@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/notifications/inbound-email/inbound-email.shared.resources-config.schemas.js

@@ -0,0 +1,258 @@
+/**
+ * Receiving email (#1600) — resource configurations.
+ *
+ * - `inboundEmails`: the engine writes every row (the email channel's stage 1). Members of the organization
+ *   READ its correspondence; no route creates, updates or deletes one. The retention sweep deletes a row
+ *   once its statutory period has passed, and the erasure writer scrubs through `UPDATE_MANY` — both
+ *   route-less.
+ * - `organizationEmailDomains`: an organization administrator drives the whole lifecycle through four
+ *   audited verbs (`claim`, `verify_ownership`, `verify`, `remove`). No generic CREATE / UPDATE / DELETE
+ *   route: a row that could be written directly could claim VERIFIED without proving anything.
+ * - `clientMailboxes`: created by a client administrator, or by the firm on the client's behalf under an
+ *   ACTIVE relationship; a client administrator can always delete one.
+ * - `inboundAddressTombstones`: written by the organization deletion, read by routing. No route at all.
+ */
+import { z } from 'zod';
+import { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions.js';
+import { ResourceOperationRiskLevel, ResourceOperationVariantType } from '../../resources/resources.shared.schemas.js';
+import { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory.js';
+import { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas.js';
+import { CORE_APP_ROLES, CORE_ORG_ROLES } from '../../security/authorizations/roles.shared.schemas.js';
+import { ErasureRetentionMode, ResourceDataSubjectKind, StatutoryRetentionGround } from '../../compliance/privacy/impersonalization.shared.schemas.js';
+import { DataRetentionClass, RetentionStartPoint } from '../../compliance/privacy/retention-schedule.shared.schemas.js';
+import { ClientMailboxCreateRequestSchema, ClientMailboxSchema, InboundAddressTombstoneSchema, InboundEmailSchema, InboundEmailStatus, InboundRouteKind, OrganizationEmailDomainClaimRequestSchema, OrganizationEmailDomainClaimResponseSchema, OrganizationEmailDomainRemoveResponseSchema, OrganizationEmailDomainSchema, OrganizationEmailDomainStatus, OrganizationEmailDomains_Operations, } from './inbound-email.shared.schemas.js';
+const CORE_OPERATIONS = [
+    CoreResourceOperation.READ,
+    CoreResourceOperation.LIST,
+    CoreResourceOperation.CREATE,
+    CoreResourceOperation.UPDATE,
+    CoreResourceOperation.UPDATE_MANY,
+    CoreResourceOperation.DELETE,
+    CoreResourceOperation.DELETE_MANY,
+];
+/**
+ * The email channel reads and writes these rows on a system context BEFORE any handler authority exists: a
+ * message is routed before anyone may act on it.
+ */
+const engineOwned = {
+    read: ResourceSystemAccessMode.ALLOWED,
+    list: ResourceSystemAccessMode.ALLOWED,
+    create: ResourceSystemAccessMode.ALLOWED,
+    update: ResourceSystemAccessMode.ALLOWED,
+    updateMany: ResourceSystemAccessMode.ALLOWED,
+};
+/** The correspondent is a person with no account here, or another organization: no login is reachable from a row. */
+const NO_PRINCIPAL = { kind: ResourceDataSubjectKind.NO_PRINCIPAL };
+/*
+ * Operation configurations are written out per resource rather than shared through a constant: contextual typing
+ * needs each variant literal in place, and a shared constant widens (or freezes) it past what the builder accepts.
+ */
+export const inboundEmailsResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
+    mainSchema: InboundEmailSchema,
+    resourceIdentifier: CoreResourceType.INBOUND_EMAILS,
+    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.INBOUND_EMAILS],
+    resourceRelationships: resourcesRelationships,
+    isSystemResource: true,
+    systemAccessPolicy: engineOwned,
+    /*
+     * A received email is business correspondence, which commercial and tax statutes require kept for a period
+     * counted from the end of the calendar year it was received. Inside that period an erasure RESTRICTS the
+     * row rather than scrubbing it (#1613, #1635); after it the retention sweep deletes the row, and its raw
+     * MIME and attachment files go with it (the file side of `BUSINESS_RECORDS`).
+     *
+     * `RETAIN_AND_IMPERSONALIZE`: the row holds a sender's address, bodies and headers — personal data — and
+     * each such field declares what erasure writes over it.
+     */
+    retentionPolicy: {
+        mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,
+        statutoryRetention: {
+            ground: StatutoryRetentionGround.LEGAL_OBLIGATION,
+            rationale: 'Business letters received: HGB §257(1) no. 2 and AO §147(1) no. 2 (six years from the end of the calendar year, §257(5) / §147(4)); Code de commerce L123-22 (ten years) where the correspondence is accounting evidence; Limitation Act 1980 s.14B (fifteen-year long-stop); SEC Rule 17a-4(b)(4) (three years) for broker-dealers.',
+        },
+    },
+    retentionBinding: {
+        retentionClass: DataRetentionClass.BUSINESS_RECORDS,
+        startPoint: RetentionStartPoint.END_OF_CALENDAR_YEAR,
+    },
+    dataSubjectPolicy: NO_PRINCIPAL,
+    coreOperations: CORE_OPERATIONS,
+    operationsConfiguration: {
+        [CoreResourceOperation.READ]: { variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_MEMBER], riskLevel: ResourceOperationRiskLevel.LOW }] },
+        [CoreResourceOperation.LIST]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_MEMBER],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                    filterFields: {
+                        status: z.enum(InboundEmailStatus),
+                        routeKind: z.enum(InboundRouteKind),
+                        threadId: z.string(),
+                    },
+                    sortFields: ['receivedAt'],
+                }],
+        },
+        [CoreResourceOperation.CREATE]: { variants: [{ variantType: ResourceOperationVariantType.REPOSITORY_ONLY, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }] },
+        // The engine moves `status` and records the thread; nothing rewrites what was received (E5).
+        [CoreResourceOperation.UPDATE]: { variants: [{ variantType: ResourceOperationVariantType.REPOSITORY_ONLY, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }] },
+        [CoreResourceOperation.UPDATE_MANY]: { variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }] },
+        // HIGH: deleting correspondence removes evidence of what a client sent.
+        [CoreResourceOperation.DELETE]: { variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [], riskLevel: ResourceOperationRiskLevel.HIGH }] },
+        [CoreResourceOperation.DELETE_MANY]: { variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [], riskLevel: ResourceOperationRiskLevel.HIGH }] },
+    },
+});
+export const organizationEmailDomainsResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
+    mainSchema: OrganizationEmailDomainSchema,
+    resourceIdentifier: CoreResourceType.ORGANIZATION_EMAIL_DOMAINS,
+    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATION_EMAIL_DOMAINS],
+    resourceRelationships: resourcesRelationships,
+    isSystemResource: true,
+    systemAccessPolicy: { ...engineOwned, exportSubject: ResourceSystemAccessMode.FORBIDDEN },
+    /*
+     * A domain names an organization's infrastructure, not a person. `RETAIN_ONLY`, and FORBIDDEN from a
+     * subject export for the same reason: no field is anybody's personal data.
+     */
+    retentionPolicy: { mode: ErasureRetentionMode.RETAIN_ONLY },
+    /*
+     * Kept while it exists; removal and tenant deletion delete the row outright (and the provider's domain with
+     * it), so the class's clock starts at creation only for a row nobody ever removes — the ordinary
+     * `RESOURCE_DATA` period of the application.
+     */
+    retentionBinding: { retentionClass: DataRetentionClass.RESOURCE_DATA, startPoint: RetentionStartPoint.CREATED },
+    dataSubjectPolicy: NO_PRINCIPAL,
+    coreOperations: CORE_OPERATIONS,
+    operationsConfiguration: {
+        [CoreResourceOperation.READ]: { variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }] },
+        [CoreResourceOperation.LIST]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                    filterFields: { status: z.enum(OrganizationEmailDomainStatus) },
+                    sortFields: ['createdAt'],
+                }],
+        },
+        [CoreResourceOperation.CREATE]: { variants: [{ variantType: ResourceOperationVariantType.REPOSITORY_ONLY, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }] },
+        [CoreResourceOperation.UPDATE]: { variants: [{ variantType: ResourceOperationVariantType.REPOSITORY_ONLY, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }] },
+        [CoreResourceOperation.UPDATE_MANY]: { variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }] },
+        [CoreResourceOperation.DELETE]: { variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [], riskLevel: ResourceOperationRiskLevel.HIGH }] },
+        [CoreResourceOperation.DELETE_MANY]: { variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [], riskLevel: ResourceOperationRiskLevel.HIGH }] },
+        /**
+         * Mint the organization's DNS TXT ownership challenge and record the claim as OWNERSHIP_PENDING. Creates
+         * nothing at the provider. Refused only when the domain is already past OWNERSHIP_PENDING for another
+         * organization; a pending claim elsewhere blocks nobody.
+         *
+         * assurance-control: WILDO.DATA.TENANT_ISOLATION — a domain routes mail into, and sends for, only the organization that proved it controls the domain's DNS.
+         */
+        [OrganizationEmailDomains_Operations.CLAIM]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    resourceOperationLike: CoreResourceOperation.CREATE,
+                    requestDto: OrganizationEmailDomainClaimRequestSchema,
+                    customResponseDto: OrganizationEmailDomainClaimResponseSchema,
+                }],
+        },
+        /** Resolve the TXT record. The first organization to prove ownership wins; only then is the domain created at the provider. */
+        [OrganizationEmailDomains_Operations.VERIFY_OWNERSHIP]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: z.object({}),
+                    enabledCondition: ({ currentObject }) => currentObject.status === OrganizationEmailDomainStatus.OWNERSHIP_PENDING,
+                }],
+        },
+        /** Ask the provider to verify the domain's DNS records; asynchronous at the provider, so it may answer PROVIDER_PENDING again. */
+        [OrganizationEmailDomains_Operations.VERIFY]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: z.object({}),
+                    enabledCondition: ({ currentObject }) => currentObject.status !== OrganizationEmailDomainStatus.OWNERSHIP_PENDING,
+                }],
+        },
+        /** Delete the domain at the provider, then the row. Mail to it stops routing at once. */
+        [OrganizationEmailDomains_Operations.REMOVE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    resourceOperationLike: CoreResourceOperation.DELETE,
+                    // Its own answer, not DELETE's `{ id }`: the caller is told whether the provider's copy went too.
+                    customResponseDto: OrganizationEmailDomainRemoveResponseSchema,
+                }],
+        },
+    },
+});
+export const clientMailboxesResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
+    mainSchema: ClientMailboxSchema,
+    resourceIdentifier: CoreResourceType.CLIENT_MAILBOXES,
+    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.CLIENT_MAILBOXES],
+    resourceRelationships: resourcesRelationships,
+    isSystemResource: true,
+    systemAccessPolicy: { ...engineOwned, exportSubject: ResourceSystemAccessMode.FORBIDDEN },
+    // An address of an organization, not of a person.
+    retentionPolicy: { mode: ErasureRetentionMode.RETAIN_ONLY },
+    retentionBinding: { retentionClass: DataRetentionClass.RESOURCE_DATA, startPoint: RetentionStartPoint.CREATED },
+    dataSubjectPolicy: NO_PRINCIPAL,
+    coreOperations: [
+        CoreResourceOperation.READ,
+        CoreResourceOperation.LIST,
+        CoreResourceOperation.CREATE,
+        CoreResourceOperation.UPDATE_MANY,
+        CoreResourceOperation.DELETE,
+        CoreResourceOperation.DELETE_MANY,
+    ],
+    operationsConfiguration: {
+        [CoreResourceOperation.READ]: { variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_MEMBER], riskLevel: ResourceOperationRiskLevel.LOW }] },
+        [CoreResourceOperation.LIST]: { variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_MEMBER], riskLevel: ResourceOperationRiskLevel.LOW, sortFields: ['createdAt'] }] },
+        /**
+         * The FIRM's administrator creates a mailbox on the firm's own verified receiving domain, for a client it
+         * serves. The implementation re-checks, whoever calls: the domain is VERIFIED for receiving and this
+         * organization's, and the relationship is ACTIVE with this organization as its provider.
+         */
+        [CoreResourceOperation.CREATE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    requestDto: ClientMailboxCreateRequestSchema,
+                }],
+        },
+        [CoreResourceOperation.UPDATE_MANY]: { variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }] },
+        /** The firm's administrator deletes a mailbox on its domain. The client ends one by ending the relationship. */
+        [CoreResourceOperation.DELETE]: { variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.MEDIUM }] },
+        [CoreResourceOperation.DELETE_MANY]: { variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [], riskLevel: ResourceOperationRiskLevel.HIGH }] },
+    },
+});
+export const inboundAddressTombstonesResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
+    mainSchema: InboundAddressTombstoneSchema,
+    resourceIdentifier: CoreResourceType.INBOUND_ADDRESS_TOMBSTONES,
+    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.INBOUND_ADDRESS_TOMBSTONES],
+    resourceRelationships: resourcesRelationships,
+    isSystemResource: true,
+    /*
+     * FORBIDDEN from a subject export and NO `retentionPolicy`: a slug names a deleted organization, not a
+     * person. No retention binding either, deliberately: a tombstone that expired would route an old
+     * organization's correspondents to whoever took its slug next — the one outcome it exists to prevent.
+     */
+    systemAccessPolicy: { read: ResourceSystemAccessMode.ALLOWED, list: ResourceSystemAccessMode.ALLOWED, create: ResourceSystemAccessMode.ALLOWED, exportSubject: ResourceSystemAccessMode.FORBIDDEN },
+    coreOperations: [CoreResourceOperation.CREATE, CoreResourceOperation.READ, CoreResourceOperation.LIST],
+    operationsConfiguration: {
+        [CoreResourceOperation.CREATE]: { variants: [{ variantType: ResourceOperationVariantType.REPOSITORY_ONLY, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }] },
+        [CoreResourceOperation.READ]: { variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }] },
+        [CoreResourceOperation.LIST]: { variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }] },
+    },
+});
+//# sourceMappingURL=inbound-email.shared.resources-config.schemas.js.map

package/dist/esm/notifications/inbound-email/inbound-email.shared.resources-config.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbound-email.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/notifications/inbound-email/inbound-email.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAA6B,MAAM,0CAA0C,CAAC;AAC/I,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,2DAA2D,CAAC;AACpJ,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,4DAA4D,CAAC;AACrH,OAAO,EACL,gCAAgC,EAChC,mBAAmB,EACnB,6BAA6B,EAC7B,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,yCAAyC,EACzC,0CAA0C,EAC1C,2CAA2C,EAC3C,6BAA6B,EAC7B,6BAA6B,EAC7B,mCAAmC,GACpC,MAAM,gCAAgC,CAAC;AAWxC,MAAM,eAAe,GAAiC;IACpD,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,WAAW;CAClC,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;IACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;IACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;IACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;IACxC,UAAU,EAAE,wBAAwB,CAAC,OAAO;CAC7C,CAAC;AAEF,qHAAqH;AACrH,MAAM,YAAY,GAAG,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE,CAAC;AAEpE;;;GAGG;AAEH,MAAM,CAAC,MAAM,wDAAwD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CACzH,0CAA0C,CAA+E;IACvH,UAAU,EAAE,kBAAkB;IAC9B,kBAAkB,EAAE,gBAAgB,CAAC,cAAc;IACnD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,cAAc,CAAC;IAC5F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,kBAAkB,EAAE,WAAW;IAC/B;;;;;;;;OAQG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;QACnD,kBAAkB,EAAE;YAClB,MAAM,EAAE,wBAAwB,CAAC,gBAAgB;YACjD,SAAS,EAAE,sUAAsU;SAClV;KACF;IACD,gBAAgB,EAAE;QAChB,cAAc,EAAE,kBAAkB,CAAC,gBAAgB;QACnD,UAAU,EAAE,mBAAmB,CAAC,oBAAoB;KACrD;IACD,iBAAiB,EAAE,YAAY;IAC/B,cAAc,EAAE,eAAe;IAC/B,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC,EAAE;QACpM,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE;wBACZ,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;wBAClC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;wBACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;qBACrB;oBACD,UAAU,EAAE,CAAC,YAAY,CAAC;iBAC3B,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,eAAe,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC,EAAE;QACxN,6FAA6F;QAC7F,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,eAAe,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC,EAAE;QACxN,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC,EAAE;QAChO,wEAAwE;QACxE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC,EAAE;QACnL,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC,EAAE;KACzL;CACF,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,mEAAmE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CACpI,0CAA0C,CAA+G;IACvJ,UAAU,EAAE,6BAA6B;IACzC,kBAAkB,EAAE,gBAAgB,CAAC,0BAA0B;IAC/D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,0BAA0B,CAAC;IACxG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,kBAAkB,EAAE,EAAE,GAAG,WAAW,EAAE,aAAa,EAAE,wBAAwB,CAAC,SAAS,EAAE;IACzF;;;OAGG;IACH,eAAe,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,WAAW,EAAE;IAC3D;;;;OAIG;IACH,gBAAgB,EAAE,EAAE,cAAc,EAAE,kBAAkB,CAAC,aAAa,EAAE,UAAU,EAAE,mBAAmB,CAAC,OAAO,EAAE;IAC/G,iBAAiB,EAAE,YAAY;IAC/B,cAAc,EAAE,eAAe;IAC/B,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC,EAAE;QACnM,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,EAAE;oBAC/D,UAAU,EAAE,CAAC,WAAW,CAAC;iBAC1B,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,eAAe,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC,EAAE;QACxN,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,eAAe,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC,EAAE;QACxN,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC,EAAE;QAChO,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC,EAAE;QACnL,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC,EAAE;QACxL;;;;;;WAMG;QACH,CAAC,mCAAmC,CAAC,KAAK,CAAC,EAAE;YAC3C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,yCAAyC;oBACrD,iBAAiB,EAAE,0CAA0C;iBAC9D,CAAC;SACH;QACD,+HAA+H;QAC/H,CAAC,mCAAmC,CAAC,gBAAgB,CAAC,EAAE;YACtD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,6BAA6B,CAAC,iBAAiB;iBAClH,CAAC;SACH;QACD,kIAAkI;QAClI,CAAC,mCAAmC,CAAC,MAAM,CAAC,EAAE;YAC5C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,6BAA6B,CAAC,iBAAiB;iBAClH,CAAC;SACH;QACD,yFAAyF;QACzF,CAAC,mCAAmC,CAAC,MAAM,CAAC,EAAE;YAC5C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,kGAAkG;oBAClG,iBAAiB,EAAE,2CAA2C;iBAC/D,CAAC;SACH;KACF;CACF,CAAC,CAAC;AAUL,MAAM,CAAC,MAAM,0DAA0D,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAC3H,0CAA0C,CAA6E;IACrH,UAAU,EAAE,mBAAmB;IAC/B,kBAAkB,EAAE,gBAAgB,CAAC,gBAAgB;IACrD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;IAC9F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,kBAAkB,EAAE,EAAE,GAAG,WAAW,EAAE,aAAa,EAAE,wBAAwB,CAAC,SAAS,EAAE;IACzF,kDAAkD;IAClD,eAAe,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,WAAW,EAAE;IAC3D,gBAAgB,EAAE,EAAE,cAAc,EAAE,kBAAkB,CAAC,aAAa,EAAE,UAAU,EAAE,mBAAmB,CAAC,OAAO,EAAE;IAC/G,iBAAiB,EAAE,YAAY;IAC/B,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,WAAW;QACjC,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC,EAAE;QACpM,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE;QAC/N;;;;WAIG;QACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,UAAU,EAAE,gCAAgC;iBAC7C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC,EAAE;QAChO,gHAAgH;QAChH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,MAAM,EAAE,CAAC,EAAE;QACxM,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC,EAAE;KACzL;CACF,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,mEAAmE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CACpI,0CAA0C,CAGxC;IACA,UAAU,EAAE,6BAA6B;IACzC,kBAAkB,EAAE,gBAAgB,CAAC,0BAA0B;IAC/D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,0BAA0B,CAAC;IACxG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB;;;;OAIG;IACH,kBAAkB,EAAE,EAAE,IAAI,EAAE,wBAAwB,CAAC,OAAO,EAAE,IAAI,EAAE,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE,aAAa,EAAE,wBAAwB,CAAC,SAAS,EAAE;IACnM,cAAc,EAAE,CAAC,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,CAAC,IAAI,CAAC;IACtG,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,eAAe,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC,EAAE;QACxN,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC,EAAE;QACpN,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC,EAAE;KACrN;CACF,CAAC,CAAC","sourcesContent":["/**\n * Receiving email (#1600) — resource configurations.\n *\n * - `inboundEmails`: the engine writes every row (the email channel's stage 1). Members of the organization\n *   READ its correspondence; no route creates, updates or deletes one. The retention sweep deletes a row\n *   once its statutory period has passed, and the erasure writer scrubs through `UPDATE_MANY` — both\n *   route-less.\n * - `organizationEmailDomains`: an organization administrator drives the whole lifecycle through four\n *   audited verbs (`claim`, `verify_ownership`, `verify`, `remove`). No generic CREATE / UPDATE / DELETE\n *   route: a row that could be written directly could claim VERIFIED without proving anything.\n * - `clientMailboxes`: created by a client administrator, or by the firm on the client's behalf under an\n *   ACTIVE relationship; a client administrator can always delete one.\n * - `inboundAddressTombstones`: written by the organization deletion, read by routing. No route at all.\n */\nimport { z } from 'zod';\n\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, type ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../../security/authorizations/roles.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind, StatutoryRetentionGround } from '../../compliance/privacy/impersonalization.shared.schemas';\nimport { DataRetentionClass, RetentionStartPoint } from '../../compliance/privacy/retention-schedule.shared.schemas';\nimport {\n  ClientMailboxCreateRequestSchema,\n  ClientMailboxSchema,\n  InboundAddressTombstoneSchema,\n  InboundEmailSchema,\n  InboundEmailStatus,\n  InboundRouteKind,\n  OrganizationEmailDomainClaimRequestSchema,\n  OrganizationEmailDomainClaimResponseSchema,\n  OrganizationEmailDomainRemoveResponseSchema,\n  OrganizationEmailDomainSchema,\n  OrganizationEmailDomainStatus,\n  OrganizationEmailDomains_Operations,\n} from './inbound-email.shared.schemas';\n\ntype InboundEmailCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.UPDATE_MANY\n  | CoreResourceOperation.DELETE\n  | CoreResourceOperation.DELETE_MANY;\n\nconst CORE_OPERATIONS: InboundEmailCoreOperations[] = [\n  CoreResourceOperation.READ,\n  CoreResourceOperation.LIST,\n  CoreResourceOperation.CREATE,\n  CoreResourceOperation.UPDATE,\n  CoreResourceOperation.UPDATE_MANY,\n  CoreResourceOperation.DELETE,\n  CoreResourceOperation.DELETE_MANY,\n];\n\n/**\n * The email channel reads and writes these rows on a system context BEFORE any handler authority exists: a\n * message is routed before anyone may act on it.\n */\nconst engineOwned = {\n  read: ResourceSystemAccessMode.ALLOWED,\n  list: ResourceSystemAccessMode.ALLOWED,\n  create: ResourceSystemAccessMode.ALLOWED,\n  update: ResourceSystemAccessMode.ALLOWED,\n  updateMany: ResourceSystemAccessMode.ALLOWED,\n};\n\n/** The correspondent is a person with no account here, or another organization: no login is reachable from a row. */\nconst NO_PRINCIPAL = { kind: ResourceDataSubjectKind.NO_PRINCIPAL };\n\n/*\n * Operation configurations are written out per resource rather than shared through a constant: contextual typing\n * needs each variant literal in place, and a shared constant widens (or freezes) it past what the builder accepts.\n */\n\nexport const inboundEmailsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<Record<string, never>, InboundEmailCoreOperations, typeof InboundEmailSchema>({\n    mainSchema: InboundEmailSchema,\n    resourceIdentifier: CoreResourceType.INBOUND_EMAILS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.INBOUND_EMAILS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n    systemAccessPolicy: engineOwned,\n    /*\n     * A received email is business correspondence, which commercial and tax statutes require kept for a period\n     * counted from the end of the calendar year it was received. Inside that period an erasure RESTRICTS the\n     * row rather than scrubbing it (#1613, #1635); after it the retention sweep deletes the row, and its raw\n     * MIME and attachment files go with it (the file side of `BUSINESS_RECORDS`).\n     *\n     * `RETAIN_AND_IMPERSONALIZE`: the row holds a sender's address, bodies and headers — personal data — and\n     * each such field declares what erasure writes over it.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n      statutoryRetention: {\n        ground: StatutoryRetentionGround.LEGAL_OBLIGATION,\n        rationale: 'Business letters received: HGB §257(1) no. 2 and AO §147(1) no. 2 (six years from the end of the calendar year, §257(5) / §147(4)); Code de commerce L123-22 (ten years) where the correspondence is accounting evidence; Limitation Act 1980 s.14B (fifteen-year long-stop); SEC Rule 17a-4(b)(4) (three years) for broker-dealers.',\n      },\n    },\n    retentionBinding: {\n      retentionClass: DataRetentionClass.BUSINESS_RECORDS,\n      startPoint: RetentionStartPoint.END_OF_CALENDAR_YEAR,\n    },\n    dataSubjectPolicy: NO_PRINCIPAL,\n    coreOperations: CORE_OPERATIONS,\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: { variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_MEMBER], riskLevel: ResourceOperationRiskLevel.LOW }] },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          filterFields: {\n            status: z.enum(InboundEmailStatus),\n            routeKind: z.enum(InboundRouteKind),\n            threadId: z.string(),\n          },\n          sortFields: ['receivedAt'],\n        }],\n      },\n      [CoreResourceOperation.CREATE]: { variants: [{ variantType: ResourceOperationVariantType.REPOSITORY_ONLY, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }] },\n      // The engine moves `status` and records the thread; nothing rewrites what was received (E5).\n      [CoreResourceOperation.UPDATE]: { variants: [{ variantType: ResourceOperationVariantType.REPOSITORY_ONLY, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }] },\n      [CoreResourceOperation.UPDATE_MANY]: { variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }] },\n      // HIGH: deleting correspondence removes evidence of what a client sent.\n      [CoreResourceOperation.DELETE]: { variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [], riskLevel: ResourceOperationRiskLevel.HIGH }] },\n      [CoreResourceOperation.DELETE_MANY]: { variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [], riskLevel: ResourceOperationRiskLevel.HIGH }] },\n    },\n  });\n\nexport const organizationEmailDomainsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<typeof OrganizationEmailDomains_Operations, InboundEmailCoreOperations, typeof OrganizationEmailDomainSchema>({\n    mainSchema: OrganizationEmailDomainSchema,\n    resourceIdentifier: CoreResourceType.ORGANIZATION_EMAIL_DOMAINS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATION_EMAIL_DOMAINS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n    systemAccessPolicy: { ...engineOwned, exportSubject: ResourceSystemAccessMode.FORBIDDEN },\n    /*\n     * A domain names an organization's infrastructure, not a person. `RETAIN_ONLY`, and FORBIDDEN from a\n     * subject export for the same reason: no field is anybody's personal data.\n     */\n    retentionPolicy: { mode: ErasureRetentionMode.RETAIN_ONLY },\n    /*\n     * Kept while it exists; removal and tenant deletion delete the row outright (and the provider's domain with\n     * it), so the class's clock starts at creation only for a row nobody ever removes — the ordinary\n     * `RESOURCE_DATA` period of the application.\n     */\n    retentionBinding: { retentionClass: DataRetentionClass.RESOURCE_DATA, startPoint: RetentionStartPoint.CREATED },\n    dataSubjectPolicy: NO_PRINCIPAL,\n    coreOperations: CORE_OPERATIONS,\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: { variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }] },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          filterFields: { status: z.enum(OrganizationEmailDomainStatus) },\n          sortFields: ['createdAt'],\n        }],\n      },\n      [CoreResourceOperation.CREATE]: { variants: [{ variantType: ResourceOperationVariantType.REPOSITORY_ONLY, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }] },\n      [CoreResourceOperation.UPDATE]: { variants: [{ variantType: ResourceOperationVariantType.REPOSITORY_ONLY, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }] },\n      [CoreResourceOperation.UPDATE_MANY]: { variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }] },\n      [CoreResourceOperation.DELETE]: { variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [], riskLevel: ResourceOperationRiskLevel.HIGH }] },\n      [CoreResourceOperation.DELETE_MANY]: { variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [], riskLevel: ResourceOperationRiskLevel.HIGH }] },\n      /**\n       * Mint the organization's DNS TXT ownership challenge and record the claim as OWNERSHIP_PENDING. Creates\n       * nothing at the provider. Refused only when the domain is already past OWNERSHIP_PENDING for another\n       * organization; a pending claim elsewhere blocks nobody.\n       *\n       * assurance-control: WILDO.DATA.TENANT_ISOLATION — a domain routes mail into, and sends for, only the organization that proved it controls the domain's DNS.\n       */\n      [OrganizationEmailDomains_Operations.CLAIM]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.CREATE,\n          requestDto: OrganizationEmailDomainClaimRequestSchema,\n          customResponseDto: OrganizationEmailDomainClaimResponseSchema,\n        }],\n      },\n      /** Resolve the TXT record. The first organization to prove ownership wins; only then is the domain created at the provider. */\n      [OrganizationEmailDomains_Operations.VERIFY_OWNERSHIP]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => currentObject.status === OrganizationEmailDomainStatus.OWNERSHIP_PENDING,\n        }],\n      },\n      /** Ask the provider to verify the domain's DNS records; asynchronous at the provider, so it may answer PROVIDER_PENDING again. */\n      [OrganizationEmailDomains_Operations.VERIFY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => currentObject.status !== OrganizationEmailDomainStatus.OWNERSHIP_PENDING,\n        }],\n      },\n      /** Delete the domain at the provider, then the row. Mail to it stops routing at once. */\n      [OrganizationEmailDomains_Operations.REMOVE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.DELETE,\n          // Its own answer, not DELETE's `{ id }`: the caller is told whether the provider's copy went too.\n          customResponseDto: OrganizationEmailDomainRemoveResponseSchema,\n        }],\n      },\n    },\n  });\n\ntype ClientMailboxOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE_MANY\n  | CoreResourceOperation.DELETE\n  | CoreResourceOperation.DELETE_MANY;\n\nexport const clientMailboxesResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<Record<string, never>, ClientMailboxOperations, typeof ClientMailboxSchema>({\n    mainSchema: ClientMailboxSchema,\n    resourceIdentifier: CoreResourceType.CLIENT_MAILBOXES,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.CLIENT_MAILBOXES],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n    systemAccessPolicy: { ...engineOwned, exportSubject: ResourceSystemAccessMode.FORBIDDEN },\n    // An address of an organization, not of a person.\n    retentionPolicy: { mode: ErasureRetentionMode.RETAIN_ONLY },\n    retentionBinding: { retentionClass: DataRetentionClass.RESOURCE_DATA, startPoint: RetentionStartPoint.CREATED },\n    dataSubjectPolicy: NO_PRINCIPAL,\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE_MANY,\n      CoreResourceOperation.DELETE,\n      CoreResourceOperation.DELETE_MANY,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: { variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_MEMBER], riskLevel: ResourceOperationRiskLevel.LOW }] },\n      [CoreResourceOperation.LIST]: { variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_MEMBER], riskLevel: ResourceOperationRiskLevel.LOW, sortFields: ['createdAt'] }] },\n      /**\n       * The FIRM's administrator creates a mailbox on the firm's own verified receiving domain, for a client it\n       * serves. The implementation re-checks, whoever calls: the domain is VERIFIED for receiving and this\n       * organization's, and the relationship is ACTIVE with this organization as its provider.\n       */\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          requestDto: ClientMailboxCreateRequestSchema,\n        }],\n      },\n      [CoreResourceOperation.UPDATE_MANY]: { variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }] },\n      /** The firm's administrator deletes a mailbox on its domain. The client ends one by ending the relationship. */\n      [CoreResourceOperation.DELETE]: { variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.MEDIUM }] },\n      [CoreResourceOperation.DELETE_MANY]: { variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [], riskLevel: ResourceOperationRiskLevel.HIGH }] },\n    },\n  });\n\nexport const inboundAddressTombstonesResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<undefined,\n    CoreResourceOperation.CREATE | CoreResourceOperation.READ | CoreResourceOperation.LIST,\n    typeof InboundAddressTombstoneSchema\n  >({\n    mainSchema: InboundAddressTombstoneSchema,\n    resourceIdentifier: CoreResourceType.INBOUND_ADDRESS_TOMBSTONES,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.INBOUND_ADDRESS_TOMBSTONES],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n    /*\n     * FORBIDDEN from a subject export and NO `retentionPolicy`: a slug names a deleted organization, not a\n     * person. No retention binding either, deliberately: a tombstone that expired would route an old\n     * organization's correspondents to whoever took its slug next — the one outcome it exists to prevent.\n     */\n    systemAccessPolicy: { read: ResourceSystemAccessMode.ALLOWED, list: ResourceSystemAccessMode.ALLOWED, create: ResourceSystemAccessMode.ALLOWED, exportSubject: ResourceSystemAccessMode.FORBIDDEN },\n    coreOperations: [CoreResourceOperation.CREATE, CoreResourceOperation.READ, CoreResourceOperation.LIST],\n    operationsConfiguration: {\n      [CoreResourceOperation.CREATE]: { variants: [{ variantType: ResourceOperationVariantType.REPOSITORY_ONLY, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }] },\n      [CoreResourceOperation.READ]: { variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }] },\n      [CoreResourceOperation.LIST]: { variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }] },\n    },\n  });\n"]}