@tearleads/client-sdk 0.1.114 → 0.1.116

package/internal/api-client/principalPolicyPages.js

@@ -1,5 +1,6 @@
 import { serializeKeyingCanonicalJson } from "../crypto/index.js";
 import { getPrincipalPolicyOperation } from "../validators/operation/index.js";
+import { isPrincipalPolicyPageResponse, isPrincipalPolicyUnchangedResponse, } from "../validators/response/index.js";
 import { principalHistoryRequest } from "./principalHistoryRequest.js";
 import { PrincipalHistoryRequestContext } from "./principalHistoryRequestContext.js";
 import { getPrincipalPolicy } from "./routes/principals/policy.js";
@@ -30,7 +31,7 @@ function readResume(input) {
             previousStates: [],
             historyPage: { afterVersion: input.afterVersion, nextAfterVersion: null },
         };
-        if (!getPrincipalPolicy.isResponse(page))
+        if (!isPrincipalPolicyPageResponse(page))
             return undefined;
         const current = structuredClone(currentArtifacts(page));
         return {
@@ -115,7 +116,7 @@ export async function* readPrincipalPolicyPages(runtime, principalType, principa
             : firstPath;
         const result = await principalHistoryRequest(runtime, {
             path,
-            validator: getPrincipalPolicy.isResponse,
+            validator: isPrincipalPolicyPageResponse,
             method: "GET",
             operation: getPrincipalPolicyOperation,
             options,
@@ -155,6 +156,51 @@ export async function* readPrincipalPolicyPages(runtime, principalType, principa
         afterVersion = nextAfterVersion;
     }
 }
+/**
+ * One unpinned discovery read. With `ifHead`, a server whose live head is
+ * exactly that head answers `{ unchanged, head }` instead of the first page.
+ * The reply is untrusted: the caller must check the head is the one it holds.
+ */
+export async function readPrincipalPolicyDiscovery(runtime, principalType, principalId, options) {
+    const { ifHead, ...requestOptions } = options;
+    const query = ifHead
+        ? { ifVersion: ifHead.version, ifStateHash: ifHead.stateHash }
+        : {};
+    if (!getPrincipalPolicyOperation.query.safeParse(query).success)
+        return pageFailure(runtime, getPrincipalPolicy.path(principalType, principalId), requestOptions, "Invalid held principal history head", null);
+    const path = getPrincipalPolicy.path(principalType, principalId, query);
+    const result = await principalHistoryRequest(runtime, {
+        path,
+        validator: getPrincipalPolicy.isResponse,
+        method: "GET",
+        operation: getPrincipalPolicyOperation,
+        options: requestOptions,
+    });
+    if (!result.ok)
+        return result;
+    const response = result.data;
+    // Exactly one variant: the strict bare-head reply, only to a conditional
+    // read and only for the requested principal, or a valid first page.
+    const unchanged = isPrincipalPolicyUnchangedResponse(response);
+    const page = isPrincipalPolicyPageResponse(response);
+    const valid = unchanged
+        ? !page &&
+            ifHead !== undefined &&
+            response.head.principalType === principalType &&
+            response.head.principalId === principalId
+        : page &&
+            validPage(response, {
+                principalType,
+                principalId,
+                stateHash: undefined,
+                pinnedBytes: undefined,
+                bytes: "",
+                afterVersion: 0,
+            });
+    return valid
+        ? result
+        : pageFailure(runtime, path, requestOptions, "Principal discovery reply does not match its request", 200);
+}
 /** Full-bundle adapter for consumers that have not adopted durable staging. */
 export async function collectPrincipalPolicyPages(runtime, principalType, principalId, options) {
     let current;

package/internal/api-client/principalPolicyPages.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalPolicyPages.js","sourceRoot":"","sources":["principalPolicyPages.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAM9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAsBhE,SAAS,gBAAgB,CAAC,IAAiC;IACzD,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,aAAuC,EACvC,WAAmB,EACnB,MAAiC,EACjC,SAA6B;IAE7B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;IAC1C,OAAO,CACL,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC;QACzC,MAAM,CAAC,YAAY,IAAI,CAAC;QACxB,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC,OAAO;QACnC,KAAK,CAAC,aAAa,KAAK,aAAa;QACrC,KAAK,CAAC,WAAW,KAAK,WAAW;QACjC,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAC3D,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAA4C;IAC9D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG;YACX,GAAG,KAAK,CAAC,OAAO;YAChB,cAAc,EAAE,EAAE;YAClB,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,gBAAgB,EAAE,IAAI,EAAE;SAC1E,CAAC;QACF,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3D,MAAM,OAAO,GAAG,eAAe,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,OAAO;YACL,OAAO;YACP,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,YAAY;YAC3C,KAAK,EAAE,4BAA4B,CAAC,OAAO,CAAC;SAC7C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAChB,IAAiC,EACjC,QAOC;IAED,MAAM,EAAE,YAAY,EAAE,GAAG,QAAQ,CAAC;IAClC,MAAM,WAAW,GAAG,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;IAC9D,OAAO,CACL,IAAI,CAAC,YAAY,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;QAC1D,IAAI,CAAC,YAAY,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;QACtD,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS;YAC/B,IAAI,CAAC,YAAY,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,CAAC;QACrD,CAAC,QAAQ,CAAC,WAAW,KAAK,SAAS;YACjC,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,WAAW,CAAC,YAAY,KAAK,YAAY;QAC9C,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO;QACvC,IAAI,CAAC,cAAc,CAAC,KAAK,CACvB,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CACnB,KAAK,CAAC,OAAO,KAAK,YAAY,GAAG,KAAK,GAAG,CAAC;YAC1C,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;YAC1C,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa,CACjD;QACD,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI;YACzC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC;YAC/C,CAAC,CAAC,WAAW,GAAG,YAAY;gBAC1B,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC;gBAC3C,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,WAAW,CAAC,CACvD,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,OAA0B,EAC1B,aAAuC,EACvC,WAAmB,EACnB,OAAuC;IAEvC,MAAM,KAAK,GACT,OAAO,CAAC,SAAS,KAAK,SAAS;QAC7B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,CAAC;YACvC,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;IACR,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC;QACpC,EAAE,EAAE,KAAc;QAClB,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;KAChE,CAAC,CAAC;IACH,IACE,OAAO,CAAC,YAAY,KAAK,SAAS;QAClC,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS;YAC9B,OAAO,CAAC,MAAM,KAAK,SAAS;YAC5B,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAE9C,OAAO,OAAO,CAAC,0DAA0D,CAAC,CAAC;IAC7E,IAAI,CAAC,2BAA2B,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO;QAC7D,OAAO,OAAO,CAAC,0CAA0C,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,IACE,OAAO,CAAC,MAAM,KAAK,SAAS;QAC5B,CAAC,CAAC,MAAM;YACN,CAAC,WAAW,CAAC,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAEtE,OAAO,OAAO,CAAC,0CAA0C,CAAC,CAAC;IAC7D,OAAO;QACL,EAAE,EAAE,IAAa;QACjB,SAAS,EAAE,kBAAkB,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,KAAK,CAAC;QACrE,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,CAAC;QACvC,MAAM;KACP,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,wBAAwB,CAC7C,OAA0B,EAC1B,aAAuC,EACvC,WAAmB,EACnB,OAAuC;IAEvC,MAAM,QAAQ,GAAG,0BAA0B,CACzC,OAAO,EACP,aAAa,EACb,WAAW,EACX,OAAO,CACR,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,OAAO,CAAC;QACvB,OAAO;IACT,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,8BAA8B,CAChD,OAAO,EACP,KAAK,EACL,SAAS,EACT,OAAO,CACR,CAAC;IACF,IAAI,MAAM,GAAG,MAAM,EAAE,OAAO,CAAC;IAC7B,IAAI,WAAW,GAAG,MAAM,EAAE,KAAK,CAAC;IAChC,IAAI,YAAY,GAAG,MAAM,EAAE,YAAY,IAAI,QAAQ,CAAC,YAAY,CAAC;IACjE,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM;YACjB,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE;gBAClD,YAAY;gBACZ,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS;aACzC,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE;YACpD,IAAI;YACJ,SAAS,EAAE,kBAAkB,CAAC,UAAU;YACxC,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,2BAA2B;YACtC,OAAO;YACP,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,MAAM,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,4BAA4B,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE;YAC5B,aAAa;YACb,WAAW;YACX,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW;YACX,KAAK;YACL,YAAY;SACb,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,WAAW,CACf,OAAO,EACP,IAAI,EACJ,OAAO,EACP,2DAA2D,EAC3D,GAAG,CACJ,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,KAAK,eAAe,CAAC,SAAS,CAAC,CAAC;QACtC,WAAW,KAAK,KAAK,CAAC;QACtB,OAAO,CAAC,aAAa,EAAE,CAAC;QACxB,MAAM,gBAAgB,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC;QAC3D,MAAM,MAAM,CAAC;QACb,4EAA4E;QAC5E,IAAI,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;YACxB,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QACD,IAAI,gBAAgB,KAAK,IAAI;YAAE,OAAO;QACtC,YAAY,GAAG,gBAAgB,CAAC;IAClC,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAA0B,EAC1B,aAAuC,EACvC,WAAmB,EACnB,OAA6B;IAE7B,IAAI,OAA+C,CAAC;IACpD,MAAM,cAAc,GAAoD,EAAE,CAAC;IAC3E,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,wBAAwB,CACjD,OAAO,EACP,aAAa,EACb,WAAW,EACX,OAAO,CACR,EAAE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC5B,OAAO,KAAK,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1C,cAAc,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzD,CAAC;AAED,SAAS,WAAW,CAClB,OAA0B,EAC1B,IAAY,EACZ,OAA6B,EAC7B,OAAe,EACf,MAAqB;IAErB,OAAO,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC;QAC3C,IAAI,EAAE,OAAO;QACb,OAAO;QACP,MAAM,EAAE,KAAK;QACb,OAAO;QACP,IAAI;QACJ,MAAM;QACN,UAAU,EAAE,EAAE;KACf,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { serializeKeyingCanonicalJson } from \"@tearleads/crypto\";\nimport { getPrincipalPolicyOperation } from \"@tearleads/validators/operation\";\nimport type {\n  PrincipalPolicyBundleResponse,\n  PrincipalPolicyPageResponse,\n} from \"@tearleads/validators/response\";\nimport type { ApiRequestRuntime } from \"./apiRequestRuntime\";\nimport { principalHistoryRequest } from \"./principalHistoryRequest\";\nimport { PrincipalHistoryRequestContext } from \"./principalHistoryRequestContext\";\nimport { getPrincipalPolicy } from \"./routes/principals/policy\";\nimport type { RequestResult, RequestResultOptions } from \"./types\";\n\nexport type PrincipalPolicyPageCurrent = Omit<\n  PrincipalPolicyBundleResponse,\n  \"previousStates\"\n>;\n\n/** A transport position. Only the caller can authenticate the saved prefix. */\nexport interface PrincipalPolicyPageResume {\n  readonly current: PrincipalPolicyPageCurrent;\n  readonly afterVersion: number;\n}\n\nexport interface PrincipalPolicyPageReadOptions extends RequestResultOptions {\n  /** Select an exact signed head even before its first page has been read. */\n  readonly stateHash?: string | undefined;\n  /** Transport offset for a caller-authenticated prefix; requires stateHash. */\n  readonly afterVersion?: number | undefined;\n  readonly resume?: PrincipalPolicyPageResume | undefined;\n}\n\nfunction currentArtifacts(page: PrincipalPolicyPageResponse) {\n  return {\n    currentState: page.currentState,\n    currentPayload: page.currentPayload,\n    currentProjection: page.currentProjection,\n    currentGrants: page.currentGrants,\n    currentMemberEnvelopes: page.currentMemberEnvelopes,\n  };\n}\n\nfunction validResume(\n  principalType: \"group\" | \"organization\",\n  principalId: string,\n  resume: PrincipalPolicyPageResume,\n  stateHash: string | undefined,\n): boolean {\n  const state = resume.current.currentState;\n  return (\n    Number.isSafeInteger(resume.afterVersion) &&\n    resume.afterVersion >= 0 &&\n    resume.afterVersion < state.version &&\n    state.principalType === principalType &&\n    state.principalId === principalId &&\n    (stateHash === undefined || state.stateHash === stateHash)\n  );\n}\n\nfunction readResume(input: PrincipalPolicyPageResume | undefined) {\n  if (input === undefined) return undefined;\n  try {\n    const page = {\n      ...input.current,\n      previousStates: [],\n      historyPage: { afterVersion: input.afterVersion, nextAfterVersion: null },\n    };\n    if (!getPrincipalPolicy.isResponse(page)) return undefined;\n    const current = structuredClone(currentArtifacts(page));\n    return {\n      current,\n      afterVersion: page.historyPage.afterVersion,\n      bytes: serializeKeyingCanonicalJson(current),\n    };\n  } catch {\n    return undefined;\n  }\n}\n\nfunction validPage(\n  page: PrincipalPolicyPageResponse,\n  expected: {\n    principalType: \"group\" | \"organization\";\n    principalId: string;\n    stateHash: string | undefined;\n    pinnedBytes: string | undefined;\n    bytes: string;\n    afterVersion: number;\n  },\n): boolean {\n  const { afterVersion } = expected;\n  const lastVersion = afterVersion + page.previousStates.length;\n  return (\n    page.currentState.principalType === expected.principalType &&\n    page.currentState.principalId === expected.principalId &&\n    (expected.stateHash === undefined ||\n      page.currentState.stateHash === expected.stateHash) &&\n    (expected.pinnedBytes === undefined ||\n      expected.bytes === expected.pinnedBytes) &&\n    page.historyPage.afterVersion === afterVersion &&\n    lastVersion < page.currentState.version &&\n    page.previousStates.every(\n      ({ state }, index) =>\n        state.version === afterVersion + index + 1 &&\n        state.principalId === expected.principalId &&\n        state.principalType === expected.principalType,\n    ) &&\n    (page.historyPage.nextAfterVersion === null\n      ? lastVersion === page.currentState.version - 1\n      : lastVersion > afterVersion &&\n        lastVersion < page.currentState.version - 1 &&\n        page.historyPage.nextAfterVersion === lastVersion)\n  );\n}\n\nfunction preparePrincipalPolicyRead(\n  runtime: ApiRequestRuntime,\n  principalType: \"group\" | \"organization\",\n  principalId: string,\n  options: PrincipalPolicyPageReadOptions,\n) {\n  const query =\n    options.stateHash === undefined\n      ? {}\n      : {\n          afterVersion: options.afterVersion ?? 0,\n          stateHash: options.stateHash,\n        };\n  const basePath = getPrincipalPolicy.path(principalType, principalId);\n  const failure = (message: string) => ({\n    ok: false as const,\n    failure: pageFailure(runtime, basePath, options, message, null),\n  });\n  if (\n    options.afterVersion !== undefined &&\n    (options.stateHash === undefined ||\n      options.resume !== undefined ||\n      !Number.isSafeInteger(options.afterVersion))\n  )\n    return failure(\"Initial principal history cursor requires one exact head\");\n  if (!getPrincipalPolicyOperation.query.safeParse(query).success)\n    return failure(\"Invalid requested principal history head\");\n  const resume = readResume(options.resume);\n  if (\n    options.resume !== undefined &&\n    (!resume ||\n      !validResume(principalType, principalId, resume, options.stateHash))\n  )\n    return failure(\"Invalid saved principal history position\");\n  return {\n    ok: true as const,\n    firstPath: getPrincipalPolicy.path(principalType, principalId, query),\n    afterVersion: options.afterVersion ?? 0,\n    resume,\n  };\n}\n\n/** Pull one page at a time; the caller owns verification and durable admission. */\nexport async function* readPrincipalPolicyPages(\n  runtime: ApiRequestRuntime,\n  principalType: \"group\" | \"organization\",\n  principalId: string,\n  options: PrincipalPolicyPageReadOptions,\n): AsyncGenerator<RequestResult<PrincipalPolicyPageResponse>, void> {\n  const position = preparePrincipalPolicyRead(\n    runtime,\n    principalType,\n    principalId,\n    options,\n  );\n  if (!position.ok) {\n    yield position.failure;\n    return;\n  }\n  const { firstPath, resume } = position;\n  const context = new PrincipalHistoryRequestContext(\n    runtime,\n    \"GET\",\n    firstPath,\n    options,\n  );\n  let pinned = resume?.current;\n  let pinnedBytes = resume?.bytes;\n  let afterVersion = resume?.afterVersion ?? position.afterVersion;\n  while (true) {\n    const path = pinned\n      ? getPrincipalPolicy.path(principalType, principalId, {\n          afterVersion,\n          stateHash: pinned.currentState.stateHash,\n        })\n      : firstPath;\n    const result = await principalHistoryRequest(runtime, {\n      path,\n      validator: getPrincipalPolicy.isResponse,\n      method: \"GET\",\n      operation: getPrincipalPolicyOperation,\n      options,\n      context,\n    });\n    if (!result.ok) {\n      yield result;\n      return;\n    }\n    const page = result.data;\n    const artifacts = currentArtifacts(page);\n    const bytes = serializeKeyingCanonicalJson(artifacts);\n    const valid = validPage(page, {\n      principalType,\n      principalId,\n      stateHash: options.stateHash,\n      pinnedBytes,\n      bytes,\n      afterVersion,\n    });\n    if (!valid) {\n      yield pageFailure(\n        runtime,\n        path,\n        options,\n        \"Principal history page changed its head, order, or cursor\",\n        200,\n      );\n      return;\n    }\n    pinned ??= structuredClone(artifacts);\n    pinnedBytes ??= bytes;\n    context.afterReadPage();\n    const nextAfterVersion = page.historyPage.nextAfterVersion;\n    yield result;\n    // A page consumer may await verification or storage while its session ends.\n    if (context.cancelled()) {\n      yield context.failure();\n      return;\n    }\n    if (nextAfterVersion === null) return;\n    afterVersion = nextAfterVersion;\n  }\n}\n\n/** Full-bundle adapter for consumers that have not adopted durable staging. */\nexport async function collectPrincipalPolicyPages(\n  runtime: ApiRequestRuntime,\n  principalType: \"group\" | \"organization\",\n  principalId: string,\n  options: RequestResultOptions,\n): Promise<PrincipalPolicyBundleResponse | null> {\n  let current: PrincipalPolicyPageCurrent | undefined;\n  const previousStates: PrincipalPolicyBundleResponse[\"previousStates\"] = [];\n  for await (const result of readPrincipalPolicyPages(\n    runtime,\n    principalType,\n    principalId,\n    options,\n  )) {\n    if (!result.ok) return null;\n    current ??= currentArtifacts(result.data);\n    previousStates.push(...result.data.previousStates);\n  }\n  return current ? { ...current, previousStates } : null;\n}\n\nfunction pageFailure(\n  runtime: ApiRequestRuntime,\n  path: string,\n  options: RequestResultOptions,\n  message: string,\n  status: number | null,\n) {\n  return runtime.responseRequest.reportFailure({\n    kind: \"shape\",\n    message,\n    method: \"GET\",\n    options,\n    path,\n    status,\n    statusText: \"\",\n  });\n}\n"]}
+{"version":3,"file":"principalPolicyPages.js","sourceRoot":"","sources":["principalPolicyPages.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,EACL,6BAA6B,EAC7B,kCAAkC,GAInC,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAsBhE,SAAS,gBAAgB,CAAC,IAAiC;IACzD,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,aAAuC,EACvC,WAAmB,EACnB,MAAiC,EACjC,SAA6B;IAE7B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;IAC1C,OAAO,CACL,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC;QACzC,MAAM,CAAC,YAAY,IAAI,CAAC;QACxB,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC,OAAO;QACnC,KAAK,CAAC,aAAa,KAAK,aAAa;QACrC,KAAK,CAAC,WAAW,KAAK,WAAW;QACjC,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAC3D,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAA4C;IAC9D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG;YACX,GAAG,KAAK,CAAC,OAAO;YAChB,cAAc,EAAE,EAAE;YAClB,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,gBAAgB,EAAE,IAAI,EAAE;SAC1E,CAAC;QACF,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3D,MAAM,OAAO,GAAG,eAAe,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,OAAO;YACL,OAAO;YACP,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,YAAY;YAC3C,KAAK,EAAE,4BAA4B,CAAC,OAAO,CAAC;SAC7C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAChB,IAAiC,EACjC,QAOC;IAED,MAAM,EAAE,YAAY,EAAE,GAAG,QAAQ,CAAC;IAClC,MAAM,WAAW,GAAG,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;IAC9D,OAAO,CACL,IAAI,CAAC,YAAY,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;QAC1D,IAAI,CAAC,YAAY,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;QACtD,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS;YAC/B,IAAI,CAAC,YAAY,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,CAAC;QACrD,CAAC,QAAQ,CAAC,WAAW,KAAK,SAAS;YACjC,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,WAAW,CAAC,YAAY,KAAK,YAAY;QAC9C,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO;QACvC,IAAI,CAAC,cAAc,CAAC,KAAK,CACvB,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CACnB,KAAK,CAAC,OAAO,KAAK,YAAY,GAAG,KAAK,GAAG,CAAC;YAC1C,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;YAC1C,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa,CACjD;QACD,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI;YACzC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC;YAC/C,CAAC,CAAC,WAAW,GAAG,YAAY;gBAC1B,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC;gBAC3C,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,WAAW,CAAC,CACvD,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,OAA0B,EAC1B,aAAuC,EACvC,WAAmB,EACnB,OAAuC;IAEvC,MAAM,KAAK,GACT,OAAO,CAAC,SAAS,KAAK,SAAS;QAC7B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,CAAC;YACvC,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;IACR,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC;QACpC,EAAE,EAAE,KAAc;QAClB,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;KAChE,CAAC,CAAC;IACH,IACE,OAAO,CAAC,YAAY,KAAK,SAAS;QAClC,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS;YAC9B,OAAO,CAAC,MAAM,KAAK,SAAS;YAC5B,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAE9C,OAAO,OAAO,CAAC,0DAA0D,CAAC,CAAC;IAC7E,IAAI,CAAC,2BAA2B,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO;QAC7D,OAAO,OAAO,CAAC,0CAA0C,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,IACE,OAAO,CAAC,MAAM,KAAK,SAAS;QAC5B,CAAC,CAAC,MAAM;YACN,CAAC,WAAW,CAAC,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAEtE,OAAO,OAAO,CAAC,0CAA0C,CAAC,CAAC;IAC7D,OAAO;QACL,EAAE,EAAE,IAAa;QACjB,SAAS,EAAE,kBAAkB,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,KAAK,CAAC;QACrE,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,CAAC;QACvC,MAAM;KACP,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,wBAAwB,CAC7C,OAA0B,EAC1B,aAAuC,EACvC,WAAmB,EACnB,OAAuC;IAEvC,MAAM,QAAQ,GAAG,0BAA0B,CACzC,OAAO,EACP,aAAa,EACb,WAAW,EACX,OAAO,CACR,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,OAAO,CAAC;QACvB,OAAO;IACT,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,8BAA8B,CAChD,OAAO,EACP,KAAK,EACL,SAAS,EACT,OAAO,CACR,CAAC;IACF,IAAI,MAAM,GAAG,MAAM,EAAE,OAAO,CAAC;IAC7B,IAAI,WAAW,GAAG,MAAM,EAAE,KAAK,CAAC;IAChC,IAAI,YAAY,GAAG,MAAM,EAAE,YAAY,IAAI,QAAQ,CAAC,YAAY,CAAC;IACjE,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM;YACjB,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE;gBAClD,YAAY;gBACZ,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS;aACzC,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE;YACpD,IAAI;YACJ,SAAS,EAAE,6BAA6B;YACxC,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,2BAA2B;YACtC,OAAO;YACP,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,MAAM,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,4BAA4B,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE;YAC5B,aAAa;YACb,WAAW;YACX,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW;YACX,KAAK;YACL,YAAY;SACb,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,WAAW,CACf,OAAO,EACP,IAAI,EACJ,OAAO,EACP,2DAA2D,EAC3D,GAAG,CACJ,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,KAAK,eAAe,CAAC,SAAS,CAAC,CAAC;QACtC,WAAW,KAAK,KAAK,CAAC;QACtB,OAAO,CAAC,aAAa,EAAE,CAAC;QACxB,MAAM,gBAAgB,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC;QAC3D,MAAM,MAAM,CAAC;QACb,4EAA4E;QAC5E,IAAI,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;YACxB,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QACD,IAAI,gBAAgB,KAAK,IAAI;YAAE,OAAO;QACtC,YAAY,GAAG,gBAAgB,CAAC;IAClC,CAAC;AACH,CAAC;AAYD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAA0B,EAC1B,aAAuC,EACvC,WAAmB,EACnB,OAAwC;IAExC,MAAM,EAAE,MAAM,EAAE,GAAG,cAAc,EAAE,GAAG,OAAO,CAAC;IAC9C,MAAM,KAAK,GAAG,MAAM;QAClB,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE;QAC9D,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,CAAC,2BAA2B,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO;QAC7D,OAAO,WAAW,CAChB,OAAO,EACP,kBAAkB,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,EACnD,cAAc,EACd,qCAAqC,EACrC,IAAI,CACL,CAAC;IACJ,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE;QACpD,IAAI;QACJ,SAAS,EAAE,kBAAkB,CAAC,UAAU;QACxC,MAAM,EAAE,KAAK;QACb,SAAS,EAAE,2BAA2B;QACtC,OAAO,EAAE,cAAc;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;IAC7B,yEAAyE;IACzE,oEAAoE;IACpE,MAAM,SAAS,GAAG,kCAAkC,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,6BAA6B,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,SAAS;QACrB,CAAC,CAAC,CAAC,IAAI;YACL,MAAM,KAAK,SAAS;YACpB,QAAQ,CAAC,IAAI,CAAC,aAAa,KAAK,aAAa;YAC7C,QAAQ,CAAC,IAAI,CAAC,WAAW,KAAK,WAAW;QAC3C,CAAC,CAAC,IAAI;YACJ,SAAS,CAAC,QAAQ,EAAE;gBAClB,aAAa;gBACb,WAAW;gBACX,SAAS,EAAE,SAAS;gBACpB,WAAW,EAAE,SAAS;gBACtB,KAAK,EAAE,EAAE;gBACT,YAAY,EAAE,CAAC;aAChB,CAAC,CAAC;IACP,OAAO,KAAK;QACV,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,WAAW,CACT,OAAO,EACP,IAAI,EACJ,cAAc,EACd,sDAAsD,EACtD,GAAG,CACJ,CAAC;AACR,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAA0B,EAC1B,aAAuC,EACvC,WAAmB,EACnB,OAA6B;IAE7B,IAAI,OAA+C,CAAC;IACpD,MAAM,cAAc,GAAoD,EAAE,CAAC;IAC3E,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,wBAAwB,CACjD,OAAO,EACP,aAAa,EACb,WAAW,EACX,OAAO,CACR,EAAE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC5B,OAAO,KAAK,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1C,cAAc,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzD,CAAC;AAED,SAAS,WAAW,CAClB,OAA0B,EAC1B,IAAY,EACZ,OAA6B,EAC7B,OAAe,EACf,MAAqB;IAErB,OAAO,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC;QAC3C,IAAI,EAAE,OAAO;QACb,OAAO;QACP,MAAM,EAAE,KAAK;QACb,OAAO;QACP,IAAI;QACJ,MAAM;QACN,UAAU,EAAE,EAAE;KACf,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { serializeKeyingCanonicalJson } from \"@tearleads/crypto\";\nimport { getPrincipalPolicyOperation } from \"@tearleads/validators/operation\";\nimport {\n  isPrincipalPolicyPageResponse,\n  isPrincipalPolicyUnchangedResponse,\n  type PrincipalPolicyBundleResponse,\n  type PrincipalPolicyPageResponse,\n  type PrincipalPolicyReadResponse,\n} from \"@tearleads/validators/response\";\nimport type { ApiRequestRuntime } from \"./apiRequestRuntime\";\nimport { principalHistoryRequest } from \"./principalHistoryRequest\";\nimport { PrincipalHistoryRequestContext } from \"./principalHistoryRequestContext\";\nimport { getPrincipalPolicy } from \"./routes/principals/policy\";\nimport type { RequestResult, RequestResultOptions } from \"./types\";\n\nexport type PrincipalPolicyPageCurrent = Omit<\n  PrincipalPolicyBundleResponse,\n  \"previousStates\"\n>;\n\n/** A transport position. Only the caller can authenticate the saved prefix. */\nexport interface PrincipalPolicyPageResume {\n  readonly current: PrincipalPolicyPageCurrent;\n  readonly afterVersion: number;\n}\n\nexport interface PrincipalPolicyPageReadOptions extends RequestResultOptions {\n  /** Select an exact signed head even before its first page has been read. */\n  readonly stateHash?: string | undefined;\n  /** Transport offset for a caller-authenticated prefix; requires stateHash. */\n  readonly afterVersion?: number | undefined;\n  readonly resume?: PrincipalPolicyPageResume | undefined;\n}\n\nfunction currentArtifacts(page: PrincipalPolicyPageResponse) {\n  return {\n    currentState: page.currentState,\n    currentPayload: page.currentPayload,\n    currentProjection: page.currentProjection,\n    currentGrants: page.currentGrants,\n    currentMemberEnvelopes: page.currentMemberEnvelopes,\n  };\n}\n\nfunction validResume(\n  principalType: \"group\" | \"organization\",\n  principalId: string,\n  resume: PrincipalPolicyPageResume,\n  stateHash: string | undefined,\n): boolean {\n  const state = resume.current.currentState;\n  return (\n    Number.isSafeInteger(resume.afterVersion) &&\n    resume.afterVersion >= 0 &&\n    resume.afterVersion < state.version &&\n    state.principalType === principalType &&\n    state.principalId === principalId &&\n    (stateHash === undefined || state.stateHash === stateHash)\n  );\n}\n\nfunction readResume(input: PrincipalPolicyPageResume | undefined) {\n  if (input === undefined) return undefined;\n  try {\n    const page = {\n      ...input.current,\n      previousStates: [],\n      historyPage: { afterVersion: input.afterVersion, nextAfterVersion: null },\n    };\n    if (!isPrincipalPolicyPageResponse(page)) return undefined;\n    const current = structuredClone(currentArtifacts(page));\n    return {\n      current,\n      afterVersion: page.historyPage.afterVersion,\n      bytes: serializeKeyingCanonicalJson(current),\n    };\n  } catch {\n    return undefined;\n  }\n}\n\nfunction validPage(\n  page: PrincipalPolicyPageResponse,\n  expected: {\n    principalType: \"group\" | \"organization\";\n    principalId: string;\n    stateHash: string | undefined;\n    pinnedBytes: string | undefined;\n    bytes: string;\n    afterVersion: number;\n  },\n): boolean {\n  const { afterVersion } = expected;\n  const lastVersion = afterVersion + page.previousStates.length;\n  return (\n    page.currentState.principalType === expected.principalType &&\n    page.currentState.principalId === expected.principalId &&\n    (expected.stateHash === undefined ||\n      page.currentState.stateHash === expected.stateHash) &&\n    (expected.pinnedBytes === undefined ||\n      expected.bytes === expected.pinnedBytes) &&\n    page.historyPage.afterVersion === afterVersion &&\n    lastVersion < page.currentState.version &&\n    page.previousStates.every(\n      ({ state }, index) =>\n        state.version === afterVersion + index + 1 &&\n        state.principalId === expected.principalId &&\n        state.principalType === expected.principalType,\n    ) &&\n    (page.historyPage.nextAfterVersion === null\n      ? lastVersion === page.currentState.version - 1\n      : lastVersion > afterVersion &&\n        lastVersion < page.currentState.version - 1 &&\n        page.historyPage.nextAfterVersion === lastVersion)\n  );\n}\n\nfunction preparePrincipalPolicyRead(\n  runtime: ApiRequestRuntime,\n  principalType: \"group\" | \"organization\",\n  principalId: string,\n  options: PrincipalPolicyPageReadOptions,\n) {\n  const query =\n    options.stateHash === undefined\n      ? {}\n      : {\n          afterVersion: options.afterVersion ?? 0,\n          stateHash: options.stateHash,\n        };\n  const basePath = getPrincipalPolicy.path(principalType, principalId);\n  const failure = (message: string) => ({\n    ok: false as const,\n    failure: pageFailure(runtime, basePath, options, message, null),\n  });\n  if (\n    options.afterVersion !== undefined &&\n    (options.stateHash === undefined ||\n      options.resume !== undefined ||\n      !Number.isSafeInteger(options.afterVersion))\n  )\n    return failure(\"Initial principal history cursor requires one exact head\");\n  if (!getPrincipalPolicyOperation.query.safeParse(query).success)\n    return failure(\"Invalid requested principal history head\");\n  const resume = readResume(options.resume);\n  if (\n    options.resume !== undefined &&\n    (!resume ||\n      !validResume(principalType, principalId, resume, options.stateHash))\n  )\n    return failure(\"Invalid saved principal history position\");\n  return {\n    ok: true as const,\n    firstPath: getPrincipalPolicy.path(principalType, principalId, query),\n    afterVersion: options.afterVersion ?? 0,\n    resume,\n  };\n}\n\n/** Pull one page at a time; the caller owns verification and durable admission. */\nexport async function* readPrincipalPolicyPages(\n  runtime: ApiRequestRuntime,\n  principalType: \"group\" | \"organization\",\n  principalId: string,\n  options: PrincipalPolicyPageReadOptions,\n): AsyncGenerator<RequestResult<PrincipalPolicyPageResponse>, void> {\n  const position = preparePrincipalPolicyRead(\n    runtime,\n    principalType,\n    principalId,\n    options,\n  );\n  if (!position.ok) {\n    yield position.failure;\n    return;\n  }\n  const { firstPath, resume } = position;\n  const context = new PrincipalHistoryRequestContext(\n    runtime,\n    \"GET\",\n    firstPath,\n    options,\n  );\n  let pinned = resume?.current;\n  let pinnedBytes = resume?.bytes;\n  let afterVersion = resume?.afterVersion ?? position.afterVersion;\n  while (true) {\n    const path = pinned\n      ? getPrincipalPolicy.path(principalType, principalId, {\n          afterVersion,\n          stateHash: pinned.currentState.stateHash,\n        })\n      : firstPath;\n    const result = await principalHistoryRequest(runtime, {\n      path,\n      validator: isPrincipalPolicyPageResponse,\n      method: \"GET\",\n      operation: getPrincipalPolicyOperation,\n      options,\n      context,\n    });\n    if (!result.ok) {\n      yield result;\n      return;\n    }\n    const page = result.data;\n    const artifacts = currentArtifacts(page);\n    const bytes = serializeKeyingCanonicalJson(artifacts);\n    const valid = validPage(page, {\n      principalType,\n      principalId,\n      stateHash: options.stateHash,\n      pinnedBytes,\n      bytes,\n      afterVersion,\n    });\n    if (!valid) {\n      yield pageFailure(\n        runtime,\n        path,\n        options,\n        \"Principal history page changed its head, order, or cursor\",\n        200,\n      );\n      return;\n    }\n    pinned ??= structuredClone(artifacts);\n    pinnedBytes ??= bytes;\n    context.afterReadPage();\n    const nextAfterVersion = page.historyPage.nextAfterVersion;\n    yield result;\n    // A page consumer may await verification or storage while its session ends.\n    if (context.cancelled()) {\n      yield context.failure();\n      return;\n    }\n    if (nextAfterVersion === null) return;\n    afterVersion = nextAfterVersion;\n  }\n}\n\n/** A head the caller already holds and has authenticated. */\nexport interface PrincipalPolicyHeldHead {\n  readonly version: number;\n  readonly stateHash: string;\n}\n\nexport interface PrincipalPolicyDiscoveryOptions extends RequestResultOptions {\n  readonly ifHead?: PrincipalPolicyHeldHead | undefined;\n}\n\n/**\n * One unpinned discovery read. With `ifHead`, a server whose live head is\n * exactly that head answers `{ unchanged, head }` instead of the first page.\n * The reply is untrusted: the caller must check the head is the one it holds.\n */\nexport async function readPrincipalPolicyDiscovery(\n  runtime: ApiRequestRuntime,\n  principalType: \"group\" | \"organization\",\n  principalId: string,\n  options: PrincipalPolicyDiscoveryOptions,\n): Promise<RequestResult<PrincipalPolicyReadResponse>> {\n  const { ifHead, ...requestOptions } = options;\n  const query = ifHead\n    ? { ifVersion: ifHead.version, ifStateHash: ifHead.stateHash }\n    : {};\n  if (!getPrincipalPolicyOperation.query.safeParse(query).success)\n    return pageFailure(\n      runtime,\n      getPrincipalPolicy.path(principalType, principalId),\n      requestOptions,\n      \"Invalid held principal history head\",\n      null,\n    );\n  const path = getPrincipalPolicy.path(principalType, principalId, query);\n  const result = await principalHistoryRequest(runtime, {\n    path,\n    validator: getPrincipalPolicy.isResponse,\n    method: \"GET\",\n    operation: getPrincipalPolicyOperation,\n    options: requestOptions,\n  });\n  if (!result.ok) return result;\n  const response = result.data;\n  // Exactly one variant: the strict bare-head reply, only to a conditional\n  // read and only for the requested principal, or a valid first page.\n  const unchanged = isPrincipalPolicyUnchangedResponse(response);\n  const page = isPrincipalPolicyPageResponse(response);\n  const valid = unchanged\n    ? !page &&\n      ifHead !== undefined &&\n      response.head.principalType === principalType &&\n      response.head.principalId === principalId\n    : page &&\n      validPage(response, {\n        principalType,\n        principalId,\n        stateHash: undefined,\n        pinnedBytes: undefined,\n        bytes: \"\",\n        afterVersion: 0,\n      });\n  return valid\n    ? result\n    : pageFailure(\n        runtime,\n        path,\n        requestOptions,\n        \"Principal discovery reply does not match its request\",\n        200,\n      );\n}\n\n/** Full-bundle adapter for consumers that have not adopted durable staging. */\nexport async function collectPrincipalPolicyPages(\n  runtime: ApiRequestRuntime,\n  principalType: \"group\" | \"organization\",\n  principalId: string,\n  options: RequestResultOptions,\n): Promise<PrincipalPolicyBundleResponse | null> {\n  let current: PrincipalPolicyPageCurrent | undefined;\n  const previousStates: PrincipalPolicyBundleResponse[\"previousStates\"] = [];\n  for await (const result of readPrincipalPolicyPages(\n    runtime,\n    principalType,\n    principalId,\n    options,\n  )) {\n    if (!result.ok) return null;\n    current ??= currentArtifacts(result.data);\n    previousStates.push(...result.data.previousStates);\n  }\n  return current ? { ...current, previousStates } : null;\n}\n\nfunction pageFailure(\n  runtime: ApiRequestRuntime,\n  path: string,\n  options: RequestResultOptions,\n  message: string,\n  status: number | null,\n) {\n  return runtime.responseRequest.reportFailure({\n    kind: \"shape\",\n    message,\n    method: \"GET\",\n    options,\n    path,\n    status,\n    statusText: \"\",\n  });\n}\n"]}

package/internal/api-client/principalPolicyRequests.d.ts

@@ -2,7 +2,7 @@ import type { CommitOrganizationGroupPolicyRequest, CreateOrganizationGroupWithP
 import type { PrincipalPolicyBundleResponse } from "../validators/response/index.js";
 import type { BoundedCache } from "./ApiCache.js";
 import type { ApiRequestRuntime } from "./apiRequestRuntime.js";
-import { type PrincipalPolicyPageReadOptions } from "./principalPolicyPages.js";
+import { type PrincipalPolicyDiscoveryOptions, type PrincipalPolicyPageReadOptions } from "./principalPolicyPages.js";
 import { readProjectionPolicyHistoryPages } from "./projectionPolicyHistoryPages.js";
 import type { RequestResultOptions } from "./types.js";
 export declare class PrincipalPolicyRequests {
@@ -203,6 +203,123 @@ export declare class PrincipalPolicyRequests {
             version: number;
         };
     }>, void, any>;
+    discover(principalType: "group" | "organization", principalId: string, options?: PrincipalPolicyDiscoveryOptions): Promise<import("./types.js").RequestResult<{
+        previousStates: {
+            grants: {
+                accessLevel: "admin" | "read" | "write";
+                containerId: string;
+            }[];
+            projection: {
+                role: "member" | "admin";
+                userId: string;
+            }[];
+            state: {
+                createdAt: string;
+                encapsulationPublicKey: string;
+                externalAuthority: {
+                    keyEpoch: number;
+                    keyFingerprint: string;
+                    principalId: string;
+                    principalType: "group";
+                    stateHash: string;
+                    version: number;
+                } | null;
+                grantCount: number;
+                grantRoot: string;
+                keyEpoch: number;
+                keyFingerprint: string;
+                memberCount: number;
+                memberEnvelopesRoot: string;
+                membershipMode: "projection";
+                membershipRoot: string;
+                payloadCiphertextHash: string;
+                prevStateHash: string | null;
+                principalId: string;
+                principalType: "group" | "organization";
+                projectionRoot: string;
+                signature: string;
+                signedAt: string;
+                signerUserId: string;
+                signerUserKeyFingerprint: string;
+                stateHash: string;
+                version: number;
+            };
+        }[];
+        historyPage: {
+            afterVersion: number;
+            nextAfterVersion: number | null;
+        };
+        currentGrants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        currentMemberEnvelopes: {
+            envelopes: {
+                kemCipherText: string;
+                memberKeyFingerprint: string;
+                userId: string;
+                wrappedKey: string;
+            }[];
+            epoch: number;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+            createdAt: string;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentProjection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        currentState: {
+            createdAt: string;
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            stateHash: string;
+            version: number;
+        };
+    } | {
+        unchanged: true;
+        head: {
+            keyEpoch: number;
+            keyFingerprint: string;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+            version: number;
+        };
+    }>>;
     get(principalType: "group" | "organization", principalId: string, options?: RequestResultOptions): Promise<{
         previousStates: {
             grants: {

package/internal/api-client/principalPolicyRequests.js

@@ -1,6 +1,6 @@
 import { commitOrganizationGroupPolicyOperation, createOrganizationGroupOperation, deleteOrganizationGroupOperation, putPrincipalPolicyOperation, } from "../validators/operation/index.js";
 import { principalHistoryRequest } from "./principalHistoryRequest.js";
-import { collectPrincipalPolicyPages, readPrincipalPolicyPages, } from "./principalPolicyPages.js";
+import { collectPrincipalPolicyPages, readPrincipalPolicyDiscovery, readPrincipalPolicyPages, } from "./principalPolicyPages.js";
 import { readProjectionPolicyHistoryPages } from "./projectionPolicyHistoryPages.js";
 import { dedupedRequest } from "./requestInternals.js";
 import { createOrganizationGroup } from "./routes/organizations/createGroup.js";
@@ -21,6 +21,9 @@ export class PrincipalPolicyRequests {
     pages(principalType, principalId, options = {}) {
         return readPrincipalPolicyPages(this.runtime, principalType, principalId, options);
     }
+    discover(principalType, principalId, options = {}) {
+        return readPrincipalPolicyDiscovery(this.runtime, principalType, principalId, options);
+    }
     get(principalType, principalId, options = {}) {
         const request = () => collectPrincipalPolicyPages(this.runtime, principalType, principalId, options);
         const key = JSON.stringify([principalType, principalId]);

package/internal/api-client/principalPolicyRequests.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalPolicyRequests.js","sourceRoot":"","sources":["principalPolicyRequests.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sCAAsC,EACtC,gCAAgC,EAChC,gCAAgC,EAChC,2BAA2B,GAC5B,MAAM,iCAAiC,CAAC;AAUzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EACL,2BAA2B,EAE3B,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EACL,6BAA6B,EAC7B,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AAGpC,MAAM,OAAO,uBAAuB;IAEf;IACA;IAGA;IALnB,YACmB,OAA0B,EAC1B,KAEhB,EACgB,2BAAuC;QAJvC,YAAO,GAAP,OAAO,CAAmB;QAC1B,UAAK,GAAL,KAAK,CAErB;QACgB,gCAA2B,GAA3B,2BAA2B,CAAY;IACvD,CAAC;IAEJ,WAAW,CACT,MAA8D,EAC9D,UAAkE,EAAE;QAEpE,OAAO,gCAAgC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CACH,aAAuC,EACvC,WAAmB,EACnB,UAA0C,EAAE;QAE5C,OAAO,wBAAwB,CAC7B,IAAI,CAAC,OAAO,EACZ,aAAa,EACb,WAAW,EACX,OAAO,CACR,CAAC;IACJ,CAAC;IAED,GAAG,CACD,aAAuC,EACvC,WAAmB,EACnB,UAAgC,EAAE;QAElC,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,2BAA2B,CACzB,IAAI,CAAC,OAAO,EACZ,aAAa,EACb,WAAW,EACX,OAAO,CACR,CAAC;QACJ,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;QACzD,0EAA0E;QAC1E,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;YACpC,CAAC,CAAC,OAAO,EAAE;YACX,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED,GAAG,CAAC,GAAG,IAAsD;QAC3D,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAC7C,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAC/B,CAAC;IACJ,CAAC;IAED,SAAS,CACP,aAA6B,EAC7B,WAAmB,EACnB,KAAyC,EACzC,UAAgC,EAAE;QAElC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE;YAC3C,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC;YACzD,SAAS,EAAE,kBAAkB,CAAC,UAAU;YACxC,MAAM,EAAE,kBAAkB,CAAC,MAAM;YACjC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAC3B,OAAO,EAAE;gBACP,qCAAqC,EAAE,WAAW;gBAClD,GAAG,OAAO;aACX;YACD,SAAS,EAAE,2BAA2B;SACvC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,YAAY,CACV,cAAsB,EACtB,KAA+C,EAC/C,UAAgC,EAAE;QAElC,OAAO,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CAC5D,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE;YACpC,IAAI,EAAE,uBAAuB,CAAC,IAAI,CAAC,cAAc,CAAC;YAClD,SAAS,EAAE,uBAAuB,CAAC,UAAU;YAC7C,MAAM,EAAE,uBAAuB,CAAC,MAAM;YACtC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAC3B,OAAO,EAAE;gBACP,qCAAqC,EAAE,cAAc;gBACrD,GAAG,OAAO;aACX;YACD,SAAS,EAAE,gCAAgC;SAC5C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,YAAY,CACV,cAAsB,EACtB,OAAe,EACf,KAAqC,EACrC,UAAgC,EAAE;QAElC,OAAO,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CACtD,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE;YACpC,IAAI,EAAE,uBAAuB,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC;YAC3D,SAAS,EAAE,uBAAuB,CAAC,UAAU;YAC7C,MAAM,EAAE,uBAAuB,CAAC,MAAM;YACtC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAC3B,OAAO,EAAE;gBACP,qCAAqC,EAAE,cAAc;gBACrD,GAAG,OAAO;aACX;YACD,SAAS,EAAE,gCAAgC;SAC5C,CAAC,CACH,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,cAAsB,EACtB,OAAe,EACf,OAAyB;QAEzB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACpD,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,EAAE,CAAC;QACzB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YACnC,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACrC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,cAAsB,EACtB,OAAe,EACf,KAA2C,EAC3C,UAAgC,EAAE;QAElC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACpD,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,MAAM,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE;gBACjD,IAAI,EAAE,6BAA6B,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC;gBACjE,SAAS,EAAE,6BAA6B,CAAC,UAAU;gBACnD,MAAM,EAAE,6BAA6B,CAAC,MAAM;gBAC5C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;gBAC3B,OAAO,EAAE;oBACP,qCAAqC,EAAE,cAAc;oBACrD,GAAG,OAAO;iBACX;gBACD,SAAS,EAAE,sCAAsC;aAClD,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YACnC,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACrC,CAAC;IACH,CAAC;CACF","sourcesContent":["import {\n  commitOrganizationGroupPolicyOperation,\n  createOrganizationGroupOperation,\n  deleteOrganizationGroupOperation,\n  putPrincipalPolicyOperation,\n} from \"@tearleads/validators/operation\";\nimport type {\n  CommitOrganizationGroupPolicyRequest,\n  CreateOrganizationGroupWithPolicyRequest,\n  DeleteOrganizationGroupRequest,\n  OrganizationPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport type { BoundedCache } from \"./ApiCache\";\nimport type { ApiRequestRuntime } from \"./apiRequestRuntime\";\nimport { principalHistoryRequest } from \"./principalHistoryRequest\";\nimport {\n  collectPrincipalPolicyPages,\n  type PrincipalPolicyPageReadOptions,\n  readPrincipalPolicyPages,\n} from \"./principalPolicyPages\";\nimport { readProjectionPolicyHistoryPages } from \"./projectionPolicyHistoryPages\";\nimport { dedupedRequest } from \"./requestInternals\";\nimport { createOrganizationGroup } from \"./routes/organizations/createGroup\";\nimport { deleteOrganizationGroup } from \"./routes/organizations/deleteGroup\";\nimport {\n  commitOrganizationGroupPolicy,\n  putPrincipalPolicy,\n} from \"./routes/principals/policy\";\nimport type { RequestResultOptions } from \"./types\";\n\nexport class PrincipalPolicyRequests {\n  constructor(\n    private readonly runtime: ApiRequestRuntime,\n    private readonly cache: BoundedCache<\n      Promise<PrincipalPolicyBundleResponse | null>\n    >,\n    private readonly clearWriterProjectionCaches: () => void,\n  ) {}\n\n  publicPages(\n    source: Parameters<typeof readProjectionPolicyHistoryPages>[1],\n    options: Parameters<typeof readProjectionPolicyHistoryPages>[2] = {},\n  ) {\n    return readProjectionPolicyHistoryPages(this.runtime, source, options);\n  }\n\n  pages(\n    principalType: \"group\" | \"organization\",\n    principalId: string,\n    options: PrincipalPolicyPageReadOptions = {},\n  ) {\n    return readPrincipalPolicyPages(\n      this.runtime,\n      principalType,\n      principalId,\n      options,\n    );\n  }\n\n  get(\n    principalType: \"group\" | \"organization\",\n    principalId: string,\n    options: RequestResultOptions = {},\n  ) {\n    const request = () =>\n      collectPrincipalPolicyPages(\n        this.runtime,\n        principalType,\n        principalId,\n        options,\n      );\n    const key = JSON.stringify([principalType, principalId]);\n    // Cancellation, reporting and renewal preferences belong to their caller.\n    return Object.keys(options).length > 0\n      ? request()\n      : dedupedRequest(this.cache, key, request);\n  }\n\n  put(...args: Parameters<PrincipalPolicyRequests[\"putResult\"]>) {\n    return this.putResult(...args).then((result) =>\n      result.ok ? result.data : null,\n    );\n  }\n\n  putResult(\n    principalType: \"organization\",\n    principalId: string,\n    input: OrganizationPrincipalPolicyRequest,\n    options: RequestResultOptions = {},\n  ) {\n    const key = JSON.stringify([principalType, principalId]);\n    this.cache.delete(key);\n    return principalHistoryRequest(this.runtime, {\n      path: putPrincipalPolicy.path(principalType, principalId),\n      validator: putPrincipalPolicy.isResponse,\n      method: putPrincipalPolicy.method,\n      body: JSON.stringify(input),\n      options: {\n        expectedPaymentRequiredOrganizationId: principalId,\n        ...options,\n      },\n      operation: putPrincipalPolicyOperation,\n    }).finally(() => this.cache.delete(key));\n  }\n\n  createResult(\n    organizationId: string,\n    input: CreateOrganizationGroupWithPolicyRequest,\n    options: RequestResultOptions = {},\n  ) {\n    return this.groupMutation(organizationId, input.groupId, () =>\n      principalHistoryRequest(this.runtime, {\n        path: createOrganizationGroup.path(organizationId),\n        validator: createOrganizationGroup.isResponse,\n        method: createOrganizationGroup.method,\n        body: JSON.stringify(input),\n        options: {\n          expectedPaymentRequiredOrganizationId: organizationId,\n          ...options,\n        },\n        operation: createOrganizationGroupOperation,\n      }),\n    );\n  }\n\n  deleteResult(\n    organizationId: string,\n    groupId: string,\n    input: DeleteOrganizationGroupRequest,\n    options: RequestResultOptions = {},\n  ) {\n    return this.groupMutation(organizationId, groupId, () =>\n      principalHistoryRequest(this.runtime, {\n        path: deleteOrganizationGroup.path(organizationId, groupId),\n        validator: deleteOrganizationGroup.isResponse,\n        method: deleteOrganizationGroup.method,\n        body: JSON.stringify(input),\n        options: {\n          expectedPaymentRequiredOrganizationId: organizationId,\n          ...options,\n        },\n        operation: deleteOrganizationGroupOperation,\n      }),\n    );\n  }\n\n  private async groupMutation<T>(\n    organizationId: string,\n    groupId: string,\n    request: () => Promise<T>,\n  ): Promise<T> {\n    const groupKey = JSON.stringify([\"group\", groupId]);\n    const organizationKey = JSON.stringify([\"organization\", organizationId]);\n    this.cache.delete(groupKey);\n    this.cache.delete(organizationKey);\n    try {\n      return await request();\n    } finally {\n      this.cache.delete(groupKey);\n      this.cache.delete(organizationKey);\n      this.clearWriterProjectionCaches();\n    }\n  }\n\n  async commitResult(\n    organizationId: string,\n    groupId: string,\n    input: CommitOrganizationGroupPolicyRequest,\n    options: RequestResultOptions = {},\n  ) {\n    const groupKey = JSON.stringify([\"group\", groupId]);\n    const organizationKey = JSON.stringify([\"organization\", organizationId]);\n    this.cache.delete(groupKey);\n    this.cache.delete(organizationKey);\n    try {\n      return await principalHistoryRequest(this.runtime, {\n        path: commitOrganizationGroupPolicy.path(organizationId, groupId),\n        validator: commitOrganizationGroupPolicy.isResponse,\n        method: commitOrganizationGroupPolicy.method,\n        body: JSON.stringify(input),\n        options: {\n          expectedPaymentRequiredOrganizationId: organizationId,\n          ...options,\n        },\n        operation: commitOrganizationGroupPolicyOperation,\n      });\n    } finally {\n      this.cache.delete(groupKey);\n      this.cache.delete(organizationKey);\n      this.clearWriterProjectionCaches();\n    }\n  }\n}\n"]}
+{"version":3,"file":"principalPolicyRequests.js","sourceRoot":"","sources":["principalPolicyRequests.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sCAAsC,EACtC,gCAAgC,EAChC,gCAAgC,EAChC,2BAA2B,GAC5B,MAAM,iCAAiC,CAAC;AAUzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EACL,2BAA2B,EAG3B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EACL,6BAA6B,EAC7B,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AAGpC,MAAM,OAAO,uBAAuB;IAEf;IACA;IAGA;IALnB,YACmB,OAA0B,EAC1B,KAEhB,EACgB,2BAAuC;QAJvC,YAAO,GAAP,OAAO,CAAmB;QAC1B,UAAK,GAAL,KAAK,CAErB;QACgB,gCAA2B,GAA3B,2BAA2B,CAAY;IACvD,CAAC;IAEJ,WAAW,CACT,MAA8D,EAC9D,UAAkE,EAAE;QAEpE,OAAO,gCAAgC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CACH,aAAuC,EACvC,WAAmB,EACnB,UAA0C,EAAE;QAE5C,OAAO,wBAAwB,CAC7B,IAAI,CAAC,OAAO,EACZ,aAAa,EACb,WAAW,EACX,OAAO,CACR,CAAC;IACJ,CAAC;IAED,QAAQ,CACN,aAAuC,EACvC,WAAmB,EACnB,UAA2C,EAAE;QAE7C,OAAO,4BAA4B,CACjC,IAAI,CAAC,OAAO,EACZ,aAAa,EACb,WAAW,EACX,OAAO,CACR,CAAC;IACJ,CAAC;IAED,GAAG,CACD,aAAuC,EACvC,WAAmB,EACnB,UAAgC,EAAE;QAElC,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,2BAA2B,CACzB,IAAI,CAAC,OAAO,EACZ,aAAa,EACb,WAAW,EACX,OAAO,CACR,CAAC;QACJ,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;QACzD,0EAA0E;QAC1E,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;YACpC,CAAC,CAAC,OAAO,EAAE;YACX,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED,GAAG,CAAC,GAAG,IAAsD;QAC3D,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAC7C,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAC/B,CAAC;IACJ,CAAC;IAED,SAAS,CACP,aAA6B,EAC7B,WAAmB,EACnB,KAAyC,EACzC,UAAgC,EAAE;QAElC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE;YAC3C,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC;YACzD,SAAS,EAAE,kBAAkB,CAAC,UAAU;YACxC,MAAM,EAAE,kBAAkB,CAAC,MAAM;YACjC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAC3B,OAAO,EAAE;gBACP,qCAAqC,EAAE,WAAW;gBAClD,GAAG,OAAO;aACX;YACD,SAAS,EAAE,2BAA2B;SACvC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,YAAY,CACV,cAAsB,EACtB,KAA+C,EAC/C,UAAgC,EAAE;QAElC,OAAO,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CAC5D,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE;YACpC,IAAI,EAAE,uBAAuB,CAAC,IAAI,CAAC,cAAc,CAAC;YAClD,SAAS,EAAE,uBAAuB,CAAC,UAAU;YAC7C,MAAM,EAAE,uBAAuB,CAAC,MAAM;YACtC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAC3B,OAAO,EAAE;gBACP,qCAAqC,EAAE,cAAc;gBACrD,GAAG,OAAO;aACX;YACD,SAAS,EAAE,gCAAgC;SAC5C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,YAAY,CACV,cAAsB,EACtB,OAAe,EACf,KAAqC,EACrC,UAAgC,EAAE;QAElC,OAAO,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CACtD,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE;YACpC,IAAI,EAAE,uBAAuB,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC;YAC3D,SAAS,EAAE,uBAAuB,CAAC,UAAU;YAC7C,MAAM,EAAE,uBAAuB,CAAC,MAAM;YACtC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAC3B,OAAO,EAAE;gBACP,qCAAqC,EAAE,cAAc;gBACrD,GAAG,OAAO;aACX;YACD,SAAS,EAAE,gCAAgC;SAC5C,CAAC,CACH,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,cAAsB,EACtB,OAAe,EACf,OAAyB;QAEzB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACpD,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,EAAE,CAAC;QACzB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YACnC,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACrC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,cAAsB,EACtB,OAAe,EACf,KAA2C,EAC3C,UAAgC,EAAE;QAElC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACpD,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,MAAM,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE;gBACjD,IAAI,EAAE,6BAA6B,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC;gBACjE,SAAS,EAAE,6BAA6B,CAAC,UAAU;gBACnD,MAAM,EAAE,6BAA6B,CAAC,MAAM;gBAC5C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;gBAC3B,OAAO,EAAE;oBACP,qCAAqC,EAAE,cAAc;oBACrD,GAAG,OAAO;iBACX;gBACD,SAAS,EAAE,sCAAsC;aAClD,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YACnC,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACrC,CAAC;IACH,CAAC;CACF","sourcesContent":["import {\n  commitOrganizationGroupPolicyOperation,\n  createOrganizationGroupOperation,\n  deleteOrganizationGroupOperation,\n  putPrincipalPolicyOperation,\n} from \"@tearleads/validators/operation\";\nimport type {\n  CommitOrganizationGroupPolicyRequest,\n  CreateOrganizationGroupWithPolicyRequest,\n  DeleteOrganizationGroupRequest,\n  OrganizationPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport type { BoundedCache } from \"./ApiCache\";\nimport type { ApiRequestRuntime } from \"./apiRequestRuntime\";\nimport { principalHistoryRequest } from \"./principalHistoryRequest\";\nimport {\n  collectPrincipalPolicyPages,\n  type PrincipalPolicyDiscoveryOptions,\n  type PrincipalPolicyPageReadOptions,\n  readPrincipalPolicyDiscovery,\n  readPrincipalPolicyPages,\n} from \"./principalPolicyPages\";\nimport { readProjectionPolicyHistoryPages } from \"./projectionPolicyHistoryPages\";\nimport { dedupedRequest } from \"./requestInternals\";\nimport { createOrganizationGroup } from \"./routes/organizations/createGroup\";\nimport { deleteOrganizationGroup } from \"./routes/organizations/deleteGroup\";\nimport {\n  commitOrganizationGroupPolicy,\n  putPrincipalPolicy,\n} from \"./routes/principals/policy\";\nimport type { RequestResultOptions } from \"./types\";\n\nexport class PrincipalPolicyRequests {\n  constructor(\n    private readonly runtime: ApiRequestRuntime,\n    private readonly cache: BoundedCache<\n      Promise<PrincipalPolicyBundleResponse | null>\n    >,\n    private readonly clearWriterProjectionCaches: () => void,\n  ) {}\n\n  publicPages(\n    source: Parameters<typeof readProjectionPolicyHistoryPages>[1],\n    options: Parameters<typeof readProjectionPolicyHistoryPages>[2] = {},\n  ) {\n    return readProjectionPolicyHistoryPages(this.runtime, source, options);\n  }\n\n  pages(\n    principalType: \"group\" | \"organization\",\n    principalId: string,\n    options: PrincipalPolicyPageReadOptions = {},\n  ) {\n    return readPrincipalPolicyPages(\n      this.runtime,\n      principalType,\n      principalId,\n      options,\n    );\n  }\n\n  discover(\n    principalType: \"group\" | \"organization\",\n    principalId: string,\n    options: PrincipalPolicyDiscoveryOptions = {},\n  ) {\n    return readPrincipalPolicyDiscovery(\n      this.runtime,\n      principalType,\n      principalId,\n      options,\n    );\n  }\n\n  get(\n    principalType: \"group\" | \"organization\",\n    principalId: string,\n    options: RequestResultOptions = {},\n  ) {\n    const request = () =>\n      collectPrincipalPolicyPages(\n        this.runtime,\n        principalType,\n        principalId,\n        options,\n      );\n    const key = JSON.stringify([principalType, principalId]);\n    // Cancellation, reporting and renewal preferences belong to their caller.\n    return Object.keys(options).length > 0\n      ? request()\n      : dedupedRequest(this.cache, key, request);\n  }\n\n  put(...args: Parameters<PrincipalPolicyRequests[\"putResult\"]>) {\n    return this.putResult(...args).then((result) =>\n      result.ok ? result.data : null,\n    );\n  }\n\n  putResult(\n    principalType: \"organization\",\n    principalId: string,\n    input: OrganizationPrincipalPolicyRequest,\n    options: RequestResultOptions = {},\n  ) {\n    const key = JSON.stringify([principalType, principalId]);\n    this.cache.delete(key);\n    return principalHistoryRequest(this.runtime, {\n      path: putPrincipalPolicy.path(principalType, principalId),\n      validator: putPrincipalPolicy.isResponse,\n      method: putPrincipalPolicy.method,\n      body: JSON.stringify(input),\n      options: {\n        expectedPaymentRequiredOrganizationId: principalId,\n        ...options,\n      },\n      operation: putPrincipalPolicyOperation,\n    }).finally(() => this.cache.delete(key));\n  }\n\n  createResult(\n    organizationId: string,\n    input: CreateOrganizationGroupWithPolicyRequest,\n    options: RequestResultOptions = {},\n  ) {\n    return this.groupMutation(organizationId, input.groupId, () =>\n      principalHistoryRequest(this.runtime, {\n        path: createOrganizationGroup.path(organizationId),\n        validator: createOrganizationGroup.isResponse,\n        method: createOrganizationGroup.method,\n        body: JSON.stringify(input),\n        options: {\n          expectedPaymentRequiredOrganizationId: organizationId,\n          ...options,\n        },\n        operation: createOrganizationGroupOperation,\n      }),\n    );\n  }\n\n  deleteResult(\n    organizationId: string,\n    groupId: string,\n    input: DeleteOrganizationGroupRequest,\n    options: RequestResultOptions = {},\n  ) {\n    return this.groupMutation(organizationId, groupId, () =>\n      principalHistoryRequest(this.runtime, {\n        path: deleteOrganizationGroup.path(organizationId, groupId),\n        validator: deleteOrganizationGroup.isResponse,\n        method: deleteOrganizationGroup.method,\n        body: JSON.stringify(input),\n        options: {\n          expectedPaymentRequiredOrganizationId: organizationId,\n          ...options,\n        },\n        operation: deleteOrganizationGroupOperation,\n      }),\n    );\n  }\n\n  private async groupMutation<T>(\n    organizationId: string,\n    groupId: string,\n    request: () => Promise<T>,\n  ): Promise<T> {\n    const groupKey = JSON.stringify([\"group\", groupId]);\n    const organizationKey = JSON.stringify([\"organization\", organizationId]);\n    this.cache.delete(groupKey);\n    this.cache.delete(organizationKey);\n    try {\n      return await request();\n    } finally {\n      this.cache.delete(groupKey);\n      this.cache.delete(organizationKey);\n      this.clearWriterProjectionCaches();\n    }\n  }\n\n  async commitResult(\n    organizationId: string,\n    groupId: string,\n    input: CommitOrganizationGroupPolicyRequest,\n    options: RequestResultOptions = {},\n  ) {\n    const groupKey = JSON.stringify([\"group\", groupId]);\n    const organizationKey = JSON.stringify([\"organization\", organizationId]);\n    this.cache.delete(groupKey);\n    this.cache.delete(organizationKey);\n    try {\n      return await principalHistoryRequest(this.runtime, {\n        path: commitOrganizationGroupPolicy.path(organizationId, groupId),\n        validator: commitOrganizationGroupPolicy.isResponse,\n        method: commitOrganizationGroupPolicy.method,\n        body: JSON.stringify(input),\n        options: {\n          expectedPaymentRequiredOrganizationId: organizationId,\n          ...options,\n        },\n        operation: commitOrganizationGroupPolicyOperation,\n      });\n    } finally {\n      this.cache.delete(groupKey);\n      this.cache.delete(organizationKey);\n      this.clearWriterProjectionCaches();\n    }\n  }\n}\n"]}

package/internal/validators/operation/principalPolicyPageQuery.d.ts

@@ -1,6 +1,15 @@
 import { z } from "zod";
+/**
+ * `stateHash` and `afterVersion` pin delivery to one exact head. The
+ * `ifVersion` and `ifStateHash` pair makes an unpinned discovery read
+ * conditional: when the live head is exactly that pair, the reply carries the
+ * head alone. The API refuses a partial pair or one combined with a pin, as it
+ * refuses a cursor without a pin.
+ */
 export declare const PrincipalPolicyPageQuerySchema: z.ZodObject<{
     afterVersion: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<number, string | number>>>;
     stateHash: z.ZodOptional<z.ZodCustom<string, string>>;
+    ifVersion: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<number, string | number>>>;
+    ifStateHash: z.ZodOptional<z.ZodCustom<string, string>>;
 }, z.core.$strict>;
 export type PrincipalPolicyPageQuery = z.infer<typeof PrincipalPolicyPageQuerySchema>;

package/internal/validators/operation/principalPolicyPageQuery.js

@@ -13,8 +13,18 @@ const cursorInput = registerJsonSchemaFragment(z.union([z.string(), z.number()])
     return Number.isSafeInteger(parsed) && parsed >= 0;
 }), cursorJsonSchema);
 const afterVersion = registerJsonSchemaFragment(cursorInput.transform(Number), cursorJsonSchema);
+const headVersion = registerJsonSchemaFragment(cursorInput.transform(Number).refine((value) => value >= 1), { ...cursorJsonSchema, minimum: 1 });
+/**
+ * `stateHash` and `afterVersion` pin delivery to one exact head. The
+ * `ifVersion` and `ifStateHash` pair makes an unpinned discovery read
+ * conditional: when the live head is exactly that pair, the reply carries the
+ * head alone. The API refuses a partial pair or one combined with a pin, as it
+ * refuses a cursor without a pin.
+ */
 export const PrincipalPolicyPageQuerySchema = z.strictObject({
     afterVersion: afterVersion.optional(),
     stateHash: sha256HexStringSchema.optional(),
+    ifVersion: headVersion.optional(),
+    ifStateHash: sha256HexStringSchema.optional(),
 });
 //# sourceMappingURL=principalPolicyPageQuery.js.map

package/internal/validators/operation/principalPolicyPageQuery.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalPolicyPageQuery.js","sourceRoot":"","sources":["principalPolicyPageQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAElD,MAAM,gBAAgB,GAAG;IACvB,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,CAAC;IACV,OAAO,EAAE,MAAM,CAAC,gBAAgB;CACxB,CAAC;AACX,MAAM,WAAW,GAAG,0BAA0B,CAC5C,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;QAC/D,OAAO,KAAK,CAAC;IACf,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC;AACrD,CAAC,CAAC,EACF,gBAAgB,CACjB,CAAC;AACF,MAAM,YAAY,GAAG,0BAA0B,CAC7C,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,EAC7B,gBAAgB,CACjB,CAAC;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3D,YAAY,EAAE,YAAY,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { registerJsonSchemaFragment } from \"../jsonSchema\";\nimport { sha256HexStringSchema } from \"../schema\";\n\nconst cursorJsonSchema = {\n  type: \"integer\",\n  minimum: 0,\n  maximum: Number.MAX_SAFE_INTEGER,\n} as const;\nconst cursorInput = registerJsonSchemaFragment(\n  z.union([z.string(), z.number()]).refine((value) => {\n    if (typeof value === \"string\" && !/^(0|[1-9][0-9]*)$/.test(value))\n      return false;\n    const parsed = Number(value);\n    return Number.isSafeInteger(parsed) && parsed >= 0;\n  }),\n  cursorJsonSchema,\n);\nconst afterVersion = registerJsonSchemaFragment(\n  cursorInput.transform(Number),\n  cursorJsonSchema,\n);\n\nexport const PrincipalPolicyPageQuerySchema = z.strictObject({\n  afterVersion: afterVersion.optional(),\n  stateHash: sha256HexStringSchema.optional(),\n});\n\nexport type PrincipalPolicyPageQuery = z.infer<\n  typeof PrincipalPolicyPageQuerySchema\n>;\n"]}
+{"version":3,"file":"principalPolicyPageQuery.js","sourceRoot":"","sources":["principalPolicyPageQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAElD,MAAM,gBAAgB,GAAG;IACvB,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,CAAC;IACV,OAAO,EAAE,MAAM,CAAC,gBAAgB;CACxB,CAAC;AACX,MAAM,WAAW,GAAG,0BAA0B,CAC5C,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;QAC/D,OAAO,KAAK,CAAC;IACf,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC;AACrD,CAAC,CAAC,EACF,gBAAgB,CACjB,CAAC;AACF,MAAM,YAAY,GAAG,0BAA0B,CAC7C,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,EAC7B,gBAAgB,CACjB,CAAC;AAEF,MAAM,WAAW,GAAG,0BAA0B,CAC5C,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,EAC3D,EAAE,GAAG,gBAAgB,EAAE,OAAO,EAAE,CAAC,EAAE,CACpC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3D,YAAY,EAAE,YAAY,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,WAAW,CAAC,QAAQ,EAAE;IACjC,WAAW,EAAE,qBAAqB,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { registerJsonSchemaFragment } from \"../jsonSchema\";\nimport { sha256HexStringSchema } from \"../schema\";\n\nconst cursorJsonSchema = {\n  type: \"integer\",\n  minimum: 0,\n  maximum: Number.MAX_SAFE_INTEGER,\n} as const;\nconst cursorInput = registerJsonSchemaFragment(\n  z.union([z.string(), z.number()]).refine((value) => {\n    if (typeof value === \"string\" && !/^(0|[1-9][0-9]*)$/.test(value))\n      return false;\n    const parsed = Number(value);\n    return Number.isSafeInteger(parsed) && parsed >= 0;\n  }),\n  cursorJsonSchema,\n);\nconst afterVersion = registerJsonSchemaFragment(\n  cursorInput.transform(Number),\n  cursorJsonSchema,\n);\n\nconst headVersion = registerJsonSchemaFragment(\n  cursorInput.transform(Number).refine((value) => value >= 1),\n  { ...cursorJsonSchema, minimum: 1 },\n);\n\n/**\n * `stateHash` and `afterVersion` pin delivery to one exact head. The\n * `ifVersion` and `ifStateHash` pair makes an unpinned discovery read\n * conditional: when the live head is exactly that pair, the reply carries the\n * head alone. The API refuses a partial pair or one combined with a pin, as it\n * refuses a cursor without a pin.\n */\nexport const PrincipalPolicyPageQuerySchema = z.strictObject({\n  afterVersion: afterVersion.optional(),\n  stateHash: sha256HexStringSchema.optional(),\n  ifVersion: headVersion.optional(),\n  ifStateHash: sha256HexStringSchema.optional(),\n});\n\nexport type PrincipalPolicyPageQuery = z.infer<\n  typeof PrincipalPolicyPageQuerySchema\n>;\n"]}

package/internal/validators/operation/principals.d.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { isCommitOrganizationGroupPolicyRequest, isOrganizationPrincipalPolicyRequest } from "../request/index.js";
-import { ErrorResponseSchema, isCommitOrganizationGroupPolicyResponse, isPrincipalPolicyMutationResponse, isPrincipalPolicyPageResponse } from "../response/index.js";
+import { ErrorResponseSchema, isCommitOrganizationGroupPolicyResponse, isPrincipalPolicyMutationResponse, type PrincipalPolicyReadResponse } from "../response/index.js";
 export declare const PrincipalPolicyPathParamsSchema: z.ZodObject<{
     principalType: z.ZodLiteral<"group" | "organization">;
     principalId: z.ZodCustom<string, string>;
@@ -75,12 +75,14 @@ export declare const getPrincipalPolicyOperation: Omit<{
     readonly query: z.ZodObject<{
         afterVersion: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<number, string | number>>>;
         stateHash: z.ZodOptional<z.ZodCustom<string, string>>;
+        ifVersion: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<number, string | number>>>;
+        ifStateHash: z.ZodOptional<z.ZodCustom<string, string>>;
     }, z.core.$strict>;
     readonly responseDescriptions: {
         readonly 202: "The attempted operation rolled back. Retry the identical request to continue verification preparation.";
     };
     readonly responses: {
-        readonly 200: z.ZodType<{
+        readonly 200: z.ZodUnion<readonly [z.ZodType<{
             previousStates: {
                 grants: {
                     accessLevel: "admin" | "read" | "write";
@@ -504,7 +506,38 @@ export declare const getPrincipalPolicyOperation: Omit<{
                 stateHash: string;
                 version: number;
             };
-        }>>;
+        }>>, z.ZodObject<{
+            unchanged: z.ZodLiteral<true>;
+            head: z.ZodType<{
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group" | "organization";
+                stateHash: string;
+                version: number;
+            }, {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group" | "organization";
+                stateHash: string;
+                version: number;
+            }, z.core.$ZodTypeInternals<{
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group" | "organization";
+                stateHash: string;
+                version: number;
+            }, {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group" | "organization";
+                stateHash: string;
+                version: number;
+            }>>;
+        }, z.core.$strict>]>;
         readonly 202: z.ZodObject<{
             code: z.ZodLiteral<"principal_history_preparation_pending">;
             committed: z.ZodLiteral<false>;
@@ -4493,6 +4526,6 @@ export declare const commitOrganizationGroupPolicyOperation: Omit<{
 };
 export declare const isCommitOrganizationGroupPolicyOperationRequest: typeof isCommitOrganizationGroupPolicyRequest;
 export declare const isCommitOrganizationGroupPolicyOperationResponse: typeof isCommitOrganizationGroupPolicyResponse;
-export declare const isGetPrincipalPolicyOperationResponse: typeof isPrincipalPolicyPageResponse;
+export declare function isGetPrincipalPolicyOperationResponse(value: unknown): value is PrincipalPolicyReadResponse;
 export declare const isPutPrincipalPolicyOperationRequest: typeof isOrganizationPrincipalPolicyRequest;
 export declare const isPutPrincipalPolicyOperationResponse: typeof isPrincipalPolicyMutationResponse;

package/internal/validators/operation/principals.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { organizationProvisioningContainerKeyringRefinement } from "../organizationProvisioningRefinements.js";
 import { CommitOrganizationGroupPolicyRequestSchema, isCommitOrganizationGroupPolicyRequest, isOrganizationPrincipalPolicyRequest, OrganizationPrincipalPolicyRequestSchema, } from "../request/index.js";
-import { CommitOrganizationGroupPolicyConflictResponseSchema, CommitOrganizationGroupPolicyResponseSchema, ErrorResponseSchema, isCommitOrganizationGroupPolicyResponse, isPrincipalPolicyMutationResponse, isPrincipalPolicyPageResponse, PaymentRequiredErrorResponseSchema, PrincipalPolicyErrorResponseSchema, PrincipalPolicyMutationResponseSchema, PrincipalPolicyPageResponseSchema, SessionFailureResponseSchema, } from "../response/index.js";
+import { CommitOrganizationGroupPolicyConflictResponseSchema, CommitOrganizationGroupPolicyResponseSchema, ErrorResponseSchema, isCommitOrganizationGroupPolicyResponse, isPrincipalPolicyMutationResponse, PaymentRequiredErrorResponseSchema, PrincipalPolicyErrorResponseSchema, PrincipalPolicyMutationResponseSchema, PrincipalPolicyReadResponseSchema, SessionFailureResponseSchema, } from "../response/index.js";
 import { PrincipalHistoryPreparationFailureResponseSchema, PrincipalHistoryPreparationResponseSchema, principalHistoryRollbackRefinement, } from "../response/principalHistoryPreparation.js";
 import { uuidV4StringSchema } from "../schema.js";
 import { defineJsonOperation } from "./definition.js";
@@ -34,7 +34,7 @@ export const getPrincipalPolicyOperation = defineJsonOperation({
     query: PrincipalPolicyPageQuerySchema,
     responseDescriptions: preparationResponseDescriptions,
     responses: {
-        200: PrincipalPolicyPageResponseSchema,
+        200: PrincipalPolicyReadResponseSchema,
         202: PrincipalHistoryPreparationResponseSchema,
     },
 });
@@ -96,7 +96,9 @@ export const commitOrganizationGroupPolicyOperation = defineJsonOperation({
 });
 export const isCommitOrganizationGroupPolicyOperationRequest = isCommitOrganizationGroupPolicyRequest;
 export const isCommitOrganizationGroupPolicyOperationResponse = isCommitOrganizationGroupPolicyResponse;
-export const isGetPrincipalPolicyOperationResponse = isPrincipalPolicyPageResponse;
+export function isGetPrincipalPolicyOperationResponse(value) {
+    return PrincipalPolicyReadResponseSchema.safeParse(value).success;
+}
 export const isPutPrincipalPolicyOperationRequest = isOrganizationPrincipalPolicyRequest;
 export const isPutPrincipalPolicyOperationResponse = isPrincipalPolicyMutationResponse;
 //# sourceMappingURL=principals.js.map

package/internal/validators/operation/principals.js.map

@@ -1 +1 @@
-{"version":3,"file":"principals.js","sourceRoot":"","sources":["principals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kDAAkD,EAAE,MAAM,wCAAwC,CAAC;AAC5G,OAAO,EACL,0CAA0C,EAC1C,sCAAsC,EACtC,oCAAoC,EACpC,wCAAwC,GACzC,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,mDAAmD,EACnD,2CAA2C,EAC3C,mBAAmB,EACnB,uCAAuC,EACvC,iCAAiC,EACjC,6BAA6B,EAC7B,kCAAkC,EAClC,kCAAkC,EAClC,qCAAqC,EACrC,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gDAAgD,EAChD,yCAAyC,EACzC,kCAAkC,GACnC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AAE5E,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACnD,WAAW,EAAE,kBAAkB;CAChC,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,YAAY,CAAC;IACpE,cAAc,EAAE,kBAAkB;IAClC,OAAO,EAAE,kBAAkB;CAC5B,CAAC,CAAC;AAMH,MAAM,+BAA+B,GAAG;IACtC,GAAG,EAAE,wGAAwG;CACrG,CAAC;AAEX,MAAM,CAAC,MAAM,2BAA2B,GAAG,mBAAmB,CAAC;IAC7D,IAAI,EAAE,SAAS;IACf,gBAAgB,EAAE;QAChB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,4BAA4B;QACjC,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;KACzB;IACD,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;IAC1C,EAAE,EAAE,uBAAuB;IAC3B,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,+BAA+B;IACvC,IAAI,EAAE,kDAAkD;IACxD,KAAK,EAAE,8BAA8B;IACrC,oBAAoB,EAAE,+BAA+B;IACrD,SAAS,EAAE;QACT,GAAG,EAAE,iCAAiC;QACtC,GAAG,EAAE,yCAAyC;KAC/C;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,mBAAmB,CAAC;IAC7D,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,wCAAwC;IAC9C,gBAAgB,EAAE;QAChB,GAAG,EAAE,kCAAkC;QACvC,GAAG,EAAE,4BAA4B;QACjC,GAAG,EAAE,kCAAkC;QACvC,GAAG,EAAE,kCAAkC;QACvC,GAAG,EAAE,kCAAkC;QACvC,GAAG,EAAE,kCAAkC;QACvC,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,gDAAgD;KACtD;IACD,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;IACzD,EAAE,EAAE,0BAA0B;IAC9B,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,+BAA+B;IACvC,IAAI,EAAE,kDAAkD;IACxD,oBAAoB,EAAE,+BAA+B;IACrD,SAAS,EAAE;QACT,GAAG,EAAE,qCAAqC;QAC1C,GAAG,EAAE,yCAAyC;KAC/C;IACD,kBAAkB,EAAE;QAClB,kDAAkD;QAClD,kCAAkC;KACnC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sCAAsC,GAAG,mBAAmB,CAAC;IACxE,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,0CAA0C;IAChD,gBAAgB,EAAE;QAChB,GAAG,EAAE,kCAAkC;QACvC,GAAG,EAAE,4BAA4B;QACjC,GAAG,EAAE,kCAAkC;QACvC,GAAG,EAAE,kCAAkC;QACvC,GAAG,EAAE,kCAAkC;QACvC,GAAG,EAAE,mDAAmD;QACxD,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,gDAAgD;KACtD;IACD,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;IACzD,EAAE,EAAE,oCAAoC;IACxC,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,uCAAuC;IAC/C,IAAI,EAAE,gEAAgE;IACtE,oBAAoB,EAAE,+BAA+B;IACrD,SAAS,EAAE;QACT,GAAG,EAAE,2CAA2C;QAChD,GAAG,EAAE,yCAAyC;KAC/C;IACD,kBAAkB,EAAE;QAClB,kDAAkD;QAClD,kCAAkC;KACnC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+CAA+C,GAC1D,sCAAsC,CAAC;AACzC,MAAM,CAAC,MAAM,gDAAgD,GAC3D,uCAAuC,CAAC;AAE1C,MAAM,CAAC,MAAM,qCAAqC,GAChD,6BAA6B,CAAC;AAChC,MAAM,CAAC,MAAM,oCAAoC,GAC/C,oCAAoC,CAAC;AACvC,MAAM,CAAC,MAAM,qCAAqC,GAChD,iCAAiC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { organizationProvisioningContainerKeyringRefinement } from \"../organizationProvisioningRefinements\";\nimport {\n  CommitOrganizationGroupPolicyRequestSchema,\n  isCommitOrganizationGroupPolicyRequest,\n  isOrganizationPrincipalPolicyRequest,\n  OrganizationPrincipalPolicyRequestSchema,\n} from \"../request\";\nimport {\n  CommitOrganizationGroupPolicyConflictResponseSchema,\n  CommitOrganizationGroupPolicyResponseSchema,\n  ErrorResponseSchema,\n  isCommitOrganizationGroupPolicyResponse,\n  isPrincipalPolicyMutationResponse,\n  isPrincipalPolicyPageResponse,\n  PaymentRequiredErrorResponseSchema,\n  PrincipalPolicyErrorResponseSchema,\n  PrincipalPolicyMutationResponseSchema,\n  PrincipalPolicyPageResponseSchema,\n  SessionFailureResponseSchema,\n} from \"../response\";\nimport {\n  PrincipalHistoryPreparationFailureResponseSchema,\n  PrincipalHistoryPreparationResponseSchema,\n  principalHistoryRollbackRefinement,\n} from \"../response/principalHistoryPreparation\";\nimport { uuidV4StringSchema } from \"../schema\";\nimport { defineJsonOperation } from \"./definition\";\nimport { PrincipalPolicyPageQuerySchema } from \"./principalPolicyPageQuery\";\n\nexport const PrincipalPolicyPathParamsSchema = z.strictObject({\n  principalType: z.literal([\"group\", \"organization\"]),\n  principalId: uuidV4StringSchema,\n});\n\nexport type PrincipalPolicyPathParams = z.infer<\n  typeof PrincipalPolicyPathParamsSchema\n>;\n\nexport const OrganizationGroupPolicyPathParamsSchema = z.strictObject({\n  organizationId: uuidV4StringSchema,\n  groupId: uuidV4StringSchema,\n});\n\nexport type OrganizationGroupPolicyPathParams = z.infer<\n  typeof OrganizationGroupPolicyPathParamsSchema\n>;\n\nconst preparationResponseDescriptions = {\n  202: \"The attempted operation rolled back. Retry the identical request to continue verification preparation.\",\n} as const;\n\nexport const getPrincipalPolicyOperation = defineJsonOperation({\n  auth: \"session\",\n  failureResponses: {\n    400: ErrorResponseSchema,\n    401: SessionFailureResponseSchema,\n    403: ErrorResponseSchema,\n    409: ErrorResponseSchema,\n    500: ErrorResponseSchema,\n  },\n  failureStatuses: [400, 401, 403, 409, 500],\n  id: \"principals.policy.get\",\n  method: \"GET\",\n  params: PrincipalPolicyPathParamsSchema,\n  path: \"/principals/{principalType}/{principalId}/policy\",\n  query: PrincipalPolicyPageQuerySchema,\n  responseDescriptions: preparationResponseDescriptions,\n  responses: {\n    200: PrincipalPolicyPageResponseSchema,\n    202: PrincipalHistoryPreparationResponseSchema,\n  },\n});\n\nexport const putPrincipalPolicyOperation = defineJsonOperation({\n  auth: \"session\",\n  body: OrganizationPrincipalPolicyRequestSchema,\n  failureResponses: {\n    400: PrincipalPolicyErrorResponseSchema,\n    401: SessionFailureResponseSchema,\n    402: PaymentRequiredErrorResponseSchema,\n    403: PrincipalPolicyErrorResponseSchema,\n    404: PrincipalPolicyErrorResponseSchema,\n    409: PrincipalPolicyErrorResponseSchema,\n    500: ErrorResponseSchema,\n    503: PrincipalHistoryPreparationFailureResponseSchema,\n  },\n  failureStatuses: [400, 401, 402, 403, 404, 409, 500, 503],\n  id: \"principals.policy.update\",\n  method: \"PUT\",\n  params: PrincipalPolicyPathParamsSchema,\n  path: \"/principals/{principalType}/{principalId}/policy\",\n  responseDescriptions: preparationResponseDescriptions,\n  responses: {\n    200: PrincipalPolicyMutationResponseSchema,\n    202: PrincipalHistoryPreparationResponseSchema,\n  },\n  runtimeRefinements: [\n    organizationProvisioningContainerKeyringRefinement,\n    principalHistoryRollbackRefinement,\n  ],\n});\n\nexport const commitOrganizationGroupPolicyOperation = defineJsonOperation({\n  auth: \"session\",\n  body: CommitOrganizationGroupPolicyRequestSchema,\n  failureResponses: {\n    400: PrincipalPolicyErrorResponseSchema,\n    401: SessionFailureResponseSchema,\n    402: PaymentRequiredErrorResponseSchema,\n    403: PrincipalPolicyErrorResponseSchema,\n    404: PrincipalPolicyErrorResponseSchema,\n    409: CommitOrganizationGroupPolicyConflictResponseSchema,\n    500: ErrorResponseSchema,\n    503: PrincipalHistoryPreparationFailureResponseSchema,\n  },\n  failureStatuses: [400, 401, 402, 403, 404, 409, 500, 503],\n  id: \"organizations.groups.policy.commit\",\n  method: \"PUT\",\n  params: OrganizationGroupPolicyPathParamsSchema,\n  path: \"/organizations/{organizationId}/groups/{groupId}/policy-commit\",\n  responseDescriptions: preparationResponseDescriptions,\n  responses: {\n    200: CommitOrganizationGroupPolicyResponseSchema,\n    202: PrincipalHistoryPreparationResponseSchema,\n  },\n  runtimeRefinements: [\n    organizationProvisioningContainerKeyringRefinement,\n    principalHistoryRollbackRefinement,\n  ],\n});\n\nexport const isCommitOrganizationGroupPolicyOperationRequest =\n  isCommitOrganizationGroupPolicyRequest;\nexport const isCommitOrganizationGroupPolicyOperationResponse =\n  isCommitOrganizationGroupPolicyResponse;\n\nexport const isGetPrincipalPolicyOperationResponse =\n  isPrincipalPolicyPageResponse;\nexport const isPutPrincipalPolicyOperationRequest =\n  isOrganizationPrincipalPolicyRequest;\nexport const isPutPrincipalPolicyOperationResponse =\n  isPrincipalPolicyMutationResponse;\n"]}
+{"version":3,"file":"principals.js","sourceRoot":"","sources":["principals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kDAAkD,EAAE,MAAM,wCAAwC,CAAC;AAC5G,OAAO,EACL,0CAA0C,EAC1C,sCAAsC,EACtC,oCAAoC,EACpC,wCAAwC,GACzC,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,mDAAmD,EACnD,2CAA2C,EAC3C,mBAAmB,EACnB,uCAAuC,EACvC,iCAAiC,EACjC,kCAAkC,EAClC,kCAAkC,EAClC,qCAAqC,EAErC,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gDAAgD,EAChD,yCAAyC,EACzC,kCAAkC,GACnC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AAE5E,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACnD,WAAW,EAAE,kBAAkB;CAChC,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,YAAY,CAAC;IACpE,cAAc,EAAE,kBAAkB;IAClC,OAAO,EAAE,kBAAkB;CAC5B,CAAC,CAAC;AAMH,MAAM,+BAA+B,GAAG;IACtC,GAAG,EAAE,wGAAwG;CACrG,CAAC;AAEX,MAAM,CAAC,MAAM,2BAA2B,GAAG,mBAAmB,CAAC;IAC7D,IAAI,EAAE,SAAS;IACf,gBAAgB,EAAE;QAChB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,4BAA4B;QACjC,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;KACzB;IACD,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;IAC1C,EAAE,EAAE,uBAAuB;IAC3B,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,+BAA+B;IACvC,IAAI,EAAE,kDAAkD;IACxD,KAAK,EAAE,8BAA8B;IACrC,oBAAoB,EAAE,+BAA+B;IACrD,SAAS,EAAE;QACT,GAAG,EAAE,iCAAiC;QACtC,GAAG,EAAE,yCAAyC;KAC/C;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,mBAAmB,CAAC;IAC7D,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,wCAAwC;IAC9C,gBAAgB,EAAE;QAChB,GAAG,EAAE,kCAAkC;QACvC,GAAG,EAAE,4BAA4B;QACjC,GAAG,EAAE,kCAAkC;QACvC,GAAG,EAAE,kCAAkC;QACvC,GAAG,EAAE,kCAAkC;QACvC,GAAG,EAAE,kCAAkC;QACvC,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,gDAAgD;KACtD;IACD,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;IACzD,EAAE,EAAE,0BAA0B;IAC9B,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,+BAA+B;IACvC,IAAI,EAAE,kDAAkD;IACxD,oBAAoB,EAAE,+BAA+B;IACrD,SAAS,EAAE;QACT,GAAG,EAAE,qCAAqC;QAC1C,GAAG,EAAE,yCAAyC;KAC/C;IACD,kBAAkB,EAAE;QAClB,kDAAkD;QAClD,kCAAkC;KACnC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sCAAsC,GAAG,mBAAmB,CAAC;IACxE,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,0CAA0C;IAChD,gBAAgB,EAAE;QAChB,GAAG,EAAE,kCAAkC;QACvC,GAAG,EAAE,4BAA4B;QACjC,GAAG,EAAE,kCAAkC;QACvC,GAAG,EAAE,kCAAkC;QACvC,GAAG,EAAE,kCAAkC;QACvC,GAAG,EAAE,mDAAmD;QACxD,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,gDAAgD;KACtD;IACD,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;IACzD,EAAE,EAAE,oCAAoC;IACxC,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,uCAAuC;IAC/C,IAAI,EAAE,gEAAgE;IACtE,oBAAoB,EAAE,+BAA+B;IACrD,SAAS,EAAE;QACT,GAAG,EAAE,2CAA2C;QAChD,GAAG,EAAE,yCAAyC;KAC/C;IACD,kBAAkB,EAAE;QAClB,kDAAkD;QAClD,kCAAkC;KACnC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+CAA+C,GAC1D,sCAAsC,CAAC;AACzC,MAAM,CAAC,MAAM,gDAAgD,GAC3D,uCAAuC,CAAC;AAE1C,MAAM,UAAU,qCAAqC,CACnD,KAAc;IAEd,OAAO,iCAAiC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACpE,CAAC;AACD,MAAM,CAAC,MAAM,oCAAoC,GAC/C,oCAAoC,CAAC;AACvC,MAAM,CAAC,MAAM,qCAAqC,GAChD,iCAAiC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { organizationProvisioningContainerKeyringRefinement } from \"../organizationProvisioningRefinements\";\nimport {\n  CommitOrganizationGroupPolicyRequestSchema,\n  isCommitOrganizationGroupPolicyRequest,\n  isOrganizationPrincipalPolicyRequest,\n  OrganizationPrincipalPolicyRequestSchema,\n} from \"../request\";\nimport {\n  CommitOrganizationGroupPolicyConflictResponseSchema,\n  CommitOrganizationGroupPolicyResponseSchema,\n  ErrorResponseSchema,\n  isCommitOrganizationGroupPolicyResponse,\n  isPrincipalPolicyMutationResponse,\n  PaymentRequiredErrorResponseSchema,\n  PrincipalPolicyErrorResponseSchema,\n  PrincipalPolicyMutationResponseSchema,\n  type PrincipalPolicyReadResponse,\n  PrincipalPolicyReadResponseSchema,\n  SessionFailureResponseSchema,\n} from \"../response\";\nimport {\n  PrincipalHistoryPreparationFailureResponseSchema,\n  PrincipalHistoryPreparationResponseSchema,\n  principalHistoryRollbackRefinement,\n} from \"../response/principalHistoryPreparation\";\nimport { uuidV4StringSchema } from \"../schema\";\nimport { defineJsonOperation } from \"./definition\";\nimport { PrincipalPolicyPageQuerySchema } from \"./principalPolicyPageQuery\";\n\nexport const PrincipalPolicyPathParamsSchema = z.strictObject({\n  principalType: z.literal([\"group\", \"organization\"]),\n  principalId: uuidV4StringSchema,\n});\n\nexport type PrincipalPolicyPathParams = z.infer<\n  typeof PrincipalPolicyPathParamsSchema\n>;\n\nexport const OrganizationGroupPolicyPathParamsSchema = z.strictObject({\n  organizationId: uuidV4StringSchema,\n  groupId: uuidV4StringSchema,\n});\n\nexport type OrganizationGroupPolicyPathParams = z.infer<\n  typeof OrganizationGroupPolicyPathParamsSchema\n>;\n\nconst preparationResponseDescriptions = {\n  202: \"The attempted operation rolled back. Retry the identical request to continue verification preparation.\",\n} as const;\n\nexport const getPrincipalPolicyOperation = defineJsonOperation({\n  auth: \"session\",\n  failureResponses: {\n    400: ErrorResponseSchema,\n    401: SessionFailureResponseSchema,\n    403: ErrorResponseSchema,\n    409: ErrorResponseSchema,\n    500: ErrorResponseSchema,\n  },\n  failureStatuses: [400, 401, 403, 409, 500],\n  id: \"principals.policy.get\",\n  method: \"GET\",\n  params: PrincipalPolicyPathParamsSchema,\n  path: \"/principals/{principalType}/{principalId}/policy\",\n  query: PrincipalPolicyPageQuerySchema,\n  responseDescriptions: preparationResponseDescriptions,\n  responses: {\n    200: PrincipalPolicyReadResponseSchema,\n    202: PrincipalHistoryPreparationResponseSchema,\n  },\n});\n\nexport const putPrincipalPolicyOperation = defineJsonOperation({\n  auth: \"session\",\n  body: OrganizationPrincipalPolicyRequestSchema,\n  failureResponses: {\n    400: PrincipalPolicyErrorResponseSchema,\n    401: SessionFailureResponseSchema,\n    402: PaymentRequiredErrorResponseSchema,\n    403: PrincipalPolicyErrorResponseSchema,\n    404: PrincipalPolicyErrorResponseSchema,\n    409: PrincipalPolicyErrorResponseSchema,\n    500: ErrorResponseSchema,\n    503: PrincipalHistoryPreparationFailureResponseSchema,\n  },\n  failureStatuses: [400, 401, 402, 403, 404, 409, 500, 503],\n  id: \"principals.policy.update\",\n  method: \"PUT\",\n  params: PrincipalPolicyPathParamsSchema,\n  path: \"/principals/{principalType}/{principalId}/policy\",\n  responseDescriptions: preparationResponseDescriptions,\n  responses: {\n    200: PrincipalPolicyMutationResponseSchema,\n    202: PrincipalHistoryPreparationResponseSchema,\n  },\n  runtimeRefinements: [\n    organizationProvisioningContainerKeyringRefinement,\n    principalHistoryRollbackRefinement,\n  ],\n});\n\nexport const commitOrganizationGroupPolicyOperation = defineJsonOperation({\n  auth: \"session\",\n  body: CommitOrganizationGroupPolicyRequestSchema,\n  failureResponses: {\n    400: PrincipalPolicyErrorResponseSchema,\n    401: SessionFailureResponseSchema,\n    402: PaymentRequiredErrorResponseSchema,\n    403: PrincipalPolicyErrorResponseSchema,\n    404: PrincipalPolicyErrorResponseSchema,\n    409: CommitOrganizationGroupPolicyConflictResponseSchema,\n    500: ErrorResponseSchema,\n    503: PrincipalHistoryPreparationFailureResponseSchema,\n  },\n  failureStatuses: [400, 401, 402, 403, 404, 409, 500, 503],\n  id: \"organizations.groups.policy.commit\",\n  method: \"PUT\",\n  params: OrganizationGroupPolicyPathParamsSchema,\n  path: \"/organizations/{organizationId}/groups/{groupId}/policy-commit\",\n  responseDescriptions: preparationResponseDescriptions,\n  responses: {\n    200: CommitOrganizationGroupPolicyResponseSchema,\n    202: PrincipalHistoryPreparationResponseSchema,\n  },\n  runtimeRefinements: [\n    organizationProvisioningContainerKeyringRefinement,\n    principalHistoryRollbackRefinement,\n  ],\n});\n\nexport const isCommitOrganizationGroupPolicyOperationRequest =\n  isCommitOrganizationGroupPolicyRequest;\nexport const isCommitOrganizationGroupPolicyOperationResponse =\n  isCommitOrganizationGroupPolicyResponse;\n\nexport function isGetPrincipalPolicyOperationResponse(\n  value: unknown,\n): value is PrincipalPolicyReadResponse {\n  return PrincipalPolicyReadResponseSchema.safeParse(value).success;\n}\nexport const isPutPrincipalPolicyOperationRequest =\n  isOrganizationPrincipalPolicyRequest;\nexport const isPutPrincipalPolicyOperationResponse =\n  isPrincipalPolicyMutationResponse;\n"]}

package/internal/validators/response/index.d.ts

@@ -31,7 +31,7 @@ export { type CreateOrganizationResponse, CreateOrganizationResponseSchema, isCr
 export { isOrganizationReadModelResponse, type OrganizationReadModelDeltaResponse, type OrganizationReadModelDirectoryResponse, type OrganizationReadModelGrantsResponse, type OrganizationReadModelGroupMemberResponse, type OrganizationReadModelGroupMembershipResponse, type OrganizationReadModelGroupMembershipsResponse, type OrganizationReadModelOrganizationPolicyResponse, type OrganizationReadModelResponse, OrganizationReadModelResponseSchema, type OrganizationReadModelSnapshotResponse, } from "./organizationReadModel.js";
 export { ORGANIZATION_READ_MODEL_ERROR_CODES, type OrganizationReadModelErrorCode, OrganizationReadModelErrorCodeSchema, type OrganizationReadModelFailureResponse, OrganizationReadModelFailureResponseSchema, } from "./organizationReadModelError.js";
 export { CommitOrganizationGroupPolicyConflictResponseSchema, type CommitOrganizationGroupPolicyResponse, CommitOrganizationGroupPolicyResponseSchema, type CurrentPrincipalMemberEnvelopesResponse, CurrentPrincipalMemberEnvelopesResponseSchema, isCommitOrganizationGroupPolicyResponse, isCurrentPrincipalMemberEnvelopesResponse, isPrincipalPolicyBundleResponse, isPrincipalPolicyMutationResponse, isPrincipalPolicyStaleErrorResponse, isPrincipalPolicyStateChainEntryResponse, isPrincipalStatePayloadResponse, isPrincipalStateResponse, type PrincipalContainerGrantResponse, PrincipalContainerGrantResponseSchema, type PrincipalMemberEnvelopeResponse, PrincipalMemberEnvelopeResponseSchema, type PrincipalPolicyBundleResponse, PrincipalPolicyBundleResponseSchema, type PrincipalPolicyErrorResponse, PrincipalPolicyErrorResponseSchema, type PrincipalPolicyMutationResponse, PrincipalPolicyMutationResponseSchema, type PrincipalPolicySnapshotResponse, PrincipalPolicySnapshotResponseSchema, type PrincipalPolicyStaleErrorResponse, PrincipalPolicyStaleErrorResponseSchema, type PrincipalPolicyStateChainEntryResponse, PrincipalPolicyStateChainEntryResponseSchema, type PrincipalProjectionMemberResponse, PrincipalProjectionMemberResponseSchema, type PrincipalStateExternalAuthorityResponse, PrincipalStateExternalAuthorityResponseSchema, type PrincipalStatePayloadResponse, PrincipalStatePayloadResponseSchema, type PrincipalStateResponse, PrincipalStateResponseSchema, } from "./principal.js";
-export { isPrincipalPolicyPageResponse, type PrincipalPolicyPageResponse, PrincipalPolicyPageResponseSchema, } from "./principalPolicyPage.js";
+export { isPrincipalPolicyPageResponse, isPrincipalPolicyUnchangedResponse, type PrincipalPolicyPageResponse, PrincipalPolicyPageResponseSchema, type PrincipalPolicyReadResponse, PrincipalPolicyReadResponseSchema, type PrincipalPolicyUnchangedResponse, PrincipalPolicyUnchangedResponseSchema, } from "./principalPolicyPage.js";
 export { isPrincipalPolicySnapshotPageResponse, type PrincipalPolicyHistorySourceResponse, PrincipalPolicyHistorySourceResponseSchema, type PrincipalPolicySnapshotPageResponse, PrincipalPolicySnapshotPageResponseSchema, } from "./principalPolicySnapshotPage.js";
 export { isReferencedPrincipalStateResponse, type ReferencedPrincipalStateResponse, ReferencedPrincipalStateResponseSchema, } from "./principalReference.js";
 export { type ProjectionPolicyEvidenceResponse, ProjectionPolicyEvidenceResponseSchema, } from "./projectionPolicyEvidence.js";

package/internal/validators/response/index.js

@@ -30,7 +30,7 @@ export { CreateOrganizationResponseSchema, isCreateOrganizationResponse, isOrgan
 export { isOrganizationReadModelResponse, OrganizationReadModelResponseSchema, } from "./organizationReadModel.js";
 export { ORGANIZATION_READ_MODEL_ERROR_CODES, OrganizationReadModelErrorCodeSchema, OrganizationReadModelFailureResponseSchema, } from "./organizationReadModelError.js";
 export { CommitOrganizationGroupPolicyConflictResponseSchema, CommitOrganizationGroupPolicyResponseSchema, CurrentPrincipalMemberEnvelopesResponseSchema, isCommitOrganizationGroupPolicyResponse, isCurrentPrincipalMemberEnvelopesResponse, isPrincipalPolicyBundleResponse, isPrincipalPolicyMutationResponse, isPrincipalPolicyStaleErrorResponse, isPrincipalPolicyStateChainEntryResponse, isPrincipalStatePayloadResponse, isPrincipalStateResponse, PrincipalContainerGrantResponseSchema, PrincipalMemberEnvelopeResponseSchema, PrincipalPolicyBundleResponseSchema, PrincipalPolicyErrorResponseSchema, PrincipalPolicyMutationResponseSchema, PrincipalPolicySnapshotResponseSchema, PrincipalPolicyStaleErrorResponseSchema, PrincipalPolicyStateChainEntryResponseSchema, PrincipalProjectionMemberResponseSchema, PrincipalStateExternalAuthorityResponseSchema, PrincipalStatePayloadResponseSchema, PrincipalStateResponseSchema, } from "./principal.js";
-export { isPrincipalPolicyPageResponse, PrincipalPolicyPageResponseSchema, } from "./principalPolicyPage.js";
+export { isPrincipalPolicyPageResponse, isPrincipalPolicyUnchangedResponse, PrincipalPolicyPageResponseSchema, PrincipalPolicyReadResponseSchema, PrincipalPolicyUnchangedResponseSchema, } from "./principalPolicyPage.js";
 export { isPrincipalPolicySnapshotPageResponse, PrincipalPolicyHistorySourceResponseSchema, PrincipalPolicySnapshotPageResponseSchema, } from "./principalPolicySnapshotPage.js";
 export { isReferencedPrincipalStateResponse, ReferencedPrincipalStateResponseSchema, } from "./principalReference.js";
 export { ProjectionPolicyEvidenceResponseSchema, } from "./projectionPolicyEvidence.js";