@tearleads/client-sdk 0.0.0-stage → 0.1.11

package/internal/validators/request/organization.d.ts

@@ -0,0 +1,1529 @@
+import { z } from "zod";
+export declare const CreateOrganizationGroupRequestSchema: z.ZodObject<{
+    groupId: z.ZodCustom<string, string>;
+    initialGroupPolicy: z.ZodType<{
+        encryptedPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+        };
+        grants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        memberEnvelopes: {
+            kemCipherText: string;
+            memberKeyFingerprint: string;
+            userId: string;
+            wrappedKey: string;
+        }[];
+        projection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        state: {
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            version: number;
+        };
+        containerMutations?: {
+            body: unknown;
+            event: Record<string, unknown>;
+            expectedManifestHash: string;
+            keyEpoch: Record<string, unknown>;
+            keyring: Record<string, unknown> | null;
+            manifest: Record<string, unknown>;
+            predecessorBridge: Record<string, unknown> | null;
+            principalPolicies: Record<string, unknown>[];
+            wraps: Record<string, unknown>[];
+            containerManifestHistory?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            destinationParentContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            parentContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            parentKekState?: Record<string, unknown> | null | undefined;
+            previousContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            previousManifest?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            } | null | undefined;
+            userRecipientKeys?: Record<string, unknown>[] | undefined;
+        }[] | undefined;
+    }, {
+        encryptedPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+        };
+        grants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        memberEnvelopes: {
+            kemCipherText: string;
+            memberKeyFingerprint: string;
+            userId: string;
+            wrappedKey: string;
+        }[];
+        projection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        state: {
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            version: number;
+        };
+        containerMutations?: {
+            body: unknown;
+            event: Record<string, unknown>;
+            expectedManifestHash: string;
+            keyEpoch: Record<string, unknown>;
+            keyring: Record<string, unknown> | null;
+            manifest: Record<string, unknown>;
+            predecessorBridge: Record<string, unknown> | null;
+            principalPolicies: Record<string, unknown>[];
+            wraps: Record<string, unknown>[];
+            containerManifestHistory?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            destinationParentContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            parentContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            parentKekState?: Record<string, unknown> | null | undefined;
+            previousContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            previousManifest?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            } | null | undefined;
+            userRecipientKeys?: Record<string, unknown>[] | undefined;
+        }[] | undefined;
+    }, z.core.$ZodTypeInternals<{
+        encryptedPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+        };
+        grants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        memberEnvelopes: {
+            kemCipherText: string;
+            memberKeyFingerprint: string;
+            userId: string;
+            wrappedKey: string;
+        }[];
+        projection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        state: {
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            version: number;
+        };
+        containerMutations?: {
+            body: unknown;
+            event: Record<string, unknown>;
+            expectedManifestHash: string;
+            keyEpoch: Record<string, unknown>;
+            keyring: Record<string, unknown> | null;
+            manifest: Record<string, unknown>;
+            predecessorBridge: Record<string, unknown> | null;
+            principalPolicies: Record<string, unknown>[];
+            wraps: Record<string, unknown>[];
+            containerManifestHistory?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            destinationParentContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            parentContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            parentKekState?: Record<string, unknown> | null | undefined;
+            previousContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            previousManifest?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            } | null | undefined;
+            userRecipientKeys?: Record<string, unknown>[] | undefined;
+        }[] | undefined;
+    }, {
+        encryptedPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+        };
+        grants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        memberEnvelopes: {
+            kemCipherText: string;
+            memberKeyFingerprint: string;
+            userId: string;
+            wrappedKey: string;
+        }[];
+        projection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        state: {
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            version: number;
+        };
+        containerMutations?: {
+            body: unknown;
+            event: Record<string, unknown>;
+            expectedManifestHash: string;
+            keyEpoch: Record<string, unknown>;
+            keyring: Record<string, unknown> | null;
+            manifest: Record<string, unknown>;
+            predecessorBridge: Record<string, unknown> | null;
+            principalPolicies: Record<string, unknown>[];
+            wraps: Record<string, unknown>[];
+            containerManifestHistory?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            destinationParentContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            parentContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            parentKekState?: Record<string, unknown> | null | undefined;
+            previousContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            previousManifest?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            } | null | undefined;
+            userRecipientKeys?: Record<string, unknown>[] | undefined;
+        }[] | undefined;
+    }>>;
+}, z.core.$strict>;
+export declare const CreateOrganizationGroupWithPolicyRequestSchema: z.ZodObject<{
+    organizationPolicy: z.ZodType<{
+        encryptedPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+        };
+        grants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        memberEnvelopes: {
+            kemCipherText: string;
+            memberKeyFingerprint: string;
+            userId: string;
+            wrappedKey: string;
+        }[];
+        projection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        state: {
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            version: number;
+        };
+        containerMutations?: {
+            body: unknown;
+            event: Record<string, unknown>;
+            expectedManifestHash: string;
+            keyEpoch: Record<string, unknown>;
+            keyring: Record<string, unknown> | null;
+            manifest: Record<string, unknown>;
+            predecessorBridge: Record<string, unknown> | null;
+            principalPolicies: Record<string, unknown>[];
+            wraps: Record<string, unknown>[];
+            containerManifestHistory?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            destinationParentContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            parentContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            parentKekState?: Record<string, unknown> | null | undefined;
+            previousContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            previousManifest?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            } | null | undefined;
+            userRecipientKeys?: Record<string, unknown>[] | undefined;
+        }[] | undefined;
+    }, {
+        encryptedPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+        };
+        grants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        memberEnvelopes: {
+            kemCipherText: string;
+            memberKeyFingerprint: string;
+            userId: string;
+            wrappedKey: string;
+        }[];
+        projection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        state: {
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            version: number;
+        };
+        containerMutations?: {
+            body: unknown;
+            event: Record<string, unknown>;
+            expectedManifestHash: string;
+            keyEpoch: Record<string, unknown>;
+            keyring: Record<string, unknown> | null;
+            manifest: Record<string, unknown>;
+            predecessorBridge: Record<string, unknown> | null;
+            principalPolicies: Record<string, unknown>[];
+            wraps: Record<string, unknown>[];
+            containerManifestHistory?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            destinationParentContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            parentContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            parentKekState?: Record<string, unknown> | null | undefined;
+            previousContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            previousManifest?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            } | null | undefined;
+            userRecipientKeys?: Record<string, unknown>[] | undefined;
+        }[] | undefined;
+    }, z.core.$ZodTypeInternals<{
+        encryptedPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+        };
+        grants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        memberEnvelopes: {
+            kemCipherText: string;
+            memberKeyFingerprint: string;
+            userId: string;
+            wrappedKey: string;
+        }[];
+        projection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        state: {
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            version: number;
+        };
+        containerMutations?: {
+            body: unknown;
+            event: Record<string, unknown>;
+            expectedManifestHash: string;
+            keyEpoch: Record<string, unknown>;
+            keyring: Record<string, unknown> | null;
+            manifest: Record<string, unknown>;
+            predecessorBridge: Record<string, unknown> | null;
+            principalPolicies: Record<string, unknown>[];
+            wraps: Record<string, unknown>[];
+            containerManifestHistory?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            destinationParentContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            parentContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            parentKekState?: Record<string, unknown> | null | undefined;
+            previousContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            previousManifest?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            } | null | undefined;
+            userRecipientKeys?: Record<string, unknown>[] | undefined;
+        }[] | undefined;
+    }, {
+        encryptedPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+        };
+        grants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        memberEnvelopes: {
+            kemCipherText: string;
+            memberKeyFingerprint: string;
+            userId: string;
+            wrappedKey: string;
+        }[];
+        projection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        state: {
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            version: number;
+        };
+        containerMutations?: {
+            body: unknown;
+            event: Record<string, unknown>;
+            expectedManifestHash: string;
+            keyEpoch: Record<string, unknown>;
+            keyring: Record<string, unknown> | null;
+            manifest: Record<string, unknown>;
+            predecessorBridge: Record<string, unknown> | null;
+            principalPolicies: Record<string, unknown>[];
+            wraps: Record<string, unknown>[];
+            containerManifestHistory?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            destinationParentContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            parentContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            parentKekState?: Record<string, unknown> | null | undefined;
+            previousContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            previousManifest?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            } | null | undefined;
+            userRecipientKeys?: Record<string, unknown>[] | undefined;
+        }[] | undefined;
+    }>>;
+    groupId: z.ZodCustom<string, string>;
+    initialGroupPolicy: z.ZodType<{
+        encryptedPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+        };
+        grants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        memberEnvelopes: {
+            kemCipherText: string;
+            memberKeyFingerprint: string;
+            userId: string;
+            wrappedKey: string;
+        }[];
+        projection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        state: {
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            version: number;
+        };
+        containerMutations?: {
+            body: unknown;
+            event: Record<string, unknown>;
+            expectedManifestHash: string;
+            keyEpoch: Record<string, unknown>;
+            keyring: Record<string, unknown> | null;
+            manifest: Record<string, unknown>;
+            predecessorBridge: Record<string, unknown> | null;
+            principalPolicies: Record<string, unknown>[];
+            wraps: Record<string, unknown>[];
+            containerManifestHistory?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            destinationParentContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            parentContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            parentKekState?: Record<string, unknown> | null | undefined;
+            previousContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            previousManifest?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            } | null | undefined;
+            userRecipientKeys?: Record<string, unknown>[] | undefined;
+        }[] | undefined;
+    }, {
+        encryptedPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+        };
+        grants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        memberEnvelopes: {
+            kemCipherText: string;
+            memberKeyFingerprint: string;
+            userId: string;
+            wrappedKey: string;
+        }[];
+        projection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        state: {
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            version: number;
+        };
+        containerMutations?: {
+            body: unknown;
+            event: Record<string, unknown>;
+            expectedManifestHash: string;
+            keyEpoch: Record<string, unknown>;
+            keyring: Record<string, unknown> | null;
+            manifest: Record<string, unknown>;
+            predecessorBridge: Record<string, unknown> | null;
+            principalPolicies: Record<string, unknown>[];
+            wraps: Record<string, unknown>[];
+            containerManifestHistory?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            destinationParentContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            parentContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            parentKekState?: Record<string, unknown> | null | undefined;
+            previousContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            previousManifest?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            } | null | undefined;
+            userRecipientKeys?: Record<string, unknown>[] | undefined;
+        }[] | undefined;
+    }, z.core.$ZodTypeInternals<{
+        encryptedPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+        };
+        grants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        memberEnvelopes: {
+            kemCipherText: string;
+            memberKeyFingerprint: string;
+            userId: string;
+            wrappedKey: string;
+        }[];
+        projection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        state: {
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            version: number;
+        };
+        containerMutations?: {
+            body: unknown;
+            event: Record<string, unknown>;
+            expectedManifestHash: string;
+            keyEpoch: Record<string, unknown>;
+            keyring: Record<string, unknown> | null;
+            manifest: Record<string, unknown>;
+            predecessorBridge: Record<string, unknown> | null;
+            principalPolicies: Record<string, unknown>[];
+            wraps: Record<string, unknown>[];
+            containerManifestHistory?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            destinationParentContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            parentContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            parentKekState?: Record<string, unknown> | null | undefined;
+            previousContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            previousManifest?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            } | null | undefined;
+            userRecipientKeys?: Record<string, unknown>[] | undefined;
+        }[] | undefined;
+    }, {
+        encryptedPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+        };
+        grants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        memberEnvelopes: {
+            kemCipherText: string;
+            memberKeyFingerprint: string;
+            userId: string;
+            wrappedKey: string;
+        }[];
+        projection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        state: {
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            version: number;
+        };
+        containerMutations?: {
+            body: unknown;
+            event: Record<string, unknown>;
+            expectedManifestHash: string;
+            keyEpoch: Record<string, unknown>;
+            keyring: Record<string, unknown> | null;
+            manifest: Record<string, unknown>;
+            predecessorBridge: Record<string, unknown> | null;
+            principalPolicies: Record<string, unknown>[];
+            wraps: Record<string, unknown>[];
+            containerManifestHistory?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            destinationParentContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            parentContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            parentKekState?: Record<string, unknown> | null | undefined;
+            previousContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            previousManifest?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            } | null | undefined;
+            userRecipientKeys?: Record<string, unknown>[] | undefined;
+        }[] | undefined;
+    }>>;
+}, z.core.$strict>;
+export type CreateOrganizationGroupRequest = z.infer<typeof CreateOrganizationGroupRequestSchema>;
+export type CreateOrganizationGroupWithPolicyRequest = z.infer<typeof CreateOrganizationGroupWithPolicyRequestSchema>;
+export declare const DeleteOrganizationGroupRequestSchema: z.ZodType<{
+    organizationPolicy: {
+        encryptedPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+        };
+        grants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        memberEnvelopes: {
+            kemCipherText: string;
+            memberKeyFingerprint: string;
+            userId: string;
+            wrappedKey: string;
+        }[];
+        projection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        state: {
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            version: number;
+        };
+        containerMutations?: {
+            body: unknown;
+            event: Record<string, unknown>;
+            expectedManifestHash: string;
+            keyEpoch: Record<string, unknown>;
+            keyring: Record<string, unknown> | null;
+            manifest: Record<string, unknown>;
+            predecessorBridge: Record<string, unknown> | null;
+            principalPolicies: Record<string, unknown>[];
+            wraps: Record<string, unknown>[];
+            containerManifestHistory?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            destinationParentContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            parentContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            parentKekState?: Record<string, unknown> | null | undefined;
+            previousContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            previousManifest?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            } | null | undefined;
+            userRecipientKeys?: Record<string, unknown>[] | undefined;
+        }[] | undefined;
+    };
+}, {
+    organizationPolicy: {
+        encryptedPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+        };
+        grants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        memberEnvelopes: {
+            kemCipherText: string;
+            memberKeyFingerprint: string;
+            userId: string;
+            wrappedKey: string;
+        }[];
+        projection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        state: {
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            version: number;
+        };
+        containerMutations?: {
+            body: unknown;
+            event: Record<string, unknown>;
+            expectedManifestHash: string;
+            keyEpoch: Record<string, unknown>;
+            keyring: Record<string, unknown> | null;
+            manifest: Record<string, unknown>;
+            predecessorBridge: Record<string, unknown> | null;
+            principalPolicies: Record<string, unknown>[];
+            wraps: Record<string, unknown>[];
+            containerManifestHistory?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            destinationParentContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            parentContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            parentKekState?: Record<string, unknown> | null | undefined;
+            previousContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            previousManifest?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            } | null | undefined;
+            userRecipientKeys?: Record<string, unknown>[] | undefined;
+        }[] | undefined;
+    };
+}, z.core.$ZodTypeInternals<{
+    organizationPolicy: {
+        encryptedPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+        };
+        grants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        memberEnvelopes: {
+            kemCipherText: string;
+            memberKeyFingerprint: string;
+            userId: string;
+            wrappedKey: string;
+        }[];
+        projection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        state: {
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            version: number;
+        };
+        containerMutations?: {
+            body: unknown;
+            event: Record<string, unknown>;
+            expectedManifestHash: string;
+            keyEpoch: Record<string, unknown>;
+            keyring: Record<string, unknown> | null;
+            manifest: Record<string, unknown>;
+            predecessorBridge: Record<string, unknown> | null;
+            principalPolicies: Record<string, unknown>[];
+            wraps: Record<string, unknown>[];
+            containerManifestHistory?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            destinationParentContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            parentContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            parentKekState?: Record<string, unknown> | null | undefined;
+            previousContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            previousManifest?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            } | null | undefined;
+            userRecipientKeys?: Record<string, unknown>[] | undefined;
+        }[] | undefined;
+    };
+}, {
+    organizationPolicy: {
+        encryptedPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+        };
+        grants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        memberEnvelopes: {
+            kemCipherText: string;
+            memberKeyFingerprint: string;
+            userId: string;
+            wrappedKey: string;
+        }[];
+        projection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        state: {
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            version: number;
+        };
+        containerMutations?: {
+            body: unknown;
+            event: Record<string, unknown>;
+            expectedManifestHash: string;
+            keyEpoch: Record<string, unknown>;
+            keyring: Record<string, unknown> | null;
+            manifest: Record<string, unknown>;
+            predecessorBridge: Record<string, unknown> | null;
+            principalPolicies: Record<string, unknown>[];
+            wraps: Record<string, unknown>[];
+            containerManifestHistory?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            destinationParentContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            parentContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            parentKekState?: Record<string, unknown> | null | undefined;
+            previousContainerPath?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[] | undefined;
+            previousManifest?: {
+                event: Record<string, unknown>;
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            } | null | undefined;
+            userRecipientKeys?: Record<string, unknown>[] | undefined;
+        }[] | undefined;
+    };
+}>>;
+export type DeleteOrganizationGroupRequest = z.infer<typeof DeleteOrganizationGroupRequestSchema>;
+export declare const OrganizationReadModelQuerySchema: z.ZodType<{
+    cursor?: string | undefined;
+}, {
+    cursor?: string | undefined;
+}, z.core.$ZodTypeInternals<{
+    cursor?: string | undefined;
+}, {
+    cursor?: string | undefined;
+}>>;
+export type OrganizationReadModelQuery = z.infer<typeof OrganizationReadModelQuerySchema>;
+export declare const UpdateOrganizationRosterEntryRequestSchema: z.ZodType<{
+    profileDocumentId: string | null;
+}, {
+    profileDocumentId: string | null;
+}, z.core.$ZodTypeInternals<{
+    profileDocumentId: string | null;
+}, {
+    profileDocumentId: string | null;
+}>>;
+export type UpdateOrganizationRosterEntryRequest = z.infer<typeof UpdateOrganizationRosterEntryRequestSchema>;
+export declare const UpdateOrganizationProfileRequestSchema: z.ZodType<{
+    profileDocumentId: string | null;
+}, {
+    profileDocumentId: string | null;
+}, z.core.$ZodTypeInternals<{
+    profileDocumentId: string | null;
+}, {
+    profileDocumentId: string | null;
+}>>;
+export type UpdateOrganizationProfileRequest = z.infer<typeof UpdateOrganizationProfileRequestSchema>;
+export declare function isCreateOrganizationGroupRequest(value: unknown): value is CreateOrganizationGroupRequest;
+export declare function isCreateOrganizationGroupWithPolicyRequest(value: unknown): value is CreateOrganizationGroupWithPolicyRequest;
+export declare function isDeleteOrganizationGroupRequest(value: unknown): value is DeleteOrganizationGroupRequest;
+export declare function isUpdateOrganizationRosterEntryRequest(value: unknown): value is UpdateOrganizationRosterEntryRequest;
+export declare function isUpdateOrganizationProfileRequest(value: unknown): value is UpdateOrganizationProfileRequest;