@wildo-ai/saas-models 1.1.9 → 1.1.10

package/dist/esm/compliance/privacy/jurisdiction-containment.shared.js

@@ -0,0 +1,46 @@
+/**
+ * Which jurisdictions contain which (#2588 carve). An IMPORT-FREE atom, so the browser-safe
+ * `@wildo-ai/saas-models/public-runtime` entrypoint and the zod-backed jurisdiction schemas
+ * (`operating-jurisdictions.shared.schemas.ts`, which validates slugs against this table) read the one copy.
+ */
+/**
+ * Which jurisdictions a broader one contains, so a source addressing the broader one answers for them.
+ *
+ * Without this, an application declaring `fr` would be reported as uncovered while the GDPR source
+ * plainly reaches it — over-warning, which is the failure mode that trains a reader to skim past the
+ * warnings that matter. Subdivisions need no table: `us-ca` is contained by `us` by construction, and
+ * that rule is applied in code rather than enumerated here.
+ *
+ * This table has a SECOND duty, so do not read it as coverage-only: its KEYS are the roots that stand
+ * for other jurisdictions, and `jurisdictionSlugProblem` (`operating-jurisdictions.shared.schemas.ts`) refuses a suffix on any of them —
+ * because a suffix can only be read as a place inside its root, and on an aggregate that reading
+ * inverts. Adding a key therefore also closes `<key>-<anything>` as an authorable slug, which is the
+ * intended consequence: the places a regime covers each have their own code.
+ *
+ * ⚠️ EU membership is a legal fact with a review trigger, not a convenience list: it changes when a
+ * state accedes or withdraws, and it has done both. Verified against the 27 members as of 2026-09-02.
+ * Nothing derives it, so a change is a deliberate edit here.
+ */
+export const JURISDICTION_CONTAINMENT = Object.freeze({
+    eu: Object.freeze([
+        'at', 'be', 'bg', 'cy', 'cz', 'de', 'dk', 'ee', 'es', 'fi', 'fr', 'gr', 'hr', 'hu',
+        'ie', 'it', 'lt', 'lu', 'lv', 'mt', 'nl', 'pl', 'pt', 'ro', 'se', 'si', 'sk',
+    ]),
+});
+/**
+ * Does a source addressing `reach` answer for an application operating in `declared`?
+ *
+ * Three ways, and the order is deliberate — exact first, because it is the common case and the other
+ * two are refinements of it.
+ */
+export function jurisdictionReachCovers(reach, declared) {
+    if (reach === declared)
+        return true;
+    // A source addressing the whole of `us` answers for `us-ca`; one addressing only `us-ca` does not answer for `us`.
+    // Sound only because a suffix is now guaranteed to be a SUBDIVISION: `jurisdictionSlugProblem` refuses a suffix
+    // on any key of JURISDICTION_CONTAINMENT, so no `eu-eea`-shaped slug — a regime WIDER than its root — reaches here.
+    if (declared.startsWith(`${reach}-`))
+        return true;
+    return (JURISDICTION_CONTAINMENT[reach] ?? []).some((member) => member === declared || declared.startsWith(`${member}-`));
+}
+//# sourceMappingURL=jurisdiction-containment.shared.js.map

package/dist/esm/compliance/privacy/jurisdiction-containment.shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jurisdiction-containment.shared.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/jurisdiction-containment.shared.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAgD,MAAM,CAAC,MAAM,CAAC;IACjG,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC;QAChB,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;QAClF,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;KAC7E,CAAC;CACH,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,QAAgB;IACrE,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpC,mHAAmH;IACnH,gHAAgH;IAChH,oHAAoH;IACpH,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,CAAC,wBAAwB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CACjD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CACrE,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Which jurisdictions contain which (#2588 carve). An IMPORT-FREE atom, so the browser-safe\n * `@wildo-ai/saas-models/public-runtime` entrypoint and the zod-backed jurisdiction schemas\n * (`operating-jurisdictions.shared.schemas.ts`, which validates slugs against this table) read the one copy.\n */\n\n/**\n * Which jurisdictions a broader one contains, so a source addressing the broader one answers for them.\n *\n * Without this, an application declaring `fr` would be reported as uncovered while the GDPR source\n * plainly reaches it — over-warning, which is the failure mode that trains a reader to skim past the\n * warnings that matter. Subdivisions need no table: `us-ca` is contained by `us` by construction, and\n * that rule is applied in code rather than enumerated here.\n *\n * This table has a SECOND duty, so do not read it as coverage-only: its KEYS are the roots that stand\n * for other jurisdictions, and `jurisdictionSlugProblem` (`operating-jurisdictions.shared.schemas.ts`) refuses a suffix on any of them —\n * because a suffix can only be read as a place inside its root, and on an aggregate that reading\n * inverts. Adding a key therefore also closes `<key>-<anything>` as an authorable slug, which is the\n * intended consequence: the places a regime covers each have their own code.\n *\n * ⚠️ EU membership is a legal fact with a review trigger, not a convenience list: it changes when a\n * state accedes or withdraws, and it has done both. Verified against the 27 members as of 2026-09-02.\n * Nothing derives it, so a change is a deliberate edit here.\n */\nexport const JURISDICTION_CONTAINMENT: Readonly<Record<string, readonly string[]>> = Object.freeze({\n  eu: Object.freeze([\n    'at', 'be', 'bg', 'cy', 'cz', 'de', 'dk', 'ee', 'es', 'fi', 'fr', 'gr', 'hr', 'hu',\n    'ie', 'it', 'lt', 'lu', 'lv', 'mt', 'nl', 'pl', 'pt', 'ro', 'se', 'si', 'sk',\n  ]),\n});\n\n/**\n * Does a source addressing `reach` answer for an application operating in `declared`?\n *\n * Three ways, and the order is deliberate — exact first, because it is the common case and the other\n * two are refinements of it.\n */\nexport function jurisdictionReachCovers(reach: string, declared: string): boolean {\n  if (reach === declared) return true;\n  // A source addressing the whole of `us` answers for `us-ca`; one addressing only `us-ca` does not answer for `us`.\n  // Sound only because a suffix is now guaranteed to be a SUBDIVISION: `jurisdictionSlugProblem` refuses a suffix\n  // on any key of JURISDICTION_CONTAINMENT, so no `eu-eea`-shaped slug — a regime WIDER than its root — reaches here.\n  if (declared.startsWith(`${reach}-`)) return true;\n  return (JURISDICTION_CONTAINMENT[reach] ?? []).some(\n    (member) => member === declared || declared.startsWith(`${member}-`),\n  );\n}\n"]}

package/dist/esm/compliance/privacy/legal-hold-subject-attribution.shared.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"legal-hold-subject-attribution.shared.utils.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/legal-hold-subject-attribution.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;AAElD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mDAAmD,CAAC;AACtF,OAAO,EAKL,KAAK,gCAAgC,EACtC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAEL,KAAK,2BAA2B,EACjC,MAAM,8BAA8B,CAAC;AAEtC;;;;;;;;;;;;GAYG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE;IACrD,QAAQ,CAAC,iBAAiB,EAAE,YAAY,CAAC;IACzC,QAAQ,CAAC,kBAAkB,EAAE,YAAY,CAAC;IAC1C,QAAQ,CAAC,kBAAkB,EAAE,gCAAgC,CAAC;IAC9D,QAAQ,CAAC,iBAAiB,EAAE,CAAC,YAAY,EAAE,YAAY,KAAK,OAAO,CAAC;IACpE,+FAA+F;IAC/F,QAAQ,CAAC,oBAAoB,EAAE,CAAC,YAAY,EAAE,YAAY,KAAK,SAAS,oBAAoB,EAAE,CAAC;IAC/F,6FAA6F;IAC7F,QAAQ,CAAC,sBAAsB,EAAE,CAAC,YAAY,EAAE,oBAAoB,KAAK,MAAM,CAAC;CACjF,GAAG,2BAA2B,CAyD9B"}
+{"version":3,"file":"legal-hold-subject-attribution.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/legal-hold-subject-attribution.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;AAElD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mDAAmD,CAAC;AACtF,OAAO,EAKL,KAAK,gCAAgC,EACtC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAEL,KAAK,2BAA2B,EACjC,MAAM,8BAA8B,CAAC;AAEtC;;;;;;;;;;;;GAYG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE;IACrD,QAAQ,CAAC,iBAAiB,EAAE,YAAY,CAAC;IACzC,QAAQ,CAAC,kBAAkB,EAAE,YAAY,CAAC;IAC1C,QAAQ,CAAC,kBAAkB,EAAE,gCAAgC,CAAC;IAC9D,QAAQ,CAAC,iBAAiB,EAAE,CAAC,YAAY,EAAE,YAAY,KAAK,OAAO,CAAC;IACpE,+FAA+F;IAC/F,QAAQ,CAAC,oBAAoB,EAAE,CAAC,YAAY,EAAE,YAAY,KAAK,SAAS,oBAAoB,EAAE,CAAC;IAC/F,6FAA6F;IAC7F,QAAQ,CAAC,sBAAsB,EAAE,CAAC,YAAY,EAAE,oBAAoB,KAAK,MAAM,CAAC;CACjF,GAAG,2BAA2B,CAyD9B"}

package/dist/esm/compliance/privacy/legal-hold-subject-attribution.shared.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"legal-hold-subject-attribution.shared.utils.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/legal-hold-subject-attribution.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,0BAA0B,GAE3B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAE/E,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4CAA4C,EAC5C,sCAAsC,GAEvC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,+BAA+B,GAEhC,MAAM,8BAA8B,CAAC;AAEtC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAS/C;IACC,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,GAAG,KAAK,CAAC;IACxD,IAAI,kBAAkB,KAAK,iBAAiB;QAAE,OAAO,EAAE,IAAI,EAAE,+BAA+B,CAAC,WAAW,EAAE,CAAC;IAC3G,IAAI,KAAK,CAAC,iBAAiB,CAAC,kBAAkB,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,+BAA+B,CAAC,cAAc,EAAE,CAAC;IAEjH,MAAM,QAAQ,GAAG,4CAA4C,CAC3D,iBAAiB,EACjB,KAAK,CAAC,kBAAkB,EACxB,oBAAoB,CAAC,aAAa,CACnC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,sCAAsC,CAAC,SAAS,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC;IAEtG,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;QACjC,IAAI,SAAS,CAAC,cAAc,CAAC,mBAAmB,KAAK,kBAAkB;YAAE,SAAS;QAClF,MAAM,MAAM,GAAG,qBAAqB,CAAC,mCAAmC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAC3G,IAAI,MAAM,KAAK,kBAAkB,EAAE,CAAC;YAClC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC,CAAC;QACvF,CAAC;aAAM,CAAC;YACN,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,sGAAsG;QACtG,uDAAuD;QACvD,MAAM,OAAO,GAAG,QAAQ;aACrB,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,cAAc,CAAC,WAAW,KAAK,4BAA4B,CAAC,cAAc,CAAC;aAC3G,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAC5D,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,EAAG,CAAC;YACjC,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAAE,SAAS;YAC1C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5B,KAAK,MAAM,YAAY,IAAI,KAAK,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/D,IAAI,YAAY,CAAC,UAAU,KAAK,IAAI;oBAAE,SAAS;gBAC/C,MAAM,SAAS,GAAG,qBAAqB,CAAC,oCAAoC,CAAC,YAAY,CAAC,CAAC;gBAC3F,IAAI,SAAS,CAAC,QAAQ,CAAC,kBAAkB,KAAK,0BAA0B,CAAC,SAAS;oBAAE,SAAS;gBAC7F,MAAM,KAAK,GAAG,YAAY,CAAC,aAA6B,CAAC;gBACzD,IAAI,KAAK,KAAK,kBAAkB,EAAE,CAAC;oBACjC,YAAY,GAAG,IAAI,CAAC;oBACpB,MAAM;gBACR,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,gBAAgB,CAAC,IAAI,GAAG,CAAC;YAC9B,CAAC,CAAC,EAAE,IAAI,EAAE,+BAA+B,CAAC,YAAY,EAAE,gBAAgB,EAAE,CAAC,GAAG,gBAAgB,CAAC,CAAC,IAAI,EAAE,EAAE;YACxG,CAAC,CAAC,EAAE,IAAI,EAAE,+BAA+B,CAAC,YAAY,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,+BAA+B,CAAC,WAAW,EAAE,gBAAgB,EAAE,CAAC,GAAG,gBAAgB,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAC/G,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,+BAA+B,CAAC,cAAc,EAAE,CAAC;AAClE,CAAC","sourcesContent":["/**\n * Which rows of a resource type a `DATA_SUBJECT` legal hold covers (#1634) — derived from the SAME\n * subject-export classification an Art. 15 access request uses, so the rows a hold on a person preserves\n * and the rows an access request about that person discloses cannot drift apart.\n *\n * Pure over configuration; the backend computes it once per resource type and caches it.\n */\n\nimport {\n  RelationshipLifecycleModel,\n  type ResourceRelationship,\n} from '../../resources/resources.shared.schemas';\nimport { Resources_SharedUtils } from '../../resources/resources.shared.utils';\nimport type { ResourceType } from '../../resources/resources.shared.core.definitions';\nimport {\n  SubjectExportEdgeDisposition,\n  SubjectExportPurpose,\n  enumerateSubjectExportRelationshipTraversals,\n  isIncludedSubjectExportEdgeDisposition,\n  type SubjectExportRelationshipBuckets,\n} from './subject-export.shared.schemas';\nimport {\n  LegalHoldSubjectAttributionKind,\n  type LegalHoldSubjectAttribution,\n} from './legal-holds.shared.schemas';\n\n/**\n * Plan the attribution of `targetResourceType`'s rows to a person.\n *\n * 1. `USERS` itself → the row IS the person.\n * 2. A resource declared `exportSubject: FORBIDDEN` is outside the export graph → never attributed. Its rows\n *    (credentials, sessions) are the ones an access request withholds, so a hold on the person does not\n *    preserve them either.\n * 3. A resource on an included `USERS` export edge whose rows hold the foreign key → attributed by that field.\n * 4. A resource the export reaches only through another row — a key held on the `USERS` side, or an owned\n *    descendant of an included owned edge — cannot be attributed from its own fields → UNRESOLVABLE, and the\n *    hold covers every row of it in the held tenant. That is the conservative direction on purpose.\n * 5. Anything else is not the person's data → not attributed.\n */\nexport function planLegalHoldSubjectAttribution(input: {\n  readonly usersResourceType: ResourceType;\n  readonly targetResourceType: ResourceType;\n  readonly usersRelationships: SubjectExportRelationshipBuckets;\n  readonly isExportForbidden: (resourceType: ResourceType) => boolean;\n  /** The child-direction relationships of a resource type (for the owned-descendant closure). */\n  readonly childRelationshipsOf: (resourceType: ResourceType) => readonly ResourceRelationship[];\n  /** The FK field of a relationship normalized with the referenced side as `resourceType1`. */\n  readonly resolveForeignKeyField: (relationship: ResourceRelationship) => string;\n}): LegalHoldSubjectAttribution {\n  const { usersResourceType, targetResourceType } = input;\n  if (targetResourceType === usersResourceType) return { kind: LegalHoldSubjectAttributionKind.SUBJECT_ROW };\n  if (input.isExportForbidden(targetResourceType)) return { kind: LegalHoldSubjectAttributionKind.NOT_ATTRIBUTED };\n\n  const included = enumerateSubjectExportRelationshipTraversals(\n    usersResourceType,\n    input.usersRelationships,\n    SubjectExportPurpose.ACCESS_ART_15,\n  ).filter((traversal) => isIncludedSubjectExportEdgeDisposition(traversal.classification.disposition));\n\n  const foreignKeyFields = new Set<string>();\n  let unresolvable = false;\n  for (const traversal of included) {\n    if (traversal.classification.relatedResourceType !== targetResourceType) continue;\n    const holder = Resources_SharedUtils.resolveForeignKeyHolderResourceType(traversal.normalizedRelationship);\n    if (holder === targetResourceType) {\n      foreignKeyFields.add(input.resolveForeignKeyField(traversal.normalizedRelationship));\n    } else {\n      unresolvable = true;\n    }\n  }\n\n  if (!unresolvable) {\n    // The owned-descendant closure: rows below a row the person owns are the person's data too, and their\n    // own fields do not say whose ancestor they hang from.\n    const pending = included\n      .filter((traversal) => traversal.classification.disposition === SubjectExportEdgeDisposition.INCLUDED_OWNED)\n      .map((traversal) => traversal.classification.relatedResourceType);\n    const walked = new Set<string>([String(usersResourceType)]);\n    while (pending.length > 0 && !unresolvable) {\n      const current = pending.shift()!;\n      if (walked.has(String(current))) continue;\n      walked.add(String(current));\n      for (const relationship of input.childRelationshipsOf(current)) {\n        if (relationship.isDisabled === true) continue;\n        const semantics = Resources_SharedUtils.requireResolvedRelationshipSemantics(relationship);\n        if (semantics.handling.lifecycleModelMode !== RelationshipLifecycleModel.DEPENDENT) continue;\n        const child = relationship.resourceType2 as ResourceType;\n        if (child === targetResourceType) {\n          unresolvable = true;\n          break;\n        }\n        pending.push(child);\n      }\n    }\n  }\n\n  if (unresolvable) {\n    return foreignKeyFields.size > 0\n      ? { kind: LegalHoldSubjectAttributionKind.UNRESOLVABLE, foreignKeyFields: [...foreignKeyFields].sort() }\n      : { kind: LegalHoldSubjectAttributionKind.UNRESOLVABLE };\n  }\n  if (foreignKeyFields.size > 0) {\n    return { kind: LegalHoldSubjectAttributionKind.FOREIGN_KEY, foreignKeyFields: [...foreignKeyFields].sort() };\n  }\n  return { kind: LegalHoldSubjectAttributionKind.NOT_ATTRIBUTED };\n}\n"]}
+{"version":3,"file":"legal-hold-subject-attribution.shared.utils.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/legal-hold-subject-attribution.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,0BAA0B,GAE3B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAE/E,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4CAA4C,EAC5C,sCAAsC,GAEvC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,+BAA+B,GAEhC,MAAM,8BAA8B,CAAC;AAEtC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAS/C;IACC,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,GAAG,KAAK,CAAC;IACxD,IAAI,kBAAkB,KAAK,iBAAiB;QAAE,OAAO,EAAE,IAAI,EAAE,+BAA+B,CAAC,WAAW,EAAE,CAAC;IAC3G,IAAI,KAAK,CAAC,iBAAiB,CAAC,kBAAkB,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,+BAA+B,CAAC,cAAc,EAAE,CAAC;IAEjH,MAAM,QAAQ,GAAG,4CAA4C,CAC3D,iBAAiB,EACjB,KAAK,CAAC,kBAAkB,EACxB,oBAAoB,CAAC,aAAa,CACnC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,sCAAsC,CAAC,SAAS,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC;IAEtG,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;QACjC,IAAI,SAAS,CAAC,cAAc,CAAC,mBAAmB,KAAK,kBAAkB;YAAE,SAAS;QAClF,MAAM,MAAM,GAAG,qBAAqB,CAAC,mCAAmC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAC3G,IAAI,MAAM,KAAK,kBAAkB,EAAE,CAAC;YAClC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC,CAAC;QACvF,CAAC;aAAM,CAAC;YACN,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,sGAAsG;QACtG,uDAAuD;QACvD,MAAM,OAAO,GAAG,QAAQ;aACrB,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,cAAc,CAAC,WAAW,KAAK,4BAA4B,CAAC,cAAc,CAAC;aAC3G,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAC5D,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,EAAG,CAAC;YACjC,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAAE,SAAS;YAC1C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5B,KAAK,MAAM,YAAY,IAAI,KAAK,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/D,IAAI,YAAY,CAAC,UAAU,KAAK,IAAI;oBAAE,SAAS;gBAC/C,MAAM,SAAS,GAAG,qBAAqB,CAAC,oCAAoC,CAAC,YAAY,CAAC,CAAC;gBAC3F,IAAI,SAAS,CAAC,QAAQ,CAAC,kBAAkB,KAAK,0BAA0B,CAAC,SAAS;oBAAE,SAAS;gBAC7F,MAAM,KAAK,GAAG,YAAY,CAAC,aAA6B,CAAC;gBACzD,IAAI,KAAK,KAAK,kBAAkB,EAAE,CAAC;oBACjC,YAAY,GAAG,IAAI,CAAC;oBACpB,MAAM;gBACR,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,gBAAgB,CAAC,IAAI,GAAG,CAAC;YAC9B,CAAC,CAAC,EAAE,IAAI,EAAE,+BAA+B,CAAC,YAAY,EAAE,gBAAgB,EAAE,CAAC,GAAG,gBAAgB,CAAC,CAAC,IAAI,EAAE,EAAE;YACxG,CAAC,CAAC,EAAE,IAAI,EAAE,+BAA+B,CAAC,YAAY,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,+BAA+B,CAAC,WAAW,EAAE,gBAAgB,EAAE,CAAC,GAAG,gBAAgB,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAC/G,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,+BAA+B,CAAC,cAAc,EAAE,CAAC;AAClE,CAAC","sourcesContent":["/**\n * Which rows of a resource type a `DATA_SUBJECT` legal hold covers (#1634) — derived from the SAME\n * subject-export classification an Art. 15 access request uses, so the rows a hold on a person preserves\n * and the rows an access request about that person discloses cannot drift apart.\n *\n * Pure over configuration; the backend computes it once per resource type and caches it.\n */\n\nimport {\n  RelationshipLifecycleModel,\n  type ResourceRelationship,\n} from '../../resources/resources.shared.schemas';\nimport { Resources_SharedUtils } from '../../resources/resources.shared.utils';\nimport type { ResourceType } from '../../resources/resources.shared.core.definitions';\nimport {\n  SubjectExportEdgeDisposition,\n  SubjectExportPurpose,\n  enumerateSubjectExportRelationshipTraversals,\n  isIncludedSubjectExportEdgeDisposition,\n  type SubjectExportRelationshipBuckets,\n} from './subject-export.shared.schemas';\nimport {\n  LegalHoldSubjectAttributionKind,\n  type LegalHoldSubjectAttribution,\n} from './legal-holds.shared.schemas';\n\n/**\n * Plan the attribution of `targetResourceType`'s rows to a person.\n *\n * 1. `USERS` itself → the row IS the person.\n * 2. A resource declared `exportSubject: FORBIDDEN` is outside the export graph → never attributed. Its rows\n *    (credentials, sessions) are the ones an access request withholds, so a hold on the person does not\n *    preserve them either.\n * 3. A resource on an included `USERS` export edge whose rows hold the foreign key → attributed by that field.\n * 4. A resource the export reaches only through another row — a key held on the `USERS` side, or an owned\n *    descendant of an included owned edge — cannot be attributed from its own fields → UNRESOLVABLE, and the\n *    hold covers every row of it in the held tenant. That is the conservative direction on purpose.\n * 5. Anything else is not the person's data → not attributed.\n */\nexport function planLegalHoldSubjectAttribution(input: {\n  readonly usersResourceType: ResourceType;\n  readonly targetResourceType: ResourceType;\n  readonly usersRelationships: SubjectExportRelationshipBuckets;\n  readonly isExportForbidden: (resourceType: ResourceType) => boolean;\n  /** The child-direction relationships of a resource type (for the owned-descendant closure). */\n  readonly childRelationshipsOf: (resourceType: ResourceType) => readonly ResourceRelationship[];\n  /** The FK field of a relationship normalized with the referenced side as `resourceType1`. */\n  readonly resolveForeignKeyField: (relationship: ResourceRelationship) => string;\n}): LegalHoldSubjectAttribution {\n  const { usersResourceType, targetResourceType } = input;\n  if (targetResourceType === usersResourceType) return { kind: LegalHoldSubjectAttributionKind.SUBJECT_ROW };\n  if (input.isExportForbidden(targetResourceType)) return { kind: LegalHoldSubjectAttributionKind.NOT_ATTRIBUTED };\n\n  const included = enumerateSubjectExportRelationshipTraversals(\n    usersResourceType,\n    input.usersRelationships,\n    SubjectExportPurpose.ACCESS_ART_15,\n  ).filter((traversal) => isIncludedSubjectExportEdgeDisposition(traversal.classification.disposition));\n\n  const foreignKeyFields = new Set<string>();\n  let unresolvable = false;\n  for (const traversal of included) {\n    if (traversal.classification.relatedResourceType !== targetResourceType) continue;\n    const holder = Resources_SharedUtils.resolveForeignKeyHolderResourceType(traversal.normalizedRelationship);\n    if (holder === targetResourceType) {\n      foreignKeyFields.add(input.resolveForeignKeyField(traversal.normalizedRelationship));\n    } else {\n      unresolvable = true;\n    }\n  }\n\n  if (!unresolvable) {\n    // The owned-descendant closure: rows below a row the person owns are the person's data too, and their\n    // own fields do not say whose ancestor they hang from.\n    const pending = included\n      .filter((traversal) => traversal.classification.disposition === SubjectExportEdgeDisposition.INCLUDED_OWNED)\n      .map((traversal) => traversal.classification.relatedResourceType);\n    const walked = new Set<string>([String(usersResourceType)]);\n    while (pending.length > 0 && !unresolvable) {\n      const current = pending.shift()!;\n      if (walked.has(String(current))) continue;\n      walked.add(String(current));\n      for (const relationship of input.childRelationshipsOf(current)) {\n        if (relationship.isDisabled === true) continue;\n        const semantics = Resources_SharedUtils.requireResolvedRelationshipSemantics(relationship);\n        if (semantics.handling.lifecycleModelMode !== RelationshipLifecycleModel.DEPENDENT) continue;\n        const child = relationship.resourceType2 as ResourceType;\n        if (child === targetResourceType) {\n          unresolvable = true;\n          break;\n        }\n        pending.push(child);\n      }\n    }\n  }\n\n  if (unresolvable) {\n    return foreignKeyFields.size > 0\n      ? { kind: LegalHoldSubjectAttributionKind.UNRESOLVABLE, foreignKeyFields: [...foreignKeyFields].sort() }\n      : { kind: LegalHoldSubjectAttributionKind.UNRESOLVABLE };\n  }\n  if (foreignKeyFields.size > 0) {\n    return { kind: LegalHoldSubjectAttributionKind.FOREIGN_KEY, foreignKeyFields: [...foreignKeyFields].sort() };\n  }\n  return { kind: LegalHoldSubjectAttributionKind.NOT_ATTRIBUTED };\n}\n"]}

package/dist/esm/compliance/privacy/legal-holds.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"legal-holds.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/legal-holds.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,sBAAsB,EAItB,eAAe,EACf,qBAAqB,EACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;AAMlD,KAAK,wBAAwB,GACzB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,KAAK,GAC3B,qBAAqB,CAAC,MAAM,CAAC;AAGjC,eAAO,MAAM,qDAAqD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;iCAsNhH,CAAC"}
+{"version":3,"file":"legal-holds.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/legal-holds.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,sBAAsB,EAItB,eAAe,EACf,qBAAqB,EACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;AAMlD,KAAK,wBAAwB,GACzB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,KAAK,GAC3B,qBAAqB,CAAC,MAAM,CAAC;AAGjC,eAAO,MAAM,qDAAqD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;iCAsNhH,CAAC"}

package/dist/esm/compliance/privacy/legal-holds.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"legal-holds.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/legal-holds.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,6BAA6B,EAC7B,eAAe,EACf,eAAe,EACf,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAE7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpG,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAS9F,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CACtH,0CAA0C,CAIxC;IACA,UAAU,EAAE,eAAe;IAC3B,kBAAkB,EAAE,gBAAgB,CAAC,WAAW;IAChD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC;IACzF,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;;;OAUG;IACH,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,SAAS;KAClD;IAED;;;;;;;;OAQG;IACH,gBAAgB,EAAE;QAChB,cAAc,EAAE,kBAAkB,CAAC,UAAU;QAC7C,UAAU,EAAE,mBAAmB,CAAC,aAAa;QAC7C,gBAAgB,EAAE,YAAY;KAC/B;IAED,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,KAAK;QAC3B,kDAAkD;QAClD,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,+FAA+F;oBAC/F,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,gIAAgI;oBAChI,uCAAuC,EAAE,IAAI;iBAC9C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,+FAA+F;oBAC/F,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,gIAAgI;oBAChI,uCAAuC,EAAE,IAAI;iBAC9C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,+FAA+F;oBAC/F,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,gIAAgI;oBAChI,uCAAuC,EAAE,IAAI;iBAC9C;aACF;SACF;QAED;;;;WAIG;QACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,EAAE;oBACT,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED;;;;;;;WAOG;QACH,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,2BAA2B;oBACvC,qGAAqG;oBACrG,yGAAyG;oBACzG,4GAA4G;oBAC5G,4BAA4B,EAAE,IAAI;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,2BAA2B;oBACvC,qGAAqG;oBACrG,yGAAyG;oBACzG,gGAAgG;oBAChG,2FAA2F;oBAC3F,oEAAoE;oBACpE,mGAAmG;oBACnG,uCAAuC,EAAE,IAAI;oBAC7C,4GAA4G;oBAC5G,4BAA4B,EAAE,IAAI;iBACnC;aACF;SACF;QAED;;;;;WAKG;QACH,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE;YAC/B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,6BAA6B;oBACzC,yGAAyG;oBACzG,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM;2BACnF,aAAa,CAAC,aAAa,KAAK,sBAAsB,CAAC,YAAY;oBACxE,4GAA4G;oBAC5G,4BAA4B,EAAE,IAAI;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,6BAA6B;oBACzC,yGAAyG;oBACzG,mGAAmG;oBACnG,uCAAuC,EAAE,IAAI;oBAC7C,sGAAsG;oBACtG,sGAAsG;oBACtG,4DAA4D;oBAC5D,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM;oBACxF,4GAA4G;oBAC5G,4BAA4B,EAAE,IAAI;iBACnC;aACF;SACF;KACF;IACD,0GAA0G;CAC3G,CAAC,CAAC","sourcesContent":["/**\n * Legal holds — resource configuration (#1634).\n *\n * Two verbs and two tiers:\n *\n *   place   — the tenant's owner (default variant), or an application super-administrator crossing into the\n *             tenant through the declared door (`admin` variant, requires a usable platform access grant)\n *   release — the SAME tier that placed the hold, and only that tier (see {@link LegalHoldPlacementTier})\n *\n * No client can create, update or delete a hold any other way. The one DELETE is route-less and exists so\n * the retention-class sweep can dispose of a RELEASED hold once its `AUDIT_LOGS` period has passed.\n */\n\nimport {\n  LegalHoldPlacementTier,\n  LegalHoldPlaceRequestSchema,\n  LegalHoldReleaseRequestSchema,\n  LegalHoldSchema,\n  LegalHoldStatus,\n  LegalHolds_Operations,\n} from './legal-holds.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  type ResourceRelationship,\n} from '../../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../../security/authorizations/roles.shared.schemas';\nimport { DataRetentionClass, RetentionStartPoint } from './retention-schedule.shared.schemas';\n\ntype LegalHoldsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.COUNT\n  | CoreResourceOperation.DELETE;\n\n\nexport const legalHoldsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<\n    typeof LegalHolds_Operations,\n    LegalHoldsCoreOperations,\n    typeof LegalHoldSchema\n  >({\n    mainSchema: LegalHoldSchema,\n    resourceIdentifier: CoreResourceType.LEGAL_HOLDS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.LEGAL_HOLDS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n\n    /**\n     * No trusted door of any kind. Every deletion path reads the ACTIVE holds through the infrastructure\n     * tier (one indexed query), and every write is a custom verb. A system `create`/`update` would be a\n     * second, unaudited way to place or lift a preservation duty.\n     *\n     * `exportSubject: FORBIDDEN`: `placedByUserId`, `releasedByUserId` and `subjectUserId` put these rows on\n     * a user's access graph, and an included resource with no declaration refuses the whole export. A hold is\n     * the operator's litigation record; disclosing it to the person it concerns can prejudice the very claim\n     * it preserves, and it names the placer and the matter. Left OUT of the bundle and recorded, never\n     * silently dropped.\n     */\n    systemAccessPolicy: {\n      exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n    },\n\n    /**\n     * A released hold is kept as defence evidence for the `AUDIT_LOGS` period, counted from its release.\n     * An ACTIVE hold has no `releasedAt`, so it never expires — a hold that lapsed on its own would be the\n     * failure it exists to prevent. The organization edge disables the teardown cascade, so the record also\n     * outlives a purged tenant until its period ends.\n     *\n     * Deliberately NOT retention-governed (`retentionPolicy`): a scrubbed-and-hidden hold would be invisible\n     * to the infrastructure read every deletion path consults, which would lift the hold silently.\n     */\n    retentionBinding: {\n      retentionClass: DataRetentionClass.AUDIT_LOGS,\n      startPoint: RetentionStartPoint.CLOSURE_EVENT,\n      closureFieldName: 'releasedAt',\n    },\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.COUNT,\n      // Route-less, for the retention-class sweep only.\n      CoreResourceOperation.DELETE,\n    ],\n\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_OWNER],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n          {\n            // The same read an operator makes into a tenant, through the declared door and a usable grant.\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: false,\n            variantKey: 'admin',\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n            // assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — an operator reads a tenant's holds only through a usable grant.\n            admitsCrossTenantPlatformAdministration: true,\n          },\n        ],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_OWNER],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n          {\n            // The same read an operator makes into a tenant, through the declared door and a usable grant.\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: false,\n            variantKey: 'admin',\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n            // assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — an operator reads a tenant's holds only through a usable grant.\n            admitsCrossTenantPlatformAdministration: true,\n          },\n        ],\n      },\n      [CoreResourceOperation.COUNT]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_OWNER],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n          {\n            // The same read an operator makes into a tenant, through the declared door and a usable grant.\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: false,\n            variantKey: 'admin',\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n            // assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — an operator reads a tenant's holds only through a usable grant.\n            admitsCrossTenantPlatformAdministration: true,\n          },\n        ],\n      },\n\n      /**\n       * SWEEP ONLY — no client can delete a hold. `INTERNAL_CALL` registers no route; the retention-class\n       * sweep disposes of a released hold at the end of its period, and the delete chokepoint itself never\n       * holds a hold.\n       */\n      [CoreResourceOperation.DELETE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            roles: [],\n            riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          },\n        ],\n      },\n\n      /**\n       * Placing a hold suspends every deletion path for its scope until it is released.\n       *\n       * HIGH with step-up: a hold stops a tenant's retention schedule and its data subjects' erasures, and a\n       * hijacked session must not be able to do that on an old login.\n       *\n       * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — deletion suspended under a recorded legal hold.\n       */\n      [LegalHolds_Operations.PLACE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_OWNER],\n            riskLevel: ResourceOperationRiskLevel.HIGH,\n            resourceOperationLike: CoreResourceOperation.CREATE,\n            requestDto: LegalHoldPlaceRequestSchema,\n            // No `auditableEvent.reasonField`: the justification names the matter, and the generic operation row\n            // it would ride is exported to every SIEM route. The hold keeps it; LEGAL_HOLD_PLACED carries the scope.\n            // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-authentication before a high-impact action.\n            requiresStepUpAuthentication: true,\n          },\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: false,\n            variantKey: 'admin',\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.HIGH,\n            resourceOperationLike: CoreResourceOperation.CREATE,\n            requestDto: LegalHoldPlaceRequestSchema,\n            // No `auditableEvent.reasonField`: the justification names the matter, and the generic operation row\n            // it would ride is exported to every SIEM route. The hold keeps it; LEGAL_HOLD_PLACED carries the scope.\n            // Preservation is monotonic — it only ever stops a destruction — so crossing to place it passes\n            // the reversibility test (`administrative-continuity-floors.md`). Still never ambient: the\n            // admission requires a usable platform access grant for the tenant.\n            // assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — declared crossing, grant required.\n            admitsCrossTenantPlatformAdministration: true,\n            // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-authentication before a high-impact action.\n            requiresStepUpAuthentication: true,\n          },\n        ],\n      },\n\n      /**\n       * Releasing a hold lets the next sweep, purge or erasure proceed. Only an ACTIVE hold, and only by the\n       * tier that placed it — the enabled condition mirrors the server-side refusal in the paired implementation.\n       *\n       * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — deletion resumes only on a recorded release.\n       */\n      [LegalHolds_Operations.RELEASE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_OWNER],\n            riskLevel: ResourceOperationRiskLevel.HIGH,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: LegalHoldReleaseRequestSchema,\n            // No `auditableEvent.reasonField`, for the same reason as `place`: the release reason stays on the hold.\n            enabledCondition: ({ currentObject }) => currentObject.status === LegalHoldStatus.ACTIVE\n              && currentObject.placementTier === LegalHoldPlacementTier.ORGANIZATION,\n            // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-authentication before a high-impact action.\n            requiresStepUpAuthentication: true,\n          },\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: false,\n            variantKey: 'admin',\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.HIGH,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: LegalHoldReleaseRequestSchema,\n            // No `auditableEvent.reasonField`, for the same reason as `place`: the release reason stays on the hold.\n            // assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — declared crossing, grant required.\n            admitsCrossTenantPlatformAdministration: true,\n            // Any ACTIVE hold: the platform's own, or a tenant's own once that tenant is marked for deletion (its\n            // owners then hold no authority to release it). The tenant's status is not on the hold, so the server\n            // decides the second case and refuses a live tenant's hold.\n            enabledCondition: ({ currentObject }) => currentObject.status === LegalHoldStatus.ACTIVE,\n            // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-authentication before a high-impact action.\n            requiresStepUpAuthentication: true,\n          },\n        ],\n      },\n    },\n    // The ORGANIZATIONS primary scope is declared on the registry relationship (ORGANIZATIONS → LEGAL_HOLDS).\n  });\n"]}
+{"version":3,"file":"legal-holds.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/legal-holds.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,6BAA6B,EAC7B,eAAe,EACf,eAAe,EACf,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAE7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpG,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAS9F,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CACtH,0CAA0C,CAIxC;IACA,UAAU,EAAE,eAAe;IAC3B,kBAAkB,EAAE,gBAAgB,CAAC,WAAW;IAChD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC;IACzF,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;;;OAUG;IACH,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,SAAS;KAClD;IAED;;;;;;;;OAQG;IACH,gBAAgB,EAAE;QAChB,cAAc,EAAE,kBAAkB,CAAC,UAAU;QAC7C,UAAU,EAAE,mBAAmB,CAAC,aAAa;QAC7C,gBAAgB,EAAE,YAAY;KAC/B;IAED,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,KAAK;QAC3B,kDAAkD;QAClD,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,+FAA+F;oBAC/F,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,gIAAgI;oBAChI,uCAAuC,EAAE,IAAI;iBAC9C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,+FAA+F;oBAC/F,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,gIAAgI;oBAChI,uCAAuC,EAAE,IAAI;iBAC9C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,+FAA+F;oBAC/F,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,gIAAgI;oBAChI,uCAAuC,EAAE,IAAI;iBAC9C;aACF;SACF;QAED;;;;WAIG;QACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,EAAE;oBACT,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED;;;;;;;WAOG;QACH,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,2BAA2B;oBACvC,qGAAqG;oBACrG,yGAAyG;oBACzG,4GAA4G;oBAC5G,4BAA4B,EAAE,IAAI;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,2BAA2B;oBACvC,qGAAqG;oBACrG,yGAAyG;oBACzG,gGAAgG;oBAChG,2FAA2F;oBAC3F,oEAAoE;oBACpE,mGAAmG;oBACnG,uCAAuC,EAAE,IAAI;oBAC7C,4GAA4G;oBAC5G,4BAA4B,EAAE,IAAI;iBACnC;aACF;SACF;QAED;;;;;WAKG;QACH,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE;YAC/B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,6BAA6B;oBACzC,yGAAyG;oBACzG,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM;2BACnF,aAAa,CAAC,aAAa,KAAK,sBAAsB,CAAC,YAAY;oBACxE,4GAA4G;oBAC5G,4BAA4B,EAAE,IAAI;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,6BAA6B;oBACzC,yGAAyG;oBACzG,mGAAmG;oBACnG,uCAAuC,EAAE,IAAI;oBAC7C,sGAAsG;oBACtG,sGAAsG;oBACtG,4DAA4D;oBAC5D,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM;oBACxF,4GAA4G;oBAC5G,4BAA4B,EAAE,IAAI;iBACnC;aACF;SACF;KACF;IACD,0GAA0G;CAC3G,CAAC,CAAC","sourcesContent":["/**\n * Legal holds — resource configuration (#1634).\n *\n * Two verbs and two tiers:\n *\n *   place   — the tenant's owner (default variant), or an application super-administrator crossing into the\n *             tenant through the declared door (`admin` variant, requires a usable platform access grant)\n *   release — the SAME tier that placed the hold, and only that tier (see {@link LegalHoldPlacementTier})\n *\n * No client can create, update or delete a hold any other way. The one DELETE is route-less and exists so\n * the retention-class sweep can dispose of a RELEASED hold once its `AUDIT_LOGS` period has passed.\n */\n\nimport {\n  LegalHoldPlacementTier,\n  LegalHoldPlaceRequestSchema,\n  LegalHoldReleaseRequestSchema,\n  LegalHoldSchema,\n  LegalHoldStatus,\n  LegalHolds_Operations,\n} from './legal-holds.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  type ResourceRelationship,\n} from '../../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../../security/authorizations/roles.shared.schemas';\nimport { DataRetentionClass, RetentionStartPoint } from './retention-schedule.shared.schemas';\n\ntype LegalHoldsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.COUNT\n  | CoreResourceOperation.DELETE;\n\n\nexport const legalHoldsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<\n    typeof LegalHolds_Operations,\n    LegalHoldsCoreOperations,\n    typeof LegalHoldSchema\n  >({\n    mainSchema: LegalHoldSchema,\n    resourceIdentifier: CoreResourceType.LEGAL_HOLDS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.LEGAL_HOLDS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n\n    /**\n     * No trusted door of any kind. Every deletion path reads the ACTIVE holds through the infrastructure\n     * tier (one indexed query), and every write is a custom verb. A system `create`/`update` would be a\n     * second, unaudited way to place or lift a preservation duty.\n     *\n     * `exportSubject: FORBIDDEN`: `placedByUserId`, `releasedByUserId` and `subjectUserId` put these rows on\n     * a user's access graph, and an included resource with no declaration refuses the whole export. A hold is\n     * the operator's litigation record; disclosing it to the person it concerns can prejudice the very claim\n     * it preserves, and it names the placer and the matter. Left OUT of the bundle and recorded, never\n     * silently dropped.\n     */\n    systemAccessPolicy: {\n      exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n    },\n\n    /**\n     * A released hold is kept as defence evidence for the `AUDIT_LOGS` period, counted from its release.\n     * An ACTIVE hold has no `releasedAt`, so it never expires — a hold that lapsed on its own would be the\n     * failure it exists to prevent. The organization edge disables the teardown cascade, so the record also\n     * outlives a purged tenant until its period ends.\n     *\n     * Deliberately NOT retention-governed (`retentionPolicy`): a scrubbed-and-hidden hold would be invisible\n     * to the infrastructure read every deletion path consults, which would lift the hold silently.\n     */\n    retentionBinding: {\n      retentionClass: DataRetentionClass.AUDIT_LOGS,\n      startPoint: RetentionStartPoint.CLOSURE_EVENT,\n      closureFieldName: 'releasedAt',\n    },\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.COUNT,\n      // Route-less, for the retention-class sweep only.\n      CoreResourceOperation.DELETE,\n    ],\n\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_OWNER],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n          {\n            // The same read an operator makes into a tenant, through the declared door and a usable grant.\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: false,\n            variantKey: 'admin',\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n            // assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — an operator reads a tenant's holds only through a usable grant.\n            admitsCrossTenantPlatformAdministration: true,\n          },\n        ],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_OWNER],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n          {\n            // The same read an operator makes into a tenant, through the declared door and a usable grant.\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: false,\n            variantKey: 'admin',\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n            // assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — an operator reads a tenant's holds only through a usable grant.\n            admitsCrossTenantPlatformAdministration: true,\n          },\n        ],\n      },\n      [CoreResourceOperation.COUNT]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_OWNER],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n          {\n            // The same read an operator makes into a tenant, through the declared door and a usable grant.\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: false,\n            variantKey: 'admin',\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n            // assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — an operator reads a tenant's holds only through a usable grant.\n            admitsCrossTenantPlatformAdministration: true,\n          },\n        ],\n      },\n\n      /**\n       * SWEEP ONLY — no client can delete a hold. `INTERNAL_CALL` registers no route; the retention-class\n       * sweep disposes of a released hold at the end of its period, and the delete chokepoint itself never\n       * holds a hold.\n       */\n      [CoreResourceOperation.DELETE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            roles: [],\n            riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          },\n        ],\n      },\n\n      /**\n       * Placing a hold suspends every deletion path for its scope until it is released.\n       *\n       * HIGH with step-up: a hold stops a tenant's retention schedule and its data subjects' erasures, and a\n       * hijacked session must not be able to do that on an old login.\n       *\n       * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — deletion suspended under a recorded legal hold.\n       */\n      [LegalHolds_Operations.PLACE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_OWNER],\n            riskLevel: ResourceOperationRiskLevel.HIGH,\n            resourceOperationLike: CoreResourceOperation.CREATE,\n            requestDto: LegalHoldPlaceRequestSchema,\n            // No `auditableEvent.reasonField`: the justification names the matter, and the generic operation row\n            // it would ride is exported to every SIEM route. The hold keeps it; LEGAL_HOLD_PLACED carries the scope.\n            // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-authentication before a high-impact action.\n            requiresStepUpAuthentication: true,\n          },\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: false,\n            variantKey: 'admin',\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.HIGH,\n            resourceOperationLike: CoreResourceOperation.CREATE,\n            requestDto: LegalHoldPlaceRequestSchema,\n            // No `auditableEvent.reasonField`: the justification names the matter, and the generic operation row\n            // it would ride is exported to every SIEM route. The hold keeps it; LEGAL_HOLD_PLACED carries the scope.\n            // Preservation is monotonic — it only ever stops a destruction — so crossing to place it passes\n            // the reversibility test (`administrative-continuity-floors.md`). Still never ambient: the\n            // admission requires a usable platform access grant for the tenant.\n            // assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — declared crossing, grant required.\n            admitsCrossTenantPlatformAdministration: true,\n            // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-authentication before a high-impact action.\n            requiresStepUpAuthentication: true,\n          },\n        ],\n      },\n\n      /**\n       * Releasing a hold lets the next sweep, purge or erasure proceed. Only an ACTIVE hold, and only by the\n       * tier that placed it — the enabled condition mirrors the server-side refusal in the paired implementation.\n       *\n       * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — deletion resumes only on a recorded release.\n       */\n      [LegalHolds_Operations.RELEASE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_OWNER],\n            riskLevel: ResourceOperationRiskLevel.HIGH,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: LegalHoldReleaseRequestSchema,\n            // No `auditableEvent.reasonField`, for the same reason as `place`: the release reason stays on the hold.\n            enabledCondition: ({ currentObject }) => currentObject.status === LegalHoldStatus.ACTIVE\n              && currentObject.placementTier === LegalHoldPlacementTier.ORGANIZATION,\n            // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-authentication before a high-impact action.\n            requiresStepUpAuthentication: true,\n          },\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: false,\n            variantKey: 'admin',\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.HIGH,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: LegalHoldReleaseRequestSchema,\n            // No `auditableEvent.reasonField`, for the same reason as `place`: the release reason stays on the hold.\n            // assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — declared crossing, grant required.\n            admitsCrossTenantPlatformAdministration: true,\n            // Any ACTIVE hold: the platform's own, or a tenant's own once that tenant is marked for deletion (its\n            // owners then hold no authority to release it). The tenant's status is not on the hold, so the server\n            // decides the second case and refuses a live tenant's hold.\n            enabledCondition: ({ currentObject }) => currentObject.status === LegalHoldStatus.ACTIVE,\n            // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-authentication before a high-impact action.\n            requiresStepUpAuthentication: true,\n          },\n        ],\n      },\n    },\n    // The ORGANIZATIONS primary scope is declared on the registry relationship (ORGANIZATIONS → LEGAL_HOLDS).\n  });\n"]}

package/dist/esm/compliance/privacy/legal-holds.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"legal-holds.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/legal-holds.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,+GAA+G;AAC/G;;;;;;;;;;GAUG;AACH,oBAAY,kBAAkB;IAC5B,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,YAAY,iBAAiB;CAC9B;AAED;;;;;;;GAOG;AACH,oBAAY,eAAe;IACzB,uFAAuF;IACvF,YAAY,iBAAiB;IAC7B,yFAAyF;IACzF,wBAAwB,6BAA6B;IACrD,+GAA+G;IAC/G,gBAAgB,qBAAqB;CACtC;AAED;;;;GAIG;AACH,oBAAY,eAAe;IACzB,MAAM,WAAW;IACjB,QAAQ,aAAa;CACtB;AAED;;;;;;;GAOG;AACH,oBAAY,sBAAsB;IAChC,0DAA0D;IAC1D,YAAY,iBAAiB;IAC7B,wGAAwG;IACxG,QAAQ,aAAa;CACtB;AAED;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,gHAAgH;IAChH,iBAAiB,sBAAsB;IACvC,sHAAsH;IACtH,6BAA6B,kCAAkC;CAChE;AAED,sFAAsF;AACtF,oBAAY,qBAAqB;IAC/B,KAAK,UAAU;IACf,OAAO,YAAY;CACpB;AAED,kIAAkI;AAClI,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;iBAmE1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,kHAAkH;AAClH,eAAO,MAAM,2BAA2B;;;;;;;iBAQtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,6DAA6D;AAE7D,eAAO,MAAM,6BAA6B;;iBAExC,CAAC;AAEH;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,EAAE,CAsBtF;AAED;;;;;;;GAOG;AACH,oBAAY,+BAA+B;IACzC,8EAA8E;IAC9E,WAAW,gBAAgB;IAC3B,yHAAyH;IACzH,WAAW,gBAAgB;IAC3B;;;;;OAKG;IACH,YAAY,iBAAiB;IAC7B,kIAAkI;IAClI,cAAc,mBAAmB;CAClC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAC;IAC/C,wGAAwG;IACxG,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAED,iDAAiD;AACjD,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,GAAG,gBAAgB,GAAG,WAAW,GAAG,cAAc,GAAG,QAAQ,GAAG,eAAe,GAAG,aAAa,CAAC,CAAC;AAEpJ,mDAAmD;AACnD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,qDAAqD;IACrD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED,kDAAkD;AAClD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC;CACvC;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,QAAQ,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,CAAC;IAC3C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAChD,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,2BAA2B,CAAC;IACzD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpD,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC,CAehC;AAwDD,uFAAuF;AACvF,MAAM,WAAW,gCAAgC;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,eAAe,EAAE,CAGxF"}
+{"version":3,"file":"legal-holds.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/legal-holds.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,+GAA+G;AAC/G;;;;;;;;;;GAUG;AACH,oBAAY,kBAAkB;IAC5B,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,YAAY,iBAAiB;CAC9B;AAED;;;;;;;GAOG;AACH,oBAAY,eAAe;IACzB,uFAAuF;IACvF,YAAY,iBAAiB;IAC7B,yFAAyF;IACzF,wBAAwB,6BAA6B;IACrD,+GAA+G;IAC/G,gBAAgB,qBAAqB;CACtC;AAED;;;;GAIG;AACH,oBAAY,eAAe;IACzB,MAAM,WAAW;IACjB,QAAQ,aAAa;CACtB;AAED;;;;;;;GAOG;AACH,oBAAY,sBAAsB;IAChC,0DAA0D;IAC1D,YAAY,iBAAiB;IAC7B,wGAAwG;IACxG,QAAQ,aAAa;CACtB;AAED;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,gHAAgH;IAChH,iBAAiB,sBAAsB;IACvC,sHAAsH;IACtH,6BAA6B,kCAAkC;CAChE;AAED,sFAAsF;AACtF,oBAAY,qBAAqB;IAC/B,KAAK,UAAU;IACf,OAAO,YAAY;CACpB;AAED,kIAAkI;AAClI,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;iBAmE1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,kHAAkH;AAClH,eAAO,MAAM,2BAA2B;;;;;;;iBAQtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,6DAA6D;AAE7D,eAAO,MAAM,6BAA6B;;iBAExC,CAAC;AAEH;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,EAAE,CAsBtF;AAED;;;;;;;GAOG;AACH,oBAAY,+BAA+B;IACzC,8EAA8E;IAC9E,WAAW,gBAAgB;IAC3B,yHAAyH;IACzH,WAAW,gBAAgB;IAC3B;;;;;OAKG;IACH,YAAY,iBAAiB;IAC7B,kIAAkI;IAClI,cAAc,mBAAmB;CAClC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAC;IAC/C,wGAAwG;IACxG,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAED,iDAAiD;AACjD,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,GAAG,gBAAgB,GAAG,WAAW,GAAG,cAAc,GAAG,QAAQ,GAAG,eAAe,GAAG,aAAa,CAAC,CAAC;AAEpJ,mDAAmD;AACnD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,qDAAqD;IACrD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED,kDAAkD;AAClD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC;CACvC;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,QAAQ,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,CAAC;IAC3C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAChD,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,2BAA2B,CAAC;IACzD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpD,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC,CAehC;AAwDD,uFAAuF;AACvF,MAAM,WAAW,gCAAgC;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,eAAe,EAAE,CAGxF"}

package/dist/esm/compliance/privacy/legal-holds.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"legal-holds.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/legal-holds.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAE/E,+GAA+G;AAC/G;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC5B,mDAA6B,CAAA;IAC7B,qDAA+B,CAAA;IAC/B,mDAA6B,CAAA;AAC/B,CAAC,EAJW,kBAAkB,KAAlB,kBAAkB,QAI7B;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,eAOX;AAPD,WAAY,eAAe;IACzB,uFAAuF;IACvF,gDAA6B,CAAA;IAC7B,yFAAyF;IACzF,wEAAqD,CAAA;IACrD,+GAA+G;IAC/G,wDAAqC,CAAA;AACvC,CAAC,EAPW,eAAe,KAAf,eAAe,QAO1B;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,eAGX;AAHD,WAAY,eAAe;IACzB,oCAAiB,CAAA;IACjB,wCAAqB,CAAA;AACvB,CAAC,EAHW,eAAe,KAAf,eAAe,QAG1B;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,sBAKX;AALD,WAAY,sBAAsB;IAChC,0DAA0D;IAC1D,uDAA6B,CAAA;IAC7B,wGAAwG;IACxG,+CAAqB,CAAA;AACvB,CAAC,EALW,sBAAsB,KAAtB,sBAAsB,QAKjC;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,kBAKX;AALD,WAAY,kBAAkB;IAC5B,gHAAgH;IAChH,6DAAuC,CAAA;IACvC,sHAAsH;IACtH,qFAA+D,CAAA;AACjE,CAAC,EALW,kBAAkB,KAAlB,kBAAkB,QAK7B;AAED,sFAAsF;AACtF,MAAM,CAAN,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,wCAAe,CAAA;IACf,4CAAmB,CAAA;AACrB,CAAC,EAHW,qBAAqB,KAArB,qBAAqB,QAGhC;AAED,kIAAkI;AAClI,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAE/C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,yFAAyF;IACzF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAErH,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;SAClC,UAAU,CAAC,oBAAoB,CAAC;SAChC,WAAW,EAAE;SACb,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IAEpB,oDAAoD;IACpD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEzF,yGAAyG;IACzG,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEnH,sEAAsE;IACtE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAE9G,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;SACjC,UAAU,CAAC,iBAAiB,CAAC;SAC7B,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IAEpB;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC;IAEhH,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;SAC1C,UAAU,CAAC,wBAAwB,CAAC;SACpC,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IAEpB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;SAC5B,UAAU,CAAC,iBAAiB,CAAC;SAC7B,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;SAC/B,WAAW,EAAE;SACb,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IAEpB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAC1G,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAE7F,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IACvH;;;;OAIG;IACH,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IACvG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC;IAExI,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAIH,kHAAkH;AAClH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,4FAA4F,CAAC;IAC5I,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kEAAkE,CAAC;IAChI,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,QAAQ,EAAE;SACjF,QAAQ,CAAC,2GAA2G,CAAC;IACxH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;IAC7G,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,iCAAiC,CAAC;IAChF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,iDAAiD,CAAC;CACvG,CAAC,CAAC;AAEH,6DAA6D;AAE7D,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,sCAAsC,CAAC;CAC5F,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAA8B;IAC1E,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,QAAQ,OAAO,CAAC,SAAS,EAAE,CAAC;QAC1B,KAAK,kBAAkB,CAAC,YAAY;YAClC,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBAC9G,QAAQ,CAAC,IAAI,CAAC,wGAAwG,CAAC,CAAC;YAC1H,CAAC;YACD,MAAM;QACR,KAAK,kBAAkB,CAAC,aAAa;YACnC,IAAI,CAAC,OAAO,CAAC,YAAY;gBAAE,QAAQ,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;YAClG,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS;gBAAE,QAAQ,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;YACvG,MAAM;QACR,KAAK,kBAAkB,CAAC,YAAY;YAClC,IAAI,CAAC,OAAO,CAAC,aAAa;gBAAE,QAAQ,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;YAC9G,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;gBAAE,QAAQ,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;YAC9I,MAAM;QACR,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,WAAW,GAAU,OAAO,CAAC,SAAS,CAAC;YAC7C,QAAQ,CAAC,IAAI,CAAC,kCAAkC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,+BAcX;AAdD,WAAY,+BAA+B;IACzC,8EAA8E;IAC9E,8DAA2B,CAAA;IAC3B,yHAAyH;IACzH,8DAA2B,CAAA;IAC3B;;;;;OAKG;IACH,gEAA6B,CAAA;IAC7B,kIAAkI;IAClI,oEAAiC,CAAA;AACnC,CAAC,EAdW,+BAA+B,KAA/B,+BAA+B,QAc1C;AA2BD;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAOrC;IACC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA4B,CAAC;IACjD,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,iBAAiB,GAAG,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,yBAAyB;YAC9E,CAAC,CAAC,SAAS,CAAC,EAAE;YACd,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,SAAS,EAAE,iBAAiB,EAAE,KAAK,CAAC;gBAAE,SAAS;YAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC7F,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAqB,EACrB,SAAgC,EAChC,iBAAqC,EACrC,KAAkD;IAElD,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QACvB,KAAK,kBAAkB,CAAC,YAAY;YAClC,OAAO,iBAAiB,KAAK,IAAI,CAAC,cAAc,CAAC;QACnD,KAAK,kBAAkB,CAAC,aAAa;YACnC,OAAO,iBAAiB,KAAK,IAAI,CAAC,cAAc;mBAC3C,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;mBACxC,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,KAAK,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC;YACrC,sGAAsG;YACtG,2GAA2G;YAC3G,IAAI,iBAAiB,KAAK,SAAS,IAAI,iBAAiB,KAAK,IAAI,CAAC,cAAc;gBAAE,OAAO,KAAK,CAAC;YAC/F,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC;YACnC,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC,CAAC,+BAA+B;YAC1D,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,CAAC;YAC7C,IAAI,WAAW,CAAC,IAAI,KAAK,+BAA+B,CAAC,cAAc;gBAAE,OAAO,KAAK,CAAC;YACtF,IAAI,KAAK,CAAC,qBAAqB,EAAE,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChE,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;gBACzB,KAAK,+BAA+B,CAAC,WAAW;oBAC9C,OAAO,SAAS,CAAC,EAAE,KAAK,OAAO,CAAC;gBAClC,KAAK,+BAA+B,CAAC,WAAW;oBAC9C,OAAO,CAAC,WAAW,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC;gBAChH,KAAK,+BAA+B,CAAC,YAAY,CAAC,CAAC,CAAC;oBAClD,6EAA6E;oBAC7E,IAAI,CAAC,WAAW,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC;wBAAE,OAAO,IAAI,CAAC;oBACxH,0GAA0G;oBAC1G,qGAAqG;oBACrG,IAAI,KAAK,CAAC,qBAAqB,KAAK,SAAS;wBAAE,OAAO,KAAK,CAAC;oBAC5D,+GAA+G;oBAC/G,kEAAkE;oBAClE,IAAI,iBAAiB,KAAK,SAAS;wBAAE,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC;oBAC5F,gHAAgH;oBAChH,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,OAAO,CAAC,CAAC,CAAC;oBACR,MAAM,WAAW,GAAU,WAAW,CAAC,IAAI,CAAC;oBAC5C,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,2DAA2D;YAC3D,MAAM,WAAW,GAAU,IAAI,CAAC,SAAS,CAAC;YAC1C,KAAK,WAAW,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAWD;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAkC;IACnE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAChF,CAAC","sourcesContent":["/**\n * Legal holds — a recorded decision that suspends DELETION of a defined scope until it is released (#1634).\n *\n * ## Why it exists\n *\n * Once data is deleted on a schedule (#1613's retention-class sweep), a firm under litigation, a\n * regulator's investigation or a client dispute must be able to stop that for a defined scope, and\n * keep proof that it did. A hold is that stop. It is a decision about a CASE, which is why it is not a\n * retention class: a statutory period is a property of a class of data (#1635); a hold names a scope\n * and a ground, and ends only when somebody releases it.\n *\n * ## What a hold suspends\n *\n * Every door that destroys data consults ONE predicate before destroying anything\n * ({@link matchLegalHoldsToRows}, evaluated over the active holds the backend reads in one query):\n *\n * | door | what a held row gets |\n * |---|---|\n * | the retention-class sweep | skipped and counted, never thrown |\n * | a subject erasure | left exactly as it is (neither deleted nor scrubbed), reported per row |\n * | the tenant purge | the whole tenant is skipped while ANY hold on it is active |\n * | a DELETE / DELETE_MANY, and an `onParentDelete` cascade | refused, 409 {@link LegalHoldErrorCode.LEGAL_HOLD_ACTIVE} |\n * | file bytes in object storage | not hard-deleted while the owning row is held |\n * | RAG chunk removal | chunks of a held row are kept |\n *\n * Impersonalization counts as destruction: a scrub removes exactly what a hold exists to preserve.\n *\n * ## What it does NOT do\n *\n * It does not restrict PROCESSING (reads, updates). A hold is a preservation duty, and a row that must\n * be preserved may still be corrected; restricting processing of kept data is #1635's statutory\n * restriction, a different obligation with a different trigger.\n *\n * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — deletion suspended under a recorded legal hold.\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from './personal-data-category.shared.schemas';\n\n/** @wildo_source:part:start saas.models.privacy.legal-holds facet:layer:shared facet:audience:app-developer */\n/**\n * WHAT a hold covers.\n *\n * - `ORGANIZATION` — every row the tenant owns, and the tenant itself (it is not purged).\n * - `RESOURCE_ROWS` — the rows of ONE resource type in the tenant: the listed `rowIds`, or every row of\n *   that type when none are listed. An explicit id list, not a query: a hold is evidence, and \"which rows\n *   were held\" must be answerable from the hold alone, without re-running a filter against data that\n *   has since changed.\n * - `DATA_SUBJECT` — every row the subject-export graph attributes to one user. What a claim concerning\n *   ONE person needs. See {@link LegalHoldSubjectAttributionKind} for how a row is attributed.\n */\nexport enum LegalHoldScopeKind {\n  ORGANIZATION = 'organization',\n  RESOURCE_ROWS = 'resource_rows',\n  DATA_SUBJECT = 'data_subject',\n}\n\n/**\n * WHY the data is held. Travels into every refusal and erasure report, because the ground is what a\n * data subject is owed when their erasure is not completed.\n *\n * GDPR Art. 17(3)(e) (establishment, exercise or defence of legal claims) and Art. 17(3)(b) (compliance\n * with a legal obligation) are the grounds under which a hold may also block an erasure.\n * spec-cite: Regulation (EU) 2016/679, Art. 17(3)(b) and (e). Not legal advice.\n */\nexport enum LegalHoldGround {\n  /** Litigation, a dispute or a claim that is reasonably anticipated — Art. 17(3)(e). */\n  LEGAL_CLAIMS = 'legal_claims',\n  /** A regulator's or authority's investigation that requires the data to be preserved. */\n  REGULATORY_INVESTIGATION = 'regulatory_investigation',\n  /** A legal obligation to keep the data, other than a statutory retention period of a class — Art. 17(3)(b). */\n  LEGAL_OBLIGATION = 'legal_obligation',\n}\n\n/**\n * A hold's lifecycle. Two states and one direction: a released hold is kept as evidence and never\n * reactivated — a new hold is a new row. There is no expiry state, deliberately: litigation ends by\n * decision, not by clock, and a hold that lapses on its own is exactly the failure it exists to prevent.\n */\nexport enum LegalHoldStatus {\n  ACTIVE = 'active',\n  RELEASED = 'released',\n}\n\n/**\n * WHO placed the hold, and therefore who may release it.\n *\n * A hold is released by the tier that placed it, and only by that tier. A tenant must not be able to\n * lift a preservation duty the operator placed on it (an investigation OF the tenant), and the operator\n * must not lift a tenant's own litigation hold on the tenant's behalf. Both tiers SEE every hold on the\n * tenant: the tenant is owed knowing why its data is not being deleted.\n */\nexport enum LegalHoldPlacementTier {\n  /** Placed by the tenant's own owner, for its own data. */\n  ORGANIZATION = 'organization',\n  /** Placed by an application super-administrator, crossing into the tenant through the declared door. */\n  PLATFORM = 'platform',\n}\n\n/**\n * Client-branchable codes carried as `context.code` on a refusal (allow-listed by the error sanitizer).\n */\nexport enum LegalHoldErrorCode {\n  /** A row the delete addresses is under an active legal hold. The caller is authorized; the state forbids it. */\n  LEGAL_HOLD_ACTIVE = 'legal_hold_active',\n  /** The active holds could not be read, so whether the rows are held is unknown. Deletion is refused (fail closed). */\n  LEGAL_HOLD_STATE_UNVERIFIABLE = 'legal_hold_state_unverifiable',\n}\n\n/** The custom verbs. No generic CREATE / UPDATE / DELETE is exposed to any client. */\nexport enum LegalHolds_Operations {\n  PLACE = 'place',\n  RELEASE = 'release',\n}\n\n/** The largest explicit row list one `RESOURCE_ROWS` hold may name. A larger set is several holds, or the whole resource type. */\nexport const LEGAL_HOLD_MAXIMUM_ROW_IDS = 1000;\n\nexport const LegalHoldSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /** The held tenant. The primary scope anchor: the tenant sees every hold on its data. */\n  organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate().isAuditEvidence(),\n\n  scopeKind: z.enum(LegalHoldScopeKind)\n    .systemEnum('LegalHoldScopeKind')\n    .isDBIndexed()\n    .isSummaryField()\n    .excludeFromUpdate()\n    .isAuditEvidence(),\n\n  /** `RESOURCE_ROWS` only: the held resource type. */\n  resourceType: z.string().min(1).max(200).optional().excludeFromUpdate().isAuditEvidence(),\n\n  /** `RESOURCE_ROWS` only: the held rows. Absent means every row of {@link resourceType} in the tenant. */\n  rowIds: z.array(z.string().min(1)).max(LEGAL_HOLD_MAXIMUM_ROW_IDS).optional().excludeFromUpdate().isAuditEvidence(),\n\n  /** `DATA_SUBJECT` only: the person whose attributed rows are held. */\n  subjectUserId: z.string().min(1).optional().isDBIndexed().isForeignKey().excludeFromUpdate().isAuditEvidence(),\n\n  legalGround: z.enum(LegalHoldGround)\n    .systemEnum('LegalHoldGround')\n    .isSummaryField()\n    .excludeFromUpdate()\n    .isAuditEvidence(),\n\n  /**\n   * Why, in the placer's words: the matter, the case reference. REQUIRED.\n   *\n   * Not scrubbed on erasure, and that is a decision: a hold is the operator's defence evidence\n   * (Art. 17(3)(e)), and the matter it names is what the hold preserves. Not exported to SIEM by default\n   * either — free text is the surface most likely to name a third party.\n   */\n  justification: z.string().min(1).max(2000).excludeFromUpdate().dataCategories(PersonalDataCategory.USER_CONTENT),\n\n  placementTier: z.enum(LegalHoldPlacementTier)\n    .systemEnum('LegalHoldPlacementTier')\n    .isSummaryField()\n    .excludeFromCreate()\n    .excludeFromUpdate()\n    .isAuditEvidence(),\n\n  status: z.enum(LegalHoldStatus)\n    .systemEnum('LegalHoldStatus')\n    .default(LegalHoldStatus.ACTIVE)\n    .isDBIndexed()\n    .isSummaryField()\n    .excludeFromCreate()\n    .excludeFromUpdate()\n    .isAuditEvidence(),\n\n  placedByUserId: z.string().min(1).isForeignKey().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  placedAt: z.date().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n\n  releasedByUserId: z.string().min(1).optional().isForeignKey().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  /**\n   * The retention clock's closure field: a released hold is kept as `AUDIT_LOGS`-class evidence from this\n   * instant. Null while ACTIVE, so an active hold never expires. Server-owned — a caller-writable clock\n   * would be a caller-ordered delete of the evidence.\n   */\n  releasedAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  releaseReason: z.string().max(2000).optional().excludeFromCreate().excludeFromUpdate().dataCategories(PersonalDataCategory.USER_CONTENT),\n\n  createdAt: z.date().optional(),\n  updatedAt: z.date().optional(),\n});\n\nexport type LegalHold = z.infer<typeof LegalHoldSchema>;\n\n/** The `place` request. Coherence between `scopeKind` and the three optional selectors is checked server-side. */\nexport const LegalHoldPlaceRequestSchema = z.object({\n  scopeKind: z.enum(LegalHoldScopeKind).describe('What the hold covers: the whole organization, rows of one resource, or one person\\'s data.'),\n  resourceType: z.string().min(1).max(200).optional().describe('For a resource-rows hold: the resource type whose rows are held.'),\n  rowIds: z.array(z.string().min(1)).min(1).max(LEGAL_HOLD_MAXIMUM_ROW_IDS).optional()\n    .describe('For a resource-rows hold: the rows held. Omit to hold every row of the resource type in the organization.'),\n  subjectUserId: z.string().min(1).optional().describe('For a data-subject hold: the user whose data is held.'),\n  legalGround: z.enum(LegalHoldGround).describe('Why the data must be preserved.'),\n  justification: z.string().min(1).max(2000).describe('The matter or case the hold preserves data for.'),\n});\nexport type LegalHoldPlaceRequest = z.infer<typeof LegalHoldPlaceRequestSchema>;\n/** @wildo_source:part:end saas.models.privacy.legal-holds */\n\nexport const LegalHoldReleaseRequestSchema = z.object({\n  releaseReason: z.string().min(1).max(2000).describe('Why the preservation duty has ended.'),\n});\n\n/**\n * The scope-coherence rule for a `place` request, as one pure function the server and any client share.\n * Returns the problems; empty means coherent.\n */\nexport function validateLegalHoldPlaceRequest(request: LegalHoldPlaceRequest): string[] {\n  const problems: string[] = [];\n  switch (request.scopeKind) {\n    case LegalHoldScopeKind.ORGANIZATION:\n      if (request.resourceType !== undefined || request.rowIds !== undefined || request.subjectUserId !== undefined) {\n        problems.push('An organization hold covers the whole organization and takes no resourceType, rowIds or subjectUserId.');\n      }\n      break;\n    case LegalHoldScopeKind.RESOURCE_ROWS:\n      if (!request.resourceType) problems.push('A resource-rows hold names the resourceType it holds.');\n      if (request.subjectUserId !== undefined) problems.push('A resource-rows hold takes no subjectUserId.');\n      break;\n    case LegalHoldScopeKind.DATA_SUBJECT:\n      if (!request.subjectUserId) problems.push('A data-subject hold names the subjectUserId whose data it holds.');\n      if (request.resourceType !== undefined || request.rowIds !== undefined) problems.push('A data-subject hold takes no resourceType or rowIds.');\n      break;\n    default: {\n      const unknownKind: never = request.scopeKind;\n      problems.push(`Unknown legal hold scope kind '${String(unknownKind)}'.`);\n    }\n  }\n  return problems;\n}\n\n/**\n * How ONE resource type's rows are attributed to a data subject, for `DATA_SUBJECT` holds.\n *\n * Derived from the subject-export graph of `USERS` (Art. 15 access purpose), so \"the rows a hold on a\n * person covers\" and \"the rows an access request about that person discloses\" are the same set by\n * construction. Where a row cannot be attributed from its own fields, the answer is UNRESOLVABLE and the\n * row is HELD: over-preserving delays a deletion until release, under-preserving destroys evidence.\n */\nexport enum LegalHoldSubjectAttributionKind {\n  /** The row IS the person (`USERS`): attributed when its id is the subject. */\n  SUBJECT_ROW = 'subject_row',\n  /** The row carries a foreign key to `USERS` on an export edge: attributed when any of those fields names the subject. */\n  FOREIGN_KEY = 'foreign_key',\n  /**\n   * The resource is in the subject's export graph, but a row's attribution needs other rows (an owned\n   * descendant, or a key held on the `USERS` side). Any foreign-key field it carries still attributes it; beyond\n   * that, a row in the held tenant is held (conservative), a row outside any tenant is the person's only when its\n   * `userId` names them, and inside ANOTHER person's erasure it is that person's, not the held subject's.\n   */\n  UNRESOLVABLE = 'unresolvable',\n  /** Not in the subject's export graph (unrelated, or declared `exportSubject: FORBIDDEN`). A data-subject hold never covers it. */\n  NOT_ATTRIBUTED = 'not_attributed',\n}\n\nexport interface LegalHoldSubjectAttribution {\n  readonly kind: LegalHoldSubjectAttributionKind;\n  /** The row fields naming a user — the whole answer for FOREIGN_KEY, a first answer for UNRESOLVABLE. */\n  readonly foreignKeyFields?: readonly string[];\n}\n\n/** An active hold, as the predicate needs it. */\nexport type ActiveLegalHold = Pick<LegalHold, '_id' | 'organizationId' | 'scopeKind' | 'resourceType' | 'rowIds' | 'subjectUserId' | 'legalGround'>;\n\n/** One row a deletion path is about to destroy. */\nexport interface LegalHoldCandidateRow {\n  readonly id: string;\n  /** The tenant the row belongs to; absent for a row with no organization scope. */\n  readonly organizationId?: string;\n  /** The row's fields, for foreign-key attribution. */\n  readonly row?: Record<string, unknown>;\n}\n\n/** Why a row is held: the hold and its ground. */\nexport interface LegalHoldMatch {\n  readonly holdId: string;\n  readonly scopeKind: LegalHoldScopeKind;\n  readonly legalGround: LegalHoldGround;\n}\n\n/**\n * THE hold predicate — which of `rows` are under which of `holds`. Pure; the backend reads the active\n * holds once per call and hands them in.\n *\n * `erasureSubjectUserIds` is set only by a subject erasure: every row that erasure reaches in a resource\n * of the subject's export graph IS attributed to the person being erased, so a `DATA_SUBJECT` hold on that\n * person covers it whatever its own fields say.\n *\n * The ORGANIZATIONS row's tenant is its own id, so an `ORGANIZATION` hold also holds the tenant row.\n */\nexport function matchLegalHoldsToRows(input: {\n  readonly holds: readonly ActiveLegalHold[];\n  readonly resourceType: string;\n  readonly rows: readonly LegalHoldCandidateRow[];\n  readonly organizationsResourceType: string;\n  readonly subjectAttribution: LegalHoldSubjectAttribution;\n  readonly erasureSubjectUserIds?: readonly string[];\n}): Map<string, LegalHoldMatch[]> {\n  const held = new Map<string, LegalHoldMatch[]>();\n  if (input.holds.length === 0) return held;\n  for (const candidate of input.rows) {\n    const rowOrganizationId = input.resourceType === input.organizationsResourceType\n      ? candidate.id\n      : candidate.organizationId;\n    for (const hold of input.holds) {\n      if (!legalHoldCoversRow(hold, candidate, rowOrganizationId, input)) continue;\n      const matches = held.get(candidate.id) ?? [];\n      matches.push({ holdId: hold._id, scopeKind: hold.scopeKind, legalGround: hold.legalGround });\n      held.set(candidate.id, matches);\n    }\n  }\n  return held;\n}\n\nfunction legalHoldCoversRow(\n  hold: ActiveLegalHold,\n  candidate: LegalHoldCandidateRow,\n  rowOrganizationId: string | undefined,\n  input: Parameters<typeof matchLegalHoldsToRows>[0],\n): boolean {\n  switch (hold.scopeKind) {\n    case LegalHoldScopeKind.ORGANIZATION:\n      return rowOrganizationId === hold.organizationId;\n    case LegalHoldScopeKind.RESOURCE_ROWS:\n      return rowOrganizationId === hold.organizationId\n        && hold.resourceType === input.resourceType\n        && (hold.rowIds === undefined || hold.rowIds.includes(candidate.id));\n    case LegalHoldScopeKind.DATA_SUBJECT: {\n      // A person's rows outside any tenant (their user-scoped profile, preferences) are theirs wherever the\n      // claim arises, so a hold placed in one tenant covers them too. Rows of ANOTHER tenant are not this one's.\n      if (rowOrganizationId !== undefined && rowOrganizationId !== hold.organizationId) return false;\n      const subject = hold.subjectUserId;\n      if (!subject) return true; // incoherent hold: fail closed\n      const attribution = input.subjectAttribution;\n      if (attribution.kind === LegalHoldSubjectAttributionKind.NOT_ATTRIBUTED) return false;\n      if (input.erasureSubjectUserIds?.includes(subject)) return true;\n      switch (attribution.kind) {\n        case LegalHoldSubjectAttributionKind.SUBJECT_ROW:\n          return candidate.id === subject;\n        case LegalHoldSubjectAttributionKind.FOREIGN_KEY:\n          return (attribution.foreignKeyFields ?? []).some((field) => String(candidate.row?.[field] ?? '') === subject);\n        case LegalHoldSubjectAttributionKind.UNRESOLVABLE: {\n          // A foreign key on the row itself still names the person, when there is one.\n          if ((attribution.foreignKeyFields ?? []).some((field) => String(candidate.row?.[field] ?? '') === subject)) return true;\n          // Inside the erasure of SOMEONE ELSE, the walk has already attributed the row: it is the erased person's,\n          // not this subject's. Holding it would refuse their erasure on a ground belonging to another matter.\n          if (input.erasureSubjectUserIds !== undefined) return false;\n          // Outside any tenant, a row's owner is its `userId` (a USER_SELF row's primary scope), so a hold on one person\n          // never reaches every other person's rows across the application.\n          if (rowOrganizationId === undefined) return String(candidate.row?.userId ?? '') === subject;\n          // Inside the held tenant, the row's owner cannot be read from its own fields: held, the conservative direction.\n          return true;\n        }\n        default: {\n          const unknownKind: never = attribution.kind;\n          throw new Error(`Unknown legal hold subject attribution '${String(unknownKind)}'`);\n        }\n      }\n    }\n    default: {\n      // An unknown scope is not a reason to delete: fail closed.\n      const unknownKind: never = hold.scopeKind;\n      void unknownKind;\n      return true;\n    }\n  }\n}\n\n/** One row a subject erasure left untouched because a legal hold covers it (#1634). */\nexport interface SubjectErasureLegalHoldRetention {\n  resourceType: string;\n  rowId: string;\n  /** The grounds of every hold covering the row — what the data subject is told. */\n  legalGrounds: LegalHoldGround[];\n  holdIds: string[];\n}\n\n/**\n * The grounds of a set of matches, de-duplicated in vocabulary order — what a refusal or a report shows.\n */\nexport function legalHoldGroundsOf(matches: readonly LegalHoldMatch[]): LegalHoldGround[] {\n  const present = new Set(matches.map((match) => match.legalGround));\n  return Object.values(LegalHoldGround).filter((ground) => present.has(ground));\n}\n"]}
+{"version":3,"file":"legal-holds.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/legal-holds.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAE/E,+GAA+G;AAC/G;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC5B,mDAA6B,CAAA;IAC7B,qDAA+B,CAAA;IAC/B,mDAA6B,CAAA;AAC/B,CAAC,EAJW,kBAAkB,KAAlB,kBAAkB,QAI7B;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,eAOX;AAPD,WAAY,eAAe;IACzB,uFAAuF;IACvF,gDAA6B,CAAA;IAC7B,yFAAyF;IACzF,wEAAqD,CAAA;IACrD,+GAA+G;IAC/G,wDAAqC,CAAA;AACvC,CAAC,EAPW,eAAe,KAAf,eAAe,QAO1B;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,eAGX;AAHD,WAAY,eAAe;IACzB,oCAAiB,CAAA;IACjB,wCAAqB,CAAA;AACvB,CAAC,EAHW,eAAe,KAAf,eAAe,QAG1B;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,sBAKX;AALD,WAAY,sBAAsB;IAChC,0DAA0D;IAC1D,uDAA6B,CAAA;IAC7B,wGAAwG;IACxG,+CAAqB,CAAA;AACvB,CAAC,EALW,sBAAsB,KAAtB,sBAAsB,QAKjC;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,kBAKX;AALD,WAAY,kBAAkB;IAC5B,gHAAgH;IAChH,6DAAuC,CAAA;IACvC,sHAAsH;IACtH,qFAA+D,CAAA;AACjE,CAAC,EALW,kBAAkB,KAAlB,kBAAkB,QAK7B;AAED,sFAAsF;AACtF,MAAM,CAAN,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,wCAAe,CAAA;IACf,4CAAmB,CAAA;AACrB,CAAC,EAHW,qBAAqB,KAArB,qBAAqB,QAGhC;AAED,kIAAkI;AAClI,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAE/C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,yFAAyF;IACzF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAErH,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;SAClC,UAAU,CAAC,oBAAoB,CAAC;SAChC,WAAW,EAAE;SACb,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IAEpB,oDAAoD;IACpD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEzF,yGAAyG;IACzG,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEnH,sEAAsE;IACtE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAE9G,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;SACjC,UAAU,CAAC,iBAAiB,CAAC;SAC7B,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IAEpB;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC;IAEhH,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;SAC1C,UAAU,CAAC,wBAAwB,CAAC;SACpC,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IAEpB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;SAC5B,UAAU,CAAC,iBAAiB,CAAC;SAC7B,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;SAC/B,WAAW,EAAE;SACb,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IAEpB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAC1G,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAE7F,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IACvH;;;;OAIG;IACH,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IACvG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC;IAExI,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAIH,kHAAkH;AAClH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,4FAA4F,CAAC;IAC5I,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kEAAkE,CAAC;IAChI,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,QAAQ,EAAE;SACjF,QAAQ,CAAC,2GAA2G,CAAC;IACxH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;IAC7G,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,iCAAiC,CAAC;IAChF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,iDAAiD,CAAC;CACvG,CAAC,CAAC;AAEH,6DAA6D;AAE7D,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,sCAAsC,CAAC;CAC5F,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAA8B;IAC1E,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,QAAQ,OAAO,CAAC,SAAS,EAAE,CAAC;QAC1B,KAAK,kBAAkB,CAAC,YAAY;YAClC,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBAC9G,QAAQ,CAAC,IAAI,CAAC,wGAAwG,CAAC,CAAC;YAC1H,CAAC;YACD,MAAM;QACR,KAAK,kBAAkB,CAAC,aAAa;YACnC,IAAI,CAAC,OAAO,CAAC,YAAY;gBAAE,QAAQ,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;YAClG,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS;gBAAE,QAAQ,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;YACvG,MAAM;QACR,KAAK,kBAAkB,CAAC,YAAY;YAClC,IAAI,CAAC,OAAO,CAAC,aAAa;gBAAE,QAAQ,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;YAC9G,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;gBAAE,QAAQ,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;YAC9I,MAAM;QACR,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,WAAW,GAAU,OAAO,CAAC,SAAS,CAAC;YAC7C,QAAQ,CAAC,IAAI,CAAC,kCAAkC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,+BAcX;AAdD,WAAY,+BAA+B;IACzC,8EAA8E;IAC9E,8DAA2B,CAAA;IAC3B,yHAAyH;IACzH,8DAA2B,CAAA;IAC3B;;;;;OAKG;IACH,gEAA6B,CAAA;IAC7B,kIAAkI;IAClI,oEAAiC,CAAA;AACnC,CAAC,EAdW,+BAA+B,KAA/B,+BAA+B,QAc1C;AA2BD;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAOrC;IACC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA4B,CAAC;IACjD,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,iBAAiB,GAAG,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,yBAAyB;YAC9E,CAAC,CAAC,SAAS,CAAC,EAAE;YACd,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,SAAS,EAAE,iBAAiB,EAAE,KAAK,CAAC;gBAAE,SAAS;YAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC7F,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAqB,EACrB,SAAgC,EAChC,iBAAqC,EACrC,KAAkD;IAElD,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QACvB,KAAK,kBAAkB,CAAC,YAAY;YAClC,OAAO,iBAAiB,KAAK,IAAI,CAAC,cAAc,CAAC;QACnD,KAAK,kBAAkB,CAAC,aAAa;YACnC,OAAO,iBAAiB,KAAK,IAAI,CAAC,cAAc;mBAC3C,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;mBACxC,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,KAAK,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC;YACrC,sGAAsG;YACtG,2GAA2G;YAC3G,IAAI,iBAAiB,KAAK,SAAS,IAAI,iBAAiB,KAAK,IAAI,CAAC,cAAc;gBAAE,OAAO,KAAK,CAAC;YAC/F,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC;YACnC,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC,CAAC,+BAA+B;YAC1D,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,CAAC;YAC7C,IAAI,WAAW,CAAC,IAAI,KAAK,+BAA+B,CAAC,cAAc;gBAAE,OAAO,KAAK,CAAC;YACtF,IAAI,KAAK,CAAC,qBAAqB,EAAE,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChE,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;gBACzB,KAAK,+BAA+B,CAAC,WAAW;oBAC9C,OAAO,SAAS,CAAC,EAAE,KAAK,OAAO,CAAC;gBAClC,KAAK,+BAA+B,CAAC,WAAW;oBAC9C,OAAO,CAAC,WAAW,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC;gBAChH,KAAK,+BAA+B,CAAC,YAAY,CAAC,CAAC,CAAC;oBAClD,6EAA6E;oBAC7E,IAAI,CAAC,WAAW,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC;wBAAE,OAAO,IAAI,CAAC;oBACxH,0GAA0G;oBAC1G,qGAAqG;oBACrG,IAAI,KAAK,CAAC,qBAAqB,KAAK,SAAS;wBAAE,OAAO,KAAK,CAAC;oBAC5D,+GAA+G;oBAC/G,kEAAkE;oBAClE,IAAI,iBAAiB,KAAK,SAAS;wBAAE,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC;oBAC5F,gHAAgH;oBAChH,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,OAAO,CAAC,CAAC,CAAC;oBACR,MAAM,WAAW,GAAU,WAAW,CAAC,IAAI,CAAC;oBAC5C,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,2DAA2D;YAC3D,MAAM,WAAW,GAAU,IAAI,CAAC,SAAS,CAAC;YAC1C,KAAK,WAAW,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAWD;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAkC;IACnE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAChF,CAAC","sourcesContent":["/**\n * Legal holds — a recorded decision that suspends DELETION of a defined scope until it is released (#1634).\n *\n * ## Why it exists\n *\n * Once data is deleted on a schedule (#1613's retention-class sweep), a firm under litigation, a\n * regulator's investigation or a client dispute must be able to stop that for a defined scope, and\n * keep proof that it did. A hold is that stop. It is a decision about a CASE, which is why it is not a\n * retention class: a statutory period is a property of a class of data (#1635); a hold names a scope\n * and a ground, and ends only when somebody releases it.\n *\n * ## What a hold suspends\n *\n * Every door that destroys data consults ONE predicate before destroying anything\n * ({@link matchLegalHoldsToRows}, evaluated over the active holds the backend reads in one query):\n *\n * | door | what a held row gets |\n * |---|---|\n * | the retention-class sweep | skipped and counted, never thrown |\n * | a subject erasure | left exactly as it is (neither deleted nor scrubbed), reported per row |\n * | the tenant purge | the whole tenant is skipped while ANY hold on it is active |\n * | a DELETE / DELETE_MANY, and an `onParentDelete` cascade | refused, 409 {@link LegalHoldErrorCode.LEGAL_HOLD_ACTIVE} |\n * | file bytes in object storage | not hard-deleted while the owning row is held |\n * | RAG chunk removal | chunks of a held row are kept |\n *\n * Impersonalization counts as destruction: a scrub removes exactly what a hold exists to preserve.\n *\n * ## What it does NOT do\n *\n * It does not restrict PROCESSING (reads, updates). A hold is a preservation duty, and a row that must\n * be preserved may still be corrected; restricting processing of kept data is #1635's statutory\n * restriction, a different obligation with a different trigger.\n *\n * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — deletion suspended under a recorded legal hold.\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from './personal-data-category.shared.schemas';\n\n/** @wildo_source:part:start saas.models.privacy.legal-holds facet:layer:shared facet:audience:app-developer */\n/**\n * WHAT a hold covers.\n *\n * - `ORGANIZATION` — every row the tenant owns, and the tenant itself (it is not purged).\n * - `RESOURCE_ROWS` — the rows of ONE resource type in the tenant: the listed `rowIds`, or every row of\n *   that type when none are listed. An explicit id list, not a query: a hold is evidence, and \"which rows\n *   were held\" must be answerable from the hold alone, without re-running a filter against data that\n *   has since changed.\n * - `DATA_SUBJECT` — every row the subject-export graph attributes to one user. What a claim concerning\n *   ONE person needs. See {@link LegalHoldSubjectAttributionKind} for how a row is attributed.\n */\nexport enum LegalHoldScopeKind {\n  ORGANIZATION = 'organization',\n  RESOURCE_ROWS = 'resource_rows',\n  DATA_SUBJECT = 'data_subject',\n}\n\n/**\n * WHY the data is held. Travels into every refusal and erasure report, because the ground is what a\n * data subject is owed when their erasure is not completed.\n *\n * GDPR Art. 17(3)(e) (establishment, exercise or defence of legal claims) and Art. 17(3)(b) (compliance\n * with a legal obligation) are the grounds under which a hold may also block an erasure.\n * spec-cite: Regulation (EU) 2016/679, Art. 17(3)(b) and (e). Not legal advice.\n */\nexport enum LegalHoldGround {\n  /** Litigation, a dispute or a claim that is reasonably anticipated — Art. 17(3)(e). */\n  LEGAL_CLAIMS = 'legal_claims',\n  /** A regulator's or authority's investigation that requires the data to be preserved. */\n  REGULATORY_INVESTIGATION = 'regulatory_investigation',\n  /** A legal obligation to keep the data, other than a statutory retention period of a class — Art. 17(3)(b). */\n  LEGAL_OBLIGATION = 'legal_obligation',\n}\n\n/**\n * A hold's lifecycle. Two states and one direction: a released hold is kept as evidence and never\n * reactivated — a new hold is a new row. There is no expiry state, deliberately: litigation ends by\n * decision, not by clock, and a hold that lapses on its own is exactly the failure it exists to prevent.\n */\nexport enum LegalHoldStatus {\n  ACTIVE = 'active',\n  RELEASED = 'released',\n}\n\n/**\n * WHO placed the hold, and therefore who may release it.\n *\n * A hold is released by the tier that placed it, and only by that tier. A tenant must not be able to\n * lift a preservation duty the operator placed on it (an investigation OF the tenant), and the operator\n * must not lift a tenant's own litigation hold on the tenant's behalf. Both tiers SEE every hold on the\n * tenant: the tenant is owed knowing why its data is not being deleted.\n */\nexport enum LegalHoldPlacementTier {\n  /** Placed by the tenant's own owner, for its own data. */\n  ORGANIZATION = 'organization',\n  /** Placed by an application super-administrator, crossing into the tenant through the declared door. */\n  PLATFORM = 'platform',\n}\n\n/**\n * Client-branchable codes carried as `context.code` on a refusal (allow-listed by the error sanitizer).\n */\nexport enum LegalHoldErrorCode {\n  /** A row the delete addresses is under an active legal hold. The caller is authorized; the state forbids it. */\n  LEGAL_HOLD_ACTIVE = 'legal_hold_active',\n  /** The active holds could not be read, so whether the rows are held is unknown. Deletion is refused (fail closed). */\n  LEGAL_HOLD_STATE_UNVERIFIABLE = 'legal_hold_state_unverifiable',\n}\n\n/** The custom verbs. No generic CREATE / UPDATE / DELETE is exposed to any client. */\nexport enum LegalHolds_Operations {\n  PLACE = 'place',\n  RELEASE = 'release',\n}\n\n/** The largest explicit row list one `RESOURCE_ROWS` hold may name. A larger set is several holds, or the whole resource type. */\nexport const LEGAL_HOLD_MAXIMUM_ROW_IDS = 1000;\n\nexport const LegalHoldSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /** The held tenant. The primary scope anchor: the tenant sees every hold on its data. */\n  organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate().isAuditEvidence(),\n\n  scopeKind: z.enum(LegalHoldScopeKind)\n    .systemEnum('LegalHoldScopeKind')\n    .isDBIndexed()\n    .isSummaryField()\n    .excludeFromUpdate()\n    .isAuditEvidence(),\n\n  /** `RESOURCE_ROWS` only: the held resource type. */\n  resourceType: z.string().min(1).max(200).optional().excludeFromUpdate().isAuditEvidence(),\n\n  /** `RESOURCE_ROWS` only: the held rows. Absent means every row of {@link resourceType} in the tenant. */\n  rowIds: z.array(z.string().min(1)).max(LEGAL_HOLD_MAXIMUM_ROW_IDS).optional().excludeFromUpdate().isAuditEvidence(),\n\n  /** `DATA_SUBJECT` only: the person whose attributed rows are held. */\n  subjectUserId: z.string().min(1).optional().isDBIndexed().isForeignKey().excludeFromUpdate().isAuditEvidence(),\n\n  legalGround: z.enum(LegalHoldGround)\n    .systemEnum('LegalHoldGround')\n    .isSummaryField()\n    .excludeFromUpdate()\n    .isAuditEvidence(),\n\n  /**\n   * Why, in the placer's words: the matter, the case reference. REQUIRED.\n   *\n   * Not scrubbed on erasure, and that is a decision: a hold is the operator's defence evidence\n   * (Art. 17(3)(e)), and the matter it names is what the hold preserves. Not exported to SIEM by default\n   * either — free text is the surface most likely to name a third party.\n   */\n  justification: z.string().min(1).max(2000).excludeFromUpdate().dataCategories(PersonalDataCategory.USER_CONTENT),\n\n  placementTier: z.enum(LegalHoldPlacementTier)\n    .systemEnum('LegalHoldPlacementTier')\n    .isSummaryField()\n    .excludeFromCreate()\n    .excludeFromUpdate()\n    .isAuditEvidence(),\n\n  status: z.enum(LegalHoldStatus)\n    .systemEnum('LegalHoldStatus')\n    .default(LegalHoldStatus.ACTIVE)\n    .isDBIndexed()\n    .isSummaryField()\n    .excludeFromCreate()\n    .excludeFromUpdate()\n    .isAuditEvidence(),\n\n  placedByUserId: z.string().min(1).isForeignKey().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  placedAt: z.date().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n\n  releasedByUserId: z.string().min(1).optional().isForeignKey().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  /**\n   * The retention clock's closure field: a released hold is kept as `AUDIT_LOGS`-class evidence from this\n   * instant. Null while ACTIVE, so an active hold never expires. Server-owned — a caller-writable clock\n   * would be a caller-ordered delete of the evidence.\n   */\n  releasedAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  releaseReason: z.string().max(2000).optional().excludeFromCreate().excludeFromUpdate().dataCategories(PersonalDataCategory.USER_CONTENT),\n\n  createdAt: z.date().optional(),\n  updatedAt: z.date().optional(),\n});\n\nexport type LegalHold = z.infer<typeof LegalHoldSchema>;\n\n/** The `place` request. Coherence between `scopeKind` and the three optional selectors is checked server-side. */\nexport const LegalHoldPlaceRequestSchema = z.object({\n  scopeKind: z.enum(LegalHoldScopeKind).describe('What the hold covers: the whole organization, rows of one resource, or one person\\'s data.'),\n  resourceType: z.string().min(1).max(200).optional().describe('For a resource-rows hold: the resource type whose rows are held.'),\n  rowIds: z.array(z.string().min(1)).min(1).max(LEGAL_HOLD_MAXIMUM_ROW_IDS).optional()\n    .describe('For a resource-rows hold: the rows held. Omit to hold every row of the resource type in the organization.'),\n  subjectUserId: z.string().min(1).optional().describe('For a data-subject hold: the user whose data is held.'),\n  legalGround: z.enum(LegalHoldGround).describe('Why the data must be preserved.'),\n  justification: z.string().min(1).max(2000).describe('The matter or case the hold preserves data for.'),\n});\nexport type LegalHoldPlaceRequest = z.infer<typeof LegalHoldPlaceRequestSchema>;\n/** @wildo_source:part:end saas.models.privacy.legal-holds */\n\nexport const LegalHoldReleaseRequestSchema = z.object({\n  releaseReason: z.string().min(1).max(2000).describe('Why the preservation duty has ended.'),\n});\n\n/**\n * The scope-coherence rule for a `place` request, as one pure function the server and any client share.\n * Returns the problems; empty means coherent.\n */\nexport function validateLegalHoldPlaceRequest(request: LegalHoldPlaceRequest): string[] {\n  const problems: string[] = [];\n  switch (request.scopeKind) {\n    case LegalHoldScopeKind.ORGANIZATION:\n      if (request.resourceType !== undefined || request.rowIds !== undefined || request.subjectUserId !== undefined) {\n        problems.push('An organization hold covers the whole organization and takes no resourceType, rowIds or subjectUserId.');\n      }\n      break;\n    case LegalHoldScopeKind.RESOURCE_ROWS:\n      if (!request.resourceType) problems.push('A resource-rows hold names the resourceType it holds.');\n      if (request.subjectUserId !== undefined) problems.push('A resource-rows hold takes no subjectUserId.');\n      break;\n    case LegalHoldScopeKind.DATA_SUBJECT:\n      if (!request.subjectUserId) problems.push('A data-subject hold names the subjectUserId whose data it holds.');\n      if (request.resourceType !== undefined || request.rowIds !== undefined) problems.push('A data-subject hold takes no resourceType or rowIds.');\n      break;\n    default: {\n      const unknownKind: never = request.scopeKind;\n      problems.push(`Unknown legal hold scope kind '${String(unknownKind)}'.`);\n    }\n  }\n  return problems;\n}\n\n/**\n * How ONE resource type's rows are attributed to a data subject, for `DATA_SUBJECT` holds.\n *\n * Derived from the subject-export graph of `USERS` (Art. 15 access purpose), so \"the rows a hold on a\n * person covers\" and \"the rows an access request about that person discloses\" are the same set by\n * construction. Where a row cannot be attributed from its own fields, the answer is UNRESOLVABLE and the\n * row is HELD: over-preserving delays a deletion until release, under-preserving destroys evidence.\n */\nexport enum LegalHoldSubjectAttributionKind {\n  /** The row IS the person (`USERS`): attributed when its id is the subject. */\n  SUBJECT_ROW = 'subject_row',\n  /** The row carries a foreign key to `USERS` on an export edge: attributed when any of those fields names the subject. */\n  FOREIGN_KEY = 'foreign_key',\n  /**\n   * The resource is in the subject's export graph, but a row's attribution needs other rows (an owned\n   * descendant, or a key held on the `USERS` side). Any foreign-key field it carries still attributes it; beyond\n   * that, a row in the held tenant is held (conservative), a row outside any tenant is the person's only when its\n   * `userId` names them, and inside ANOTHER person's erasure it is that person's, not the held subject's.\n   */\n  UNRESOLVABLE = 'unresolvable',\n  /** Not in the subject's export graph (unrelated, or declared `exportSubject: FORBIDDEN`). A data-subject hold never covers it. */\n  NOT_ATTRIBUTED = 'not_attributed',\n}\n\nexport interface LegalHoldSubjectAttribution {\n  readonly kind: LegalHoldSubjectAttributionKind;\n  /** The row fields naming a user — the whole answer for FOREIGN_KEY, a first answer for UNRESOLVABLE. */\n  readonly foreignKeyFields?: readonly string[];\n}\n\n/** An active hold, as the predicate needs it. */\nexport type ActiveLegalHold = Pick<LegalHold, '_id' | 'organizationId' | 'scopeKind' | 'resourceType' | 'rowIds' | 'subjectUserId' | 'legalGround'>;\n\n/** One row a deletion path is about to destroy. */\nexport interface LegalHoldCandidateRow {\n  readonly id: string;\n  /** The tenant the row belongs to; absent for a row with no organization scope. */\n  readonly organizationId?: string;\n  /** The row's fields, for foreign-key attribution. */\n  readonly row?: Record<string, unknown>;\n}\n\n/** Why a row is held: the hold and its ground. */\nexport interface LegalHoldMatch {\n  readonly holdId: string;\n  readonly scopeKind: LegalHoldScopeKind;\n  readonly legalGround: LegalHoldGround;\n}\n\n/**\n * THE hold predicate — which of `rows` are under which of `holds`. Pure; the backend reads the active\n * holds once per call and hands them in.\n *\n * `erasureSubjectUserIds` is set only by a subject erasure: every row that erasure reaches in a resource\n * of the subject's export graph IS attributed to the person being erased, so a `DATA_SUBJECT` hold on that\n * person covers it whatever its own fields say.\n *\n * The ORGANIZATIONS row's tenant is its own id, so an `ORGANIZATION` hold also holds the tenant row.\n */\nexport function matchLegalHoldsToRows(input: {\n  readonly holds: readonly ActiveLegalHold[];\n  readonly resourceType: string;\n  readonly rows: readonly LegalHoldCandidateRow[];\n  readonly organizationsResourceType: string;\n  readonly subjectAttribution: LegalHoldSubjectAttribution;\n  readonly erasureSubjectUserIds?: readonly string[];\n}): Map<string, LegalHoldMatch[]> {\n  const held = new Map<string, LegalHoldMatch[]>();\n  if (input.holds.length === 0) return held;\n  for (const candidate of input.rows) {\n    const rowOrganizationId = input.resourceType === input.organizationsResourceType\n      ? candidate.id\n      : candidate.organizationId;\n    for (const hold of input.holds) {\n      if (!legalHoldCoversRow(hold, candidate, rowOrganizationId, input)) continue;\n      const matches = held.get(candidate.id) ?? [];\n      matches.push({ holdId: hold._id, scopeKind: hold.scopeKind, legalGround: hold.legalGround });\n      held.set(candidate.id, matches);\n    }\n  }\n  return held;\n}\n\nfunction legalHoldCoversRow(\n  hold: ActiveLegalHold,\n  candidate: LegalHoldCandidateRow,\n  rowOrganizationId: string | undefined,\n  input: Parameters<typeof matchLegalHoldsToRows>[0],\n): boolean {\n  switch (hold.scopeKind) {\n    case LegalHoldScopeKind.ORGANIZATION:\n      return rowOrganizationId === hold.organizationId;\n    case LegalHoldScopeKind.RESOURCE_ROWS:\n      return rowOrganizationId === hold.organizationId\n        && hold.resourceType === input.resourceType\n        && (hold.rowIds === undefined || hold.rowIds.includes(candidate.id));\n    case LegalHoldScopeKind.DATA_SUBJECT: {\n      // A person's rows outside any tenant (their user-scoped profile, preferences) are theirs wherever the\n      // claim arises, so a hold placed in one tenant covers them too. Rows of ANOTHER tenant are not this one's.\n      if (rowOrganizationId !== undefined && rowOrganizationId !== hold.organizationId) return false;\n      const subject = hold.subjectUserId;\n      if (!subject) return true; // incoherent hold: fail closed\n      const attribution = input.subjectAttribution;\n      if (attribution.kind === LegalHoldSubjectAttributionKind.NOT_ATTRIBUTED) return false;\n      if (input.erasureSubjectUserIds?.includes(subject)) return true;\n      switch (attribution.kind) {\n        case LegalHoldSubjectAttributionKind.SUBJECT_ROW:\n          return candidate.id === subject;\n        case LegalHoldSubjectAttributionKind.FOREIGN_KEY:\n          return (attribution.foreignKeyFields ?? []).some((field) => String(candidate.row?.[field] ?? '') === subject);\n        case LegalHoldSubjectAttributionKind.UNRESOLVABLE: {\n          // A foreign key on the row itself still names the person, when there is one.\n          if ((attribution.foreignKeyFields ?? []).some((field) => String(candidate.row?.[field] ?? '') === subject)) return true;\n          // Inside the erasure of SOMEONE ELSE, the walk has already attributed the row: it is the erased person's,\n          // not this subject's. Holding it would refuse their erasure on a ground belonging to another matter.\n          if (input.erasureSubjectUserIds !== undefined) return false;\n          // Outside any tenant, a row's owner is its `userId` (a USER_SELF row's primary scope), so a hold on one person\n          // never reaches every other person's rows across the application.\n          if (rowOrganizationId === undefined) return String(candidate.row?.userId ?? '') === subject;\n          // Inside the held tenant, the row's owner cannot be read from its own fields: held, the conservative direction.\n          return true;\n        }\n        default: {\n          const unknownKind: never = attribution.kind;\n          throw new Error(`Unknown legal hold subject attribution '${String(unknownKind)}'`);\n        }\n      }\n    }\n    default: {\n      // An unknown scope is not a reason to delete: fail closed.\n      const unknownKind: never = hold.scopeKind;\n      void unknownKind;\n      return true;\n    }\n  }\n}\n\n/** One row a subject erasure left untouched because a legal hold covers it (#1634). */\nexport interface SubjectErasureLegalHoldRetention {\n  resourceType: string;\n  rowId: string;\n  /** The grounds of every hold covering the row — what the data subject is told. */\n  legalGrounds: LegalHoldGround[];\n  holdIds: string[];\n}\n\n/**\n * The grounds of a set of matches, de-duplicated in vocabulary order — what a refusal or a report shows.\n */\nexport function legalHoldGroundsOf(matches: readonly LegalHoldMatch[]): LegalHoldGround[] {\n  const present = new Set(matches.map((match) => match.legalGround));\n  return Object.values(LegalHoldGround).filter((ground) => present.has(ground));\n}\n"]}

package/dist/esm/compliance/privacy/legal-notice-obligation.shared.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Whether an application owes a LEGAL NOTICE (imprint), and which of its particulars are still undeclared (#2588).
+ *
+ * ## Who owes one, read from the sources
+ *
+ * Every information-society service provider ESTABLISHED in the EU must keep its identity easily, directly and
+ * permanently accessible (Directive 2000/31/EC Art. 5(1)). The Directive is part of the EEA Agreement (Joint Committee
+ * Decision 091/2000), so Iceland, Liechtenstein and Norway carry the same duty. Establishment decides, not the markets
+ * served: a provider established in Germany is held to German requirements wherever it offers the service, and one
+ * established in another member state offers into Germany under its own state's rules (§ 3 DDG, country of origin).
+ * spec-cite: Directive 2000/31/EC Art. 2(c), Art. 3, Art. 5(1); § 3 Abs. 1, 2 DDG; EEA Joint Committee Decision 091/2000
+ *
+ * The United Kingdom kept the same duty after leaving the EU: the Electronic Commerce (EC Directive) Regulations 2002
+ * reg. 6(1) require the same particulars, in the Directive's words, of a provider established in the UK.
+ * spec-cite: SI 2002/2013 reg. 6(1) (legislation.gov.uk, revised 31.12.2020)
+ *
+ * Switzerland requires the same core of anyone offering goods, works or services in electronic commerce: clear and
+ * complete information about its identity and contact address, including e-mail (UWG Art. 3 Abs. 1 Bst. s). A provider
+ * established there is held to it; the conditional particulars are the EU's and are shown only when declared.
+ * spec-cite: UWG (SR 241) Art. 3 Abs. 1 Bst. s, as quoted by SECO (seco.admin.ch/de/onlinehandel)
+ *
+ * So the derivation reads `operatorComplianceIdentity.establishmentJurisdiction` and nothing else. An operator that has
+ * not declared where it is established gets `undefined`: unknown, never "not owed".
+ *
+ * ## What `false` means, and does not
+ *
+ * `false` means none of the regimes researched here applies: the Directive in the EU, the EEA Agreement, and the UK
+ * Regulations. It is NOT a legal opinion that the establishment's own law asks for no identity disclosure. Other regimes
+ * exist and are not modelled: add one to the list below only after reading its primary source.
+ */
+/** The EEA states outside the EU, where the Directive applies through the EEA Agreement (JCD 091/2000). */
+export declare const E_COMMERCE_DIRECTIVE_EEA_EFTA_STATES: readonly string[];
+/**
+ * Jurisdictions outside the EEA whose own law imposes the Directive's Art. 5(1) duty, or its core (identity, address,
+ * direct contact), on providers established there.
+ */
+export declare const E_COMMERCE_INFORMATION_DUTY_OTHER_JURISDICTIONS: readonly string[];
+/**
+ * The one fact the obligation reads: where the operator is established. Structural, so this atom imports no schema;
+ * an `ApplicationOperatorComplianceIdentity` satisfies it.
+ */
+export interface LegalNoticeEstablishment {
+    readonly establishmentJurisdiction?: string | undefined;
+}
+/** `true` when the operator's establishment owes a legal notice, `false` when it does not, `undefined` when undeclared. */
+export declare function legalNoticeOwed(identity: LegalNoticeEstablishment | undefined): boolean | undefined;
+//# sourceMappingURL=legal-notice-obligation.shared.d.ts.map

package/dist/esm/compliance/privacy/legal-notice-obligation.shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legal-notice-obligation.shared.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/legal-notice-obligation.shared.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,2GAA2G;AAC3G,eAAO,MAAM,oCAAoC,EAAE,SAAS,MAAM,EAAsC,CAAC;AAEzG;;;GAGG;AACH,eAAO,MAAM,+CAA+C,EAAE,SAAS,MAAM,EAK3E,CAAC;AAEH;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACzD;AAED,2HAA2H;AAC3H,wBAAgB,eAAe,CAAC,QAAQ,EAAE,wBAAwB,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAMnG"}

package/dist/esm/compliance/privacy/legal-notice-obligation.shared.js

@@ -0,0 +1,54 @@
+import { jurisdictionReachCovers } from './jurisdiction-containment.shared.js';
+/**
+ * Whether an application owes a LEGAL NOTICE (imprint), and which of its particulars are still undeclared (#2588).
+ *
+ * ## Who owes one, read from the sources
+ *
+ * Every information-society service provider ESTABLISHED in the EU must keep its identity easily, directly and
+ * permanently accessible (Directive 2000/31/EC Art. 5(1)). The Directive is part of the EEA Agreement (Joint Committee
+ * Decision 091/2000), so Iceland, Liechtenstein and Norway carry the same duty. Establishment decides, not the markets
+ * served: a provider established in Germany is held to German requirements wherever it offers the service, and one
+ * established in another member state offers into Germany under its own state's rules (§ 3 DDG, country of origin).
+ * spec-cite: Directive 2000/31/EC Art. 2(c), Art. 3, Art. 5(1); § 3 Abs. 1, 2 DDG; EEA Joint Committee Decision 091/2000
+ *
+ * The United Kingdom kept the same duty after leaving the EU: the Electronic Commerce (EC Directive) Regulations 2002
+ * reg. 6(1) require the same particulars, in the Directive's words, of a provider established in the UK.
+ * spec-cite: SI 2002/2013 reg. 6(1) (legislation.gov.uk, revised 31.12.2020)
+ *
+ * Switzerland requires the same core of anyone offering goods, works or services in electronic commerce: clear and
+ * complete information about its identity and contact address, including e-mail (UWG Art. 3 Abs. 1 Bst. s). A provider
+ * established there is held to it; the conditional particulars are the EU's and are shown only when declared.
+ * spec-cite: UWG (SR 241) Art. 3 Abs. 1 Bst. s, as quoted by SECO (seco.admin.ch/de/onlinehandel)
+ *
+ * So the derivation reads `operatorComplianceIdentity.establishmentJurisdiction` and nothing else. An operator that has
+ * not declared where it is established gets `undefined`: unknown, never "not owed".
+ *
+ * ## What `false` means, and does not
+ *
+ * `false` means none of the regimes researched here applies: the Directive in the EU, the EEA Agreement, and the UK
+ * Regulations. It is NOT a legal opinion that the establishment's own law asks for no identity disclosure. Other regimes
+ * exist and are not modelled: add one to the list below only after reading its primary source.
+ */
+/** The EEA states outside the EU, where the Directive applies through the EEA Agreement (JCD 091/2000). */
+export const E_COMMERCE_DIRECTIVE_EEA_EFTA_STATES = Object.freeze(['is', 'li', 'no']);
+/**
+ * Jurisdictions outside the EEA whose own law imposes the Directive's Art. 5(1) duty, or its core (identity, address,
+ * direct contact), on providers established there.
+ */
+export const E_COMMERCE_INFORMATION_DUTY_OTHER_JURISDICTIONS = Object.freeze([
+    // The Electronic Commerce (EC Directive) Regulations 2002, reg. 6(1).
+    'gb',
+    // UWG Art. 3 Abs. 1 Bst. s (identity, contact address and e-mail of anyone offering in electronic commerce).
+    'ch',
+]);
+/** `true` when the operator's establishment owes a legal notice, `false` when it does not, `undefined` when undeclared. */
+export function legalNoticeOwed(identity) {
+    const establishment = identity?.establishmentJurisdiction;
+    if (establishment === undefined)
+        return undefined;
+    if (jurisdictionReachCovers('eu', establishment))
+        return true;
+    return [...E_COMMERCE_DIRECTIVE_EEA_EFTA_STATES, ...E_COMMERCE_INFORMATION_DUTY_OTHER_JURISDICTIONS]
+        .some((jurisdiction) => jurisdictionReachCovers(jurisdiction, establishment));
+}
+//# sourceMappingURL=legal-notice-obligation.shared.js.map

package/dist/esm/compliance/privacy/legal-notice-obligation.shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legal-notice-obligation.shared.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/legal-notice-obligation.shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAE5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,2GAA2G;AAC3G,MAAM,CAAC,MAAM,oCAAoC,GAAsB,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAEzG;;;GAGG;AACH,MAAM,CAAC,MAAM,+CAA+C,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC9F,sEAAsE;IACtE,IAAI;IACJ,6GAA6G;IAC7G,IAAI;CACL,CAAC,CAAC;AAUH,2HAA2H;AAC3H,MAAM,UAAU,eAAe,CAAC,QAA8C;IAC5E,MAAM,aAAa,GAAG,QAAQ,EAAE,yBAAyB,CAAC;IAC1D,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAClD,IAAI,uBAAuB,CAAC,IAAI,EAAE,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO,CAAC,GAAG,oCAAoC,EAAE,GAAG,+CAA+C,CAAC;SACjG,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,uBAAuB,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC;AAClF,CAAC","sourcesContent":["import { jurisdictionReachCovers } from './jurisdiction-containment.shared';\n\n/**\n * Whether an application owes a LEGAL NOTICE (imprint), and which of its particulars are still undeclared (#2588).\n *\n * ## Who owes one, read from the sources\n *\n * Every information-society service provider ESTABLISHED in the EU must keep its identity easily, directly and\n * permanently accessible (Directive 2000/31/EC Art. 5(1)). The Directive is part of the EEA Agreement (Joint Committee\n * Decision 091/2000), so Iceland, Liechtenstein and Norway carry the same duty. Establishment decides, not the markets\n * served: a provider established in Germany is held to German requirements wherever it offers the service, and one\n * established in another member state offers into Germany under its own state's rules (§ 3 DDG, country of origin).\n * spec-cite: Directive 2000/31/EC Art. 2(c), Art. 3, Art. 5(1); § 3 Abs. 1, 2 DDG; EEA Joint Committee Decision 091/2000\n *\n * The United Kingdom kept the same duty after leaving the EU: the Electronic Commerce (EC Directive) Regulations 2002\n * reg. 6(1) require the same particulars, in the Directive's words, of a provider established in the UK.\n * spec-cite: SI 2002/2013 reg. 6(1) (legislation.gov.uk, revised 31.12.2020)\n *\n * Switzerland requires the same core of anyone offering goods, works or services in electronic commerce: clear and\n * complete information about its identity and contact address, including e-mail (UWG Art. 3 Abs. 1 Bst. s). A provider\n * established there is held to it; the conditional particulars are the EU's and are shown only when declared.\n * spec-cite: UWG (SR 241) Art. 3 Abs. 1 Bst. s, as quoted by SECO (seco.admin.ch/de/onlinehandel)\n *\n * So the derivation reads `operatorComplianceIdentity.establishmentJurisdiction` and nothing else. An operator that has\n * not declared where it is established gets `undefined`: unknown, never \"not owed\".\n *\n * ## What `false` means, and does not\n *\n * `false` means none of the regimes researched here applies: the Directive in the EU, the EEA Agreement, and the UK\n * Regulations. It is NOT a legal opinion that the establishment's own law asks for no identity disclosure. Other regimes\n * exist and are not modelled: add one to the list below only after reading its primary source.\n */\n\n/** The EEA states outside the EU, where the Directive applies through the EEA Agreement (JCD 091/2000). */\nexport const E_COMMERCE_DIRECTIVE_EEA_EFTA_STATES: readonly string[] = Object.freeze(['is', 'li', 'no']);\n\n/**\n * Jurisdictions outside the EEA whose own law imposes the Directive's Art. 5(1) duty, or its core (identity, address,\n * direct contact), on providers established there.\n */\nexport const E_COMMERCE_INFORMATION_DUTY_OTHER_JURISDICTIONS: readonly string[] = Object.freeze([\n  // The Electronic Commerce (EC Directive) Regulations 2002, reg. 6(1).\n  'gb',\n  // UWG Art. 3 Abs. 1 Bst. s (identity, contact address and e-mail of anyone offering in electronic commerce).\n  'ch',\n]);\n\n/**\n * The one fact the obligation reads: where the operator is established. Structural, so this atom imports no schema;\n * an `ApplicationOperatorComplianceIdentity` satisfies it.\n */\nexport interface LegalNoticeEstablishment {\n  readonly establishmentJurisdiction?: string | undefined;\n}\n\n/** `true` when the operator's establishment owes a legal notice, `false` when it does not, `undefined` when undeclared. */\nexport function legalNoticeOwed(identity: LegalNoticeEstablishment | undefined): boolean | undefined {\n  const establishment = identity?.establishmentJurisdiction;\n  if (establishment === undefined) return undefined;\n  if (jurisdictionReachCovers('eu', establishment)) return true;\n  return [...E_COMMERCE_DIRECTIVE_EEA_EFTA_STATES, ...E_COMMERCE_INFORMATION_DUTY_OTHER_JURISDICTIONS]\n    .some((jurisdiction) => jurisdictionReachCovers(jurisdiction, establishment));\n}\n"]}

package/dist/esm/compliance/privacy/legal-notice.shared.d.ts

@@ -0,0 +1,105 @@
+import { z } from 'zod';
+import { type ApplicationOperatorComplianceIdentity } from './operator-compliance-identity.shared.schemas';
+/**
+ * The particulars of a legal notice, and its runtime projection (#2588). Whether one is owed at all is decided in
+ * `legal-notice-obligation.shared.ts`, an import-free atom the marketing website's build reads too.
+ */
+/**
+ * The particulars a legal notice states, one per item of Art. 5(1) and § 5 Abs. 1 DDG, so a page, a launch list and
+ * an operator-facing check name the same things by the same names.
+ */
+export declare enum LegalNoticeParticular {
+    /** Art. 5(1)(a). */
+    LEGAL_ENTITY_NAME = "legalEntityName",
+    /** Art. 5(1)(b): the geographic address of the establishment. */
+    REGISTERED_ADDRESS = "registeredAddress",
+    /** Art. 5(1)(c): rapid, direct contact including e-mail. */
+    GENERAL_CONTACT = "generalContact",
+    /** § 5 Abs. 1 Nr. 1 DDG, for a legal person. */
+    LEGAL_FORM = "legalForm",
+    /** § 5 Abs. 1 Nr. 1 DDG, for a legal person. */
+    AUTHORIZED_REPRESENTATIVES = "authorizedRepresentatives",
+    /** § 5 Abs. 1 Nr. 1 DDG, where the provider states its capital. */
+    SHARE_CAPITAL = "shareCapital",
+    /** Art. 5(1)(d), where the operator is registered. */
+    TRADE_REGISTER = "tradeRegister",
+    /** Art. 5(1)(g), where the activity is subject to VAT. */
+    VAT_IDENTIFICATION_NUMBER = "vatIdentificationNumber",
+    /** § 5 Abs. 1 Nr. 6 DDG, where the operator has a Wirtschafts-Identifikationsnummer. */
+    ECONOMIC_IDENTIFICATION_NUMBER = "economicIdentificationNumber",
+    /** Art. 5(1)(e), where the activity needs an authorisation. */
+    SUPERVISORY_AUTHORITY = "supervisoryAuthority",
+    /** Art. 5(1)(f), where the service is provided in a regulated profession. */
+    REGULATED_PROFESSION = "regulatedProfession",
+    /** § 5 Abs. 1 Nr. 7 DDG, for a company being wound up. */
+    IN_LIQUIDATION = "inLiquidation"
+}
+/**
+ * The particulars EVERY established provider owes: name, address, contact. The others apply only to some operators (a
+ * legal person, a registered one, one subject to VAT or to an authorisation), which nothing in the configuration can
+ * decide for the operator, so they are reported as `toConfirm` rather than as owed. The legal-notice page reads this
+ * list to decide which particulars it marks "not yet declared", so the page and the launch list cannot disagree.
+ */
+export declare const LEGAL_NOTICE_ALWAYS_OWED_PARTICULARS: readonly LegalNoticeParticular[];
+/**
+ * What a legal notice still lacks: `owed` (always required, undeclared) and `toConfirm` (required where it applies,
+ * undeclared). Both empty when the notice is not owed. A page renders an undeclared particular as MARKED, never omitted
+ * and never invented: the duty exists whether or not the operator has filled the field.
+ */
+export declare function outstandingLegalNoticeParticulars(identity: ApplicationOperatorComplianceIdentity | undefined): {
+    readonly owed: readonly LegalNoticeParticular[];
+    readonly toConfirm: readonly LegalNoticeParticular[];
+};
+/**
+ * Where `wildo config legal-notice` writes the projected notice in an application, and where `saas-config.backend.ts`
+ * imports it from. One constant for the generator, the validate domain and the launch list, which reports an owed
+ * notice whose module is absent: the running application would then say no notice is required.
+ */
+export declare const LEGAL_NOTICE_GENERATED_RELATIVE_PATH = "backend-api/src/legal-notice.generated.ts";
+/**
+ * The legal notice an application SERVES, carried in its runtime configuration as `compliance.legalNotice` (#2588).
+ *
+ * Exactly the particulars a notice states, taken from the identity's own field schemas so there is one definition of
+ * each, and nothing else: the lawful bases, role allocations and the rest of the identity are not a legal notice and do
+ * not reach the unauthenticated page. Every particular is optional, because an undeclared one is MARKED on the page as
+ * "not yet declared" rather than omitted: the duty exists whether or not the operator has filled the field.
+ *
+ * Written by `wildo config legal-notice` from `operatorComplianceIdentity`, only when the notice is owed
+ * (`legalNoticeOwed`); an application that owes none carries no `legalNotice`, and its page says so.
+ */
+export declare const LegalNoticeSchema: z.ZodObject<{
+    establishmentJurisdiction: z.ZodOptional<z.ZodString>;
+    legalEntityName: z.ZodOptional<z.ZodString>;
+    registeredAddress: z.ZodOptional<z.ZodString>;
+    legalForm: z.ZodOptional<z.ZodString>;
+    authorizedRepresentatives: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    shareCapital: z.ZodOptional<z.ZodObject<{
+        amount: z.ZodString;
+        outstandingContributions: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    generalContact: z.ZodOptional<z.ZodObject<{
+        email: z.ZodEmail;
+        phone: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    tradeRegister: z.ZodOptional<z.ZodObject<{
+        register: z.ZodString;
+        registrationNumber: z.ZodString;
+    }, z.core.$strict>>;
+    vatIdentificationNumber: z.ZodOptional<z.ZodString>;
+    economicIdentificationNumber: z.ZodOptional<z.ZodString>;
+    supervisoryAuthority: z.ZodOptional<z.ZodString>;
+    regulatedProfession: z.ZodOptional<z.ZodObject<{
+        professionalBody: z.ZodString;
+        professionalTitle: z.ZodString;
+        titleGrantedIn: z.ZodString;
+        professionalRules: z.ZodString;
+    }, z.core.$strict>>;
+    inLiquidation: z.ZodOptional<z.ZodLiteral<true>>;
+}, z.core.$strict>;
+export type LegalNotice = z.infer<typeof LegalNoticeSchema>;
+/**
+ * The legal notice to serve, projected from the operator's identity: `undefined` when none is owed (or when the
+ * establishment is undeclared, so it cannot be known to be owed), the declared particulars otherwise.
+ */
+export declare function projectLegalNotice(identity: ApplicationOperatorComplianceIdentity | undefined): LegalNotice | undefined;
+//# sourceMappingURL=legal-notice.shared.d.ts.map

package/dist/esm/compliance/privacy/legal-notice.shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legal-notice.shared.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/legal-notice.shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAA+C,KAAK,qCAAqC,EAAE,MAAM,+CAA+C,CAAC;AAExJ;;;GAGG;AAEH;;;GAGG;AACH,oBAAY,qBAAqB;IAC/B,oBAAoB;IACpB,iBAAiB,oBAAoB;IACrC,iEAAiE;IACjE,kBAAkB,sBAAsB;IACxC,4DAA4D;IAC5D,eAAe,mBAAmB;IAClC,gDAAgD;IAChD,UAAU,cAAc;IACxB,gDAAgD;IAChD,0BAA0B,8BAA8B;IACxD,mEAAmE;IACnE,aAAa,iBAAiB;IAC9B,sDAAsD;IACtD,cAAc,kBAAkB;IAChC,0DAA0D;IAC1D,yBAAyB,4BAA4B;IACrD,wFAAwF;IACxF,8BAA8B,iCAAiC;IAC/D,+DAA+D;IAC/D,qBAAqB,yBAAyB;IAC9C,6EAA6E;IAC7E,oBAAoB,wBAAwB;IAC5C,0DAA0D;IAC1D,cAAc,kBAAkB;CACjC;AAED;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC,EAAE,SAAS,qBAAqB,EAI/E,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,qCAAqC,GAAG,SAAS,GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,qBAAqB,EAAE,CAAA;CAAE,CAQ3G;AAED;;;;GAIG;AACH,eAAO,MAAM,oCAAoC,8CAA8C,CAAC;AAIhG;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAc5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,qCAAqC,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAOvH"}