@oneuptime/common 14.0.8 → 14.0.9

package/Models/DatabaseModels/TeamComplianceSetting.ts

@@ -1,3 +1,5 @@
+import AlertSeverity from "./AlertSeverity";
+import IncidentSeverity from "./IncidentSeverity";
 import Project from "./Project";
 import Team from "./Team";
 import User from "./User";
@@ -21,8 +23,17 @@ import IconProp from "../../Types/Icon/IconProp";
 import { JSONObject } from "../../Types/JSON";
 import ObjectID from "../../Types/ObjectID";
 import Permission from "../../Types/Permission";
+import ComplianceNotificationChannel from "../../Types/Team/ComplianceNotificationChannel";
 import ComplianceRuleType from "../../Types/Team/ComplianceRuleType";
-import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
+import {
+  Column,
+  Entity,
+  Index,
+  JoinColumn,
+  JoinTable,
+  ManyToMany,
+  ManyToOne,
+} from "typeorm";
 
 @TableEditionAccessControl({
   requiresEnterprise: true,
@@ -60,7 +71,12 @@ import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
 })
 @TenantColumn("projectId")
 @CrudApiEndpoint(new Route("/team-compliance-setting"))
-@Index(["teamId", "ruleType"], { unique: true })
+/*
+ * No unique (teamId, ruleType) index: one team can hold several rules of the
+ * same type - "Call for Critical incidents" and "Push for Critical incidents"
+ * are both HasIncidentOnCallRules. TeamComplianceSettingService rejects exact
+ * duplicates (same type, channel and severities) instead.
+ */
 @Entity({
   name: "TeamComplianceSetting",
 })
@@ -414,4 +430,129 @@ export default class TeamComplianceSetting extends BaseModel {
     nullable: true,
   })
   public options?: JSONObject = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditProjectTeam,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ReadProjectTeam,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditProjectTeam,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.ShortText,
+    title: "Notification Channel",
+    description:
+      "On-call rules only: the channel the member's rule must notify them on (Call, SMS, Push, Email, WhatsApp, Telegram, Slack, MicrosoftTeams or Webhook). Leave empty to accept any channel.",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+  })
+  public notificationChannel?: ComplianceNotificationChannel = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditProjectTeam,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ReadProjectTeam,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditProjectTeam,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.EntityArray,
+    modelType: IncidentSeverity,
+    title: "Incident Severities",
+    description:
+      "Incident and incident episode on-call rules only: the severities members must have a rule for. Leave empty to require every incident severity.",
+  })
+  @ManyToMany(
+    () => {
+      return IncidentSeverity;
+    },
+    { eager: false },
+  )
+  @JoinTable({
+    name: "TeamComplianceSettingIncidentSeverity",
+    inverseJoinColumn: {
+      name: "incidentSeverityId",
+      referencedColumnName: "_id",
+    },
+    joinColumn: {
+      name: "teamComplianceSettingId",
+      referencedColumnName: "_id",
+    },
+  })
+  public incidentSeverities?: Array<IncidentSeverity> = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditProjectTeam,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ReadProjectTeam,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditProjectTeam,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.EntityArray,
+    modelType: AlertSeverity,
+    title: "Alert Severities",
+    description:
+      "Alert and alert episode on-call rules only: the severities members must have a rule for. Leave empty to require every alert severity.",
+  })
+  @ManyToMany(
+    () => {
+      return AlertSeverity;
+    },
+    { eager: false },
+  )
+  @JoinTable({
+    name: "TeamComplianceSettingAlertSeverity",
+    inverseJoinColumn: {
+      name: "alertSeverityId",
+      referencedColumnName: "_id",
+    },
+    joinColumn: {
+      name: "teamComplianceSettingId",
+      referencedColumnName: "_id",
+    },
+  })
+  public alertSeverities?: Array<AlertSeverity> = undefined;
 }

package/Models/DatabaseModels/WorkspaceProjectAuthToken.ts

@@ -43,6 +43,23 @@ export interface MicrosoftTeamsChat {
    * shipped.
    */
   memberAadObjectIds?: Array<string> | undefined;
+  /*
+   * The chat's name in Teams (Graph's "topic"), as last read. `name` is built
+   * from it; it is kept separately so a lookup that fails later can keep the
+   * chat's real name instead of falling back to member names. Absent when the
+   * chat has no name, or its name has never been readable.
+   */
+  topic?: string | undefined;
+  /*
+   * The first few human members' display names — only what a chat named
+   * after its members shows — and how many members have a name. Kept so the
+   * name can be rebuilt when a group chat's Teams name is removed, without a
+   * roster call. miscData is readable by every project Viewer, so the full
+   * roster is deliberately not stored. Absent on records captured before this
+   * shipped (a group chat without memberCount is re-captured once).
+   */
+  memberNames?: Array<string> | undefined;
+  memberCount?: number | undefined;
 }
 
 /*

package/Server/API/AIChatAPI.ts

@@ -47,6 +47,7 @@ import AIConversationMessageService from "../Services/AIConversationMessageServi
 import AIRunEventService from "../Services/AIRunEventService";
 import AIRunService from "../Services/AIRunService";
 import ProjectService from "../Services/ProjectService";
+import { AI_DISABLED_MESSAGE } from "../Services/AIService";
 import LlmProviderService from "../Services/LlmProviderService";
 import LlmProvider from "../../Models/DatabaseModels/LlmProvider";
 import ChatAgentRunner, {
@@ -217,10 +218,12 @@ router.post(
           }),
         ]);
 
+      /*
+       * The shared kill-switch sentence, so Ask AI names the same settings
+       * page as every other AI surface that refuses.
+       */
       if (project && project.enableAi === false) {
-        throw new BadDataException(
-          "AI features are disabled for this project. Enable them in Project Settings > AI Credits.",
-        );
+        throw new BadDataException(AI_DISABLED_MESSAGE);
       }
 
       if (runningRunsInProject >= MAX_CONCURRENT_RUNS_PER_PROJECT) {

package/Server/API/AIInvestigationAPI.ts

@@ -49,6 +49,7 @@ import {
   KubernetesAiAccessGapCode,
   KubernetesAiAccessRunnerSummary,
   KubernetesClusterAiAccessStatus,
+  getKubernetesAiAccessTargetKind,
 } from "../../Types/Kubernetes/KubernetesClusterAiAccess";
 import { KUBERNETES_AI_ACCESS_CREDENTIAL_PERMISSIONS } from "../../Types/Kubernetes/KubernetesClusterAiAccessPermissions";
 import CodeFixTaskType from "../../Types/AI/CodeFixTaskType";
@@ -544,22 +545,21 @@ export type InvestigationPanelClusterAccess = Pick<
  * identifier the Runner reported.
  */
 export const RESTRICTED_GAP_DESCRIPTION: string =
-  "Someone who can view this Kubernetes cluster can see the details on its AI page.";
+  "Someone who can view this Kubernetes cluster can see the details on its AI agent page (AI → Agent).";
 
 /*
  * Stand in for a gap's next step on a row whose viewer cannot read the
- * cluster. The service's next steps are written for the cluster's AI page
- * and may name the Runner to select ('Select the kubernetes-agent Runner
- * "kubernetes-agent/<cluster identifier>" …'), the credential, or the
- * cluster identifier — none of which such a viewer is shown — and point at
- * a page they cannot open. A project-level gap is fixed in Project
- * Settings instead.
+ * cluster. The service's next steps are written for the cluster's AI agent
+ * page and may name the Runner, the credential, the agent's namespace or
+ * the cluster identifier — none of which such a viewer is shown — and
+ * point at a page they cannot open. A project-level gap is fixed in
+ * Project Settings instead.
  */
 export const RESTRICTED_GAP_NEXT_STEP: string =
-  "Ask someone who can edit this Kubernetes cluster's AI access to fix it on the cluster's AI page.";
+  "Ask someone who can edit this Kubernetes cluster's AI access to fix it on the cluster's AI agent page (AI → Agent).";
 
 export const RESTRICTED_PROJECT_GAP_NEXT_STEP: string =
-  "Ask a project admin to change this under Project Settings → AI.";
+  "Ask a project owner or admin to change this in Project Settings (AI Features, AI Credits or LLM Providers).";
 
 /*
  * The gaps fixed in Project Settings rather than on the cluster. Every
@@ -571,6 +571,7 @@ const PROJECT_LEVEL_GAP_CODES: ReadonlyArray<KubernetesAiAccessGapCode> = [
   "project_auto_remediation_disabled",
   "project_ai_command_execution_disabled",
   "llm_provider_missing",
+  "ai_balance_insufficient",
 ];
 
 // The next step a viewer who cannot read the cluster sees for a gap.
@@ -586,7 +587,7 @@ export function getRestrictedGapNextStep(code: string): string {
  * credential.
  */
 export const RESTRICTED_CREDENTIAL_GAP_DESCRIPTION: string =
-  "The Kubernetes credential this cluster's Runner needs is missing or cannot be used. Someone who can view Runner credentials can see which one on the cluster's AI page.";
+  "The Kubernetes credential this cluster's Runner needs is missing or cannot be used. Someone who can view Runner credentials can see which one on the cluster's AI agent page (AI → Agent).";
 
 function toPanelRunnerSummary(
   runner: KubernetesAiAccessRunnerSummary | null,
@@ -598,6 +599,12 @@ function toPanelRunnerSummary(
   return {
     id: runner.id,
     name: runner.name,
+    /*
+     * Which kind of target it is: the panel names the Kubernetes AI agent
+     * and a Runner differently, and accessMethod ("in_cluster" for both
+     * the agent and the previous in-cluster Runner) cannot tell them apart.
+     */
+    kind: getKubernetesAiAccessTargetKind(runner) || undefined,
     isOnline: runner.isOnline,
     lastAliveAt: runner.lastAliveAt,
     canRunAiCommands: runner.canRunAiCommands,

package/Server/API/AutoRemediationAPI.ts

@@ -24,6 +24,7 @@ import RunbookStepType from "../../Types/Runbook/RunbookStepType";
 import {
   KubernetesAiAccessGap,
   KubernetesClusterAiAccessStatus,
+  getKubernetesAiAccessTargetKind,
   isKubernetesAgentRunnerName,
   isKubernetesAgentRunnerPosture,
   parseKubernetesRunnerPosture,
@@ -53,6 +54,7 @@ import RunnerService from "../Services/RunnerService";
 import KubernetesClusterAiAccessService from "../Services/KubernetesClusterAiAccessService";
 import CommandPlanExecutor from "../Utils/AutoRemediation/CommandPlanExecutor";
 import RemediationCommandToolkit from "../Utils/AI/Remediation/RemediationCommandTools";
+import { isClusterRemediationRound } from "../Utils/AI/Remediation/RemediationExecutionRunner";
 import logger from "../Utils/Logger";
 
 const router: ExpressRouter = Express.getRouter();
@@ -112,24 +114,158 @@ async function findAccessibleSuggestion(
   return suggestion.id;
 }
 
+/*
+ * One approval reads each cluster's AI access status at most once: the
+ * Runner loop reads it to recognise the Kubernetes AI agent, and the kubectl
+ * re-check reuses the same answer.
+ */
+type ClusterStatusCache = Map<string, KubernetesClusterAiAccessStatus | null>;
+
+async function getClusterStatusOnce(data: {
+  clusterId: string;
+  projectId: ObjectID;
+  statusByClusterId: ClusterStatusCache;
+}): Promise<KubernetesClusterAiAccessStatus | null> {
+  if (data.statusByClusterId.has(data.clusterId)) {
+    return data.statusByClusterId.get(data.clusterId) || null;
+  }
+
+  const status: KubernetesClusterAiAccessStatus | null =
+    await KubernetesClusterAiAccessService.getStatusForCluster({
+      clusterId: new ObjectID(data.clusterId),
+      projectId: data.projectId,
+    });
+
+  data.statusByClusterId.set(data.clusterId, status);
+
+  return status;
+}
+
+/*
+ * The cluster status whose access target is the Kubernetes AI agent this
+ * plan names as `runnerId`, or null when `runnerId` is not the resolved AI
+ * agent of any cluster its kubectl commands target. Only a Kubectl command
+ * can reach the agent, and only the cluster's current status (not the plan)
+ * says what the target is — so a Runner id never passes for the agent, and
+ * an agent that is no longer the cluster's target falls back to the Runner
+ * re-read, which refuses it.
+ */
+async function findAiAgentTargetStatus(data: {
+  plan: AiRemediationCommandPlan;
+  runnerId: string;
+  projectId: ObjectID;
+  statusByClusterId: ClusterStatusCache;
+}): Promise<KubernetesClusterAiAccessStatus | null> {
+  for (const command of data.plan.commands) {
+    if (
+      command.stepType !== RunbookStepType.Kubectl ||
+      command.runnerId !== data.runnerId ||
+      !command.kubernetesClusterId
+    ) {
+      continue;
+    }
+
+    const status: KubernetesClusterAiAccessStatus | null =
+      await getClusterStatusOnce({
+        clusterId: command.kubernetesClusterId,
+        projectId: data.projectId,
+        statusByClusterId: data.statusByClusterId,
+      });
+
+    if (
+      status?.runner &&
+      getKubernetesAiAccessTargetKind(status.runner) === "ai_agent" &&
+      status.runner.id === data.runnerId
+    ) {
+      return status;
+    }
+  }
+
+  return null;
+}
+
+/*
+ * The AI agent's side of the Runner consent re-check. The agent is not a
+ * Runner row, so there is no canRunAiCommands flag to re-read — the chart
+ * that installed it is its consent. What can still have changed is whether
+ * it is connected, and it only ever runs Kubectl steps, so a Bash or SSH
+ * step aimed at it fails the click for the same reason as on the legacy
+ * in-cluster Runner.
+ */
+function assertAiAgentCanRunPlan(data: {
+  plan: AiRemediationCommandPlan;
+  runnerId: string;
+  status: KubernetesClusterAiAccessStatus;
+}): void {
+  const hostStep: AiRemediationCommand | undefined = data.plan.commands.find(
+    (command: AiRemediationCommand) => {
+      return (
+        command.runnerId === data.runnerId &&
+        command.stepType !== RunbookStepType.Kubectl
+      );
+    },
+  );
+
+  if (hostStep) {
+    throw new BadDataException(
+      `Command ${hostStep.sequence} is a ${hostStep.stepType} step on the Kubernetes AI agent of cluster "${data.status.clusterName}", which runs only Kubectl steps. The plan cannot be run — dismiss it and let a new suggestion be composed.`,
+    );
+  }
+
+  if (!data.status.runner?.isOnline) {
+    throw new BadDataException(
+      `The Kubernetes AI agent of cluster "${data.status.clusterName}" is offline, so this plan cannot be run. Check the agent on the cluster's AI agent page (AI → Agent) and approve again, or dismiss the suggestion.`,
+    );
+  }
+}
+
+/*
+ * What to do about a write-scope refusal, three ways by who runs kubectl for
+ * the cluster — the same split as RemediationCommandToolkit
+ * .getRunnerScopeSettings, which words the refusal itself:
+ *
+ * - the Kubernetes AI agent: its chart values; after a helm upgrade the
+ *   same agent serves the cluster, so the plan can be approved again;
+ * - the chart's previous in-cluster Runner: the chart no longer ships it,
+ *   so the way to widen its scope is to upgrade to the AI agent — which
+ *   replaces the Runner, so this plan (composed for the Runner) cannot be
+ *   approved again and a new one is needed;
+ * - any other Runner (a credential Runner): no chart configures it, its
+ *   scope is set where it runs.
+ */
+export function getScopeRefusalNextStep(
+  runner: KubernetesClusterAiAccessStatus["runner"],
+): string {
+  if (getKubernetesAiAccessTargetKind(runner) === "ai_agent") {
+    return "Dismiss the suggestion and let a new plan be composed, or change the AI agent's write access (aiAgent.remediation.*) on the Kubernetes agent chart and approve again.";
+  }
+
+  if (
+    isKubernetesAgentRunnerName(runner?.name) ||
+    isKubernetesAgentRunnerPosture(runner?.posture)
+  ) {
+    return "Dismiss the suggestion and let a new plan be composed. To allow changes like this, upgrade the Kubernetes agent chart to the AI agent and set aiAgent.remediation.*.";
+  }
+
+  return "Dismiss the suggestion and let a new plan be composed, or change the Runner's write scope on the Runner's host and approve again.";
+}
+
 /*
  * Approval-time re-check of a Kubectl command's cluster. The plan named the
  * cluster, the Runner and the credential it was composed for; any of them
  * can have changed since (the operator turned remediation off on the
- * cluster's AI page, re-pointed it at another Runner, swapped or removed
- * the credential, the agent went offline). CommandPlanExecutor hard-stops
- * on the same conditions right before each command runs — this makes the
- * Approve click fail up front, with the first blocking gap named, instead
- * of claiming the plan and having it stop one command in. Each cluster is
- * checked once however many commands target it.
+ * cluster's AI agent page, re-pointed it at another Runner, swapped or
+ * removed the credential, the agent went offline). CommandPlanExecutor
+ * hard-stops on the same conditions right before each command runs — this
+ * makes the Approve click fail up front, with the first blocking gap named,
+ * instead of claiming the plan and having it stop one command in. Each
+ * cluster is checked once however many commands target it.
  */
 async function assertKubectlCommandsStillRunnable(data: {
   plan: AiRemediationCommandPlan;
   projectId: ObjectID;
+  statusByClusterId: ClusterStatusCache;
 }): Promise<void> {
-  const statusByClusterId: Map<string, KubernetesClusterAiAccessStatus | null> =
-    new Map<string, KubernetesClusterAiAccessStatus | null>();
-
   for (const command of data.plan.commands) {
     if (command.stepType !== RunbookStepType.Kubectl) {
       continue;
@@ -146,16 +282,12 @@ async function assertKubectlCommandsStillRunnable(data: {
       );
     }
 
-    let status: KubernetesClusterAiAccessStatus | null | undefined =
-      statusByClusterId.get(command.kubernetesClusterId);
-
-    if (status === undefined) {
-      status = await KubernetesClusterAiAccessService.getStatusForCluster({
-        clusterId: new ObjectID(command.kubernetesClusterId),
+    const status: KubernetesClusterAiAccessStatus | null =
+      await getClusterStatusOnce({
+        clusterId: command.kubernetesClusterId,
         projectId: data.projectId,
+        statusByClusterId: data.statusByClusterId,
       });
-      statusByClusterId.set(command.kubernetesClusterId, status);
-    }
 
     if (!status) {
       throw new BadDataException(
@@ -173,7 +305,7 @@ async function assertKubectlCommandsStillRunnable(data: {
       throw new BadDataException(
         `Cluster "${status.clusterName}" (command ${command.sequence}) no longer allows AI remediation${
           gap ? `: ${gap.title} — ${gap.nextStep}` : ""
-        }. Fix that on the cluster's AI page and approve again, or dismiss the suggestion.`,
+        }. Fix that on the cluster's AI agent page (AI → Agent) and approve again, or dismiss the suggestion.`,
       );
     }
 
@@ -218,7 +350,7 @@ async function assertKubectlCommandsStillRunnable(data: {
 
       if (scopeRefusal) {
         throw new BadDataException(
-          `Command ${command.sequence}${part.label} cannot run on cluster "${status.clusterName}": ${scopeRefusal} Nothing ran. Dismiss the suggestion and let a new plan be composed, or change the Runner's scope on the Kubernetes agent chart and approve again.`,
+          `Command ${command.sequence}${part.label} cannot run on cluster "${status.clusterName}": ${scopeRefusal} Nothing ran. ${getScopeRefusalNextStep(status.runner)}`,
         );
       }
     }
@@ -284,6 +416,13 @@ async function loadSuggestionAsRoot(
         verificationWindowMinutes: true,
         suggestionType: true,
         commandPlan: true,
+        /*
+         * Which lane composed a command plan: a cluster round (a cluster,
+         * no rule) does not need the project's AI command execution opt-in,
+         * a rule round does (isClusterRemediationRound).
+         */
+        kubernetesClusterId: true,
+        autoRemediationRuleId: true,
       },
       props: { isRoot: true },
     });
@@ -371,10 +510,15 @@ router.post(
         assertCanExecuteRunbooks(props, suggestion.projectId);
 
         /*
-         * Re-check the project opt-in at approval time. The plan may have
-         * been composed hours ago; an operator who has since turned AI
-         * command execution off expects that switch to stop pending plans
-         * too, not just new ones.
+         * Re-check the project switches at approval time. The plan may have
+         * been composed hours ago; an operator who has since turned AI,
+         * auto-remediation or AI command execution off expects that switch
+         * to stop pending plans too, not just new ones. The command
+         * execution opt-in covers rule rounds only — the same line
+         * RemediationExecutionRunner.checkProjectGates draws — and is keyed
+         * on the round, never on the plan's step types: a rule's
+         * all-kubectl plan still needs it. A cluster round's consent is the
+         * cluster's own, re-checked per kubectl command below.
          */
         const project: Project | null = await ProjectService.findOneById({
           id: suggestion.projectId,
@@ -390,11 +534,19 @@ router.post(
         if (
           !project ||
           project.enableAi === false ||
-          project.enableAutoRemediation === false ||
+          project.enableAutoRemediation === false
+        ) {
+          throw new BadDataException(
+            "AI or auto-remediation is disabled for this project, so this plan cannot be run. Re-enable it in Project Settings → AI Features, or dismiss the suggestion.",
+          );
+        }
+
+        if (
+          !isClusterRemediationRound(suggestion) &&
           project.enableAiCommandExecution !== true
         ) {
           throw new BadDataException(
-            "AI command execution is disabled for this project, so this plan cannot be run. Re-enable it in Project Settings → AI, or dismiss the suggestion.",
+            "AI command execution is disabled for this project, so this plan cannot be run. Re-enable it in Project Settings → AI Features, or dismiss the suggestion.",
           );
         }
 
@@ -421,7 +573,36 @@ router.post(
           ),
         );
 
+        const statusByClusterId: ClusterStatusCache = new Map<
+          string,
+          KubernetesClusterAiAccessStatus | null
+        >();
+
         for (const runnerId of runnerIds) {
+          /*
+           * A kubectl command composed for a cluster's Kubernetes AI agent
+           * names the agent's id where a Runner id would be. The agent is
+           * not a Runner row — re-reading the Runner table would refuse
+           * every agent plan — so it is recognised from the cluster's
+           * status instead, and must be connected.
+           */
+          const aiAgentStatus: KubernetesClusterAiAccessStatus | null =
+            await findAiAgentTargetStatus({
+              plan,
+              runnerId,
+              projectId: suggestion.projectId,
+              statusByClusterId,
+            });
+
+          if (aiAgentStatus) {
+            assertAiAgentCanRunPlan({
+              plan,
+              runnerId,
+              status: aiAgentStatus,
+            });
+            continue;
+          }
+
           const runner: Runner | null = await RunnerService.findOneBy({
             query: {
               _id: runnerId,
@@ -454,6 +635,7 @@ router.post(
         await assertKubectlCommandsStillRunnable({
           plan,
           projectId: suggestion.projectId,
+          statusByClusterId,
         });
 
         const claimedPlan: number =