@opentdf/sdk 0.17.0 → 0.19.0-beta.167

package/src/platform/entityresolution/entity_resolution_pb.ts

@@ -8,14 +8,13 @@ import type { Entity, EntityChain, Token } from "../authorization/authorization_
 import { file_authorization_authorization } from "../authorization/authorization_pb.js";
 import type { Any } from "@bufbuild/protobuf/wkt";
 import { file_google_protobuf_any, file_google_protobuf_struct } from "@bufbuild/protobuf/wkt";
-import { file_google_api_annotations } from "../google/api/annotations_pb.js";
 import type { JsonObject, Message } from "@bufbuild/protobuf";
 
 /**
  * Describes the file entityresolution/entity_resolution.proto.
  */
 export const file_entityresolution_entity_resolution: GenFile = /*@__PURE__*/
-  fileDesc("CihlbnRpdHlyZXNvbHV0aW9uL2VudGl0eV9yZXNvbHV0aW9uLnByb3RvEhBlbnRpdHlyZXNvbHV0aW9uIkEKFlJlc29sdmVFbnRpdGllc1JlcXVlc3QSJwoIZW50aXRpZXMYASADKAsyFS5hdXRob3JpemF0aW9uLkVudGl0eSJeChRFbnRpdHlSZXByZXNlbnRhdGlvbhIxChBhZGRpdGlvbmFsX3Byb3BzGAEgAygLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdBITCgtvcmlnaW5hbF9pZBgCIAEoCSJhChdSZXNvbHZlRW50aXRpZXNSZXNwb25zZRJGChZlbnRpdHlfcmVwcmVzZW50YXRpb25zGAEgAygLMiYuZW50aXR5cmVzb2x1dGlvbi5FbnRpdHlSZXByZXNlbnRhdGlvbiJrChNFbnRpdHlOb3RGb3VuZEVycm9yEgwKBGNvZGUYASABKAUSDwoHbWVzc2FnZRgCIAEoCRIlCgdkZXRhaWxzGAMgAygLMhQuZ29vZ2xlLnByb3RvYnVmLkFueRIOCgZlbnRpdHkYBCABKAkiRwofQ3JlYXRlRW50aXR5Q2hhaW5Gcm9tSnd0UmVxdWVzdBIkCgZ0b2tlbnMYASADKAsyFC5hdXRob3JpemF0aW9uLlRva2VuIlUKIENyZWF0ZUVudGl0eUNoYWluRnJvbUp3dFJlc3BvbnNlEjEKDWVudGl0eV9jaGFpbnMYASADKAsyGi5hdXRob3JpemF0aW9uLkVudGl0eUNoYWluMtYCChdFbnRpdHlSZXNvbHV0aW9uU2VydmljZRKMAQoPUmVzb2x2ZUVudGl0aWVzEiguZW50aXR5cmVzb2x1dGlvbi5SZXNvbHZlRW50aXRpZXNSZXF1ZXN0GikuZW50aXR5cmVzb2x1dGlvbi5SZXNvbHZlRW50aXRpZXNSZXNwb25zZSIkgtPkkwIeOgEqIhkvZW50aXR5cmVzb2x1dGlvbi9yZXNvbHZlEqsBChhDcmVhdGVFbnRpdHlDaGFpbkZyb21Kd3QSMS5lbnRpdHlyZXNvbHV0aW9uLkNyZWF0ZUVudGl0eUNoYWluRnJvbUp3dFJlcXVlc3QaMi5lbnRpdHlyZXNvbHV0aW9uLkNyZWF0ZUVudGl0eUNoYWluRnJvbUp3dFJlc3BvbnNlIiiC0+STAiI6ASoiHS9lbnRpdHlyZXNvbHV0aW9uL2VudGl0eWNoYWluYgZwcm90bzM", [file_authorization_authorization, file_google_protobuf_struct, file_google_protobuf_any, file_google_api_annotations]);
+  fileDesc("CihlbnRpdHlyZXNvbHV0aW9uL2VudGl0eV9yZXNvbHV0aW9uLnByb3RvEhBlbnRpdHlyZXNvbHV0aW9uIkEKFlJlc29sdmVFbnRpdGllc1JlcXVlc3QSJwoIZW50aXRpZXMYASADKAsyFS5hdXRob3JpemF0aW9uLkVudGl0eSJeChRFbnRpdHlSZXByZXNlbnRhdGlvbhIxChBhZGRpdGlvbmFsX3Byb3BzGAEgAygLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdBITCgtvcmlnaW5hbF9pZBgCIAEoCSJhChdSZXNvbHZlRW50aXRpZXNSZXNwb25zZRJGChZlbnRpdHlfcmVwcmVzZW50YXRpb25zGAEgAygLMiYuZW50aXR5cmVzb2x1dGlvbi5FbnRpdHlSZXByZXNlbnRhdGlvbiJrChNFbnRpdHlOb3RGb3VuZEVycm9yEgwKBGNvZGUYASABKAUSDwoHbWVzc2FnZRgCIAEoCRIlCgdkZXRhaWxzGAMgAygLMhQuZ29vZ2xlLnByb3RvYnVmLkFueRIOCgZlbnRpdHkYBCABKAkiRwofQ3JlYXRlRW50aXR5Q2hhaW5Gcm9tSnd0UmVxdWVzdBIkCgZ0b2tlbnMYASADKAsyFC5hdXRob3JpemF0aW9uLlRva2VuIlUKIENyZWF0ZUVudGl0eUNoYWluRnJvbUp3dFJlc3BvbnNlEjEKDWVudGl0eV9jaGFpbnMYASADKAsyGi5hdXRob3JpemF0aW9uLkVudGl0eUNoYWluMokCChdFbnRpdHlSZXNvbHV0aW9uU2VydmljZRJoCg9SZXNvbHZlRW50aXRpZXMSKC5lbnRpdHlyZXNvbHV0aW9uLlJlc29sdmVFbnRpdGllc1JlcXVlc3QaKS5lbnRpdHlyZXNvbHV0aW9uLlJlc29sdmVFbnRpdGllc1Jlc3BvbnNlIgASgwEKGENyZWF0ZUVudGl0eUNoYWluRnJvbUp3dBIxLmVudGl0eXJlc29sdXRpb24uQ3JlYXRlRW50aXR5Q2hhaW5Gcm9tSnd0UmVxdWVzdBoyLmVudGl0eXJlc29sdXRpb24uQ3JlYXRlRW50aXR5Q2hhaW5Gcm9tSnd0UmVzcG9uc2UiAGIGcHJvdG8z", [file_authorization_authorization, file_google_protobuf_any, file_google_protobuf_struct]);
 
 /**
  *

package/src/platform/entityresolution/v2/entity_resolution_pb.ts

@@ -9,13 +9,39 @@ import type { Entity, EntityChain, Token } from "../../entity/entity_pb.js";
 import { file_entity_entity } from "../../entity/entity_pb.js";
 import type { Any } from "@bufbuild/protobuf/wkt";
 import { file_google_protobuf_any, file_google_protobuf_struct } from "@bufbuild/protobuf/wkt";
+import type { Resource } from "../../authorization/v2/authorization_pb.js";
+import { file_authorization_v2_authorization } from "../../authorization/v2/authorization_pb.js";
 import type { JsonObject, Message } from "@bufbuild/protobuf";
 
 /**
  * Describes the file entityresolution/v2/entity_resolution.proto.
  */
 export const file_entityresolution_v2_entity_resolution: GenFile = /*@__PURE__*/
-  fileDesc("CitlbnRpdHlyZXNvbHV0aW9uL3YyL2VudGl0eV9yZXNvbHV0aW9uLnByb3RvEhNlbnRpdHlyZXNvbHV0aW9uLnYyIl4KFEVudGl0eVJlcHJlc2VudGF0aW9uEhMKC29yaWdpbmFsX2lkGAEgASgJEjEKEGFkZGl0aW9uYWxfcHJvcHMYAiADKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0IkcKFlJlc29sdmVFbnRpdGllc1JlcXVlc3QSLQoIZW50aXRpZXMYASADKAsyDi5lbnRpdHkuRW50aXR5Qgu6SAjIAQGSAQIIASJkChdSZXNvbHZlRW50aXRpZXNSZXNwb25zZRJJChZlbnRpdHlfcmVwcmVzZW50YXRpb25zGAEgAygLMikuZW50aXR5cmVzb2x1dGlvbi52Mi5FbnRpdHlSZXByZXNlbnRhdGlvbiJrChNFbnRpdHlOb3RGb3VuZEVycm9yEgwKBGNvZGUYASABKAUSDwoHbWVzc2FnZRgCIAEoCRIlCgdkZXRhaWxzGAMgAygLMhQuZ29vZ2xlLnByb3RvYnVmLkFueRIOCgZlbnRpdHkYBCABKAkiRAojQ3JlYXRlRW50aXR5Q2hhaW5zRnJvbVRva2Vuc1JlcXVlc3QSHQoGdG9rZW5zGAEgAygLMg0uZW50aXR5LlRva2VuIlIKJENyZWF0ZUVudGl0eUNoYWluc0Zyb21Ub2tlbnNSZXNwb25zZRIqCg1lbnRpdHlfY2hhaW5zGAEgAygLMhMuZW50aXR5LkVudGl0eUNoYWluMqECChdFbnRpdHlSZXNvbHV0aW9uU2VydmljZRJuCg9SZXNvbHZlRW50aXRpZXMSKy5lbnRpdHlyZXNvbHV0aW9uLnYyLlJlc29sdmVFbnRpdGllc1JlcXVlc3QaLC5lbnRpdHlyZXNvbHV0aW9uLnYyLlJlc29sdmVFbnRpdGllc1Jlc3BvbnNlIgASlQEKHENyZWF0ZUVudGl0eUNoYWluc0Zyb21Ub2tlbnMSOC5lbnRpdHlyZXNvbHV0aW9uLnYyLkNyZWF0ZUVudGl0eUNoYWluc0Zyb21Ub2tlbnNSZXF1ZXN0GjkuZW50aXR5cmVzb2x1dGlvbi52Mi5DcmVhdGVFbnRpdHlDaGFpbnNGcm9tVG9rZW5zUmVzcG9uc2UiAGIGcHJvdG8z", [file_buf_validate_validate, file_entity_entity, file_google_protobuf_any, file_google_protobuf_struct]);
+  fileDesc("CitlbnRpdHlyZXNvbHV0aW9uL3YyL2VudGl0eV9yZXNvbHV0aW9uLnByb3RvEhNlbnRpdHlyZXNvbHV0aW9uLnYyIkEKEURpcmVjdEVudGl0bGVtZW50EhsKE2F0dHJpYnV0ZV92YWx1ZV9mcW4YASABKAkSDwoHYWN0aW9ucxgCIAMoCSKjAQoURW50aXR5UmVwcmVzZW50YXRpb24SEwoLb3JpZ2luYWxfaWQYASABKAkSMQoQYWRkaXRpb25hbF9wcm9wcxgCIAMoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3QSQwoTZGlyZWN0X2VudGl0bGVtZW50cxgDIAMoCzImLmVudGl0eXJlc29sdXRpb24udjIuRGlyZWN0RW50aXRsZW1lbnQiRwoWUmVzb2x2ZUVudGl0aWVzUmVxdWVzdBItCghlbnRpdGllcxgBIAMoCzIOLmVudGl0eS5FbnRpdHlCC7pICMgBAZIBAggBImQKF1Jlc29sdmVFbnRpdGllc1Jlc3BvbnNlEkkKFmVudGl0eV9yZXByZXNlbnRhdGlvbnMYASADKAsyKS5lbnRpdHlyZXNvbHV0aW9uLnYyLkVudGl0eVJlcHJlc2VudGF0aW9uImsKE0VudGl0eU5vdEZvdW5kRXJyb3ISDAoEY29kZRgBIAEoBRIPCgdtZXNzYWdlGAIgASgJEiUKB2RldGFpbHMYAyADKAsyFC5nb29nbGUucHJvdG9idWYuQW55Eg4KBmVudGl0eRgEIAEoCSJzCiNDcmVhdGVFbnRpdHlDaGFpbnNGcm9tVG9rZW5zUmVxdWVzdBIdCgZ0b2tlbnMYASADKAsyDS5lbnRpdHkuVG9rZW4SLQoJcmVzb3VyY2VzGAIgAygLMhouYXV0aG9yaXphdGlvbi52Mi5SZXNvdXJjZSJSCiRDcmVhdGVFbnRpdHlDaGFpbnNGcm9tVG9rZW5zUmVzcG9uc2USKgoNZW50aXR5X2NoYWlucxgBIAMoCzITLmVudGl0eS5FbnRpdHlDaGFpbjKhAgoXRW50aXR5UmVzb2x1dGlvblNlcnZpY2USbgoPUmVzb2x2ZUVudGl0aWVzEisuZW50aXR5cmVzb2x1dGlvbi52Mi5SZXNvbHZlRW50aXRpZXNSZXF1ZXN0GiwuZW50aXR5cmVzb2x1dGlvbi52Mi5SZXNvbHZlRW50aXRpZXNSZXNwb25zZSIAEpUBChxDcmVhdGVFbnRpdHlDaGFpbnNGcm9tVG9rZW5zEjguZW50aXR5cmVzb2x1dGlvbi52Mi5DcmVhdGVFbnRpdHlDaGFpbnNGcm9tVG9rZW5zUmVxdWVzdBo5LmVudGl0eXJlc29sdXRpb24udjIuQ3JlYXRlRW50aXR5Q2hhaW5zRnJvbVRva2Vuc1Jlc3BvbnNlIgBiBnByb3RvMw", [file_buf_validate_validate, file_entity_entity, file_google_protobuf_any, file_google_protobuf_struct, file_authorization_v2_authorization]);
+
+/**
+ * Entity Entitlements that do not require subject mappings (experimental)
+ *
+ * @generated from message entityresolution.v2.DirectEntitlement
+ */
+export type DirectEntitlement = Message<"entityresolution.v2.DirectEntitlement"> & {
+  /**
+   * @generated from field: string attribute_value_fqn = 1;
+   */
+  attributeValueFqn: string;
+
+  /**
+   * @generated from field: repeated string actions = 2;
+   */
+  actions: string[];
+};
+
+/**
+ * Describes the message entityresolution.v2.DirectEntitlement.
+ * Use `create(DirectEntitlementSchema)` to create a new message.
+ */
+export const DirectEntitlementSchema: GenMessage<DirectEntitlement> = /*@__PURE__*/
+  messageDesc(file_entityresolution_v2_entity_resolution, 0);
 
 /**
  * @generated from message entityresolution.v2.EntityRepresentation
@@ -32,6 +58,13 @@ export type EntityRepresentation = Message<"entityresolution.v2.EntityRepresenta
    * @generated from field: repeated google.protobuf.Struct additional_props = 2;
    */
   additionalProps: JsonObject[];
+
+  /**
+   * direct entitlements applied to Entity (experimental)
+   *
+   * @generated from field: repeated entityresolution.v2.DirectEntitlement direct_entitlements = 3;
+   */
+  directEntitlements: DirectEntitlement[];
 };
 
 /**
@@ -39,7 +72,7 @@ export type EntityRepresentation = Message<"entityresolution.v2.EntityRepresenta
  * Use `create(EntityRepresentationSchema)` to create a new message.
  */
 export const EntityRepresentationSchema: GenMessage<EntityRepresentation> = /*@__PURE__*/
-  messageDesc(file_entityresolution_v2_entity_resolution, 0);
+  messageDesc(file_entityresolution_v2_entity_resolution, 1);
 
 /**
  * Resolve a set of entities to their representations.
@@ -58,7 +91,7 @@ export type ResolveEntitiesRequest = Message<"entityresolution.v2.ResolveEntitie
  * Use `create(ResolveEntitiesRequestSchema)` to create a new message.
  */
 export const ResolveEntitiesRequestSchema: GenMessage<ResolveEntitiesRequest> = /*@__PURE__*/
-  messageDesc(file_entityresolution_v2_entity_resolution, 1);
+  messageDesc(file_entityresolution_v2_entity_resolution, 2);
 
 /**
  * @generated from message entityresolution.v2.ResolveEntitiesResponse
@@ -75,7 +108,7 @@ export type ResolveEntitiesResponse = Message<"entityresolution.v2.ResolveEntiti
  * Use `create(ResolveEntitiesResponseSchema)` to create a new message.
  */
 export const ResolveEntitiesResponseSchema: GenMessage<ResolveEntitiesResponse> = /*@__PURE__*/
-  messageDesc(file_entityresolution_v2_entity_resolution, 2);
+  messageDesc(file_entityresolution_v2_entity_resolution, 3);
 
 /**
  * @generated from message entityresolution.v2.EntityNotFoundError
@@ -107,7 +140,7 @@ export type EntityNotFoundError = Message<"entityresolution.v2.EntityNotFoundErr
  * Use `create(EntityNotFoundErrorSchema)` to create a new message.
  */
 export const EntityNotFoundErrorSchema: GenMessage<EntityNotFoundError> = /*@__PURE__*/
-  messageDesc(file_entityresolution_v2_entity_resolution, 3);
+  messageDesc(file_entityresolution_v2_entity_resolution, 4);
 
 /**
  * Create an entity chain for each token (JWT) in the request.
@@ -119,6 +152,13 @@ export type CreateEntityChainsFromTokensRequest = Message<"entityresolution.v2.C
    * @generated from field: repeated entity.Token tokens = 1;
    */
   tokens: Token[];
+
+  /**
+   * resources to consider for direct entitlements (experimental)
+   *
+   * @generated from field: repeated authorization.v2.Resource resources = 2;
+   */
+  resources: Resource[];
 };
 
 /**
@@ -126,7 +166,7 @@ export type CreateEntityChainsFromTokensRequest = Message<"entityresolution.v2.C
  * Use `create(CreateEntityChainsFromTokensRequestSchema)` to create a new message.
  */
 export const CreateEntityChainsFromTokensRequestSchema: GenMessage<CreateEntityChainsFromTokensRequest> = /*@__PURE__*/
-  messageDesc(file_entityresolution_v2_entity_resolution, 4);
+  messageDesc(file_entityresolution_v2_entity_resolution, 5);
 
 /**
  * @generated from message entityresolution.v2.CreateEntityChainsFromTokensResponse
@@ -143,7 +183,7 @@ export type CreateEntityChainsFromTokensResponse = Message<"entityresolution.v2.
  * Use `create(CreateEntityChainsFromTokensResponseSchema)` to create a new message.
  */
 export const CreateEntityChainsFromTokensResponseSchema: GenMessage<CreateEntityChainsFromTokensResponse> = /*@__PURE__*/
-  messageDesc(file_entityresolution_v2_entity_resolution, 5);
+  messageDesc(file_entityresolution_v2_entity_resolution, 6);
 
 /**
  * @generated from service entityresolution.v2.EntityResolutionService

package/src/platform/kas/kas_pb.ts

@@ -4,17 +4,15 @@
 
 import type { GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv1";
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
-import { file_google_api_annotations } from "../google/api/annotations_pb.js";
 import type { StringValueSchema, Value } from "@bufbuild/protobuf/wkt";
 import { file_google_protobuf_struct, file_google_protobuf_wrappers } from "@bufbuild/protobuf/wkt";
-import { file_protoc_gen_openapiv2_options_annotations } from "../protoc-gen-openapiv2/options/annotations_pb.js";
 import type { Message } from "@bufbuild/protobuf";
 
 /**
  * Describes the file kas/kas.proto.
  */
 export const file_kas_kas: GenFile = /*@__PURE__*/
-  fileDesc("Cg1rYXMva2FzLnByb3RvEgNrYXMiDQoLSW5mb1JlcXVlc3QiHwoMSW5mb1Jlc3BvbnNlEg8KB3ZlcnNpb24YASABKAkiKwoWTGVnYWN5UHVibGljS2V5UmVxdWVzdBIRCglhbGdvcml0aG0YASABKAkiNQoNUG9saWN5QmluZGluZxIWCglhbGdvcml0aG0YASABKAlSA2FsZxIMCgRoYXNoGAIgASgJIvoBCglLZXlBY2Nlc3MSGgoSZW5jcnlwdGVkX21ldGFkYXRhGAEgASgJEioKDnBvbGljeV9iaW5kaW5nGAIgASgLMhIua2FzLlBvbGljeUJpbmRpbmcSEAoIcHJvdG9jb2wYAyABKAkSFgoIa2V5X3R5cGUYBCABKAlSBHR5cGUSFAoHa2FzX3VybBgFIAEoCVIDdXJsEgsKA2tpZBgGIAEoCRIVCghzcGxpdF9pZBgHIAEoCVIDc2lkEhMKC3dyYXBwZWRfa2V5GAggASgMEg4KBmhlYWRlchgJIAEoDBIcChRlcGhlbWVyYWxfcHVibGljX2tleRgKIAEoCSL5AwoVVW5zaWduZWRSZXdyYXBSZXF1ZXN0EhkKEWNsaWVudF9wdWJsaWNfa2V5GAEgASgJEj4KCHJlcXVlc3RzGAIgAygLMiwua2FzLlVuc2lnbmVkUmV3cmFwUmVxdWVzdC5XaXRoUG9saWN5UmVxdWVzdBImCgprZXlfYWNjZXNzGAMgASgLMg4ua2FzLktleUFjY2Vzc0ICGAESEgoGcG9saWN5GAQgASgJQgIYARIVCglhbGdvcml0aG0YBSABKAlCAhgBGiYKCldpdGhQb2xpY3kSCgoCaWQYASABKAkSDAoEYm9keRgCIAEoCRpeChNXaXRoS2V5QWNjZXNzT2JqZWN0EhwKFGtleV9hY2Nlc3Nfb2JqZWN0X2lkGAEgASgJEikKEWtleV9hY2Nlc3Nfb2JqZWN0GAIgASgLMg4ua2FzLktleUFjY2VzcxqpAQoRV2l0aFBvbGljeVJlcXVlc3QSSgoSa2V5X2FjY2Vzc19vYmplY3RzGAEgAygLMi4ua2FzLlVuc2lnbmVkUmV3cmFwUmVxdWVzdC5XaXRoS2V5QWNjZXNzT2JqZWN0EjUKBnBvbGljeRgCIAEoCzIlLmthcy5VbnNpZ25lZFJld3JhcFJlcXVlc3QuV2l0aFBvbGljeRIRCglhbGdvcml0aG0YAyABKAkingEKEFB1YmxpY0tleVJlcXVlc3QSRgoJYWxnb3JpdGhtGAEgASgJQjOSQTAyLmFsZ29yaXRobSB0eXBlIHJzYTo8a2V5c2l6ZT4gb3IgZWM6PGN1cnZlbmFtZT4SIQoDZm10GAIgASgJQhSSQREyD3Jlc3BvbnNlIGZvcm1hdBIfCgF2GAMgASgJQhSSQREyD3JlcXVlc3QgdmVyc2lvbiI0ChFQdWJsaWNLZXlSZXNwb25zZRISCgpwdWJsaWNfa2V5GAEgASgJEgsKA2tpZBgCIAEoCSI7Cg1SZXdyYXBSZXF1ZXN0EhwKFHNpZ25lZF9yZXF1ZXN0X3Rva2VuGAEgASgJSgQIAhADUgZiZWFyZXIigAIKFUtleUFjY2Vzc1Jld3JhcFJlc3VsdBI6CghtZXRhZGF0YRgBIAMoCzIoLmthcy5LZXlBY2Nlc3NSZXdyYXBSZXN1bHQuTWV0YWRhdGFFbnRyeRIcChRrZXlfYWNjZXNzX29iamVjdF9pZBgCIAEoCRIOCgZzdGF0dXMYAyABKAkSGQoPa2FzX3dyYXBwZWRfa2V5GAQgASgMSAASDwoFZXJyb3IYBSABKAlIABpHCg1NZXRhZGF0YUVudHJ5EgsKA2tleRgBIAEoCRIlCgV2YWx1ZRgCIAEoCzIWLmdvb2dsZS5wcm90b2J1Zi5WYWx1ZToCOAFCCAoGcmVzdWx0IlQKElBvbGljeVJld3JhcFJlc3VsdBIRCglwb2xpY3lfaWQYASABKAkSKwoHcmVzdWx0cxgCIAMoCzIaLmthcy5LZXlBY2Nlc3NSZXdyYXBSZXN1bHQilgIKDlJld3JhcFJlc3BvbnNlEjcKCG1ldGFkYXRhGAEgAygLMiEua2FzLlJld3JhcFJlc3BvbnNlLk1ldGFkYXRhRW50cnlCAhgBEh4KEmVudGl0eV93cmFwcGVkX2tleRgCIAEoDEICGAESGgoSc2Vzc2lvbl9wdWJsaWNfa2V5GAMgASgJEhoKDnNjaGVtYV92ZXJzaW9uGAQgASgJQgIYARIqCglyZXNwb25zZXMYBSADKAsyFy5rYXMuUG9saWN5UmV3cmFwUmVzdWx0GkcKDU1ldGFkYXRhRW50cnkSCwoDa2V5GAEgASgJEiUKBXZhbHVlGAIgASgLMhYuZ29vZ2xlLnByb3RvYnVmLlZhbHVlOgI4ATLRAgoNQWNjZXNzU2VydmljZRJpCglQdWJsaWNLZXkSFS5rYXMuUHVibGljS2V5UmVxdWVzdBoWLmthcy5QdWJsaWNLZXlSZXNwb25zZSItkAIBkkEJSgcKAzIwMBIAgtPkkwIYEhYva2FzL3YyL2thc19wdWJsaWNfa2V5EnsKD0xlZ2FjeVB1YmxpY0tleRIbLmthcy5MZWdhY3lQdWJsaWNLZXlSZXF1ZXN0GhwuZ29vZ2xlLnByb3RvYnVmLlN0cmluZ1ZhbHVlIi2IAgGQAgGSQQlKBwoDMjAwEgCC0+STAhUSEy9rYXMva2FzX3B1YmxpY19rZXkSWAoGUmV3cmFwEhIua2FzLlJld3JhcFJlcXVlc3QaEy5rYXMuUmV3cmFwUmVzcG9uc2UiJZJBCUoHCgMyMDASAILT5JMCEzoBKiIOL2thcy92Mi9yZXdyYXBCdpJBcxJxChpPcGVuVERGIEtleSBBY2Nlc3MgU2VydmljZSpMChJCU0QgMy1DbGF1c2UgQ2xlYXISNmh0dHBzOi8vZ2l0aHViLmNvbS9vcGVudGRmL2JhY2tlbmQvYmxvYi9tYXN0ZXIvTElDRU5TRTIFMS41LjBiBnByb3RvMw", [file_google_api_annotations, file_google_protobuf_struct, file_google_protobuf_wrappers, file_protoc_gen_openapiv2_options_annotations]);
+  fileDesc("Cg1rYXMva2FzLnByb3RvEgNrYXMiDQoLSW5mb1JlcXVlc3QiHwoMSW5mb1Jlc3BvbnNlEg8KB3ZlcnNpb24YASABKAkiKwoWTGVnYWN5UHVibGljS2V5UmVxdWVzdBIRCglhbGdvcml0aG0YASABKAkiNQoNUG9saWN5QmluZGluZxIWCglhbGdvcml0aG0YASABKAlSA2FsZxIMCgRoYXNoGAIgASgJIvoBCglLZXlBY2Nlc3MSGgoSZW5jcnlwdGVkX21ldGFkYXRhGAEgASgJEioKDnBvbGljeV9iaW5kaW5nGAIgASgLMhIua2FzLlBvbGljeUJpbmRpbmcSEAoIcHJvdG9jb2wYAyABKAkSFgoIa2V5X3R5cGUYBCABKAlSBHR5cGUSFAoHa2FzX3VybBgFIAEoCVIDdXJsEgsKA2tpZBgGIAEoCRIVCghzcGxpdF9pZBgHIAEoCVIDc2lkEhMKC3dyYXBwZWRfa2V5GAggASgMEg4KBmhlYWRlchgJIAEoDBIcChRlcGhlbWVyYWxfcHVibGljX2tleRgKIAEoCSL5AwoVVW5zaWduZWRSZXdyYXBSZXF1ZXN0EhkKEWNsaWVudF9wdWJsaWNfa2V5GAEgASgJEj4KCHJlcXVlc3RzGAIgAygLMiwua2FzLlVuc2lnbmVkUmV3cmFwUmVxdWVzdC5XaXRoUG9saWN5UmVxdWVzdBImCgprZXlfYWNjZXNzGAMgASgLMg4ua2FzLktleUFjY2Vzc0ICGAESEgoGcG9saWN5GAQgASgJQgIYARIVCglhbGdvcml0aG0YBSABKAlCAhgBGiYKCldpdGhQb2xpY3kSCgoCaWQYASABKAkSDAoEYm9keRgCIAEoCRpeChNXaXRoS2V5QWNjZXNzT2JqZWN0EhwKFGtleV9hY2Nlc3Nfb2JqZWN0X2lkGAEgASgJEikKEWtleV9hY2Nlc3Nfb2JqZWN0GAIgASgLMg4ua2FzLktleUFjY2VzcxqpAQoRV2l0aFBvbGljeVJlcXVlc3QSSgoSa2V5X2FjY2Vzc19vYmplY3RzGAEgAygLMi4ua2FzLlVuc2lnbmVkUmV3cmFwUmVxdWVzdC5XaXRoS2V5QWNjZXNzT2JqZWN0EjUKBnBvbGljeRgCIAEoCzIlLmthcy5VbnNpZ25lZFJld3JhcFJlcXVlc3QuV2l0aFBvbGljeRIRCglhbGdvcml0aG0YAyABKAkiPQoQUHVibGljS2V5UmVxdWVzdBIRCglhbGdvcml0aG0YASABKAkSCwoDZm10GAIgASgJEgkKAXYYAyABKAkiNAoRUHVibGljS2V5UmVzcG9uc2USEgoKcHVibGljX2tleRgBIAEoCRILCgNraWQYAiABKAkiOwoNUmV3cmFwUmVxdWVzdBIcChRzaWduZWRfcmVxdWVzdF90b2tlbhgBIAEoCUoECAIQA1IGYmVhcmVyIoACChVLZXlBY2Nlc3NSZXdyYXBSZXN1bHQSOgoIbWV0YWRhdGEYASADKAsyKC5rYXMuS2V5QWNjZXNzUmV3cmFwUmVzdWx0Lk1ldGFkYXRhRW50cnkSHAoUa2V5X2FjY2Vzc19vYmplY3RfaWQYAiABKAkSDgoGc3RhdHVzGAMgASgJEhkKD2thc193cmFwcGVkX2tleRgEIAEoDEgAEg8KBWVycm9yGAUgASgJSAAaRwoNTWV0YWRhdGFFbnRyeRILCgNrZXkYASABKAkSJQoFdmFsdWUYAiABKAsyFi5nb29nbGUucHJvdG9idWYuVmFsdWU6AjgBQggKBnJlc3VsdCJUChJQb2xpY3lSZXdyYXBSZXN1bHQSEQoJcG9saWN5X2lkGAEgASgJEisKB3Jlc3VsdHMYAiADKAsyGi5rYXMuS2V5QWNjZXNzUmV3cmFwUmVzdWx0IpYCCg5SZXdyYXBSZXNwb25zZRI3CghtZXRhZGF0YRgBIAMoCzIhLmthcy5SZXdyYXBSZXNwb25zZS5NZXRhZGF0YUVudHJ5QgIYARIeChJlbnRpdHlfd3JhcHBlZF9rZXkYAiABKAxCAhgBEhoKEnNlc3Npb25fcHVibGljX2tleRgDIAEoCRIaCg5zY2hlbWFfdmVyc2lvbhgEIAEoCUICGAESKgoJcmVzcG9uc2VzGAUgAygLMhcua2FzLlBvbGljeVJld3JhcFJlc3VsdBpHCg1NZXRhZGF0YUVudHJ5EgsKA2tleRgBIAEoCRIlCgV2YWx1ZRgCIAEoCzIWLmdvb2dsZS5wcm90b2J1Zi5WYWx1ZToCOAEy2wEKDUFjY2Vzc1NlcnZpY2USPwoJUHVibGljS2V5EhUua2FzLlB1YmxpY0tleVJlcXVlc3QaFi5rYXMuUHVibGljS2V5UmVzcG9uc2UiA5ACARJUCg9MZWdhY3lQdWJsaWNLZXkSGy5rYXMuTGVnYWN5UHVibGljS2V5UmVxdWVzdBocLmdvb2dsZS5wcm90b2J1Zi5TdHJpbmdWYWx1ZSIGiAIBkAIBEjMKBlJld3JhcBISLmthcy5SZXdyYXBSZXF1ZXN0GhMua2FzLlJld3JhcFJlc3BvbnNlIgBiBnByb3RvMw", [file_google_protobuf_struct, file_google_protobuf_wrappers]);
 
 /**
  * Intentionally empty. May include features later.
@@ -68,15 +66,29 @@ export const LegacyPublicKeyRequestSchema: GenMessage<LegacyPublicKeyRequest> =
   messageDesc(file_kas_kas, 2);
 
 /**
+ * Policy binding ensures cryptographic integrity between policy and wrapped key
+ * Prevents policy tampering by binding the policy hash to the encrypted key
+ *
  * @generated from message kas.PolicyBinding
  */
 export type PolicyBinding = Message<"kas.PolicyBinding"> & {
   /**
+   * Cryptographic hashing algorithm used for policy binding
+   * Optional: ZTDF (when policy_binding is an object)
+   * Value: Always "HS256" (HMAC-SHA256) - other algorithms not supported
+   * Example: "HS256"
+   *
    * @generated from field: string algorithm = 1 [json_name = "alg"];
    */
   algorithm: string;
 
   /**
+   * HMAC-SHA256 hash of the base64-encoded policy using the DEK as the secret key
+   * 4.2.2 TDFs are hex and base64 encoded before HMAC computation
+   * Required: ZTDF (when policy_binding is an object)
+   * Links the policy content to the wrapped DEK cryptographically via HMAC
+   * Computed as HMAC-SHA256(DEK, base64_policy) then hex-encoded and base64-encoded
+   *
    * @generated from field: string hash = 2;
    */
   hash: string;
@@ -90,59 +102,102 @@ export const PolicyBindingSchema: GenMessage<PolicyBinding> = /*@__PURE__*/
   messageDesc(file_kas_kas, 3);
 
 /**
+ * Key Access Object containing cryptographic material and metadata for TDF decryption
+ *
  * @generated from message kas.KeyAccess
  */
 export type KeyAccess = Message<"kas.KeyAccess"> & {
   /**
+   * Base64-encoded encrypted metadata containing additional key information
+   * Optional: Not used during KAS rewrap operations (client-side only)
+   * KAS service passes this through without processing or validation
+   *
    * @generated from field: string encrypted_metadata = 1;
    */
   encryptedMetadata: string;
 
   /**
+   * Policy binding ensuring cryptographic integrity between policy and wrapped key
+   * Required: ZTDF (contains hash and algorithm)
+   * Links the policy to the wrapped key cryptographically
+   *
    * @generated from field: kas.PolicyBinding policy_binding = 2;
    */
   policyBinding?: PolicyBinding;
 
   /**
+   * Protocol identifier for the key access mechanism
+   * Optional: Defaults to 'kas'
+   * Typically: 'kas' for standard Key Access Service protocol
+   * Example: "kas"
+   *
    * @generated from field: string protocol = 3;
    */
   protocol: string;
 
   /**
+   * Type of key wrapping used for the data encryption key
+   * Required: Always
+   * Values: 'wrapped' (RSA-wrapped for ZTDF), 'ec-wrapped' (experimental ECDH-wrapped), 'hybrid-wrapped' (experimental X-Wing-wrapped)
+   *
    * @generated from field: string key_type = 4 [json_name = "type"];
    */
   keyType: string;
 
   /**
+   * URL of the Key Access Server that can unwrap this key
+   * Optional: May be omitted if KAS URL is known from context
+   * Used to route rewrap requests to the correct KAS instance
+   * Example: "https://kas.example.com"
+   *
    * @generated from field: string kas_url = 5 [json_name = "url"];
    */
   kasUrl: string;
 
   /**
+   * Key identifier for the KAS public key used for wrapping
+   * Optional: ZTDF (may specify which KAS key to use, required if present in the TDF)
+   * References a specific public key in the KAS key storage (either local keyring or KAS Registry service)
+   * Example: "k1", "ec-key-2024"
+   *
    * @generated from field: string kid = 6;
    */
   kid: string;
 
   /**
+   * Split identifier for key splitting scenarios
+   * Optional: ZTDF (used in advanced key splitting configurations)
+   * Used when keys are split across multiple parties for enhanced security
+   *
    * @generated from field: string split_id = 7 [json_name = "sid"];
    */
   splitId: string;
 
   /**
+   * Client-generated data encryption key wrapped by KAS
+   * Required: Always
+   * Contains the actual DEK encrypted with KAS's public key
+   * This is the core cryptographic material needed for TDF decryption
+   *
    * @generated from field: bytes wrapped_key = 8;
    */
   wrappedKey: Uint8Array;
 
   /**
-   * header is only used for NanoTDFs
+   * Complete header containing all metadata and policy information (for formats that embed it)
+   * Optional: Not used by ZTDF (policy and metadata are separate)
+   * Contains magic bytes, version, algorithm, policy, and ephemeral key information
    *
    * @generated from field: bytes header = 9;
    */
   header: Uint8Array;
 
   /**
-   * For wrapping with an ECDH derived key, when type=ec-wrapped.
-   * Should be a PEM-encoded PKCS#8 (asn.1) value.
+   * Ephemeral public key for ECDH key derivation (ec-wrapped type only)
+   * Required: When key_type="ec-wrapped" (experimental ECDH-based ZTDF)
+   * Omitted: When key_type="wrapped" or key_type="hybrid-wrapped"
+   * Should be a PEM-encoded PKCS#8 (ASN.1) formatted public key
+   * Used to derive the symmetric key for unwrapping the DEK
    *
    * @generated from field: string ephemeral_public_key = 10;
    */
@@ -157,21 +212,35 @@ export const KeyAccessSchema: GenMessage<KeyAccess> = /*@__PURE__*/
   messageDesc(file_kas_kas, 4);
 
 /**
+ * Bulk-style Rewrap request structure that is serialized into JSON and signed
+ * within a Rewrap flow. This message represents the unsigned payload that gets
+ * embedded in a JWT as the 'requestBody' claim and signed with a DPoP key.
+ *
  * @generated from message kas.UnsignedRewrapRequest
  */
 export type UnsignedRewrapRequest = Message<"kas.UnsignedRewrapRequest"> & {
   /**
+   * Client's public key in PEM format for establishing a session key
+   * Required: Always
+   * Used by KAS to generate an ephemeral session key for secure key exchange
+   *
    * @generated from field: string client_public_key = 1;
    */
   clientPublicKey: string;
 
   /**
+   * List of policy requests to be processed
+   * Required: Always (at least one)
+   * Each request represents a policy with its associated key access objects
+   *
    * @generated from field: repeated kas.UnsignedRewrapRequest.WithPolicyRequest requests = 2;
    */
   requests: UnsignedRewrapRequest_WithPolicyRequest[];
 
   /**
-   * Used for legacy non-bulk requests
+   * Deprecated: Legacy single Key Access Object
+   * Used for legacy non-bulk requests (v1 API)
+   * Modern clients should use the 'requests' field instead
    *
    * @generated from field: kas.KeyAccess key_access = 3 [deprecated = true];
    * @deprecated
@@ -179,7 +248,9 @@ export type UnsignedRewrapRequest = Message<"kas.UnsignedRewrapRequest"> & {
   keyAccess?: KeyAccess;
 
   /**
-   * Used for legacy non-bulk requests
+   * Deprecated: Legacy single policy
+   * Used for legacy non-bulk requests (v1 API)
+   * Modern clients should use the 'requests' field instead
    *
    * @generated from field: string policy = 4 [deprecated = true];
    * @deprecated
@@ -187,7 +258,9 @@ export type UnsignedRewrapRequest = Message<"kas.UnsignedRewrapRequest"> & {
   policy: string;
 
   /**
-   * Used for legacy non-bulk requests
+   * Deprecated: Legacy algorithm specification
+   * Used for legacy non-bulk requests (v1 API)  
+   * Modern clients should use the 'requests' field instead
    *
    * @generated from field: string algorithm = 5 [deprecated = true];
    * @deprecated
@@ -203,15 +276,26 @@ export const UnsignedRewrapRequestSchema: GenMessage<UnsignedRewrapRequest> = /*
   messageDesc(file_kas_kas, 5);
 
 /**
+ * Policy metadata and content for a group of KeyAccessObjects
+ *
  * @generated from message kas.UnsignedRewrapRequest.WithPolicy
  */
 export type UnsignedRewrapRequest_WithPolicy = Message<"kas.UnsignedRewrapRequest.WithPolicy"> & {
   /**
+   * An identifier unique within the scope of the rewrap request
+   * Used for mapping between request and response items.
+   * Required: Always
+   * Example: "policy", "policy-0", "policy-1"
+   *
    * @generated from field: string id = 1;
    */
   id: string;
 
   /**
+   * Policy content - format varies by TDF type:
+   * ZTDF: Base64-encoded JSON policy object containing attributes and other policy data
+   * Required: ZTDF (base64-encoded policy JSON)
+   *
    * @generated from field: string body = 2;
    */
   body: string;
@@ -225,15 +309,24 @@ export const UnsignedRewrapRequest_WithPolicySchema: GenMessage<UnsignedRewrapRe
   messageDesc(file_kas_kas, 5, 0);
 
 /**
+ * Key Access Object wrapper with identifier
+ *
  * @generated from message kas.UnsignedRewrapRequest.WithKeyAccessObject
  */
 export type UnsignedRewrapRequest_WithKeyAccessObject = Message<"kas.UnsignedRewrapRequest.WithKeyAccessObject"> & {
   /**
+   * Ephemeral, unique identifier for this KAO within the request
+   * Required: Always
+   * Example: "kao-0", "kao-1", "key-access-object-uuid"
+   *
    * @generated from field: string key_access_object_id = 1;
    */
   keyAccessObjectId: string;
 
   /**
+   * The actual Key Access Object containing cryptographic material and metadata
+   * Required: Always
+   *
    * @generated from field: kas.KeyAccess key_access_object = 2;
    */
   keyAccessObject?: KeyAccess;
@@ -247,20 +340,34 @@ export const UnsignedRewrapRequest_WithKeyAccessObjectSchema: GenMessage<Unsigne
   messageDesc(file_kas_kas, 5, 1);
 
 /**
+ * Request grouping policy with associated key access objects
+ *
  * @generated from message kas.UnsignedRewrapRequest.WithPolicyRequest
  */
 export type UnsignedRewrapRequest_WithPolicyRequest = Message<"kas.UnsignedRewrapRequest.WithPolicyRequest"> & {
   /**
+   * List of Key Access Objects associated with this policy
+   * Required: Always (at least one)
+   * Some formats require exactly one KAO per policy
+   *
    * @generated from field: repeated kas.UnsignedRewrapRequest.WithKeyAccessObject key_access_objects = 1;
    */
   keyAccessObjects: UnsignedRewrapRequest_WithKeyAccessObject[];
 
   /**
+   * Policy information for this group of KAOs
+   * Required: Always
+   *
    * @generated from field: kas.UnsignedRewrapRequest.WithPolicy policy = 2;
    */
   policy?: UnsignedRewrapRequest_WithPolicy;
 
   /**
+   * Cryptographic algorithm identifier for the TDF type
+   * Optional: Defaults to rsa:2048 if omitted
+   * Values: "ec:secp256r1" (EC-based), "rsa:2048" (RSA-based), "" (defaults to rsa:2048)
+   * Example: "ec:secp256r1"
+   *
    * @generated from field: string algorithm = 3;
    */
   algorithm: string;
@@ -323,10 +430,18 @@ export const PublicKeyResponseSchema: GenMessage<PublicKeyResponse> = /*@__PURE_
   messageDesc(file_kas_kas, 7);
 
 /**
+ * Request to rewrap (decrypt and re-encrypt) TDF keys for client access
+ *
  * @generated from message kas.RewrapRequest
  */
 export type RewrapRequest = Message<"kas.RewrapRequest"> & {
   /**
+   * A JWT signed by the DPoP (Demonstration of Proof of Possession) private key
+   * Required: Always
+   * Version differences:
+   * - v1 (legacy): Uses existing TDF spec schema in requestBody
+   * - v2 (bulk): Uses UnsignedRewrapRequest proto serialized as JSON in requestBody
+   *
    * @generated from field: string signed_request_token = 1;
    */
   signedRequestToken: string;
@@ -340,35 +455,58 @@ export const RewrapRequestSchema: GenMessage<RewrapRequest> = /*@__PURE__*/
   messageDesc(file_kas_kas, 8);
 
 /**
+ * Result of a key access object rewrap operation
+ *
  * @generated from message kas.KeyAccessRewrapResult
  */
 export type KeyAccessRewrapResult = Message<"kas.KeyAccessRewrapResult"> & {
   /**
+   * Metadata associated with this KAO result (e.g., required obligations)
+   * Optional: May contain obligation requirements or other policy metadata
+   * Common keys: "X-Required-Obligations" with array of obligation FQNs
+   *
    * @generated from field: map<string, google.protobuf.Value> metadata = 1;
    */
   metadata: { [key: string]: Value };
 
   /**
+   * Identifier matching the key_access_object_id from the request
+   * Required: Always matches the ID from UnsignedRewrapRequest_WithKeyAccessObject
+   *
    * @generated from field: string key_access_object_id = 2;
    */
   keyAccessObjectId: string;
 
   /**
+   * Status of the rewrap operation for this KAO
+   * Required: Always
+   * Values: "permit" (success), "fail" (failure)
+   *
    * @generated from field: string status = 3;
    */
   status: string;
 
   /**
+   * Result of the rewrap operation - either success or error
+   *
    * @generated from oneof kas.KeyAccessRewrapResult.result
    */
   result: {
     /**
+     * Successfully rewrapped key encrypted with the session key
+     * Present when status="permit"
+     * Contains the DEK encrypted with the ephemeral session key
+     *
      * @generated from field: bytes kas_wrapped_key = 4;
      */
     value: Uint8Array;
     case: "kasWrappedKey";
   } | {
     /**
+     * Error message when rewrap failed
+     * Present when status="fail"
+     * Human-readable description of the failure reason
+     *
      * @generated from field: string error = 5;
      */
     value: string;
@@ -384,15 +522,23 @@ export const KeyAccessRewrapResultSchema: GenMessage<KeyAccessRewrapResult> = /*
   messageDesc(file_kas_kas, 9);
 
 /**
+ * Result for all KAOs associated with a single policy
+ *
  * @generated from message kas.PolicyRewrapResult
  */
 export type PolicyRewrapResult = Message<"kas.PolicyRewrapResult"> & {
   /**
+   * Policy identifier matching the policy.id from the request
+   * Required: Always matches the ID from UnsignedRewrapRequest_WithPolicy
+   *
    * @generated from field: string policy_id = 1;
    */
   policyId: string;
 
   /**
+   * Results for each KAO under this policy
+   * Required: One result per KAO in the original request
+   *
    * @generated from field: repeated kas.KeyAccessRewrapResult results = 2;
    */
   results: KeyAccessRewrapResult[];
@@ -406,34 +552,52 @@ export const PolicyRewrapResultSchema: GenMessage<PolicyRewrapResult> = /*@__PUR
   messageDesc(file_kas_kas, 10);
 
 /**
+ * Response containing rewrapped keys and session information
+ *
  * @generated from message kas.RewrapResponse
  */
 export type RewrapResponse = Message<"kas.RewrapResponse"> & {
   /**
+   * Deprecated: Legacy metadata field
+   * Modern responses use metadata in individual KeyAccessRewrapResult
+   *
    * @generated from field: map<string, google.protobuf.Value> metadata = 1 [deprecated = true];
    * @deprecated
    */
   metadata: { [key: string]: Value };
 
   /**
+   * Deprecated: Legacy single entity wrapped key
+   * Modern responses use kas_wrapped_key in KeyAccessRewrapResult
+   *
    * @generated from field: bytes entity_wrapped_key = 2 [deprecated = true];
    * @deprecated
    */
   entityWrappedKey: Uint8Array;
 
   /**
+   * KAS's ephemeral session public key in PEM format
+   * Required: For EC-based operations (key_type="ec-wrapped")
+   * Optional: Empty for RSA-based or X-Wing-based ZTDF (key_type="wrapped" or key_type="hybrid-wrapped")
+   * Used by client to perform ECDH key agreement and decrypt the kas_wrapped_key values
+   *
    * @generated from field: string session_public_key = 3;
    */
   sessionPublicKey: string;
 
   /**
+   * Deprecated: Legacy schema version identifier
+   * Modern responses use implicit versioning
+   *
    * @generated from field: string schema_version = 4 [deprecated = true];
    * @deprecated
    */
   schemaVersion: string;
 
   /**
-   * New Rewrap API changes
+   * Policy-grouped rewrap results for the bulk API
+   * Required: Modern v2 API responses
+   * Each PolicyRewrapResult contains results for all KAOs under that policy
    *
    * @generated from field: repeated kas.PolicyRewrapResult responses = 5;
    */