feat: govern legacy archive encryption

webui/src/api/campaigns.ts

@@ -38,6 +38,24 @@ export type CampaignShare = {
 export type CampaignShareTarget = {id: string;name: string;secondary?: string | null;};
 export type CampaignShareTargets = {users: CampaignShareTarget[];groups: CampaignShareTarget[];};
 
+export type CampaignArchiveEncryptionPolicy = {
+  available: boolean;
+  allowed_password_encryption_methods: Array<"aes" | "zip_standard">;
+  allowed_password_delivery_channels: Array<"separate_mail" | "sms" | "letter" | "phone" | "in_person">;
+  policy_hash: string;
+  source_path: Array<{
+    scope_type: string;
+    scope_id?: string | null;
+    path: string;
+    label: string;
+    applied_fields: string[];
+    policy: Record<string, unknown>;
+  }>;
+  reason: string;
+  diagnostics: Array<Record<string, unknown>>;
+  legacy_label: string;
+};
+
 export type CampaignUpdatePayload = {
   external_id?: string | null;
   name?: string | null;
@@ -1141,6 +1159,16 @@ export async function getCampaign(settings: ApiSettings, campaignId: string): Pr
   return apiFetch<CampaignListItem>(settings, `/api/v1/campaigns/${campaignId}`);
 }
 
+export async function getCampaignArchiveEncryptionPolicy(
+  settings: ApiSettings,
+  campaignId: string
+): Promise<CampaignArchiveEncryptionPolicy> {
+  return apiFetch<CampaignArchiveEncryptionPolicy>(
+    settings,
+    `/api/v1/campaigns/${encodeURIComponent(campaignId)}/archive-encryption-policy`
+  );
+}
+
 export async function updateCampaignMetadata(
 settings: ApiSettings,
 campaignId: string,