\n\nexport const RETENTION_LIMIT_MINIMUM = {\n  operate: 5,\n  tasklist: 5,\n  optimize: 5,\n  unified: 5,\n}\nexport const RETENTION_LIMIT_MAXIMUM = {\n  operate: 365,\n  tasklist: 90,\n  optimize: 720,\n  unified: 365,\n}\nexport const RETENTION_LIMIT_DEFAULT = {\n  operate: 30,\n  tasklist: 30,\n  optimize: 180,\n  unified: 30,\n}\n\n/**\n * Default maximum number of clients per cluster on development stage.\n */\nexport const MAX_CLUSTER_CLIENTS_DEV = 10\n\n/**\n * Default maximum number of clients per cluster on integration and production stages.\n */\nexport const MAX_CLUSTER_CLIENTS_DEFAULT = 200\n\nexport function deprecatedLimit(key: string): string | undefined {\n  if (['dataRetentionOperate', 'dataRetentionTasklist'].includes(key)) {\n    return 'unifiedDataRetention'\n  }\n  return undefined\n}\n\nexport function allClusterBasedLimits(): {\n  key: string\n  type: 'number' | 'boolean' | 'string'\n  description: string\n  isClusterBasedLimit: boolean\n  validate?: (input: number) => boolean\n}[] {\n  return [\n    {\n      key: 'dataRetentionOperate',\n      type: 'number',\n      isClusterBasedLimit: true,\n      description: `Data retention in days for Operate. default = ${RETENTION_LIMIT_DEFAULT.operate}days. Min = ${RETENTION_LIMIT_MINIMUM.operate}days, Max = ${RETENTION_LIMIT_MAXIMUM.operate}days.`,\n      validate: (input) =>\n        Number.isInteger(input) &&\n        input >= RETENTION_LIMIT_MINIMUM.operate &&\n        input <= RETENTION_LIMIT_MAXIMUM.operate,\n    },\n    {\n      key: 'dataRetentionTasklist',\n      type: 'number',\n      isClusterBasedLimit: true,\n      description: `Data retention in days for Tasklist. default = ${RETENTION_LIMIT_DEFAULT.tasklist}days. Min = ${RETENTION_LIMIT_MINIMUM.tasklist}days, Max = ${RETENTION_LIMIT_MAXIMUM.tasklist}days.`,\n      validate: (input) =>\n        Number.isInteger(input) &&\n        input >= RETENTION_LIMIT_MINIMUM.tasklist &&\n        input <= RETENTION_LIMIT_MAXIMUM.tasklist,\n    },\n    {\n      key: 'dataRetentionOptimize',\n      type: 'number',\n      isClusterBasedLimit: true,\n      description: `Data retention in days for Optimize. default = ${RETENTION_LIMIT_DEFAULT.optimize}days. Min = ${RETENTION_LIMIT_MINIMUM.optimize}days, Max = ${RETENTION_LIMIT_MAXIMUM.optimize}days.`,\n      validate: (input) =>\n        Number.isInteger(input) &&\n        input >= RETENTION_LIMIT_MINIMUM.optimize &&\n        input <= RETENTION_LIMIT_MAXIMUM.optimize,\n    },\n    {\n      key: 'unifiedDataRetention',\n      type: 'number',\n      isClusterBasedLimit: true,\n      description: `Unified data retention in days for Zeebe broker. default = ${RETENTION_LIMIT_DEFAULT.unified}days. Min = ${RETENTION_LIMIT_MINIMUM.unified}days, Max = ${RETENTION_LIMIT_MAXIMUM.unified}days.`,\n      validate: (input) =>\n        Number.isInteger(input) &&\n        input >= RETENTION_LIMIT_MINIMUM.unified &&\n        input <= RETENTION_LIMIT_MAXIMUM.unified,\n    },\n  ]\n}\n\nexport function allSalesPlanLimits(): {\n  key: string\n  type: 'number' | 'boolean' | 'string'\n  description: string\n  isClusterBasedLimit: boolean\n  validate?: (input: number) => boolean\n  /** An editor on prod does not offer the limit, because only dev and int act on it. */\n  preprodOnly?: boolean\n}[] {\n  return [\n    {\n      key: 'maxMembers',\n      type: 'number',\n      description:\n        'used to limit the amount of collaborators within one organization. default = no limit',\n      isClusterBasedLimit: false,\n      validate: (input) => Number.isInteger(input) && input >= 0,\n    },\n    {\n      key: 'hotBackup',\n      type: 'boolean',\n      description:\n        'used to activate the hot backup functionality in organizations. default = not active',\n      isClusterBasedLimit: false,\n    },\n    {\n      key: 'hotBackupManualRetainedCount',\n      type: 'number',\n      description:\n        'overrides how many manual (on-demand) hot backups the operator retains before deleting the oldest. default = 3',\n      isClusterBasedLimit: false,\n      validate: (input) => Number.isInteger(input) && input >= 1,\n    },\n    {\n      key: 'hotBackupScheduledRetainedCount',\n      type: 'number',\n      description:\n        'overrides how many scheduled hot backups the operator retains before deleting the oldest. default = 3',\n      isClusterBasedLimit: false,\n      validate: (input) => Number.isInteger(input) && input >= 1,\n    },\n    {\n      key: 'ipWhiteList',\n      type: 'boolean',\n      description:\n        'used to activate the ipWhitelist feature in console. default = not active',\n      isClusterBasedLimit: false,\n    },\n    {\n      key: 'secureConnectivity',\n      type: 'boolean',\n      description:\n        'used to activate the secure connectivity feature in console. default = not active',\n      isClusterBasedLimit: false,\n    },\n    {\n      key: 'failover',\n      type: 'boolean',\n      description:\n        'used to activate the failover functionality for multi-region clusters. default = not active',\n      isClusterBasedLimit: false,\n    },\n    {\n      key: 'allowedHostnamesForInvites',\n      type: 'string',\n      description:\n        'allowed hostnames for invites - comma separated, default: every hostname is allowed',\n      isClusterBasedLimit: false,\n    },\n    {\n      key: 'regionWhiteList',\n      type: 'string',\n      description:\n        'allowed regions - comma separated, default: every region is allowed',\n      isClusterBasedLimit: false,\n    },\n    {\n      key: 'suppressDropDisks',\n      type: 'boolean',\n      description:\n        'used to not drop disks of sleeping clusters. default = not suppressed',\n      isClusterBasedLimit: false,\n    },\n    {\n      key: 'legacyStreams',\n      type: 'boolean',\n      description:\n        'used to allow organizations to use legacy minor streams (e.g. 8.5, 8.6) for cluster creation. default = not allowed',\n      isClusterBasedLimit: false,\n    },\n    {\n      key: 'ignoreGracePeriod',\n      type: 'boolean',\n      description:\n        'used to bypass the 24h grace period on cluster upgrades after a minor version bump. default = not active (grace period enforced)',\n      isClusterBasedLimit: false,\n    },\n    {\n      key: 'maxClusterClients',\n      type: 'number',\n      description: `maximum number of clients per cluster. default = ${MAX_CLUSTER_CLIENTS_DEFAULT} (${MAX_CLUSTER_CLIENTS_DEV} on dev). Can be overridden per org for special customers (e.g. OEM).`,\n      isClusterBasedLimit: false,\n      validate: (input) => Number.isInteger(input) && input >= 1,\n    },\n    {\n      key: 'generationWhiteList',\n      type: 'string',\n      description:\n        'unlocked generation UUIDs - comma separated. These generations will be available for cluster creation regardless of channel membership. Attached to the Stable channel.',\n      isClusterBasedLimit: false,\n    },\n    {\n      key: 'clusterPlanWhiteList',\n      type: 'string',\n      description:\n        'unlocked cluster plan UUIDs - comma separated. On create, a cluster can use one of these plans instead of the active plan of its plan type. The reservation still counts against the plan type. The limit has an effect only on dev and int.',\n      isClusterBasedLimit: false,\n    },\n    {\n      key: 'developerNoClusterCreate',\n      type: 'boolean',\n      description:\n        'when enabled, users with only the Developer role cannot create clusters in this org. Admins, Owners, Members, and Operations Engineers are unaffected.',\n      isClusterBasedLimit: false,\n    },\n    {\n      key: 'preprodClusterTtlHours',\n      type: 'number',\n      description:\n        'dev and int only: the nightly delete cron deletes every cluster of this org that is older than N hours, with no confirmation. On a sales plan, every org that gets the plan later gets the limit too. For our own test orgs. default = not active',\n      isClusterBasedLimit: false,\n      validate: (input) => Number.isInteger(input) && input >= 1,\n      preprodOnly: true,\n    },\n    ...allClusterBasedLimits(),\n  ]\n}\n\nexport function unusedClusterBasedLimits(limits: ClusterLimits): {\n  key: string\n  type: 'number' | 'boolean' | 'string'\n  description: string\n  isClusterBasedLimit: boolean\n}[] {\n  return allClusterBasedLimits().filter(\n    (current) =>\n      !(\n        Object.keys(limits).includes(current.key) &&\n        (limits as Record<string, unknown>)[current.key] !== null\n      ),\n  )\n}\n\n/**\n * Returns whether an editor on the stage offers the limit. A `preprodOnly`\n * limit is offered only on dev and int. Every other limit is offered on\n * every stage.\n */\nexport function isLimitOfferedOnStage(\n  limit: { preprodOnly?: boolean },\n  stage: string,\n): boolean {\n  return !limit.preprodOnly || isPreprodClusterTtlStage(stage)\n}\n\n/**\n * Returns the limits that `limits` does not set yet. With a `stage`, it also\n * leaves out the limits that the stage does not offer.\n */\nexport function unusedSalesPlanLimits(\n  limits: Limits,\n  stage?: string,\n): {\n  key: string\n  type: 'number' | 'boolean' | 'string'\n  description: string\n  isClusterBasedLimit: boolean\n}[] {\n  return allSalesPlanLimits().filter(\n    (current) =>\n      !(\n        Object.keys(limits).includes(current.key) &&\n        (limits as Record<string, unknown>)[current.key] !== null\n      ) &&\n      (stage === undefined || isLimitOfferedOnStage(current, stage)),\n  )\n}\n\n/**\n * Returns the cluster plan uuids of the `clusterPlanWhiteList` limit. A value\n * that is not a string gives no ids, because an old write path did not check\n * the type.\n */\nexport function clusterPlanWhiteListIds(limits: Limits | undefined): string[] {\n  const value: unknown = limits?.clusterPlanWhiteList\n  if (typeof value !== 'string') {\n    return []\n  }\n  return value\n    .split(',')\n    .map((id) => id.trim())\n    .filter((id) => id.length > 0)\n}\n\n/**\n * Returns the generation uuids of the `generationWhiteList` limit. A value\n * that is not a string gives no ids.\n */\nexport function generationWhiteListIds(limits: Limits | undefined): string[] {\n  const value: unknown = limits?.generationWhiteList\n  if (typeof value !== 'string') {\n    return []\n  }\n  return value\n    .split(',')\n    .map((id) => id.trim())\n    .filter((id) => id.length > 0)\n}\n\n/**\n * Says if unlocked cluster plans work on a stage. They work on local, dev and\n * int. They never work on prod, and an unknown stage reads as off. This is a\n * fixed rule of the stage, not a feature flag, so no row can turn it on for\n * prod.\n */\nexport function isUnlockedClusterPlansStage(stage?: string): boolean {\n  return stage === 'local' || stage === 'dev' || stage === 'int'\n}\n\n/**\n * Says if the unlocked cluster plans of the stage offer the limit key. When\n * they are off, `clusterPlanWhiteList` is hidden.\n */\nexport function isLimitKeyEnabled(\n  limitKey: string,\n  unlockedClusterPlans: boolean,\n): boolean {\n  return limitKey !== 'clusterPlanWhiteList' || unlockedClusterPlans\n}\n"],
+  "mappings": "AAOA,SAAS,gCAAgC;AA0FlC,MAAM,0BAA0B;AAAA,EACrC,SAAS;AAAA,EACT,UAAU;AAAA,EACV,UAAU;AAAA,EACV,SAAS;AACX;AACO,MAAM,0BAA0B;AAAA,EACrC,SAAS;AAAA,EACT,UAAU;AAAA,EACV,UAAU;AAAA,EACV,SAAS;AACX;AACO,MAAM,0BAA0B;AAAA,EACrC,SAAS;AAAA,EACT,UAAU;AAAA,EACV,UAAU;AAAA,EACV,SAAS;AACX;AAKO,MAAM,0BAA0B;AAKhC,MAAM,8BAA8B;AAEpC,SAAS,gBAAgB,KAAiC;AAC/D,MAAI,CAAC,wBAAwB,uBAAuB,EAAE,SAAS,GAAG,GAAG;AACnE,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,SAAS,wBAMZ;AACF,SAAO;AAAA,IACL;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,qBAAqB;AAAA,MACrB,aAAa,iDAAiD,wBAAwB,OAAO,eAAe,wBAAwB,OAAO,eAAe,wBAAwB,OAAO;AAAA,MACzL,UAAU,CAAC,UACT,OAAO,UAAU,KAAK,KACtB,SAAS,wBAAwB,WACjC,SAAS,wBAAwB;AAAA,IACrC;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,qBAAqB;AAAA,MACrB,aAAa,kDAAkD,wBAAwB,QAAQ,eAAe,wBAAwB,QAAQ,eAAe,wBAAwB,QAAQ;AAAA,MAC7L,UAAU,CAAC,UACT,OAAO,UAAU,KAAK,KACtB,SAAS,wBAAwB,YACjC,SAAS,wBAAwB;AAAA,IACrC;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,qBAAqB;AAAA,MACrB,aAAa,kDAAkD,wBAAwB,QAAQ,eAAe,wBAAwB,QAAQ,eAAe,wBAAwB,QAAQ;AAAA,MAC7L,UAAU,CAAC,UACT,OAAO,UAAU,KAAK,KACtB,SAAS,wBAAwB,YACjC,SAAS,wBAAwB;AAAA,IACrC;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,qBAAqB;AAAA,MACrB,aAAa,8DAA8D,wBAAwB,OAAO,eAAe,wBAAwB,OAAO,eAAe,wBAAwB,OAAO;AAAA,MACtM,UAAU,CAAC,UACT,OAAO,UAAU,KAAK,KACtB,SAAS,wBAAwB,WACjC,SAAS,wBAAwB;AAAA,IACrC;AAAA,EACF;AACF;AAEO,SAAS,qBAQZ;AACF,SAAO;AAAA,IACL;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aACE;AAAA,MACF,qBAAqB;AAAA,MACrB,UAAU,CAAC,UAAU,OAAO,UAAU,KAAK,KAAK,SAAS;AAAA,IAC3D;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aACE;AAAA,MACF,qBAAqB;AAAA,IACvB;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aACE;AAAA,MACF,qBAAqB;AAAA,MACrB,UAAU,CAAC,UAAU,OAAO,UAAU,KAAK,KAAK,SAAS;AAAA,IAC3D;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aACE;AAAA,MACF,qBAAqB;AAAA,MACrB,UAAU,CAAC,UAAU,OAAO,UAAU,KAAK,KAAK,SAAS;AAAA,IAC3D;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aACE;AAAA,MACF,qBAAqB;AAAA,IACvB;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aACE;AAAA,MACF,qBAAqB;AAAA,IACvB;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aACE;AAAA,MACF,qBAAqB;AAAA,IACvB;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aACE;AAAA,MACF,qBAAqB;AAAA,IACvB;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aACE;AAAA,MACF,qBAAqB;AAAA,IACvB;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aACE;AAAA,MACF,qBAAqB;AAAA,IACvB;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aACE;AAAA,MACF,qBAAqB;AAAA,IACvB;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aACE;AAAA,MACF,qBAAqB;AAAA,IACvB;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aAAa,oDAAoD,2BAA2B,KAAK,uBAAuB;AAAA,MACxH,qBAAqB;AAAA,MACrB,UAAU,CAAC,UAAU,OAAO,UAAU,KAAK,KAAK,SAAS;AAAA,IAC3D;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aACE;AAAA,MACF,qBAAqB;AAAA,IACvB;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aACE;AAAA,MACF,qBAAqB;AAAA,IACvB;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aACE;AAAA,MACF,qBAAqB;AAAA,IACvB;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN,aACE;AAAA,MACF,qBAAqB;AAAA,MACrB,UAAU,CAAC,UAAU,OAAO,UAAU,KAAK,KAAK,SAAS;AAAA,MACzD,aAAa;AAAA,IACf;AAAA,IACA,GAAG,sBAAsB;AAAA,EAC3B;AACF;AAEO,SAAS,yBAAyB,QAKrC;AACF,SAAO,sBAAsB,EAAE;AAAA,IAC7B,CAAC,YACC,EACE,OAAO,KAAK,MAAM,EAAE,SAAS,QAAQ,GAAG,KACvC,OAAmC,QAAQ,GAAG,MAAM;AAAA,EAE3D;AACF;AAOO,SAAS,sBACd,OACA,OACS;AACT,SAAO,CAAC,MAAM,eAAe,yBAAyB,KAAK;AAC7D;AAMO,SAAS,sBACd,QACA,OAME;AACF,SAAO,mBAAmB,EAAE;AAAA,IAC1B,CAAC,YACC,EACE,OAAO,KAAK,MAAM,EAAE,SAAS,QAAQ,GAAG,KACvC,OAAmC,QAAQ,GAAG,MAAM,UAEtD,UAAU,UAAa,sBAAsB,SAAS,KAAK;AAAA,EAChE;AACF;AAOO,SAAS,wBAAwB,QAAsC;AAC5E,QAAM,QAAiB,QAAQ;AAC/B,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,CAAC;AAAA,EACV;AACA,SAAO,MACJ,MAAM,GAAG,EACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,EACrB,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;AACjC;AAMO,SAAS,uBAAuB,QAAsC;AAC3E,QAAM,QAAiB,QAAQ;AAC/B,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,CAAC;AAAA,EACV;AACA,SAAO,MACJ,MAAM,GAAG,EACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,EACrB,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;AACjC;AAQO,SAAS,4BAA4B,OAAyB;AACnE,SAAO,UAAU,WAAW,UAAU,SAAS,UAAU;AAC3D;AAMO,SAAS,kBACd,UACA,sBACS;AACT,SAAO,aAAa,0BAA0B;AAChD;",
   "names": []
 }

package/dist/index.d.ts

@@ -1,4 +1,5 @@
-export { CUSTOMER_HARDWARE_SIZING_BROKER_TOTAL_CAPS, CUSTOMER_HARDWARE_SIZING_COUNT_CAPS, CUSTOMER_HARDWARE_SIZING_ELASTICSEARCH_TOTAL_CAPS, CUSTOMER_HARDWARE_SIZING_MAX_AUTO_RESIZE_INCREASE_GI, CUSTOMER_HARDWARE_SIZING_MAX_PLAN_JSON_LENGTH, CUSTOMER_HARDWARE_SIZING_MAX_PLANS_PER_REQUESTER, CUSTOMER_HARDWARE_SIZING_NAME_MAX_LENGTH, CUSTOMER_HARDWARE_SIZING_NAME_MIN_LENGTH, CUSTOMER_HARDWARE_SIZING_REPLICA_SET_TOTAL_CAPS, CUSTOMER_HARDWARE_SIZING_RESOURCE_CAPS, checkCustomerHardwareSizing, isCustomerHardwareSizingStage, parseKubernetesQuantity, } from './constants/customer-hardware-sizing.const.js';
+export { CUSTOM_GENERATION_MAX_PER_REQUESTER, CUSTOM_GENERATION_MAX_UPGRADEABLE_FROM, CUSTOM_GENERATION_NAME_MAX_LENGTH, CUSTOM_GENERATION_NAME_MIN_LENGTH, checkNewGenerationVersions, isCustomGenerationStage, } from './constants/custom-generation.const.js';
+export { CUSTOM_HARDWARE_SIZING_BROKER_TOTAL_CAPS, CUSTOM_HARDWARE_SIZING_COUNT_CAPS, CUSTOM_HARDWARE_SIZING_ELASTICSEARCH_TOTAL_CAPS, CUSTOM_HARDWARE_SIZING_MAX_AUTO_RESIZE_INCREASE_GI, CUSTOM_HARDWARE_SIZING_MAX_PLAN_JSON_LENGTH, CUSTOM_HARDWARE_SIZING_MAX_PLANS_PER_REQUESTER, CUSTOM_HARDWARE_SIZING_NAME_MAX_LENGTH, CUSTOM_HARDWARE_SIZING_NAME_MIN_LENGTH, CUSTOM_HARDWARE_SIZING_REPLICA_SET_TOTAL_CAPS, CUSTOM_HARDWARE_SIZING_RESOURCE_CAPS, checkCustomHardwareSizing, isCustomHardwareSizingStage, parseKubernetesQuantity, } from './constants/custom-hardware-sizing.const.js';
 export { DAY, HOUR, MINUTE, SECOND, WEEK } from './constants/duration.const.js';
 export type { Stage } from './constants/misc.const.js';
 export { CAMUNDA_CLAIMS_NAMESPACE, CONSOLE_API_USER_ID, FIRSTNAME_LASTNAME_MAX_LENGTH, HOTBACKUP_MIN_CREATE_PERIOD, MAX_HARDWARE_PACKAGE_COUNT, MAX_LENGTH_CLUSTER_NAME, MINIMUM_EYEPAIRS, NAMES_OF_ENTERPRISE_SALESPLANS_WITH_SLEEPING_CLUSTERS, SECRETS_MAX_LENGTH, STARTING_PRICE_PER_MONTH_IN_EURO, TEMPORARY_CLUSTER_NAME, UNKNOWN_ACTOR_EMAIL, } from './constants/misc.const.js';
@@ -61,7 +62,7 @@ export type { OrganizationToSalesPlanDto } from './dtos/OrganizationToSalesPlan.
 export type { ReleaseTrainSanityReport, SanityFix, SanityRuleInfo, SanitySeverity, SanityViolation, } from './dtos/ReleaseTrainSanity.dto.js';
 export type { RestoreDto, RestoreState } from './dtos/Restore.dto.js';
 export type { ClusterLimits, ConsumptionDataItem, Limits, SalesPlanDto, SalesPlanMetadata, } from './dtos/SalesPlan.dto.js';
-export { allClusterBasedLimits, allSalesPlanLimits, clusterPlanWhiteListIds, deprecatedLimit, isLimitKeyEnabled, isLimitOfferedOnStage, isUnlockedClusterPlansStage, MAX_CLUSTER_CLIENTS_DEFAULT, MAX_CLUSTER_CLIENTS_DEV, RETENTION_LIMIT_DEFAULT, RETENTION_LIMIT_MAXIMUM, RETENTION_LIMIT_MINIMUM, unusedClusterBasedLimits, unusedSalesPlanLimits, } from './dtos/SalesPlan.dto.js';
+export { allClusterBasedLimits, allSalesPlanLimits, clusterPlanWhiteListIds, deprecatedLimit, generationWhiteListIds, isLimitKeyEnabled, isLimitOfferedOnStage, isUnlockedClusterPlansStage, MAX_CLUSTER_CLIENTS_DEFAULT, MAX_CLUSTER_CLIENTS_DEV, RETENTION_LIMIT_DEFAULT, RETENTION_LIMIT_MAXIMUM, RETENTION_LIMIT_MINIMUM, unusedClusterBasedLimits, unusedSalesPlanLimits, } from './dtos/SalesPlan.dto.js';
 export type { SecureConnectivityDto } from './dtos/SecureConnectivity.dto.js';
 export type { SignupDto } from './dtos/Signup.dto.js';
 export type { StorybookConfig, StorybookConfigBackup, StorybookConfigChannel, StorybookConfigDatacenter, StorybookConfigGeneration, } from './dtos/StorybookConfig.dto.js';
@@ -115,7 +116,7 @@ export { ClusterPlanTypeAvailabilityClass, hasNoAvailabilityClass, sortByAvailab
 export { ClusterPlanTypeCategory, hasAvailabilityClass, sortByClusterPlanTypeCategory, } from './types/ClusterPlanTypeCategory.type.js';
 export type { ClusterPlanTypesToConfig } from './types/ClusterPlanTypesToConfig.type.js';
 export type { ClusterPlanTypesToReserved } from './types/ClusterPlanTypesToReserved.type.js';
-export type { ClusterTtlDto, ClusterTtlDuration, ClusterTtlOption, ClusterTtlUnlimited, UpdateClusterTtlBody, } from './types/ClusterTtl.type.js';
+export type { ClusterTtlDeletionPayload, ClusterTtlDeletionResult, ClusterTtlDto, ClusterTtlDuration, ClusterTtlOption, ClusterTtlUnlimited, UpdateClusterTtlBody, } from './types/ClusterTtl.type.js';
 export { CLUSTER_TTL_BACKFILL_REASON, CLUSTER_TTL_DURATION_MS, CLUSTER_TTL_DURATIONS, CLUSTER_TTL_FEATURE_FLAG, CLUSTER_TTL_OPTIONS, CLUSTER_TTL_UNLIMITED_LINK_MAX_LENGTH, CLUSTER_TTL_UNLIMITED_REASON_MAX_LENGTH, clusterTtlExpiresAt, DEFAULT_CLUSTER_TTL_OPTION, extendClusterTtl, isClusterTtlDuration, isClusterTtlOption, isClusterTtlStage, isHttpUrl, isPastClusterTtl, validateClusterTtlUnlimited, } from './types/ClusterTtl.type.js';
 export type { ClusterUsageDataRequest, ClusterUsageMetricsAddRequestByMetricHeap, ClusterUsageMetricsData, ClusterUsageMetricsFilter, ClusterUsageOrgStartDate, } from './types/ClusterUsageMetrics.type.js';
 export { ConsoleSM } from './types/ConsoleSelfManaged.type.js';

package/dist/index.js

@@ -1,18 +1,26 @@
 import {
-  CUSTOMER_HARDWARE_SIZING_BROKER_TOTAL_CAPS,
-  CUSTOMER_HARDWARE_SIZING_COUNT_CAPS,
-  CUSTOMER_HARDWARE_SIZING_ELASTICSEARCH_TOTAL_CAPS,
-  CUSTOMER_HARDWARE_SIZING_MAX_AUTO_RESIZE_INCREASE_GI,
-  CUSTOMER_HARDWARE_SIZING_MAX_PLAN_JSON_LENGTH,
-  CUSTOMER_HARDWARE_SIZING_MAX_PLANS_PER_REQUESTER,
-  CUSTOMER_HARDWARE_SIZING_NAME_MAX_LENGTH,
-  CUSTOMER_HARDWARE_SIZING_NAME_MIN_LENGTH,
-  CUSTOMER_HARDWARE_SIZING_REPLICA_SET_TOTAL_CAPS,
-  CUSTOMER_HARDWARE_SIZING_RESOURCE_CAPS,
-  checkCustomerHardwareSizing,
-  isCustomerHardwareSizingStage,
+  CUSTOM_GENERATION_MAX_PER_REQUESTER,
+  CUSTOM_GENERATION_MAX_UPGRADEABLE_FROM,
+  CUSTOM_GENERATION_NAME_MAX_LENGTH,
+  CUSTOM_GENERATION_NAME_MIN_LENGTH,
+  checkNewGenerationVersions,
+  isCustomGenerationStage
+} from "./constants/custom-generation.const.js";
+import {
+  CUSTOM_HARDWARE_SIZING_BROKER_TOTAL_CAPS,
+  CUSTOM_HARDWARE_SIZING_COUNT_CAPS,
+  CUSTOM_HARDWARE_SIZING_ELASTICSEARCH_TOTAL_CAPS,
+  CUSTOM_HARDWARE_SIZING_MAX_AUTO_RESIZE_INCREASE_GI,
+  CUSTOM_HARDWARE_SIZING_MAX_PLAN_JSON_LENGTH,
+  CUSTOM_HARDWARE_SIZING_MAX_PLANS_PER_REQUESTER,
+  CUSTOM_HARDWARE_SIZING_NAME_MAX_LENGTH,
+  CUSTOM_HARDWARE_SIZING_NAME_MIN_LENGTH,
+  CUSTOM_HARDWARE_SIZING_REPLICA_SET_TOTAL_CAPS,
+  CUSTOM_HARDWARE_SIZING_RESOURCE_CAPS,
+  checkCustomHardwareSizing,
+  isCustomHardwareSizingStage,
   parseKubernetesQuantity
-} from "./constants/customer-hardware-sizing.const.js";
+} from "./constants/custom-hardware-sizing.const.js";
 import { DAY, HOUR, MINUTE, SECOND, WEEK } from "./constants/duration.const.js";
 import {
   CAMUNDA_CLAIMS_NAMESPACE,
@@ -279,6 +287,7 @@ import {
   allSalesPlanLimits,
   clusterPlanWhiteListIds,
   deprecatedLimit,
+  generationWhiteListIds,
   isLimitKeyEnabled,
   isLimitOfferedOnStage,
   isUnlockedClusterPlansStage,
@@ -642,16 +651,20 @@ export {
   CONNECTOR_MANAGEMENT_METRICS_MIN_VERSION,
   CONNECTOR_SECRET_SYNC_MIN_VERSION,
   CONSOLE_API_USER_ID,
-  CUSTOMER_HARDWARE_SIZING_BROKER_TOTAL_CAPS,
-  CUSTOMER_HARDWARE_SIZING_COUNT_CAPS,
-  CUSTOMER_HARDWARE_SIZING_ELASTICSEARCH_TOTAL_CAPS,
-  CUSTOMER_HARDWARE_SIZING_MAX_AUTO_RESIZE_INCREASE_GI,
-  CUSTOMER_HARDWARE_SIZING_MAX_PLANS_PER_REQUESTER,
-  CUSTOMER_HARDWARE_SIZING_MAX_PLAN_JSON_LENGTH,
-  CUSTOMER_HARDWARE_SIZING_NAME_MAX_LENGTH,
-  CUSTOMER_HARDWARE_SIZING_NAME_MIN_LENGTH,
-  CUSTOMER_HARDWARE_SIZING_REPLICA_SET_TOTAL_CAPS,
-  CUSTOMER_HARDWARE_SIZING_RESOURCE_CAPS,
+  CUSTOM_GENERATION_MAX_PER_REQUESTER,
+  CUSTOM_GENERATION_MAX_UPGRADEABLE_FROM,
+  CUSTOM_GENERATION_NAME_MAX_LENGTH,
+  CUSTOM_GENERATION_NAME_MIN_LENGTH,
+  CUSTOM_HARDWARE_SIZING_BROKER_TOTAL_CAPS,
+  CUSTOM_HARDWARE_SIZING_COUNT_CAPS,
+  CUSTOM_HARDWARE_SIZING_ELASTICSEARCH_TOTAL_CAPS,
+  CUSTOM_HARDWARE_SIZING_MAX_AUTO_RESIZE_INCREASE_GI,
+  CUSTOM_HARDWARE_SIZING_MAX_PLANS_PER_REQUESTER,
+  CUSTOM_HARDWARE_SIZING_MAX_PLAN_JSON_LENGTH,
+  CUSTOM_HARDWARE_SIZING_NAME_MAX_LENGTH,
+  CUSTOM_HARDWARE_SIZING_NAME_MIN_LENGTH,
+  CUSTOM_HARDWARE_SIZING_REPLICA_SET_TOTAL_CAPS,
+  CUSTOM_HARDWARE_SIZING_RESOURCE_CAPS,
   ChartQueryError,
   ClusterBulkOperationStatus,
   ClusterBulkOperationType,
@@ -839,7 +852,8 @@ export {
   chartBucketStart,
   chartToday,
   chartWindowRange,
-  checkCustomerHardwareSizing,
+  checkCustomHardwareSizing,
+  checkNewGenerationVersions,
   checkNoteBody,
   checkTagName,
   checkVersion,
@@ -875,6 +889,7 @@ export {
   findSearchField,
   formatChartSpec,
   generationImageErrorMessage,
+  generationWhiteListIds,
   getAnalyticsSalesPlanFromOrgSalesPlan,
   getApplicableRolesForEmployee,
   getCloudProviderLabel,
@@ -912,7 +927,8 @@ export {
   isClusterTtlDuration,
   isClusterTtlOption,
   isClusterTtlStage,
-  isCustomerHardwareSizingStage,
+  isCustomGenerationStage,
+  isCustomHardwareSizingStage,
   isDnsSubdomain,
   isEncryptionStatus,
   isExpired,