@wildo-ai/saas-models 1.1.5 → 1.1.6

package/dist/esm/compliance/privacy/legal-holds.shared.resources-config.schemas.js

@@ -0,0 +1,223 @@
+/**
+ * Legal holds — resource configuration (#1634).
+ *
+ * Two verbs and two tiers:
+ *
+ *   place   — the tenant's owner (default variant), or an application super-administrator crossing into the
+ *             tenant through the declared door (`admin` variant, requires a usable platform access grant)
+ *   release — the SAME tier that placed the hold, and only that tier (see {@link LegalHoldPlacementTier})
+ *
+ * No client can create, update or delete a hold any other way. The one DELETE is route-less and exists so
+ * the retention-class sweep can dispose of a RELEASED hold once its `AUDIT_LOGS` period has passed.
+ */
+import { LegalHoldPlacementTier, LegalHoldPlaceRequestSchema, LegalHoldReleaseRequestSchema, LegalHoldSchema, LegalHoldStatus, LegalHolds_Operations, } from './legal-holds.shared.schemas.js';
+import { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions.js';
+import { ResourceOperationRiskLevel, ResourceOperationVariantType, } from '../../resources/resources.shared.schemas.js';
+import { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory.js';
+import { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas.js';
+import { CORE_APP_ROLES, CORE_ORG_ROLES } from '../../security/authorizations/roles.shared.schemas.js';
+import { DataRetentionClass, RetentionStartPoint } from './retention-schedule.shared.schemas.js';
+export const legalHoldsResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
+    mainSchema: LegalHoldSchema,
+    resourceIdentifier: CoreResourceType.LEGAL_HOLDS,
+    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.LEGAL_HOLDS],
+    resourceRelationships: resourcesRelationships,
+    isSystemResource: true,
+    /**
+     * No trusted door of any kind. Every deletion path reads the ACTIVE holds through the infrastructure
+     * tier (one indexed query), and every write is a custom verb. A system `create`/`update` would be a
+     * second, unaudited way to place or lift a preservation duty.
+     *
+     * `exportSubject: FORBIDDEN`: `placedByUserId`, `releasedByUserId` and `subjectUserId` put these rows on
+     * a user's access graph, and an included resource with no declaration refuses the whole export. A hold is
+     * the operator's litigation record; disclosing it to the person it concerns can prejudice the very claim
+     * it preserves, and it names the placer and the matter. Left OUT of the bundle and recorded, never
+     * silently dropped.
+     */
+    systemAccessPolicy: {
+        exportSubject: ResourceSystemAccessMode.FORBIDDEN,
+    },
+    /**
+     * A released hold is kept as defence evidence for the `AUDIT_LOGS` period, counted from its release.
+     * An ACTIVE hold has no `releasedAt`, so it never expires — a hold that lapsed on its own would be the
+     * failure it exists to prevent. The organization edge disables the teardown cascade, so the record also
+     * outlives a purged tenant until its period ends.
+     *
+     * Deliberately NOT retention-governed (`retentionPolicy`): a scrubbed-and-hidden hold would be invisible
+     * to the infrastructure read every deletion path consults, which would lift the hold silently.
+     */
+    retentionBinding: {
+        retentionClass: DataRetentionClass.AUDIT_LOGS,
+        startPoint: RetentionStartPoint.CLOSURE_EVENT,
+        closureFieldName: 'releasedAt',
+    },
+    coreOperations: [
+        CoreResourceOperation.READ,
+        CoreResourceOperation.LIST,
+        CoreResourceOperation.COUNT,
+        // Route-less, for the retention-class sweep only.
+        CoreResourceOperation.DELETE,
+    ],
+    operationsConfiguration: {
+        [CoreResourceOperation.READ]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_OWNER],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                },
+                {
+                    // The same read an operator makes into a tenant, through the declared door and a usable grant.
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: false,
+                    variantKey: 'admin',
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                    // assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — an operator reads a tenant's holds only through a usable grant.
+                    admitsCrossTenantPlatformAdministration: true,
+                },
+            ],
+        },
+        [CoreResourceOperation.LIST]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_OWNER],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                },
+                {
+                    // The same read an operator makes into a tenant, through the declared door and a usable grant.
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: false,
+                    variantKey: 'admin',
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                    // assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — an operator reads a tenant's holds only through a usable grant.
+                    admitsCrossTenantPlatformAdministration: true,
+                },
+            ],
+        },
+        [CoreResourceOperation.COUNT]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_OWNER],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                },
+                {
+                    // The same read an operator makes into a tenant, through the declared door and a usable grant.
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: false,
+                    variantKey: 'admin',
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                    // assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — an operator reads a tenant's holds only through a usable grant.
+                    admitsCrossTenantPlatformAdministration: true,
+                },
+            ],
+        },
+        /**
+         * SWEEP ONLY — no client can delete a hold. `INTERNAL_CALL` registers no route; the retention-class
+         * sweep disposes of a released hold at the end of its period, and the delete chokepoint itself never
+         * holds a hold.
+         */
+        [CoreResourceOperation.DELETE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [],
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                },
+            ],
+        },
+        /**
+         * Placing a hold suspends every deletion path for its scope until it is released.
+         *
+         * HIGH with step-up: a hold stops a tenant's retention schedule and its data subjects' erasures, and a
+         * hijacked session must not be able to do that on an old login.
+         *
+         * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — deletion suspended under a recorded legal hold.
+         */
+        [LegalHolds_Operations.PLACE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_OWNER],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    resourceOperationLike: CoreResourceOperation.CREATE,
+                    requestDto: LegalHoldPlaceRequestSchema,
+                    // No `auditableEvent.reasonField`: the justification names the matter, and the generic operation row
+                    // it would ride is exported to every SIEM route. The hold keeps it; LEGAL_HOLD_PLACED carries the scope.
+                    // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-authentication before a high-impact action.
+                    requiresStepUpAuthentication: true,
+                },
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: false,
+                    variantKey: 'admin',
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    resourceOperationLike: CoreResourceOperation.CREATE,
+                    requestDto: LegalHoldPlaceRequestSchema,
+                    // No `auditableEvent.reasonField`: the justification names the matter, and the generic operation row
+                    // it would ride is exported to every SIEM route. The hold keeps it; LEGAL_HOLD_PLACED carries the scope.
+                    // Preservation is monotonic — it only ever stops a destruction — so crossing to place it passes
+                    // the reversibility test (`administrative-continuity-floors.md`). Still never ambient: the
+                    // admission requires a usable platform access grant for the tenant.
+                    // assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — declared crossing, grant required.
+                    admitsCrossTenantPlatformAdministration: true,
+                    // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-authentication before a high-impact action.
+                    requiresStepUpAuthentication: true,
+                },
+            ],
+        },
+        /**
+         * Releasing a hold lets the next sweep, purge or erasure proceed. Only an ACTIVE hold, and only by the
+         * tier that placed it — the enabled condition mirrors the server-side refusal in the paired implementation.
+         *
+         * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — deletion resumes only on a recorded release.
+         */
+        [LegalHolds_Operations.RELEASE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_OWNER],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: LegalHoldReleaseRequestSchema,
+                    // No `auditableEvent.reasonField`, for the same reason as `place`: the release reason stays on the hold.
+                    enabledCondition: ({ currentObject }) => currentObject.status === LegalHoldStatus.ACTIVE
+                        && currentObject.placementTier === LegalHoldPlacementTier.ORGANIZATION,
+                    // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-authentication before a high-impact action.
+                    requiresStepUpAuthentication: true,
+                },
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: false,
+                    variantKey: 'admin',
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: LegalHoldReleaseRequestSchema,
+                    // No `auditableEvent.reasonField`, for the same reason as `place`: the release reason stays on the hold.
+                    // assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — declared crossing, grant required.
+                    admitsCrossTenantPlatformAdministration: true,
+                    // Any ACTIVE hold: the platform's own, or a tenant's own once that tenant is marked for deletion (its
+                    // owners then hold no authority to release it). The tenant's status is not on the hold, so the server
+                    // decides the second case and refuses a live tenant's hold.
+                    enabledCondition: ({ currentObject }) => currentObject.status === LegalHoldStatus.ACTIVE,
+                    // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-authentication before a high-impact action.
+                    requiresStepUpAuthentication: true,
+                },
+            ],
+        },
+    },
+    // The ORGANIZATIONS primary scope is declared on the registry relationship (ORGANIZATIONS → LEGAL_HOLDS).
+});
+//# sourceMappingURL=legal-holds.shared.resources-config.schemas.js.map

package/dist/esm/compliance/privacy/legal-holds.shared.resources-config.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legal-holds.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/legal-holds.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,6BAA6B,EAC7B,eAAe,EACf,eAAe,EACf,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAE7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpG,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAS9F,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CACtH,0CAA0C,CAIxC;IACA,UAAU,EAAE,eAAe;IAC3B,kBAAkB,EAAE,gBAAgB,CAAC,WAAW;IAChD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC;IACzF,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;;;OAUG;IACH,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,SAAS;KAClD;IAED;;;;;;;;OAQG;IACH,gBAAgB,EAAE;QAChB,cAAc,EAAE,kBAAkB,CAAC,UAAU;QAC7C,UAAU,EAAE,mBAAmB,CAAC,aAAa;QAC7C,gBAAgB,EAAE,YAAY;KAC/B;IAED,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,KAAK;QAC3B,kDAAkD;QAClD,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,+FAA+F;oBAC/F,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,gIAAgI;oBAChI,uCAAuC,EAAE,IAAI;iBAC9C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,+FAA+F;oBAC/F,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,gIAAgI;oBAChI,uCAAuC,EAAE,IAAI;iBAC9C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,+FAA+F;oBAC/F,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,gIAAgI;oBAChI,uCAAuC,EAAE,IAAI;iBAC9C;aACF;SACF;QAED;;;;WAIG;QACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,EAAE;oBACT,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED;;;;;;;WAOG;QACH,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,2BAA2B;oBACvC,qGAAqG;oBACrG,yGAAyG;oBACzG,4GAA4G;oBAC5G,4BAA4B,EAAE,IAAI;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,2BAA2B;oBACvC,qGAAqG;oBACrG,yGAAyG;oBACzG,gGAAgG;oBAChG,2FAA2F;oBAC3F,oEAAoE;oBACpE,mGAAmG;oBACnG,uCAAuC,EAAE,IAAI;oBAC7C,4GAA4G;oBAC5G,4BAA4B,EAAE,IAAI;iBACnC;aACF;SACF;QAED;;;;;WAKG;QACH,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE;YAC/B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,6BAA6B;oBACzC,yGAAyG;oBACzG,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM;2BACnF,aAAa,CAAC,aAAa,KAAK,sBAAsB,CAAC,YAAY;oBACxE,4GAA4G;oBAC5G,4BAA4B,EAAE,IAAI;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,6BAA6B;oBACzC,yGAAyG;oBACzG,mGAAmG;oBACnG,uCAAuC,EAAE,IAAI;oBAC7C,sGAAsG;oBACtG,sGAAsG;oBACtG,4DAA4D;oBAC5D,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM;oBACxF,4GAA4G;oBAC5G,4BAA4B,EAAE,IAAI;iBACnC;aACF;SACF;KACF;IACD,0GAA0G;CAC3G,CAAC,CAAC","sourcesContent":["/**\n * Legal holds — resource configuration (#1634).\n *\n * Two verbs and two tiers:\n *\n *   place   — the tenant's owner (default variant), or an application super-administrator crossing into the\n *             tenant through the declared door (`admin` variant, requires a usable platform access grant)\n *   release — the SAME tier that placed the hold, and only that tier (see {@link LegalHoldPlacementTier})\n *\n * No client can create, update or delete a hold any other way. The one DELETE is route-less and exists so\n * the retention-class sweep can dispose of a RELEASED hold once its `AUDIT_LOGS` period has passed.\n */\n\nimport {\n  LegalHoldPlacementTier,\n  LegalHoldPlaceRequestSchema,\n  LegalHoldReleaseRequestSchema,\n  LegalHoldSchema,\n  LegalHoldStatus,\n  LegalHolds_Operations,\n} from './legal-holds.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  type ResourceRelationship,\n} from '../../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../../security/authorizations/roles.shared.schemas';\nimport { DataRetentionClass, RetentionStartPoint } from './retention-schedule.shared.schemas';\n\ntype LegalHoldsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.COUNT\n  | CoreResourceOperation.DELETE;\n\n\nexport const legalHoldsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<\n    typeof LegalHolds_Operations,\n    LegalHoldsCoreOperations,\n    typeof LegalHoldSchema\n  >({\n    mainSchema: LegalHoldSchema,\n    resourceIdentifier: CoreResourceType.LEGAL_HOLDS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.LEGAL_HOLDS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n\n    /**\n     * No trusted door of any kind. Every deletion path reads the ACTIVE holds through the infrastructure\n     * tier (one indexed query), and every write is a custom verb. A system `create`/`update` would be a\n     * second, unaudited way to place or lift a preservation duty.\n     *\n     * `exportSubject: FORBIDDEN`: `placedByUserId`, `releasedByUserId` and `subjectUserId` put these rows on\n     * a user's access graph, and an included resource with no declaration refuses the whole export. A hold is\n     * the operator's litigation record; disclosing it to the person it concerns can prejudice the very claim\n     * it preserves, and it names the placer and the matter. Left OUT of the bundle and recorded, never\n     * silently dropped.\n     */\n    systemAccessPolicy: {\n      exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n    },\n\n    /**\n     * A released hold is kept as defence evidence for the `AUDIT_LOGS` period, counted from its release.\n     * An ACTIVE hold has no `releasedAt`, so it never expires — a hold that lapsed on its own would be the\n     * failure it exists to prevent. The organization edge disables the teardown cascade, so the record also\n     * outlives a purged tenant until its period ends.\n     *\n     * Deliberately NOT retention-governed (`retentionPolicy`): a scrubbed-and-hidden hold would be invisible\n     * to the infrastructure read every deletion path consults, which would lift the hold silently.\n     */\n    retentionBinding: {\n      retentionClass: DataRetentionClass.AUDIT_LOGS,\n      startPoint: RetentionStartPoint.CLOSURE_EVENT,\n      closureFieldName: 'releasedAt',\n    },\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.COUNT,\n      // Route-less, for the retention-class sweep only.\n      CoreResourceOperation.DELETE,\n    ],\n\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_OWNER],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n          {\n            // The same read an operator makes into a tenant, through the declared door and a usable grant.\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: false,\n            variantKey: 'admin',\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n            // assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — an operator reads a tenant's holds only through a usable grant.\n            admitsCrossTenantPlatformAdministration: true,\n          },\n        ],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_OWNER],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n          {\n            // The same read an operator makes into a tenant, through the declared door and a usable grant.\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: false,\n            variantKey: 'admin',\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n            // assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — an operator reads a tenant's holds only through a usable grant.\n            admitsCrossTenantPlatformAdministration: true,\n          },\n        ],\n      },\n      [CoreResourceOperation.COUNT]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_OWNER],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n          {\n            // The same read an operator makes into a tenant, through the declared door and a usable grant.\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: false,\n            variantKey: 'admin',\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n            // assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — an operator reads a tenant's holds only through a usable grant.\n            admitsCrossTenantPlatformAdministration: true,\n          },\n        ],\n      },\n\n      /**\n       * SWEEP ONLY — no client can delete a hold. `INTERNAL_CALL` registers no route; the retention-class\n       * sweep disposes of a released hold at the end of its period, and the delete chokepoint itself never\n       * holds a hold.\n       */\n      [CoreResourceOperation.DELETE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            roles: [],\n            riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          },\n        ],\n      },\n\n      /**\n       * Placing a hold suspends every deletion path for its scope until it is released.\n       *\n       * HIGH with step-up: a hold stops a tenant's retention schedule and its data subjects' erasures, and a\n       * hijacked session must not be able to do that on an old login.\n       *\n       * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — deletion suspended under a recorded legal hold.\n       */\n      [LegalHolds_Operations.PLACE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_OWNER],\n            riskLevel: ResourceOperationRiskLevel.HIGH,\n            resourceOperationLike: CoreResourceOperation.CREATE,\n            requestDto: LegalHoldPlaceRequestSchema,\n            // No `auditableEvent.reasonField`: the justification names the matter, and the generic operation row\n            // it would ride is exported to every SIEM route. The hold keeps it; LEGAL_HOLD_PLACED carries the scope.\n            // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-authentication before a high-impact action.\n            requiresStepUpAuthentication: true,\n          },\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: false,\n            variantKey: 'admin',\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.HIGH,\n            resourceOperationLike: CoreResourceOperation.CREATE,\n            requestDto: LegalHoldPlaceRequestSchema,\n            // No `auditableEvent.reasonField`: the justification names the matter, and the generic operation row\n            // it would ride is exported to every SIEM route. The hold keeps it; LEGAL_HOLD_PLACED carries the scope.\n            // Preservation is monotonic — it only ever stops a destruction — so crossing to place it passes\n            // the reversibility test (`administrative-continuity-floors.md`). Still never ambient: the\n            // admission requires a usable platform access grant for the tenant.\n            // assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — declared crossing, grant required.\n            admitsCrossTenantPlatformAdministration: true,\n            // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-authentication before a high-impact action.\n            requiresStepUpAuthentication: true,\n          },\n        ],\n      },\n\n      /**\n       * Releasing a hold lets the next sweep, purge or erasure proceed. Only an ACTIVE hold, and only by the\n       * tier that placed it — the enabled condition mirrors the server-side refusal in the paired implementation.\n       *\n       * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — deletion resumes only on a recorded release.\n       */\n      [LegalHolds_Operations.RELEASE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_OWNER],\n            riskLevel: ResourceOperationRiskLevel.HIGH,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: LegalHoldReleaseRequestSchema,\n            // No `auditableEvent.reasonField`, for the same reason as `place`: the release reason stays on the hold.\n            enabledCondition: ({ currentObject }) => currentObject.status === LegalHoldStatus.ACTIVE\n              && currentObject.placementTier === LegalHoldPlacementTier.ORGANIZATION,\n            // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-authentication before a high-impact action.\n            requiresStepUpAuthentication: true,\n          },\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: false,\n            variantKey: 'admin',\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.HIGH,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: LegalHoldReleaseRequestSchema,\n            // No `auditableEvent.reasonField`, for the same reason as `place`: the release reason stays on the hold.\n            // assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — declared crossing, grant required.\n            admitsCrossTenantPlatformAdministration: true,\n            // Any ACTIVE hold: the platform's own, or a tenant's own once that tenant is marked for deletion (its\n            // owners then hold no authority to release it). The tenant's status is not on the hold, so the server\n            // decides the second case and refuses a live tenant's hold.\n            enabledCondition: ({ currentObject }) => currentObject.status === LegalHoldStatus.ACTIVE,\n            // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-authentication before a high-impact action.\n            requiresStepUpAuthentication: true,\n          },\n        ],\n      },\n    },\n    // The ORGANIZATIONS primary scope is declared on the registry relationship (ORGANIZATIONS → LEGAL_HOLDS).\n  });\n"]}

package/dist/esm/compliance/privacy/legal-holds.shared.schemas.d.ts

@@ -0,0 +1,222 @@
+/**
+ * Legal holds — a recorded decision that suspends DELETION of a defined scope until it is released (#1634).
+ *
+ * ## Why it exists
+ *
+ * Once data is deleted on a schedule (#1613's retention-class sweep), a firm under litigation, a
+ * regulator's investigation or a client dispute must be able to stop that for a defined scope, and
+ * keep proof that it did. A hold is that stop. It is a decision about a CASE, which is why it is not a
+ * retention class: a statutory period is a property of a class of data (#1635); a hold names a scope
+ * and a ground, and ends only when somebody releases it.
+ *
+ * ## What a hold suspends
+ *
+ * Every door that destroys data consults ONE predicate before destroying anything
+ * ({@link matchLegalHoldsToRows}, evaluated over the active holds the backend reads in one query):
+ *
+ * | door | what a held row gets |
+ * |---|---|
+ * | the retention-class sweep | skipped and counted, never thrown |
+ * | a subject erasure | left exactly as it is (neither deleted nor scrubbed), reported per row |
+ * | the tenant purge | the whole tenant is skipped while ANY hold on it is active |
+ * | a DELETE / DELETE_MANY, and an `onParentDelete` cascade | refused, 409 {@link LegalHoldErrorCode.LEGAL_HOLD_ACTIVE} |
+ * | file bytes in object storage | not hard-deleted while the owning row is held |
+ * | RAG chunk removal | chunks of a held row are kept |
+ *
+ * Impersonalization counts as destruction: a scrub removes exactly what a hold exists to preserve.
+ *
+ * ## What it does NOT do
+ *
+ * It does not restrict PROCESSING (reads, updates). A hold is a preservation duty, and a row that must
+ * be preserved may still be corrected; restricting processing of kept data is #1635's statutory
+ * restriction, a different obligation with a different trigger.
+ *
+ * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — deletion suspended under a recorded legal hold.
+ */
+import { z } from 'zod';
+/** @wildo_source:part:start saas.models.privacy.legal-holds facet:layer:shared facet:audience:app-developer */
+/**
+ * WHAT a hold covers.
+ *
+ * - `ORGANIZATION` — every row the tenant owns, and the tenant itself (it is not purged).
+ * - `RESOURCE_ROWS` — the rows of ONE resource type in the tenant: the listed `rowIds`, or every row of
+ *   that type when none are listed. An explicit id list, not a query: a hold is evidence, and "which rows
+ *   were held" must be answerable from the hold alone, without re-running a filter against data that
+ *   has since changed.
+ * - `DATA_SUBJECT` — every row the subject-export graph attributes to one user. What a claim concerning
+ *   ONE person needs. See {@link LegalHoldSubjectAttributionKind} for how a row is attributed.
+ */
+export declare enum LegalHoldScopeKind {
+    ORGANIZATION = "organization",
+    RESOURCE_ROWS = "resource_rows",
+    DATA_SUBJECT = "data_subject"
+}
+/**
+ * WHY the data is held. Travels into every refusal and erasure report, because the ground is what a
+ * data subject is owed when their erasure is not completed.
+ *
+ * GDPR Art. 17(3)(e) (establishment, exercise or defence of legal claims) and Art. 17(3)(b) (compliance
+ * with a legal obligation) are the grounds under which a hold may also block an erasure.
+ * spec-cite: Regulation (EU) 2016/679, Art. 17(3)(b) and (e). Not legal advice.
+ */
+export declare enum LegalHoldGround {
+    /** Litigation, a dispute or a claim that is reasonably anticipated — Art. 17(3)(e). */
+    LEGAL_CLAIMS = "legal_claims",
+    /** A regulator's or authority's investigation that requires the data to be preserved. */
+    REGULATORY_INVESTIGATION = "regulatory_investigation",
+    /** A legal obligation to keep the data, other than a statutory retention period of a class — Art. 17(3)(b). */
+    LEGAL_OBLIGATION = "legal_obligation"
+}
+/**
+ * A hold's lifecycle. Two states and one direction: a released hold is kept as evidence and never
+ * reactivated — a new hold is a new row. There is no expiry state, deliberately: litigation ends by
+ * decision, not by clock, and a hold that lapses on its own is exactly the failure it exists to prevent.
+ */
+export declare enum LegalHoldStatus {
+    ACTIVE = "active",
+    RELEASED = "released"
+}
+/**
+ * WHO placed the hold, and therefore who may release it.
+ *
+ * A hold is released by the tier that placed it, and only by that tier. A tenant must not be able to
+ * lift a preservation duty the operator placed on it (an investigation OF the tenant), and the operator
+ * must not lift a tenant's own litigation hold on the tenant's behalf. Both tiers SEE every hold on the
+ * tenant: the tenant is owed knowing why its data is not being deleted.
+ */
+export declare enum LegalHoldPlacementTier {
+    /** Placed by the tenant's own owner, for its own data. */
+    ORGANIZATION = "organization",
+    /** Placed by an application super-administrator, crossing into the tenant through the declared door. */
+    PLATFORM = "platform"
+}
+/**
+ * Client-branchable codes carried as `context.code` on a refusal (allow-listed by the error sanitizer).
+ */
+export declare enum LegalHoldErrorCode {
+    /** A row the delete addresses is under an active legal hold. The caller is authorized; the state forbids it. */
+    LEGAL_HOLD_ACTIVE = "legal_hold_active",
+    /** The active holds could not be read, so whether the rows are held is unknown. Deletion is refused (fail closed). */
+    LEGAL_HOLD_STATE_UNVERIFIABLE = "legal_hold_state_unverifiable"
+}
+/** The custom verbs. No generic CREATE / UPDATE / DELETE is exposed to any client. */
+export declare enum LegalHolds_Operations {
+    PLACE = "place",
+    RELEASE = "release"
+}
+/** The largest explicit row list one `RESOURCE_ROWS` hold may name. A larger set is several holds, or the whole resource type. */
+export declare const LEGAL_HOLD_MAXIMUM_ROW_IDS = 1000;
+export declare const LegalHoldSchema: z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
+    scopeKind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof LegalHoldScopeKind>>>>>>;
+    resourceType: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>;
+    rowIds: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodArray<z.ZodString>>>>;
+    subjectUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>>;
+    legalGround: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof LegalHoldGround>>>>>;
+    justification: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    placementTier: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof LegalHoldPlacementTier>>>>>>;
+    status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof LegalHoldStatus>>>>>>>>;
+    placedByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
+    placedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>>>;
+    releasedByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>>;
+    releasedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>>;
+    releaseReason: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
+    createdAt: z.ZodOptional<z.ZodDate>;
+    updatedAt: z.ZodOptional<z.ZodDate>;
+}, z.core.$strip>;
+export type LegalHold = z.infer<typeof LegalHoldSchema>;
+/** The `place` request. Coherence between `scopeKind` and the three optional selectors is checked server-side. */
+export declare const LegalHoldPlaceRequestSchema: z.ZodObject<{
+    scopeKind: z.ZodEnum<typeof LegalHoldScopeKind>;
+    resourceType: z.ZodOptional<z.ZodString>;
+    rowIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    subjectUserId: z.ZodOptional<z.ZodString>;
+    legalGround: z.ZodEnum<typeof LegalHoldGround>;
+    justification: z.ZodString;
+}, z.core.$strip>;
+export type LegalHoldPlaceRequest = z.infer<typeof LegalHoldPlaceRequestSchema>;
+/** @wildo_source:part:end saas.models.privacy.legal-holds */
+export declare const LegalHoldReleaseRequestSchema: z.ZodObject<{
+    releaseReason: z.ZodString;
+}, z.core.$strip>;
+/**
+ * The scope-coherence rule for a `place` request, as one pure function the server and any client share.
+ * Returns the problems; empty means coherent.
+ */
+export declare function validateLegalHoldPlaceRequest(request: LegalHoldPlaceRequest): string[];
+/**
+ * How ONE resource type's rows are attributed to a data subject, for `DATA_SUBJECT` holds.
+ *
+ * Derived from the subject-export graph of `USERS` (Art. 15 access purpose), so "the rows a hold on a
+ * person covers" and "the rows an access request about that person discloses" are the same set by
+ * construction. Where a row cannot be attributed from its own fields, the answer is UNRESOLVABLE and the
+ * row is HELD: over-preserving delays a deletion until release, under-preserving destroys evidence.
+ */
+export declare enum LegalHoldSubjectAttributionKind {
+    /** The row IS the person (`USERS`): attributed when its id is the subject. */
+    SUBJECT_ROW = "subject_row",
+    /** The row carries a foreign key to `USERS` on an export edge: attributed when any of those fields names the subject. */
+    FOREIGN_KEY = "foreign_key",
+    /**
+     * The resource is in the subject's export graph, but a row's attribution needs other rows (an owned
+     * descendant, or a key held on the `USERS` side). Any foreign-key field it carries still attributes it; beyond
+     * that, a row in the held tenant is held (conservative), a row outside any tenant is the person's only when its
+     * `userId` names them, and inside ANOTHER person's erasure it is that person's, not the held subject's.
+     */
+    UNRESOLVABLE = "unresolvable",
+    /** Not in the subject's export graph (unrelated, or declared `exportSubject: FORBIDDEN`). A data-subject hold never covers it. */
+    NOT_ATTRIBUTED = "not_attributed"
+}
+export interface LegalHoldSubjectAttribution {
+    readonly kind: LegalHoldSubjectAttributionKind;
+    /** The row fields naming a user — the whole answer for FOREIGN_KEY, a first answer for UNRESOLVABLE. */
+    readonly foreignKeyFields?: readonly string[];
+}
+/** An active hold, as the predicate needs it. */
+export type ActiveLegalHold = Pick<LegalHold, '_id' | 'organizationId' | 'scopeKind' | 'resourceType' | 'rowIds' | 'subjectUserId' | 'legalGround'>;
+/** One row a deletion path is about to destroy. */
+export interface LegalHoldCandidateRow {
+    readonly id: string;
+    /** The tenant the row belongs to; absent for a row with no organization scope. */
+    readonly organizationId?: string;
+    /** The row's fields, for foreign-key attribution. */
+    readonly row?: Record<string, unknown>;
+}
+/** Why a row is held: the hold and its ground. */
+export interface LegalHoldMatch {
+    readonly holdId: string;
+    readonly scopeKind: LegalHoldScopeKind;
+    readonly legalGround: LegalHoldGround;
+}
+/**
+ * THE hold predicate — which of `rows` are under which of `holds`. Pure; the backend reads the active
+ * holds once per call and hands them in.
+ *
+ * `erasureSubjectUserIds` is set only by a subject erasure: every row that erasure reaches in a resource
+ * of the subject's export graph IS attributed to the person being erased, so a `DATA_SUBJECT` hold on that
+ * person covers it whatever its own fields say.
+ *
+ * The ORGANIZATIONS row's tenant is its own id, so an `ORGANIZATION` hold also holds the tenant row.
+ */
+export declare function matchLegalHoldsToRows(input: {
+    readonly holds: readonly ActiveLegalHold[];
+    readonly resourceType: string;
+    readonly rows: readonly LegalHoldCandidateRow[];
+    readonly organizationsResourceType: string;
+    readonly subjectAttribution: LegalHoldSubjectAttribution;
+    readonly erasureSubjectUserIds?: readonly string[];
+}): Map<string, LegalHoldMatch[]>;
+/** One row a subject erasure left untouched because a legal hold covers it (#1634). */
+export interface SubjectErasureLegalHoldRetention {
+    resourceType: string;
+    rowId: string;
+    /** The grounds of every hold covering the row — what the data subject is told. */
+    legalGrounds: LegalHoldGround[];
+    holdIds: string[];
+}
+/**
+ * The grounds of a set of matches, de-duplicated in vocabulary order — what a refusal or a report shows.
+ */
+export declare function legalHoldGroundsOf(matches: readonly LegalHoldMatch[]): LegalHoldGround[];
+//# sourceMappingURL=legal-holds.shared.schemas.d.ts.map

package/dist/esm/compliance/privacy/legal-holds.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legal-holds.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/legal-holds.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,+GAA+G;AAC/G;;;;;;;;;;GAUG;AACH,oBAAY,kBAAkB;IAC5B,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,YAAY,iBAAiB;CAC9B;AAED;;;;;;;GAOG;AACH,oBAAY,eAAe;IACzB,uFAAuF;IACvF,YAAY,iBAAiB;IAC7B,yFAAyF;IACzF,wBAAwB,6BAA6B;IACrD,+GAA+G;IAC/G,gBAAgB,qBAAqB;CACtC;AAED;;;;GAIG;AACH,oBAAY,eAAe;IACzB,MAAM,WAAW;IACjB,QAAQ,aAAa;CACtB;AAED;;;;;;;GAOG;AACH,oBAAY,sBAAsB;IAChC,0DAA0D;IAC1D,YAAY,iBAAiB;IAC7B,wGAAwG;IACxG,QAAQ,aAAa;CACtB;AAED;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,gHAAgH;IAChH,iBAAiB,sBAAsB;IACvC,sHAAsH;IACtH,6BAA6B,kCAAkC;CAChE;AAED,sFAAsF;AACtF,oBAAY,qBAAqB;IAC/B,KAAK,UAAU;IACf,OAAO,YAAY;CACpB;AAED,kIAAkI;AAClI,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;iBAmE1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,kHAAkH;AAClH,eAAO,MAAM,2BAA2B;;;;;;;iBAQtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,6DAA6D;AAE7D,eAAO,MAAM,6BAA6B;;iBAExC,CAAC;AAEH;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,EAAE,CAsBtF;AAED;;;;;;;GAOG;AACH,oBAAY,+BAA+B;IACzC,8EAA8E;IAC9E,WAAW,gBAAgB;IAC3B,yHAAyH;IACzH,WAAW,gBAAgB;IAC3B;;;;;OAKG;IACH,YAAY,iBAAiB;IAC7B,kIAAkI;IAClI,cAAc,mBAAmB;CAClC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAC;IAC/C,wGAAwG;IACxG,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAED,iDAAiD;AACjD,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,GAAG,gBAAgB,GAAG,WAAW,GAAG,cAAc,GAAG,QAAQ,GAAG,eAAe,GAAG,aAAa,CAAC,CAAC;AAEpJ,mDAAmD;AACnD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,qDAAqD;IACrD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED,kDAAkD;AAClD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC;CACvC;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,QAAQ,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,CAAC;IAC3C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAChD,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,2BAA2B,CAAC;IACzD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpD,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC,CAehC;AAwDD,uFAAuF;AACvF,MAAM,WAAW,gCAAgC;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,eAAe,EAAE,CAGxF"}