@tearleads/client-sdk 0.0.0-stage → 0.1.11

package/internal/validators/response/principal.d.ts

@@ -0,0 +1,2573 @@
+import { z } from "zod";
+export { type CurrentPrincipalMemberEnvelopesResponse, CurrentPrincipalMemberEnvelopesResponseSchema, isCurrentPrincipalMemberEnvelopesResponse, isPrincipalPolicyStateChainEntryResponse, isPrincipalStatePayloadResponse, isPrincipalStateResponse, type PrincipalContainerGrantResponse, PrincipalContainerGrantResponseSchema, type PrincipalMemberEnvelopeResponse, PrincipalMemberEnvelopeResponseSchema, type PrincipalPolicySnapshotResponse, PrincipalPolicySnapshotResponseSchema, type PrincipalPolicyStateChainEntryResponse, PrincipalPolicyStateChainEntryResponseSchema, type PrincipalProjectionMemberResponse, PrincipalProjectionMemberResponseSchema, type PrincipalStateExternalAuthorityResponse, PrincipalStateExternalAuthorityResponseSchema, type PrincipalStatePayloadResponse, PrincipalStatePayloadResponseSchema, type PrincipalStateResponse, PrincipalStateResponseSchema, } from "./principalSnapshot.js";
+export declare const principalPolicyCurrentResponseShape: {
+    currentGrants: z.ZodCustom<{
+        accessLevel: "admin" | "read" | "write";
+        containerId: string;
+    }[], {
+        accessLevel: "admin" | "read" | "write";
+        containerId: string;
+    }[]>;
+    currentMemberEnvelopes: z.ZodType<{
+        envelopes: {
+            kemCipherText: string;
+            memberKeyFingerprint: string;
+            userId: string;
+            wrappedKey: string;
+        }[];
+        epoch: number;
+        principalId: string;
+        principalType: "group" | "organization";
+        stateHash: string;
+    }, {
+        envelopes: {
+            kemCipherText: string;
+            memberKeyFingerprint: string;
+            userId: string;
+            wrappedKey: string;
+        }[];
+        epoch: number;
+        principalId: string;
+        principalType: "group" | "organization";
+        stateHash: string;
+    }, z.core.$ZodTypeInternals<{
+        envelopes: {
+            kemCipherText: string;
+            memberKeyFingerprint: string;
+            userId: string;
+            wrappedKey: string;
+        }[];
+        epoch: number;
+        principalId: string;
+        principalType: "group" | "organization";
+        stateHash: string;
+    }, {
+        envelopes: {
+            kemCipherText: string;
+            memberKeyFingerprint: string;
+            userId: string;
+            wrappedKey: string;
+        }[];
+        epoch: number;
+        principalId: string;
+        principalType: "group" | "organization";
+        stateHash: string;
+    }>>;
+    currentPayload: z.ZodType<{
+        cipherSuite: "aes-256-gcm";
+        ciphertext: string;
+        ciphertextHash: string;
+        createdAt: string;
+        principalId: string;
+        principalType: "group" | "organization";
+        stateHash: string;
+    }, {
+        cipherSuite: "aes-256-gcm";
+        ciphertext: string;
+        ciphertextHash: string;
+        createdAt: string;
+        principalId: string;
+        principalType: "group" | "organization";
+        stateHash: string;
+    }, z.core.$ZodTypeInternals<{
+        cipherSuite: "aes-256-gcm";
+        ciphertext: string;
+        ciphertextHash: string;
+        createdAt: string;
+        principalId: string;
+        principalType: "group" | "organization";
+        stateHash: string;
+    }, {
+        cipherSuite: "aes-256-gcm";
+        ciphertext: string;
+        ciphertextHash: string;
+        createdAt: string;
+        principalId: string;
+        principalType: "group" | "organization";
+        stateHash: string;
+    }>>;
+    currentProjection: z.ZodCustom<{
+        role: "member" | "admin";
+        userId: string;
+    }[], {
+        role: "member" | "admin";
+        userId: string;
+    }[]>;
+    currentState: z.ZodType<{
+        createdAt: string;
+        encapsulationPublicKey: string;
+        externalAuthority: {
+            keyEpoch: number;
+            keyFingerprint: string;
+            principalId: string;
+            principalType: "group";
+            stateHash: string;
+            version: number;
+        } | null;
+        grantCount: number;
+        grantRoot: string;
+        keyEpoch: number;
+        keyFingerprint: string;
+        memberCount: number;
+        memberEnvelopesRoot: string;
+        membershipMode: "projection";
+        membershipRoot: string;
+        payloadCiphertextHash: string;
+        prevStateHash: string | null;
+        principalId: string;
+        principalType: "group" | "organization";
+        projectionRoot: string;
+        signature: string;
+        signedAt: string;
+        signerUserId: string;
+        signerUserKeyFingerprint: string;
+        stateHash: string;
+        version: number;
+    }, {
+        createdAt: string;
+        encapsulationPublicKey: string;
+        externalAuthority: {
+            keyEpoch: number;
+            keyFingerprint: string;
+            principalId: string;
+            principalType: "group";
+            stateHash: string;
+            version: number;
+        } | null;
+        grantCount: number;
+        grantRoot: string;
+        keyEpoch: number;
+        keyFingerprint: string;
+        memberCount: number;
+        memberEnvelopesRoot: string;
+        membershipMode: "projection";
+        membershipRoot: string;
+        payloadCiphertextHash: string;
+        prevStateHash: string | null;
+        principalId: string;
+        principalType: "group" | "organization";
+        projectionRoot: string;
+        signature: string;
+        signedAt: string;
+        signerUserId: string;
+        signerUserKeyFingerprint: string;
+        stateHash: string;
+        version: number;
+    }, z.core.$ZodTypeInternals<{
+        createdAt: string;
+        encapsulationPublicKey: string;
+        externalAuthority: {
+            keyEpoch: number;
+            keyFingerprint: string;
+            principalId: string;
+            principalType: "group";
+            stateHash: string;
+            version: number;
+        } | null;
+        grantCount: number;
+        grantRoot: string;
+        keyEpoch: number;
+        keyFingerprint: string;
+        memberCount: number;
+        memberEnvelopesRoot: string;
+        membershipMode: "projection";
+        membershipRoot: string;
+        payloadCiphertextHash: string;
+        prevStateHash: string | null;
+        principalId: string;
+        principalType: "group" | "organization";
+        projectionRoot: string;
+        signature: string;
+        signedAt: string;
+        signerUserId: string;
+        signerUserKeyFingerprint: string;
+        stateHash: string;
+        version: number;
+    }, {
+        createdAt: string;
+        encapsulationPublicKey: string;
+        externalAuthority: {
+            keyEpoch: number;
+            keyFingerprint: string;
+            principalId: string;
+            principalType: "group";
+            stateHash: string;
+            version: number;
+        } | null;
+        grantCount: number;
+        grantRoot: string;
+        keyEpoch: number;
+        keyFingerprint: string;
+        memberCount: number;
+        memberEnvelopesRoot: string;
+        membershipMode: "projection";
+        membershipRoot: string;
+        payloadCiphertextHash: string;
+        prevStateHash: string | null;
+        principalId: string;
+        principalType: "group" | "organization";
+        projectionRoot: string;
+        signature: string;
+        signedAt: string;
+        signerUserId: string;
+        signerUserKeyFingerprint: string;
+        stateHash: string;
+        version: number;
+    }>>;
+};
+export declare const PrincipalPolicyBundleResponseSchema: z.ZodType<{
+    previousStates: {
+        grants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        projection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        state: {
+            createdAt: string;
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            stateHash: string;
+            version: number;
+        };
+    }[];
+    currentGrants: {
+        accessLevel: "admin" | "read" | "write";
+        containerId: string;
+    }[];
+    currentMemberEnvelopes: {
+        envelopes: {
+            kemCipherText: string;
+            memberKeyFingerprint: string;
+            userId: string;
+            wrappedKey: string;
+        }[];
+        epoch: number;
+        principalId: string;
+        principalType: "group" | "organization";
+        stateHash: string;
+    };
+    currentPayload: {
+        cipherSuite: "aes-256-gcm";
+        ciphertext: string;
+        ciphertextHash: string;
+        createdAt: string;
+        principalId: string;
+        principalType: "group" | "organization";
+        stateHash: string;
+    };
+    currentProjection: {
+        role: "member" | "admin";
+        userId: string;
+    }[];
+    currentState: {
+        createdAt: string;
+        encapsulationPublicKey: string;
+        externalAuthority: {
+            keyEpoch: number;
+            keyFingerprint: string;
+            principalId: string;
+            principalType: "group";
+            stateHash: string;
+            version: number;
+        } | null;
+        grantCount: number;
+        grantRoot: string;
+        keyEpoch: number;
+        keyFingerprint: string;
+        memberCount: number;
+        memberEnvelopesRoot: string;
+        membershipMode: "projection";
+        membershipRoot: string;
+        payloadCiphertextHash: string;
+        prevStateHash: string | null;
+        principalId: string;
+        principalType: "group" | "organization";
+        projectionRoot: string;
+        signature: string;
+        signedAt: string;
+        signerUserId: string;
+        signerUserKeyFingerprint: string;
+        stateHash: string;
+        version: number;
+    };
+}, {
+    previousStates: {
+        grants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        projection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        state: {
+            createdAt: string;
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            stateHash: string;
+            version: number;
+        };
+    }[];
+    currentGrants: {
+        accessLevel: "admin" | "read" | "write";
+        containerId: string;
+    }[];
+    currentMemberEnvelopes: {
+        envelopes: {
+            kemCipherText: string;
+            memberKeyFingerprint: string;
+            userId: string;
+            wrappedKey: string;
+        }[];
+        epoch: number;
+        principalId: string;
+        principalType: "group" | "organization";
+        stateHash: string;
+    };
+    currentPayload: {
+        cipherSuite: "aes-256-gcm";
+        ciphertext: string;
+        ciphertextHash: string;
+        createdAt: string;
+        principalId: string;
+        principalType: "group" | "organization";
+        stateHash: string;
+    };
+    currentProjection: {
+        role: "member" | "admin";
+        userId: string;
+    }[];
+    currentState: {
+        createdAt: string;
+        encapsulationPublicKey: string;
+        externalAuthority: {
+            keyEpoch: number;
+            keyFingerprint: string;
+            principalId: string;
+            principalType: "group";
+            stateHash: string;
+            version: number;
+        } | null;
+        grantCount: number;
+        grantRoot: string;
+        keyEpoch: number;
+        keyFingerprint: string;
+        memberCount: number;
+        memberEnvelopesRoot: string;
+        membershipMode: "projection";
+        membershipRoot: string;
+        payloadCiphertextHash: string;
+        prevStateHash: string | null;
+        principalId: string;
+        principalType: "group" | "organization";
+        projectionRoot: string;
+        signature: string;
+        signedAt: string;
+        signerUserId: string;
+        signerUserKeyFingerprint: string;
+        stateHash: string;
+        version: number;
+    };
+}, z.core.$ZodTypeInternals<{
+    previousStates: {
+        grants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        projection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        state: {
+            createdAt: string;
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            stateHash: string;
+            version: number;
+        };
+    }[];
+    currentGrants: {
+        accessLevel: "admin" | "read" | "write";
+        containerId: string;
+    }[];
+    currentMemberEnvelopes: {
+        envelopes: {
+            kemCipherText: string;
+            memberKeyFingerprint: string;
+            userId: string;
+            wrappedKey: string;
+        }[];
+        epoch: number;
+        principalId: string;
+        principalType: "group" | "organization";
+        stateHash: string;
+    };
+    currentPayload: {
+        cipherSuite: "aes-256-gcm";
+        ciphertext: string;
+        ciphertextHash: string;
+        createdAt: string;
+        principalId: string;
+        principalType: "group" | "organization";
+        stateHash: string;
+    };
+    currentProjection: {
+        role: "member" | "admin";
+        userId: string;
+    }[];
+    currentState: {
+        createdAt: string;
+        encapsulationPublicKey: string;
+        externalAuthority: {
+            keyEpoch: number;
+            keyFingerprint: string;
+            principalId: string;
+            principalType: "group";
+            stateHash: string;
+            version: number;
+        } | null;
+        grantCount: number;
+        grantRoot: string;
+        keyEpoch: number;
+        keyFingerprint: string;
+        memberCount: number;
+        memberEnvelopesRoot: string;
+        membershipMode: "projection";
+        membershipRoot: string;
+        payloadCiphertextHash: string;
+        prevStateHash: string | null;
+        principalId: string;
+        principalType: "group" | "organization";
+        projectionRoot: string;
+        signature: string;
+        signedAt: string;
+        signerUserId: string;
+        signerUserKeyFingerprint: string;
+        stateHash: string;
+        version: number;
+    };
+}, {
+    previousStates: {
+        grants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        projection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        state: {
+            createdAt: string;
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            stateHash: string;
+            version: number;
+        };
+    }[];
+    currentGrants: {
+        accessLevel: "admin" | "read" | "write";
+        containerId: string;
+    }[];
+    currentMemberEnvelopes: {
+        envelopes: {
+            kemCipherText: string;
+            memberKeyFingerprint: string;
+            userId: string;
+            wrappedKey: string;
+        }[];
+        epoch: number;
+        principalId: string;
+        principalType: "group" | "organization";
+        stateHash: string;
+    };
+    currentPayload: {
+        cipherSuite: "aes-256-gcm";
+        ciphertext: string;
+        ciphertextHash: string;
+        createdAt: string;
+        principalId: string;
+        principalType: "group" | "organization";
+        stateHash: string;
+    };
+    currentProjection: {
+        role: "member" | "admin";
+        userId: string;
+    }[];
+    currentState: {
+        createdAt: string;
+        encapsulationPublicKey: string;
+        externalAuthority: {
+            keyEpoch: number;
+            keyFingerprint: string;
+            principalId: string;
+            principalType: "group";
+            stateHash: string;
+            version: number;
+        } | null;
+        grantCount: number;
+        grantRoot: string;
+        keyEpoch: number;
+        keyFingerprint: string;
+        memberCount: number;
+        memberEnvelopesRoot: string;
+        membershipMode: "projection";
+        membershipRoot: string;
+        payloadCiphertextHash: string;
+        prevStateHash: string | null;
+        principalId: string;
+        principalType: "group" | "organization";
+        projectionRoot: string;
+        signature: string;
+        signedAt: string;
+        signerUserId: string;
+        signerUserKeyFingerprint: string;
+        stateHash: string;
+        version: number;
+    };
+}>>;
+export type PrincipalPolicyBundleResponse = z.infer<typeof PrincipalPolicyBundleResponseSchema>;
+export declare const PrincipalPolicyMutationResponseSchema: z.ZodType<{
+    containerMutations: {
+        createdAt: string;
+        manifestHead: {
+            epoch: number;
+            manifestHash: string;
+        };
+        organizationId: string;
+        parentId: string | null;
+        referencedPrincipalHeads: {
+            principalType: "group";
+            keyEpoch: number;
+            keyFingerprint: string;
+            principalId: string;
+            stateHash: string;
+            version: number;
+        }[];
+        updatedAt: string;
+        accessManifest: {
+            event: {
+                body: unknown;
+                event: Record<string, unknown>;
+                eventHash: string;
+            };
+            manifest: Record<string, unknown>;
+            manifestHash: string;
+            state: Record<string, unknown>;
+        };
+        containerId: string;
+        containerKek: {
+            accessManifestHash: string;
+            containerId: string;
+            containerKeyEpoch: number;
+            containerKeyEpochId: string;
+            containerManifestHistory: {
+                event: {
+                    body: unknown;
+                    event: Record<string, unknown>;
+                    eventHash: string;
+                };
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[];
+            keyEpoch: Record<string, unknown>;
+            keyEpochHash: string;
+            keyring: {
+                containerId: string;
+                containerKeyEpochId: string;
+                iv: string;
+                sealed: string;
+                sealingSuite: string;
+                version: number;
+            } | null;
+            keyTargetHash: string;
+            parentContainerKeyEpochId: string | null;
+            recipientTargets: Record<string, unknown>[];
+            wraps: Record<string, unknown>[];
+        };
+        systemSlot?: string | null | undefined;
+    }[];
+    currentGrants: {
+        accessLevel: "admin" | "read" | "write";
+        containerId: string;
+    }[];
+    currentMemberEnvelopes: {
+        envelopes: {
+            kemCipherText: string;
+            memberKeyFingerprint: string;
+            userId: string;
+            wrappedKey: string;
+        }[];
+        epoch: number;
+        principalId: string;
+        principalType: "group" | "organization";
+        stateHash: string;
+    };
+    currentPayload: {
+        cipherSuite: "aes-256-gcm";
+        ciphertext: string;
+        ciphertextHash: string;
+        createdAt: string;
+        principalId: string;
+        principalType: "group" | "organization";
+        stateHash: string;
+    };
+    currentProjection: {
+        role: "member" | "admin";
+        userId: string;
+    }[];
+    currentState: {
+        createdAt: string;
+        encapsulationPublicKey: string;
+        externalAuthority: {
+            keyEpoch: number;
+            keyFingerprint: string;
+            principalId: string;
+            principalType: "group";
+            stateHash: string;
+            version: number;
+        } | null;
+        grantCount: number;
+        grantRoot: string;
+        keyEpoch: number;
+        keyFingerprint: string;
+        memberCount: number;
+        memberEnvelopesRoot: string;
+        membershipMode: "projection";
+        membershipRoot: string;
+        payloadCiphertextHash: string;
+        prevStateHash: string | null;
+        principalId: string;
+        principalType: "group" | "organization";
+        projectionRoot: string;
+        signature: string;
+        signedAt: string;
+        signerUserId: string;
+        signerUserKeyFingerprint: string;
+        stateHash: string;
+        version: number;
+    };
+}, {
+    containerMutations: {
+        createdAt: string;
+        manifestHead: {
+            epoch: number;
+            manifestHash: string;
+        };
+        organizationId: string;
+        parentId: string | null;
+        referencedPrincipalHeads: {
+            principalType: "group";
+            keyEpoch: number;
+            keyFingerprint: string;
+            principalId: string;
+            stateHash: string;
+            version: number;
+        }[];
+        updatedAt: string;
+        accessManifest: {
+            event: {
+                body: unknown;
+                event: Record<string, unknown>;
+                eventHash: string;
+            };
+            manifest: Record<string, unknown>;
+            manifestHash: string;
+            state: Record<string, unknown>;
+        };
+        containerId: string;
+        containerKek: {
+            accessManifestHash: string;
+            containerId: string;
+            containerKeyEpoch: number;
+            containerKeyEpochId: string;
+            containerManifestHistory: {
+                event: {
+                    body: unknown;
+                    event: Record<string, unknown>;
+                    eventHash: string;
+                };
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[];
+            keyEpoch: Record<string, unknown>;
+            keyEpochHash: string;
+            keyring: {
+                containerId: string;
+                containerKeyEpochId: string;
+                iv: string;
+                sealed: string;
+                sealingSuite: string;
+                version: number;
+            } | null;
+            keyTargetHash: string;
+            parentContainerKeyEpochId: string | null;
+            recipientTargets: Record<string, unknown>[];
+            wraps: Record<string, unknown>[];
+        };
+        systemSlot?: string | null | undefined;
+    }[];
+    currentGrants: {
+        accessLevel: "admin" | "read" | "write";
+        containerId: string;
+    }[];
+    currentMemberEnvelopes: {
+        envelopes: {
+            kemCipherText: string;
+            memberKeyFingerprint: string;
+            userId: string;
+            wrappedKey: string;
+        }[];
+        epoch: number;
+        principalId: string;
+        principalType: "group" | "organization";
+        stateHash: string;
+    };
+    currentPayload: {
+        cipherSuite: "aes-256-gcm";
+        ciphertext: string;
+        ciphertextHash: string;
+        createdAt: string;
+        principalId: string;
+        principalType: "group" | "organization";
+        stateHash: string;
+    };
+    currentProjection: {
+        role: "member" | "admin";
+        userId: string;
+    }[];
+    currentState: {
+        createdAt: string;
+        encapsulationPublicKey: string;
+        externalAuthority: {
+            keyEpoch: number;
+            keyFingerprint: string;
+            principalId: string;
+            principalType: "group";
+            stateHash: string;
+            version: number;
+        } | null;
+        grantCount: number;
+        grantRoot: string;
+        keyEpoch: number;
+        keyFingerprint: string;
+        memberCount: number;
+        memberEnvelopesRoot: string;
+        membershipMode: "projection";
+        membershipRoot: string;
+        payloadCiphertextHash: string;
+        prevStateHash: string | null;
+        principalId: string;
+        principalType: "group" | "organization";
+        projectionRoot: string;
+        signature: string;
+        signedAt: string;
+        signerUserId: string;
+        signerUserKeyFingerprint: string;
+        stateHash: string;
+        version: number;
+    };
+}, z.core.$ZodTypeInternals<{
+    containerMutations: {
+        createdAt: string;
+        manifestHead: {
+            epoch: number;
+            manifestHash: string;
+        };
+        organizationId: string;
+        parentId: string | null;
+        referencedPrincipalHeads: {
+            principalType: "group";
+            keyEpoch: number;
+            keyFingerprint: string;
+            principalId: string;
+            stateHash: string;
+            version: number;
+        }[];
+        updatedAt: string;
+        accessManifest: {
+            event: {
+                body: unknown;
+                event: Record<string, unknown>;
+                eventHash: string;
+            };
+            manifest: Record<string, unknown>;
+            manifestHash: string;
+            state: Record<string, unknown>;
+        };
+        containerId: string;
+        containerKek: {
+            accessManifestHash: string;
+            containerId: string;
+            containerKeyEpoch: number;
+            containerKeyEpochId: string;
+            containerManifestHistory: {
+                event: {
+                    body: unknown;
+                    event: Record<string, unknown>;
+                    eventHash: string;
+                };
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[];
+            keyEpoch: Record<string, unknown>;
+            keyEpochHash: string;
+            keyring: {
+                containerId: string;
+                containerKeyEpochId: string;
+                iv: string;
+                sealed: string;
+                sealingSuite: string;
+                version: number;
+            } | null;
+            keyTargetHash: string;
+            parentContainerKeyEpochId: string | null;
+            recipientTargets: Record<string, unknown>[];
+            wraps: Record<string, unknown>[];
+        };
+        systemSlot?: string | null | undefined;
+    }[];
+    currentGrants: {
+        accessLevel: "admin" | "read" | "write";
+        containerId: string;
+    }[];
+    currentMemberEnvelopes: {
+        envelopes: {
+            kemCipherText: string;
+            memberKeyFingerprint: string;
+            userId: string;
+            wrappedKey: string;
+        }[];
+        epoch: number;
+        principalId: string;
+        principalType: "group" | "organization";
+        stateHash: string;
+    };
+    currentPayload: {
+        cipherSuite: "aes-256-gcm";
+        ciphertext: string;
+        ciphertextHash: string;
+        createdAt: string;
+        principalId: string;
+        principalType: "group" | "organization";
+        stateHash: string;
+    };
+    currentProjection: {
+        role: "member" | "admin";
+        userId: string;
+    }[];
+    currentState: {
+        createdAt: string;
+        encapsulationPublicKey: string;
+        externalAuthority: {
+            keyEpoch: number;
+            keyFingerprint: string;
+            principalId: string;
+            principalType: "group";
+            stateHash: string;
+            version: number;
+        } | null;
+        grantCount: number;
+        grantRoot: string;
+        keyEpoch: number;
+        keyFingerprint: string;
+        memberCount: number;
+        memberEnvelopesRoot: string;
+        membershipMode: "projection";
+        membershipRoot: string;
+        payloadCiphertextHash: string;
+        prevStateHash: string | null;
+        principalId: string;
+        principalType: "group" | "organization";
+        projectionRoot: string;
+        signature: string;
+        signedAt: string;
+        signerUserId: string;
+        signerUserKeyFingerprint: string;
+        stateHash: string;
+        version: number;
+    };
+}, {
+    containerMutations: {
+        createdAt: string;
+        manifestHead: {
+            epoch: number;
+            manifestHash: string;
+        };
+        organizationId: string;
+        parentId: string | null;
+        referencedPrincipalHeads: {
+            principalType: "group";
+            keyEpoch: number;
+            keyFingerprint: string;
+            principalId: string;
+            stateHash: string;
+            version: number;
+        }[];
+        updatedAt: string;
+        accessManifest: {
+            event: {
+                body: unknown;
+                event: Record<string, unknown>;
+                eventHash: string;
+            };
+            manifest: Record<string, unknown>;
+            manifestHash: string;
+            state: Record<string, unknown>;
+        };
+        containerId: string;
+        containerKek: {
+            accessManifestHash: string;
+            containerId: string;
+            containerKeyEpoch: number;
+            containerKeyEpochId: string;
+            containerManifestHistory: {
+                event: {
+                    body: unknown;
+                    event: Record<string, unknown>;
+                    eventHash: string;
+                };
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            }[];
+            keyEpoch: Record<string, unknown>;
+            keyEpochHash: string;
+            keyring: {
+                containerId: string;
+                containerKeyEpochId: string;
+                iv: string;
+                sealed: string;
+                sealingSuite: string;
+                version: number;
+            } | null;
+            keyTargetHash: string;
+            parentContainerKeyEpochId: string | null;
+            recipientTargets: Record<string, unknown>[];
+            wraps: Record<string, unknown>[];
+        };
+        systemSlot?: string | null | undefined;
+    }[];
+    currentGrants: {
+        accessLevel: "admin" | "read" | "write";
+        containerId: string;
+    }[];
+    currentMemberEnvelopes: {
+        envelopes: {
+            kemCipherText: string;
+            memberKeyFingerprint: string;
+            userId: string;
+            wrappedKey: string;
+        }[];
+        epoch: number;
+        principalId: string;
+        principalType: "group" | "organization";
+        stateHash: string;
+    };
+    currentPayload: {
+        cipherSuite: "aes-256-gcm";
+        ciphertext: string;
+        ciphertextHash: string;
+        createdAt: string;
+        principalId: string;
+        principalType: "group" | "organization";
+        stateHash: string;
+    };
+    currentProjection: {
+        role: "member" | "admin";
+        userId: string;
+    }[];
+    currentState: {
+        createdAt: string;
+        encapsulationPublicKey: string;
+        externalAuthority: {
+            keyEpoch: number;
+            keyFingerprint: string;
+            principalId: string;
+            principalType: "group";
+            stateHash: string;
+            version: number;
+        } | null;
+        grantCount: number;
+        grantRoot: string;
+        keyEpoch: number;
+        keyFingerprint: string;
+        memberCount: number;
+        memberEnvelopesRoot: string;
+        membershipMode: "projection";
+        membershipRoot: string;
+        payloadCiphertextHash: string;
+        prevStateHash: string | null;
+        principalId: string;
+        principalType: "group" | "organization";
+        projectionRoot: string;
+        signature: string;
+        signedAt: string;
+        signerUserId: string;
+        signerUserKeyFingerprint: string;
+        stateHash: string;
+        version: number;
+    };
+}>>;
+export type PrincipalPolicyMutationResponse = z.infer<typeof PrincipalPolicyMutationResponseSchema>;
+export declare const CommitOrganizationGroupPolicyResponseSchema: z.ZodType<{
+    groupPolicy: {
+        containerMutations: {
+            createdAt: string;
+            manifestHead: {
+                epoch: number;
+                manifestHash: string;
+            };
+            organizationId: string;
+            parentId: string | null;
+            referencedPrincipalHeads: {
+                principalType: "group";
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                stateHash: string;
+                version: number;
+            }[];
+            updatedAt: string;
+            accessManifest: {
+                event: {
+                    body: unknown;
+                    event: Record<string, unknown>;
+                    eventHash: string;
+                };
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            };
+            containerId: string;
+            containerKek: {
+                accessManifestHash: string;
+                containerId: string;
+                containerKeyEpoch: number;
+                containerKeyEpochId: string;
+                containerManifestHistory: {
+                    event: {
+                        body: unknown;
+                        event: Record<string, unknown>;
+                        eventHash: string;
+                    };
+                    manifest: Record<string, unknown>;
+                    manifestHash: string;
+                    state: Record<string, unknown>;
+                }[];
+                keyEpoch: Record<string, unknown>;
+                keyEpochHash: string;
+                keyring: {
+                    containerId: string;
+                    containerKeyEpochId: string;
+                    iv: string;
+                    sealed: string;
+                    sealingSuite: string;
+                    version: number;
+                } | null;
+                keyTargetHash: string;
+                parentContainerKeyEpochId: string | null;
+                recipientTargets: Record<string, unknown>[];
+                wraps: Record<string, unknown>[];
+            };
+            systemSlot?: string | null | undefined;
+        }[];
+        currentGrants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        currentMemberEnvelopes: {
+            envelopes: {
+                kemCipherText: string;
+                memberKeyFingerprint: string;
+                userId: string;
+                wrappedKey: string;
+            }[];
+            epoch: number;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+            createdAt: string;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentProjection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        currentState: {
+            createdAt: string;
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            stateHash: string;
+            version: number;
+        };
+    };
+    organizationPolicy: {
+        containerMutations: {
+            createdAt: string;
+            manifestHead: {
+                epoch: number;
+                manifestHash: string;
+            };
+            organizationId: string;
+            parentId: string | null;
+            referencedPrincipalHeads: {
+                principalType: "group";
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                stateHash: string;
+                version: number;
+            }[];
+            updatedAt: string;
+            accessManifest: {
+                event: {
+                    body: unknown;
+                    event: Record<string, unknown>;
+                    eventHash: string;
+                };
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            };
+            containerId: string;
+            containerKek: {
+                accessManifestHash: string;
+                containerId: string;
+                containerKeyEpoch: number;
+                containerKeyEpochId: string;
+                containerManifestHistory: {
+                    event: {
+                        body: unknown;
+                        event: Record<string, unknown>;
+                        eventHash: string;
+                    };
+                    manifest: Record<string, unknown>;
+                    manifestHash: string;
+                    state: Record<string, unknown>;
+                }[];
+                keyEpoch: Record<string, unknown>;
+                keyEpochHash: string;
+                keyring: {
+                    containerId: string;
+                    containerKeyEpochId: string;
+                    iv: string;
+                    sealed: string;
+                    sealingSuite: string;
+                    version: number;
+                } | null;
+                keyTargetHash: string;
+                parentContainerKeyEpochId: string | null;
+                recipientTargets: Record<string, unknown>[];
+                wraps: Record<string, unknown>[];
+            };
+            systemSlot?: string | null | undefined;
+        }[];
+        currentGrants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        currentMemberEnvelopes: {
+            envelopes: {
+                kemCipherText: string;
+                memberKeyFingerprint: string;
+                userId: string;
+                wrappedKey: string;
+            }[];
+            epoch: number;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+            createdAt: string;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentProjection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        currentState: {
+            createdAt: string;
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            stateHash: string;
+            version: number;
+        };
+    };
+}, {
+    groupPolicy: {
+        containerMutations: {
+            createdAt: string;
+            manifestHead: {
+                epoch: number;
+                manifestHash: string;
+            };
+            organizationId: string;
+            parentId: string | null;
+            referencedPrincipalHeads: {
+                principalType: "group";
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                stateHash: string;
+                version: number;
+            }[];
+            updatedAt: string;
+            accessManifest: {
+                event: {
+                    body: unknown;
+                    event: Record<string, unknown>;
+                    eventHash: string;
+                };
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            };
+            containerId: string;
+            containerKek: {
+                accessManifestHash: string;
+                containerId: string;
+                containerKeyEpoch: number;
+                containerKeyEpochId: string;
+                containerManifestHistory: {
+                    event: {
+                        body: unknown;
+                        event: Record<string, unknown>;
+                        eventHash: string;
+                    };
+                    manifest: Record<string, unknown>;
+                    manifestHash: string;
+                    state: Record<string, unknown>;
+                }[];
+                keyEpoch: Record<string, unknown>;
+                keyEpochHash: string;
+                keyring: {
+                    containerId: string;
+                    containerKeyEpochId: string;
+                    iv: string;
+                    sealed: string;
+                    sealingSuite: string;
+                    version: number;
+                } | null;
+                keyTargetHash: string;
+                parentContainerKeyEpochId: string | null;
+                recipientTargets: Record<string, unknown>[];
+                wraps: Record<string, unknown>[];
+            };
+            systemSlot?: string | null | undefined;
+        }[];
+        currentGrants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        currentMemberEnvelopes: {
+            envelopes: {
+                kemCipherText: string;
+                memberKeyFingerprint: string;
+                userId: string;
+                wrappedKey: string;
+            }[];
+            epoch: number;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+            createdAt: string;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentProjection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        currentState: {
+            createdAt: string;
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            stateHash: string;
+            version: number;
+        };
+    };
+    organizationPolicy: {
+        containerMutations: {
+            createdAt: string;
+            manifestHead: {
+                epoch: number;
+                manifestHash: string;
+            };
+            organizationId: string;
+            parentId: string | null;
+            referencedPrincipalHeads: {
+                principalType: "group";
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                stateHash: string;
+                version: number;
+            }[];
+            updatedAt: string;
+            accessManifest: {
+                event: {
+                    body: unknown;
+                    event: Record<string, unknown>;
+                    eventHash: string;
+                };
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            };
+            containerId: string;
+            containerKek: {
+                accessManifestHash: string;
+                containerId: string;
+                containerKeyEpoch: number;
+                containerKeyEpochId: string;
+                containerManifestHistory: {
+                    event: {
+                        body: unknown;
+                        event: Record<string, unknown>;
+                        eventHash: string;
+                    };
+                    manifest: Record<string, unknown>;
+                    manifestHash: string;
+                    state: Record<string, unknown>;
+                }[];
+                keyEpoch: Record<string, unknown>;
+                keyEpochHash: string;
+                keyring: {
+                    containerId: string;
+                    containerKeyEpochId: string;
+                    iv: string;
+                    sealed: string;
+                    sealingSuite: string;
+                    version: number;
+                } | null;
+                keyTargetHash: string;
+                parentContainerKeyEpochId: string | null;
+                recipientTargets: Record<string, unknown>[];
+                wraps: Record<string, unknown>[];
+            };
+            systemSlot?: string | null | undefined;
+        }[];
+        currentGrants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        currentMemberEnvelopes: {
+            envelopes: {
+                kemCipherText: string;
+                memberKeyFingerprint: string;
+                userId: string;
+                wrappedKey: string;
+            }[];
+            epoch: number;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+            createdAt: string;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentProjection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        currentState: {
+            createdAt: string;
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            stateHash: string;
+            version: number;
+        };
+    };
+}, z.core.$ZodTypeInternals<{
+    groupPolicy: {
+        containerMutations: {
+            createdAt: string;
+            manifestHead: {
+                epoch: number;
+                manifestHash: string;
+            };
+            organizationId: string;
+            parentId: string | null;
+            referencedPrincipalHeads: {
+                principalType: "group";
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                stateHash: string;
+                version: number;
+            }[];
+            updatedAt: string;
+            accessManifest: {
+                event: {
+                    body: unknown;
+                    event: Record<string, unknown>;
+                    eventHash: string;
+                };
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            };
+            containerId: string;
+            containerKek: {
+                accessManifestHash: string;
+                containerId: string;
+                containerKeyEpoch: number;
+                containerKeyEpochId: string;
+                containerManifestHistory: {
+                    event: {
+                        body: unknown;
+                        event: Record<string, unknown>;
+                        eventHash: string;
+                    };
+                    manifest: Record<string, unknown>;
+                    manifestHash: string;
+                    state: Record<string, unknown>;
+                }[];
+                keyEpoch: Record<string, unknown>;
+                keyEpochHash: string;
+                keyring: {
+                    containerId: string;
+                    containerKeyEpochId: string;
+                    iv: string;
+                    sealed: string;
+                    sealingSuite: string;
+                    version: number;
+                } | null;
+                keyTargetHash: string;
+                parentContainerKeyEpochId: string | null;
+                recipientTargets: Record<string, unknown>[];
+                wraps: Record<string, unknown>[];
+            };
+            systemSlot?: string | null | undefined;
+        }[];
+        currentGrants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        currentMemberEnvelopes: {
+            envelopes: {
+                kemCipherText: string;
+                memberKeyFingerprint: string;
+                userId: string;
+                wrappedKey: string;
+            }[];
+            epoch: number;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+            createdAt: string;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentProjection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        currentState: {
+            createdAt: string;
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            stateHash: string;
+            version: number;
+        };
+    };
+    organizationPolicy: {
+        containerMutations: {
+            createdAt: string;
+            manifestHead: {
+                epoch: number;
+                manifestHash: string;
+            };
+            organizationId: string;
+            parentId: string | null;
+            referencedPrincipalHeads: {
+                principalType: "group";
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                stateHash: string;
+                version: number;
+            }[];
+            updatedAt: string;
+            accessManifest: {
+                event: {
+                    body: unknown;
+                    event: Record<string, unknown>;
+                    eventHash: string;
+                };
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            };
+            containerId: string;
+            containerKek: {
+                accessManifestHash: string;
+                containerId: string;
+                containerKeyEpoch: number;
+                containerKeyEpochId: string;
+                containerManifestHistory: {
+                    event: {
+                        body: unknown;
+                        event: Record<string, unknown>;
+                        eventHash: string;
+                    };
+                    manifest: Record<string, unknown>;
+                    manifestHash: string;
+                    state: Record<string, unknown>;
+                }[];
+                keyEpoch: Record<string, unknown>;
+                keyEpochHash: string;
+                keyring: {
+                    containerId: string;
+                    containerKeyEpochId: string;
+                    iv: string;
+                    sealed: string;
+                    sealingSuite: string;
+                    version: number;
+                } | null;
+                keyTargetHash: string;
+                parentContainerKeyEpochId: string | null;
+                recipientTargets: Record<string, unknown>[];
+                wraps: Record<string, unknown>[];
+            };
+            systemSlot?: string | null | undefined;
+        }[];
+        currentGrants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        currentMemberEnvelopes: {
+            envelopes: {
+                kemCipherText: string;
+                memberKeyFingerprint: string;
+                userId: string;
+                wrappedKey: string;
+            }[];
+            epoch: number;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+            createdAt: string;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentProjection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        currentState: {
+            createdAt: string;
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            stateHash: string;
+            version: number;
+        };
+    };
+}, {
+    groupPolicy: {
+        containerMutations: {
+            createdAt: string;
+            manifestHead: {
+                epoch: number;
+                manifestHash: string;
+            };
+            organizationId: string;
+            parentId: string | null;
+            referencedPrincipalHeads: {
+                principalType: "group";
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                stateHash: string;
+                version: number;
+            }[];
+            updatedAt: string;
+            accessManifest: {
+                event: {
+                    body: unknown;
+                    event: Record<string, unknown>;
+                    eventHash: string;
+                };
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            };
+            containerId: string;
+            containerKek: {
+                accessManifestHash: string;
+                containerId: string;
+                containerKeyEpoch: number;
+                containerKeyEpochId: string;
+                containerManifestHistory: {
+                    event: {
+                        body: unknown;
+                        event: Record<string, unknown>;
+                        eventHash: string;
+                    };
+                    manifest: Record<string, unknown>;
+                    manifestHash: string;
+                    state: Record<string, unknown>;
+                }[];
+                keyEpoch: Record<string, unknown>;
+                keyEpochHash: string;
+                keyring: {
+                    containerId: string;
+                    containerKeyEpochId: string;
+                    iv: string;
+                    sealed: string;
+                    sealingSuite: string;
+                    version: number;
+                } | null;
+                keyTargetHash: string;
+                parentContainerKeyEpochId: string | null;
+                recipientTargets: Record<string, unknown>[];
+                wraps: Record<string, unknown>[];
+            };
+            systemSlot?: string | null | undefined;
+        }[];
+        currentGrants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        currentMemberEnvelopes: {
+            envelopes: {
+                kemCipherText: string;
+                memberKeyFingerprint: string;
+                userId: string;
+                wrappedKey: string;
+            }[];
+            epoch: number;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+            createdAt: string;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentProjection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        currentState: {
+            createdAt: string;
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            stateHash: string;
+            version: number;
+        };
+    };
+    organizationPolicy: {
+        containerMutations: {
+            createdAt: string;
+            manifestHead: {
+                epoch: number;
+                manifestHash: string;
+            };
+            organizationId: string;
+            parentId: string | null;
+            referencedPrincipalHeads: {
+                principalType: "group";
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                stateHash: string;
+                version: number;
+            }[];
+            updatedAt: string;
+            accessManifest: {
+                event: {
+                    body: unknown;
+                    event: Record<string, unknown>;
+                    eventHash: string;
+                };
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            };
+            containerId: string;
+            containerKek: {
+                accessManifestHash: string;
+                containerId: string;
+                containerKeyEpoch: number;
+                containerKeyEpochId: string;
+                containerManifestHistory: {
+                    event: {
+                        body: unknown;
+                        event: Record<string, unknown>;
+                        eventHash: string;
+                    };
+                    manifest: Record<string, unknown>;
+                    manifestHash: string;
+                    state: Record<string, unknown>;
+                }[];
+                keyEpoch: Record<string, unknown>;
+                keyEpochHash: string;
+                keyring: {
+                    containerId: string;
+                    containerKeyEpochId: string;
+                    iv: string;
+                    sealed: string;
+                    sealingSuite: string;
+                    version: number;
+                } | null;
+                keyTargetHash: string;
+                parentContainerKeyEpochId: string | null;
+                recipientTargets: Record<string, unknown>[];
+                wraps: Record<string, unknown>[];
+            };
+            systemSlot?: string | null | undefined;
+        }[];
+        currentGrants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        currentMemberEnvelopes: {
+            envelopes: {
+                kemCipherText: string;
+                memberKeyFingerprint: string;
+                userId: string;
+                wrappedKey: string;
+            }[];
+            epoch: number;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+            createdAt: string;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentProjection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        currentState: {
+            createdAt: string;
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            stateHash: string;
+            version: number;
+        };
+    };
+}>>;
+export type CommitOrganizationGroupPolicyResponse = z.infer<typeof CommitOrganizationGroupPolicyResponseSchema>;
+export declare const PrincipalPolicyErrorResponseSchema: z.ZodType<{
+    error: string;
+    code?: "billing_checkout_no_active_members" | "billing_roster_over_capacity" | undefined;
+}, {
+    error: string;
+    code?: "billing_checkout_no_active_members" | "billing_roster_over_capacity" | undefined;
+}, z.core.$ZodTypeInternals<{
+    error: string;
+    code?: "billing_checkout_no_active_members" | "billing_roster_over_capacity" | undefined;
+}, {
+    error: string;
+    code?: "billing_checkout_no_active_members" | "billing_roster_over_capacity" | undefined;
+}>>;
+export type PrincipalPolicyErrorResponse = z.infer<typeof PrincipalPolicyErrorResponseSchema>;
+/**
+ * The commit's conflict envelope alone: only a group commit carries container
+ * mutations, so only it can be refused for what they strand. The principal
+ * policy read and the organization policy write keep the plain envelope.
+ */
+export declare const CommitOrganizationGroupPolicyConflictResponseSchema: z.ZodUnion<readonly [z.ZodType<{
+    error: string;
+    code?: "billing_checkout_no_active_members" | "billing_roster_over_capacity" | undefined;
+}, {
+    error: string;
+    code?: "billing_checkout_no_active_members" | "billing_roster_over_capacity" | undefined;
+}, z.core.$ZodTypeInternals<{
+    error: string;
+    code?: "billing_checkout_no_active_members" | "billing_roster_over_capacity" | undefined;
+}, {
+    error: string;
+    code?: "billing_checkout_no_active_members" | "billing_roster_over_capacity" | undefined;
+}>>, z.ZodType<{
+    code: "container_descendant_rekeys_required";
+    error: string;
+    requiredContainerIds: string[];
+}, {
+    code: "container_descendant_rekeys_required";
+    error: string;
+    requiredContainerIds: string[];
+}, z.core.$ZodTypeInternals<{
+    code: "container_descendant_rekeys_required";
+    error: string;
+    requiredContainerIds: string[];
+}, {
+    code: "container_descendant_rekeys_required";
+    error: string;
+    requiredContainerIds: string[];
+}>>]>;
+export declare const PrincipalPolicyStaleErrorResponseSchema: z.ZodType<{
+    code: "principal_policy_stale";
+    error: string;
+    principalPolicies: {
+        previousStates: {
+            grants: {
+                accessLevel: "admin" | "read" | "write";
+                containerId: string;
+            }[];
+            projection: {
+                role: "member" | "admin";
+                userId: string;
+            }[];
+            state: {
+                createdAt: string;
+                encapsulationPublicKey: string;
+                externalAuthority: {
+                    keyEpoch: number;
+                    keyFingerprint: string;
+                    principalId: string;
+                    principalType: "group";
+                    stateHash: string;
+                    version: number;
+                } | null;
+                grantCount: number;
+                grantRoot: string;
+                keyEpoch: number;
+                keyFingerprint: string;
+                memberCount: number;
+                memberEnvelopesRoot: string;
+                membershipMode: "projection";
+                membershipRoot: string;
+                payloadCiphertextHash: string;
+                prevStateHash: string | null;
+                principalId: string;
+                principalType: "group" | "organization";
+                projectionRoot: string;
+                signature: string;
+                signedAt: string;
+                signerUserId: string;
+                signerUserKeyFingerprint: string;
+                stateHash: string;
+                version: number;
+            };
+        }[];
+        currentGrants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        currentMemberEnvelopes: {
+            envelopes: {
+                kemCipherText: string;
+                memberKeyFingerprint: string;
+                userId: string;
+                wrappedKey: string;
+            }[];
+            epoch: number;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+            createdAt: string;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentProjection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        currentState: {
+            createdAt: string;
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            stateHash: string;
+            version: number;
+        };
+    }[];
+}, {
+    code: "principal_policy_stale";
+    error: string;
+    principalPolicies: {
+        previousStates: {
+            grants: {
+                accessLevel: "admin" | "read" | "write";
+                containerId: string;
+            }[];
+            projection: {
+                role: "member" | "admin";
+                userId: string;
+            }[];
+            state: {
+                createdAt: string;
+                encapsulationPublicKey: string;
+                externalAuthority: {
+                    keyEpoch: number;
+                    keyFingerprint: string;
+                    principalId: string;
+                    principalType: "group";
+                    stateHash: string;
+                    version: number;
+                } | null;
+                grantCount: number;
+                grantRoot: string;
+                keyEpoch: number;
+                keyFingerprint: string;
+                memberCount: number;
+                memberEnvelopesRoot: string;
+                membershipMode: "projection";
+                membershipRoot: string;
+                payloadCiphertextHash: string;
+                prevStateHash: string | null;
+                principalId: string;
+                principalType: "group" | "organization";
+                projectionRoot: string;
+                signature: string;
+                signedAt: string;
+                signerUserId: string;
+                signerUserKeyFingerprint: string;
+                stateHash: string;
+                version: number;
+            };
+        }[];
+        currentGrants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        currentMemberEnvelopes: {
+            envelopes: {
+                kemCipherText: string;
+                memberKeyFingerprint: string;
+                userId: string;
+                wrappedKey: string;
+            }[];
+            epoch: number;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+            createdAt: string;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentProjection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        currentState: {
+            createdAt: string;
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            stateHash: string;
+            version: number;
+        };
+    }[];
+}, z.core.$ZodTypeInternals<{
+    code: "principal_policy_stale";
+    error: string;
+    principalPolicies: {
+        previousStates: {
+            grants: {
+                accessLevel: "admin" | "read" | "write";
+                containerId: string;
+            }[];
+            projection: {
+                role: "member" | "admin";
+                userId: string;
+            }[];
+            state: {
+                createdAt: string;
+                encapsulationPublicKey: string;
+                externalAuthority: {
+                    keyEpoch: number;
+                    keyFingerprint: string;
+                    principalId: string;
+                    principalType: "group";
+                    stateHash: string;
+                    version: number;
+                } | null;
+                grantCount: number;
+                grantRoot: string;
+                keyEpoch: number;
+                keyFingerprint: string;
+                memberCount: number;
+                memberEnvelopesRoot: string;
+                membershipMode: "projection";
+                membershipRoot: string;
+                payloadCiphertextHash: string;
+                prevStateHash: string | null;
+                principalId: string;
+                principalType: "group" | "organization";
+                projectionRoot: string;
+                signature: string;
+                signedAt: string;
+                signerUserId: string;
+                signerUserKeyFingerprint: string;
+                stateHash: string;
+                version: number;
+            };
+        }[];
+        currentGrants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        currentMemberEnvelopes: {
+            envelopes: {
+                kemCipherText: string;
+                memberKeyFingerprint: string;
+                userId: string;
+                wrappedKey: string;
+            }[];
+            epoch: number;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+            createdAt: string;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentProjection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        currentState: {
+            createdAt: string;
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            stateHash: string;
+            version: number;
+        };
+    }[];
+}, {
+    code: "principal_policy_stale";
+    error: string;
+    principalPolicies: {
+        previousStates: {
+            grants: {
+                accessLevel: "admin" | "read" | "write";
+                containerId: string;
+            }[];
+            projection: {
+                role: "member" | "admin";
+                userId: string;
+            }[];
+            state: {
+                createdAt: string;
+                encapsulationPublicKey: string;
+                externalAuthority: {
+                    keyEpoch: number;
+                    keyFingerprint: string;
+                    principalId: string;
+                    principalType: "group";
+                    stateHash: string;
+                    version: number;
+                } | null;
+                grantCount: number;
+                grantRoot: string;
+                keyEpoch: number;
+                keyFingerprint: string;
+                memberCount: number;
+                memberEnvelopesRoot: string;
+                membershipMode: "projection";
+                membershipRoot: string;
+                payloadCiphertextHash: string;
+                prevStateHash: string | null;
+                principalId: string;
+                principalType: "group" | "organization";
+                projectionRoot: string;
+                signature: string;
+                signedAt: string;
+                signerUserId: string;
+                signerUserKeyFingerprint: string;
+                stateHash: string;
+                version: number;
+            };
+        }[];
+        currentGrants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        currentMemberEnvelopes: {
+            envelopes: {
+                kemCipherText: string;
+                memberKeyFingerprint: string;
+                userId: string;
+                wrappedKey: string;
+            }[];
+            epoch: number;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+            createdAt: string;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentProjection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        currentState: {
+            createdAt: string;
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            stateHash: string;
+            version: number;
+        };
+    }[];
+}>>;
+export type PrincipalPolicyStaleErrorResponse = z.infer<typeof PrincipalPolicyStaleErrorResponseSchema>;
+export declare function isPrincipalPolicyBundleResponse(value: unknown): value is PrincipalPolicyBundleResponse;
+export declare function isPrincipalPolicyMutationResponse(value: unknown): value is PrincipalPolicyMutationResponse;
+export declare function isCommitOrganizationGroupPolicyResponse(value: unknown): value is CommitOrganizationGroupPolicyResponse;
+export declare function isPrincipalPolicyStaleErrorResponse(value: unknown): value is PrincipalPolicyStaleErrorResponse;