@tearleads/client-sdk 0.1.105 → 0.1.107

package/client/session/sessionTypes.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessionTypes.js","sourceRoot":"","sources":["sessionTypes.ts"],"names":[],"mappings":"","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { DocumentProjectorRegistryInput } from \"../../data/documents/documentKinds\";\nimport type { SecurityIncidentReporter } from \"../../data/shared/securityIncidents\";\nimport type { ProvisionedSystemContainerSpec } from \"../../workflows/registration\";\nimport type { ProvisionedPrincipalHistoryPrimer } from \"../../workflows/registration/provisionedPrincipalHistory\";\nimport type { ClearRemoteSyncStateResult } from \"../../workflows/sync\";\nimport type { Identity } from \"../identity\";\nimport type { Database } from \"../runtime/database\";\nimport type {\n  BoundUserIdLookup,\n  SessionRegistrationRefusal,\n  UserIdentityAvailable,\n} from \"./sessionIdentityTrust\";\n\nexport type { SessionRegistrationRefusal } from \"./sessionIdentityTrust\";\n\nexport interface SessionDependencies {\n  api: ApiClient;\n  database: Database;\n  documentProjectors?: DocumentProjectorRegistryInput | undefined;\n  identity: Identity;\n  log: (message: string) => void;\n  logError: (message: string | Error, cause?: unknown) => void;\n  /** The user this device's trust store already binds a signing key to. */\n  boundUserIdForSigningKey?: BoundUserIdLookup | undefined;\n  onUserIdentityAvailable?: UserIdentityAvailable | undefined;\n  /** Seeds verified recovery progress for a new organization's founding heads. */\n  primeProvisionedPrincipalHistory?:\n    | ProvisionedPrincipalHistoryPrimer\n    | undefined;\n  /** App-owned system containers provisioned with each new organization. */\n  provisionedSystemContainers?:\n    | ReadonlyArray<ProvisionedSystemContainerSpec>\n    | undefined;\n  /**\n   * Records a refused login (a different account than acknowledged) or a\n   * refused root acknowledgement; absent in bare test harnesses.\n   */\n  reportSecurityIncident?: SecurityIncidentReporter | undefined;\n}\n\nexport interface SessionContext {\n  /** Fingerprint-bound host restore only; view selections never acknowledge roots. */\n  rootAcknowledgments?: SessionSnapshot[\"rootAcknowledgments\"] | undefined;\n  authToken?: string | null | undefined;\n  containerId?: string | null | undefined;\n  /** Server-backed personal organization; independent of the active org. */\n  defaultOrganizationId?: string | null | undefined;\n  isAuthenticated?: boolean | undefined;\n  /** Platform-operator flag reported by the server at login. */\n  isRoot?: boolean | undefined;\n  organizationId?: string | null | undefined;\n  userId?: string | null | undefined;\n}\n\nexport interface SessionSnapshot {\n  /**\n   * Server acknowledgements retained independently of the selected container.\n   * Bound to (signing fingerprint, user, organization): once acknowledged, an\n   * organization's root id may only be re-acknowledged or reported purged.\n   */\n  rootAcknowledgments: ReadonlyArray<{\n    readonly signingFingerprint: string;\n    readonly userId: string;\n    readonly organizationId: string;\n    readonly rootContainerId: string | null;\n  }>;\n  authToken: string | null;\n  containerId: string | null;\n  /** Server-backed personal organization; independent of the active org. */\n  defaultOrganizationId: string | null;\n  isAuthenticated: boolean;\n  /** Platform-operator flag reported by the server at login. */\n  isRoot: boolean;\n  organizationId: string | null;\n  userId: string | null;\n}\n\nexport type SessionListener = () => void;\n\nexport interface SessionRegistrationResult {\n  readonly challenge: string;\n  readonly containerId: string;\n  readonly organizationId: string;\n  readonly userId: string;\n}\n\nexport interface SessionCreateOrganizationResult {\n  readonly containerId: string;\n  readonly organizationId: string;\n}\n\nexport interface SessionRecoverOrganizationResult\n  extends SessionCreateOrganizationResult {\n  readonly reset: ClearRemoteSyncStateResult;\n  readonly replacedOrganizationId: string;\n}\n\nexport interface CreateOrganizationOptions {\n  /** Overrides the seeded organization profile name; see registration. */\n  readonly organizationProfileName?: string | undefined;\n  /** Overrides the seeded self roster-profile nickname; see registration. */\n  readonly rosterProfileNickname?: string | undefined;\n}\n\nexport interface RegisterIdentityOptions {\n  /**\n   * Overrides the seeded personal-organization profile name. Optional; when\n   * omitted the default personal-org name is used. The demo host passes each\n   * pane's peer-labeled org name (\"Peer 1's Org\").\n   */\n  readonly organizationProfileName?: string | undefined;\n  /**\n   * Overrides the seeded self roster-profile nickname. Optional; when omitted\n   * the default (\"You\") is used. The demo host passes each pane's peer-labeled\n   * self name (\"Peer 1 (You)\").\n   */\n  readonly rosterProfileNickname?: string | undefined;\n}\n\nexport interface UserSession {\n  readonly createdAt: string;\n  readonly id: string;\n  readonly ipAddresses: string[];\n  readonly isCurrent: boolean;\n  readonly lastActiveAt: string;\n  readonly lastActiveIp: string | null;\n  readonly signingKeyFingerprint: string;\n}\n\nexport interface Session {\n  readonly authToken: string | null;\n  readonly containerId: string | null;\n  /** Server-backed personal organization; independent of the active org. */\n  readonly defaultOrganizationId: string | null;\n  readonly isAuthenticated: boolean;\n  /**\n   * Platform-operator flag reported by the server at login. It only decides\n   * whether the root console is offered; the API enforces root access itself.\n   */\n  readonly isRoot: boolean;\n  readonly organizationId: string | null;\n  readonly snapshot: SessionSnapshot;\n  /** Controls server replication without changing network connectivity. */\n  readonly syncEnabled: boolean;\n  readonly userId: string | null;\n  /**\n   * Whether `userId` was acknowledged by the server for the active signing\n   * identity (a successful login or a fingerprint-bound host restore). A user\n   * ID chosen locally through `setUserId` is not, and hosts must not persist\n   * it as this identity's account.\n   */\n  readonly userIdAcknowledged: boolean;\n  bootstrapLocalRootContainer(): Promise<{\n    containerId: string;\n    created: boolean;\n  }>;\n  clearRemoteSyncState(\n    organizationId: string,\n  ): Promise<ClearRemoteSyncStateResult>;\n  createOrganization(\n    options?: CreateOrganizationOptions,\n  ): Promise<SessionCreateOrganizationResult | null>;\n  completeNativeSubscriptionRestoreOrganization(\n    organizationId: string,\n  ): Promise<boolean>;\n  destroySession(sessionId: string): Promise<boolean>;\n  listSessions(): Promise<UserSession[]>;\n  login(challengeHex?: string | undefined): Promise<boolean>;\n  logout(): void;\n  logoutRemote(): Promise<boolean>;\n  prepareNativeSubscriptionRestoreOrganization(\n    options?: CreateOrganizationOptions,\n  ): Promise<SessionCreateOrganizationResult | null>;\n  registerIdentity(\n    options?: RegisterIdentityOptions,\n  ): Promise<SessionRegistrationResult | SessionRegistrationRefusal | null>;\n  recoverPurgedOrganization(\n    organizationId: string,\n    options?: CreateOrganizationOptions,\n  ): Promise<SessionRecoverOrganizationResult | null>;\n  setAuthToken(authToken: string | null): void;\n  setContainerId(containerId: string | null): void;\n  /** Host-restored context must match the active signing identity; conflicting user acknowledgments throw. */\n  setContext(context: SessionContext): void;\n  setOrganizationId(organizationId: string | null): void;\n  setSyncEnabled(enabled: boolean): void;\n  setUserId(userId: string | null): void;\n  subscribe(listener: SessionListener): () => void;\n}\n"]}
+{"version":3,"file":"sessionTypes.js","sourceRoot":"","sources":["sessionTypes.ts"],"names":[],"mappings":"","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { DocumentProjectorRegistryInput } from \"../../data/documents/documentKinds\";\nimport type { SecurityIncidentReporter } from \"../../data/shared/securityIncidents\";\nimport type { ProvisionedSystemContainerSpec } from \"../../workflows/registration\";\nimport type { ProvisionedPrincipalHistoryPrimer } from \"../../workflows/registration/provisionedPrincipalHistory\";\nimport type { ClearRemoteSyncStateResult } from \"../../workflows/sync\";\nimport type { Identity } from \"../identity\";\nimport type { Database } from \"../runtime/database\";\nimport type {\n  BoundUserIdLookup,\n  SessionRegistrationRefusal,\n  UserIdentityAvailable,\n} from \"./sessionIdentityTrust\";\n\nexport type { SessionRegistrationRefusal } from \"./sessionIdentityTrust\";\n\nexport interface SessionDependencies {\n  api: ApiClient;\n  database: Database;\n  documentProjectors?: DocumentProjectorRegistryInput | undefined;\n  identity: Identity;\n  log: (message: string) => void;\n  logError: (message: string | Error, cause?: unknown) => void;\n  /** The user this device's trust store already binds a signing key to. */\n  boundUserIdForSigningKey?: BoundUserIdLookup | undefined;\n  onUserIdentityAvailable?: UserIdentityAvailable | undefined;\n  /** Seeds verified recovery progress for a new organization's founding heads. */\n  primeProvisionedPrincipalHistory?:\n    | ProvisionedPrincipalHistoryPrimer\n    | undefined;\n  /** App-owned system containers provisioned with each new organization. */\n  provisionedSystemContainers?:\n    | ReadonlyArray<ProvisionedSystemContainerSpec>\n    | undefined;\n  /**\n   * Records a refused login (a different account than acknowledged) or a\n   * refused root acknowledgement; absent in bare test harnesses.\n   */\n  reportSecurityIncident?: SecurityIncidentReporter | undefined;\n}\n\nexport interface SessionContext {\n  /** Fingerprint-bound host restore only; view selections never acknowledge roots. */\n  rootAcknowledgments?: SessionSnapshot[\"rootAcknowledgments\"] | undefined;\n  authToken?: string | null | undefined;\n  containerId?: string | null | undefined;\n  /** Server-backed personal organization; independent of the active org. */\n  defaultOrganizationId?: string | null | undefined;\n  isAuthenticated?: boolean | undefined;\n  /** Platform-operator flag reported by the server at login. */\n  isRoot?: boolean | undefined;\n  organizationId?: string | null | undefined;\n  userId?: string | null | undefined;\n}\n\nexport interface SessionSnapshot {\n  /**\n   * Server acknowledgements retained independently of the selected container.\n   * Bound to (signing fingerprint, user, organization): once acknowledged, an\n   * organization's root id may only be re-acknowledged or reported purged.\n   */\n  rootAcknowledgments: ReadonlyArray<{\n    readonly signingFingerprint: string;\n    readonly userId: string;\n    readonly organizationId: string;\n    readonly rootContainerId: string | null;\n  }>;\n  authToken: string | null;\n  containerId: string | null;\n  /** Server-backed personal organization; independent of the active org. */\n  defaultOrganizationId: string | null;\n  isAuthenticated: boolean;\n  /** Platform-operator flag reported by the server at login. */\n  isRoot: boolean;\n  organizationId: string | null;\n  userId: string | null;\n}\n\nexport type SessionListener = () => void;\n\nexport interface SessionRegistrationResult {\n  readonly challenge: string;\n  readonly containerId: string;\n  readonly organizationId: string;\n  readonly userId: string;\n}\n\nexport interface SessionCreateOrganizationResult {\n  readonly containerId: string;\n  readonly organizationId: string;\n}\n\nexport interface SessionRecoverOrganizationResult\n  extends SessionCreateOrganizationResult {\n  readonly reset: ClearRemoteSyncStateResult;\n  readonly replacedOrganizationId: string;\n}\n\nexport interface CreateOrganizationOptions {\n  /** Overrides the seeded organization profile name; see registration. */\n  readonly organizationProfileName?: string | undefined;\n  /** Overrides the seeded self roster-profile nickname; see registration. */\n  readonly rosterProfileNickname?: string | undefined;\n}\n\nexport interface RegisterIdentityOptions {\n  /**\n   * Overrides the seeded personal-organization profile name. Optional; when\n   * omitted the default personal-org name is used. The demo host passes each\n   * pane's peer-labeled org name (\"Peer 1's Org\").\n   */\n  readonly organizationProfileName?: string | undefined;\n  /**\n   * Overrides the seeded self roster-profile nickname. Optional; when omitted\n   * the default (\"You\") is used. The demo host passes each pane's peer-labeled\n   * self name (\"Peer 1 (You)\").\n   */\n  readonly rosterProfileNickname?: string | undefined;\n}\n\nexport interface UserSession {\n  readonly createdAt: string;\n  readonly id: string;\n  readonly ipAddresses: string[];\n  readonly isCurrent: boolean;\n  readonly lastActiveAt: string;\n  readonly lastActiveIp: string | null;\n  readonly signingKeyFingerprint: string;\n}\n\nexport interface Session {\n  readonly authToken: string | null;\n  readonly containerId: string | null;\n  /** Server-backed personal organization; independent of the active org. */\n  readonly defaultOrganizationId: string | null;\n  readonly isAuthenticated: boolean;\n  /**\n   * Platform-operator flag reported by the server at login. It only decides\n   * whether the root console is offered; the API enforces root access itself.\n   */\n  readonly isRoot: boolean;\n  readonly organizationId: string | null;\n  readonly snapshot: SessionSnapshot;\n  /** Controls server replication without changing network connectivity. */\n  readonly syncEnabled: boolean;\n  readonly userId: string | null;\n  /**\n   * Whether `userId` was acknowledged by the server for the active signing\n   * identity (a successful login or a fingerprint-bound host restore). A user\n   * ID chosen locally through `setUserId` is not, and hosts must not persist\n   * it as this identity's account.\n   */\n  readonly userIdAcknowledged: boolean;\n  bootstrapLocalRootContainer(isCurrent?: () => boolean): Promise<{\n    containerId: string;\n    created: boolean;\n  }>;\n  clearRemoteSyncState(\n    organizationId: string,\n  ): Promise<ClearRemoteSyncStateResult>;\n  createOrganization(\n    options?: CreateOrganizationOptions,\n  ): Promise<SessionCreateOrganizationResult | null>;\n  completeNativeSubscriptionRestoreOrganization(\n    organizationId: string,\n  ): Promise<boolean>;\n  destroySession(sessionId: string): Promise<boolean>;\n  listSessions(): Promise<UserSession[]>;\n  login(challengeHex?: string | undefined): Promise<boolean>;\n  logout(): void;\n  logoutRemote(): Promise<boolean>;\n  prepareNativeSubscriptionRestoreOrganization(\n    options?: CreateOrganizationOptions,\n  ): Promise<SessionCreateOrganizationResult | null>;\n  registerIdentity(\n    options?: RegisterIdentityOptions,\n  ): Promise<SessionRegistrationResult | SessionRegistrationRefusal | null>;\n  recoverPurgedOrganization(\n    organizationId: string,\n    options?: CreateOrganizationOptions,\n  ): Promise<SessionRecoverOrganizationResult | null>;\n  setAuthToken(authToken: string | null): void;\n  setContainerId(containerId: string | null): void;\n  /** Host-restored context must match the active signing identity; conflicting user acknowledgments throw. */\n  setContext(context: SessionContext): void;\n  setOrganizationId(organizationId: string | null): void;\n  setSyncEnabled(enabled: boolean): void;\n  setUserId(userId: string | null): void;\n  subscribe(listener: SessionListener): () => void;\n}\n"]}

package/index.js

@@ -1,4 +1,4 @@
-// SDK: verified identity links, read-only pins and device-first handles.
+// SDK: verified identity links and cancellable identity setup.
 // Authority loaders take exact heads, including cached citations. Obsolete
 // adapters are excluded; authored policy journals survive restart. See workflows/README.md.
 export { ApiRequestMetrics, } from "./internal/api-client/index.js";

package/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,2EAA2E;AAC3E,4FAA4F;AAC5F,OAAO,EAGL,iBAAiB,GAElB,MAAM,uBAAuB,CAAC;AAsK/B,OAAO,EAEL,KAAK,EACL,yBAAyB,EACzB,sCAAsC,EACtC,gCAAgC,EAChC,sCAAsC,EACtC,iBAAiB,EACjB,wCAAwC,EACxC,kCAAkC,EAClC,kBAAkB,EAClB,2CAA2C,EAC3C,qCAAqC,EACrC,+BAA+B,EAC/B,gCAAgC,EAChC,gCAAgC,EAChC,yBAAyB,EACzB,+BAA+B,EAC/B,0BAA0B,EAC1B,yBAAyB,EACzB,QAAQ,EACR,mBAAmB,EAKnB,8BAA8B,EAC9B,2BAA2B,EAC3B,MAAM,EAGN,2BAA2B,EAC3B,8BAA8B,EAC9B,2BAA2B,EAC3B,mCAAmC,EACnC,6BAA6B,EAC7B,oBAAoB,EACpB,OAAO,EACP,0BAA0B,EAG1B,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAE5B,yBAAyB,EACzB,8CAA8C,EAC9C,yBAAyB,EAKzB,eAAe,EAIf,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,UAAU,CAAC;AAuBlB,OAAO,EACL,sBAAsB,EACtB,+BAA+B,EAC/B,4BAA4B,EAC5B,6BAA6B,EAC7B,qBAAqB,EACrB,gCAAgC,EAChC,yBAAyB,EACzB,iCAAiC,EACjC,sBAAsB,EACtB,iCAAiC,EACjC,0BAA0B,EAC1B,wBAAwB,EACxB,4BAA4B,EAC5B,0BAA0B,EAC1B,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,EAC7B,cAAc,EACd,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAY1B,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,EACjC,qCAAqC,EACrC,iCAAiC,EACjC,qBAAqB,EACrB,uCAAuC,EACvC,iCAAiC,EACjC,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,6BAA6B,CAAC;AAQrC,OAAO,EACL,mBAAmB,EACnB,mCAAmC,EACnC,wBAAwB,EACxB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAexC,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,wBAAwB,EACxB,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,8BAA8B,EAC9B,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAc3B,OAAO,EACL,uCAAuC,EACvC,gDAAgD,EAChD,2CAA2C,EAC3C,+BAA+B,EAC/B,sCAAsC,EACtC,6BAA6B,EAC7B,0CAA0C,EAC1C,mCAAmC,EACnC,yBAAyB,EACzB,6BAA6B,EAC7B,YAAY,EACZ,8BAA8B,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,sCAAsC,GACvC,MAAM,gCAAgC,CAAC;AASxC,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,0BAA0B,EAC1B,mCAAmC,EACnC,+BAA+B,EAC/B,kCAAkC,EAClC,yBAAyB,EACzB,6BAA6B,EAC7B,sCAAsC,EACtC,qBAAqB,EACrB,oBAAoB,EACpB,8BAA8B,EAE9B,sCAAsC,EACtC,mBAAmB,EACnB,4BAA4B,EAC5B,4BAA4B,EAC5B,oBAAoB,EACpB,qBAAqB,EACrB,2CAA2C,EAC3C,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAgBhC,OAAO,EACL,mCAAmC,EACnC,uCAAuC,EACvC,8BAA8B,EAC9B,oBAAoB,EACpB,4BAA4B,EAC5B,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,kCAAkC,EAClC,wCAAwC,EACxC,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACtB,8BAA8B,EAC9B,iCAAiC,GAClC,MAAM,uBAAuB,CAAC;AAkB/B,OAAO,EACL,iCAAiC,EACjC,wBAAwB,EACxB,8BAA8B,EAC9B,oCAAoC,EACpC,mCAAmC,EACnC,qCAAqC,EACrC,+BAA+B,EAC/B,8BAA8B,EAC9B,sCAAsC,EACtC,uBAAuB,EACvB,0CAA0C,EAC1C,6CAA6C,EAC7C,kDAAkD,EAClD,2CAA2C,EAC3C,gCAAgC,EAChC,2BAA2B,EAC3B,qCAAqC,EACrC,+BAA+B,EAC/B,sBAAsB,EACtB,8BAA8B,EAC9B,uCAAuC,EACvC,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,oCAAoC,EACpC,kCAAkC,EAClC,0CAA0C,EAC1C,6BAA6B,EAC7B,oCAAoC,EACpC,4BAA4B,EAC5B,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC9B,uCAAuC,EACvC,iCAAiC,EACjC,2BAA2B,EAC3B,8BAA8B,EAC9B,mCAAmC,EACnC,gCAAgC,EAChC,6BAA6B,EAC7B,sBAAsB,EACtB,gCAAgC,EAChC,0CAA0C,EAC1C,gCAAgC,EAChC,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AAWnC,OAAO,EACL,gCAAgC,EAChC,uCAAuC,EACvC,+BAA+B,EAC/B,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,GACpC,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EACL,sBAAsB,EACtB,qCAAqC,EACrC,kCAAkC,EAClC,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAWlC,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,EAClB,6BAA6B,EAC7B,8BAA8B,EAC9B,oCAAoC,EACpC,qBAAqB,EACrB,8BAA8B,EAC9B,gBAAgB,EAChB,uBAAuB,EACvB,oBAAoB,EACpB,6BAA6B,EAyB7B,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAe1B,OAAO,EACL,oBAAoB,EACpB,gCAAgC,EAChC,gCAAgC,EAChC,mCAAmC,EACnC,yBAAyB,EACzB,gCAAgC,EAChC,oCAAoC,GACrC,MAAM,kBAAkB,CAAC","sourcesContent":["// SDK: verified identity links, read-only pins and device-first handles.\n// Authority loaders take exact heads, including cached citations. Obsolete\n// adapters are excluded; authored policy journals survive restart. See workflows/README.md.\nexport {\n  type ApiRequestCounts,\n  type ApiRequestEndpointCounts,\n  ApiRequestMetrics,\n  type ApiRequestMetricsSnapshot,\n} from \"@tearleads/api-client\";\nexport type {\n  AbandonOrganizationPolicyMutationInput,\n  AddOrganizationGroupUserInput,\n  BlobInfo,\n  BlobInfoAttachmentKind,\n  BlobInfoDocumentReference,\n  BlobInfoInput,\n  BlobInfoList,\n  BlobInfoSort,\n  BlobInfoSortDirection,\n  BlobInfoSortKey,\n  BrowserLocalKeyringOptions,\n  ContainerContents,\n  ContainerContentsContextValue,\n  ContainerContentsStore,\n  ContainerContentsStoreOptions,\n  ContainerDocumentLinkInput,\n  ContainerDocumentLinks,\n  ContainerDocumentObjectSyncState,\n  ContainerDocumentObjectSyncStatus,\n  ContainerDocumentQueries,\n  ContainerDocumentSidebarRow,\n  ContainerInfo,\n  ContainerInfoInput,\n  ContainerItemRow,\n  ContainerItemSort,\n  ContainerItemSortDirection,\n  ContainerItemSortKey,\n  ContainerNode,\n  ContainerShareAccessLevel,\n  CreateOrganizationOptions,\n  DatabaseListener,\n  DatabaseOptions,\n  DatabaseSnapshot,\n  DatabaseStatus,\n  DeviceFirst,\n  DeviceFirstContainerContents,\n  DiscardUnreadableOrganizationPolicyMutationInput,\n  DocumentAttachmentStatus,\n  DocumentAttachmentUpload,\n  DocumentAttributionRangesInput,\n  DocumentAttributionRangesPage,\n  DocumentContextValue,\n  DocumentInfo,\n  DocumentInfoInput,\n  DocumentList,\n  DocumentSort,\n  DocumentSortDirection,\n  DocumentSortKey,\n  DocumentStore,\n  DocumentSubscriptionOptions,\n  Documents,\n  DocumentsRuntime,\n  DomainScope,\n  FileSaver,\n  Identity,\n  IdentityGenerationResult,\n  IdentityKeyPackage,\n  IdentityListener,\n  IdentityOptions,\n  IdentitySnapshot,\n  ImportedOrganizationUser,\n  IndexedDbLocalKeyringManifestStoreOptions,\n  IndexedDbWrappingKeyKeystoreOptions,\n  LinkDocumentToContainerInput,\n  ListDocumentsInput,\n  LocalKeyPurpose,\n  LocalKeyring,\n  LocalKeyringManifest,\n  LocalKeyringManifestFormat,\n  LocalKeyringManifestStorage,\n  LocalKeyringManifestStore,\n  LocalKeyringOptions,\n  LocalKeyringPinCode,\n  LocalKeyringScope,\n  LocalKeyringSession,\n  LocalOrganizationSummary,\n  LocalProjectionReconciledDelta,\n  LocalProjectionSnapshot,\n  LocalProjectionView,\n  LocalSecretContext,\n  LocalStorageLocalKeyringManifestStoreOptions,\n  Logger,\n  MergeDocumentSummary,\n  MoveDocumentToContainerInput,\n  NetworkListener,\n  NetworkMode,\n  NetworkStatusSource,\n  NormalizedLocalKeyringScope,\n  OpenContainerDocumentInput,\n  OpenDocumentInput,\n  OpenDocumentOptions,\n  OrganizationBilling,\n  OrganizationBillingHistory,\n  OrganizationBillingHistoryEntry,\n  OrganizationBillingManagementUrl,\n  OrganizationBillingView,\n  OrganizationContainerGrant,\n  OrganizationContainerGrants,\n  OrganizationDataUsage,\n  OrganizationDirectory,\n  OrganizationDirectoryAndGroups,\n  OrganizationDirectoryUser,\n  OrganizationGrantRef,\n  OrganizationGroupContainer,\n  OrganizationGroupContainers,\n  OrganizationGroupDetails,\n  OrganizationGroupMember,\n  OrganizationGroupMembers,\n  OrganizationGroupMutationReceipt,\n  OrganizationGroupPolicyHistory,\n  OrganizationGroupSummary,\n  OrganizationLeaveRequestResult,\n  OrganizationMembership,\n  OrganizationMemberships,\n  OrganizationPolicyGrantChange,\n  OrganizationPolicyGroupChange,\n  /** Verified organization display page with an optional older-page cursor. */\n  OrganizationPolicyHistory,\n  OrganizationPolicyHistoryEntry,\n  OrganizationProfile,\n  OrganizationSyncPauseResult,\n  Organizations,\n  OrganizationUserDetail,\n  PendingWriteQueueItem,\n  PendingWriteQueueItemStatus,\n  PendingWriteQueueObjectKind,\n  PendingWriteQueueOperation,\n  PendingWriteQueueOperationKind,\n  PendingWriteQueueOperationStatus,\n  // Persistence notifications distinguish placement changes from content saves.\n  PersistedDocumentListener,\n  PinCodeBrowserLocalKeyringOptions,\n  PinCodeWrappingKeyKeystoreOptions,\n  PurgeDocumentInput,\n  PurgeDocumentResult,\n  ReconciliationService,\n  RemoveOrganizationGroupUserInput,\n  ResolvedUserIdentity,\n  SaveFileRequest,\n  SecurityIncident,\n  SecurityIncidentListener,\n  SecurityIncidentObjectKind,\n  SecurityIncidents,\n  Session,\n  SessionContext,\n  SessionCreateOrganizationResult,\n  SessionListener,\n  SessionRecoverOrganizationResult,\n  SessionRegistrationRefusal,\n  SessionRegistrationResult,\n  SessionSnapshot,\n  SetActiveDocumentContainerInput,\n  SetLinkedContainerIdsForDocument,\n  UnlinkDocumentFromContainerInput,\n  UnwrapLocalSecretInput,\n  UserIdentities,\n  UserSession,\n  WrapLocalSecretInput,\n  WrappedLocalSecretEnvelope,\n  WrappedLocalSecretFormat,\n  WrappingKeyHandle,\n  WrappingKeyKeystore,\n  WrappingKeyMaterialStorage,\n} from \"./client\";\nexport {\n  type BlobStoreFactory,\n  Blobs,\n  createBrowserLocalKeyring,\n  createBrowserLocalKeyringManifestStore,\n  createBrowserNetworkStatusSource,\n  createContainerDocumentObjectSyncState,\n  createDomainScope,\n  createIndexedDbLocalKeyringManifestStore,\n  createIndexedDbWrappingKeyKeystore,\n  createLocalKeyring,\n  createLocalStorageLocalKeyringManifestStore,\n  createMemoryLocalKeyringManifestStore,\n  createMemoryWrappingKeyKeystore,\n  createPinCodeBrowserLocalKeyring,\n  createPinCodeWrappingKeyKeystore,\n  createRevenueCatPurchases,\n  createUnavailableDirectCheckout,\n  createUnavailablePurchases,\n  createWebViewLocalKeyring,\n  Database,\n  DEFAULT_DOCUMENT_ID,\n  type DirectCheckoutAppearance,\n  type DirectCheckoutCapability,\n  type DirectCheckoutConfirmation,\n  type DirectCheckoutSession,\n  DirectCheckoutUnavailableError,\n  decodeLocalKeyringSqliteKey,\n  Events,\n  type EventsListener,\n  type EventsSnapshot,\n  encodeLocalKeyringSqliteKey,\n  enqueueReconciliationForEvents,\n  IDENTITY_KEY_PACKAGE_FORMAT,\n  isPinCodeWrappedLocalSecretEnvelope,\n  LOCAL_KEYRING_MANIFEST_FORMAT,\n  localKeyringScopeKey,\n  Network,\n  normalizeLocalKeyringScope,\n  type PrincipalHistoryKeyProvider,\n  type PrincipalHistoryKeyScope,\n  PurchaseAbortedError,\n  PurchaseAlreadyOwnedError,\n  PurchaseCancelledError,\n  PurchaseIdentityPendingError,\n  PurchaseProviderStalledError,\n  type PurchasesCapability,\n  PurchasesUnavailableError,\n  PurgedOrganizationRecoveryBillingRequiredError,\n  parseLocalKeyringManifest,\n  type RevenueCatBackend,\n  type RevenueCatCustomerInfo,\n  type RevenueCatPackage,\n  type RevenueCatPurchasesConfig,\n  SyncBillingGate,\n  type SyncBillingGateListener,\n  type SyncPurchaseResult,\n  type SyncSubscriptionOption,\n  serializeLocalKeyringManifest,\n  WRAPPED_LOCAL_SECRET_FORMAT,\n} from \"./client\";\nexport type {\n  DiscoveredDocumentInput,\n  DocumentAttachment,\n  DocumentClientProjectionDefinition,\n  DocumentClientProjectionDeleteInput,\n  DocumentClientProjectionSaveInput,\n  DocumentFieldValidationIssue,\n  DocumentProjection,\n  DocumentProjectorDefinition,\n  DocumentProjectorInput,\n  DocumentProjectorRegistry,\n  DocumentProjectorRegistryInput,\n  DocumentRow,\n  DocumentRowSummary,\n  DocumentSummary,\n  StoredDocumentKind,\n  StoredDocumentState,\n  StructuredDocumentMap,\n  StructuredDocumentShape,\n  StructuredDocumentText,\n  ValidatedDocumentFields,\n} from \"./data/documents\";\nexport {\n  addDocumentAttachments,\n  createDocumentProjectorRegistry,\n  createDocumentSignerDeviceId,\n  DEFAULT_DOCUMENT_ACCESS_EPOCH,\n  DEFAULT_DOCUMENT_KIND,\n  defaultDocumentProjectorRegistry,\n  deriveStoredDocumentTitle,\n  ensureDocumentAttachmentStructure,\n  getDocumentAttachments,\n  getDocumentClientProjectionTables,\n  getStoredDocumentTypeLabel,\n  getUntitledDocumentTitle,\n  initializeStoredDocumentKind,\n  projectStoredDocumentState,\n  readStoredDocumentState,\n  readStringDocumentField,\n  resolveOpIdAttribution,\n  sameDocumentAttachments,\n  summarizeDocumentContributors,\n  writerByPeerId,\n  writeStoredDocumentFields,\n} from \"./data/documents\";\nexport type {\n  ContainerContentsSnapshot,\n  ContainerContentsStoreRuntime,\n  ContainerContentsStoreState,\n  ContainerContentsStoreSyncAgent,\n  ContainerContentsStoreSyncState,\n  ContainerState,\n  PurgeMoveSettlement,\n  PurgeOptions,\n  PurgeProgress,\n} from \"./stores/container-contents\";\nexport {\n  createContainerContentsStore,\n  createContainerContentsStoreState,\n  createContainerContentsStoreSyncAgent,\n  getOrCreateContainerContentsStore,\n  isSystemContainerNode,\n  requestContainerContentsDocumentPriming,\n  subscribeToContainerContentsStore,\n  updateContainerContentsSnapshot,\n  updateContainerContentsStoreRuntime,\n} from \"./stores/container-contents\";\nexport type {\n  DocumentSnapshot,\n  DocumentStoreFacade,\n  DocumentStoreOpenOptions,\n  DocumentStoreRelinkInput,\n  DocumentStructuredFieldPatch,\n} from \"./stores/documents\";\nexport {\n  createDocumentStore,\n  discardRegisteredDocumentLocalState,\n  getOrCreateDocumentStore,\n  openDocumentStore,\n  requestDomainDocumentSync,\n  subscribeToPersistedDocuments,\n} from \"./stores/documents\";\nexport { Tearleads } from \"./Tearleads\";\nexport type {\n  TearleadsDatabaseOptions,\n  TearleadsOptions,\n} from \"./TearleadsOptions\";\nexport type {\n  BlobByteSource,\n  BlobByteSourceInput,\n  BlobBytes,\n  BlobStore,\n  EncryptedBlobStoreCipher,\n  EncryptedBlobStoreKey,\n  EncryptedBlobStoreOptions,\n  WrapEncryptedBlobStoreOptions,\n} from \"./workflows/blobs\";\nexport {\n  blobByteSourceInputLength,\n  createBlobByteSource,\n  createBlobStore,\n  createEncryptedBlobStore,\n  createLazyEncryptedBlobStore,\n  createMemoryBlobStore,\n  decryptDocumentAttachmentBlob,\n  hydrateDocumentAttachmentBlobs,\n  purgeOpfsBlobStore,\n  readBlobByteSource,\n  uploadDocumentAttachment,\n  wrapEncryptedBlobStore,\n} from \"./workflows/blobs\";\nexport type {\n  ContainerContentsRootAdopter,\n  ContainerContentsRootAdoptionInput,\n  ContainerContentsStoreWorkflowRuntime,\n  ContainerContentsWorkflowRuntime,\n  // Distinct from the canonical `ContainerDocumentLinkInput` (./client); the\n  // documentQueries variant has a different shape, so it keeps a disambiguating\n  // alias on the public surface.\n  ContainerDocumentLinkInput as ContainerDocumentQueriesLinkInput,\n  ContainerSystemSlotDefinition,\n  PendingDownloadQueueItem,\n  RecoveryFolder,\n} from \"./workflows/container-contents\";\nexport {\n  createContainerContentsDocumentsRuntime,\n  createContainerContentsProjectionUserKeyResolver,\n  createContainerContentsStoreWorkflowRuntime,\n  createContainerContentsSyncLane,\n  createContainerContentsWorkflowRuntime,\n  createContainerParentSyncLane,\n  createInitializedContainerMetadataDocument,\n  defaultContainerContentsPersistence,\n  deriveContainerSystemSlot,\n  initializeDocumentLinksSchema,\n  listBlobInfo,\n  listDocumentLinkedContainerIds,\n  loadContainerInfo,\n  loadContainerSyncWatermark,\n  loadDocumentAttributionRanges,\n  loadDocumentInfo,\n  replaceDocumentLinks,\n  saveContainerSyncWatermark,\n  syncedContainerDocumentObjectSyncState,\n} from \"./workflows/container-contents\";\nexport type {\n  AggregatedContainerKekLog,\n  ContainerMutationAuthor,\n  ContainerReciteApi,\n  ContainerWriteRefusal,\n  KeyringRebuildResult,\n  MaterializedContainerRekeyPlan,\n} from \"./workflows/containers\";\nexport {\n  buildMaterializedContainerRekeyPlan,\n  buildRootContainerCreatePlan,\n  ContainerAuthorAccessError,\n  ContainerKekRepairInaccessibleError,\n  ContainerKekRepairRequiredError,\n  ContainerKeyringOverrideStaleError,\n  ContainerPathTooDeepError,\n  classifyContainerWriteRefusal,\n  containerWriterProjectionFromRekeyPlan,\n  createRemoteContainer,\n  fetchContainerKekLog,\n  HistoricalWrapUnavailableError,\n  type HistoricalWrapUnavailableReason,\n  isProjectionVerificationCancelledError,\n  moveRemoteContainer,\n  rebuildKeyringEntriesFromLog,\n  recoverKeyringEntryFromWraps,\n  rekeyRemoteContainer,\n  revokeRemoteContainer,\n  rootContainerWriterProjectionFromCreatePlan,\n  shareRemoteContainer,\n} from \"./workflows/containers\";\nexport type {\n  DocumentRecord,\n  DocumentSyncContainerRekeyBuilder,\n  DocumentSyncPullContinuation,\n  DocumentSyncUpdateIsolationError,\n  DocumentsPersistence,\n  DocumentsWorkflowRuntime,\n  DocumentsWorkflowRuntimeInput,\n  IncomingDocumentSyncUpdateValidator,\n  LocalAttachmentRecord,\n  PendingAttachmentRecord,\n  PendingUpdateInsert,\n  PendingUpdateRecord,\n  SyncRemoteDocumentInput,\n} from \"./workflows/documents\";\nexport {\n  buildMaterializedDocumentCreatePlan,\n  createDocumentProjectionUserKeyResolver,\n  createDocumentsWorkflowRuntime,\n  createRemoteDocument,\n  DOCUMENT_SYNC_TRACE_FRAGMENT,\n  DOCUMENT_SYNC_TRACE_PATTERN,\n  DOCUMENTS_APP_KIND,\n  DocumentRawHistoryUnavailableError,\n  defaultDocumentsPersistence,\n  deletePersistedDocument,\n  isDatabaseUnavailableError,\n  isDocumentSyncUpdateIsolationError,\n  persistedDocumentCreateStateFromResponse,\n  readPullContinuation,\n  syncRemoteDocument,\n  unwrapContainerKekPath,\n  unwrapDocumentContentKeyTarget,\n  validateDocumentSyncUpdateImports,\n} from \"./workflows/documents\";\n// Nominal identity constructors are available only through the testing subpath\n// for low-level runtime tests.\nexport type {\n  AcknowledgedPrincipalCurrentInput,\n  AcknowledgedPrincipalCurrentRetirement,\n  AuthoredPrincipalMutation,\n  OrganizationGroupPolicyHistoryEntry,\n  OrganizationNativePurchaseEligibility,\n  OrganizationPrincipalMemberChange,\n  OrganizationPrincipalMemberChangeType,\n  OrganizationPrincipalPolicyHistory,\n  OrganizationPrincipalPolicyHistoryEntry,\n  PrincipalMutationJournalContext,\n  PrincipalMutationJournalScope,\n  PrincipalMutationResponse,\n  ReconcileOrganizationDataUsageInput,\n} from \"./workflows/organizations\";\nexport {\n  abandonJournaledPrincipalMutation,\n  addOrganizationGroupUser,\n  buildInitialGroupPolicyRequest,\n  buildInitialMemberGroupPolicyRequest,\n  buildOrganizationGroupPolicyHistory,\n  buildOrganizationProfileDocumentPatch,\n  buildRosterProfileDocumentPatch,\n  checkNativePurchaseEligibility,\n  createInitializedRosterProfileDocument,\n  createOrganizationGroup,\n  DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME,\n  deriveOrganizationMetadataContainerSystemSlot,\n  deriveOrganizationRosterProfileContainerSystemSlot,\n  discardUnreadableJournaledPrincipalMutation,\n  GroupMembershipNameMismatchError,\n  GroupShareNameMismatchError,\n  getOrganizationProfileDocumentLocalId,\n  getRosterProfileDocumentLocalId,\n  importOrganizationUser,\n  loadLocalOrganizationDataUsage,\n  loadLocalOrganizationDirectoryAndGroups,\n  loadOrganizationBilling,\n  loadOrganizationBillingHistory,\n  loadOrganizationBillingManagementUrl,\n  ORGANIZATION_METADATA_CONTAINER_NAME,\n  ORGANIZATION_PROFILE_DOCUMENT_KIND,\n  ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n  PendingPrincipalMutationError,\n  PrincipalMutationOutcomeUnknownError,\n  ROSTER_PROFILE_DOCUMENT_KIND,\n  readJournaledPrincipalMutation,\n  readOrganizationProfileName,\n  reconcileOrganizationDataUsage,\n  reconcileOrganizationDirectoryAndGroups,\n  recoverJournaledPrincipalMutation,\n  removeOrganizationGroupUser,\n  resolveOrganizationBillingView,\n  retainAcknowledgedPrincipalCurrents,\n  revokeOrganizationContainerGrant,\n  shareRemoteContainerWithGroup,\n  startOrganizationTrial,\n  submitJournaledPrincipalMutation,\n  subscribeOrganizationReadModelInvalidation,\n  UnreadablePrincipalMutationError,\n  updateOrganizationProfile,\n  updateOrganizationRosterEntry,\n} from \"./workflows/organizations\";\nexport type {\n  AcknowledgedPrincipalPredecessor,\n  CacheReferencedPrincipalPoliciesOptions,\n  PrincipalHistoryProtectionLease,\n  ProjectionPolicyHistoryRecoveryOptions,\n  RecoveredPrincipalPolicyHistory,\n  RecoveredScopedPrincipalPolicyHistory,\n  RecoverPrincipalPolicyHistoryOptions,\n  RecoverScopedPrincipalPolicyHistoryOptions,\n} from \"./workflows/principals\";\nexport {\n  cacheReferencedPrincipalPolicies,\n  captureAcknowledgedPrincipalPredecessor,\n  PrincipalPolicyHistoryReadError,\n  recoverPrincipalPolicyHistory,\n  recoverProjectionPolicyHistory,\n  recoverScopedPrincipalPolicyHistory,\n} from \"./workflows/principals\";\nexport type {\n  InitialRootMetadataBootstrap,\n  ProvisionedSystemContainerSpec,\n  RegisterIdentityInput,\n  RegistrationApi,\n} from \"./workflows/registration\";\nexport {\n  bootstrapRootContainer,\n  buildInitialOrganizationPolicyRequest,\n  createInitialRootMetadataBootstrap,\n  persistRegistrationBootstrap,\n  registerIdentity,\n} from \"./workflows/registration\";\nexport type {\n  RootIdentitiesApi,\n  RootIdentitiesPage,\n  RootIdentitiesQueryInput,\n  RootIdentity,\n  RootIdentityDetail,\n  RootIdentityOrganization,\n  RootIdentitySession,\n  RootRequestOutcome,\n} from \"./workflows/root\";\nexport {\n  liftRootIdentitySuspension,\n  listRootAuditEvents,\n  listRootDataUsageReport,\n  listRootIdentities,\n  listRootIdentityOrganizations,\n  listRootOrganizationIdentities,\n  listRootOrganizationRevenuecatEvents,\n  listRootOrganizations,\n  listRootRevenuecatEventsReport,\n  loadRootIdentity,\n  loadRootOpsHealthReport,\n  loadRootOrganization,\n  loadRootOrganizationDataUsage,\n  type RootAuditApi,\n  type RootAuditEvent,\n  type RootAuditEventsPage,\n  type RootAuditEventsQueryInput,\n  type RootDataUsageApi,\n  type RootDataUsageReportPage,\n  type RootOpsHealthApi,\n  type RootOpsHealthReport,\n  type RootOrganization,\n  type RootOrganizationDetail,\n  type RootOrganizationIdentitiesPage,\n  type RootOrganizationIdentity,\n  type RootOrganizationPageQueryInput,\n  type RootOrganizationRevenuecatEvent,\n  type RootOrganizationRevenuecatEventsPage,\n  type RootOrganizationsApi,\n  type RootOrganizationsPage,\n  type RootOrganizationsQueryInput,\n  type RootRevenuecatApi,\n  type RootRevenuecatEvent,\n  type RootRevenuecatEventsQueryInput,\n  type RootRevenuecatEventsReportPage,\n  type RootRevenuecatEventsReportQueryInput,\n  type RootSuspensionApi,\n  suspendRootIdentity,\n} from \"./workflows/root\";\nexport type {\n  ClearRemoteSyncStateResult,\n  DomainSyncCoordinator,\n  DomainSyncSnapshot,\n  RemoteResetInput,\n  RemoteResetReplacement,\n  SyncIdleOptions,\n  SyncLane,\n  SyncLaneConfig,\n  SyncLaneLastAction,\n  SyncLanePhase,\n  SyncLaneSnapshot,\n  SyncLaneStatus,\n} from \"./workflows/sync\";\nexport {\n  clearRemoteSyncState,\n  getDomainSyncCoordinatorSnapshot,\n  getOrCreateDomainSyncCoordinator,\n  hasDomainSyncCoordinatorPendingWork,\n  requestAllDomainSyncLanes,\n  subscribeToDomainSyncCoordinator,\n  waitForDomainSyncCoordinatorToSettle,\n} from \"./workflows/sync\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,2EAA2E;AAC3E,4FAA4F;AAC5F,OAAO,EAGL,iBAAiB,GAElB,MAAM,uBAAuB,CAAC;AAsK/B,OAAO,EAEL,KAAK,EACL,yBAAyB,EACzB,sCAAsC,EACtC,gCAAgC,EAChC,sCAAsC,EACtC,iBAAiB,EACjB,wCAAwC,EACxC,kCAAkC,EAClC,kBAAkB,EAClB,2CAA2C,EAC3C,qCAAqC,EACrC,+BAA+B,EAC/B,gCAAgC,EAChC,gCAAgC,EAChC,yBAAyB,EACzB,+BAA+B,EAC/B,0BAA0B,EAC1B,yBAAyB,EACzB,QAAQ,EACR,mBAAmB,EAKnB,8BAA8B,EAC9B,2BAA2B,EAC3B,MAAM,EAGN,2BAA2B,EAC3B,8BAA8B,EAC9B,2BAA2B,EAC3B,mCAAmC,EACnC,6BAA6B,EAC7B,oBAAoB,EACpB,OAAO,EACP,0BAA0B,EAG1B,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAE5B,yBAAyB,EACzB,8CAA8C,EAC9C,yBAAyB,EAKzB,eAAe,EAIf,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,UAAU,CAAC;AAuBlB,OAAO,EACL,sBAAsB,EACtB,+BAA+B,EAC/B,4BAA4B,EAC5B,6BAA6B,EAC7B,qBAAqB,EACrB,gCAAgC,EAChC,yBAAyB,EACzB,iCAAiC,EACjC,sBAAsB,EACtB,iCAAiC,EACjC,0BAA0B,EAC1B,wBAAwB,EACxB,4BAA4B,EAC5B,0BAA0B,EAC1B,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,EAC7B,cAAc,EACd,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAY1B,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,EACjC,qCAAqC,EACrC,iCAAiC,EACjC,qBAAqB,EACrB,uCAAuC,EACvC,iCAAiC,EACjC,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,6BAA6B,CAAC;AAQrC,OAAO,EACL,mBAAmB,EACnB,mCAAmC,EACnC,wBAAwB,EACxB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAexC,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,wBAAwB,EACxB,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,8BAA8B,EAC9B,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAc3B,OAAO,EACL,uCAAuC,EACvC,gDAAgD,EAChD,2CAA2C,EAC3C,+BAA+B,EAC/B,sCAAsC,EACtC,6BAA6B,EAC7B,0CAA0C,EAC1C,mCAAmC,EACnC,yBAAyB,EACzB,6BAA6B,EAC7B,YAAY,EACZ,8BAA8B,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,sCAAsC,GACvC,MAAM,gCAAgC,CAAC;AASxC,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,0BAA0B,EAC1B,mCAAmC,EACnC,+BAA+B,EAC/B,kCAAkC,EAClC,yBAAyB,EACzB,6BAA6B,EAC7B,sCAAsC,EACtC,qBAAqB,EACrB,oBAAoB,EACpB,8BAA8B,EAE9B,sCAAsC,EACtC,mBAAmB,EACnB,4BAA4B,EAC5B,4BAA4B,EAC5B,oBAAoB,EACpB,qBAAqB,EACrB,2CAA2C,EAC3C,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAgBhC,OAAO,EACL,mCAAmC,EACnC,uCAAuC,EACvC,8BAA8B,EAC9B,oBAAoB,EACpB,4BAA4B,EAC5B,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,kCAAkC,EAClC,wCAAwC,EACxC,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACtB,8BAA8B,EAC9B,iCAAiC,GAClC,MAAM,uBAAuB,CAAC;AAkB/B,OAAO,EACL,iCAAiC,EACjC,wBAAwB,EACxB,8BAA8B,EAC9B,oCAAoC,EACpC,mCAAmC,EACnC,qCAAqC,EACrC,+BAA+B,EAC/B,8BAA8B,EAC9B,sCAAsC,EACtC,uBAAuB,EACvB,0CAA0C,EAC1C,6CAA6C,EAC7C,kDAAkD,EAClD,2CAA2C,EAC3C,gCAAgC,EAChC,2BAA2B,EAC3B,qCAAqC,EACrC,+BAA+B,EAC/B,sBAAsB,EACtB,8BAA8B,EAC9B,uCAAuC,EACvC,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,oCAAoC,EACpC,kCAAkC,EAClC,0CAA0C,EAC1C,6BAA6B,EAC7B,oCAAoC,EACpC,4BAA4B,EAC5B,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC9B,uCAAuC,EACvC,iCAAiC,EACjC,2BAA2B,EAC3B,8BAA8B,EAC9B,mCAAmC,EACnC,gCAAgC,EAChC,6BAA6B,EAC7B,sBAAsB,EACtB,gCAAgC,EAChC,0CAA0C,EAC1C,gCAAgC,EAChC,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AAWnC,OAAO,EACL,gCAAgC,EAChC,uCAAuC,EACvC,+BAA+B,EAC/B,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,GACpC,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EACL,sBAAsB,EACtB,qCAAqC,EACrC,kCAAkC,EAClC,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAWlC,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,EAClB,6BAA6B,EAC7B,8BAA8B,EAC9B,oCAAoC,EACpC,qBAAqB,EACrB,8BAA8B,EAC9B,gBAAgB,EAChB,uBAAuB,EACvB,oBAAoB,EACpB,6BAA6B,EAyB7B,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAe1B,OAAO,EACL,oBAAoB,EACpB,gCAAgC,EAChC,gCAAgC,EAChC,mCAAmC,EACnC,yBAAyB,EACzB,gCAAgC,EAChC,oCAAoC,GACrC,MAAM,kBAAkB,CAAC","sourcesContent":["// SDK: verified identity links and cancellable identity setup.\n// Authority loaders take exact heads, including cached citations. Obsolete\n// adapters are excluded; authored policy journals survive restart. See workflows/README.md.\nexport {\n  type ApiRequestCounts,\n  type ApiRequestEndpointCounts,\n  ApiRequestMetrics,\n  type ApiRequestMetricsSnapshot,\n} from \"@tearleads/api-client\";\nexport type {\n  AbandonOrganizationPolicyMutationInput,\n  AddOrganizationGroupUserInput,\n  BlobInfo,\n  BlobInfoAttachmentKind,\n  BlobInfoDocumentReference,\n  BlobInfoInput,\n  BlobInfoList,\n  BlobInfoSort,\n  BlobInfoSortDirection,\n  BlobInfoSortKey,\n  BrowserLocalKeyringOptions,\n  ContainerContents,\n  ContainerContentsContextValue,\n  ContainerContentsStore,\n  ContainerContentsStoreOptions,\n  ContainerDocumentLinkInput,\n  ContainerDocumentLinks,\n  ContainerDocumentObjectSyncState,\n  ContainerDocumentObjectSyncStatus,\n  ContainerDocumentQueries,\n  ContainerDocumentSidebarRow,\n  ContainerInfo,\n  ContainerInfoInput,\n  ContainerItemRow,\n  ContainerItemSort,\n  ContainerItemSortDirection,\n  ContainerItemSortKey,\n  ContainerNode,\n  ContainerShareAccessLevel,\n  CreateOrganizationOptions,\n  DatabaseListener,\n  DatabaseOptions,\n  DatabaseSnapshot,\n  DatabaseStatus,\n  DeviceFirst,\n  DeviceFirstContainerContents,\n  DiscardUnreadableOrganizationPolicyMutationInput,\n  DocumentAttachmentStatus,\n  DocumentAttachmentUpload,\n  DocumentAttributionRangesInput,\n  DocumentAttributionRangesPage,\n  DocumentContextValue,\n  DocumentInfo,\n  DocumentInfoInput,\n  DocumentList,\n  DocumentSort,\n  DocumentSortDirection,\n  DocumentSortKey,\n  DocumentStore,\n  DocumentSubscriptionOptions,\n  Documents,\n  DocumentsRuntime,\n  DomainScope,\n  FileSaver,\n  Identity,\n  IdentityGenerationResult,\n  IdentityKeyPackage,\n  IdentityListener,\n  IdentityOptions,\n  IdentitySnapshot,\n  ImportedOrganizationUser,\n  IndexedDbLocalKeyringManifestStoreOptions,\n  IndexedDbWrappingKeyKeystoreOptions,\n  LinkDocumentToContainerInput,\n  ListDocumentsInput,\n  LocalKeyPurpose,\n  LocalKeyring,\n  LocalKeyringManifest,\n  LocalKeyringManifestFormat,\n  LocalKeyringManifestStorage,\n  LocalKeyringManifestStore,\n  LocalKeyringOptions,\n  LocalKeyringPinCode,\n  LocalKeyringScope,\n  LocalKeyringSession,\n  LocalOrganizationSummary,\n  LocalProjectionReconciledDelta,\n  LocalProjectionSnapshot,\n  LocalProjectionView,\n  LocalSecretContext,\n  LocalStorageLocalKeyringManifestStoreOptions,\n  Logger,\n  MergeDocumentSummary,\n  MoveDocumentToContainerInput,\n  NetworkListener,\n  NetworkMode,\n  NetworkStatusSource,\n  NormalizedLocalKeyringScope,\n  OpenContainerDocumentInput,\n  OpenDocumentInput,\n  OpenDocumentOptions,\n  OrganizationBilling,\n  OrganizationBillingHistory,\n  OrganizationBillingHistoryEntry,\n  OrganizationBillingManagementUrl,\n  OrganizationBillingView,\n  OrganizationContainerGrant,\n  OrganizationContainerGrants,\n  OrganizationDataUsage,\n  OrganizationDirectory,\n  OrganizationDirectoryAndGroups,\n  OrganizationDirectoryUser,\n  OrganizationGrantRef,\n  OrganizationGroupContainer,\n  OrganizationGroupContainers,\n  OrganizationGroupDetails,\n  OrganizationGroupMember,\n  OrganizationGroupMembers,\n  OrganizationGroupMutationReceipt,\n  OrganizationGroupPolicyHistory,\n  OrganizationGroupSummary,\n  OrganizationLeaveRequestResult,\n  OrganizationMembership,\n  OrganizationMemberships,\n  OrganizationPolicyGrantChange,\n  OrganizationPolicyGroupChange,\n  /** Verified organization display page with an optional older-page cursor. */\n  OrganizationPolicyHistory,\n  OrganizationPolicyHistoryEntry,\n  OrganizationProfile,\n  OrganizationSyncPauseResult,\n  Organizations,\n  OrganizationUserDetail,\n  PendingWriteQueueItem,\n  PendingWriteQueueItemStatus,\n  PendingWriteQueueObjectKind,\n  PendingWriteQueueOperation,\n  PendingWriteQueueOperationKind,\n  PendingWriteQueueOperationStatus,\n  // Persistence notifications distinguish placement changes from content saves.\n  PersistedDocumentListener,\n  PinCodeBrowserLocalKeyringOptions,\n  PinCodeWrappingKeyKeystoreOptions,\n  PurgeDocumentInput,\n  PurgeDocumentResult,\n  ReconciliationService,\n  RemoveOrganizationGroupUserInput,\n  ResolvedUserIdentity,\n  SaveFileRequest,\n  SecurityIncident,\n  SecurityIncidentListener,\n  SecurityIncidentObjectKind,\n  SecurityIncidents,\n  Session,\n  SessionContext,\n  SessionCreateOrganizationResult,\n  SessionListener,\n  SessionRecoverOrganizationResult,\n  SessionRegistrationRefusal,\n  SessionRegistrationResult,\n  SessionSnapshot,\n  SetActiveDocumentContainerInput,\n  SetLinkedContainerIdsForDocument,\n  UnlinkDocumentFromContainerInput,\n  UnwrapLocalSecretInput,\n  UserIdentities,\n  UserSession,\n  WrapLocalSecretInput,\n  WrappedLocalSecretEnvelope,\n  WrappedLocalSecretFormat,\n  WrappingKeyHandle,\n  WrappingKeyKeystore,\n  WrappingKeyMaterialStorage,\n} from \"./client\";\nexport {\n  type BlobStoreFactory,\n  Blobs,\n  createBrowserLocalKeyring,\n  createBrowserLocalKeyringManifestStore,\n  createBrowserNetworkStatusSource,\n  createContainerDocumentObjectSyncState,\n  createDomainScope,\n  createIndexedDbLocalKeyringManifestStore,\n  createIndexedDbWrappingKeyKeystore,\n  createLocalKeyring,\n  createLocalStorageLocalKeyringManifestStore,\n  createMemoryLocalKeyringManifestStore,\n  createMemoryWrappingKeyKeystore,\n  createPinCodeBrowserLocalKeyring,\n  createPinCodeWrappingKeyKeystore,\n  createRevenueCatPurchases,\n  createUnavailableDirectCheckout,\n  createUnavailablePurchases,\n  createWebViewLocalKeyring,\n  Database,\n  DEFAULT_DOCUMENT_ID,\n  type DirectCheckoutAppearance,\n  type DirectCheckoutCapability,\n  type DirectCheckoutConfirmation,\n  type DirectCheckoutSession,\n  DirectCheckoutUnavailableError,\n  decodeLocalKeyringSqliteKey,\n  Events,\n  type EventsListener,\n  type EventsSnapshot,\n  encodeLocalKeyringSqliteKey,\n  enqueueReconciliationForEvents,\n  IDENTITY_KEY_PACKAGE_FORMAT,\n  isPinCodeWrappedLocalSecretEnvelope,\n  LOCAL_KEYRING_MANIFEST_FORMAT,\n  localKeyringScopeKey,\n  Network,\n  normalizeLocalKeyringScope,\n  type PrincipalHistoryKeyProvider,\n  type PrincipalHistoryKeyScope,\n  PurchaseAbortedError,\n  PurchaseAlreadyOwnedError,\n  PurchaseCancelledError,\n  PurchaseIdentityPendingError,\n  PurchaseProviderStalledError,\n  type PurchasesCapability,\n  PurchasesUnavailableError,\n  PurgedOrganizationRecoveryBillingRequiredError,\n  parseLocalKeyringManifest,\n  type RevenueCatBackend,\n  type RevenueCatCustomerInfo,\n  type RevenueCatPackage,\n  type RevenueCatPurchasesConfig,\n  SyncBillingGate,\n  type SyncBillingGateListener,\n  type SyncPurchaseResult,\n  type SyncSubscriptionOption,\n  serializeLocalKeyringManifest,\n  WRAPPED_LOCAL_SECRET_FORMAT,\n} from \"./client\";\nexport type {\n  DiscoveredDocumentInput,\n  DocumentAttachment,\n  DocumentClientProjectionDefinition,\n  DocumentClientProjectionDeleteInput,\n  DocumentClientProjectionSaveInput,\n  DocumentFieldValidationIssue,\n  DocumentProjection,\n  DocumentProjectorDefinition,\n  DocumentProjectorInput,\n  DocumentProjectorRegistry,\n  DocumentProjectorRegistryInput,\n  DocumentRow,\n  DocumentRowSummary,\n  DocumentSummary,\n  StoredDocumentKind,\n  StoredDocumentState,\n  StructuredDocumentMap,\n  StructuredDocumentShape,\n  StructuredDocumentText,\n  ValidatedDocumentFields,\n} from \"./data/documents\";\nexport {\n  addDocumentAttachments,\n  createDocumentProjectorRegistry,\n  createDocumentSignerDeviceId,\n  DEFAULT_DOCUMENT_ACCESS_EPOCH,\n  DEFAULT_DOCUMENT_KIND,\n  defaultDocumentProjectorRegistry,\n  deriveStoredDocumentTitle,\n  ensureDocumentAttachmentStructure,\n  getDocumentAttachments,\n  getDocumentClientProjectionTables,\n  getStoredDocumentTypeLabel,\n  getUntitledDocumentTitle,\n  initializeStoredDocumentKind,\n  projectStoredDocumentState,\n  readStoredDocumentState,\n  readStringDocumentField,\n  resolveOpIdAttribution,\n  sameDocumentAttachments,\n  summarizeDocumentContributors,\n  writerByPeerId,\n  writeStoredDocumentFields,\n} from \"./data/documents\";\nexport type {\n  ContainerContentsSnapshot,\n  ContainerContentsStoreRuntime,\n  ContainerContentsStoreState,\n  ContainerContentsStoreSyncAgent,\n  ContainerContentsStoreSyncState,\n  ContainerState,\n  PurgeMoveSettlement,\n  PurgeOptions,\n  PurgeProgress,\n} from \"./stores/container-contents\";\nexport {\n  createContainerContentsStore,\n  createContainerContentsStoreState,\n  createContainerContentsStoreSyncAgent,\n  getOrCreateContainerContentsStore,\n  isSystemContainerNode,\n  requestContainerContentsDocumentPriming,\n  subscribeToContainerContentsStore,\n  updateContainerContentsSnapshot,\n  updateContainerContentsStoreRuntime,\n} from \"./stores/container-contents\";\nexport type {\n  DocumentSnapshot,\n  DocumentStoreFacade,\n  DocumentStoreOpenOptions,\n  DocumentStoreRelinkInput,\n  DocumentStructuredFieldPatch,\n} from \"./stores/documents\";\nexport {\n  createDocumentStore,\n  discardRegisteredDocumentLocalState,\n  getOrCreateDocumentStore,\n  openDocumentStore,\n  requestDomainDocumentSync,\n  subscribeToPersistedDocuments,\n} from \"./stores/documents\";\nexport { Tearleads } from \"./Tearleads\";\nexport type {\n  TearleadsDatabaseOptions,\n  TearleadsOptions,\n} from \"./TearleadsOptions\";\nexport type {\n  BlobByteSource,\n  BlobByteSourceInput,\n  BlobBytes,\n  BlobStore,\n  EncryptedBlobStoreCipher,\n  EncryptedBlobStoreKey,\n  EncryptedBlobStoreOptions,\n  WrapEncryptedBlobStoreOptions,\n} from \"./workflows/blobs\";\nexport {\n  blobByteSourceInputLength,\n  createBlobByteSource,\n  createBlobStore,\n  createEncryptedBlobStore,\n  createLazyEncryptedBlobStore,\n  createMemoryBlobStore,\n  decryptDocumentAttachmentBlob,\n  hydrateDocumentAttachmentBlobs,\n  purgeOpfsBlobStore,\n  readBlobByteSource,\n  uploadDocumentAttachment,\n  wrapEncryptedBlobStore,\n} from \"./workflows/blobs\";\nexport type {\n  ContainerContentsRootAdopter,\n  ContainerContentsRootAdoptionInput,\n  ContainerContentsStoreWorkflowRuntime,\n  ContainerContentsWorkflowRuntime,\n  // Distinct from the canonical `ContainerDocumentLinkInput` (./client); the\n  // documentQueries variant has a different shape, so it keeps a disambiguating\n  // alias on the public surface.\n  ContainerDocumentLinkInput as ContainerDocumentQueriesLinkInput,\n  ContainerSystemSlotDefinition,\n  PendingDownloadQueueItem,\n  RecoveryFolder,\n} from \"./workflows/container-contents\";\nexport {\n  createContainerContentsDocumentsRuntime,\n  createContainerContentsProjectionUserKeyResolver,\n  createContainerContentsStoreWorkflowRuntime,\n  createContainerContentsSyncLane,\n  createContainerContentsWorkflowRuntime,\n  createContainerParentSyncLane,\n  createInitializedContainerMetadataDocument,\n  defaultContainerContentsPersistence,\n  deriveContainerSystemSlot,\n  initializeDocumentLinksSchema,\n  listBlobInfo,\n  listDocumentLinkedContainerIds,\n  loadContainerInfo,\n  loadContainerSyncWatermark,\n  loadDocumentAttributionRanges,\n  loadDocumentInfo,\n  replaceDocumentLinks,\n  saveContainerSyncWatermark,\n  syncedContainerDocumentObjectSyncState,\n} from \"./workflows/container-contents\";\nexport type {\n  AggregatedContainerKekLog,\n  ContainerMutationAuthor,\n  ContainerReciteApi,\n  ContainerWriteRefusal,\n  KeyringRebuildResult,\n  MaterializedContainerRekeyPlan,\n} from \"./workflows/containers\";\nexport {\n  buildMaterializedContainerRekeyPlan,\n  buildRootContainerCreatePlan,\n  ContainerAuthorAccessError,\n  ContainerKekRepairInaccessibleError,\n  ContainerKekRepairRequiredError,\n  ContainerKeyringOverrideStaleError,\n  ContainerPathTooDeepError,\n  classifyContainerWriteRefusal,\n  containerWriterProjectionFromRekeyPlan,\n  createRemoteContainer,\n  fetchContainerKekLog,\n  HistoricalWrapUnavailableError,\n  type HistoricalWrapUnavailableReason,\n  isProjectionVerificationCancelledError,\n  moveRemoteContainer,\n  rebuildKeyringEntriesFromLog,\n  recoverKeyringEntryFromWraps,\n  rekeyRemoteContainer,\n  revokeRemoteContainer,\n  rootContainerWriterProjectionFromCreatePlan,\n  shareRemoteContainer,\n} from \"./workflows/containers\";\nexport type {\n  DocumentRecord,\n  DocumentSyncContainerRekeyBuilder,\n  DocumentSyncPullContinuation,\n  DocumentSyncUpdateIsolationError,\n  DocumentsPersistence,\n  DocumentsWorkflowRuntime,\n  DocumentsWorkflowRuntimeInput,\n  IncomingDocumentSyncUpdateValidator,\n  LocalAttachmentRecord,\n  PendingAttachmentRecord,\n  PendingUpdateInsert,\n  PendingUpdateRecord,\n  SyncRemoteDocumentInput,\n} from \"./workflows/documents\";\nexport {\n  buildMaterializedDocumentCreatePlan,\n  createDocumentProjectionUserKeyResolver,\n  createDocumentsWorkflowRuntime,\n  createRemoteDocument,\n  DOCUMENT_SYNC_TRACE_FRAGMENT,\n  DOCUMENT_SYNC_TRACE_PATTERN,\n  DOCUMENTS_APP_KIND,\n  DocumentRawHistoryUnavailableError,\n  defaultDocumentsPersistence,\n  deletePersistedDocument,\n  isDatabaseUnavailableError,\n  isDocumentSyncUpdateIsolationError,\n  persistedDocumentCreateStateFromResponse,\n  readPullContinuation,\n  syncRemoteDocument,\n  unwrapContainerKekPath,\n  unwrapDocumentContentKeyTarget,\n  validateDocumentSyncUpdateImports,\n} from \"./workflows/documents\";\n// Nominal identity constructors are available only through the testing subpath\n// for low-level runtime tests.\nexport type {\n  AcknowledgedPrincipalCurrentInput,\n  AcknowledgedPrincipalCurrentRetirement,\n  AuthoredPrincipalMutation,\n  OrganizationGroupPolicyHistoryEntry,\n  OrganizationNativePurchaseEligibility,\n  OrganizationPrincipalMemberChange,\n  OrganizationPrincipalMemberChangeType,\n  OrganizationPrincipalPolicyHistory,\n  OrganizationPrincipalPolicyHistoryEntry,\n  PrincipalMutationJournalContext,\n  PrincipalMutationJournalScope,\n  PrincipalMutationResponse,\n  ReconcileOrganizationDataUsageInput,\n} from \"./workflows/organizations\";\nexport {\n  abandonJournaledPrincipalMutation,\n  addOrganizationGroupUser,\n  buildInitialGroupPolicyRequest,\n  buildInitialMemberGroupPolicyRequest,\n  buildOrganizationGroupPolicyHistory,\n  buildOrganizationProfileDocumentPatch,\n  buildRosterProfileDocumentPatch,\n  checkNativePurchaseEligibility,\n  createInitializedRosterProfileDocument,\n  createOrganizationGroup,\n  DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME,\n  deriveOrganizationMetadataContainerSystemSlot,\n  deriveOrganizationRosterProfileContainerSystemSlot,\n  discardUnreadableJournaledPrincipalMutation,\n  GroupMembershipNameMismatchError,\n  GroupShareNameMismatchError,\n  getOrganizationProfileDocumentLocalId,\n  getRosterProfileDocumentLocalId,\n  importOrganizationUser,\n  loadLocalOrganizationDataUsage,\n  loadLocalOrganizationDirectoryAndGroups,\n  loadOrganizationBilling,\n  loadOrganizationBillingHistory,\n  loadOrganizationBillingManagementUrl,\n  ORGANIZATION_METADATA_CONTAINER_NAME,\n  ORGANIZATION_PROFILE_DOCUMENT_KIND,\n  ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n  PendingPrincipalMutationError,\n  PrincipalMutationOutcomeUnknownError,\n  ROSTER_PROFILE_DOCUMENT_KIND,\n  readJournaledPrincipalMutation,\n  readOrganizationProfileName,\n  reconcileOrganizationDataUsage,\n  reconcileOrganizationDirectoryAndGroups,\n  recoverJournaledPrincipalMutation,\n  removeOrganizationGroupUser,\n  resolveOrganizationBillingView,\n  retainAcknowledgedPrincipalCurrents,\n  revokeOrganizationContainerGrant,\n  shareRemoteContainerWithGroup,\n  startOrganizationTrial,\n  submitJournaledPrincipalMutation,\n  subscribeOrganizationReadModelInvalidation,\n  UnreadablePrincipalMutationError,\n  updateOrganizationProfile,\n  updateOrganizationRosterEntry,\n} from \"./workflows/organizations\";\nexport type {\n  AcknowledgedPrincipalPredecessor,\n  CacheReferencedPrincipalPoliciesOptions,\n  PrincipalHistoryProtectionLease,\n  ProjectionPolicyHistoryRecoveryOptions,\n  RecoveredPrincipalPolicyHistory,\n  RecoveredScopedPrincipalPolicyHistory,\n  RecoverPrincipalPolicyHistoryOptions,\n  RecoverScopedPrincipalPolicyHistoryOptions,\n} from \"./workflows/principals\";\nexport {\n  cacheReferencedPrincipalPolicies,\n  captureAcknowledgedPrincipalPredecessor,\n  PrincipalPolicyHistoryReadError,\n  recoverPrincipalPolicyHistory,\n  recoverProjectionPolicyHistory,\n  recoverScopedPrincipalPolicyHistory,\n} from \"./workflows/principals\";\nexport type {\n  InitialRootMetadataBootstrap,\n  ProvisionedSystemContainerSpec,\n  RegisterIdentityInput,\n  RegistrationApi,\n} from \"./workflows/registration\";\nexport {\n  bootstrapRootContainer,\n  buildInitialOrganizationPolicyRequest,\n  createInitialRootMetadataBootstrap,\n  persistRegistrationBootstrap,\n  registerIdentity,\n} from \"./workflows/registration\";\nexport type {\n  RootIdentitiesApi,\n  RootIdentitiesPage,\n  RootIdentitiesQueryInput,\n  RootIdentity,\n  RootIdentityDetail,\n  RootIdentityOrganization,\n  RootIdentitySession,\n  RootRequestOutcome,\n} from \"./workflows/root\";\nexport {\n  liftRootIdentitySuspension,\n  listRootAuditEvents,\n  listRootDataUsageReport,\n  listRootIdentities,\n  listRootIdentityOrganizations,\n  listRootOrganizationIdentities,\n  listRootOrganizationRevenuecatEvents,\n  listRootOrganizations,\n  listRootRevenuecatEventsReport,\n  loadRootIdentity,\n  loadRootOpsHealthReport,\n  loadRootOrganization,\n  loadRootOrganizationDataUsage,\n  type RootAuditApi,\n  type RootAuditEvent,\n  type RootAuditEventsPage,\n  type RootAuditEventsQueryInput,\n  type RootDataUsageApi,\n  type RootDataUsageReportPage,\n  type RootOpsHealthApi,\n  type RootOpsHealthReport,\n  type RootOrganization,\n  type RootOrganizationDetail,\n  type RootOrganizationIdentitiesPage,\n  type RootOrganizationIdentity,\n  type RootOrganizationPageQueryInput,\n  type RootOrganizationRevenuecatEvent,\n  type RootOrganizationRevenuecatEventsPage,\n  type RootOrganizationsApi,\n  type RootOrganizationsPage,\n  type RootOrganizationsQueryInput,\n  type RootRevenuecatApi,\n  type RootRevenuecatEvent,\n  type RootRevenuecatEventsQueryInput,\n  type RootRevenuecatEventsReportPage,\n  type RootRevenuecatEventsReportQueryInput,\n  type RootSuspensionApi,\n  suspendRootIdentity,\n} from \"./workflows/root\";\nexport type {\n  ClearRemoteSyncStateResult,\n  DomainSyncCoordinator,\n  DomainSyncSnapshot,\n  RemoteResetInput,\n  RemoteResetReplacement,\n  SyncIdleOptions,\n  SyncLane,\n  SyncLaneConfig,\n  SyncLaneLastAction,\n  SyncLanePhase,\n  SyncLaneSnapshot,\n  SyncLaneStatus,\n} from \"./workflows/sync\";\nexport {\n  clearRemoteSyncState,\n  getDomainSyncCoordinatorSnapshot,\n  getOrCreateDomainSyncCoordinator,\n  hasDomainSyncCoordinatorPendingWork,\n  requestAllDomainSyncLanes,\n  subscribeToDomainSyncCoordinator,\n  waitForDomainSyncCoordinatorToSettle,\n} from \"./workflows/sync\";\n"]}

package/internal/api-client/ApiClient.d.ts

@@ -2095,6 +2095,13 @@ export declare class ApiClient {
             organizationId: string;
             userId: string;
             requestedAt: string;
+            membersHead: {
+                principalId: string;
+                version: number;
+                keyEpoch: number;
+                stateHash: string;
+                keyFingerprint: string;
+            };
             signature: string;
         } | null;
         profileDocumentId: string | null;

package/internal/crypto/organizationLeaveRequest.d.ts

@@ -7,7 +7,7 @@ export declare function signOrganizationLeaveRequest(payload: LeaveRequestPayloa
 /**
  * Whether `value` is a well-formed leave request signed by the holder of
  * `publicKey`. Callers still check that it names the organization and member
- * they expect.
+ * they expect, and that the member has stayed in Members since the cited head.
  */
 export declare function isValidOrganizationLeaveRequest(value: unknown, publicKey: Uint8Array): value is OrganizationLeaveRequest;
 export {};

package/internal/crypto/organizationLeaveRequest.js

@@ -5,7 +5,14 @@ import { sign } from "./signing/sign.js";
 import { verify } from "./signing/verify.js";
 export function organizationLeaveRequestSigningBytes(payload) {
     return new TextEncoder().encode(serializeKeyingCanonicalJson({
-        domain: "tearleads.organization-leave-request.v1",
+        domain: "tearleads.organization-leave-request.v2",
+        membersHead: {
+            keyEpoch: payload.membersHead.keyEpoch,
+            keyFingerprint: payload.membersHead.keyFingerprint,
+            principalId: payload.membersHead.principalId,
+            stateHash: payload.membersHead.stateHash,
+            version: payload.membersHead.version,
+        },
         organizationId: payload.organizationId,
         requestedAt: payload.requestedAt,
         userId: payload.userId,
@@ -21,7 +28,7 @@ export function signOrganizationLeaveRequest(payload, keys) {
 /**
  * Whether `value` is a well-formed leave request signed by the holder of
  * `publicKey`. Callers still check that it names the organization and member
- * they expect.
+ * they expect, and that the member has stayed in Members since the cited head.
  */
 export function isValidOrganizationLeaveRequest(value, publicKey) {
     const parsed = OrganizationLeaveRequestSchema.safeParse(value);

package/internal/crypto/organizationLeaveRequest.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizationLeaveRequest.js","sourceRoot":"","sources":["organizationLeaveRequest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAEL,8BAA8B,GAC/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAElE,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAI1C,MAAM,UAAU,oCAAoC,CAClD,OAA4B;IAE5B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAC7B,4BAA4B,CAAC;QAC3B,MAAM,EAAE,yCAAyC;QACjD,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CACH,CAAC;AACJ,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,4BAA4B,CAC1C,OAA4B,EAC5B,IAA+C;IAE/C,OAAO,8BAA8B,CAAC,KAAK,CAAC;QAC1C,GAAG,OAAO;QACV,SAAS,EAAE,aAAa,CACtB,IAAI,CACF,oCAAoC,CAAC,OAAO,CAAC,EAC7C,IAAI,CAAC,iBAAiB,CACvB,CACF;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAC7C,KAAc,EACd,SAAqB;IAErB,MAAM,MAAM,GAAG,8BAA8B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAClC,IAAI,SAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CACX,SAAS,EACT,oCAAoC,CAAC,MAAM,CAAC,IAAI,CAAC,EACjD,SAAS,CACV,CAAC;AACJ,CAAC","sourcesContent":["import { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport {\n  type OrganizationLeaveRequest,\n  OrganizationLeaveRequestSchema,\n} from \"@tearleads/validators/util\";\nimport { serializeKeyingCanonicalJson } from \"./keying/canonical\";\nimport type { SigningKeyPair } from \"./signing/generateKeyPair\";\nimport { sign } from \"./signing/sign\";\nimport { verify } from \"./signing/verify\";\n\ntype LeaveRequestPayload = Omit<OrganizationLeaveRequest, \"signature\">;\n\nexport function organizationLeaveRequestSigningBytes(\n  payload: LeaveRequestPayload,\n): Uint8Array {\n  return new TextEncoder().encode(\n    serializeKeyingCanonicalJson({\n      domain: \"tearleads.organization-leave-request.v1\",\n      organizationId: payload.organizationId,\n      requestedAt: payload.requestedAt,\n      userId: payload.userId,\n    }),\n  );\n}\n\n/** Signs a member's request to leave one organization. */\nexport function signOrganizationLeaveRequest(\n  payload: LeaveRequestPayload,\n  keys: Pick<SigningKeyPair, \"signingPrivateKey\">,\n): OrganizationLeaveRequest {\n  return OrganizationLeaveRequestSchema.parse({\n    ...payload,\n    signature: bytesToBase64(\n      sign(\n        organizationLeaveRequestSigningBytes(payload),\n        keys.signingPrivateKey,\n      ),\n    ),\n  });\n}\n\n/**\n * Whether `value` is a well-formed leave request signed by the holder of\n * `publicKey`. Callers still check that it names the organization and member\n * they expect.\n */\nexport function isValidOrganizationLeaveRequest(\n  value: unknown,\n  publicKey: Uint8Array,\n): value is OrganizationLeaveRequest {\n  const parsed = OrganizationLeaveRequestSchema.safeParse(value);\n  if (!parsed.success) return false;\n  let signature: Uint8Array;\n  try {\n    signature = base64ToBytes(parsed.data.signature);\n  } catch {\n    return false;\n  }\n  return verify(\n    signature,\n    organizationLeaveRequestSigningBytes(parsed.data),\n    publicKey,\n  );\n}\n"]}
+{"version":3,"file":"organizationLeaveRequest.js","sourceRoot":"","sources":["organizationLeaveRequest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAEL,8BAA8B,GAC/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAElE,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAI1C,MAAM,UAAU,oCAAoC,CAClD,OAA4B;IAE5B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAC7B,4BAA4B,CAAC;QAC3B,MAAM,EAAE,yCAAyC;QACjD,WAAW,EAAE;YACX,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,QAAQ;YACtC,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC,cAAc;YAClD,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,WAAW;YAC5C,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,SAAS;YACxC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,OAAO;SACrC;QACD,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CACH,CAAC;AACJ,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,4BAA4B,CAC1C,OAA4B,EAC5B,IAA+C;IAE/C,OAAO,8BAA8B,CAAC,KAAK,CAAC;QAC1C,GAAG,OAAO;QACV,SAAS,EAAE,aAAa,CACtB,IAAI,CACF,oCAAoC,CAAC,OAAO,CAAC,EAC7C,IAAI,CAAC,iBAAiB,CACvB,CACF;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAC7C,KAAc,EACd,SAAqB;IAErB,MAAM,MAAM,GAAG,8BAA8B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAClC,IAAI,SAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CACX,SAAS,EACT,oCAAoC,CAAC,MAAM,CAAC,IAAI,CAAC,EACjD,SAAS,CACV,CAAC;AACJ,CAAC","sourcesContent":["import { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport {\n  type OrganizationLeaveRequest,\n  OrganizationLeaveRequestSchema,\n} from \"@tearleads/validators/util\";\nimport { serializeKeyingCanonicalJson } from \"./keying/canonical\";\nimport type { SigningKeyPair } from \"./signing/generateKeyPair\";\nimport { sign } from \"./signing/sign\";\nimport { verify } from \"./signing/verify\";\n\ntype LeaveRequestPayload = Omit<OrganizationLeaveRequest, \"signature\">;\n\nexport function organizationLeaveRequestSigningBytes(\n  payload: LeaveRequestPayload,\n): Uint8Array {\n  return new TextEncoder().encode(\n    serializeKeyingCanonicalJson({\n      domain: \"tearleads.organization-leave-request.v2\",\n      membersHead: {\n        keyEpoch: payload.membersHead.keyEpoch,\n        keyFingerprint: payload.membersHead.keyFingerprint,\n        principalId: payload.membersHead.principalId,\n        stateHash: payload.membersHead.stateHash,\n        version: payload.membersHead.version,\n      },\n      organizationId: payload.organizationId,\n      requestedAt: payload.requestedAt,\n      userId: payload.userId,\n    }),\n  );\n}\n\n/** Signs a member's request to leave one organization. */\nexport function signOrganizationLeaveRequest(\n  payload: LeaveRequestPayload,\n  keys: Pick<SigningKeyPair, \"signingPrivateKey\">,\n): OrganizationLeaveRequest {\n  return OrganizationLeaveRequestSchema.parse({\n    ...payload,\n    signature: bytesToBase64(\n      sign(\n        organizationLeaveRequestSigningBytes(payload),\n        keys.signingPrivateKey,\n      ),\n    ),\n  });\n}\n\n/**\n * Whether `value` is a well-formed leave request signed by the holder of\n * `publicKey`. Callers still check that it names the organization and member\n * they expect, and that the member has stayed in Members since the cited head.\n */\nexport function isValidOrganizationLeaveRequest(\n  value: unknown,\n  publicKey: Uint8Array,\n): value is OrganizationLeaveRequest {\n  const parsed = OrganizationLeaveRequestSchema.safeParse(value);\n  if (!parsed.success) return false;\n  let signature: Uint8Array;\n  try {\n    signature = base64ToBytes(parsed.data.signature);\n  } catch {\n    return false;\n  }\n  return verify(\n    signature,\n    organizationLeaveRequestSigningBytes(parsed.data),\n    publicKey,\n  );\n}\n"]}

package/internal/validators/operation/organizationMemberships.d.ts

@@ -255,6 +255,13 @@ export declare const requestOrganizationLeaveOperation: Omit<{
         organizationId: z.ZodCustom<string, string>;
         userId: z.ZodCustom<string, string>;
         requestedAt: z.ZodString;
+        membersHead: z.ZodObject<{
+            principalId: z.ZodCustom<string, string>;
+            version: z.ZodCustom<number, number>;
+            keyEpoch: z.ZodCustom<number, number>;
+            stateHash: z.ZodString;
+            keyFingerprint: z.ZodString;
+        }, z.core.$strict>;
         signature: z.ZodString;
     }, z.core.$strict>;
     readonly failureResponses: {

package/internal/validators/operation/organizations.d.ts

@@ -7458,6 +7458,13 @@ export declare const getOrganizationReadModelOperation: Omit<{
                             organizationId: string;
                             userId: string;
                             requestedAt: string;
+                            membersHead: {
+                                principalId: string;
+                                version: number;
+                                keyEpoch: number;
+                                stateHash: string;
+                                keyFingerprint: string;
+                            };
                             signature: string;
                         } | null;
                         profileDocumentId: string | null;
@@ -7479,6 +7486,13 @@ export declare const getOrganizationReadModelOperation: Omit<{
                             organizationId: string;
                             userId: string;
                             requestedAt: string;
+                            membersHead: {
+                                principalId: string;
+                                version: number;
+                                keyEpoch: number;
+                                stateHash: string;
+                                keyFingerprint: string;
+                            };
                             signature: string;
                         } | null;
                         profileDocumentId: string | null;
@@ -7611,6 +7625,13 @@ export declare const getOrganizationReadModelOperation: Omit<{
                             organizationId: string;
                             userId: string;
                             requestedAt: string;
+                            membersHead: {
+                                principalId: string;
+                                version: number;
+                                keyEpoch: number;
+                                stateHash: string;
+                                keyFingerprint: string;
+                            };
                             signature: string;
                         } | null;
                         profileDocumentId: string | null;
@@ -7632,6 +7653,13 @@ export declare const getOrganizationReadModelOperation: Omit<{
                             organizationId: string;
                             userId: string;
                             requestedAt: string;
+                            membersHead: {
+                                principalId: string;
+                                version: number;
+                                keyEpoch: number;
+                                stateHash: string;
+                                keyFingerprint: string;
+                            };
                             signature: string;
                         } | null;
                         profileDocumentId: string | null;
@@ -10777,6 +10805,13 @@ export declare const updateOrganizationRosterEntryOperation: Omit<{
                 organizationId: string;
                 userId: string;
                 requestedAt: string;
+                membersHead: {
+                    principalId: string;
+                    version: number;
+                    keyEpoch: number;
+                    stateHash: string;
+                    keyFingerprint: string;
+                };
                 signature: string;
             } | null;
             profileDocumentId: string | null;
@@ -10798,6 +10833,13 @@ export declare const updateOrganizationRosterEntryOperation: Omit<{
                 organizationId: string;
                 userId: string;
                 requestedAt: string;
+                membersHead: {
+                    principalId: string;
+                    version: number;
+                    keyEpoch: number;
+                    stateHash: string;
+                    keyFingerprint: string;
+                };
                 signature: string;
             } | null;
             profileDocumentId: string | null;
@@ -10819,6 +10861,13 @@ export declare const updateOrganizationRosterEntryOperation: Omit<{
                 organizationId: string;
                 userId: string;
                 requestedAt: string;
+                membersHead: {
+                    principalId: string;
+                    version: number;
+                    keyEpoch: number;
+                    stateHash: string;
+                    keyFingerprint: string;
+                };
                 signature: string;
             } | null;
             profileDocumentId: string | null;
@@ -10840,6 +10889,13 @@ export declare const updateOrganizationRosterEntryOperation: Omit<{
                 organizationId: string;
                 userId: string;
                 requestedAt: string;
+                membersHead: {
+                    principalId: string;
+                    version: number;
+                    keyEpoch: number;
+                    stateHash: string;
+                    keyFingerprint: string;
+                };
                 signature: string;
             } | null;
             profileDocumentId: string | null;

package/internal/validators/response/organization.d.ts

@@ -24,6 +24,13 @@ export declare const OrganizationDirectoryUserResponseShape: {
         organizationId: z.ZodCustom<string, string>;
         userId: z.ZodCustom<string, string>;
         requestedAt: z.ZodString;
+        membersHead: z.ZodObject<{
+            principalId: z.ZodCustom<string, string>;
+            version: z.ZodCustom<number, number>;
+            keyEpoch: z.ZodCustom<number, number>;
+            stateHash: z.ZodString;
+            keyFingerprint: z.ZodString;
+        }, z.core.$strict>;
         signature: z.ZodString;
     }, z.core.$strict>>;
     profileDocumentId: z.ZodNullable<z.ZodString>;
@@ -46,6 +53,13 @@ export declare const OrganizationDirectoryUserResponseSchema: z.ZodType<{
         organizationId: string;
         userId: string;
         requestedAt: string;
+        membersHead: {
+            principalId: string;
+            version: number;
+            keyEpoch: number;
+            stateHash: string;
+            keyFingerprint: string;
+        };
         signature: string;
     } | null;
     profileDocumentId: string | null;
@@ -67,6 +81,13 @@ export declare const OrganizationDirectoryUserResponseSchema: z.ZodType<{
         organizationId: string;
         userId: string;
         requestedAt: string;
+        membersHead: {
+            principalId: string;
+            version: number;
+            keyEpoch: number;
+            stateHash: string;
+            keyFingerprint: string;
+        };
         signature: string;
     } | null;
     profileDocumentId: string | null;
@@ -88,6 +109,13 @@ export declare const OrganizationDirectoryUserResponseSchema: z.ZodType<{
         organizationId: string;
         userId: string;
         requestedAt: string;
+        membersHead: {
+            principalId: string;
+            version: number;
+            keyEpoch: number;
+            stateHash: string;
+            keyFingerprint: string;
+        };
         signature: string;
     } | null;
     profileDocumentId: string | null;
@@ -109,6 +137,13 @@ export declare const OrganizationDirectoryUserResponseSchema: z.ZodType<{
         organizationId: string;
         userId: string;
         requestedAt: string;
+        membersHead: {
+            principalId: string;
+            version: number;
+            keyEpoch: number;
+            stateHash: string;
+            keyFingerprint: string;
+        };
         signature: string;
     } | null;
     profileDocumentId: string | null;
@@ -141,6 +176,13 @@ export declare const OrganizationDirectoryResponseSchema: z.ZodType<{
             organizationId: string;
             userId: string;
             requestedAt: string;
+            membersHead: {
+                principalId: string;
+                version: number;
+                keyEpoch: number;
+                stateHash: string;
+                keyFingerprint: string;
+            };
             signature: string;
         } | null;
         profileDocumentId: string | null;
@@ -169,6 +211,13 @@ export declare const OrganizationDirectoryResponseSchema: z.ZodType<{
             organizationId: string;
             userId: string;
             requestedAt: string;
+            membersHead: {
+                principalId: string;
+                version: number;
+                keyEpoch: number;
+                stateHash: string;
+                keyFingerprint: string;
+            };
             signature: string;
         } | null;
         profileDocumentId: string | null;
@@ -197,6 +246,13 @@ export declare const OrganizationDirectoryResponseSchema: z.ZodType<{
             organizationId: string;
             userId: string;
             requestedAt: string;
+            membersHead: {
+                principalId: string;
+                version: number;
+                keyEpoch: number;
+                stateHash: string;
+                keyFingerprint: string;
+            };
             signature: string;
         } | null;
         profileDocumentId: string | null;
@@ -225,6 +281,13 @@ export declare const OrganizationDirectoryResponseSchema: z.ZodType<{
             organizationId: string;
             userId: string;
             requestedAt: string;
+            membersHead: {
+                principalId: string;
+                version: number;
+                keyEpoch: number;
+                stateHash: string;
+                keyFingerprint: string;
+            };
             signature: string;
         } | null;
         profileDocumentId: string | null;
@@ -2041,6 +2104,13 @@ export declare const OrganizationUserDetailResponseSchema: z.ZodType<{
             organizationId: string;
             userId: string;
             requestedAt: string;
+            membersHead: {
+                principalId: string;
+                version: number;
+                keyEpoch: number;
+                stateHash: string;
+                keyFingerprint: string;
+            };
             signature: string;
         } | null;
         profileDocumentId: string | null;
@@ -2114,6 +2184,13 @@ export declare const OrganizationUserDetailResponseSchema: z.ZodType<{
             organizationId: string;
             userId: string;
             requestedAt: string;
+            membersHead: {
+                principalId: string;
+                version: number;
+                keyEpoch: number;
+                stateHash: string;
+                keyFingerprint: string;
+            };
             signature: string;
         } | null;
         profileDocumentId: string | null;
@@ -2187,6 +2264,13 @@ export declare const OrganizationUserDetailResponseSchema: z.ZodType<{
             organizationId: string;
             userId: string;
             requestedAt: string;
+            membersHead: {
+                principalId: string;
+                version: number;
+                keyEpoch: number;
+                stateHash: string;
+                keyFingerprint: string;
+            };
             signature: string;
         } | null;
         profileDocumentId: string | null;
@@ -2260,6 +2344,13 @@ export declare const OrganizationUserDetailResponseSchema: z.ZodType<{
             organizationId: string;
             userId: string;
             requestedAt: string;
+            membersHead: {
+                principalId: string;
+                version: number;
+                keyEpoch: number;
+                stateHash: string;
+                keyFingerprint: string;
+            };
             signature: string;
         } | null;
         profileDocumentId: string | null;