@xemahq/contracts 0.1.0

package/dist/resource-role/lib/resource-role-binding.js

@@ -0,0 +1,118 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResourceRoleBindingSchema = exports.ResourceRoleTargetSchema = exports.OwnerQualifiedInstanceTargetSchema = exports.ResourceRoleKeySchema = exports.RESOURCE_ROLE_QUALIFIER_PATTERN = exports.RESOURCE_ROLE_PATTERN = void 0;
+exports.formatResourceRoleKey = formatResourceRoleKey;
+exports.parseResourceRoleKey = parseResourceRoleKey;
+exports.isRevisionRoleTarget = isRevisionRoleTarget;
+exports.resourceRoleTargetResourceKind = resourceRoleTargetResourceKind;
+exports.resolveResourceRoleBinding = resolveResourceRoleBinding;
+const zod_1 = require("zod");
+const revision_target_1 = require("../../revision-target");
+const space_1 = require("../../space");
+exports.RESOURCE_ROLE_PATTERN = /^[a-z][a-z0-9-]{0,62}$/u;
+exports.RESOURCE_ROLE_QUALIFIER_PATTERN = /^[a-z][a-z0-9-]{0,62}$/u;
+const ROLE_KEY_SEPARATOR = '.';
+const ROLE_QUALIFIER_SEPARATOR = '/';
+exports.ResourceRoleKeySchema = zod_1.z
+    .object({
+    resourceKind: zod_1.z.string().regex(revision_target_1.REVISION_RESOURCE_KIND_PATTERN),
+    role: zod_1.z.string().regex(exports.RESOURCE_ROLE_PATTERN),
+    qualifier: zod_1.z.string().regex(exports.RESOURCE_ROLE_QUALIFIER_PATTERN).optional(),
+})
+    .strict();
+function formatResourceRoleKey(key) {
+    const base = `${key.resourceKind}${ROLE_KEY_SEPARATOR}${key.role}`;
+    return key.qualifier === undefined
+        ? base
+        : `${base}${ROLE_QUALIFIER_SEPARATOR}${key.qualifier}`;
+}
+function parseResourceRoleKey(value) {
+    const qualifierIndex = value.indexOf(ROLE_QUALIFIER_SEPARATOR);
+    const base = qualifierIndex === -1 ? value : value.slice(0, qualifierIndex);
+    const qualifier = qualifierIndex === -1
+        ? undefined
+        : value.slice(qualifierIndex + ROLE_QUALIFIER_SEPARATOR.length);
+    const index = base.indexOf(ROLE_KEY_SEPARATOR);
+    if (index === -1) {
+        throw new Error(`Invalid resource role key "${value}": expected <resourceKind>.<role>[/<qualifier>].`);
+    }
+    return exports.ResourceRoleKeySchema.parse({
+        resourceKind: base.slice(0, index),
+        role: base.slice(index + ROLE_KEY_SEPARATOR.length),
+        ...(qualifier === undefined ? {} : { qualifier }),
+    });
+}
+exports.OwnerQualifiedInstanceTargetSchema = zod_1.z
+    .object({
+    ownerSpaceRef: space_1.OwnerSpaceRefSchema,
+    resourceKind: zod_1.z.string().regex(revision_target_1.REVISION_RESOURCE_KIND_PATTERN),
+    resourceId: zod_1.z.string().min(1).max(2_048),
+})
+    .strict();
+exports.ResourceRoleTargetSchema = zod_1.z.union([
+    revision_target_1.OwnerQualifiedRevisionTargetSchema,
+    exports.OwnerQualifiedInstanceTargetSchema,
+]);
+function isRevisionRoleTarget(target) {
+    return 'target' in target;
+}
+function resourceRoleTargetResourceKind(target) {
+    return isRevisionRoleTarget(target)
+        ? target.target.resourceKind
+        : target.resourceKind;
+}
+exports.ResourceRoleBindingSchema = zod_1.z
+    .object({
+    ownerSpaceRef: space_1.OwnerSpaceRefSchema,
+    roleKey: exports.ResourceRoleKeySchema,
+    target: exports.ResourceRoleTargetSchema,
+})
+    .strict()
+    .superRefine((binding, ctx) => {
+    const targetKind = resourceRoleTargetResourceKind(binding.target);
+    if (targetKind !== binding.roleKey.resourceKind) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: isRevisionRoleTarget(binding.target)
+                ? ['target', 'target', 'resourceKind']
+                : ['target', 'resourceKind'],
+            message: `role key names kind "${binding.roleKey.resourceKind}" but the target ` +
+                `names "${targetKind}"`,
+        });
+    }
+});
+const ROLE_KEY_RANK_QUALIFIED = 0;
+const ROLE_KEY_RANK_GENERAL = 1;
+function roleKeySpecificityRank(candidate, wanted) {
+    if (candidate.resourceKind !== wanted.resourceKind ||
+        candidate.role !== wanted.role) {
+        return undefined;
+    }
+    if (candidate.qualifier === undefined)
+        return ROLE_KEY_RANK_GENERAL;
+    if (wanted.qualifier === undefined)
+        return undefined;
+    return candidate.qualifier === wanted.qualifier
+        ? ROLE_KEY_RANK_QUALIFIED
+        : undefined;
+}
+function resolveResourceRoleBinding(candidates, roleKey) {
+    let winner;
+    let bestSpecificity = Number.POSITIVE_INFINITY;
+    let bestTier = Number.POSITIVE_INFINITY;
+    for (const candidate of candidates) {
+        const specificity = roleKeySpecificityRank(candidate.binding.roleKey, roleKey);
+        if (specificity === undefined)
+            continue;
+        const tier = (0, space_1.spaceKindRank)(candidate.ownerSpaceKind);
+        if (specificity > bestSpecificity)
+            continue;
+        if (specificity < bestSpecificity || tier < bestTier) {
+            winner = candidate;
+            bestSpecificity = specificity;
+            bestTier = tier;
+        }
+    }
+    return winner?.binding;
+}
+//# sourceMappingURL=resource-role-binding.js.map

package/dist/resource-role/lib/resource-role-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-role-binding.js","sourceRoot":"","sources":["../../../src/resource-role/lib/resource-role-binding.ts"],"names":[],"mappings":";;;AAuPA,sDAKC;AAqBD,oDAuBC;AAyDD,oDAIC;AASD,wEAIC;AAuJD,gEA8BC;AAtaD,6BAAwB;AAQxB,2DAI+B;AAC/B,uCAKqB;AAGR,QAAA,qBAAqB,GAAG,yBAAyB,CAAC;AAUlD,QAAA,+BAA+B,GAAG,yBAAyB,CAAC;AAGzE,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAqB/B,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAgDxB,QAAA,qBAAqB,GAA+B,OAAC;KAC/D,MAAM,CAAC;IACN,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gDAA8B,CAAC;IAC9D,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,6BAAqB,CAAC;IAC7C,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uCAA+B,CAAC,CAAC,QAAQ,EAAE;CACxE,CAAC;KACD,MAAM,EAA2C,CAAC;AASrD,SAAgB,qBAAqB,CAAC,GAAoB;IACxD,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,YAAY,GAAG,kBAAkB,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACnE,OAAO,GAAG,CAAC,SAAS,KAAK,SAAS;QAChC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,GAAG,IAAI,GAAG,wBAAwB,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC;AAC3D,CAAC;AAqBD,SAAgB,oBAAoB,CAAC,KAAa;IAChD,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC/D,MAAM,IAAI,GACR,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;IACjE,MAAM,SAAS,GACb,cAAc,KAAK,CAAC,CAAC;QACnB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAEpE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/C,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,8BAA8B,KAAK,kDAAkD,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,6BAAqB,CAAC,KAAK,CAAC;QACjC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;QAClC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC;QAInD,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;KAClD,CAAC,CAAC;AACL,CAAC;AAsBY,QAAA,kCAAkC,GAC7C,OAAC;KACE,MAAM,CAAC;IACN,aAAa,EAAE,2BAAmB;IAClC,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gDAA8B,CAAC;IAC9D,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;CACzC,CAAC;KACD,MAAM,EAAE,CAAC;AAsBD,QAAA,wBAAwB,GAAkC,OAAC,CAAC,KAAK,CAAC;IAC7E,oDAAkC;IAClC,0CAAkC;CACnC,CAAkC,CAAC;AAGpC,SAAgB,oBAAoB,CAClC,MAA0B;IAE1B,OAAO,QAAQ,IAAI,MAAM,CAAC;AAC5B,CAAC;AASD,SAAgB,8BAA8B,CAAC,MAA0B;IACvE,OAAO,oBAAoB,CAAC,MAAM,CAAC;QACjC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY;QAC5B,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;AAC1B,CAAC;AAeY,QAAA,yBAAyB,GAAmC,OAAC;KACvE,MAAM,CAAC;IACN,aAAa,EAAE,2BAAmB;IAClC,OAAO,EAAE,6BAAqB;IAC9B,MAAM,EAAE,gCAAwB;CACjC,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAK5B,MAAM,UAAU,GAAG,8BAA8B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClE,IAAI,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QAChD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAI3B,IAAI,EAAE,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC;gBACxC,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,cAAc,CAAC;gBACtC,CAAC,CAAC,CAAC,QAAQ,EAAE,cAAc,CAAC;YAC9B,OAAO,EACL,wBAAwB,OAAO,CAAC,OAAO,CAAC,YAAY,mBAAmB;gBACvE,UAAU,UAAU,GAAG;SAC1B,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAA8C,CAAC;AAelD,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAGlC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AA6BhC,SAAS,sBAAsB,CAC7B,SAA0B,EAC1B,MAAuB;IAEvB,IACE,SAAS,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;QAC9C,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAC9B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,qBAAqB,CAAC;IACpE,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACrD,OAAO,SAAS,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QAC7C,CAAC,CAAC,uBAAuB;QACzB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AA+CD,SAAgB,0BAA0B,CACxC,UAAgD,EAChD,OAAwB;IAExB,IAAI,MAA6C,CAAC;IAClD,IAAI,eAAe,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAC/C,IAAI,QAAQ,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACxC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,WAAW,GAAG,sBAAsB,CACxC,SAAS,CAAC,OAAO,CAAC,OAAO,EACzB,OAAO,CACR,CAAC;QACF,IAAI,WAAW,KAAK,SAAS;YAAE,SAAS;QASxC,MAAM,IAAI,GAAG,IAAA,qBAAa,EAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACrD,IAAI,WAAW,GAAG,eAAe;YAAE,SAAS;QAC5C,IAAI,WAAW,GAAG,eAAe,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;YACrD,MAAM,GAAG,SAAS,CAAC;YACnB,eAAe,GAAG,WAAW,CAAC;YAC9B,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,EAAE,OAAO,CAAC;AACzB,CAAC"}

package/dist/resource-role/lib/resource-role-contribution.d.ts

@@ -0,0 +1,11 @@
+import { z } from 'zod';
+import { SpaceKind } from '../../space';
+import { type ResourceRoleKey } from './resource-role-binding';
+export interface ResourceRoleContributionManifest {
+    readonly roleKey: ResourceRoleKey;
+    readonly title: string;
+    readonly description: string;
+    readonly resolvedAtSpaceKinds: readonly SpaceKind[];
+}
+export declare const ResourceRoleContributionManifestSchema: z.ZodType<ResourceRoleContributionManifest>;
+//# sourceMappingURL=resource-role-contribution.d.ts.map

package/dist/resource-role/lib/resource-role-contribution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-role-contribution.d.ts","sourceRoot":"","sources":["../../../src/resource-role/lib/resource-role-contribution.ts"],"names":[],"mappings":"AAwDA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,yBAAyB,CAAC;AAYjC,MAAM,WAAW,gCAAgC;IAM/C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAElC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAOvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAkB7B,QAAQ,CAAC,oBAAoB,EAAE,SAAS,SAAS,EAAE,CAAC;CACrD;AAWD,eAAO,MAAM,sCAAsC,EAAE,CAAC,CAAC,OAAO,CAAC,gCAAgC,CAyC/B,CAAC"}

package/dist/resource-role/lib/resource-role-contribution.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResourceRoleContributionManifestSchema = void 0;
+const zod_1 = require("zod");
+const space_1 = require("../../space");
+const resource_role_binding_1 = require("./resource-role-binding");
+const RESOURCE_ROLE_TITLE_MAX = 200;
+const RESOURCE_ROLE_DESCRIPTION_MAX = 2000;
+exports.ResourceRoleContributionManifestSchema = zod_1.z
+    .object({
+    roleKey: resource_role_binding_1.ResourceRoleKeySchema,
+    title: zod_1.z.string().min(1).max(RESOURCE_ROLE_TITLE_MAX),
+    description: zod_1.z.string().min(1).max(RESOURCE_ROLE_DESCRIPTION_MAX),
+    resolvedAtSpaceKinds: zod_1.z
+        .array(zod_1.z.nativeEnum(space_1.SpaceKind))
+        .min(1, 'a role nothing resolves is a role nothing can use')
+        .refine((kinds) => new Set(kinds).size === kinds.length, 'resolvedAtSpaceKinds must not repeat a tier'),
+})
+    .strict()
+    .superRefine((manifest, ctx) => {
+    if (manifest.roleKey.qualifier !== undefined) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['roleKey', 'qualifier'],
+            message: 'a role DECLARATION must not carry a qualifier: a qualifier narrows ' +
+                "one owner's binding for a case, it does not declare a second role",
+        });
+    }
+});
+//# sourceMappingURL=resource-role-contribution.js.map

package/dist/resource-role/lib/resource-role-contribution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-role-contribution.js","sourceRoot":"","sources":["../../../src/resource-role/lib/resource-role-contribution.ts"],"names":[],"mappings":";;;AAwDA,6BAAwB;AAExB,uCAAwC;AACxC,mEAGiC;AAGjC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAGpC,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAmD9B,QAAA,sCAAsC,GACjD,OAAC;KACE,MAAM,CAAC;IACN,OAAO,EAAE,6CAAqB;IAC9B,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC;IACrD,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,6BAA6B,CAAC;IACjE,oBAAoB,EAAE,OAAC;SACpB,KAAK,CAAC,OAAC,CAAC,UAAU,CAAC,iBAAS,CAAC,CAAC;SAC9B,GAAG,CAAC,CAAC,EAAE,mDAAmD,CAAC;SAC3D,MAAM,CACL,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAC/C,6CAA6C,CAC9C;CACJ,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAiB7B,IAAI,QAAQ,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC7C,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC;YAC9B,OAAO,EACL,qEAAqE;gBACrE,mEAAmE;SACtE,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAA2D,CAAC"}

package/dist/retention/index.d.ts

@@ -0,0 +1,5 @@
+export * from './lib/primitives';
+export * from './lib/subject';
+export * from './lib/legal-hold';
+export * from './lib/policy';
+//# sourceMappingURL=index.d.ts.map

package/dist/retention/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/retention/index.ts"],"names":[],"mappings":"AAiBA,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC"}

package/dist/retention/index.js

@@ -0,0 +1,21 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./lib/primitives"), exports);
+__exportStar(require("./lib/subject"), exports);
+__exportStar(require("./lib/legal-hold"), exports);
+__exportStar(require("./lib/policy"), exports);
+//# sourceMappingURL=index.js.map

package/dist/retention/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/retention/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAiBA,mDAAiC;AACjC,gDAA8B;AAC9B,mDAAiC;AACjC,+CAA6B"}

package/dist/retention/lib/legal-hold.d.ts

@@ -0,0 +1,107 @@
+import { z } from 'zod';
+export declare enum LegalHoldScopeKind {
+    Org = "org",
+    SubjectClass = "subject_class",
+    Subject = "subject"
+}
+export declare const LegalHoldScopeKindSchema: z.ZodEnum<typeof LegalHoldScopeKind>;
+export declare const LegalHoldScopeSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<LegalHoldScopeKind.Org>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<LegalHoldScopeKind.SubjectClass>;
+    subjectClass: z.ZodEnum<typeof import("./subject").RetentionSubjectClass>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<LegalHoldScopeKind.Subject>;
+    subjectClass: z.ZodEnum<typeof import("./subject").RetentionSubjectClass>;
+    subjectId: z.ZodString;
+}, z.core.$strict>], "kind">;
+export type LegalHoldScope = z.infer<typeof LegalHoldScopeSchema>;
+export declare enum LegalHoldState {
+    Active = "active",
+    Released = "released"
+}
+export declare const LegalHoldStateSchema: z.ZodEnum<typeof LegalHoldState>;
+export declare const LegalHoldRecordSchema: z.ZodObject<{
+    apiVersion: z.ZodLiteral<"xema.retention/v1">;
+    kind: z.ZodLiteral<"legal_hold">;
+    holdId: z.ZodString;
+    orgId: z.ZodString;
+    matterRef: z.ZodString;
+    scope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<LegalHoldScopeKind.Org>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<LegalHoldScopeKind.SubjectClass>;
+        subjectClass: z.ZodEnum<typeof import("./subject").RetentionSubjectClass>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<LegalHoldScopeKind.Subject>;
+        subjectClass: z.ZodEnum<typeof import("./subject").RetentionSubjectClass>;
+        subjectId: z.ZodString;
+    }, z.core.$strict>], "kind">;
+    reason: z.ZodString;
+    placedBy: z.ZodString;
+    placedAt: z.ZodString;
+    state: z.ZodEnum<typeof LegalHoldState>;
+    releasedBy: z.ZodNullable<z.ZodString>;
+    releasedAt: z.ZodNullable<z.ZodString>;
+    releaseReason: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type LegalHoldRecord = z.infer<typeof LegalHoldRecordSchema>;
+export declare const LegalHoldMatchSchema: z.ZodObject<{
+    holdId: z.ZodString;
+    matterRef: z.ZodString;
+    scope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<LegalHoldScopeKind.Org>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<LegalHoldScopeKind.SubjectClass>;
+        subjectClass: z.ZodEnum<typeof import("./subject").RetentionSubjectClass>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<LegalHoldScopeKind.Subject>;
+        subjectClass: z.ZodEnum<typeof import("./subject").RetentionSubjectClass>;
+        subjectId: z.ZodString;
+    }, z.core.$strict>], "kind">;
+    placedAt: z.ZodString;
+}, z.core.$strict>;
+export type LegalHoldMatch = z.infer<typeof LegalHoldMatchSchema>;
+export declare const LegalHoldDecisionSchema: z.ZodObject<{
+    apiVersion: z.ZodLiteral<"xema.retention/v1">;
+    kind: z.ZodLiteral<"legal_hold_decision">;
+    orgId: z.ZodString;
+    subject: z.ZodObject<{
+        subjectClass: z.ZodEnum<typeof import("./subject").RetentionSubjectClass>;
+        subjectId: z.ZodString;
+    }, z.core.$strict>;
+    held: z.ZodBoolean;
+    holds: z.ZodArray<z.ZodObject<{
+        holdId: z.ZodString;
+        matterRef: z.ZodString;
+        scope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<LegalHoldScopeKind.Org>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<LegalHoldScopeKind.SubjectClass>;
+            subjectClass: z.ZodEnum<typeof import("./subject").RetentionSubjectClass>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<LegalHoldScopeKind.Subject>;
+            subjectClass: z.ZodEnum<typeof import("./subject").RetentionSubjectClass>;
+            subjectId: z.ZodString;
+        }, z.core.$strict>], "kind">;
+        placedAt: z.ZodString;
+    }, z.core.$strict>>;
+    truncated: z.ZodBoolean;
+    resolvedAt: z.ZodString;
+}, z.core.$strict>;
+export type LegalHoldDecision = z.infer<typeof LegalHoldDecisionSchema>;
+export declare enum LegalHoldProbeOutcome {
+    Resolved = "resolved",
+    Unavailable = "unavailable"
+}
+export type LegalHoldProbe = {
+    readonly outcome: LegalHoldProbeOutcome.Resolved;
+    readonly decision: LegalHoldDecision;
+} | {
+    readonly outcome: LegalHoldProbeOutcome.Unavailable;
+    readonly reason: string;
+};
+export declare function unavailableLegalHoldProbe(reason: string): LegalHoldProbe;
+export declare function legalHoldProbeFromResponse(body: unknown): LegalHoldProbe;
+export declare function isRetentionBlockedByLegalHold(probe: LegalHoldProbe): boolean;
+//# sourceMappingURL=legal-hold.d.ts.map

package/dist/retention/lib/legal-hold.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legal-hold.d.ts","sourceRoot":"","sources":["../../../src/retention/lib/legal-hold.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAuBxB,oBAAY,kBAAkB;IAC5B,GAAG,QAAQ;IACX,YAAY,kBAAkB;IAC9B,OAAO,YAAY;CACpB;AAED,eAAO,MAAM,wBAAwB,sCAAmC,CAAC;AAEzE,eAAO,MAAM,oBAAoB;;;;;;;;;4BAe/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAUlE,oBAAY,cAAc;IACxB,MAAM,WAAW;IACjB,QAAQ,aAAa;CACtB;AAED,eAAO,MAAM,oBAAoB,kCAA+B,CAAC;AAGjE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;kBAyC9B,CAAC;AACL,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAGpE,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;kBAOtB,CAAC;AACZ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AASlE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;kBA2BhC,CAAC;AACL,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAyBxE,oBAAY,qBAAqB;IAE/B,QAAQ,aAAa;IAErB,WAAW,gBAAgB;CAC5B;AAED,MAAM,MAAM,cAAc,GACtB;IACE,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC,QAAQ,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;CACtC,GACD;IACE,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC,WAAW,CAAC;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAGN,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,CAExE;AASD,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,CAUxE;AAMD,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAK5E"}

package/dist/retention/lib/legal-hold.js

@@ -0,0 +1,131 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LegalHoldProbeOutcome = exports.LegalHoldDecisionSchema = exports.LegalHoldMatchSchema = exports.LegalHoldRecordSchema = exports.LegalHoldStateSchema = exports.LegalHoldState = exports.LegalHoldScopeSchema = exports.LegalHoldScopeKindSchema = exports.LegalHoldScopeKind = void 0;
+exports.unavailableLegalHoldProbe = unavailableLegalHoldProbe;
+exports.legalHoldProbeFromResponse = legalHoldProbeFromResponse;
+exports.isRetentionBlockedByLegalHold = isRetentionBlockedByLegalHold;
+const zod_1 = require("zod");
+const primitives_1 = require("./primitives");
+const subject_1 = require("./subject");
+const LEGAL_HOLD_MATCHES_MAX = 100;
+var LegalHoldScopeKind;
+(function (LegalHoldScopeKind) {
+    LegalHoldScopeKind["Org"] = "org";
+    LegalHoldScopeKind["SubjectClass"] = "subject_class";
+    LegalHoldScopeKind["Subject"] = "subject";
+})(LegalHoldScopeKind || (exports.LegalHoldScopeKind = LegalHoldScopeKind = {}));
+exports.LegalHoldScopeKindSchema = zod_1.z.nativeEnum(LegalHoldScopeKind);
+exports.LegalHoldScopeSchema = zod_1.z.discriminatedUnion('kind', [
+    zod_1.z.object({ kind: zod_1.z.literal(LegalHoldScopeKind.Org) }).strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal(LegalHoldScopeKind.SubjectClass),
+        subjectClass: subject_1.RetentionSubjectClassSchema,
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal(LegalHoldScopeKind.Subject),
+        subjectClass: subject_1.RetentionSubjectClassSchema,
+        subjectId: primitives_1.RetentionIdentifierSchema,
+    })
+        .strict(),
+]);
+var LegalHoldState;
+(function (LegalHoldState) {
+    LegalHoldState["Active"] = "active";
+    LegalHoldState["Released"] = "released";
+})(LegalHoldState || (exports.LegalHoldState = LegalHoldState = {}));
+exports.LegalHoldStateSchema = zod_1.z.nativeEnum(LegalHoldState);
+exports.LegalHoldRecordSchema = zod_1.z
+    .object({
+    apiVersion: primitives_1.RetentionApiVersionSchema,
+    kind: zod_1.z.literal('legal_hold'),
+    holdId: primitives_1.RetentionIdentifierSchema,
+    orgId: primitives_1.RetentionIdentifierSchema,
+    matterRef: primitives_1.RetentionIdentifierSchema,
+    scope: exports.LegalHoldScopeSchema,
+    reason: zod_1.z.string().min(1).max(2000),
+    placedBy: primitives_1.RetentionIdentifierSchema,
+    placedAt: primitives_1.RetentionTimestampSchema,
+    state: exports.LegalHoldStateSchema,
+    releasedBy: primitives_1.RetentionIdentifierSchema.nullable(),
+    releasedAt: primitives_1.RetentionTimestampSchema.nullable(),
+    releaseReason: zod_1.z.string().min(1).max(2000).nullable(),
+})
+    .strict()
+    .superRefine((hold, context) => {
+    const releaseFields = [
+        hold.releasedBy,
+        hold.releasedAt,
+        hold.releaseReason,
+    ];
+    const released = hold.state === LegalHoldState.Released;
+    if (released && releaseFields.some((field) => field === null)) {
+        context.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['state'],
+            message: 'A released hold must record who released it, when, and why — the release is evidence too.',
+        });
+    }
+    if (!released && releaseFields.some((field) => field !== null)) {
+        context.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['state'],
+            message: 'An active hold must not carry release provenance.',
+        });
+    }
+});
+exports.LegalHoldMatchSchema = zod_1.z
+    .object({
+    holdId: primitives_1.RetentionIdentifierSchema,
+    matterRef: primitives_1.RetentionIdentifierSchema,
+    scope: exports.LegalHoldScopeSchema,
+    placedAt: primitives_1.RetentionTimestampSchema,
+})
+    .strict();
+exports.LegalHoldDecisionSchema = zod_1.z
+    .object({
+    apiVersion: primitives_1.RetentionApiVersionSchema,
+    kind: zod_1.z.literal('legal_hold_decision'),
+    orgId: primitives_1.RetentionIdentifierSchema,
+    subject: subject_1.RetentionSubjectRefSchema,
+    held: zod_1.z.boolean(),
+    holds: zod_1.z.array(exports.LegalHoldMatchSchema).max(LEGAL_HOLD_MATCHES_MAX),
+    truncated: zod_1.z.boolean(),
+    resolvedAt: primitives_1.RetentionTimestampSchema,
+})
+    .strict()
+    .superRefine((decision, context) => {
+    if (decision.held !== decision.holds.length > 0) {
+        context.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['held'],
+            message: '`held` must agree with the cited holds — a verdict with no citation is not evidence.',
+        });
+    }
+});
+var LegalHoldProbeOutcome;
+(function (LegalHoldProbeOutcome) {
+    LegalHoldProbeOutcome["Resolved"] = "resolved";
+    LegalHoldProbeOutcome["Unavailable"] = "unavailable";
+})(LegalHoldProbeOutcome || (exports.LegalHoldProbeOutcome = LegalHoldProbeOutcome = {}));
+function unavailableLegalHoldProbe(reason) {
+    return { outcome: LegalHoldProbeOutcome.Unavailable, reason };
+}
+function legalHoldProbeFromResponse(body) {
+    const parsed = exports.LegalHoldDecisionSchema.safeParse(body);
+    if (!parsed.success) {
+        return unavailableLegalHoldProbe(`legal-hold decision did not parse: ${parsed.error.issues
+            .map((issue) => `${issue.path.join('.') || '<root>'}: ${issue.message}`)
+            .join('; ')}`);
+    }
+    return { outcome: LegalHoldProbeOutcome.Resolved, decision: parsed.data };
+}
+function isRetentionBlockedByLegalHold(probe) {
+    if (probe.outcome !== LegalHoldProbeOutcome.Resolved) {
+        return true;
+    }
+    return probe.decision.held;
+}
+//# sourceMappingURL=legal-hold.js.map

package/dist/retention/lib/legal-hold.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legal-hold.js","sourceRoot":"","sources":["../../../src/retention/lib/legal-hold.ts"],"names":[],"mappings":";;;AAsMA,8DAEC;AASD,gEAUC;AAMD,sEAKC;AAtOD,6BAAwB;AAExB,6CAIsB;AACtB,uCAGmB;AAEnB,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAWnC,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC5B,iCAAW,CAAA;IACX,oDAA8B,CAAA;IAC9B,yCAAmB,CAAA;AACrB,CAAC,EAJW,kBAAkB,kCAAlB,kBAAkB,QAI7B;AAEY,QAAA,wBAAwB,GAAG,OAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;AAE5D,QAAA,oBAAoB,GAAG,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC/D,OAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IAC9D,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,YAAY,CAAC;QAChD,YAAY,EAAE,qCAA2B;KAC1C,CAAC;SACD,MAAM,EAAE;IACX,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC;QAC3C,YAAY,EAAE,qCAA2B;QACzC,SAAS,EAAE,sCAAyB;KACrC,CAAC;SACD,MAAM,EAAE;CACZ,CAAC,CAAC;AAWH,IAAY,cAGX;AAHD,WAAY,cAAc;IACxB,mCAAiB,CAAA;IACjB,uCAAqB,CAAA;AACvB,CAAC,EAHW,cAAc,8BAAd,cAAc,QAGzB;AAEY,QAAA,oBAAoB,GAAG,OAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AAGpD,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,UAAU,EAAE,sCAAyB;IACrC,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC7B,MAAM,EAAE,sCAAyB;IAEjC,KAAK,EAAE,sCAAyB;IAEhC,SAAS,EAAE,sCAAyB;IACpC,KAAK,EAAE,4BAAoB;IAC3B,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACnC,QAAQ,EAAE,sCAAyB;IACnC,QAAQ,EAAE,qCAAwB;IAClC,KAAK,EAAE,4BAAoB;IAC3B,UAAU,EAAE,sCAAyB,CAAC,QAAQ,EAAE;IAChD,UAAU,EAAE,qCAAwB,CAAC,QAAQ,EAAE;IAC/C,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;IAC7B,MAAM,aAAa,GAAG;QACpB,IAAI,CAAC,UAAU;QACf,IAAI,CAAC,UAAU;QACf,IAAI,CAAC,aAAa;KACnB,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,KAAK,cAAc,CAAC,QAAQ,CAAC;IACxD,IAAI,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC;QAC9D,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,OAAO,CAAC;YACf,OAAO,EACL,2FAA2F;SAC9F,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/D,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,OAAO,CAAC;YACf,OAAO,EAAE,mDAAmD;SAC7D,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIQ,QAAA,oBAAoB,GAAG,OAAC;KAClC,MAAM,CAAC;IACN,MAAM,EAAE,sCAAyB;IACjC,SAAS,EAAE,sCAAyB;IACpC,KAAK,EAAE,4BAAoB;IAC3B,QAAQ,EAAE,qCAAwB;CACnC,CAAC;KACD,MAAM,EAAE,CAAC;AAUC,QAAA,uBAAuB,GAAG,OAAC;KACrC,MAAM,CAAC;IACN,UAAU,EAAE,sCAAyB;IACrC,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;IACtC,KAAK,EAAE,sCAAyB;IAChC,OAAO,EAAE,mCAAyB;IAClC,IAAI,EAAE,OAAC,CAAC,OAAO,EAAE;IACjB,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,4BAAoB,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAOhE,SAAS,EAAE,OAAC,CAAC,OAAO,EAAE;IACtB,UAAU,EAAE,qCAAwB;CACrC,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;IACjC,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,MAAM,CAAC;YACd,OAAO,EACL,sFAAsF;SACzF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AA0BL,IAAY,qBAKX;AALD,WAAY,qBAAqB;IAE/B,8CAAqB,CAAA;IAErB,oDAA2B,CAAA;AAC7B,CAAC,EALW,qBAAqB,qCAArB,qBAAqB,QAKhC;AAaD,SAAgB,yBAAyB,CAAC,MAAc;IACtD,OAAO,EAAE,OAAO,EAAE,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;AAChE,CAAC;AASD,SAAgB,0BAA0B,CAAC,IAAa;IACtD,MAAM,MAAM,GAAG,+BAAuB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,yBAAyB,CAC9B,sCAAsC,MAAM,CAAC,KAAK,CAAC,MAAM;aACtD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;aACvE,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC5E,CAAC;AAMD,SAAgB,6BAA6B,CAAC,KAAqB;IACjE,IAAI,KAAK,CAAC,OAAO,KAAK,qBAAqB,CAAC,QAAQ,EAAE,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;AAC7B,CAAC"}

package/dist/retention/lib/policy.d.ts

@@ -0,0 +1,152 @@
+import { z } from 'zod';
+import { ResourcePolicySourceKind } from '../../resource-accounting';
+export declare enum RetentionRuleRole {
+    Floor = "floor",
+    Ceiling = "ceiling",
+    Choice = "choice"
+}
+export declare const RetentionRuleRoleSchema: z.ZodEnum<typeof RetentionRuleRole>;
+export declare const RETENTION_ROLE_SOURCE_KINDS: Readonly<Record<RetentionRuleRole, readonly ResourcePolicySourceKind[]>>;
+export declare function isRetentionRoleAllowedForSource(role: RetentionRuleRole, sourceKind: ResourcePolicySourceKind): boolean;
+export declare const RetentionRuleSchema: z.ZodObject<{
+    ruleId: z.ZodString;
+    subjectClass: z.ZodEnum<typeof import("./subject").RetentionSubjectClass>;
+    role: z.ZodEnum<typeof RetentionRuleRole>;
+    windowDays: z.ZodNumber;
+}, z.core.$strict>;
+export type RetentionRule = z.infer<typeof RetentionRuleSchema>;
+export declare const RetentionPolicyBundleSchema: z.ZodObject<{
+    apiVersion: z.ZodLiteral<"xema.retention/v1">;
+    kind: z.ZodLiteral<"retention_policy_bundle">;
+    policyKey: z.ZodString;
+    revision: z.ZodNumber;
+    displayName: z.ZodString;
+    rules: z.ZodArray<z.ZodObject<{
+        ruleId: z.ZodString;
+        subjectClass: z.ZodEnum<typeof import("./subject").RetentionSubjectClass>;
+        role: z.ZodEnum<typeof RetentionRuleRole>;
+        windowDays: z.ZodNumber;
+    }, z.core.$strict>>;
+    createdAt: z.ZodString;
+}, z.core.$strict>;
+export type RetentionPolicyBundle = z.infer<typeof RetentionPolicyBundleSchema>;
+export interface RetentionBounds {
+    readonly floorDays: number | null;
+    readonly ceilingDays: number | null;
+}
+export declare class RetentionBoundsContradictionError extends Error {
+    readonly floorDays: number;
+    readonly ceilingDays: number;
+    constructor(floorDays: number, ceilingDays: number);
+}
+export declare function areRetentionBoundsSatisfiable(bounds: RetentionBounds): boolean;
+export declare enum RetentionBoundsViolation {
+    BelowFloor = "below_floor",
+    AboveCeiling = "above_ceiling"
+}
+export declare function checkRetentionChoiceWithinBounds(choiceDays: number, bounds: RetentionBounds): RetentionBoundsViolation | null;
+export declare function clampRetentionDays(choiceDays: number, bounds: RetentionBounds): number;
+export declare const RetentionProvenanceEntrySchema: z.ZodObject<{
+    assignmentId: z.ZodString;
+    assignmentKey: z.ZodString;
+    assignmentRevision: z.ZodNumber;
+    bundleId: z.ZodString;
+    bundleKey: z.ZodString;
+    bundleRevision: z.ZodNumber;
+    ruleId: z.ZodString;
+    role: z.ZodEnum<typeof RetentionRuleRole>;
+    sourceKind: z.ZodEnum<typeof ResourcePolicySourceKind>;
+    sourceRef: z.ZodString;
+    scopeKind: z.ZodEnum<typeof import("./primitives").RetentionScopeKind>;
+    scopeRef: z.ZodString;
+    orgId: z.ZodNullable<z.ZodString>;
+    windowDays: z.ZodNumber;
+    pointerRevision: z.ZodString;
+}, z.core.$strict>;
+export type RetentionProvenanceEntry = z.infer<typeof RetentionProvenanceEntrySchema>;
+export declare const EffectiveRetentionSchema: z.ZodObject<{
+    apiVersion: z.ZodLiteral<"xema.retention/v1">;
+    kind: z.ZodLiteral<"effective_retention">;
+    orgId: z.ZodString;
+    subjectClass: z.ZodEnum<typeof import("./subject").RetentionSubjectClass>;
+    configured: z.ZodBoolean;
+    effectiveDays: z.ZodNullable<z.ZodNumber>;
+    floorDays: z.ZodNullable<z.ZodNumber>;
+    ceilingDays: z.ZodNullable<z.ZodNumber>;
+    chosenDays: z.ZodNullable<z.ZodNumber>;
+    clamped: z.ZodBoolean;
+    policyWatermark: z.ZodString;
+    provenance: z.ZodObject<{
+        floor: z.ZodNullable<z.ZodObject<{
+            assignmentId: z.ZodString;
+            assignmentKey: z.ZodString;
+            assignmentRevision: z.ZodNumber;
+            bundleId: z.ZodString;
+            bundleKey: z.ZodString;
+            bundleRevision: z.ZodNumber;
+            ruleId: z.ZodString;
+            role: z.ZodEnum<typeof RetentionRuleRole>;
+            sourceKind: z.ZodEnum<typeof ResourcePolicySourceKind>;
+            sourceRef: z.ZodString;
+            scopeKind: z.ZodEnum<typeof import("./primitives").RetentionScopeKind>;
+            scopeRef: z.ZodString;
+            orgId: z.ZodNullable<z.ZodString>;
+            windowDays: z.ZodNumber;
+            pointerRevision: z.ZodString;
+        }, z.core.$strict>>;
+        ceiling: z.ZodNullable<z.ZodObject<{
+            assignmentId: z.ZodString;
+            assignmentKey: z.ZodString;
+            assignmentRevision: z.ZodNumber;
+            bundleId: z.ZodString;
+            bundleKey: z.ZodString;
+            bundleRevision: z.ZodNumber;
+            ruleId: z.ZodString;
+            role: z.ZodEnum<typeof RetentionRuleRole>;
+            sourceKind: z.ZodEnum<typeof ResourcePolicySourceKind>;
+            sourceRef: z.ZodString;
+            scopeKind: z.ZodEnum<typeof import("./primitives").RetentionScopeKind>;
+            scopeRef: z.ZodString;
+            orgId: z.ZodNullable<z.ZodString>;
+            windowDays: z.ZodNumber;
+            pointerRevision: z.ZodString;
+        }, z.core.$strict>>;
+        choice: z.ZodNullable<z.ZodObject<{
+            assignmentId: z.ZodString;
+            assignmentKey: z.ZodString;
+            assignmentRevision: z.ZodNumber;
+            bundleId: z.ZodString;
+            bundleKey: z.ZodString;
+            bundleRevision: z.ZodNumber;
+            ruleId: z.ZodString;
+            role: z.ZodEnum<typeof RetentionRuleRole>;
+            sourceKind: z.ZodEnum<typeof ResourcePolicySourceKind>;
+            sourceRef: z.ZodString;
+            scopeKind: z.ZodEnum<typeof import("./primitives").RetentionScopeKind>;
+            scopeRef: z.ZodString;
+            orgId: z.ZodNullable<z.ZodString>;
+            windowDays: z.ZodNumber;
+            pointerRevision: z.ZodString;
+        }, z.core.$strict>>;
+        considered: z.ZodArray<z.ZodObject<{
+            assignmentId: z.ZodString;
+            assignmentKey: z.ZodString;
+            assignmentRevision: z.ZodNumber;
+            bundleId: z.ZodString;
+            bundleKey: z.ZodString;
+            bundleRevision: z.ZodNumber;
+            ruleId: z.ZodString;
+            role: z.ZodEnum<typeof RetentionRuleRole>;
+            sourceKind: z.ZodEnum<typeof ResourcePolicySourceKind>;
+            sourceRef: z.ZodString;
+            scopeKind: z.ZodEnum<typeof import("./primitives").RetentionScopeKind>;
+            scopeRef: z.ZodString;
+            orgId: z.ZodNullable<z.ZodString>;
+            windowDays: z.ZodNumber;
+            pointerRevision: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    resolvedAt: z.ZodString;
+}, z.core.$strict>;
+export type EffectiveRetention = z.infer<typeof EffectiveRetentionSchema>;
+//# sourceMappingURL=policy.d.ts.map

package/dist/retention/lib/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/retention/lib/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAcrE,oBAAY,iBAAiB;IAE3B,KAAK,UAAU;IAEf,OAAO,YAAY;IAEnB,MAAM,WAAW;CAClB;AAED,eAAO,MAAM,uBAAuB,qCAAkC,CAAC;AAavE,eAAO,MAAM,2BAA2B,EAAE,QAAQ,CAChD,MAAM,CAAC,iBAAiB,EAAE,SAAS,wBAAwB,EAAE,CAAC,CAkB/D,CAAC;AAEF,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,iBAAiB,EACvB,UAAU,EAAE,wBAAwB,GACnC,OAAO,CAET;AAGD,eAAO,MAAM,mBAAmB;;;;;kBAOrB,CAAC;AACZ,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;kBAoBpC,CAAC;AACL,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAShF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAQD,qBAAa,iCAAkC,SAAQ,KAAK;IAC1D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;gBAEjB,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM;CAUnD;AAED,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,eAAe,GACtB,OAAO,CAKT;AAGD,oBAAY,wBAAwB;IAClC,UAAU,gBAAgB;IAC1B,YAAY,kBAAkB;CAC/B;AAOD,wBAAgB,gCAAgC,CAC9C,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,eAAe,GACtB,wBAAwB,GAAG,IAAI,CAQjC;AAcD,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,eAAe,GACtB,MAAM,CAgBR;AAGD,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;kBAmBhC,CAAC;AACZ,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,8BAA8B,CACtC,CAAC;AASF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA4CjC,CAAC;AACL,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}