@camunda/ccma-shared-types 9.1.0 → 9.2.0

package/dist/approvals/policy.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/approvals/policy.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { UNKNOWN_ACTOR_EMAIL } from '../constants/misc.const.js'\nimport type {\n  ApprovalJobDto,\n  ApprovalUseCaseDto,\n} from '../dtos/ApprovalJob.dto.js'\nimport { ConsolePermissions } from '../permissions/console.permissions.js'\n\n/**\n * The rules of the approval mechanism, as pure functions.\n *\n * Three consumers run this file: control-backend decides whether to reject a\n * request, control-frontend decides whether to disable a button, and cloudbot\n * decides whether to answer. One copy means the button and the endpoint can\n * never disagree.\n *\n * Two choices in the signatures carry the design:\n *\n * - The actor is an interface with a `has` method. The backend holds an array\n *   of Auth0 claims, and `useSession()` in the frontend gives a flat record of\n *   booleans. Neither side has to convert to the shape of the other.\n * - `now` is a parameter. The expiry is lazy, so a stored `pending` request can\n *   be expired already. A parameter makes a difference between the two clocks\n *   an input that a test can set, and not a silent disagreement.\n *\n * No function here does I/O or returns a promise. The browser call site is what\n * enforces that, and it also stops a later use case from turning a list of 50\n * rows into 200 network calls.\n */\n\n/** Who is asking. See the note above on why this is an interface. */\nexport interface ApprovalActorView {\n  userId: string\n  /**\n   * The email of the actor. It is the SECOND identity of the four-eyes rule.\n   *\n   * `userId` alone is not enough. One person can hold more than one identity in\n   * Auth0 \u2014 a connection through SSO and a connection through a database, or an\n   * account that was made again \u2014 and each one carries a different `sub`. The\n   * same human then opens a request with one identity and approves it with the\n   * other, which is the rule defeated.\n   *\n   * It is optional because a token can carry no email. See\n   * `isSameActorEmail` for what that means for the comparison.\n   */\n  email?: string\n  has(permission: string): boolean\n}\n\n/**\n * Builds the `has` of an actor from the permissions that the actor holds.\n *\n * `ConsolePermissions.APPROVALS_ALL_USE_CASES` stands in for every permission\n * that a use case asks for. Both actor builders call this function, the one of\n * control-backend and the one of the browser, so the button and the route\n * agree on it. A rule that reads `actor.has` needs no change for it, and nor\n * does a use case that a later change adds.\n */\nexport function approvalPermissionCheck(\n  held: ReadonlySet<string>,\n): (permission: string) => boolean {\n  const all = held.has(ConsolePermissions.APPROVALS_ALL_USE_CASES)\n  return (permission) => all || held.has(permission)\n}\n\n/**\n * Reports whether two email addresses name one person.\n *\n * Two values that are absent, empty, or `UNKNOWN_ACTOR_EMAIL` are NOT one\n * person. A token with no email would otherwise make every actor equal to\n * every other actor, and the rule would refuse everybody.\n *\n * The comparison removes the spaces and the case. Auth0 gives the address as\n * the identity provider wrote it, so `A.B@camunda.com` and `a.b@camunda.com`\n * are one mailbox and must not pass as two people.\n */\nexport function isSameActorEmail(one?: string, other?: string): boolean {\n  const left = comparableActorEmail(one)\n  return left.length > 0 && left === comparableActorEmail(other)\n}\n\n/**\n * The address in the one form that a comparison may use.\n *\n * An absent address, an empty one and `UNKNOWN_ACTOR_EMAIL` all become an\n * empty string, because none of the three names a person. The spaces and the\n * case go as well: Auth0 gives the address as the identity provider wrote it.\n */\nfunction comparableActorEmail(value?: string): string {\n  const trimmed = value?.trim().toLowerCase() ?? ''\n  return trimmed === UNKNOWN_ACTOR_EMAIL ? '' : trimmed\n}\n\n/**\n * Reports whether one identity of a request names the actor.\n *\n * The `sub` of the token OR the email, because one person can hold more than\n * one Auth0 identity. Every rule that asks \"is this the same human?\" reads both\n * through this function, so a rule cannot forget the second half: `canWithdraw`\n * did, and it refused a creator whose browser and whose service resolved the\n * id from two different tokens.\n */\nexport function isSameActor(\n  identity: { userId: string; email?: string },\n  actor: ApprovalActorView,\n): boolean {\n  return (\n    identity.userId === actor.userId ||\n    isSameActorEmail(identity.email, actor.email)\n  )\n}\n\n/**\n * Reports whether this actor carries an address that names a person.\n *\n * A machine-to-machine token carries none: accounts-backend builds the\n * permissions of such a token from its `permissions` claim alone, and there is\n * no person behind it. See `creatorEmailRequired` of the use case.\n */\nexport function hasActorEmail(actor: ApprovalActorView): boolean {\n  return comparableActorEmail(actor.email).length > 0\n}\n\n/**\n * Why an action is not allowed.\n *\n * The code is for a program: control-backend maps it to a status, and the\n * frontend can branch on it. The message is for a person, and it is shown as\n * written.\n */\nexport type ApprovalDenialCode =\n  | 'forbidden'\n  | 'not-pending'\n  | 'self-approval'\n  | 'self-rejection'\n  | 'already-acknowledged'\n  | 'expired'\n  | 'not-creator'\n  | 'not-executable'\n  | 'no-reason'\n  | 'too-few-acks'\n  | 'no-creator-email'\n\nexport type ApprovalDecision =\n  | { allowed: true }\n  | { allowed: false; code: ApprovalDenialCode; message: string }\n\nconst ALLOWED: ApprovalDecision = { allowed: true }\n\nfunction deny(code: ApprovalDenialCode, message: string): ApprovalDecision {\n  return { allowed: false, code, message }\n}\n\n/**\n * Reports whether the time to answer a request has passed.\n *\n * Only a `pending` request expires. A request that already reached an end state\n * keeps that state, because \"expired\" would lose the answer that was given.\n */\nexport function isExpired(job: ApprovalJobDto, now: Date): boolean {\n  return (\n    job.status === 'pending' &&\n    new Date(job.expiresAt).getTime() <= now.getTime()\n  )\n}\n\n/** Reports the status to show, which is `expired` once the time has passed. */\nexport function effectiveStatus(\n  job: ApprovalJobDto,\n  now: Date,\n): ApprovalJobDto['status'] {\n  return isExpired(job, now) ? 'expired' : job.status\n}\n\n/** Reports how many more acknowledgements the request needs. */\nexport function remainingAcks(job: ApprovalJobDto): number {\n  return Math.max(0, job.requiredAcks - job.acks.length)\n}\n\n/**\n * Reports whether the actor holds EVERY permission of the set.\n *\n * Every, and not one of them. A payload that raises the guard adds a\n * permission, so \"one of them\" would let the base permission alone carry a\n * request that the extra permission exists to stop.\n *\n * An EMPTY set is held by nobody. That is the opposite of what `Array.every`\n * answers, and it is deliberate: this function guards a privileged action, so\n * the empty case must fail closed. A row with no permissions is not a row that\n * everybody may run \u2014 it is a row that lost its guard, through a migration\n * that did not backfill it or a write that went around the service. Every use\n * case builds a set of at least one, so no real request meets this branch.\n */\nexport function hasEveryPermission(\n  actor: ApprovalActorView,\n  permissions: string[],\n): boolean {\n  if (permissions.length === 0) {\n    return false\n  }\n  return permissions.every((permission) => actor.has(permission))\n}\n\n/**\n * What a person must hold to act on a request.\n *\n * A request carries its own set, because a payload can raise the guard. A use\n * case that never does has a set of one, and it is the base permission.\n */\nexport function requiredPermissionsOf(job: ApprovalJobDto): string[] {\n  return job.requiredPermissions\n}\n\n/**\n * Who can READ a request.\n *\n * Two people: one who can act on it, and the one who opened it. A Camundi who\n * holds neither has no reason to read which customer somebody proposed to\n * expire, so the list and the detail both hide it.\n *\n * The rule reads the BASE permission of the use case and not the effective set\n * of the request. A payload that raises the guard raises who can APPROVE, and\n * not who can look: a generation update with the yolo flag is visible to\n * everybody who can approve a plain one, and only the yolo permission runs it.\n * The list filters by use case in SQL, which is what makes one page of rows\n * the same page that a person is allowed to read.\n */\nexport function canView(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  useCase: ApprovalUseCaseDto,\n): ApprovalDecision {\n  if (\n    actor.has(useCase.requiredPermission) ||\n    isSameActor(job.createdBy, actor)\n  ) {\n    return ALLOWED\n  }\n  return deny('forbidden', 'You cannot see this request.')\n}\n\n/**\n * Who can OPEN a request, and with what.\n *\n * `createPermission` is what keeps the pool that asks as small as the pool that\n * approves. A use case that leaves it absent says the opposite on purpose: the\n * approvals are the guard, and anybody signed in can propose the action.\n *\n * The two checks after it are about the request and not about the person. A\n * count below the floor of the use case, and a missing reason, are both a 400\n * and not a 403, so the words say which one the caller must repair.\n */\nexport function canCreate(\n  actor: ApprovalActorView,\n  useCase: ApprovalUseCaseDto,\n  request: {\n    reason?: string\n    requiredAcks?: number\n    /**\n     * The effective permissions of the payload, from `permissionsFor`.\n     *\n     * Absent means \"the base permission alone\", which is what most use cases\n     * build. Only the permissions ABOVE the base one gate opening a request:\n     * see the note in the body.\n     */\n    requiredPermissions?: string[]\n  } = {},\n): ApprovalDecision {\n  // The message NAMES the permission. \"You cannot open this request\" is true\n  // and useless: a Camundi who reads it cannot tell a missing permission from\n  // a rule they never heard of, and the detail page already names a permission\n  // the same way (\"Approving needs aacp\").\n  if (useCase.createPermission && !actor.has(useCase.createPermission)) {\n    return deny(\n      'forbidden',\n      `Opening this request needs ${useCase.createPermission}, and you do not hold it.`,\n    )\n  }\n  // What the PAYLOAD raised, on top of the base permission of the use case.\n  // A bulk generation update with the yolo flag needs the yolo permission, and\n  // without this check a person who holds the base permission alone could open\n  // one. They could not approve it and could not run it, so it is not an\n  // escalation \u2014 it is a request that its own author is not allowed to make,\n  // waiting in the queue of the people who are.\n  //\n  // The BASE permission is deliberately not checked here. `createPermission`\n  // above is the only gate on the person, and a use case that leaves it absent\n  // means that anybody signed in can propose the action. Checking the base\n  // permission too would take that choice away from every use case.\n  const raised = (request.requiredPermissions ?? []).filter(\n    (permission) => permission !== useCase.requiredPermission,\n  )\n  if (raised.length > 0 && !hasEveryPermission(actor, raised)) {\n    return deny(\n      'forbidden',\n      `This payload needs ${raised.join(' and ')}, and you do not hold it.`,\n    )\n  }\n  // A request that needs no approval RUNS when it is opened, so the person who\n  // opens it must hold what running it needs. Every other use case leaves this\n  // to the approvals, which is why the base permission is not checked above.\n  // With a floor of zero there is no approval to leave it to.\n  const toRun = request.requiredPermissions ?? [useCase.requiredPermission]\n  // A service that opens a request of its own use case holds the\n  // `createPermission` checked above, and that is the guard of the run. Without\n  // a `createPermission` there is no such guard, so the flag lifts nothing.\n  const openedBySystem = useCase.openedBySystem && !!useCase.createPermission\n  if (\n    resolveRequiredAcks(useCase, request.requiredAcks) === 0 &&\n    !useCase.openToEveryone &&\n    !openedBySystem &&\n    !hasEveryPermission(actor, toRun)\n  ) {\n    // The message NAMES the permission, and it says why opening needs it. A\n    // Camundi who reads \"you cannot open this request\" for an action that\n    // needs no approval cannot tell which of the two rules refused them.\n    return deny(\n      'forbidden',\n      `This request needs no approval, so opening it runs it. That needs ` +\n        `${toRun.join(' and ')}, and you do not hold it.`,\n    )\n  }\n  // The action of this use case carries the address of the person who asked,\n  // so a caller with no address must be refused HERE. The alternative is a\n  // request that looks ordinary, collects its approvals over days, and then\n  // fails because the other service cannot find a user called \"unknown\".\n  if (useCase.creatorEmailRequired && !hasActorEmail(actor)) {\n    return deny(\n      'no-creator-email',\n      'This action needs the email address of the person who asks for it, ' +\n        'and your session carries none. Sign in as a person to open this ' +\n        'request.',\n    )\n  }\n  if (useCase.reasonRequired && (request.reason ?? '').trim().length === 0) {\n    return deny('no-reason', 'Give a reason to open this request.')\n  }\n  if (\n    request.requiredAcks !== undefined &&\n    request.requiredAcks < useCase.minAcks\n  ) {\n    return deny(\n      'too-few-acks',\n      `This action needs at least ${useCase.minAcks} approvals.`,\n    )\n  }\n  return ALLOWED\n}\n\n/**\n * The approvals that a new request asks for.\n *\n * The caller names a number or names none. A number below the floor is refused\n * by `canCreate`, and this function holds the answer inside the range anyway:\n * the two run in the same call, and a floor that only one of them knows is a\n * floor that a later caller can step over.\n */\nexport function resolveRequiredAcks(\n  useCase: ApprovalUseCaseDto,\n  requested?: number,\n): number {\n  if (requested === undefined) {\n    return Math.max(useCase.defaultAcks, useCase.minAcks)\n  }\n  return Math.max(Math.trunc(requested), useCase.minAcks)\n}\n\n/**\n * The four-eyes rule.\n *\n * The bans are in the order a person meets them, and each one has its own\n * message: \"you already approved this\" and \"you cannot approve your own\n * request\" are different mistakes, and one message for both helps nobody.\n *\n * Each of the two bans on a person reads BOTH identities: the `sub` of the\n * token, and the email. See `ApprovalActorView.email` for why one of them is\n * not enough.\n */\nexport function canAcknowledge(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  now: Date,\n): ApprovalDecision {\n  if (!hasEveryPermission(actor, job.requiredPermissions)) {\n    return deny('forbidden', 'You cannot approve this request.')\n  }\n  if (isExpired(job, now)) {\n    return deny(\n      'expired',\n      'This request expired and can no longer be approved.',\n    )\n  }\n  if (job.status !== 'pending') {\n    return deny(\n      'not-pending',\n      `This request is ${job.status} and can no longer be approved.`,\n    )\n  }\n  if (isSameActor(job.createdBy, actor)) {\n    return deny(\n      'self-approval',\n      'You opened this request, so you cannot approve it.',\n    )\n  }\n  if (job.acks.some((ack) => isSameActor(ack, actor))) {\n    return deny('already-acknowledged', 'You already approved this request.')\n  }\n  return ALLOWED\n}\n\n/**\n * A rejection needs the same permission as an acknowledgement, and a reason.\n *\n * Two people answer a request, and each one has ONE verb. Somebody else\n * approves or rejects it; the person who opened it withdraws it. The creator is\n * refused here for the same reason `canAcknowledge` refuses them: one person\n * must not be both sides of a four-eyes decision. The message names the button\n * that they do have, and the trail loses nothing, because a withdrawal writes\n * its reason into the same field.\n *\n * The ORDER of the checks is the order that a person meets them, and the state\n * of the request comes before the reason. A closed request must answer\n * \"already closed\" whatever the caller typed: with the reason first, a page\n * that had no reason yet read `no-reason` from a rejected request, and the\n * Reject button of control-frontend stayed enabled on a request that nothing\n * could reject any more.\n */\nexport function canReject(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  now: Date,\n  reason: string,\n): ApprovalDecision {\n  if (!hasEveryPermission(actor, job.requiredPermissions)) {\n    return deny('forbidden', 'You cannot reject this request.')\n  }\n  if (isExpired(job, now)) {\n    return deny(\n      'expired',\n      'This request expired and can no longer be rejected.',\n    )\n  }\n  if (job.status !== 'pending') {\n    return deny(\n      'not-pending',\n      `This request is ${job.status} and can no longer be rejected.`,\n    )\n  }\n  if (isSameActor(job.createdBy, actor)) {\n    return deny(\n      'self-rejection',\n      'You opened this request, so withdraw it instead of rejecting it.',\n    )\n  }\n  if (reason.trim().length === 0) {\n    return deny('no-reason', 'Give a reason to reject this request.')\n  }\n  return ALLOWED\n}\n\n/**\n * Only the person who opened a request can take it back.\n *\n * BOTH identities, as every other rule of this file reads them. One person can\n * hold two Auth0 identities with two different `sub` values, and a rule that\n * read the id alone refused the creator their own withdrawal as soon as the\n * browser and the service resolved that id from two different tokens.\n */\nexport function canWithdraw(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  now: Date,\n): ApprovalDecision {\n  if (!isSameActor(job.createdBy, actor)) {\n    return deny(\n      'not-creator',\n      'Only the person who opened a request can withdraw it.',\n    )\n  }\n  if (isExpired(job, now)) {\n    return deny(\n      'expired',\n      'This request expired and can no longer be withdrawn.',\n    )\n  }\n  if (job.status !== 'pending') {\n    return deny(\n      'not-pending',\n      `This request is ${job.status} and can no longer be withdrawn.`,\n    )\n  }\n  return ALLOWED\n}\n\n/**\n * Runs a request that has its approvals.\n *\n * This is the button of the explicit mode. `failed` is executable again,\n * because a failure is often a problem of the system that is now repaired, and\n * asking for the approvals a second time helps nobody.\n *\n * ANY holder of the permission may press it, and not only the person who\n * opened the request. The decision was made when the request reached\n * `approved`: `canAcknowledge` refuses the creator, so the approvals on the\n * row came from other people, and the button only carries out what they\n * already agreed to. Holding the button to the creator would let one Camundi\n * on holiday freeze an approved action, and a use case that must not run\n * without its author has `executionMode: 'auto'` instead.\n *\n * Who PRESSED it and who ASKED for it are two different facts, and both are\n * kept: the audit trail of control-backend records the actor of the run, and\n * an action that names a person to another service names the creator. See\n * `onBehalfOf` of `extend-trial`.\n */\nexport function canExecute(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n): ApprovalDecision {\n  if (!hasEveryPermission(actor, job.requiredPermissions)) {\n    return deny('forbidden', 'You cannot run this request.')\n  }\n  if (job.status !== 'approved' && job.status !== 'failed') {\n    return deny(\n      'not-executable',\n      `This request is ${job.status} and cannot be run.`,\n    )\n  }\n  return ALLOWED\n}\n"],
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { UNKNOWN_ACTOR_EMAIL } from '../constants/misc.const.js'\nimport type {\n  ApprovalJobDto,\n  ApprovalUseCaseDto,\n} from '../dtos/ApprovalJob.dto.js'\nimport { ConsolePermissions } from '../permissions/console.permissions.js'\n\n/**\n * The rules of the approval mechanism, as pure functions.\n *\n * Three consumers run this file: control-backend decides whether to reject a\n * request, control-frontend decides whether to disable a button, and cloudbot\n * decides whether to answer. One copy means the button and the endpoint can\n * never disagree.\n *\n * Two choices in the signatures carry the design:\n *\n * - The actor is an interface with a `has` method. The backend holds an array\n *   of Auth0 claims, and `useSession()` in the frontend gives a flat record of\n *   booleans. Neither side has to convert to the shape of the other.\n * - `now` is a parameter. The expiry is lazy, so a stored `pending` request can\n *   be expired already. A parameter makes a difference between the two clocks\n *   an input that a test can set, and not a silent disagreement.\n *\n * No function here does I/O or returns a promise. The browser call site is what\n * enforces that, and it also stops a later use case from turning a list of 50\n * rows into 200 network calls.\n */\n\n/** Who is asking. See the note above on why this is an interface. */\nexport interface ApprovalActorView {\n  userId: string\n  /**\n   * The email of the actor. It is the SECOND identity of the four-eyes rule.\n   *\n   * `userId` alone is not enough. One person can hold more than one identity in\n   * Auth0 \u2014 a connection through SSO and a connection through a database, or an\n   * account that was made again \u2014 and each one carries a different `sub`. The\n   * same human then opens a request with one identity and approves it with the\n   * other, which is the rule defeated.\n   *\n   * It is optional because a token can carry no email. See\n   * `isSameActorEmail` for what that means for the comparison.\n   */\n  email?: string\n  has(permission: string): boolean\n}\n\n/**\n * Builds the `has` of an actor from the permissions that the actor holds.\n *\n * `ConsolePermissions.APPROVALS_ALL_USE_CASES` stands in for every permission\n * that a use case asks for. Both actor builders call this function, the one of\n * control-backend and the one of the browser, so the button and the route\n * agree on it. A rule that reads `actor.has` needs no change for it, and nor\n * does a use case that a later change adds.\n */\nexport function approvalPermissionCheck(\n  held: ReadonlySet<string>,\n): (permission: string) => boolean {\n  const all = held.has(ConsolePermissions.APPROVALS_ALL_USE_CASES)\n  return (permission) => all || held.has(permission)\n}\n\n/**\n * Reports whether two email addresses name one person.\n *\n * Two values that are absent, empty, or `UNKNOWN_ACTOR_EMAIL` are NOT one\n * person. A token with no email would otherwise make every actor equal to\n * every other actor, and the rule would refuse everybody.\n *\n * The comparison removes the spaces and the case. Auth0 gives the address as\n * the identity provider wrote it, so `A.B@camunda.com` and `a.b@camunda.com`\n * are one mailbox and must not pass as two people.\n */\nexport function isSameActorEmail(one?: string, other?: string): boolean {\n  const left = comparableActorEmail(one)\n  return left.length > 0 && left === comparableActorEmail(other)\n}\n\n/**\n * The address in the one form that a comparison may use.\n *\n * An absent address, an empty one and `UNKNOWN_ACTOR_EMAIL` all become an\n * empty string, because none of the three names a person. The spaces and the\n * case go as well: Auth0 gives the address as the identity provider wrote it.\n */\nfunction comparableActorEmail(value?: string): string {\n  const trimmed = value?.trim().toLowerCase() ?? ''\n  return trimmed === UNKNOWN_ACTOR_EMAIL ? '' : trimmed\n}\n\n/**\n * Reports whether one identity of a request names the actor.\n *\n * The `sub` of the token OR the email, because one person can hold more than\n * one Auth0 identity. Every rule that asks \"is this the same human?\" reads both\n * through this function, so a rule cannot forget the second half: `canWithdraw`\n * did, and it refused a creator whose browser and whose service resolved the\n * id from two different tokens.\n */\nexport function isSameActor(\n  identity: { userId: string; email?: string },\n  actor: ApprovalActorView,\n): boolean {\n  return (\n    identity.userId === actor.userId ||\n    isSameActorEmail(identity.email, actor.email)\n  )\n}\n\n/**\n * Reports whether this actor carries an address that names a person.\n *\n * A machine-to-machine token carries none: accounts-backend builds the\n * permissions of such a token from its `permissions` claim alone, and there is\n * no person behind it. See `creatorEmailRequired` of the use case.\n */\nexport function hasActorEmail(actor: ApprovalActorView): boolean {\n  return comparableActorEmail(actor.email).length > 0\n}\n\n/**\n * Why an action is not allowed.\n *\n * The code is for a program: control-backend maps it to a status, and the\n * frontend can branch on it. The message is for a person, and it is shown as\n * written.\n */\nexport type ApprovalDenialCode =\n  | 'forbidden'\n  | 'not-pending'\n  | 'self-approval'\n  | 'self-rejection'\n  | 'already-acknowledged'\n  | 'expired'\n  | 'not-creator'\n  | 'not-executable'\n  | 'no-reason'\n  | 'too-few-acks'\n  | 'no-creator-email'\n\nexport type ApprovalDecision =\n  | { allowed: true }\n  | { allowed: false; code: ApprovalDenialCode; message: string }\n\nconst ALLOWED: ApprovalDecision = { allowed: true }\n\nfunction deny(code: ApprovalDenialCode, message: string): ApprovalDecision {\n  return { allowed: false, code, message }\n}\n\n/**\n * Reports whether the time to answer a request has passed.\n *\n * Only a `pending` request expires. A request that already reached an end state\n * keeps that state, because \"expired\" would lose the answer that was given.\n */\nexport function isExpired(job: ApprovalJobDto, now: Date): boolean {\n  return (\n    job.status === 'pending' &&\n    new Date(job.expiresAt).getTime() <= now.getTime()\n  )\n}\n\n/** Reports the status to show, which is `expired` once the time has passed. */\nexport function effectiveStatus(\n  job: ApprovalJobDto,\n  now: Date,\n): ApprovalJobDto['status'] {\n  return isExpired(job, now) ? 'expired' : job.status\n}\n\n/** Reports how many more acknowledgements the request needs. */\nexport function remainingAcks(job: ApprovalJobDto): number {\n  return Math.max(0, job.requiredAcks - job.acks.length)\n}\n\n/**\n * Reports whether the actor holds EVERY permission of the set.\n *\n * Every, and not one of them. A payload that raises the guard adds a\n * permission, so \"one of them\" would let the base permission alone carry a\n * request that the extra permission exists to stop.\n *\n * An EMPTY set is held by nobody. That is the opposite of what `Array.every`\n * answers, and it is deliberate: this function guards a privileged action, so\n * the empty case must fail closed. A row with no permissions is not a row that\n * everybody may run \u2014 it is a row that lost its guard, through a migration\n * that did not backfill it or a write that went around the service. Every use\n * case builds a set of at least one, so no real request meets this branch.\n */\nexport function hasEveryPermission(\n  actor: ApprovalActorView,\n  permissions: string[],\n): boolean {\n  if (permissions.length === 0) {\n    return false\n  }\n  return permissions.every((permission) => actor.has(permission))\n}\n\n/**\n * What a person must hold to act on a request.\n *\n * A request carries its own set, because a payload can raise the guard. A use\n * case that never does has a set of one, and it is the base permission.\n */\nexport function requiredPermissionsOf(job: ApprovalJobDto): string[] {\n  return job.requiredPermissions\n}\n\n/**\n * Who can READ a request.\n *\n * Two people: one who can act on it, and the one who opened it. A Camundi who\n * holds neither has no reason to read which customer somebody proposed to\n * expire, so the list and the detail both hide it.\n *\n * The rule reads the BASE permission of the use case and not the effective set\n * of the request. A payload that raises the guard raises who can APPROVE, and\n * not who can look: a generation update with the yolo flag is visible to\n * everybody who can approve a plain one, and only the yolo permission runs it.\n * The list filters by use case in SQL, which is what makes one page of rows\n * the same page that a person is allowed to read.\n */\nexport function canView(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  useCase: ApprovalUseCaseDto,\n): ApprovalDecision {\n  if (\n    actor.has(useCase.requiredPermission) ||\n    isSameActor(job.createdBy, actor)\n  ) {\n    return ALLOWED\n  }\n  return deny('forbidden', 'You cannot see this request.')\n}\n\n/**\n * Who can OPEN a request, and with what.\n *\n * `createPermission` is what keeps the pool that asks as small as the pool that\n * approves. A use case that leaves it absent says the opposite on purpose: the\n * approvals are the guard, and anybody signed in can propose the action.\n *\n * The two checks after it are about the request and not about the person. A\n * count below the floor of the use case, and a missing reason, are both a 400\n * and not a 403, so the words say which one the caller must repair.\n */\nexport function canCreate(\n  actor: ApprovalActorView,\n  useCase: ApprovalUseCaseDto,\n  request: {\n    reason?: string\n    requiredAcks?: number\n    /**\n     * The effective permissions of the payload, from `permissionsFor`.\n     *\n     * Absent means \"the base permission alone\", which is what most use cases\n     * build. Only the permissions ABOVE the base one gate opening a request:\n     * see the note in the body.\n     */\n    requiredPermissions?: string[]\n  } = {},\n): ApprovalDecision {\n  // The message NAMES the permission. \"You cannot open this request\" is true\n  // and useless: a Camundi who reads it cannot tell a missing permission from\n  // a rule they never heard of, and the detail page names the permissions of\n  // a request in the same way.\n  if (useCase.createPermission && !actor.has(useCase.createPermission)) {\n    return deny(\n      'forbidden',\n      `Opening this request needs ${useCase.createPermission}, and you do not hold it.`,\n    )\n  }\n  // What the PAYLOAD raised, on top of the base permission of the use case.\n  // A bulk generation update with the yolo flag needs the yolo permission, and\n  // without this check a person who holds the base permission alone could open\n  // one. They could not approve it and could not run it, so it is not an\n  // escalation \u2014 it is a request that its own author is not allowed to make,\n  // waiting in the queue of the people who are.\n  //\n  // The BASE permission is deliberately not checked here. `createPermission`\n  // above is the only gate on the person, and a use case that leaves it absent\n  // means that anybody signed in can propose the action. Checking the base\n  // permission too would take that choice away from every use case.\n  const raised = (request.requiredPermissions ?? []).filter(\n    (permission) => permission !== useCase.requiredPermission,\n  )\n  if (raised.length > 0 && !hasEveryPermission(actor, raised)) {\n    return deny(\n      'forbidden',\n      `This payload needs ${raised.join(' and ')}, and you do not hold it.`,\n    )\n  }\n  // A request that needs no approval RUNS when it is opened, so the person who\n  // opens it must hold what running it needs. Every other use case leaves this\n  // to the approvals, which is why the base permission is not checked above.\n  // With a floor of zero there is no approval to leave it to.\n  const toRun = request.requiredPermissions ?? [useCase.requiredPermission]\n  // A service that opens a request of its own use case holds the\n  // `createPermission` checked above, and that is the guard of the run. Without\n  // a `createPermission` there is no such guard, so the flag lifts nothing.\n  const openedBySystem = useCase.openedBySystem && !!useCase.createPermission\n  if (\n    resolveRequiredAcks(useCase, request.requiredAcks) === 0 &&\n    !useCase.openToEveryone &&\n    !openedBySystem &&\n    !hasEveryPermission(actor, toRun)\n  ) {\n    // The message NAMES the permission, and it says why opening needs it. A\n    // Camundi who reads \"you cannot open this request\" for an action that\n    // needs no approval cannot tell which of the two rules refused them.\n    return deny(\n      'forbidden',\n      `This request needs no approval, so opening it runs it. That needs ` +\n        `${toRun.join(' and ')}, and you do not hold it.`,\n    )\n  }\n  // The action of this use case carries the address of the person who asked,\n  // so a caller with no address must be refused HERE. The alternative is a\n  // request that looks ordinary, collects its approvals over days, and then\n  // fails because the other service cannot find a user called \"unknown\".\n  if (useCase.creatorEmailRequired && !hasActorEmail(actor)) {\n    return deny(\n      'no-creator-email',\n      'This action needs the email address of the person who asks for it, ' +\n        'and your session carries none. Sign in as a person to open this ' +\n        'request.',\n    )\n  }\n  if (useCase.reasonRequired && (request.reason ?? '').trim().length === 0) {\n    return deny('no-reason', 'Give a reason to open this request.')\n  }\n  if (\n    request.requiredAcks !== undefined &&\n    request.requiredAcks < useCase.minAcks\n  ) {\n    return deny(\n      'too-few-acks',\n      `This action needs at least ${useCase.minAcks} approvals.`,\n    )\n  }\n  return ALLOWED\n}\n\n/**\n * The approvals that a new request asks for.\n *\n * The caller names a number or names none. A number below the floor is refused\n * by `canCreate`, and this function holds the answer inside the range anyway:\n * the two run in the same call, and a floor that only one of them knows is a\n * floor that a later caller can step over.\n */\nexport function resolveRequiredAcks(\n  useCase: ApprovalUseCaseDto,\n  requested?: number,\n): number {\n  if (requested === undefined) {\n    return Math.max(useCase.defaultAcks, useCase.minAcks)\n  }\n  return Math.max(Math.trunc(requested), useCase.minAcks)\n}\n\n/**\n * The four-eyes rule.\n *\n * The bans are in the order a person meets them, and each one has its own\n * message: \"you already approved this\" and \"you cannot approve your own\n * request\" are different mistakes, and one message for both helps nobody.\n *\n * Each of the two bans on a person reads BOTH identities: the `sub` of the\n * token, and the email. See `ApprovalActorView.email` for why one of them is\n * not enough.\n */\nexport function canAcknowledge(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  now: Date,\n): ApprovalDecision {\n  if (!hasEveryPermission(actor, job.requiredPermissions)) {\n    return deny('forbidden', 'You cannot approve this request.')\n  }\n  if (isExpired(job, now)) {\n    return deny(\n      'expired',\n      'This request expired and can no longer be approved.',\n    )\n  }\n  if (job.status !== 'pending') {\n    return deny(\n      'not-pending',\n      `This request is ${job.status} and can no longer be approved.`,\n    )\n  }\n  if (isSameActor(job.createdBy, actor)) {\n    return deny(\n      'self-approval',\n      'You opened this request, so you cannot approve it.',\n    )\n  }\n  if (job.acks.some((ack) => isSameActor(ack, actor))) {\n    return deny('already-acknowledged', 'You already approved this request.')\n  }\n  return ALLOWED\n}\n\n/**\n * A rejection needs the same permission as an acknowledgement, and a reason.\n *\n * Two people answer a request, and each one has ONE verb. Somebody else\n * approves or rejects it; the person who opened it withdraws it. The creator is\n * refused here for the same reason `canAcknowledge` refuses them: one person\n * must not be both sides of a four-eyes decision. The message names the button\n * that they do have, and the trail loses nothing, because a withdrawal writes\n * its reason into the same field.\n *\n * The ORDER of the checks is the order that a person meets them, and the state\n * of the request comes before the reason. A closed request must answer\n * \"already closed\" whatever the caller typed: with the reason first, a page\n * that had no reason yet read `no-reason` from a rejected request, and the\n * Reject button of control-frontend stayed enabled on a request that nothing\n * could reject any more.\n */\nexport function canReject(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  now: Date,\n  reason: string,\n): ApprovalDecision {\n  if (!hasEveryPermission(actor, job.requiredPermissions)) {\n    return deny('forbidden', 'You cannot reject this request.')\n  }\n  if (isExpired(job, now)) {\n    return deny(\n      'expired',\n      'This request expired and can no longer be rejected.',\n    )\n  }\n  if (job.status !== 'pending') {\n    return deny(\n      'not-pending',\n      `This request is ${job.status} and can no longer be rejected.`,\n    )\n  }\n  if (isSameActor(job.createdBy, actor)) {\n    return deny(\n      'self-rejection',\n      'You opened this request, so withdraw it instead of rejecting it.',\n    )\n  }\n  if (reason.trim().length === 0) {\n    return deny('no-reason', 'Give a reason to reject this request.')\n  }\n  return ALLOWED\n}\n\n/**\n * Only the person who opened a request can take it back.\n *\n * BOTH identities, as every other rule of this file reads them. One person can\n * hold two Auth0 identities with two different `sub` values, and a rule that\n * read the id alone refused the creator their own withdrawal as soon as the\n * browser and the service resolved that id from two different tokens.\n */\nexport function canWithdraw(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  now: Date,\n): ApprovalDecision {\n  if (!isSameActor(job.createdBy, actor)) {\n    return deny(\n      'not-creator',\n      'Only the person who opened a request can withdraw it.',\n    )\n  }\n  if (isExpired(job, now)) {\n    return deny(\n      'expired',\n      'This request expired and can no longer be withdrawn.',\n    )\n  }\n  if (job.status !== 'pending') {\n    return deny(\n      'not-pending',\n      `This request is ${job.status} and can no longer be withdrawn.`,\n    )\n  }\n  return ALLOWED\n}\n\n/**\n * Runs a request that has its approvals.\n *\n * This is the button of the explicit mode. `failed` is executable again,\n * because a failure is often a problem of the system that is now repaired, and\n * asking for the approvals a second time helps nobody.\n *\n * ANY holder of the permission may press it, and not only the person who\n * opened the request. The decision was made when the request reached\n * `approved`: `canAcknowledge` refuses the creator, so the approvals on the\n * row came from other people, and the button only carries out what they\n * already agreed to. Holding the button to the creator would let one Camundi\n * on holiday freeze an approved action, and a use case that must not run\n * without its author has `executionMode: 'auto'` instead.\n *\n * Who PRESSED it and who ASKED for it are two different facts, and both are\n * kept: the audit trail of control-backend records the actor of the run, and\n * an action that names a person to another service names the creator. See\n * `onBehalfOf` of `extend-trial`.\n */\nexport function canExecute(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n): ApprovalDecision {\n  if (!hasEveryPermission(actor, job.requiredPermissions)) {\n    return deny('forbidden', 'You cannot run this request.')\n  }\n  if (job.status !== 'approved' && job.status !== 'failed') {\n    return deny(\n      'not-executable',\n      `This request is ${job.status} and cannot be run.`,\n    )\n  }\n  return ALLOWED\n}\n"],
   "mappings": "AAMA,SAAS,2BAA2B;AAKpC,SAAS,0BAA0B;AAoD5B,SAAS,wBACd,MACiC;AACjC,QAAM,MAAM,KAAK,IAAI,mBAAmB,uBAAuB;AAC/D,SAAO,CAAC,eAAe,OAAO,KAAK,IAAI,UAAU;AACnD;AAaO,SAAS,iBAAiB,KAAc,OAAyB;AACtE,QAAM,OAAO,qBAAqB,GAAG;AACrC,SAAO,KAAK,SAAS,KAAK,SAAS,qBAAqB,KAAK;AAC/D;AASA,SAAS,qBAAqB,OAAwB;AACpD,QAAM,UAAU,OAAO,KAAK,EAAE,YAAY,KAAK;AAC/C,SAAO,YAAY,sBAAsB,KAAK;AAChD;AAWO,SAAS,YACd,UACA,OACS;AACT,SACE,SAAS,WAAW,MAAM,UAC1B,iBAAiB,SAAS,OAAO,MAAM,KAAK;AAEhD;AASO,SAAS,cAAc,OAAmC;AAC/D,SAAO,qBAAqB,MAAM,KAAK,EAAE,SAAS;AACpD;AA0BA,MAAM,UAA4B,EAAE,SAAS,KAAK;AAElD,SAAS,KAAK,MAA0B,SAAmC;AACzE,SAAO,EAAE,SAAS,OAAO,MAAM,QAAQ;AACzC;AAQO,SAAS,UAAU,KAAqB,KAAoB;AACjE,SACE,IAAI,WAAW,aACf,IAAI,KAAK,IAAI,SAAS,EAAE,QAAQ,KAAK,IAAI,QAAQ;AAErD;AAGO,SAAS,gBACd,KACA,KAC0B;AAC1B,SAAO,UAAU,KAAK,GAAG,IAAI,YAAY,IAAI;AAC/C;AAGO,SAAS,cAAc,KAA6B;AACzD,SAAO,KAAK,IAAI,GAAG,IAAI,eAAe,IAAI,KAAK,MAAM;AACvD;AAgBO,SAAS,mBACd,OACA,aACS;AACT,MAAI,YAAY,WAAW,GAAG;AAC5B,WAAO;AAAA,EACT;AACA,SAAO,YAAY,MAAM,CAAC,eAAe,MAAM,IAAI,UAAU,CAAC;AAChE;AAQO,SAAS,sBAAsB,KAA+B;AACnE,SAAO,IAAI;AACb;AAgBO,SAAS,QACd,KACA,OACA,SACkB;AAClB,MACE,MAAM,IAAI,QAAQ,kBAAkB,KACpC,YAAY,IAAI,WAAW,KAAK,GAChC;AACA,WAAO;AAAA,EACT;AACA,SAAO,KAAK,aAAa,8BAA8B;AACzD;AAaO,SAAS,UACd,OACA,SACA,UAWI,CAAC,GACa;AAKlB,MAAI,QAAQ,oBAAoB,CAAC,MAAM,IAAI,QAAQ,gBAAgB,GAAG;AACpE,WAAO;AAAA,MACL;AAAA,MACA,8BAA8B,QAAQ,gBAAgB;AAAA,IACxD;AAAA,EACF;AAYA,QAAM,UAAU,QAAQ,uBAAuB,CAAC,GAAG;AAAA,IACjD,CAAC,eAAe,eAAe,QAAQ;AAAA,EACzC;AACA,MAAI,OAAO,SAAS,KAAK,CAAC,mBAAmB,OAAO,MAAM,GAAG;AAC3D,WAAO;AAAA,MACL;AAAA,MACA,sBAAsB,OAAO,KAAK,OAAO,CAAC;AAAA,IAC5C;AAAA,EACF;AAKA,QAAM,QAAQ,QAAQ,uBAAuB,CAAC,QAAQ,kBAAkB;AAIxE,QAAM,iBAAiB,QAAQ,kBAAkB,CAAC,CAAC,QAAQ;AAC3D,MACE,oBAAoB,SAAS,QAAQ,YAAY,MAAM,KACvD,CAAC,QAAQ,kBACT,CAAC,kBACD,CAAC,mBAAmB,OAAO,KAAK,GAChC;AAIA,WAAO;AAAA,MACL;AAAA,MACA,qEACK,MAAM,KAAK,OAAO,CAAC;AAAA,IAC1B;AAAA,EACF;AAKA,MAAI,QAAQ,wBAAwB,CAAC,cAAc,KAAK,GAAG;AACzD,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IAGF;AAAA,EACF;AACA,MAAI,QAAQ,mBAAmB,QAAQ,UAAU,IAAI,KAAK,EAAE,WAAW,GAAG;AACxE,WAAO,KAAK,aAAa,qCAAqC;AAAA,EAChE;AACA,MACE,QAAQ,iBAAiB,UACzB,QAAQ,eAAe,QAAQ,SAC/B;AACA,WAAO;AAAA,MACL;AAAA,MACA,8BAA8B,QAAQ,OAAO;AAAA,IAC/C;AAAA,EACF;AACA,SAAO;AACT;AAUO,SAAS,oBACd,SACA,WACQ;AACR,MAAI,cAAc,QAAW;AAC3B,WAAO,KAAK,IAAI,QAAQ,aAAa,QAAQ,OAAO;AAAA,EACtD;AACA,SAAO,KAAK,IAAI,KAAK,MAAM,SAAS,GAAG,QAAQ,OAAO;AACxD;AAaO,SAAS,eACd,KACA,OACA,KACkB;AAClB,MAAI,CAAC,mBAAmB,OAAO,IAAI,mBAAmB,GAAG;AACvD,WAAO,KAAK,aAAa,kCAAkC;AAAA,EAC7D;AACA,MAAI,UAAU,KAAK,GAAG,GAAG;AACvB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,WAAW,WAAW;AAC5B,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,MAAI,YAAY,IAAI,WAAW,KAAK,GAAG;AACrC,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,KAAK,KAAK,CAAC,QAAQ,YAAY,KAAK,KAAK,CAAC,GAAG;AACnD,WAAO,KAAK,wBAAwB,oCAAoC;AAAA,EAC1E;AACA,SAAO;AACT;AAmBO,SAAS,UACd,KACA,OACA,KACA,QACkB;AAClB,MAAI,CAAC,mBAAmB,OAAO,IAAI,mBAAmB,GAAG;AACvD,WAAO,KAAK,aAAa,iCAAiC;AAAA,EAC5D;AACA,MAAI,UAAU,KAAK,GAAG,GAAG;AACvB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,WAAW,WAAW;AAC5B,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,MAAI,YAAY,IAAI,WAAW,KAAK,GAAG;AACrC,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,KAAK,EAAE,WAAW,GAAG;AAC9B,WAAO,KAAK,aAAa,uCAAuC;AAAA,EAClE;AACA,SAAO;AACT;AAUO,SAAS,YACd,KACA,OACA,KACkB;AAClB,MAAI,CAAC,YAAY,IAAI,WAAW,KAAK,GAAG;AACtC,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,UAAU,KAAK,GAAG,GAAG;AACvB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,WAAW,WAAW;AAC5B,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;AAsBO,SAAS,WACd,KACA,OACkB;AAClB,MAAI,CAAC,mBAAmB,OAAO,IAAI,mBAAmB,GAAG;AACvD,WAAO,KAAK,aAAa,8BAA8B;AAAA,EACzD;AACA,MAAI,IAAI,WAAW,cAAc,IAAI,WAAW,UAAU;AACxD,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;",
   "names": []
 }

package/dist/dtos/Dashboard.dto.d.ts

@@ -90,7 +90,14 @@ export type DashboardClusterCard = (typeof DASHBOARD_CLUSTER_CARDS)[number];
 /** The cards of the Overview tab of an organization. */
 export declare const DASHBOARD_ORG_CARDS: readonly ["summary", "details", "sales-plan", "queued-operations", "clusters", "managed-llm", "recent-activity"];
 export type DashboardOrgCard = (typeof DASHBOARD_ORG_CARDS)[number];
-/** DASHBOARD_ENTITY_ID_MAX is the longest cluster id or organization id. */
+/**
+ * DASHBOARD_ENTITY_ID_MAX was the longest cluster id or organization id of a
+ * detail tile.
+ *
+ * @deprecated control-backend accepts only a GUID as the id of a detail
+ * tile, and no code reads this constant. It stays for the consumers of the
+ * published package.
+ */
 export declare const DASHBOARD_ENTITY_ID_MAX = 64;
 /**
  * DASHBOARD_NOTE_MAX is the longest text of a note tile.

package/dist/dtos/Dashboard.dto.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/dtos/Dashboard.dto.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type {\n  ChartGrain,\n  ChartSpec,\n  ChartUnit,\n  ChartWindowUnit,\n} from '../charts/chart-spec.js'\nimport type {\n  SearchFieldCapability,\n  SearchFieldType,\n} from '../search/fields.js'\nimport type { AnnotationEntityKind, AnnotationKind } from './Annotation.dto.js'\n\n/**\n * The wire types of the dashboards of Camunda Control.\n *\n * A dashboard stores QUESTIONS and never answers. A tile holds the filters of\n * the page that it came from, and the dashboard runs them again each time a\n * reader opens it. So a stored dashboard stays small, and it never holds a\n * copy of fleet data that can go stale or leak.\n *\n * control-backend and control-frontend both read this file, so it holds no\n * logic with I/O and no dependency.\n */\n\n/** DASHBOARD_TILES_MAX is the most tiles that one dashboard can hold. */\nexport const DASHBOARD_TILES_MAX = 20\n\n/** DASHBOARD_GRID_COLUMNS is the width of the tile grid, in columns. */\nexport const DASHBOARD_GRID_COLUMNS = 12\n\n/** DASHBOARD_TILE_ROWS_MAX is the tallest tile, in grid rows. */\nexport const DASHBOARD_TILE_ROWS_MAX = 24\n\n/**\n * DASHBOARD_GRID_ROWS_MAX is the lowest row that a tile can start on. It is\n * the height of 20 tiles of the tallest size, one under the other, so a\n * compact grid never reaches it.\n */\nexport const DASHBOARD_GRID_ROWS_MAX =\n  DASHBOARD_TILES_MAX * DASHBOARD_TILE_ROWS_MAX\n\n/** DASHBOARD_TITLE_MAX is the longest title of a dashboard or of a tile. */\nexport const DASHBOARD_TITLE_MAX = 120\n\n/**\n * DASHBOARD_DEFINITION_BYTES_MAX is the largest definition that the backend\n * stores, as JSON text. Twenty tiles of filters need a few kilobytes, so a\n * larger body is a client that tries to store data and not filters.\n */\nexport const DASHBOARD_DEFINITION_BYTES_MAX = 32_768\n\n/** DASHBOARD_PAGE_SIZE_MAX is the most dashboards that one list page holds. */\nexport const DASHBOARD_PAGE_SIZE_MAX = 200\n\n/** DASHBOARD_PAGE_SIZE_DEFAULT is the list page size when a caller sends none. */\nexport const DASHBOARD_PAGE_SIZE_DEFAULT = 200\n\n/**\n * DASHBOARD_DEFINITION_VERSION is the `schemaVersion` that this code writes.\n *\n * Raise it when the shape of the definition changes, add the old shape to\n * `StoredDashboardDefinition`, and teach `upgradeDashboardDefinition` to read\n * it. A row is never rewritten in place: it moves to the new version on its\n * next save.\n */\nexport const DASHBOARD_DEFINITION_VERSION = 3\n\n/**\n * Every kind of tile.\n *\n * `fleet-query` and `annotations` run saved filters. `cluster-detail` and\n * `org-detail` show one card of the page of one cluster or one organization.\n * `heading`, `note` and `link` hold text that a person wrote, and fetch\n * nothing. `chart` runs a chart query on HDP.\n */\nexport const DASHBOARD_TILE_KINDS = [\n  'fleet-query',\n  'annotations',\n  'cluster-detail',\n  'org-detail',\n  'heading',\n  'note',\n  'link',\n  'chart',\n] as const\n\nexport type DashboardTileKind = (typeof DASHBOARD_TILE_KINDS)[number]\n\n/** Where a tile sits on the grid, in columns and rows from the top left. */\nexport interface DashboardTileLayout {\n  x: number\n  y: number\n  w: number\n  h: number\n}\n\n/**\n * The search params of a Fleet query page, as that page writes them.\n *\n * The backend stores them as they are and checks only their shape: flat\n * values, no objects. The keys belong to the Fleet query page, so the\n * frontend validates them on read with the same function that validates the\n * URL. A tile with a key that this function drops does not run, because the\n * query would be wider than the one that was saved.\n */\nexport type DashboardFleetQuery = Record<\n  string,\n  string | number | boolean | string[]\n>\n\n/** The filters of the Notes & tags page. */\nexport interface DashboardAnnotationsQuery {\n  kind?: AnnotationKind\n  entityKind?: AnnotationEntityKind\n  tag?: string\n  q?: string\n}\n\n/**\n * The cards of the Overview tab of a cluster that a dashboard can show.\n *\n * The id names the card and never its content. The tile reads the cluster\n * again each time it is in view, so it shows the current state.\n */\nexport const DASHBOARD_CLUSTER_CARDS = [\n  'identity',\n  'component-status',\n  'datacenter',\n  'generation',\n  'plan',\n  'backup-encryption',\n  'settings-flags',\n  'external-idp',\n  'data-filters',\n  'auto-pause',\n  'change-history',\n  'disk-usage',\n] as const\n\nexport type DashboardClusterCard = (typeof DASHBOARD_CLUSTER_CARDS)[number]\n\n/** The cards of the Overview tab of an organization. */\nexport const DASHBOARD_ORG_CARDS = [\n  'summary',\n  'details',\n  'sales-plan',\n  'queued-operations',\n  'clusters',\n  'managed-llm',\n  'recent-activity',\n] as const\n\nexport type DashboardOrgCard = (typeof DASHBOARD_ORG_CARDS)[number]\n\n/** DASHBOARD_ENTITY_ID_MAX is the longest cluster id or organization id. */\nexport const DASHBOARD_ENTITY_ID_MAX = 64\n\n/**\n * DASHBOARD_NOTE_MAX is the longest text of a note tile.\n *\n * Twenty full notes of ASCII text fit in `DASHBOARD_DEFINITION_BYTES_MAX`.\n * Text with characters of more than one UTF-8 byte can pass that limit first,\n * so the frontend measures the whole definition with\n * `dashboardDefinitionBytes` before it saves.\n */\nexport const DASHBOARD_NOTE_MAX = 1000\n\n/** DASHBOARD_LINK_URL_MAX is the longest address of a link tile. */\nexport const DASHBOARD_LINK_URL_MAX = 1000\n\n/**\n * How a chart tile draws its result. `stat` is one number with a sparkline.\n * Each render is a chart of `@camunda/design-system`, which has no area chart.\n */\nexport const DASHBOARD_CHART_RENDERS = [\n  'line',\n  'bar',\n  'stacked-bar',\n  'stat',\n] as const\n\nexport type DashboardChartRender = (typeof DASHBOARD_CHART_RENDERS)[number]\n\n/**\n * A chart query and how to draw it. The tile stores the structured spec and\n * not the text, so a later change of the grammar cannot break a stored tile.\n */\nexport interface DashboardChartQuery extends ChartSpec {\n  render: DashboardChartRender\n}\n\n/** One card of one cluster. */\nexport interface DashboardClusterDetailQuery {\n  clusterId: string\n  card: DashboardClusterCard\n}\n\n/** One card of one organization. */\nexport interface DashboardOrgDetailQuery {\n  orgId: string\n  card: DashboardOrgCard\n}\n\ninterface DashboardTileBaseV1 {\n  /** Unique in its dashboard. The client makes it. */\n  id: string\n  title: string\n  layout: DashboardTileLayout\n}\n\nexport interface DashboardFleetQueryTileV1 extends DashboardTileBaseV1 {\n  kind: 'fleet-query'\n  query: DashboardFleetQuery\n}\n\nexport interface DashboardAnnotationsTileV1 extends DashboardTileBaseV1 {\n  kind: 'annotations'\n  query: DashboardAnnotationsQuery\n}\n\nexport type DashboardTileV1 =\n  | DashboardFleetQueryTileV1\n  | DashboardAnnotationsTileV1\n\nexport interface DashboardDefinitionV1 {\n  schemaVersion: 1\n  tiles: DashboardTileV1[]\n}\n\nexport interface DashboardClusterDetailTileV2 extends DashboardTileBaseV1 {\n  kind: 'cluster-detail'\n  query: DashboardClusterDetailQuery\n}\n\nexport interface DashboardOrgDetailTileV2 extends DashboardTileBaseV1 {\n  kind: 'org-detail'\n  query: DashboardOrgDetailQuery\n}\n\n/** A section title. The `title` of the tile is the text. */\nexport interface DashboardHeadingTileV2 extends DashboardTileBaseV1 {\n  kind: 'heading'\n}\n\n/** Plain text. Line breaks stay, and nothing in it is markup. */\nexport interface DashboardNoteTileV2 extends DashboardTileBaseV1 {\n  kind: 'note'\n  body: string\n}\n\n/**\n * A link to a page of Control (a path that starts with `/`) or to an\n * `https://` address. `isSafeDashboardLink` holds the rule.\n */\nexport interface DashboardLinkTileV2 extends DashboardTileBaseV1 {\n  kind: 'link'\n  url: string\n}\n\n/**\n * Version 2 adds kinds of tiles and changes no tile of version 1. A version 1\n * row is a version 2 row with a lower number, so an upgrade only sets the\n * number.\n *\n * The number moved because the kinds are new. A pod with version 1 code\n * answers `unsupportedVersion` for a row with a new kind, and not a 500 from\n * its serializer. A row with no new kind stays version 1, so that pod still\n * reads it (`toStoredDashboardDefinition`).\n */\nexport type DashboardTileV2 =\n  | DashboardTileV1\n  | DashboardClusterDetailTileV2\n  | DashboardOrgDetailTileV2\n  | DashboardHeadingTileV2\n  | DashboardNoteTileV2\n  | DashboardLinkTileV2\n\nexport interface DashboardDefinitionV2 {\n  schemaVersion: 2\n  tiles: DashboardTileV2[]\n}\n\n/** A chart of a metric of HDP. accounts-backend runs the query. */\nexport interface DashboardChartTileV3 extends DashboardTileBaseV1 {\n  kind: 'chart'\n  query: DashboardChartQuery\n}\n\n/**\n * Version 3 adds the `chart` kind and changes no tile of version 2, for the\n * same reason that version 2 moved the number. A row with no chart tile stays\n * at version 1 or 2 (`toStoredDashboardDefinition`).\n */\nexport type DashboardTileV3 = DashboardTileV2 | DashboardChartTileV3\n\nexport interface DashboardDefinitionV3 {\n  schemaVersion: 3\n  tiles: DashboardTileV3[]\n}\n\n/**\n * Every shape that a row can hold. A row keeps its old shape until somebody\n * saves the dashboard again.\n */\nexport type StoredDashboardDefinition =\n  | DashboardDefinitionV1\n  | DashboardDefinitionV2\n  | DashboardDefinitionV3\n\n/** The current shape. Every DTO carries this one. */\nexport type DashboardDefinition = DashboardDefinitionV3\nexport type DashboardTile = DashboardTileV3\nexport type DashboardFleetQueryTile = DashboardFleetQueryTileV1\nexport type DashboardAnnotationsTile = DashboardAnnotationsTileV1\nexport type DashboardClusterDetailTile = DashboardClusterDetailTileV2\nexport type DashboardOrgDetailTile = DashboardOrgDetailTileV2\nexport type DashboardHeadingTile = DashboardHeadingTileV2\nexport type DashboardNoteTile = DashboardNoteTileV2\nexport type DashboardLinkTile = DashboardLinkTileV2\nexport type DashboardChartTile = DashboardChartTileV3\n\n/**\n * `Omit` on a union merges its members into one shape. This one omits from\n * each member, so the kinds stay apart.\n */\ntype OmitEach<T, K extends PropertyKey> = T extends unknown ? Omit<T, K> : never\n\n/** A tile as a client adds it to a dashboard. The backend places it. */\nexport type DashboardNewTile = OmitEach<DashboardTile, 'layout'>\n\n/** Who created or archived a dashboard. The same shape as `ApprovalActor`. */\nexport interface DashboardActor {\n  userId: string\n  email: string\n}\n\n/**\n * One dashboard in a list, without its tiles.\n *\n * The sidebar reads a list of these, so it never parses a definition.\n */\nexport interface DashboardSummaryDto {\n  id: string\n  title: string\n  tileCount: number\n  createdBy: DashboardActor\n  createdAt: string\n  updatedAt: string\n  /** Set when the dashboard is archived. An archived dashboard is read-only. */\n  archivedAt?: string\n  archivedBy?: DashboardActor\n  /** True when the CALLER pinned it. A pin is personal. */\n  pinned: boolean\n}\n\nexport interface DashboardDto extends DashboardSummaryDto {\n  definition: DashboardDefinition\n  /**\n   * The version that the optimistic lock of a save compares. Send back the\n   * value of the read that the edit started from.\n   */\n  version: number\n}\n\nexport interface DashboardListDto {\n  dashboards: DashboardSummaryDto[]\n  page: { limit: number; offset: number; hasMore: boolean }\n}\n\n/** One Lucene field that a search or a chart filter can use. */\nexport interface DashboardCatalogueSearchField {\n  field: string\n  label: string\n  description: string\n  type: SearchFieldType\n  capabilities: SearchFieldCapability[]\n  enumValues?: string[]\n  example: string\n}\n\n/** One metric of the chart tiles, without its SQL. */\nexport interface DashboardCatalogueChartMetric {\n  id: string\n  label: string\n  description: string\n  unit: ChartUnit\n  dimensions: { id: string; label: string; description: string }[]\n  filters: DashboardCatalogueSearchField[]\n  grains: ChartGrain[]\n  maxWindowDays: number\n}\n\n/**\n * What a client must know to write a dashboard definition: the kinds of tiles,\n * the cards, the chart metrics and the limits. The answer of\n * `GET /api/dashboards/catalogue`.\n */\nexport interface DashboardCatalogue {\n  definitionVersion: number\n  limits: {\n    tiles: number\n    gridColumns: number\n    tileRowsMax: number\n    titleMax: number\n    noteMax: number\n    linkUrlMax: number\n    definitionBytesMax: number\n  }\n  tileKinds: { kind: DashboardTileKind; description: string }[]\n  clusterCards: DashboardClusterCard[]\n  orgCards: DashboardOrgCard[]\n  fleetSearchFields: {\n    cluster: DashboardCatalogueSearchField[]\n    org: DashboardCatalogueSearchField[]\n  }\n  charts: {\n    /** False where the flag `control.dashboardCharts` is off. */\n    enabled: boolean\n    grammar: string\n    queryMaxLength: number\n    renders: DashboardChartRender[]\n    grains: ChartGrain[]\n    windowUnits: ChartWindowUnit[]\n    defaults: {\n      grain: ChartGrain\n      window: { amount: number; unit: ChartWindowUnit }\n      top: number\n    }\n    topMax: number\n    metrics: DashboardCatalogueChartMetric[]\n  }\n}\n"],
-  "mappings": "AA+BO,MAAM,sBAAsB;AAG5B,MAAM,yBAAyB;AAG/B,MAAM,0BAA0B;AAOhC,MAAM,0BACX,sBAAsB;AAGjB,MAAM,sBAAsB;AAO5B,MAAM,iCAAiC;AAGvC,MAAM,0BAA0B;AAGhC,MAAM,8BAA8B;AAUpC,MAAM,+BAA+B;AAUrC,MAAM,uBAAuB;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAwCO,MAAM,0BAA0B;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAKO,MAAM,sBAAsB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAKO,MAAM,0BAA0B;AAUhC,MAAM,qBAAqB;AAG3B,MAAM,yBAAyB;AAM/B,MAAM,0BAA0B;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type {\n  ChartGrain,\n  ChartSpec,\n  ChartUnit,\n  ChartWindowUnit,\n} from '../charts/chart-spec.js'\nimport type {\n  SearchFieldCapability,\n  SearchFieldType,\n} from '../search/fields.js'\nimport type { AnnotationEntityKind, AnnotationKind } from './Annotation.dto.js'\n\n/**\n * The wire types of the dashboards of Camunda Control.\n *\n * A dashboard stores QUESTIONS and never answers. A tile holds the filters of\n * the page that it came from, and the dashboard runs them again each time a\n * reader opens it. So a stored dashboard stays small, and it never holds a\n * copy of fleet data that can go stale or leak.\n *\n * control-backend and control-frontend both read this file, so it holds no\n * logic with I/O and no dependency.\n */\n\n/** DASHBOARD_TILES_MAX is the most tiles that one dashboard can hold. */\nexport const DASHBOARD_TILES_MAX = 20\n\n/** DASHBOARD_GRID_COLUMNS is the width of the tile grid, in columns. */\nexport const DASHBOARD_GRID_COLUMNS = 12\n\n/** DASHBOARD_TILE_ROWS_MAX is the tallest tile, in grid rows. */\nexport const DASHBOARD_TILE_ROWS_MAX = 24\n\n/**\n * DASHBOARD_GRID_ROWS_MAX is the lowest row that a tile can start on. It is\n * the height of 20 tiles of the tallest size, one under the other, so a\n * compact grid never reaches it.\n */\nexport const DASHBOARD_GRID_ROWS_MAX =\n  DASHBOARD_TILES_MAX * DASHBOARD_TILE_ROWS_MAX\n\n/** DASHBOARD_TITLE_MAX is the longest title of a dashboard or of a tile. */\nexport const DASHBOARD_TITLE_MAX = 120\n\n/**\n * DASHBOARD_DEFINITION_BYTES_MAX is the largest definition that the backend\n * stores, as JSON text. Twenty tiles of filters need a few kilobytes, so a\n * larger body is a client that tries to store data and not filters.\n */\nexport const DASHBOARD_DEFINITION_BYTES_MAX = 32_768\n\n/** DASHBOARD_PAGE_SIZE_MAX is the most dashboards that one list page holds. */\nexport const DASHBOARD_PAGE_SIZE_MAX = 200\n\n/** DASHBOARD_PAGE_SIZE_DEFAULT is the list page size when a caller sends none. */\nexport const DASHBOARD_PAGE_SIZE_DEFAULT = 200\n\n/**\n * DASHBOARD_DEFINITION_VERSION is the `schemaVersion` that this code writes.\n *\n * Raise it when the shape of the definition changes, add the old shape to\n * `StoredDashboardDefinition`, and teach `upgradeDashboardDefinition` to read\n * it. A row is never rewritten in place: it moves to the new version on its\n * next save.\n */\nexport const DASHBOARD_DEFINITION_VERSION = 3\n\n/**\n * Every kind of tile.\n *\n * `fleet-query` and `annotations` run saved filters. `cluster-detail` and\n * `org-detail` show one card of the page of one cluster or one organization.\n * `heading`, `note` and `link` hold text that a person wrote, and fetch\n * nothing. `chart` runs a chart query on HDP.\n */\nexport const DASHBOARD_TILE_KINDS = [\n  'fleet-query',\n  'annotations',\n  'cluster-detail',\n  'org-detail',\n  'heading',\n  'note',\n  'link',\n  'chart',\n] as const\n\nexport type DashboardTileKind = (typeof DASHBOARD_TILE_KINDS)[number]\n\n/** Where a tile sits on the grid, in columns and rows from the top left. */\nexport interface DashboardTileLayout {\n  x: number\n  y: number\n  w: number\n  h: number\n}\n\n/**\n * The search params of a Fleet query page, as that page writes them.\n *\n * The backend stores them as they are and checks only their shape: flat\n * values, no objects. The keys belong to the Fleet query page, so the\n * frontend validates them on read with the same function that validates the\n * URL. A tile with a key that this function drops does not run, because the\n * query would be wider than the one that was saved.\n */\nexport type DashboardFleetQuery = Record<\n  string,\n  string | number | boolean | string[]\n>\n\n/** The filters of the Notes & tags page. */\nexport interface DashboardAnnotationsQuery {\n  kind?: AnnotationKind\n  entityKind?: AnnotationEntityKind\n  tag?: string\n  q?: string\n}\n\n/**\n * The cards of the Overview tab of a cluster that a dashboard can show.\n *\n * The id names the card and never its content. The tile reads the cluster\n * again each time it is in view, so it shows the current state.\n */\nexport const DASHBOARD_CLUSTER_CARDS = [\n  'identity',\n  'component-status',\n  'datacenter',\n  'generation',\n  'plan',\n  'backup-encryption',\n  'settings-flags',\n  'external-idp',\n  'data-filters',\n  'auto-pause',\n  'change-history',\n  'disk-usage',\n] as const\n\nexport type DashboardClusterCard = (typeof DASHBOARD_CLUSTER_CARDS)[number]\n\n/** The cards of the Overview tab of an organization. */\nexport const DASHBOARD_ORG_CARDS = [\n  'summary',\n  'details',\n  'sales-plan',\n  'queued-operations',\n  'clusters',\n  'managed-llm',\n  'recent-activity',\n] as const\n\nexport type DashboardOrgCard = (typeof DASHBOARD_ORG_CARDS)[number]\n\n/**\n * DASHBOARD_ENTITY_ID_MAX was the longest cluster id or organization id of a\n * detail tile.\n *\n * @deprecated control-backend accepts only a GUID as the id of a detail\n * tile, and no code reads this constant. It stays for the consumers of the\n * published package.\n */\nexport const DASHBOARD_ENTITY_ID_MAX = 64\n\n/**\n * DASHBOARD_NOTE_MAX is the longest text of a note tile.\n *\n * Twenty full notes of ASCII text fit in `DASHBOARD_DEFINITION_BYTES_MAX`.\n * Text with characters of more than one UTF-8 byte can pass that limit first,\n * so the frontend measures the whole definition with\n * `dashboardDefinitionBytes` before it saves.\n */\nexport const DASHBOARD_NOTE_MAX = 1000\n\n/** DASHBOARD_LINK_URL_MAX is the longest address of a link tile. */\nexport const DASHBOARD_LINK_URL_MAX = 1000\n\n/**\n * How a chart tile draws its result. `stat` is one number with a sparkline.\n * Each render is a chart of `@camunda/design-system`, which has no area chart.\n */\nexport const DASHBOARD_CHART_RENDERS = [\n  'line',\n  'bar',\n  'stacked-bar',\n  'stat',\n] as const\n\nexport type DashboardChartRender = (typeof DASHBOARD_CHART_RENDERS)[number]\n\n/**\n * A chart query and how to draw it. The tile stores the structured spec and\n * not the text, so a later change of the grammar cannot break a stored tile.\n */\nexport interface DashboardChartQuery extends ChartSpec {\n  render: DashboardChartRender\n}\n\n/** One card of one cluster. */\nexport interface DashboardClusterDetailQuery {\n  clusterId: string\n  card: DashboardClusterCard\n}\n\n/** One card of one organization. */\nexport interface DashboardOrgDetailQuery {\n  orgId: string\n  card: DashboardOrgCard\n}\n\ninterface DashboardTileBaseV1 {\n  /** Unique in its dashboard. The client makes it. */\n  id: string\n  title: string\n  layout: DashboardTileLayout\n}\n\nexport interface DashboardFleetQueryTileV1 extends DashboardTileBaseV1 {\n  kind: 'fleet-query'\n  query: DashboardFleetQuery\n}\n\nexport interface DashboardAnnotationsTileV1 extends DashboardTileBaseV1 {\n  kind: 'annotations'\n  query: DashboardAnnotationsQuery\n}\n\nexport type DashboardTileV1 =\n  | DashboardFleetQueryTileV1\n  | DashboardAnnotationsTileV1\n\nexport interface DashboardDefinitionV1 {\n  schemaVersion: 1\n  tiles: DashboardTileV1[]\n}\n\nexport interface DashboardClusterDetailTileV2 extends DashboardTileBaseV1 {\n  kind: 'cluster-detail'\n  query: DashboardClusterDetailQuery\n}\n\nexport interface DashboardOrgDetailTileV2 extends DashboardTileBaseV1 {\n  kind: 'org-detail'\n  query: DashboardOrgDetailQuery\n}\n\n/** A section title. The `title` of the tile is the text. */\nexport interface DashboardHeadingTileV2 extends DashboardTileBaseV1 {\n  kind: 'heading'\n}\n\n/** Plain text. Line breaks stay, and nothing in it is markup. */\nexport interface DashboardNoteTileV2 extends DashboardTileBaseV1 {\n  kind: 'note'\n  body: string\n}\n\n/**\n * A link to a page of Control (a path that starts with `/`) or to an\n * `https://` address. `isSafeDashboardLink` holds the rule.\n */\nexport interface DashboardLinkTileV2 extends DashboardTileBaseV1 {\n  kind: 'link'\n  url: string\n}\n\n/**\n * Version 2 adds kinds of tiles and changes no tile of version 1. A version 1\n * row is a version 2 row with a lower number, so an upgrade only sets the\n * number.\n *\n * The number moved because the kinds are new. A pod with version 1 code\n * answers `unsupportedVersion` for a row with a new kind, and not a 500 from\n * its serializer. A row with no new kind stays version 1, so that pod still\n * reads it (`toStoredDashboardDefinition`).\n */\nexport type DashboardTileV2 =\n  | DashboardTileV1\n  | DashboardClusterDetailTileV2\n  | DashboardOrgDetailTileV2\n  | DashboardHeadingTileV2\n  | DashboardNoteTileV2\n  | DashboardLinkTileV2\n\nexport interface DashboardDefinitionV2 {\n  schemaVersion: 2\n  tiles: DashboardTileV2[]\n}\n\n/** A chart of a metric of HDP. accounts-backend runs the query. */\nexport interface DashboardChartTileV3 extends DashboardTileBaseV1 {\n  kind: 'chart'\n  query: DashboardChartQuery\n}\n\n/**\n * Version 3 adds the `chart` kind and changes no tile of version 2, for the\n * same reason that version 2 moved the number. A row with no chart tile stays\n * at version 1 or 2 (`toStoredDashboardDefinition`).\n */\nexport type DashboardTileV3 = DashboardTileV2 | DashboardChartTileV3\n\nexport interface DashboardDefinitionV3 {\n  schemaVersion: 3\n  tiles: DashboardTileV3[]\n}\n\n/**\n * Every shape that a row can hold. A row keeps its old shape until somebody\n * saves the dashboard again.\n */\nexport type StoredDashboardDefinition =\n  | DashboardDefinitionV1\n  | DashboardDefinitionV2\n  | DashboardDefinitionV3\n\n/** The current shape. Every DTO carries this one. */\nexport type DashboardDefinition = DashboardDefinitionV3\nexport type DashboardTile = DashboardTileV3\nexport type DashboardFleetQueryTile = DashboardFleetQueryTileV1\nexport type DashboardAnnotationsTile = DashboardAnnotationsTileV1\nexport type DashboardClusterDetailTile = DashboardClusterDetailTileV2\nexport type DashboardOrgDetailTile = DashboardOrgDetailTileV2\nexport type DashboardHeadingTile = DashboardHeadingTileV2\nexport type DashboardNoteTile = DashboardNoteTileV2\nexport type DashboardLinkTile = DashboardLinkTileV2\nexport type DashboardChartTile = DashboardChartTileV3\n\n/**\n * `Omit` on a union merges its members into one shape. This one omits from\n * each member, so the kinds stay apart.\n */\ntype OmitEach<T, K extends PropertyKey> = T extends unknown ? Omit<T, K> : never\n\n/** A tile as a client adds it to a dashboard. The backend places it. */\nexport type DashboardNewTile = OmitEach<DashboardTile, 'layout'>\n\n/** Who created or archived a dashboard. The same shape as `ApprovalActor`. */\nexport interface DashboardActor {\n  userId: string\n  email: string\n}\n\n/**\n * One dashboard in a list, without its tiles.\n *\n * The sidebar reads a list of these, so it never parses a definition.\n */\nexport interface DashboardSummaryDto {\n  id: string\n  title: string\n  tileCount: number\n  createdBy: DashboardActor\n  createdAt: string\n  updatedAt: string\n  /** Set when the dashboard is archived. An archived dashboard is read-only. */\n  archivedAt?: string\n  archivedBy?: DashboardActor\n  /** True when the CALLER pinned it. A pin is personal. */\n  pinned: boolean\n}\n\nexport interface DashboardDto extends DashboardSummaryDto {\n  definition: DashboardDefinition\n  /**\n   * The version that the optimistic lock of a save compares. Send back the\n   * value of the read that the edit started from.\n   */\n  version: number\n}\n\nexport interface DashboardListDto {\n  dashboards: DashboardSummaryDto[]\n  page: { limit: number; offset: number; hasMore: boolean }\n}\n\n/** One Lucene field that a search or a chart filter can use. */\nexport interface DashboardCatalogueSearchField {\n  field: string\n  label: string\n  description: string\n  type: SearchFieldType\n  capabilities: SearchFieldCapability[]\n  enumValues?: string[]\n  example: string\n}\n\n/** One metric of the chart tiles, without its SQL. */\nexport interface DashboardCatalogueChartMetric {\n  id: string\n  label: string\n  description: string\n  unit: ChartUnit\n  dimensions: { id: string; label: string; description: string }[]\n  filters: DashboardCatalogueSearchField[]\n  grains: ChartGrain[]\n  maxWindowDays: number\n}\n\n/**\n * What a client must know to write a dashboard definition: the kinds of tiles,\n * the cards, the chart metrics and the limits. The answer of\n * `GET /api/dashboards/catalogue`.\n */\nexport interface DashboardCatalogue {\n  definitionVersion: number\n  limits: {\n    tiles: number\n    gridColumns: number\n    tileRowsMax: number\n    titleMax: number\n    noteMax: number\n    linkUrlMax: number\n    definitionBytesMax: number\n  }\n  tileKinds: { kind: DashboardTileKind; description: string }[]\n  clusterCards: DashboardClusterCard[]\n  orgCards: DashboardOrgCard[]\n  fleetSearchFields: {\n    cluster: DashboardCatalogueSearchField[]\n    org: DashboardCatalogueSearchField[]\n  }\n  charts: {\n    /** False where the flag `control.dashboardCharts` is off. */\n    enabled: boolean\n    grammar: string\n    queryMaxLength: number\n    renders: DashboardChartRender[]\n    grains: ChartGrain[]\n    windowUnits: ChartWindowUnit[]\n    defaults: {\n      grain: ChartGrain\n      window: { amount: number; unit: ChartWindowUnit }\n      top: number\n    }\n    topMax: number\n    metrics: DashboardCatalogueChartMetric[]\n  }\n}\n"],
+  "mappings": "AA+BO,MAAM,sBAAsB;AAG5B,MAAM,yBAAyB;AAG/B,MAAM,0BAA0B;AAOhC,MAAM,0BACX,sBAAsB;AAGjB,MAAM,sBAAsB;AAO5B,MAAM,iCAAiC;AAGvC,MAAM,0BAA0B;AAGhC,MAAM,8BAA8B;AAUpC,MAAM,+BAA+B;AAUrC,MAAM,uBAAuB;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAwCO,MAAM,0BAA0B;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAKO,MAAM,sBAAsB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAYO,MAAM,0BAA0B;AAUhC,MAAM,qBAAqB;AAG3B,MAAM,yBAAyB;AAM/B,MAAM,0BAA0B;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;",
   "names": []
 }

package/dist/index.d.ts

@@ -101,7 +101,7 @@ export { ConsolePermissions } from './permissions/console.permissions.js';
 export { NotificationPermissions } from './permissions/notification.permissions.js';
 export type { OnboardConfig } from './permissions/profile.permissions.js';
 export { PROFILES } from './permissions/profile.permissions.js';
-export { expandRolesToPermissions } from './permissions/roleExpansion.utils.js';
+export { ALL_PERMISSIONS_AT_AUTH0, expandRolesToPermissions, } from './permissions/roleExpansion.utils.js';
 export type { AuditData } from './types/AuditData.type.js';
 export type { ActivitySleepEligibilityOptions, SleepCronEligibilityOptions, } from './types/AutoSleep.type.js';
 export { INTERNAL_LOW_HARDWARE_PLAN_NAME, isActivitySleepEligible, isClusterTagEligibleForSleepCron, isSalesPlanEligibleForSleepCron, isSleepCronEligible, SLEEP_CRON_ELIGIBLE_TAGS, } from './types/AutoSleep.type.js';

package/dist/index.js

@@ -382,7 +382,10 @@ import {
 import { ConsolePermissions } from "./permissions/console.permissions.js";
 import { NotificationPermissions } from "./permissions/notification.permissions.js";
 import { PROFILES } from "./permissions/profile.permissions.js";
-import { expandRolesToPermissions } from "./permissions/roleExpansion.utils.js";
+import {
+  ALL_PERMISSIONS_AT_AUTH0,
+  expandRolesToPermissions
+} from "./permissions/roleExpansion.utils.js";
 import {
   INTERNAL_LOW_HARDWARE_PLAN_NAME,
   isActivitySleepEligible,
@@ -594,6 +597,7 @@ import {
 export {
   ADMIN_APP_RENAME_MIN_VERSION,
   ALLOWED_CAMUNDA_LABELS,
+  ALL_PERMISSIONS_AT_AUTH0,
   ANNOTATION_BODY_MAX,
   ANNOTATION_DENIAL_MESSAGES,
   ANNOTATION_ENTITY_KINDS,

package/dist/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/index.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n// ============================================================================\n// Constants (runtime values)\n// ============================================================================\n\nexport {\n  CUSTOM_GENERATION_MAX_PER_REQUESTER,\n  CUSTOM_GENERATION_MAX_UPGRADEABLE_FROM,\n  CUSTOM_GENERATION_NAME_MAX_LENGTH,\n  CUSTOM_GENERATION_NAME_MIN_LENGTH,\n  checkNewGenerationVersions,\n  isCustomGenerationStage,\n} from './constants/custom-generation.const.js'\nexport {\n  CUSTOM_HARDWARE_SIZING_BROKER_TOTAL_CAPS,\n  CUSTOM_HARDWARE_SIZING_COUNT_CAPS,\n  CUSTOM_HARDWARE_SIZING_ELASTICSEARCH_TOTAL_CAPS,\n  CUSTOM_HARDWARE_SIZING_MAX_AUTO_RESIZE_INCREASE_GI,\n  CUSTOM_HARDWARE_SIZING_MAX_PLAN_JSON_LENGTH,\n  CUSTOM_HARDWARE_SIZING_MAX_PLANS_PER_REQUESTER,\n  CUSTOM_HARDWARE_SIZING_NAME_MAX_LENGTH,\n  CUSTOM_HARDWARE_SIZING_NAME_MIN_LENGTH,\n  CUSTOM_HARDWARE_SIZING_REPLICA_SET_TOTAL_CAPS,\n  CUSTOM_HARDWARE_SIZING_RESOURCE_CAPS,\n  checkCustomHardwareSizing,\n  isCustomHardwareSizingStage,\n  parseKubernetesQuantity,\n} from './constants/custom-hardware-sizing.const.js'\nexport { DAY, HOUR, MINUTE, SECOND, WEEK } from './constants/duration.const.js'\nexport type { Stage } from './constants/misc.const.js'\nexport {\n  CAMUNDA_CLAIMS_NAMESPACE,\n  CONSOLE_API_USER_ID,\n  countBulkOperationAcks,\n  FIRSTNAME_LASTNAME_MAX_LENGTH,\n  HOTBACKUP_MIN_CREATE_PERIOD,\n  INT_MINIMUM_BULK_OPERATION_ACKS,\n  MAX_HARDWARE_PACKAGE_COUNT,\n  MAX_LENGTH_CLUSTER_NAME,\n  MINIMUM_EYEPAIRS,\n  MINIMUM_EYEPAIRS_BY_BULK_OPERATION_TYPE,\n  minimumBulkOperationAcks,\n  minimumBulkOperationEyes,\n  missingBulkOperationAcks,\n  NAMES_OF_ENTERPRISE_SALESPLANS_WITH_SLEEPING_CLUSTERS,\n  requiredBulkOperationAcks,\n  SECRETS_MAX_LENGTH,\n  STARTING_PRICE_PER_MONTH_IN_EURO,\n  TEMPORARY_CLUSTER_NAME,\n  UNKNOWN_ACTOR_EMAIL,\n} from './constants/misc.const.js'\nexport {\n  getGatewayPropertyHint,\n  getGatewayPropertyPath,\n  isAffectedByStreamlinedDeployment,\n  isPre89AffectedPath,\n  PRE89_AFFECTED_PATHS,\n  PRE89_AFFECTED_PROPERTY_PREFIXES,\n  PRE89_GATEWAY_PROPERTY_PATHS,\n  PRE89_GATEWAY_RESOURCE_PREFIXES,\n} from './constants/pre89EnvVarMapping.const.js'\nexport { PRIVATE_LINK_REGIONS } from './constants/privateLinkRegions.const.js'\nexport { SECURE_CONNECTIVITY_ALLOWED_ENTRIES_LIMIT } from './constants/secureConnectivity.const.js'\nexport { isSelfServiceClusterModificationStage } from './constants/self-service-cluster-modification.const.js'\nexport type {\n  TrialExtensionSurveyAnswer,\n  TrialExtensionSurveyQuestion,\n} from './constants/trialExtensionSurvey.const.js'\nexport { TRIAL_EXTENSION_SURVEY_QUESTIONS } from './constants/trialExtensionSurvey.const.js'\nexport {\n  V2_BODY_IDS_MAX,\n  V2_FILTER_IDS_MAX,\n  V2_MAX_PAGE_LIMIT,\n} from './constants/v2-list.const.js'\nexport {\n  ADMIN_APP_RENAME_MIN_VERSION,\n  APP_INTEGRATIONS_89_STREAM_CONNECTOR_BRIDGE_MIN_VERSION,\n  APP_INTEGRATIONS_89_STREAM_MINOR,\n  APP_INTEGRATIONS_89_STREAM_ZEEBE_MIN_VERSION,\n  APP_INTEGRATIONS_MIN_VERSION,\n  AUDIT_LOG_TAB_MIN_VERSION,\n  AUTHORIZATION_TOGGLE_MIN_VERSION,\n  AWS_ONLY_GENERATION_MIN_VERSION,\n  BUSINESS_ID_UNIQUENESS_MIN_VERSION,\n  BYOIDP_MIN_VERSION,\n  CLUSTER_SECRETS_LABEL_MIN_VERSION,\n  CLUSTER_STATISTICS_CONFIG_MIN_VERSION,\n  CONNECTOR_MANAGEMENT_METRICS_MIN_VERSION,\n  CONNECTOR_SECRET_SYNC_MIN_VERSION,\n  CONNECTORS_MANAGEMENT_LINK_MIN_VERSION,\n  ENFORCE_GROUPS_TASKLIST_V2_HIDDEN_MIN_VERSION,\n  ENFORCE_GROUPS_TOGGLE_MIN_VERSION,\n  GATEWAY_SPEC_8_9_MIN_VERSION,\n  HOT_BACKUP_MIN_VERSION,\n  IDENTITY_AUTHORIZATION_MIN_VERSION,\n  IDENTITY_AUTHORIZATION_NOTICE_MAX_VERSION,\n  IDENTITY_MANAGEMENT_MIN_VERSION,\n  INTERNAL_CONNECTORS_MANAGEMENT_MIN_VERSION,\n  JOB_DASHBOARD_MIN_VERSION,\n  LINE_8_9_MIN_VERSION,\n  LINE_8_10_MIN_VERSION,\n  MCP_MIN_VERSION,\n  MULTI_TENANCY_TOGGLE_MIN_VERSION,\n  NEW_CLUSTER_ROLES_MIN_VERSION,\n  OPTIMIZE_DEFAULT_ON_MIN_VERSION,\n  OPTIMIZE_FILTERING_MIN_VERSION,\n  OPTIONAL_TELEMETRY_MIN_VERSION,\n  RESOURCE_BASED_AUTHORIZATIONS_MIN_VERSION,\n  REST_API_URL_TRANSFORM_MIN_VERSION,\n  REST_API_V2_MIN_VERSION,\n  RESUME_ALPHA_MIN_VERSION,\n  SECRET_SOURCE_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_6_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_7_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_8_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_9_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_10_MIN_VERSION,\n  SESSION_CONFIG_MIN_VERSION,\n  SWAGGER_MIN_VERSION,\n  SWAGGER_URL_8_9_MIN_VERSION,\n  TASKLIST_MODE_TOGGLE_MIN_VERSION,\n  TASKLIST_UPGRADE_BANNER_MIN_VERSION,\n  TASKLIST_V2_AUTO_ENABLE_FROM_MINOR,\n  TASKLIST_V2_AUTO_ENABLE_TO_MINOR,\n  TASKLIST_V2_DEFAULT_ON_MIN_VERSION,\n  TASKLIST_V2_SETTING_MAX_VERSION,\n  TASKLIST_V2_UPGRADE_MIN_VERSION,\n  TASKLIST_V2_UPGRADE_TARGET_MIN_VERSION,\n  UPGRADE_READINESS_MIN_VERSION,\n  ZEEBE_REST_URL_MIN_VERSION,\n} from './constants/version-gates.const.js'\n\n// ============================================================================\n// DTOs - Types (interfaces and type aliases)\n// ============================================================================\n\n// Annotations - the notes and the tags that a Camundi attaches to a fleet\n// entity. The wire types and the rules are pure and browser-safe, so\n// control-backend and control-frontend run the same code.\nexport type {\n  AnnotationActorView,\n  AnnotationDecision,\n  AnnotationDenialCode,\n} from './annotations/policy.js'\nexport {\n  ANNOTATION_DENIAL_MESSAGES,\n  canEditNote,\n  canRemove,\n  checkNoteBody,\n  checkTagName,\n  isAuthor,\n} from './annotations/policy.js'\nexport type {\n  ClusterBulkClusterResultDto,\n  ClusterBulkFinalStatus,\n  ClusterBulkGenerationUpdateSettings,\n  ClusterBulkOperationPayloadDto,\n  ClusterBulkOperationRule,\n  ClusterBulkPlanTypeUpdateSettings,\n  ClusterBulkPlanUpdateSettings,\n  ClusterBulkSettingsByType,\n  ClusterBulkSleepWakeupSettings,\n  ClusterBulkStepRequestDto,\n  ClusterBulkStepResultDto,\n  ClusterBulkTargetDto,\n} from './approvals/cluster-bulk-operation.js'\nexport {\n  CLUSTER_BULK_OPERATION_CLUSTER_NAME_MAX_LENGTH,\n  CLUSTER_BULK_OPERATION_MAX_CLUSTERS,\n  CLUSTER_BULK_OPERATION_MIN_ACKS,\n  CLUSTER_BULK_OPERATION_NAME_MAX_LENGTH,\n  CLUSTER_BULK_OPERATION_RULES,\n  CLUSTER_BULK_OPERATION_TEST_STAGE_MIN_ACKS,\n  CLUSTER_BULK_OPERATION_TYPES,\n  CLUSTER_BULK_SLEEPING_CLUSTER_DELAY_MS,\n  clusterBulkOperationTypeOf,\n  clusterBulkParameterOf,\n  clusterBulkRequiredPermissions,\n  clusterBulkResultOf,\n  isClusterBulkYolo,\n} from './approvals/cluster-bulk-operation.js'\nexport {\n  DNS_SUBDOMAIN_MAX_LENGTH,\n  isDnsSubdomain,\n} from './approvals/dns-subdomain.js'\nexport type { ApprovalExpectedChange } from './approvals/expected-value.js'\nexport {\n  isSameApprovalValue,\n  staleApprovalKeys,\n} from './approvals/expected-value.js'\nexport type {\n  ApprovalActorView,\n  ApprovalDecision,\n  ApprovalDenialCode,\n} from './approvals/policy.js'\nexport {\n  approvalPermissionCheck,\n  canAcknowledge,\n  canCreate,\n  canExecute,\n  canReject,\n  canView,\n  canWithdraw,\n  effectiveStatus,\n  hasActorEmail,\n  hasEveryPermission,\n  isExpired,\n  isSameActor,\n  isSameActorEmail,\n  remainingAcks,\n  requiredPermissionsOf,\n  resolveRequiredAcks,\n} from './approvals/policy.js'\nexport type {\n  ReleaseTrainAutoUpgradeCandidates,\n  ReleaseTrainPublishPayload,\n  ReleaseTrainRollbackPayload,\n} from './approvals/release-train.js'\nexport type { ApprovalUseCaseType } from './approvals/use-cases.const.js'\nexport {\n  APPROVAL_EMAIL_MAX_LENGTH,\n  APPROVAL_EMAIL_PATTERN,\n  APPROVAL_USE_CASE_TYPES,\n  ENTERPRISE_ONBOARDING_METRIC_MAX,\n  ENTERPRISE_ONBOARDING_NAME_MAX_LENGTH,\n  ENTERPRISE_ONBOARDING_RESERVATION_MAX,\n  ENTERPRISE_ONBOARDING_SFDC_ID_MAX_LENGTH,\n  ENTERPRISE_ONBOARDING_TERM_MAX_MONTHS,\n  ENTERPRISE_ONBOARDING_TERM_MIN_MONTHS,\n  EXTEND_TRIAL_MAX_DAYS,\n  EXTEND_TRIAL_MIN_DAYS,\n  FEATURE_FLAG_MIN_ACKS_PROD,\n  GENERATION_VERSION_VALUE_MAX_LENGTH,\n  GENERATION_VERSIONS_MAX_GENERATIONS,\n  isCalendarDay,\n  ORG_LIMIT_TEXT_MAX_LENGTH,\n  PERSONAL_ORGANIZATION_MAX_PER_REQUESTER,\n  PERSONAL_ORGANIZATION_NAME_MAX_LENGTH,\n  PERSONAL_ORGANIZATION_NAME_MIN_LENGTH,\n  PLATFORM_ROLE_CHANGE_MAX_ROLES,\n  PURGE_USERS_MAX_USERS,\n  PURGE_USERS_REQUIRED_PERMISSIONS,\n  USER_METADATA_EXPECTED_MAX_LENGTH,\n  USER_METADATA_MAX_LENGTH,\n} from './approvals/use-cases.const.js'\n// The chart query of a dashboard tile (catalogue, language, result).\nexport {\n  CHART_DAY_GRAIN_MAX_DAYS,\n  CHART_FILTER_MAX_LENGTH,\n  CHART_GRAIN_DEFAULT,\n  CHART_GRAINS,\n  CHART_ID_MAX_LENGTH,\n  CHART_METRICS,\n  CHART_OTHER_SERIES_KEY,\n  CHART_QUERY_MAX_LENGTH,\n  CHART_TOP_DEFAULT,\n  CHART_TOP_MAX,\n  CHART_UNKNOWN_SERIES_KEY,\n  CHART_WINDOW_AMOUNT_MAX,\n  CHART_WINDOW_DEFAULT,\n  CHART_WINDOW_UNITS,\n  type ChartDimensionSpec,\n  type ChartGrain,\n  type ChartMetricSpec,\n  type ChartPoint,\n  type ChartQueryCheck,\n  ChartQueryError,\n  type ChartQueryErrorKind,\n  type ChartQueryOptions,\n  type ChartResult,\n  type ChartSeries,\n  type ChartSpec,\n  type ChartUnit,\n  type ChartWindow,\n  type ChartWindowUnit,\n  chartBucketStart,\n  chartToday,\n  chartWindowRange,\n  findChartDimension,\n  findChartMetric,\n  formatChartSpec,\n  isChartQueryError,\n  parseChartQuery,\n  readChartSpec,\n  validateChartSpec,\n} from './charts/index.js'\n// Dashboards - the tiles of a dashboard hold filters and never data. The\n// wire types and the placement rules are pure, so control-backend and\n// control-frontend run the same code.\nexport {\n  DASHBOARD_TILE_DEFAULT_SIZE,\n  dashboardDefinitionBytes,\n  dashboardDefinitionFits,\n  dashboardTileDefaultSize,\n  emptyDashboardDefinition,\n  isSafeDashboardLink,\n  placeNewTile,\n  placeNewTiles,\n  tilesOverlap,\n  toStoredDashboardDefinition,\n  upgradeDashboardDefinition,\n} from './dashboards/definition.js'\nexport type {\n  ALERT_SUBSCRIPTION_REPORT_TYPES,\n  ALERT_SUBSCRIPTION_TYPES,\n  AlertSubscriptionDto,\n  AlertSubscriptionEntryDto,\n  AlertSubscriptionWebhookAuth,\n  CheckFailedReason,\n} from './dtos/AlertSubscription.dto.js'\n// DTOs - Values (constants)\nexport {\n  FORBIDDEN_HOSTNAMES_FOR_WEBHOOK_ALERTS,\n  HMAC_HEADER_POSITION,\n  HMAC_SUPPORTED_ALGORITHM,\n} from './dtos/AlertSubscription.dto.js'\nexport type {\n  AnnotationActor,\n  AnnotationDto,\n  AnnotationEntityKind,\n  AnnotationKind,\n  AnnotationLookupDto,\n  AnnotationLookupEntryDto,\n  AnnotationTagDto,\n  EntityAnnotationsDto,\n} from './dtos/Annotation.dto.js'\nexport {\n  ANNOTATION_BODY_MAX,\n  ANNOTATION_ENTITY_KIND_LABELS,\n  ANNOTATION_ENTITY_KINDS,\n  ANNOTATION_ENTITY_MAX,\n  ANNOTATION_KINDS,\n  ANNOTATION_LOOKUP_MAX_ENTITIES,\n  ANNOTATION_LOOKUP_TAGS_MAX,\n  ANNOTATION_PAGE_SIZE_DEFAULT,\n  ANNOTATION_PAGE_SIZE_MAX,\n  ANNOTATION_SEARCH_MAX_LENGTH,\n  ANNOTATION_TAG_NAME_MAX,\n  normalizeTagName,\n} from './dtos/Annotation.dto.js'\n// Approvals - the wire types, and the rules that read them. Both are pure and\n// browser-safe, so control-backend, control-frontend and cloudbot run the same\n// code and cannot disagree.\nexport type {\n  ApprovalAck,\n  ApprovalActionMode,\n  ApprovalActor,\n  ApprovalEntityRef,\n  ApprovalEntityType,\n  ApprovalExecutionMode,\n  ApprovalJobDto,\n  ApprovalJobStatus,\n  ApprovalM2mActor,\n  ApprovalProgress,\n  ApprovalSortField,\n  ApprovalSortOrder,\n  ApprovalStatusCountsDto,\n  ApprovalSummaryField,\n  ApprovalSummaryFieldKind,\n  ApprovalSummaryValue,\n  ApprovalUseCaseDto,\n} from './dtos/ApprovalJob.dto.js'\nexport {\n  APPROVAL_ACKS_MAX,\n  APPROVAL_ENTITY_TYPES,\n  APPROVAL_JOB_STATUSES,\n  APPROVAL_LIST_SUMMARY_VALUES_MAX,\n  APPROVAL_LIVE_STATUSES,\n  APPROVAL_PAGE_SIZE_DEFAULT,\n  APPROVAL_PAGE_SIZE_MAX,\n  APPROVAL_PAYLOAD_ORG_FIELD,\n  APPROVAL_REASON_MAX_LENGTH,\n  APPROVAL_RUN_STALE_MS,\n  APPROVAL_SEARCH_MAX_LENGTH,\n  APPROVAL_SORT_DEFAULT,\n  APPROVAL_SORT_FIELDS,\n  APPROVAL_SUMMARY_FIELD_KINDS,\n  isRunStalled,\n  progressFraction,\n} from './dtos/ApprovalJob.dto.js'\nexport type { AuditDto } from './dtos/Audit.dto.js'\nexport type { Auth0ResourceServerDto } from './dtos/Auth0ResourceServer.dto.js'\nexport type { BackupDto } from './dtos/Backup.dto.js'\nexport type { BackupScheduleDto } from './dtos/BackupSchedule.dto.js'\nexport type { ByomClientDto, ByomStatus } from './dtos/ByomClient.dto.js'\nexport type {\n  ClusterCreationDefaultField,\n  ClusterCreationDefaultKey,\n  ClusterCreationDefaults,\n} from './dtos/ClusterCreationDefaults.dto.js'\nexport { CLUSTER_CREATION_DEFAULT_FIELDS } from './dtos/ClusterCreationDefaults.dto.js'\nexport type {\n  ClusterDeferredSpecChange,\n  DeferredSpecChangeType,\n} from './dtos/ClusterDeferredSpecChange.dto.js'\nexport type { ClusterIpWhitelistDto } from './dtos/ClusterIpWhitelist.dto.js'\nexport type {\n  MoveClusterOwnerResult,\n  MoveClusterWarnings,\n} from './dtos/ClusterOwnerMove.dto.js'\nexport type { ClusterPlanDto } from './dtos/ClusterPlan.dto.js'\nexport type { ClusterPlanTypeDto } from './dtos/ClusterPlanType.dto.js'\nexport type {\n  ChangeClusterPlanTypeResult,\n  ClusterModificationConfigRef,\n  ClusterPlanTypeChangeRefusal,\n  ClusterPlanTypeStateDto,\n} from './dtos/ClusterPlanTypeChange.dto.js'\nexport {\n  CLUSTER_PLAN_TYPE_CHANGE_REFUSALS,\n  clusterPlanTypeChangeRefusalOf,\n} from './dtos/ClusterPlanTypeChange.dto.js'\nexport type {\n  ClusterSpecChange,\n  ClusterSpecChangeActor,\n  ClusterSpecHistory,\n} from './dtos/ClusterSpecHistory.dto.js'\nexport type {\n  CommonClusterDto,\n  ExternalIdpConfig,\n  OptimizeFilteringConfig,\n  OptimizeFilteringIncludeExclude,\n  OptimizeFilteringPatch,\n  SecretsFilterMode,\n} from './dtos/CommonCluster.dto.js'\nexport type { ConsoleClusterDto } from './dtos/ConsoleCluster.dto.js'\nexport type {\n  ClusterActivityBucket,\n  ClusterActivityTile,\n  ClusterActivityV2Dto,\n  ClusterActivityV2Response,\n  ClusterByClientV2Dto,\n  ClusterDatacenterOptionV2Dto,\n  ClusterDetailV2Dto,\n  ClusterFacetsV2Dto,\n  ClusterListItemV2Dto,\n  ClusterLiveStateV2Dto,\n  ClusterLiveStateV2Entry,\n  ClusterModificationState,\n  ClusterParameterOptionV2Dto,\n  ClusterParametersV2Dto,\n  ClusterTtlFilter,\n  ControlResolvedPermissions,\n  ControlSessionDto,\n  ControlSessionUser,\n  CursorPage,\n  CursorParams,\n  ListClustersV2Params,\n  ListOrganizationsV2Params,\n  ListOrgMembersV2Params,\n  OrgDetailV2Dto,\n  OrgListItemV2Dto,\n  OrgMemberV2Dto,\n  OrgSummaryV2Dto,\n} from './dtos/ControlV2.dto.js'\nexport { CLUSTER_MODIFICATION_STATES } from './dtos/ControlV2.dto.js'\nexport type {\n  DashboardActor,\n  DashboardAnnotationsQuery,\n  DashboardAnnotationsTile,\n  DashboardAnnotationsTileV1,\n  DashboardCatalogue,\n  DashboardCatalogueChartMetric,\n  DashboardCatalogueSearchField,\n  DashboardChartQuery,\n  DashboardChartRender,\n  DashboardChartTile,\n  DashboardChartTileV3,\n  DashboardClusterCard,\n  DashboardClusterDetailQuery,\n  DashboardClusterDetailTile,\n  DashboardClusterDetailTileV2,\n  DashboardDefinition,\n  DashboardDefinitionV1,\n  DashboardDefinitionV2,\n  DashboardDefinitionV3,\n  DashboardDto,\n  DashboardFleetQuery,\n  DashboardFleetQueryTile,\n  DashboardFleetQueryTileV1,\n  DashboardHeadingTile,\n  DashboardHeadingTileV2,\n  DashboardLinkTile,\n  DashboardLinkTileV2,\n  DashboardListDto,\n  DashboardNewTile,\n  DashboardNoteTile,\n  DashboardNoteTileV2,\n  DashboardOrgCard,\n  DashboardOrgDetailQuery,\n  DashboardOrgDetailTile,\n  DashboardOrgDetailTileV2,\n  DashboardSummaryDto,\n  DashboardTile,\n  DashboardTileKind,\n  DashboardTileLayout,\n  DashboardTileV1,\n  DashboardTileV2,\n  DashboardTileV3,\n  StoredDashboardDefinition,\n} from './dtos/Dashboard.dto.js'\nexport {\n  DASHBOARD_CHART_RENDERS,\n  DASHBOARD_CLUSTER_CARDS,\n  DASHBOARD_DEFINITION_BYTES_MAX,\n  DASHBOARD_DEFINITION_VERSION,\n  DASHBOARD_ENTITY_ID_MAX,\n  DASHBOARD_GRID_COLUMNS,\n  DASHBOARD_GRID_ROWS_MAX,\n  DASHBOARD_LINK_URL_MAX,\n  DASHBOARD_NOTE_MAX,\n  DASHBOARD_ORG_CARDS,\n  DASHBOARD_PAGE_SIZE_DEFAULT,\n  DASHBOARD_PAGE_SIZE_MAX,\n  DASHBOARD_TILE_KINDS,\n  DASHBOARD_TILE_ROWS_MAX,\n  DASHBOARD_TILES_MAX,\n  DASHBOARD_TITLE_MAX,\n} from './dtos/Dashboard.dto.js'\nexport type { EarlyAccessFeatureDto } from './dtos/EarlyAccessFeature.dto.js'\nexport type {\n  CamundaWebApp,\n  CamundaWebAppWithZeebe,\n  ExternalClickwrapConfigDto,\n  ExternalClusterDto,\n  ExternalOrganizationDto,\n} from './dtos/ExternalWebapp.dto.js'\nexport type {\n  CreateFeatureFlagDto,\n  FeatureFlagAnswer,\n  FeatureFlagDto,\n  FeatureFlagListDto,\n  UpdateFeatureFlagDto,\n} from './dtos/FeatureFlags.dto.js'\n// Functions\nexport {\n  activeGenerations,\n  compareGenerationNamesNewestFirst,\n  type GenerationDto,\n  type GenerationWithClusterCountDto,\n  sortGenerationBySemverOfZeebe,\n  type UpgradableGenerationsDto,\n} from './dtos/Generations.dto.js'\nexport type { ChangeGenerationVersionsResult } from './dtos/GenerationVersionsChange.dto.js'\n// Namespace (type-only - contains only interfaces)\nexport type { Hdp } from './dtos/Hdp.dto.js'\nexport type {\n  K8sBackupConfig,\n  K8sConfig,\n  K8sConfigLegacyFormat,\n  K8sContext,\n  K8sContextDto,\n} from './dtos/K8sContext.dto.js'\nexport type {\n  M2mTokenCountDto,\n  M2mTokenCountsDto,\n} from './dtos/M2mTokenCount.dto.js'\nexport type { MetaDto } from './dtos/Meta.dto.js'\nexport type {\n  AutoJoinAssignment,\n  LicensingModelType,\n  LlmProviderName,\n  OrganizationDto,\n  OrganizationMetadata,\n  OrgOwner,\n  OrgWithNameAndSalesPlan,\n} from './dtos/Organization.dto.js'\nexport {\n  LICENSING_MODEL_DISPLAY_NAMES,\n  VALID_LICENSING_MODELS,\n} from './dtos/Organization.dto.js'\nexport type { OrganizationMemberDto } from './dtos/OrganizationMember.dto.js'\nexport type { OrganizationToSalesPlanDto } from './dtos/OrganizationToSalesPlan.dto.js'\nexport type {\n  DryRunSanityDiff,\n  ReleaseTrainPreview,\n  ReleaseTrainSanityReport,\n  SanityFix,\n  SanityRuleInfo,\n  SanitySeverity,\n  SanityViolation,\n} from './dtos/ReleaseTrainSanity.dto.js'\nexport type { RestoreDto, RestoreState } from './dtos/Restore.dto.js'\n// SalesPlan.dto - Types\nexport type {\n  ClusterLimits,\n  ConsumptionDataItem,\n  Limits,\n  SalesPlanDto,\n  SalesPlanMetadata,\n} from './dtos/SalesPlan.dto.js'\n// SalesPlan.dto - Values (constants and functions)\nexport {\n  allClusterBasedLimits,\n  allSalesPlanLimits,\n  clusterPlanWhiteListIds,\n  deprecatedLimit,\n  generationWhiteListIds,\n  isLimitKeyEnabled,\n  isLimitOfferedOnStage,\n  isUnlockedClusterPlansStage,\n  MAX_CLUSTER_CLIENTS_DEFAULT,\n  MAX_CLUSTER_CLIENTS_DEV,\n  RETENTION_LIMIT_DEFAULT,\n  RETENTION_LIMIT_MAXIMUM,\n  RETENTION_LIMIT_MINIMUM,\n  unusedClusterBasedLimits,\n  unusedSalesPlanLimits,\n} from './dtos/SalesPlan.dto.js'\nexport type { SecureConnectivityDto } from './dtos/SecureConnectivity.dto.js'\nexport type { SignupDto } from './dtos/Signup.dto.js'\nexport type {\n  StorybookConfig,\n  StorybookConfigBackup,\n  StorybookConfigChannel,\n  StorybookConfigDatacenter,\n  StorybookConfigGeneration,\n} from './dtos/StorybookConfig.dto.js'\nexport type { SystemAuditDto } from './dtos/SystemAudit.dto.js'\nexport type {\n  UpgradeReadinessDto,\n  UpgradeReadinessSource,\n  UpgradeReadinessState,\n} from './dtos/UpgradeReadiness.dto.js'\n// UsageAlert.dto - Types\nexport type { UsageAlertDto } from './dtos/UsageAlert.dto.js'\n// UsageAlert.dto - Values (enum and constants)\nexport {\n  UsageAlertInitValues,\n  UsageAlertMetric,\n  UsageAlertThresholdLimits,\n} from './dtos/UsageAlert.dto.js'\nexport type { UserMetaDataDto } from './dtos/UserMetaData.dto.js'\n// Lucene-style table search (parser + AST \u2192 SQL compiler + field registries).\nexport {\n  type AndNode,\n  CLUSTER_DEFAULT_SEARCH_FIELDS,\n  CLUSTER_SEARCH_FIELDS,\n  CLUSTER_TTL_SEARCH_FIELDS,\n  type CompileContext,\n  type CompiledQuery,\n  clusterSearchFieldsForStage,\n  compileQuery,\n  type FieldBinding,\n  findSearchField,\n  idSetPredicate,\n  isLuceneQueryError,\n  joinIdSet,\n  LuceneQueryError,\n  likeArgument,\n  type NotNode,\n  ORG_DEFAULT_SEARCH_FIELDS,\n  ORGANIZATION_SEARCH_FIELDS,\n  type OrNode,\n  parseLuceneQuery,\n  type QueryNode,\n  type RangeNode,\n  type SearchFieldCapability,\n  type SearchFieldSpec,\n  type SearchFieldType,\n  type SearchTermOperator,\n  type SqlDialect,\n  type TermNode,\n} from './search/index.js'\nexport { upgradeGateReason } from './utils/upgradeGateReason.utils.js'\n\n// ============================================================================\n// Enums (runtime values)\n// ============================================================================\n\nexport {\n  AlertSubscriptionReportType,\n  AlertSubscriptionType,\n} from './enums/AlertSubscription.enum.js'\nexport { AuditEntity, AuditEntityAttribute } from './enums/AuditEntity.enum.js'\nexport { AuditService } from './enums/AuditService.enum.js'\nexport { BackupStatus } from './enums/BackupStatus.enum.js'\nexport {\n  ClusterBulkOperationStatus,\n  ClusterBulkOperationType,\n} from './enums/ClusterBulkOperation.enum.js'\nexport { ClusterClientPermission } from './enums/ClusterClientPermissions.enum.js'\nexport { ClusterEncryptionKey } from './enums/ClusterEncryptionKey.enum.js'\nexport { ClusterStatus } from './enums/ClusterStatus.enum.js'\nexport { ConsoleAPIClientPermission } from './enums/ConsoleApiClientPermission.enum.js'\nexport { ErrorType } from './enums/ErrorType.enum.js'\nexport type {\n  AssignableOrganizationRoleType,\n  OrganizationRoleType,\n  UnassignableOrganizationRoleType,\n} from './enums/OrganizationRole.enum.js'\nexport {\n  AssignableOrganizationRole,\n  LegacyHeldOrganizationRole,\n  OrganizationRole,\n  UnassignableOrganizationRole,\n} from './enums/OrganizationRole.enum.js'\nexport { SseEntity, SseType } from './enums/Sse.enum.js'\nexport {\n  SystemAuditEntity,\n  SystemAuditEntityAttribute,\n} from './enums/SystemAuditEntity.enum.js'\n\n// ============================================================================\n// Permissions - Namespaces (runtime values)\n// ============================================================================\n\nexport { AccountsPermissions } from './permissions/accounts.permissions.js'\nexport { AlertDistributorPermissions } from './permissions/alert-distributor.permissions.js'\nexport { AuditLoggerPermissions } from './permissions/auditlogger.permissions.js'\nexport {\n  accountsUserFeaturesFromPermissions,\n  consoleUserFeaturesFromPermissions,\n  sessionHasPermission,\n  sessionPermissionKeysFor,\n} from './permissions/combo.js'\nexport { ConsolePermissions } from './permissions/console.permissions.js'\nexport { NotificationPermissions } from './permissions/notification.permissions.js'\n// profile.permissions - Types\nexport type { OnboardConfig } from './permissions/profile.permissions.js'\n// profile.permissions - Values (constants)\n// NOTE: the `allowed` email lists (CLOUD_TEAM_EMAILS, SRE_TEAM_EMAILS, etc.)\n// intentionally live in the private `@camunda-cloud/shared-backend` package\n// instead of here, since this package is published publicly to npm.\nexport { PROFILES } from './permissions/profile.permissions.js'\nexport { expandRolesToPermissions } from './permissions/roleExpansion.utils.js'\n\n// ============================================================================\n// Types - Type-only exports (interfaces and type aliases)\n// ============================================================================\n\nexport type { AuditData } from './types/AuditData.type.js'\n// AutoSleep.type - Types\nexport type {\n  ActivitySleepEligibilityOptions,\n  SleepCronEligibilityOptions,\n} from './types/AutoSleep.type.js'\n// AutoSleep.type - Values (constants and functions)\nexport {\n  INTERNAL_LOW_HARDWARE_PLAN_NAME,\n  isActivitySleepEligible,\n  isClusterTagEligibleForSleepCron,\n  isSalesPlanEligibleForSleepCron,\n  isSleepCronEligible,\n  SLEEP_CRON_ELIGIBLE_TAGS,\n} from './types/AutoSleep.type.js'\nexport type {\n  BotContext,\n  BotOptions,\n  BotRequest,\n  GetUserDetailsResponse,\n  ListRolesForUserResponse,\n  UpdateUserRolesRequest,\n  UpdateUserRolesResponse,\n  UserContext,\n  UserDetails,\n} from './types/Bot.types.js'\n// BulkOperation.type - Types\nexport type {\n  BulkClusterDeletionContent,\n  BulkClusterDeletionItem,\n  BulkClusterGenerationUpdateItem,\n  BulkClusterPlanTypeUpdateContent,\n  BulkClusterPlanTypeUpdateItem,\n  BulkClusterPlanUpdateContent,\n  BulkClusterPlanUpdateItem,\n  BulkGenerationUpdateContent,\n  GenericBulkClusterOperationContent,\n  GenericBulkOperationContent,\n  GenericClusterBulkOperationItem,\n} from './types/BulkOperation.type.js'\n// BulkOperation.type - Functions (type guards)\nexport {\n  isBulkClusterDeletionItem,\n  isBulkClusterPlanTypeUpdateItem,\n  isBulkClusterPlanUpdateItem,\n  isIsBulkClusterGenerationUpdateIten,\n} from './types/BulkOperation.type.js'\n// C8ClusterComponentVersions.type - Types\nexport type {\n  GenerationImageVersionsDto,\n  ImmutableZeebeClusterVersionsDto,\n  MutableZeebeClusterVersionsDto,\n  ZeebeClusterVersionsDto,\n} from './types/C8ClusterComponentVersions.type.js'\n// C8ClusterComponentVersions.type - Values (constants)\nexport {\n  AllThings,\n  GENERATION_IMAGE_VERSION_KEYS,\n  ImmutableThings,\n  MutableThings,\n} from './types/C8ClusterComponentVersions.type.js'\n// CamundaClusterLabels.type - Types\nexport type {\n  CamundaClusterStage,\n  CamundaClusterStageLabel,\n  ClusterLabels,\n} from './types/CamundaClusterLabels.type.js'\n// CamundaClusterLabels.type - Values (constants)\nexport {\n  ALLOWED_CAMUNDA_LABELS,\n  StageClusterLabels,\n} from './types/CamundaClusterLabels.type.js'\n// Chargebee.type - Types\nexport type { SubscriptionItem } from './types/Chargebee.type.js'\n// Chargebee.type - Values (enums)\nexport { ConsumptionData, ConsumptionDataType } from './types/Chargebee.type.js'\n// ClusterBulkOperation.type - Types\nexport type {\n  ClusterBulkOperationAck,\n  ClusterBulkOperationClusterDto,\n  ClusterBulkOperationContent,\n  ClusterBulkOperationDto,\n  ClusterBulkOperationGenerationUpdateParameter,\n  ClusterBulkOperationParameter,\n  ClusterBulkOperationPlanTypeUpdateParameter,\n  ClusterBulkOperationPlanUpdateParameter,\n  ClusterBulkOperationPostContent,\n  ClusterSleepWakeupParameter,\n} from './types/ClusterBulkOperation.type.js'\nexport type {\n  ClusterModificationConfigDto,\n  ClusterModificationDto,\n} from './types/ClusterModification.type.js'\n// ClusterPlanFields.type - Values (field spec and type guard)\nexport {\n  CLUSTER_PLAN_FIELDS,\n  type ClusterPlanFieldSpec,\n  type ClusterPlanFieldTree,\n  isClusterPlanFieldSpec,\n} from './types/ClusterPlanFields.type.js'\nexport type {\n  ClusterPlanModificationAck,\n  ClusterPlanModificationConfig,\n  ClusterPlanModificationDto,\n} from './types/ClusterPlanModification.type.js'\n// ClusterPlanTypeAvailabilityClass.type - Values (enum and function)\nexport {\n  ClusterPlanTypeAvailabilityClass,\n  hasNoAvailabilityClass,\n  sortByAvailabilityClasses,\n} from './types/ClusterPlanTypeAvailabilityClass.type.js'\n// ClusterPlanTypeCategory.type - Values (enum and functions)\nexport {\n  ClusterPlanTypeCategory,\n  hasAvailabilityClass,\n  sortByClusterPlanTypeCategory,\n} from './types/ClusterPlanTypeCategory.type.js'\nexport type { ClusterPlanTypesToConfig } from './types/ClusterPlanTypesToConfig.type.js'\nexport type { ClusterPlanTypesToReserved } from './types/ClusterPlanTypesToReserved.type.js'\nexport type {\n  ClusterTtlDeletionPayload,\n  ClusterTtlDeletionResult,\n  ClusterTtlDto,\n  ClusterTtlDuration,\n  ClusterTtlOption,\n  ClusterTtlUnlimited,\n  UpdateClusterTtlBody,\n} from './types/ClusterTtl.type.js'\nexport {\n  CLUSTER_TTL_BACKFILL_REASON,\n  CLUSTER_TTL_DURATION_MS,\n  CLUSTER_TTL_DURATIONS,\n  CLUSTER_TTL_FEATURE_FLAG,\n  CLUSTER_TTL_OPTIONS,\n  CLUSTER_TTL_UNLIMITED_LINK_MAX_LENGTH,\n  CLUSTER_TTL_UNLIMITED_REASON_MAX_LENGTH,\n  clusterTtlExpiresAt,\n  DEFAULT_CLUSTER_TTL_OPTION,\n  extendClusterTtl,\n  isClusterTtlDuration,\n  isClusterTtlOption,\n  isClusterTtlStage,\n  isHttpUrl,\n  isPastClusterTtl,\n  validateClusterTtlUnlimited,\n} from './types/ClusterTtl.type.js'\nexport type {\n  ClusterUsageDataRequest,\n  ClusterUsageMetadataDto,\n  ClusterUsageMetricsAddRequestByMetricHeap,\n  ClusterUsageMetricsData,\n  ClusterUsageMetricsFilter,\n  ClusterUsageOrgStartDate,\n} from './types/ClusterUsageMetrics.type.js'\n// Dashboard.types - Types\nexport type {\n  DashboardConfig,\n  DashboardMappingItem,\n  DashboardMappingTarget,\n  DashboardResultPrimitive,\n  DashboardResultRow,\n  EngineeringOperationsDashboardResponse,\n} from './types/Dashboard.types.js'\nexport type { EnterpriseIncludingValueMetrics } from './types/EnterpriseIncludingValueMetrics.type.js'\nexport type {\n  HdpTenantUsageBreakdown,\n  HdpTenantUsagePerClusterPoint,\n  HdpTenantUsagePoint,\n} from './types/HdpTenantUsage.type.js'\n// hdp.types - Types (interfaces)\nexport type {\n  AlertSubscription as HdpAlertSubscription,\n  Audit as HdpAudit,\n  ByomClient as HdpByomClient,\n  Channel as HdpChannel,\n  Cluster as HdpCluster,\n  ClusterBackup as HdpClusterBackup,\n  ClusterBackupSchedule as HdpClusterBackupSchedule,\n  ClusterBulkOperation as HdpClusterBulkOperation,\n  ClusterClient as HdpClusterClient,\n  ClusterModification as HdpClusterModification,\n  ClusterPlan as HdpClusterPlan,\n  ClusterPlanType as HdpClusterPlanType,\n  ConnectorSecret as HdpConnectorSecret,\n  ConsoleApiClient as HdpConsoleApiClient,\n  Datacenter as HdpDatacenter,\n  Generation as HdpGeneration,\n  HdpBackendChangeEvent,\n  HdpClusterModificationConfig,\n  HdpDisk,\n  HdpEntity,\n  HdpPrometheusDataCapacityDataPoint,\n  Invite as HdpInvite,\n  LlmSpend as HdpLlmSpend,\n  Organization as HdpOrganization,\n  SecureConnectivity as HdpSecureConnectivity,\n  SystemAudit as HdpSystemAudit,\n  TelemetryData as HdpTelemetryData,\n  UsageAlert as HdpUsageAlert,\n  User as HdpUser,\n  UserLogin as HdpUserLogin,\n} from './types/hdp.types.js'\n// hdp.types - Values (enums)\nexport {\n  AlertSubscriptionReportType as HdpAlertSubscriptionReportType,\n  AlertSubscriptionType as HdpAlertSubscriptionType,\n  HDP_DISKS,\n} from './types/hdp.types.js'\n// notification.type - Types\nexport type {\n  GlobalNotification,\n  NotificationDto,\n  NotificationMeta,\n  NotificationOptions,\n  NotificationPermission,\n  NotificationSource,\n  NotificationState,\n  NotificationType,\n  OrgNotification,\n  UserNotification,\n  UserOrgNotification,\n} from './types/notification.type.js'\n// notification.type - Values (enums and constants)\nexport {\n  NotificationPermissionValues,\n  NotificationSourceEnum,\n  NotificationStateEnum,\n  NotificationTypeEnum,\n} from './types/notification.type.js'\n// OrganizationPermission.type - Types\nexport type {\n  CreateReadUpdateDelete,\n  OrganizationPermissions,\n} from './types/OrganizationPermission.type.js'\n// OrganizationPermission.type - Values (constants)\nexport {\n  OrganizationPermissionsDescriptions,\n  PermissionsForOrganizationRole,\n} from './types/OrganizationPermission.type.js'\nexport {\n  getPreprodClusterTtlHours,\n  isPastPreprodClusterTtl,\n  isPreprodClusterTtlStage,\n  parseNumericLimit,\n} from './types/PreprodClusterTtl.type.js'\n// Roles.js - Types\nexport type {\n  AccountRoles,\n  ConsoleRoles,\n  ModelerRoles,\n  Roles,\n} from './types/Roles.js'\n// Roles.js - Values (constants)\nexport { SAFE_ROLES } from './types/Roles.js'\n// SalesPlanType.type - Types\nexport type {\n  DisplayedSalesPlan,\n  RevisitedSalesPlanName,\n} from './types/SalesPlanType.type.js'\n// SalesPlanType.type - Values (enums and functions)\nexport {\n  AnalyticsSalesPlanType,\n  getAnalyticsSalesPlanFromOrgSalesPlan,\n  getDisplayedSalesPlan,\n  getRevisitedSalesPlanName,\n  OPTIMIZE_DISABLED_PLAN_TYPES,\n  SalesPlanType,\n} from './types/SalesPlanType.type.js'\n// SpamDetection.type - Types\nexport type { SpamDetectionPatterns } from './types/SpamDetection.type.js'\n// SpamDetection.type - Values (constants)\nexport { TEERGRUBE_PATTERNS } from './types/SpamDetection.type.js'\nexport type {\n  AlertSubscriptionSseEvent,\n  BackupSseEvent,\n  ClusterClientSseEvent,\n  ClusterSseEvent,\n  ConnectorSecretsSseEvent,\n  ConsoleApiClientSseEvent,\n  ConsoleSseEvent,\n  MonitoringSseEvent,\n  SecureConnectivitySseEvent,\n  SseClusterPayload,\n  SseMonitoringPayload,\n  SseSecureConnectivityPayload,\n} from './types/SseEvent.type.js'\n// Namespace (type-only - contains only interfaces)\nexport type { AccountsStats } from './types/Stats.types.js'\n// Survey.type - Types\nexport type { Persona, SurveyDto } from './types/Survey.type.js'\n// Survey.type - Values (enum)\nexport { FeedbackType } from './types/Survey.type.js'\n// SuspendStrategy.type - Types\nexport type {\n  GetSuspendStrategyOptions,\n  SuspendStrategy,\n} from './types/SuspendStrategy.type.js'\n// SuspendStrategy.type - Values (function)\nexport { getSuspendStrategy } from './types/SuspendStrategy.type.js'\nexport type { SystemAuditData } from './types/SystemAuditData.type.js'\n\n// Namespace (runtime value)\nexport { Telemetry } from './types/Telemetry.type.js'\n\n// TrialManagement.types - Types\nexport type {\n  ExtensionListItem,\n  ExtensionListResponse,\n  OrgTrialDetail,\n  TrialExtensionSource,\n  TrialManagementStats,\n} from './types/TrialManagement.types.js'\n\n// User.type - Types\nexport type {\n  AccountsData,\n  AppMetadata,\n  BasicUser,\n  BlockedFor,\n  Identity,\n  OrgMembership,\n  User,\n  UserMetadata,\n  UserRequest,\n} from './types/User.type.js'\n\n// User.type - Values (enum)\nexport { UserMetadataEvent } from './types/User.type.js'\n\nexport type {\n  UniqueTaskUser,\n  ValueMetrics,\n  ValueMetricsPerYearMonth,\n} from './types/ValueMetrics.type.js'\n\n// ============================================================================\n// Utils - Classes (runtime values)\n// ============================================================================\n\nexport {\n  CLOUD_PROVIDER_ORDER,\n  getCloudProviderLabel,\n  getCloudProviderRank,\n} from './utils/cloudProvider.utils.js'\nexport {\n  type ConnectivityStatus,\n  deriveConnectivityMessage,\n  deriveConnectivityStatus,\n} from './utils/connectivityStatus.utils.js'\nexport type {\n  CronScheduleValidationFailure,\n  CronScheduleValidationResult,\n  CronScheduleValidationSuccess,\n} from './utils/cronSchedule.utils.js'\nexport {\n  BACKUP_SCHEDULE_MIN_INTERVAL_MINUTES,\n  validateCronSchedule,\n} from './utils/cronSchedule.utils.js'\nexport {\n  canonicalPlan,\n  canonicalPlanKey,\n} from './utils/elasticsearchPlanPath.utils.js'\nexport {\n  deriveEncryptionStatus,\n  type EncryptionStatus,\n  isEncryptionStatus,\n} from './utils/encryptionStatus.utils.js'\n// enterprise-connection.utils - Types\nexport type { EnterpriseConnectionOrganizationAssignment } from './utils/enterprise-connection.utils.js'\n// enterprise-connection.utils - Values (functions)\nexport {\n  enterpriseConnectionMetadataToOrganizationAssignments,\n  organizationAssignmentsToEnterpriseConnectionMetadata,\n} from './utils/enterprise-connection.utils.js'\nexport {\n  addMonthsClamped,\n  DEFAULT_ENTERPRISE_DURATION_IN_MONTHS,\n  diffInWholeMonths,\n  type EnterpriseTermWindow,\n  getCurrentEnterpriseTerm,\n  peakWithinTerm,\n  toUtcDayStartMs,\n} from './utils/enterpriseTerm.utils.js'\nexport type { EnvVarEntry } from './utils/envVars.js'\nexport { parseEnvVars, serializeEnvVars } from './utils/envVars.js'\nexport {\n  deriveFailoverKeyPolicyPrincipals,\n  type FailoverKeyPolicyPrincipals,\n} from './utils/failoverKeyPolicy.utils.js'\nexport type {\n  JvmOptionsModificationKey,\n  ParsedJvmOption,\n} from './utils/jvmOptions.js'\nexport {\n  addsEnvVarsOverrideValue,\n  isJvmOptionsModificationKey,\n  isUnderJvmSpec,\n  JVM_OPTION_MAX_LENGTH,\n  JVM_OPTION_PATTERN,\n  JVM_OPTIONS_MAX_ITEMS,\n  JVM_OPTIONS_MODIFICATION_KEYS,\n  JVM_OPTIONS_TARGETS,\n  joinJvmOptions,\n  parseJvmOption,\n  requiresEnvVarsOverride,\n  splitJvmOptions,\n  validateJvmOptions,\n  validateJvmOptionsValue,\n} from './utils/jvmOptions.js'\nexport {\n  KMS_ARN,\n  KMS_MRK_ARN,\n  type KmsArnValidationError,\n  type ParsedKmsArn,\n  parseKmsArn,\n  validateKmsArnForRegion,\n} from './utils/kmsArn.utils.js'\nexport { validateLabels } from './utils/labelValidator.utils.js'\nexport { ObjectMergeUtils } from './utils/objectMerge.utils.js'\nexport {\n  computeOrgStartDate,\n  type OrgStartDateInput,\n} from './utils/orgStartDate.utils.js'\nexport {\n  getPermissionsByRoles,\n  getUserPermissionsForOrg,\n} from './utils/orgs/OrgHelper.js'\n\n// PasswordPolicy - Types\nexport type {\n  PasswordPolicyRequest,\n  PasswordPolicyResult,\n} from './utils/PasswordPolicy.js'\n\n// PasswordPolicy - Values (constants and function)\nexport {\n  MAXLENGTH as PASSWORD_POLICY_MAXLENGTH,\n  MINLENGTH as PASSWORD_POLICY_MINLENGTH,\n  passwordPolicyCheck,\n} from './utils/PasswordPolicy.js'\nexport { isQaUserEmail, qaUserEmail } from './utils/qa-user.utils.js'\nexport {\n  deriveSecondaryStorageStatus,\n  type SecondaryStorageStatus,\n} from './utils/secondaryStorageStatus.utils.js'\nexport {\n  allSettledResultsCounts,\n  getFulfilledPromises,\n  getRejectedPromises,\n  getSettledSummary,\n} from './utils/settledPromises.util.js'\nexport {\n  isValidAwsArn,\n  isValidCIDR,\n  isValidCIDRList,\n  isValidClientName,\n  isValidHostname,\n  isValidPrivateLinkRegion,\n  normalizeCIDRList,\n} from './utils/string-validation.utils.js'\nexport {\n  extractCamundaUserEmail,\n  guessName,\n  isCamundaUserId,\n} from './utils/user.utils.js'\n\n// versionCheck.utils - Values (enum and function)\nexport {\n  checkVersion,\n  generationImageErrorMessage,\n  isAppIntegrationsVersionSupported,\n  isGenerationResumable,\n  isSecretsFilterModeConfigurable,\n  isValidGenerationImage,\n  normalizeGenerationVersion,\n  stripSecfixPostfix,\n  VersionCheckOperator,\n} from './utils/versionCheck.utils.js'\n\n// ============================================================================\n// Config - Configuration files and types\n// ============================================================================\n\nexport { default as CAMUNDI_PERMISSION_RULES } from './config/camundi-permission-rules.js'\nexport type { CamundiPermissionRules } from './config/camundi-permission-rules.types.js'\n\nexport {\n  augmentCamundiPermissions,\n  getApplicableRolesForEmployee,\n  HIBOB_CACHE_KEY,\n  HIBOB_CACHE_NAMESPACE,\n  isManager,\n} from './utils/camundiPermissionAugmenter.utils.js'\n"],
-  "mappings": "AAUA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,KAAK,MAAM,QAAQ,QAAQ,YAAY;AAEhD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,4BAA4B;AACrC,SAAS,iDAAiD;AAC1D,SAAS,6CAA6C;AAKtD,SAAS,wCAAwC;AACjD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAcP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAeP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAMP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAOP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAMA;AAAA,EASA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAIP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAUP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAWP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAuBP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAWP,SAAS,uCAAuC;AAkBhD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AA4CP,SAAS,mCAAmC;AA8C5C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAiBP;AAAA,EACE;AAAA,EACA;AAAA,EAGA;AAAA,OAEK;AAyBP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAsBP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAmBP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EAEA;AAAA,OASK;AACP,SAAS,yBAAyB;AAMlC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,aAAa,4BAA4B;AAClD,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,+BAA+B;AACxC,SAAS,4BAA4B;AACrC,SAAS,qBAAqB;AAC9B,SAAS,kCAAkC;AAC3C,SAAS,iBAAiB;AAM1B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,WAAW,eAAe;AACnC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAMP,SAAS,2BAA2B;AACpC,SAAS,mCAAmC;AAC5C,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B;AACnC,SAAS,+BAA+B;AAOxC,SAAS,gBAAgB;AACzB,SAAS,gCAAgC;AAazC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA2BP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AASP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAQP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAIP,SAAS,iBAAiB,2BAA2B;AAmBrD;AAAA,EACE;AAAA,EAGA;AAAA,OACK;AAOP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAYP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA0DP;AAAA,EACiC,+BAA/BA;AAAA,EACyB,yBAAzBC;AAAA,EACA;AAAA,OACK;AAgBP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAOP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AASP,SAAS,kBAAkB;AAO3B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAIP,SAAS,0BAA0B;AAoBnC,SAAS,oBAAoB;AAO7B,SAAS,0BAA0B;AAInC,SAAS,iBAAiB;AAyB1B,SAAS,yBAAyB;AAYlC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EAEE;AAAA,EACA;AAAA,OACK;AAMP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EAEA;AAAA,OACK;AAIP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,cAAc,wBAAwB;AAC/C;AAAA,EACE;AAAA,OAEK;AAKP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB;AAC/B,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AASP;AAAA,EACe;AAAA,EACA;AAAA,EACb;AAAA,OACK;AACP,SAAS,eAAe,mBAAmB;AAC3C;AAAA,EACE;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAMP,SAAoB,WAAXC,gBAA2C;AAGpD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n// ============================================================================\n// Constants (runtime values)\n// ============================================================================\n\nexport {\n  CUSTOM_GENERATION_MAX_PER_REQUESTER,\n  CUSTOM_GENERATION_MAX_UPGRADEABLE_FROM,\n  CUSTOM_GENERATION_NAME_MAX_LENGTH,\n  CUSTOM_GENERATION_NAME_MIN_LENGTH,\n  checkNewGenerationVersions,\n  isCustomGenerationStage,\n} from './constants/custom-generation.const.js'\nexport {\n  CUSTOM_HARDWARE_SIZING_BROKER_TOTAL_CAPS,\n  CUSTOM_HARDWARE_SIZING_COUNT_CAPS,\n  CUSTOM_HARDWARE_SIZING_ELASTICSEARCH_TOTAL_CAPS,\n  CUSTOM_HARDWARE_SIZING_MAX_AUTO_RESIZE_INCREASE_GI,\n  CUSTOM_HARDWARE_SIZING_MAX_PLAN_JSON_LENGTH,\n  CUSTOM_HARDWARE_SIZING_MAX_PLANS_PER_REQUESTER,\n  CUSTOM_HARDWARE_SIZING_NAME_MAX_LENGTH,\n  CUSTOM_HARDWARE_SIZING_NAME_MIN_LENGTH,\n  CUSTOM_HARDWARE_SIZING_REPLICA_SET_TOTAL_CAPS,\n  CUSTOM_HARDWARE_SIZING_RESOURCE_CAPS,\n  checkCustomHardwareSizing,\n  isCustomHardwareSizingStage,\n  parseKubernetesQuantity,\n} from './constants/custom-hardware-sizing.const.js'\nexport { DAY, HOUR, MINUTE, SECOND, WEEK } from './constants/duration.const.js'\nexport type { Stage } from './constants/misc.const.js'\nexport {\n  CAMUNDA_CLAIMS_NAMESPACE,\n  CONSOLE_API_USER_ID,\n  countBulkOperationAcks,\n  FIRSTNAME_LASTNAME_MAX_LENGTH,\n  HOTBACKUP_MIN_CREATE_PERIOD,\n  INT_MINIMUM_BULK_OPERATION_ACKS,\n  MAX_HARDWARE_PACKAGE_COUNT,\n  MAX_LENGTH_CLUSTER_NAME,\n  MINIMUM_EYEPAIRS,\n  MINIMUM_EYEPAIRS_BY_BULK_OPERATION_TYPE,\n  minimumBulkOperationAcks,\n  minimumBulkOperationEyes,\n  missingBulkOperationAcks,\n  NAMES_OF_ENTERPRISE_SALESPLANS_WITH_SLEEPING_CLUSTERS,\n  requiredBulkOperationAcks,\n  SECRETS_MAX_LENGTH,\n  STARTING_PRICE_PER_MONTH_IN_EURO,\n  TEMPORARY_CLUSTER_NAME,\n  UNKNOWN_ACTOR_EMAIL,\n} from './constants/misc.const.js'\nexport {\n  getGatewayPropertyHint,\n  getGatewayPropertyPath,\n  isAffectedByStreamlinedDeployment,\n  isPre89AffectedPath,\n  PRE89_AFFECTED_PATHS,\n  PRE89_AFFECTED_PROPERTY_PREFIXES,\n  PRE89_GATEWAY_PROPERTY_PATHS,\n  PRE89_GATEWAY_RESOURCE_PREFIXES,\n} from './constants/pre89EnvVarMapping.const.js'\nexport { PRIVATE_LINK_REGIONS } from './constants/privateLinkRegions.const.js'\nexport { SECURE_CONNECTIVITY_ALLOWED_ENTRIES_LIMIT } from './constants/secureConnectivity.const.js'\nexport { isSelfServiceClusterModificationStage } from './constants/self-service-cluster-modification.const.js'\nexport type {\n  TrialExtensionSurveyAnswer,\n  TrialExtensionSurveyQuestion,\n} from './constants/trialExtensionSurvey.const.js'\nexport { TRIAL_EXTENSION_SURVEY_QUESTIONS } from './constants/trialExtensionSurvey.const.js'\nexport {\n  V2_BODY_IDS_MAX,\n  V2_FILTER_IDS_MAX,\n  V2_MAX_PAGE_LIMIT,\n} from './constants/v2-list.const.js'\nexport {\n  ADMIN_APP_RENAME_MIN_VERSION,\n  APP_INTEGRATIONS_89_STREAM_CONNECTOR_BRIDGE_MIN_VERSION,\n  APP_INTEGRATIONS_89_STREAM_MINOR,\n  APP_INTEGRATIONS_89_STREAM_ZEEBE_MIN_VERSION,\n  APP_INTEGRATIONS_MIN_VERSION,\n  AUDIT_LOG_TAB_MIN_VERSION,\n  AUTHORIZATION_TOGGLE_MIN_VERSION,\n  AWS_ONLY_GENERATION_MIN_VERSION,\n  BUSINESS_ID_UNIQUENESS_MIN_VERSION,\n  BYOIDP_MIN_VERSION,\n  CLUSTER_SECRETS_LABEL_MIN_VERSION,\n  CLUSTER_STATISTICS_CONFIG_MIN_VERSION,\n  CONNECTOR_MANAGEMENT_METRICS_MIN_VERSION,\n  CONNECTOR_SECRET_SYNC_MIN_VERSION,\n  CONNECTORS_MANAGEMENT_LINK_MIN_VERSION,\n  ENFORCE_GROUPS_TASKLIST_V2_HIDDEN_MIN_VERSION,\n  ENFORCE_GROUPS_TOGGLE_MIN_VERSION,\n  GATEWAY_SPEC_8_9_MIN_VERSION,\n  HOT_BACKUP_MIN_VERSION,\n  IDENTITY_AUTHORIZATION_MIN_VERSION,\n  IDENTITY_AUTHORIZATION_NOTICE_MAX_VERSION,\n  IDENTITY_MANAGEMENT_MIN_VERSION,\n  INTERNAL_CONNECTORS_MANAGEMENT_MIN_VERSION,\n  JOB_DASHBOARD_MIN_VERSION,\n  LINE_8_9_MIN_VERSION,\n  LINE_8_10_MIN_VERSION,\n  MCP_MIN_VERSION,\n  MULTI_TENANCY_TOGGLE_MIN_VERSION,\n  NEW_CLUSTER_ROLES_MIN_VERSION,\n  OPTIMIZE_DEFAULT_ON_MIN_VERSION,\n  OPTIMIZE_FILTERING_MIN_VERSION,\n  OPTIONAL_TELEMETRY_MIN_VERSION,\n  RESOURCE_BASED_AUTHORIZATIONS_MIN_VERSION,\n  REST_API_URL_TRANSFORM_MIN_VERSION,\n  REST_API_V2_MIN_VERSION,\n  RESUME_ALPHA_MIN_VERSION,\n  SECRET_SOURCE_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_6_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_7_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_8_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_9_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_10_MIN_VERSION,\n  SESSION_CONFIG_MIN_VERSION,\n  SWAGGER_MIN_VERSION,\n  SWAGGER_URL_8_9_MIN_VERSION,\n  TASKLIST_MODE_TOGGLE_MIN_VERSION,\n  TASKLIST_UPGRADE_BANNER_MIN_VERSION,\n  TASKLIST_V2_AUTO_ENABLE_FROM_MINOR,\n  TASKLIST_V2_AUTO_ENABLE_TO_MINOR,\n  TASKLIST_V2_DEFAULT_ON_MIN_VERSION,\n  TASKLIST_V2_SETTING_MAX_VERSION,\n  TASKLIST_V2_UPGRADE_MIN_VERSION,\n  TASKLIST_V2_UPGRADE_TARGET_MIN_VERSION,\n  UPGRADE_READINESS_MIN_VERSION,\n  ZEEBE_REST_URL_MIN_VERSION,\n} from './constants/version-gates.const.js'\n\n// ============================================================================\n// DTOs - Types (interfaces and type aliases)\n// ============================================================================\n\n// Annotations - the notes and the tags that a Camundi attaches to a fleet\n// entity. The wire types and the rules are pure and browser-safe, so\n// control-backend and control-frontend run the same code.\nexport type {\n  AnnotationActorView,\n  AnnotationDecision,\n  AnnotationDenialCode,\n} from './annotations/policy.js'\nexport {\n  ANNOTATION_DENIAL_MESSAGES,\n  canEditNote,\n  canRemove,\n  checkNoteBody,\n  checkTagName,\n  isAuthor,\n} from './annotations/policy.js'\nexport type {\n  ClusterBulkClusterResultDto,\n  ClusterBulkFinalStatus,\n  ClusterBulkGenerationUpdateSettings,\n  ClusterBulkOperationPayloadDto,\n  ClusterBulkOperationRule,\n  ClusterBulkPlanTypeUpdateSettings,\n  ClusterBulkPlanUpdateSettings,\n  ClusterBulkSettingsByType,\n  ClusterBulkSleepWakeupSettings,\n  ClusterBulkStepRequestDto,\n  ClusterBulkStepResultDto,\n  ClusterBulkTargetDto,\n} from './approvals/cluster-bulk-operation.js'\nexport {\n  CLUSTER_BULK_OPERATION_CLUSTER_NAME_MAX_LENGTH,\n  CLUSTER_BULK_OPERATION_MAX_CLUSTERS,\n  CLUSTER_BULK_OPERATION_MIN_ACKS,\n  CLUSTER_BULK_OPERATION_NAME_MAX_LENGTH,\n  CLUSTER_BULK_OPERATION_RULES,\n  CLUSTER_BULK_OPERATION_TEST_STAGE_MIN_ACKS,\n  CLUSTER_BULK_OPERATION_TYPES,\n  CLUSTER_BULK_SLEEPING_CLUSTER_DELAY_MS,\n  clusterBulkOperationTypeOf,\n  clusterBulkParameterOf,\n  clusterBulkRequiredPermissions,\n  clusterBulkResultOf,\n  isClusterBulkYolo,\n} from './approvals/cluster-bulk-operation.js'\nexport {\n  DNS_SUBDOMAIN_MAX_LENGTH,\n  isDnsSubdomain,\n} from './approvals/dns-subdomain.js'\nexport type { ApprovalExpectedChange } from './approvals/expected-value.js'\nexport {\n  isSameApprovalValue,\n  staleApprovalKeys,\n} from './approvals/expected-value.js'\nexport type {\n  ApprovalActorView,\n  ApprovalDecision,\n  ApprovalDenialCode,\n} from './approvals/policy.js'\nexport {\n  approvalPermissionCheck,\n  canAcknowledge,\n  canCreate,\n  canExecute,\n  canReject,\n  canView,\n  canWithdraw,\n  effectiveStatus,\n  hasActorEmail,\n  hasEveryPermission,\n  isExpired,\n  isSameActor,\n  isSameActorEmail,\n  remainingAcks,\n  requiredPermissionsOf,\n  resolveRequiredAcks,\n} from './approvals/policy.js'\nexport type {\n  ReleaseTrainAutoUpgradeCandidates,\n  ReleaseTrainPublishPayload,\n  ReleaseTrainRollbackPayload,\n} from './approvals/release-train.js'\nexport type { ApprovalUseCaseType } from './approvals/use-cases.const.js'\nexport {\n  APPROVAL_EMAIL_MAX_LENGTH,\n  APPROVAL_EMAIL_PATTERN,\n  APPROVAL_USE_CASE_TYPES,\n  ENTERPRISE_ONBOARDING_METRIC_MAX,\n  ENTERPRISE_ONBOARDING_NAME_MAX_LENGTH,\n  ENTERPRISE_ONBOARDING_RESERVATION_MAX,\n  ENTERPRISE_ONBOARDING_SFDC_ID_MAX_LENGTH,\n  ENTERPRISE_ONBOARDING_TERM_MAX_MONTHS,\n  ENTERPRISE_ONBOARDING_TERM_MIN_MONTHS,\n  EXTEND_TRIAL_MAX_DAYS,\n  EXTEND_TRIAL_MIN_DAYS,\n  FEATURE_FLAG_MIN_ACKS_PROD,\n  GENERATION_VERSION_VALUE_MAX_LENGTH,\n  GENERATION_VERSIONS_MAX_GENERATIONS,\n  isCalendarDay,\n  ORG_LIMIT_TEXT_MAX_LENGTH,\n  PERSONAL_ORGANIZATION_MAX_PER_REQUESTER,\n  PERSONAL_ORGANIZATION_NAME_MAX_LENGTH,\n  PERSONAL_ORGANIZATION_NAME_MIN_LENGTH,\n  PLATFORM_ROLE_CHANGE_MAX_ROLES,\n  PURGE_USERS_MAX_USERS,\n  PURGE_USERS_REQUIRED_PERMISSIONS,\n  USER_METADATA_EXPECTED_MAX_LENGTH,\n  USER_METADATA_MAX_LENGTH,\n} from './approvals/use-cases.const.js'\n// The chart query of a dashboard tile (catalogue, language, result).\nexport {\n  CHART_DAY_GRAIN_MAX_DAYS,\n  CHART_FILTER_MAX_LENGTH,\n  CHART_GRAIN_DEFAULT,\n  CHART_GRAINS,\n  CHART_ID_MAX_LENGTH,\n  CHART_METRICS,\n  CHART_OTHER_SERIES_KEY,\n  CHART_QUERY_MAX_LENGTH,\n  CHART_TOP_DEFAULT,\n  CHART_TOP_MAX,\n  CHART_UNKNOWN_SERIES_KEY,\n  CHART_WINDOW_AMOUNT_MAX,\n  CHART_WINDOW_DEFAULT,\n  CHART_WINDOW_UNITS,\n  type ChartDimensionSpec,\n  type ChartGrain,\n  type ChartMetricSpec,\n  type ChartPoint,\n  type ChartQueryCheck,\n  ChartQueryError,\n  type ChartQueryErrorKind,\n  type ChartQueryOptions,\n  type ChartResult,\n  type ChartSeries,\n  type ChartSpec,\n  type ChartUnit,\n  type ChartWindow,\n  type ChartWindowUnit,\n  chartBucketStart,\n  chartToday,\n  chartWindowRange,\n  findChartDimension,\n  findChartMetric,\n  formatChartSpec,\n  isChartQueryError,\n  parseChartQuery,\n  readChartSpec,\n  validateChartSpec,\n} from './charts/index.js'\n// Dashboards - the tiles of a dashboard hold filters and never data. The\n// wire types and the placement rules are pure, so control-backend and\n// control-frontend run the same code.\nexport {\n  DASHBOARD_TILE_DEFAULT_SIZE,\n  dashboardDefinitionBytes,\n  dashboardDefinitionFits,\n  dashboardTileDefaultSize,\n  emptyDashboardDefinition,\n  isSafeDashboardLink,\n  placeNewTile,\n  placeNewTiles,\n  tilesOverlap,\n  toStoredDashboardDefinition,\n  upgradeDashboardDefinition,\n} from './dashboards/definition.js'\nexport type {\n  ALERT_SUBSCRIPTION_REPORT_TYPES,\n  ALERT_SUBSCRIPTION_TYPES,\n  AlertSubscriptionDto,\n  AlertSubscriptionEntryDto,\n  AlertSubscriptionWebhookAuth,\n  CheckFailedReason,\n} from './dtos/AlertSubscription.dto.js'\n// DTOs - Values (constants)\nexport {\n  FORBIDDEN_HOSTNAMES_FOR_WEBHOOK_ALERTS,\n  HMAC_HEADER_POSITION,\n  HMAC_SUPPORTED_ALGORITHM,\n} from './dtos/AlertSubscription.dto.js'\nexport type {\n  AnnotationActor,\n  AnnotationDto,\n  AnnotationEntityKind,\n  AnnotationKind,\n  AnnotationLookupDto,\n  AnnotationLookupEntryDto,\n  AnnotationTagDto,\n  EntityAnnotationsDto,\n} from './dtos/Annotation.dto.js'\nexport {\n  ANNOTATION_BODY_MAX,\n  ANNOTATION_ENTITY_KIND_LABELS,\n  ANNOTATION_ENTITY_KINDS,\n  ANNOTATION_ENTITY_MAX,\n  ANNOTATION_KINDS,\n  ANNOTATION_LOOKUP_MAX_ENTITIES,\n  ANNOTATION_LOOKUP_TAGS_MAX,\n  ANNOTATION_PAGE_SIZE_DEFAULT,\n  ANNOTATION_PAGE_SIZE_MAX,\n  ANNOTATION_SEARCH_MAX_LENGTH,\n  ANNOTATION_TAG_NAME_MAX,\n  normalizeTagName,\n} from './dtos/Annotation.dto.js'\n// Approvals - the wire types, and the rules that read them. Both are pure and\n// browser-safe, so control-backend, control-frontend and cloudbot run the same\n// code and cannot disagree.\nexport type {\n  ApprovalAck,\n  ApprovalActionMode,\n  ApprovalActor,\n  ApprovalEntityRef,\n  ApprovalEntityType,\n  ApprovalExecutionMode,\n  ApprovalJobDto,\n  ApprovalJobStatus,\n  ApprovalM2mActor,\n  ApprovalProgress,\n  ApprovalSortField,\n  ApprovalSortOrder,\n  ApprovalStatusCountsDto,\n  ApprovalSummaryField,\n  ApprovalSummaryFieldKind,\n  ApprovalSummaryValue,\n  ApprovalUseCaseDto,\n} from './dtos/ApprovalJob.dto.js'\nexport {\n  APPROVAL_ACKS_MAX,\n  APPROVAL_ENTITY_TYPES,\n  APPROVAL_JOB_STATUSES,\n  APPROVAL_LIST_SUMMARY_VALUES_MAX,\n  APPROVAL_LIVE_STATUSES,\n  APPROVAL_PAGE_SIZE_DEFAULT,\n  APPROVAL_PAGE_SIZE_MAX,\n  APPROVAL_PAYLOAD_ORG_FIELD,\n  APPROVAL_REASON_MAX_LENGTH,\n  APPROVAL_RUN_STALE_MS,\n  APPROVAL_SEARCH_MAX_LENGTH,\n  APPROVAL_SORT_DEFAULT,\n  APPROVAL_SORT_FIELDS,\n  APPROVAL_SUMMARY_FIELD_KINDS,\n  isRunStalled,\n  progressFraction,\n} from './dtos/ApprovalJob.dto.js'\nexport type { AuditDto } from './dtos/Audit.dto.js'\nexport type { Auth0ResourceServerDto } from './dtos/Auth0ResourceServer.dto.js'\nexport type { BackupDto } from './dtos/Backup.dto.js'\nexport type { BackupScheduleDto } from './dtos/BackupSchedule.dto.js'\nexport type { ByomClientDto, ByomStatus } from './dtos/ByomClient.dto.js'\nexport type {\n  ClusterCreationDefaultField,\n  ClusterCreationDefaultKey,\n  ClusterCreationDefaults,\n} from './dtos/ClusterCreationDefaults.dto.js'\nexport { CLUSTER_CREATION_DEFAULT_FIELDS } from './dtos/ClusterCreationDefaults.dto.js'\nexport type {\n  ClusterDeferredSpecChange,\n  DeferredSpecChangeType,\n} from './dtos/ClusterDeferredSpecChange.dto.js'\nexport type { ClusterIpWhitelistDto } from './dtos/ClusterIpWhitelist.dto.js'\nexport type {\n  MoveClusterOwnerResult,\n  MoveClusterWarnings,\n} from './dtos/ClusterOwnerMove.dto.js'\nexport type { ClusterPlanDto } from './dtos/ClusterPlan.dto.js'\nexport type { ClusterPlanTypeDto } from './dtos/ClusterPlanType.dto.js'\nexport type {\n  ChangeClusterPlanTypeResult,\n  ClusterModificationConfigRef,\n  ClusterPlanTypeChangeRefusal,\n  ClusterPlanTypeStateDto,\n} from './dtos/ClusterPlanTypeChange.dto.js'\nexport {\n  CLUSTER_PLAN_TYPE_CHANGE_REFUSALS,\n  clusterPlanTypeChangeRefusalOf,\n} from './dtos/ClusterPlanTypeChange.dto.js'\nexport type {\n  ClusterSpecChange,\n  ClusterSpecChangeActor,\n  ClusterSpecHistory,\n} from './dtos/ClusterSpecHistory.dto.js'\nexport type {\n  CommonClusterDto,\n  ExternalIdpConfig,\n  OptimizeFilteringConfig,\n  OptimizeFilteringIncludeExclude,\n  OptimizeFilteringPatch,\n  SecretsFilterMode,\n} from './dtos/CommonCluster.dto.js'\nexport type { ConsoleClusterDto } from './dtos/ConsoleCluster.dto.js'\nexport type {\n  ClusterActivityBucket,\n  ClusterActivityTile,\n  ClusterActivityV2Dto,\n  ClusterActivityV2Response,\n  ClusterByClientV2Dto,\n  ClusterDatacenterOptionV2Dto,\n  ClusterDetailV2Dto,\n  ClusterFacetsV2Dto,\n  ClusterListItemV2Dto,\n  ClusterLiveStateV2Dto,\n  ClusterLiveStateV2Entry,\n  ClusterModificationState,\n  ClusterParameterOptionV2Dto,\n  ClusterParametersV2Dto,\n  ClusterTtlFilter,\n  ControlResolvedPermissions,\n  ControlSessionDto,\n  ControlSessionUser,\n  CursorPage,\n  CursorParams,\n  ListClustersV2Params,\n  ListOrganizationsV2Params,\n  ListOrgMembersV2Params,\n  OrgDetailV2Dto,\n  OrgListItemV2Dto,\n  OrgMemberV2Dto,\n  OrgSummaryV2Dto,\n} from './dtos/ControlV2.dto.js'\nexport { CLUSTER_MODIFICATION_STATES } from './dtos/ControlV2.dto.js'\nexport type {\n  DashboardActor,\n  DashboardAnnotationsQuery,\n  DashboardAnnotationsTile,\n  DashboardAnnotationsTileV1,\n  DashboardCatalogue,\n  DashboardCatalogueChartMetric,\n  DashboardCatalogueSearchField,\n  DashboardChartQuery,\n  DashboardChartRender,\n  DashboardChartTile,\n  DashboardChartTileV3,\n  DashboardClusterCard,\n  DashboardClusterDetailQuery,\n  DashboardClusterDetailTile,\n  DashboardClusterDetailTileV2,\n  DashboardDefinition,\n  DashboardDefinitionV1,\n  DashboardDefinitionV2,\n  DashboardDefinitionV3,\n  DashboardDto,\n  DashboardFleetQuery,\n  DashboardFleetQueryTile,\n  DashboardFleetQueryTileV1,\n  DashboardHeadingTile,\n  DashboardHeadingTileV2,\n  DashboardLinkTile,\n  DashboardLinkTileV2,\n  DashboardListDto,\n  DashboardNewTile,\n  DashboardNoteTile,\n  DashboardNoteTileV2,\n  DashboardOrgCard,\n  DashboardOrgDetailQuery,\n  DashboardOrgDetailTile,\n  DashboardOrgDetailTileV2,\n  DashboardSummaryDto,\n  DashboardTile,\n  DashboardTileKind,\n  DashboardTileLayout,\n  DashboardTileV1,\n  DashboardTileV2,\n  DashboardTileV3,\n  StoredDashboardDefinition,\n} from './dtos/Dashboard.dto.js'\nexport {\n  DASHBOARD_CHART_RENDERS,\n  DASHBOARD_CLUSTER_CARDS,\n  DASHBOARD_DEFINITION_BYTES_MAX,\n  DASHBOARD_DEFINITION_VERSION,\n  DASHBOARD_ENTITY_ID_MAX,\n  DASHBOARD_GRID_COLUMNS,\n  DASHBOARD_GRID_ROWS_MAX,\n  DASHBOARD_LINK_URL_MAX,\n  DASHBOARD_NOTE_MAX,\n  DASHBOARD_ORG_CARDS,\n  DASHBOARD_PAGE_SIZE_DEFAULT,\n  DASHBOARD_PAGE_SIZE_MAX,\n  DASHBOARD_TILE_KINDS,\n  DASHBOARD_TILE_ROWS_MAX,\n  DASHBOARD_TILES_MAX,\n  DASHBOARD_TITLE_MAX,\n} from './dtos/Dashboard.dto.js'\nexport type { EarlyAccessFeatureDto } from './dtos/EarlyAccessFeature.dto.js'\nexport type {\n  CamundaWebApp,\n  CamundaWebAppWithZeebe,\n  ExternalClickwrapConfigDto,\n  ExternalClusterDto,\n  ExternalOrganizationDto,\n} from './dtos/ExternalWebapp.dto.js'\nexport type {\n  CreateFeatureFlagDto,\n  FeatureFlagAnswer,\n  FeatureFlagDto,\n  FeatureFlagListDto,\n  UpdateFeatureFlagDto,\n} from './dtos/FeatureFlags.dto.js'\n// Functions\nexport {\n  activeGenerations,\n  compareGenerationNamesNewestFirst,\n  type GenerationDto,\n  type GenerationWithClusterCountDto,\n  sortGenerationBySemverOfZeebe,\n  type UpgradableGenerationsDto,\n} from './dtos/Generations.dto.js'\nexport type { ChangeGenerationVersionsResult } from './dtos/GenerationVersionsChange.dto.js'\n// Namespace (type-only - contains only interfaces)\nexport type { Hdp } from './dtos/Hdp.dto.js'\nexport type {\n  K8sBackupConfig,\n  K8sConfig,\n  K8sConfigLegacyFormat,\n  K8sContext,\n  K8sContextDto,\n} from './dtos/K8sContext.dto.js'\nexport type {\n  M2mTokenCountDto,\n  M2mTokenCountsDto,\n} from './dtos/M2mTokenCount.dto.js'\nexport type { MetaDto } from './dtos/Meta.dto.js'\nexport type {\n  AutoJoinAssignment,\n  LicensingModelType,\n  LlmProviderName,\n  OrganizationDto,\n  OrganizationMetadata,\n  OrgOwner,\n  OrgWithNameAndSalesPlan,\n} from './dtos/Organization.dto.js'\nexport {\n  LICENSING_MODEL_DISPLAY_NAMES,\n  VALID_LICENSING_MODELS,\n} from './dtos/Organization.dto.js'\nexport type { OrganizationMemberDto } from './dtos/OrganizationMember.dto.js'\nexport type { OrganizationToSalesPlanDto } from './dtos/OrganizationToSalesPlan.dto.js'\nexport type {\n  DryRunSanityDiff,\n  ReleaseTrainPreview,\n  ReleaseTrainSanityReport,\n  SanityFix,\n  SanityRuleInfo,\n  SanitySeverity,\n  SanityViolation,\n} from './dtos/ReleaseTrainSanity.dto.js'\nexport type { RestoreDto, RestoreState } from './dtos/Restore.dto.js'\n// SalesPlan.dto - Types\nexport type {\n  ClusterLimits,\n  ConsumptionDataItem,\n  Limits,\n  SalesPlanDto,\n  SalesPlanMetadata,\n} from './dtos/SalesPlan.dto.js'\n// SalesPlan.dto - Values (constants and functions)\nexport {\n  allClusterBasedLimits,\n  allSalesPlanLimits,\n  clusterPlanWhiteListIds,\n  deprecatedLimit,\n  generationWhiteListIds,\n  isLimitKeyEnabled,\n  isLimitOfferedOnStage,\n  isUnlockedClusterPlansStage,\n  MAX_CLUSTER_CLIENTS_DEFAULT,\n  MAX_CLUSTER_CLIENTS_DEV,\n  RETENTION_LIMIT_DEFAULT,\n  RETENTION_LIMIT_MAXIMUM,\n  RETENTION_LIMIT_MINIMUM,\n  unusedClusterBasedLimits,\n  unusedSalesPlanLimits,\n} from './dtos/SalesPlan.dto.js'\nexport type { SecureConnectivityDto } from './dtos/SecureConnectivity.dto.js'\nexport type { SignupDto } from './dtos/Signup.dto.js'\nexport type {\n  StorybookConfig,\n  StorybookConfigBackup,\n  StorybookConfigChannel,\n  StorybookConfigDatacenter,\n  StorybookConfigGeneration,\n} from './dtos/StorybookConfig.dto.js'\nexport type { SystemAuditDto } from './dtos/SystemAudit.dto.js'\nexport type {\n  UpgradeReadinessDto,\n  UpgradeReadinessSource,\n  UpgradeReadinessState,\n} from './dtos/UpgradeReadiness.dto.js'\n// UsageAlert.dto - Types\nexport type { UsageAlertDto } from './dtos/UsageAlert.dto.js'\n// UsageAlert.dto - Values (enum and constants)\nexport {\n  UsageAlertInitValues,\n  UsageAlertMetric,\n  UsageAlertThresholdLimits,\n} from './dtos/UsageAlert.dto.js'\nexport type { UserMetaDataDto } from './dtos/UserMetaData.dto.js'\n// Lucene-style table search (parser + AST \u2192 SQL compiler + field registries).\nexport {\n  type AndNode,\n  CLUSTER_DEFAULT_SEARCH_FIELDS,\n  CLUSTER_SEARCH_FIELDS,\n  CLUSTER_TTL_SEARCH_FIELDS,\n  type CompileContext,\n  type CompiledQuery,\n  clusterSearchFieldsForStage,\n  compileQuery,\n  type FieldBinding,\n  findSearchField,\n  idSetPredicate,\n  isLuceneQueryError,\n  joinIdSet,\n  LuceneQueryError,\n  likeArgument,\n  type NotNode,\n  ORG_DEFAULT_SEARCH_FIELDS,\n  ORGANIZATION_SEARCH_FIELDS,\n  type OrNode,\n  parseLuceneQuery,\n  type QueryNode,\n  type RangeNode,\n  type SearchFieldCapability,\n  type SearchFieldSpec,\n  type SearchFieldType,\n  type SearchTermOperator,\n  type SqlDialect,\n  type TermNode,\n} from './search/index.js'\nexport { upgradeGateReason } from './utils/upgradeGateReason.utils.js'\n\n// ============================================================================\n// Enums (runtime values)\n// ============================================================================\n\nexport {\n  AlertSubscriptionReportType,\n  AlertSubscriptionType,\n} from './enums/AlertSubscription.enum.js'\nexport { AuditEntity, AuditEntityAttribute } from './enums/AuditEntity.enum.js'\nexport { AuditService } from './enums/AuditService.enum.js'\nexport { BackupStatus } from './enums/BackupStatus.enum.js'\nexport {\n  ClusterBulkOperationStatus,\n  ClusterBulkOperationType,\n} from './enums/ClusterBulkOperation.enum.js'\nexport { ClusterClientPermission } from './enums/ClusterClientPermissions.enum.js'\nexport { ClusterEncryptionKey } from './enums/ClusterEncryptionKey.enum.js'\nexport { ClusterStatus } from './enums/ClusterStatus.enum.js'\nexport { ConsoleAPIClientPermission } from './enums/ConsoleApiClientPermission.enum.js'\nexport { ErrorType } from './enums/ErrorType.enum.js'\nexport type {\n  AssignableOrganizationRoleType,\n  OrganizationRoleType,\n  UnassignableOrganizationRoleType,\n} from './enums/OrganizationRole.enum.js'\nexport {\n  AssignableOrganizationRole,\n  LegacyHeldOrganizationRole,\n  OrganizationRole,\n  UnassignableOrganizationRole,\n} from './enums/OrganizationRole.enum.js'\nexport { SseEntity, SseType } from './enums/Sse.enum.js'\nexport {\n  SystemAuditEntity,\n  SystemAuditEntityAttribute,\n} from './enums/SystemAuditEntity.enum.js'\n\n// ============================================================================\n// Permissions - Namespaces (runtime values)\n// ============================================================================\n\nexport { AccountsPermissions } from './permissions/accounts.permissions.js'\nexport { AlertDistributorPermissions } from './permissions/alert-distributor.permissions.js'\nexport { AuditLoggerPermissions } from './permissions/auditlogger.permissions.js'\nexport {\n  accountsUserFeaturesFromPermissions,\n  consoleUserFeaturesFromPermissions,\n  sessionHasPermission,\n  sessionPermissionKeysFor,\n} from './permissions/combo.js'\nexport { ConsolePermissions } from './permissions/console.permissions.js'\nexport { NotificationPermissions } from './permissions/notification.permissions.js'\n// profile.permissions - Types\nexport type { OnboardConfig } from './permissions/profile.permissions.js'\n// profile.permissions - Values (constants)\n// NOTE: the `allowed` email lists (CLOUD_TEAM_EMAILS, SRE_TEAM_EMAILS, etc.)\n// intentionally live in the private `@camunda-cloud/shared-backend` package\n// instead of here, since this package is published publicly to npm.\nexport { PROFILES } from './permissions/profile.permissions.js'\nexport {\n  ALL_PERMISSIONS_AT_AUTH0,\n  expandRolesToPermissions,\n} from './permissions/roleExpansion.utils.js'\n\n// ============================================================================\n// Types - Type-only exports (interfaces and type aliases)\n// ============================================================================\n\nexport type { AuditData } from './types/AuditData.type.js'\n// AutoSleep.type - Types\nexport type {\n  ActivitySleepEligibilityOptions,\n  SleepCronEligibilityOptions,\n} from './types/AutoSleep.type.js'\n// AutoSleep.type - Values (constants and functions)\nexport {\n  INTERNAL_LOW_HARDWARE_PLAN_NAME,\n  isActivitySleepEligible,\n  isClusterTagEligibleForSleepCron,\n  isSalesPlanEligibleForSleepCron,\n  isSleepCronEligible,\n  SLEEP_CRON_ELIGIBLE_TAGS,\n} from './types/AutoSleep.type.js'\nexport type {\n  BotContext,\n  BotOptions,\n  BotRequest,\n  GetUserDetailsResponse,\n  ListRolesForUserResponse,\n  UpdateUserRolesRequest,\n  UpdateUserRolesResponse,\n  UserContext,\n  UserDetails,\n} from './types/Bot.types.js'\n// BulkOperation.type - Types\nexport type {\n  BulkClusterDeletionContent,\n  BulkClusterDeletionItem,\n  BulkClusterGenerationUpdateItem,\n  BulkClusterPlanTypeUpdateContent,\n  BulkClusterPlanTypeUpdateItem,\n  BulkClusterPlanUpdateContent,\n  BulkClusterPlanUpdateItem,\n  BulkGenerationUpdateContent,\n  GenericBulkClusterOperationContent,\n  GenericBulkOperationContent,\n  GenericClusterBulkOperationItem,\n} from './types/BulkOperation.type.js'\n// BulkOperation.type - Functions (type guards)\nexport {\n  isBulkClusterDeletionItem,\n  isBulkClusterPlanTypeUpdateItem,\n  isBulkClusterPlanUpdateItem,\n  isIsBulkClusterGenerationUpdateIten,\n} from './types/BulkOperation.type.js'\n// C8ClusterComponentVersions.type - Types\nexport type {\n  GenerationImageVersionsDto,\n  ImmutableZeebeClusterVersionsDto,\n  MutableZeebeClusterVersionsDto,\n  ZeebeClusterVersionsDto,\n} from './types/C8ClusterComponentVersions.type.js'\n// C8ClusterComponentVersions.type - Values (constants)\nexport {\n  AllThings,\n  GENERATION_IMAGE_VERSION_KEYS,\n  ImmutableThings,\n  MutableThings,\n} from './types/C8ClusterComponentVersions.type.js'\n// CamundaClusterLabels.type - Types\nexport type {\n  CamundaClusterStage,\n  CamundaClusterStageLabel,\n  ClusterLabels,\n} from './types/CamundaClusterLabels.type.js'\n// CamundaClusterLabels.type - Values (constants)\nexport {\n  ALLOWED_CAMUNDA_LABELS,\n  StageClusterLabels,\n} from './types/CamundaClusterLabels.type.js'\n// Chargebee.type - Types\nexport type { SubscriptionItem } from './types/Chargebee.type.js'\n// Chargebee.type - Values (enums)\nexport { ConsumptionData, ConsumptionDataType } from './types/Chargebee.type.js'\n// ClusterBulkOperation.type - Types\nexport type {\n  ClusterBulkOperationAck,\n  ClusterBulkOperationClusterDto,\n  ClusterBulkOperationContent,\n  ClusterBulkOperationDto,\n  ClusterBulkOperationGenerationUpdateParameter,\n  ClusterBulkOperationParameter,\n  ClusterBulkOperationPlanTypeUpdateParameter,\n  ClusterBulkOperationPlanUpdateParameter,\n  ClusterBulkOperationPostContent,\n  ClusterSleepWakeupParameter,\n} from './types/ClusterBulkOperation.type.js'\nexport type {\n  ClusterModificationConfigDto,\n  ClusterModificationDto,\n} from './types/ClusterModification.type.js'\n// ClusterPlanFields.type - Values (field spec and type guard)\nexport {\n  CLUSTER_PLAN_FIELDS,\n  type ClusterPlanFieldSpec,\n  type ClusterPlanFieldTree,\n  isClusterPlanFieldSpec,\n} from './types/ClusterPlanFields.type.js'\nexport type {\n  ClusterPlanModificationAck,\n  ClusterPlanModificationConfig,\n  ClusterPlanModificationDto,\n} from './types/ClusterPlanModification.type.js'\n// ClusterPlanTypeAvailabilityClass.type - Values (enum and function)\nexport {\n  ClusterPlanTypeAvailabilityClass,\n  hasNoAvailabilityClass,\n  sortByAvailabilityClasses,\n} from './types/ClusterPlanTypeAvailabilityClass.type.js'\n// ClusterPlanTypeCategory.type - Values (enum and functions)\nexport {\n  ClusterPlanTypeCategory,\n  hasAvailabilityClass,\n  sortByClusterPlanTypeCategory,\n} from './types/ClusterPlanTypeCategory.type.js'\nexport type { ClusterPlanTypesToConfig } from './types/ClusterPlanTypesToConfig.type.js'\nexport type { ClusterPlanTypesToReserved } from './types/ClusterPlanTypesToReserved.type.js'\nexport type {\n  ClusterTtlDeletionPayload,\n  ClusterTtlDeletionResult,\n  ClusterTtlDto,\n  ClusterTtlDuration,\n  ClusterTtlOption,\n  ClusterTtlUnlimited,\n  UpdateClusterTtlBody,\n} from './types/ClusterTtl.type.js'\nexport {\n  CLUSTER_TTL_BACKFILL_REASON,\n  CLUSTER_TTL_DURATION_MS,\n  CLUSTER_TTL_DURATIONS,\n  CLUSTER_TTL_FEATURE_FLAG,\n  CLUSTER_TTL_OPTIONS,\n  CLUSTER_TTL_UNLIMITED_LINK_MAX_LENGTH,\n  CLUSTER_TTL_UNLIMITED_REASON_MAX_LENGTH,\n  clusterTtlExpiresAt,\n  DEFAULT_CLUSTER_TTL_OPTION,\n  extendClusterTtl,\n  isClusterTtlDuration,\n  isClusterTtlOption,\n  isClusterTtlStage,\n  isHttpUrl,\n  isPastClusterTtl,\n  validateClusterTtlUnlimited,\n} from './types/ClusterTtl.type.js'\nexport type {\n  ClusterUsageDataRequest,\n  ClusterUsageMetadataDto,\n  ClusterUsageMetricsAddRequestByMetricHeap,\n  ClusterUsageMetricsData,\n  ClusterUsageMetricsFilter,\n  ClusterUsageOrgStartDate,\n} from './types/ClusterUsageMetrics.type.js'\n// Dashboard.types - Types\nexport type {\n  DashboardConfig,\n  DashboardMappingItem,\n  DashboardMappingTarget,\n  DashboardResultPrimitive,\n  DashboardResultRow,\n  EngineeringOperationsDashboardResponse,\n} from './types/Dashboard.types.js'\nexport type { EnterpriseIncludingValueMetrics } from './types/EnterpriseIncludingValueMetrics.type.js'\nexport type {\n  HdpTenantUsageBreakdown,\n  HdpTenantUsagePerClusterPoint,\n  HdpTenantUsagePoint,\n} from './types/HdpTenantUsage.type.js'\n// hdp.types - Types (interfaces)\nexport type {\n  AlertSubscription as HdpAlertSubscription,\n  Audit as HdpAudit,\n  ByomClient as HdpByomClient,\n  Channel as HdpChannel,\n  Cluster as HdpCluster,\n  ClusterBackup as HdpClusterBackup,\n  ClusterBackupSchedule as HdpClusterBackupSchedule,\n  ClusterBulkOperation as HdpClusterBulkOperation,\n  ClusterClient as HdpClusterClient,\n  ClusterModification as HdpClusterModification,\n  ClusterPlan as HdpClusterPlan,\n  ClusterPlanType as HdpClusterPlanType,\n  ConnectorSecret as HdpConnectorSecret,\n  ConsoleApiClient as HdpConsoleApiClient,\n  Datacenter as HdpDatacenter,\n  Generation as HdpGeneration,\n  HdpBackendChangeEvent,\n  HdpClusterModificationConfig,\n  HdpDisk,\n  HdpEntity,\n  HdpPrometheusDataCapacityDataPoint,\n  Invite as HdpInvite,\n  LlmSpend as HdpLlmSpend,\n  Organization as HdpOrganization,\n  SecureConnectivity as HdpSecureConnectivity,\n  SystemAudit as HdpSystemAudit,\n  TelemetryData as HdpTelemetryData,\n  UsageAlert as HdpUsageAlert,\n  User as HdpUser,\n  UserLogin as HdpUserLogin,\n} from './types/hdp.types.js'\n// hdp.types - Values (enums)\nexport {\n  AlertSubscriptionReportType as HdpAlertSubscriptionReportType,\n  AlertSubscriptionType as HdpAlertSubscriptionType,\n  HDP_DISKS,\n} from './types/hdp.types.js'\n// notification.type - Types\nexport type {\n  GlobalNotification,\n  NotificationDto,\n  NotificationMeta,\n  NotificationOptions,\n  NotificationPermission,\n  NotificationSource,\n  NotificationState,\n  NotificationType,\n  OrgNotification,\n  UserNotification,\n  UserOrgNotification,\n} from './types/notification.type.js'\n// notification.type - Values (enums and constants)\nexport {\n  NotificationPermissionValues,\n  NotificationSourceEnum,\n  NotificationStateEnum,\n  NotificationTypeEnum,\n} from './types/notification.type.js'\n// OrganizationPermission.type - Types\nexport type {\n  CreateReadUpdateDelete,\n  OrganizationPermissions,\n} from './types/OrganizationPermission.type.js'\n// OrganizationPermission.type - Values (constants)\nexport {\n  OrganizationPermissionsDescriptions,\n  PermissionsForOrganizationRole,\n} from './types/OrganizationPermission.type.js'\nexport {\n  getPreprodClusterTtlHours,\n  isPastPreprodClusterTtl,\n  isPreprodClusterTtlStage,\n  parseNumericLimit,\n} from './types/PreprodClusterTtl.type.js'\n// Roles.js - Types\nexport type {\n  AccountRoles,\n  ConsoleRoles,\n  ModelerRoles,\n  Roles,\n} from './types/Roles.js'\n// Roles.js - Values (constants)\nexport { SAFE_ROLES } from './types/Roles.js'\n// SalesPlanType.type - Types\nexport type {\n  DisplayedSalesPlan,\n  RevisitedSalesPlanName,\n} from './types/SalesPlanType.type.js'\n// SalesPlanType.type - Values (enums and functions)\nexport {\n  AnalyticsSalesPlanType,\n  getAnalyticsSalesPlanFromOrgSalesPlan,\n  getDisplayedSalesPlan,\n  getRevisitedSalesPlanName,\n  OPTIMIZE_DISABLED_PLAN_TYPES,\n  SalesPlanType,\n} from './types/SalesPlanType.type.js'\n// SpamDetection.type - Types\nexport type { SpamDetectionPatterns } from './types/SpamDetection.type.js'\n// SpamDetection.type - Values (constants)\nexport { TEERGRUBE_PATTERNS } from './types/SpamDetection.type.js'\nexport type {\n  AlertSubscriptionSseEvent,\n  BackupSseEvent,\n  ClusterClientSseEvent,\n  ClusterSseEvent,\n  ConnectorSecretsSseEvent,\n  ConsoleApiClientSseEvent,\n  ConsoleSseEvent,\n  MonitoringSseEvent,\n  SecureConnectivitySseEvent,\n  SseClusterPayload,\n  SseMonitoringPayload,\n  SseSecureConnectivityPayload,\n} from './types/SseEvent.type.js'\n// Namespace (type-only - contains only interfaces)\nexport type { AccountsStats } from './types/Stats.types.js'\n// Survey.type - Types\nexport type { Persona, SurveyDto } from './types/Survey.type.js'\n// Survey.type - Values (enum)\nexport { FeedbackType } from './types/Survey.type.js'\n// SuspendStrategy.type - Types\nexport type {\n  GetSuspendStrategyOptions,\n  SuspendStrategy,\n} from './types/SuspendStrategy.type.js'\n// SuspendStrategy.type - Values (function)\nexport { getSuspendStrategy } from './types/SuspendStrategy.type.js'\nexport type { SystemAuditData } from './types/SystemAuditData.type.js'\n\n// Namespace (runtime value)\nexport { Telemetry } from './types/Telemetry.type.js'\n\n// TrialManagement.types - Types\nexport type {\n  ExtensionListItem,\n  ExtensionListResponse,\n  OrgTrialDetail,\n  TrialExtensionSource,\n  TrialManagementStats,\n} from './types/TrialManagement.types.js'\n\n// User.type - Types\nexport type {\n  AccountsData,\n  AppMetadata,\n  BasicUser,\n  BlockedFor,\n  Identity,\n  OrgMembership,\n  User,\n  UserMetadata,\n  UserRequest,\n} from './types/User.type.js'\n\n// User.type - Values (enum)\nexport { UserMetadataEvent } from './types/User.type.js'\n\nexport type {\n  UniqueTaskUser,\n  ValueMetrics,\n  ValueMetricsPerYearMonth,\n} from './types/ValueMetrics.type.js'\n\n// ============================================================================\n// Utils - Classes (runtime values)\n// ============================================================================\n\nexport {\n  CLOUD_PROVIDER_ORDER,\n  getCloudProviderLabel,\n  getCloudProviderRank,\n} from './utils/cloudProvider.utils.js'\nexport {\n  type ConnectivityStatus,\n  deriveConnectivityMessage,\n  deriveConnectivityStatus,\n} from './utils/connectivityStatus.utils.js'\nexport type {\n  CronScheduleValidationFailure,\n  CronScheduleValidationResult,\n  CronScheduleValidationSuccess,\n} from './utils/cronSchedule.utils.js'\nexport {\n  BACKUP_SCHEDULE_MIN_INTERVAL_MINUTES,\n  validateCronSchedule,\n} from './utils/cronSchedule.utils.js'\nexport {\n  canonicalPlan,\n  canonicalPlanKey,\n} from './utils/elasticsearchPlanPath.utils.js'\nexport {\n  deriveEncryptionStatus,\n  type EncryptionStatus,\n  isEncryptionStatus,\n} from './utils/encryptionStatus.utils.js'\n// enterprise-connection.utils - Types\nexport type { EnterpriseConnectionOrganizationAssignment } from './utils/enterprise-connection.utils.js'\n// enterprise-connection.utils - Values (functions)\nexport {\n  enterpriseConnectionMetadataToOrganizationAssignments,\n  organizationAssignmentsToEnterpriseConnectionMetadata,\n} from './utils/enterprise-connection.utils.js'\nexport {\n  addMonthsClamped,\n  DEFAULT_ENTERPRISE_DURATION_IN_MONTHS,\n  diffInWholeMonths,\n  type EnterpriseTermWindow,\n  getCurrentEnterpriseTerm,\n  peakWithinTerm,\n  toUtcDayStartMs,\n} from './utils/enterpriseTerm.utils.js'\nexport type { EnvVarEntry } from './utils/envVars.js'\nexport { parseEnvVars, serializeEnvVars } from './utils/envVars.js'\nexport {\n  deriveFailoverKeyPolicyPrincipals,\n  type FailoverKeyPolicyPrincipals,\n} from './utils/failoverKeyPolicy.utils.js'\nexport type {\n  JvmOptionsModificationKey,\n  ParsedJvmOption,\n} from './utils/jvmOptions.js'\nexport {\n  addsEnvVarsOverrideValue,\n  isJvmOptionsModificationKey,\n  isUnderJvmSpec,\n  JVM_OPTION_MAX_LENGTH,\n  JVM_OPTION_PATTERN,\n  JVM_OPTIONS_MAX_ITEMS,\n  JVM_OPTIONS_MODIFICATION_KEYS,\n  JVM_OPTIONS_TARGETS,\n  joinJvmOptions,\n  parseJvmOption,\n  requiresEnvVarsOverride,\n  splitJvmOptions,\n  validateJvmOptions,\n  validateJvmOptionsValue,\n} from './utils/jvmOptions.js'\nexport {\n  KMS_ARN,\n  KMS_MRK_ARN,\n  type KmsArnValidationError,\n  type ParsedKmsArn,\n  parseKmsArn,\n  validateKmsArnForRegion,\n} from './utils/kmsArn.utils.js'\nexport { validateLabels } from './utils/labelValidator.utils.js'\nexport { ObjectMergeUtils } from './utils/objectMerge.utils.js'\nexport {\n  computeOrgStartDate,\n  type OrgStartDateInput,\n} from './utils/orgStartDate.utils.js'\nexport {\n  getPermissionsByRoles,\n  getUserPermissionsForOrg,\n} from './utils/orgs/OrgHelper.js'\n\n// PasswordPolicy - Types\nexport type {\n  PasswordPolicyRequest,\n  PasswordPolicyResult,\n} from './utils/PasswordPolicy.js'\n\n// PasswordPolicy - Values (constants and function)\nexport {\n  MAXLENGTH as PASSWORD_POLICY_MAXLENGTH,\n  MINLENGTH as PASSWORD_POLICY_MINLENGTH,\n  passwordPolicyCheck,\n} from './utils/PasswordPolicy.js'\nexport { isQaUserEmail, qaUserEmail } from './utils/qa-user.utils.js'\nexport {\n  deriveSecondaryStorageStatus,\n  type SecondaryStorageStatus,\n} from './utils/secondaryStorageStatus.utils.js'\nexport {\n  allSettledResultsCounts,\n  getFulfilledPromises,\n  getRejectedPromises,\n  getSettledSummary,\n} from './utils/settledPromises.util.js'\nexport {\n  isValidAwsArn,\n  isValidCIDR,\n  isValidCIDRList,\n  isValidClientName,\n  isValidHostname,\n  isValidPrivateLinkRegion,\n  normalizeCIDRList,\n} from './utils/string-validation.utils.js'\nexport {\n  extractCamundaUserEmail,\n  guessName,\n  isCamundaUserId,\n} from './utils/user.utils.js'\n\n// versionCheck.utils - Values (enum and function)\nexport {\n  checkVersion,\n  generationImageErrorMessage,\n  isAppIntegrationsVersionSupported,\n  isGenerationResumable,\n  isSecretsFilterModeConfigurable,\n  isValidGenerationImage,\n  normalizeGenerationVersion,\n  stripSecfixPostfix,\n  VersionCheckOperator,\n} from './utils/versionCheck.utils.js'\n\n// ============================================================================\n// Config - Configuration files and types\n// ============================================================================\n\nexport { default as CAMUNDI_PERMISSION_RULES } from './config/camundi-permission-rules.js'\nexport type { CamundiPermissionRules } from './config/camundi-permission-rules.types.js'\n\nexport {\n  augmentCamundiPermissions,\n  getApplicableRolesForEmployee,\n  HIBOB_CACHE_KEY,\n  HIBOB_CACHE_NAMESPACE,\n  isManager,\n} from './utils/camundiPermissionAugmenter.utils.js'\n"],
+  "mappings": "AAUA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,KAAK,MAAM,QAAQ,QAAQ,YAAY;AAEhD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,4BAA4B;AACrC,SAAS,iDAAiD;AAC1D,SAAS,6CAA6C;AAKtD,SAAS,wCAAwC;AACjD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAcP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAeP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAMP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAOP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAMA;AAAA,EASA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAIP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAUP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAWP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAuBP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAWP,SAAS,uCAAuC;AAkBhD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AA4CP,SAAS,mCAAmC;AA8C5C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAiBP;AAAA,EACE;AAAA,EACA;AAAA,EAGA;AAAA,OAEK;AAyBP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAsBP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAmBP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EAEA;AAAA,OASK;AACP,SAAS,yBAAyB;AAMlC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,aAAa,4BAA4B;AAClD,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,+BAA+B;AACxC,SAAS,4BAA4B;AACrC,SAAS,qBAAqB;AAC9B,SAAS,kCAAkC;AAC3C,SAAS,iBAAiB;AAM1B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,WAAW,eAAe;AACnC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAMP,SAAS,2BAA2B;AACpC,SAAS,mCAAmC;AAC5C,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B;AACnC,SAAS,+BAA+B;AAOxC,SAAS,gBAAgB;AACzB;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAaP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA2BP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AASP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAQP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAIP,SAAS,iBAAiB,2BAA2B;AAmBrD;AAAA,EACE;AAAA,EAGA;AAAA,OACK;AAOP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAYP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA0DP;AAAA,EACiC,+BAA/BA;AAAA,EACyB,yBAAzBC;AAAA,EACA;AAAA,OACK;AAgBP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAOP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AASP,SAAS,kBAAkB;AAO3B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAIP,SAAS,0BAA0B;AAoBnC,SAAS,oBAAoB;AAO7B,SAAS,0BAA0B;AAInC,SAAS,iBAAiB;AAyB1B,SAAS,yBAAyB;AAYlC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EAEE;AAAA,EACA;AAAA,OACK;AAMP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EAEA;AAAA,OACK;AAIP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,cAAc,wBAAwB;AAC/C;AAAA,EACE;AAAA,OAEK;AAKP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB;AAC/B,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AASP;AAAA,EACe;AAAA,EACA;AAAA,EACb;AAAA,OACK;AACP,SAAS,eAAe,mBAAmB;AAC3C;AAAA,EACE;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAMP,SAAoB,WAAXC,gBAA2C;AAGpD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;",
   "names": ["AlertSubscriptionReportType", "AlertSubscriptionType", "default"]
 }

package/dist/permissions/roleExpansion.utils.d.ts

@@ -1,4 +1,12 @@
 import type { Roles } from '../types/Roles.js';
+/**
+ * All permission definitions from various permission namespaces
+ */
+export declare const ALL_PERMISSIONS_AT_AUTH0: {
+    value: string;
+    description: string;
+    initialRoles: Roles[];
+}[];
 /**
  * Expands a list of roles into their corresponding permissions.
  * This function looks up each role in the PermissionsAtAuth0 arrays

package/dist/permissions/roleExpansion.utils.js

@@ -22,6 +22,7 @@ function expandRolesToPermissions(roles) {
   return Array.from(permissions);
 }
 export {
+  ALL_PERMISSIONS_AT_AUTH0,
   expandRolesToPermissions
 };
 //# sourceMappingURL=roleExpansion.utils.js.map

package/dist/permissions/roleExpansion.utils.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/permissions/roleExpansion.utils.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type { Roles } from '../types/Roles.js'\nimport { AccountsPermissions } from './accounts.permissions.js'\nimport { AlertDistributorPermissions } from './alert-distributor.permissions.js'\nimport { AuditLoggerPermissions } from './auditlogger.permissions.js'\nimport { ConsolePermissions } from './console.permissions.js'\nimport { NotificationPermissions } from './notification.permissions.js'\n\n/**\n * All permission definitions from various permission namespaces\n */\nconst ALL_PERMISSIONS_AT_AUTH0 = [\n  ...AccountsPermissions.PermissionsAtAuth0,\n  ...ConsolePermissions.PermissionsAtAuth0,\n  ...AuditLoggerPermissions.PermissionsAtAuth0,\n  ...NotificationPermissions.PERMISSIONS_AT_AUTH0,\n  ...AlertDistributorPermissions.PermissionsAtAuth0,\n]\n\n/**\n * Expands a list of roles into their corresponding permissions.\n * This function looks up each role in the PermissionsAtAuth0 arrays\n * and returns all unique permissions that should be granted for those roles.\n *\n * @param roles - Array of role names to expand\n * @returns Array of unique permission strings\n */\nexport function expandRolesToPermissions(roles: Roles[]): string[] {\n  const permissions = new Set<string>()\n\n  for (const role of roles) {\n    for (const permissionDef of ALL_PERMISSIONS_AT_AUTH0) {\n      if (permissionDef.initialRoles.includes(role)) {\n        permissions.add(permissionDef.value)\n      }\n    }\n  }\n\n  return Array.from(permissions)\n}\n"],
-  "mappings": "AAOA,SAAS,2BAA2B;AACpC,SAAS,mCAAmC;AAC5C,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,+BAA+B;AAKxC,MAAM,2BAA2B;AAAA,EAC/B,GAAG,oBAAoB;AAAA,EACvB,GAAG,mBAAmB;AAAA,EACtB,GAAG,uBAAuB;AAAA,EAC1B,GAAG,wBAAwB;AAAA,EAC3B,GAAG,4BAA4B;AACjC;AAUO,SAAS,yBAAyB,OAA0B;AACjE,QAAM,cAAc,oBAAI,IAAY;AAEpC,aAAW,QAAQ,OAAO;AACxB,eAAW,iBAAiB,0BAA0B;AACpD,UAAI,cAAc,aAAa,SAAS,IAAI,GAAG;AAC7C,oBAAY,IAAI,cAAc,KAAK;AAAA,MACrC;AAAA,IACF;AAAA,EACF;AAEA,SAAO,MAAM,KAAK,WAAW;AAC/B;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type { Roles } from '../types/Roles.js'\nimport { AccountsPermissions } from './accounts.permissions.js'\nimport { AlertDistributorPermissions } from './alert-distributor.permissions.js'\nimport { AuditLoggerPermissions } from './auditlogger.permissions.js'\nimport { ConsolePermissions } from './console.permissions.js'\nimport { NotificationPermissions } from './notification.permissions.js'\n\n/**\n * All permission definitions from various permission namespaces\n */\nexport const ALL_PERMISSIONS_AT_AUTH0 = [\n  ...AccountsPermissions.PermissionsAtAuth0,\n  ...ConsolePermissions.PermissionsAtAuth0,\n  ...AuditLoggerPermissions.PermissionsAtAuth0,\n  ...NotificationPermissions.PERMISSIONS_AT_AUTH0,\n  ...AlertDistributorPermissions.PermissionsAtAuth0,\n]\n\n/**\n * Expands a list of roles into their corresponding permissions.\n * This function looks up each role in the PermissionsAtAuth0 arrays\n * and returns all unique permissions that should be granted for those roles.\n *\n * @param roles - Array of role names to expand\n * @returns Array of unique permission strings\n */\nexport function expandRolesToPermissions(roles: Roles[]): string[] {\n  const permissions = new Set<string>()\n\n  for (const role of roles) {\n    for (const permissionDef of ALL_PERMISSIONS_AT_AUTH0) {\n      if (permissionDef.initialRoles.includes(role)) {\n        permissions.add(permissionDef.value)\n      }\n    }\n  }\n\n  return Array.from(permissions)\n}\n"],
+  "mappings": "AAOA,SAAS,2BAA2B;AACpC,SAAS,mCAAmC;AAC5C,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,+BAA+B;AAKjC,MAAM,2BAA2B;AAAA,EACtC,GAAG,oBAAoB;AAAA,EACvB,GAAG,mBAAmB;AAAA,EACtB,GAAG,uBAAuB;AAAA,EAC1B,GAAG,wBAAwB;AAAA,EAC3B,GAAG,4BAA4B;AACjC;AAUO,SAAS,yBAAyB,OAA0B;AACjE,QAAM,cAAc,oBAAI,IAAY;AAEpC,aAAW,QAAQ,OAAO;AACxB,eAAW,iBAAiB,0BAA0B;AACpD,UAAI,cAAc,aAAa,SAAS,IAAI,GAAG;AAC7C,oBAAY,IAAI,cAAc,KAAK;AAAA,MACrC;AAAA,IACF;AAAA,EACF;AAEA,SAAO,MAAM,KAAK,WAAW;AAC/B;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camunda/ccma-shared-types",
-  "version": "9.1.0",
+  "version": "9.2.0",
   "description": "Shared TypeScript types for Camunda Cloud Management Apps",
   "bugs": {
     "url": "https://github.com/camunda/camunda-cloud-management-apps/issues"