@tearleads/client-sdk 0.1.116 → 0.1.118

package/internal/validators/knownManifestsRefinements.js.map

@@ -1 +1 @@
-{"version":3,"file":"knownManifestsRefinements.js","sourceRoot":"","sources":["knownManifestsRefinements.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,EAAE,EAAE,8BAA8B;IAClC,WAAW,EACT,iFAAiF;CAC3E,CAAC","sourcesContent":["export const knownManifestsHeaderRefinement = {\n  id: \"request.known-manifest-hints\",\n  description:\n    \"x-known-manifests must list at most 48 unique lowercase SHA-256 manifest hashes\",\n} as const;\n"]}
+{"version":3,"file":"knownManifestsRefinements.js","sourceRoot":"","sources":["knownManifestsRefinements.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,EAAE,EAAE,8BAA8B;IAClC,WAAW,EACT,uHAAuH;CACjH,CAAC","sourcesContent":["export const knownManifestsHeaderRefinement = {\n  id: \"request.known-manifest-hints\",\n  description:\n    \"x-known-manifests must list at most 48 unique typed digests, each m: or k: followed by a lowercase SHA-256 hex digest\",\n} as const;\n"]}

package/internal/validators/operation/writerProjections.d.ts

@@ -125,7 +125,7 @@ export declare const getContainerWriterProjectionOperation: Omit<{
                 }[];
             };
             containerId: string;
-            containerKeks: {
+            containerKeks: ({
                 containerManifestHistory: string[];
                 accessManifestHash: string;
                 containerId: string;
@@ -145,7 +145,10 @@ export declare const getContainerWriterProjectionOperation: Omit<{
                 parentContainerKeyEpochId: string | null;
                 recipientTargets: Record<string, unknown>[];
                 wraps: Record<string, unknown>[];
-            }[];
+            } | {
+                levelDigest: string;
+                containerManifestHistory: string[];
+            })[];
             organizationId: string;
             path: string[];
             bundles: Record<string, {
@@ -204,7 +207,7 @@ export declare const getContainerWriterProjectionOperation: Omit<{
                 }[];
             };
             containerId: string;
-            containerKeks: {
+            containerKeks: ({
                 containerManifestHistory: string[];
                 accessManifestHash: string;
                 containerId: string;
@@ -224,7 +227,10 @@ export declare const getContainerWriterProjectionOperation: Omit<{
                 parentContainerKeyEpochId: string | null;
                 recipientTargets: Record<string, unknown>[];
                 wraps: Record<string, unknown>[];
-            }[];
+            } | {
+                levelDigest: string;
+                containerManifestHistory: string[];
+            })[];
             organizationId: string;
             path: string[];
             bundles: Record<string, {
@@ -283,7 +289,7 @@ export declare const getContainerWriterProjectionOperation: Omit<{
                 }[];
             };
             containerId: string;
-            containerKeks: {
+            containerKeks: ({
                 containerManifestHistory: string[];
                 accessManifestHash: string;
                 containerId: string;
@@ -303,7 +309,10 @@ export declare const getContainerWriterProjectionOperation: Omit<{
                 parentContainerKeyEpochId: string | null;
                 recipientTargets: Record<string, unknown>[];
                 wraps: Record<string, unknown>[];
-            }[];
+            } | {
+                levelDigest: string;
+                containerManifestHistory: string[];
+            })[];
             organizationId: string;
             path: string[];
             bundles: Record<string, {
@@ -362,7 +371,7 @@ export declare const getContainerWriterProjectionOperation: Omit<{
                 }[];
             };
             containerId: string;
-            containerKeks: {
+            containerKeks: ({
                 containerManifestHistory: string[];
                 accessManifestHash: string;
                 containerId: string;
@@ -382,7 +391,10 @@ export declare const getContainerWriterProjectionOperation: Omit<{
                 parentContainerKeyEpochId: string | null;
                 recipientTargets: Record<string, unknown>[];
                 wraps: Record<string, unknown>[];
-            }[];
+            } | {
+                levelDigest: string;
+                containerManifestHistory: string[];
+            })[];
             organizationId: string;
             path: string[];
             bundles: Record<string, {
@@ -414,7 +426,7 @@ export declare const getContainerWriterProjectionOperation: Omit<{
         readonly id: "response.writer-projection-manifest-bundles";
     }, {
         readonly id: "request.known-manifest-hints";
-        readonly description: "x-known-manifests must list at most 48 unique lowercase SHA-256 manifest hashes";
+        readonly description: "x-known-manifests must list at most 48 unique typed digests, each m: or k: followed by a lowercase SHA-256 hex digest";
     }];
 }, "failureResponses" | "failureStatuses"> & {
     readonly failureResponses: {
@@ -600,7 +612,7 @@ export declare const getDocumentWriterProjectionOperation: Omit<{
             };
             authorizingContainerPaths: {
                 containerId: string;
-                containerKeks: {
+                containerKeks: ({
                     containerManifestHistory: string[];
                     accessManifestHash: string;
                     containerId: string;
@@ -620,7 +632,10 @@ export declare const getDocumentWriterProjectionOperation: Omit<{
                     parentContainerKeyEpochId: string | null;
                     recipientTargets: Record<string, unknown>[];
                     wraps: Record<string, unknown>[];
-                }[];
+                } | {
+                    levelDigest: string;
+                    containerManifestHistory: string[];
+                })[];
                 organizationId: string;
                 path: string[];
             }[];
@@ -709,7 +724,7 @@ export declare const getDocumentWriterProjectionOperation: Omit<{
             };
             authorizingContainerPaths: {
                 containerId: string;
-                containerKeks: {
+                containerKeks: ({
                     containerManifestHistory: string[];
                     accessManifestHash: string;
                     containerId: string;
@@ -729,7 +744,10 @@ export declare const getDocumentWriterProjectionOperation: Omit<{
                     parentContainerKeyEpochId: string | null;
                     recipientTargets: Record<string, unknown>[];
                     wraps: Record<string, unknown>[];
-                }[];
+                } | {
+                    levelDigest: string;
+                    containerManifestHistory: string[];
+                })[];
                 organizationId: string;
                 path: string[];
             }[];
@@ -818,7 +836,7 @@ export declare const getDocumentWriterProjectionOperation: Omit<{
             };
             authorizingContainerPaths: {
                 containerId: string;
-                containerKeks: {
+                containerKeks: ({
                     containerManifestHistory: string[];
                     accessManifestHash: string;
                     containerId: string;
@@ -838,7 +856,10 @@ export declare const getDocumentWriterProjectionOperation: Omit<{
                     parentContainerKeyEpochId: string | null;
                     recipientTargets: Record<string, unknown>[];
                     wraps: Record<string, unknown>[];
-                }[];
+                } | {
+                    levelDigest: string;
+                    containerManifestHistory: string[];
+                })[];
                 organizationId: string;
                 path: string[];
             }[];
@@ -927,7 +948,7 @@ export declare const getDocumentWriterProjectionOperation: Omit<{
             };
             authorizingContainerPaths: {
                 containerId: string;
-                containerKeks: {
+                containerKeks: ({
                     containerManifestHistory: string[];
                     accessManifestHash: string;
                     containerId: string;
@@ -947,7 +968,10 @@ export declare const getDocumentWriterProjectionOperation: Omit<{
                     parentContainerKeyEpochId: string | null;
                     recipientTargets: Record<string, unknown>[];
                     wraps: Record<string, unknown>[];
-                }[];
+                } | {
+                    levelDigest: string;
+                    containerManifestHistory: string[];
+                })[];
                 organizationId: string;
                 path: string[];
             }[];
@@ -997,7 +1021,7 @@ export declare const getDocumentWriterProjectionOperation: Omit<{
         readonly id: "response.writer-projection-manifest-bundles";
     }, {
         readonly id: "request.known-manifest-hints";
-        readonly description: "x-known-manifests must list at most 48 unique lowercase SHA-256 manifest hashes";
+        readonly description: "x-known-manifests must list at most 48 unique typed digests, each m: or k: followed by a lowercase SHA-256 hex digest";
     }];
 }, "failureResponses" | "failureStatuses"> & {
     readonly failureResponses: {

package/internal/validators/response/container.d.ts

@@ -151,7 +151,104 @@ declare const ContainerKekResponseSchema: z.ZodType<{
     recipientTargets: Record<string, unknown>[];
     wraps: Record<string, unknown>[];
 }>>;
+/** On the writer-projection wire, KEK history cites manifests by hash. */
+declare const ContainerKekWireResponseSchema: z.ZodType<{
+    containerManifestHistory: string[];
+    accessManifestHash: string;
+    containerId: string;
+    containerKeyEpoch: number;
+    containerKeyEpochId: string;
+    keyEpoch: Record<string, unknown>;
+    keyEpochHash: string;
+    keyring: {
+        containerId: string;
+        containerKeyEpochId: string;
+        iv: string;
+        sealed: string;
+        sealingSuite: string;
+        version: number;
+    } | null;
+    keyTargetHash: string;
+    parentContainerKeyEpochId: string | null;
+    recipientTargets: Record<string, unknown>[];
+    wraps: Record<string, unknown>[];
+}, {
+    containerManifestHistory: string[];
+    accessManifestHash: string;
+    containerId: string;
+    containerKeyEpoch: number;
+    containerKeyEpochId: string;
+    keyEpoch: Record<string, unknown>;
+    keyEpochHash: string;
+    keyring: {
+        containerId: string;
+        containerKeyEpochId: string;
+        iv: string;
+        sealed: string;
+        sealingSuite: string;
+        version: number;
+    } | null;
+    keyTargetHash: string;
+    parentContainerKeyEpochId: string | null;
+    recipientTargets: Record<string, unknown>[];
+    wraps: Record<string, unknown>[];
+}, z.core.$ZodTypeInternals<{
+    containerManifestHistory: string[];
+    accessManifestHash: string;
+    containerId: string;
+    containerKeyEpoch: number;
+    containerKeyEpochId: string;
+    keyEpoch: Record<string, unknown>;
+    keyEpochHash: string;
+    keyring: {
+        containerId: string;
+        containerKeyEpochId: string;
+        iv: string;
+        sealed: string;
+        sealingSuite: string;
+        version: number;
+    } | null;
+    keyTargetHash: string;
+    parentContainerKeyEpochId: string | null;
+    recipientTargets: Record<string, unknown>[];
+    wraps: Record<string, unknown>[];
+}, {
+    containerManifestHistory: string[];
+    accessManifestHash: string;
+    containerId: string;
+    containerKeyEpoch: number;
+    containerKeyEpochId: string;
+    keyEpoch: Record<string, unknown>;
+    keyEpochHash: string;
+    keyring: {
+        containerId: string;
+        containerKeyEpochId: string;
+        iv: string;
+        sealed: string;
+        sealingSuite: string;
+        version: number;
+    } | null;
+    keyTargetHash: string;
+    parentContainerKeyEpochId: string | null;
+    recipientTargets: Record<string, unknown>[];
+    wraps: Record<string, unknown>[];
+}>>;
 export type ContainerKekResponse = z.infer<typeof ContainerKekResponseSchema>;
+/** One KEK level as served in full, its manifest history cited by hash. */
+export type ContainerKekWireLevel = z.infer<typeof ContainerKekWireResponseSchema>;
+export declare function isContainerKekWireLevel(value: unknown): value is ContainerKekWireLevel;
+/**
+ * A KEK level the request declared held (`k:` hint), replaced by the digest
+ * of its canonical wire bytes. It keeps the level's manifest citations, so
+ * the response's bundle bookkeeping stays exact; the client refills the
+ * level from those exact held bytes before anything reads it.
+ */
+export declare const CitedContainerKekLevelSchema: z.ZodObject<{
+    levelDigest: z.ZodCustom<string, string>;
+    containerManifestHistory: z.ZodCustom<string[], string[]>;
+}, z.core.$strict>;
+export type CitedContainerKekLevel = z.infer<typeof CitedContainerKekLevelSchema>;
+export declare function isCitedContainerKekLevel(value: unknown): value is CitedContainerKekLevel;
 /**
  * The append-only rotation log for one container: every epoch with its
  * write-once bridge and sealed keyring. This is the rebuild/repair read
@@ -1689,7 +1786,7 @@ export declare const ContainerWriterProjectionResponseSchema: z.ZodType<{
 export type ContainerWriterProjectionResponse = z.infer<typeof ContainerWriterProjectionResponseSchema>;
 export declare const ContainerKeyingPathWireResponseSchema: z.ZodType<{
     containerId: string;
-    containerKeks: {
+    containerKeks: ({
         containerManifestHistory: string[];
         accessManifestHash: string;
         containerId: string;
@@ -1709,12 +1806,15 @@ export declare const ContainerKeyingPathWireResponseSchema: z.ZodType<{
         parentContainerKeyEpochId: string | null;
         recipientTargets: Record<string, unknown>[];
         wraps: Record<string, unknown>[];
-    }[];
+    } | {
+        levelDigest: string;
+        containerManifestHistory: string[];
+    })[];
     organizationId: string;
     path: string[];
 }, {
     containerId: string;
-    containerKeks: {
+    containerKeks: ({
         containerManifestHistory: string[];
         accessManifestHash: string;
         containerId: string;
@@ -1734,12 +1834,15 @@ export declare const ContainerKeyingPathWireResponseSchema: z.ZodType<{
         parentContainerKeyEpochId: string | null;
         recipientTargets: Record<string, unknown>[];
         wraps: Record<string, unknown>[];
-    }[];
+    } | {
+        levelDigest: string;
+        containerManifestHistory: string[];
+    })[];
     organizationId: string;
     path: string[];
 }, z.core.$ZodTypeInternals<{
     containerId: string;
-    containerKeks: {
+    containerKeks: ({
         containerManifestHistory: string[];
         accessManifestHash: string;
         containerId: string;
@@ -1759,12 +1862,15 @@ export declare const ContainerKeyingPathWireResponseSchema: z.ZodType<{
         parentContainerKeyEpochId: string | null;
         recipientTargets: Record<string, unknown>[];
         wraps: Record<string, unknown>[];
-    }[];
+    } | {
+        levelDigest: string;
+        containerManifestHistory: string[];
+    })[];
     organizationId: string;
     path: string[];
 }, {
     containerId: string;
-    containerKeks: {
+    containerKeks: ({
         containerManifestHistory: string[];
         accessManifestHash: string;
         containerId: string;
@@ -1784,7 +1890,10 @@ export declare const ContainerKeyingPathWireResponseSchema: z.ZodType<{
         parentContainerKeyEpochId: string | null;
         recipientTargets: Record<string, unknown>[];
         wraps: Record<string, unknown>[];
-    }[];
+    } | {
+        levelDigest: string;
+        containerManifestHistory: string[];
+    })[];
     organizationId: string;
     path: string[];
 }>>;
@@ -1838,7 +1947,7 @@ export declare const ContainerWriterProjectionWireResponseSchema: z.ZodType<{
         }[];
     };
     containerId: string;
-    containerKeks: {
+    containerKeks: ({
         containerManifestHistory: string[];
         accessManifestHash: string;
         containerId: string;
@@ -1858,7 +1967,10 @@ export declare const ContainerWriterProjectionWireResponseSchema: z.ZodType<{
         parentContainerKeyEpochId: string | null;
         recipientTargets: Record<string, unknown>[];
         wraps: Record<string, unknown>[];
-    }[];
+    } | {
+        levelDigest: string;
+        containerManifestHistory: string[];
+    })[];
     organizationId: string;
     path: string[];
     bundles: Record<string, {
@@ -1917,7 +2029,7 @@ export declare const ContainerWriterProjectionWireResponseSchema: z.ZodType<{
         }[];
     };
     containerId: string;
-    containerKeks: {
+    containerKeks: ({
         containerManifestHistory: string[];
         accessManifestHash: string;
         containerId: string;
@@ -1937,7 +2049,10 @@ export declare const ContainerWriterProjectionWireResponseSchema: z.ZodType<{
         parentContainerKeyEpochId: string | null;
         recipientTargets: Record<string, unknown>[];
         wraps: Record<string, unknown>[];
-    }[];
+    } | {
+        levelDigest: string;
+        containerManifestHistory: string[];
+    })[];
     organizationId: string;
     path: string[];
     bundles: Record<string, {
@@ -1996,7 +2111,7 @@ export declare const ContainerWriterProjectionWireResponseSchema: z.ZodType<{
         }[];
     };
     containerId: string;
-    containerKeks: {
+    containerKeks: ({
         containerManifestHistory: string[];
         accessManifestHash: string;
         containerId: string;
@@ -2016,7 +2131,10 @@ export declare const ContainerWriterProjectionWireResponseSchema: z.ZodType<{
         parentContainerKeyEpochId: string | null;
         recipientTargets: Record<string, unknown>[];
         wraps: Record<string, unknown>[];
-    }[];
+    } | {
+        levelDigest: string;
+        containerManifestHistory: string[];
+    })[];
     organizationId: string;
     path: string[];
     bundles: Record<string, {
@@ -2075,7 +2193,7 @@ export declare const ContainerWriterProjectionWireResponseSchema: z.ZodType<{
         }[];
     };
     containerId: string;
-    containerKeks: {
+    containerKeks: ({
         containerManifestHistory: string[];
         accessManifestHash: string;
         containerId: string;
@@ -2095,7 +2213,10 @@ export declare const ContainerWriterProjectionWireResponseSchema: z.ZodType<{
         parentContainerKeyEpochId: string | null;
         recipientTargets: Record<string, unknown>[];
         wraps: Record<string, unknown>[];
-    }[];
+    } | {
+        levelDigest: string;
+        containerManifestHistory: string[];
+    })[];
     organizationId: string;
     path: string[];
     bundles: Record<string, {

package/internal/validators/response/container.js

@@ -3,7 +3,7 @@ import { containerKekLogSingleKeyringRefinement } from "../containerReadRefineme
 import { ContainerSystemSlotSchema } from "../containerSystemSlot.js";
 import { registerJsonSchemaRuntimeRefinements } from "../jsonSchema.js";
 import { organizationProvisioningContainerKeyringRefinement } from "../organizationProvisioningRefinements.js";
-import { arraySchema, loosePlainObject, nonEmptyArraySchema, nonEmptyStringSchema, nonNegativeIntegerSchema, plainObjectSchema, positiveIntegerSchema, } from "../schema.js";
+import { arraySchema, loosePlainObject, nonEmptyArraySchema, nonEmptyStringSchema, nonNegativeIntegerSchema, plainObjectSchema, positiveIntegerSchema, sha256HexStringSchema, } from "../schema.js";
 import { AccessManifestBundleWireResponseSchema, CONTAINER_KEK_LOG_PAGE_LIMIT, CONTAINER_KEK_WRAPS_PER_EPOCH_LIMIT, ContainerKekKeyringWireRecordSchema, } from "../util/index.js";
 import { containerWriterProjectionPathKekCountRefinement, writerProjectionManifestBundlesRefinement, } from "../writerProjectionRefinements.js";
 import { EffectiveAccessLevelSchema } from "./accessLevel.js";
@@ -50,6 +50,27 @@ const ContainerKekWireResponseSchema = registerJsonSchemaRuntimeRefinements(loos
     ...containerKekResponseShape,
     containerManifestHistory: arraySchema(ManifestHashReferenceSchema),
 }).superRefine(refineContainerKekKeyring), [organizationProvisioningContainerKeyringRefinement]);
+export function isContainerKekWireLevel(value) {
+    return (ContainerKekWireResponseSchema.safeParse(value).success &&
+        !Object.hasOwn(Object(value), "levelDigest"));
+}
+/**
+ * A KEK level the request declared held (`k:` hint), replaced by the digest
+ * of its canonical wire bytes. It keeps the level's manifest citations, so
+ * the response's bundle bookkeeping stays exact; the client refills the
+ * level from those exact held bytes before anything reads it.
+ */
+export const CitedContainerKekLevelSchema = z.strictObject({
+    levelDigest: sha256HexStringSchema,
+    containerManifestHistory: arraySchema(ManifestHashReferenceSchema),
+});
+export function isCitedContainerKekLevel(value) {
+    return CitedContainerKekLevelSchema.safeParse(value).success;
+}
+const ServedContainerKekLevelSchema = z.union([
+    CitedContainerKekLevelSchema,
+    ContainerKekWireResponseSchema,
+]);
 /**
  * The append-only rotation log for one container: every epoch with its
  * write-once bridge and sealed keyring. This is the rebuild/repair read
@@ -157,7 +178,7 @@ export const ContainerWriterProjectionResponseSchema = registerJsonSchemaRuntime
 }).superRefine(refineContainerKeyingPath), [containerWriterProjectionPathKekCountRefinement]);
 const containerKeyingPathWireShape = {
     containerId: z.string(),
-    containerKeks: arraySchema(ContainerKekWireResponseSchema),
+    containerKeks: arraySchema(ServedContainerKekLevelSchema),
     organizationId: z.string(),
     path: nonEmptyArraySchema(ManifestHashReferenceSchema),
 };

package/internal/validators/response/container.js.map

@@ -1 +1 @@
-{"version":3,"file":"container.js","sourceRoot":"","sources":["container.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,sCAAsC,EAAE,MAAM,6BAA6B,CAAC;AACrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,oCAAoC,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,kDAAkD,EAAE,MAAM,wCAAwC,CAAC;AAC5G,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,sCAAsC,EACtC,4BAA4B,EAC5B,mCAAmC,EACnC,mCAAmC,GACpC,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,+CAA+C,EAC/C,yCAAyC,GAC1C,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,2BAA2B,EAC3B,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,sCAAsC,EACtC,qCAAqC,GACtC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,sCAAsC,EAAE,MAAM,4BAA4B,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD,MAAM,0CAA0C,GAAG,gBAAgB,CAAC;IAClE,GAAG,qCAAqC;IACxC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;CAClC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,qCAAqC,GACzC,mCAAmC,CAAC;AAMtC,MAAM,yBAAyB,GAAG;IAChC,kBAAkB,EAAE,oBAAoB;IACxC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,iBAAiB,EAAE,qBAAqB;IACxC,mBAAmB,EAAE,oBAAoB;IACzC,wBAAwB,EAAE,WAAW,CAAC,sCAAsC,CAAC;IAC7E,QAAQ,EAAE,iBAAiB;IAC3B,YAAY,EAAE,oBAAoB;IAClC,OAAO,EAAE,qCAAqC,CAAC,QAAQ,EAAE;IACzD,aAAa,EAAE,oBAAoB;IACnC,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChD,gBAAgB,EAAE,mBAAmB,CAAC,iBAAiB,CAAC;IACxD,KAAK,EAAE,mBAAmB,CAAC,iBAAiB,CAAC;CAC9C,CAAC;AAEF,SAAS,yBAAyB,CAChC,KAAwE,EACxE,OAAwB;IAExB,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,KAAK,CAAC,CAAC,EAAE,CAAC;QACjE,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,mDAAmD;YAC5D,IAAI,EAAE,CAAC,SAAS,CAAC;SAClB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,0BAA0B,GAAG,oCAAoC,CACrE,gBAAgB,CAAC,yBAAyB,CAAC,CAAC,WAAW,CACrD,yBAAyB,CAC1B,EACD,CAAC,kDAAkD,CAAC,CACrD,CAAC;AAEF,0EAA0E;AAC1E,MAAM,8BAA8B,GAAG,oCAAoC,CACzE,gBAAgB,CAAC;IACf,GAAG,yBAAyB;IAC5B,wBAAwB,EAAE,WAAW,CAAC,2BAA2B,CAAC;CACnE,CAAC,CAAC,WAAW,CAAC,yBAAyB,CAAC,EACzC,CAAC,kDAAkD,CAAC,CACrD,CAAC;AAIF;;;;GAIG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,gBAAgB,CAAC;IACjE,kBAAkB,EAAE,oBAAoB;IACxC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACpC,iBAAiB,EAAE,qBAAqB;IACxC,mBAAmB,EAAE,oBAAoB;IACzC,OAAO,EAAE,qCAAqC,CAAC,QAAQ,EAAE;IACzD,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChD;;;OAGG;IACH,KAAK,EAAE,WAAW,CAAC,iBAAiB,EAAE,mCAAmC,CAAC;CAC3E,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,6BAA6B,GACxC,oCAAoC,CAClC,gBAAgB,CAAC;IACf,WAAW,EAAE,oBAAoB;IACjC,MAAM,EAAE,WAAW,CACjB,kCAAkC,EAClC,4BAA4B,CAC7B;IACD,+DAA+D;IAC/D,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE;IACrC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChE,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,qDAAqD;YAC9D,IAAI,EAAE,CAAC,QAAQ,CAAC;SACjB,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,EACF,CAAC,sCAAsC,CAAC,CACzC,CAAC;AAMJ,MAAM,UAAU,yBAAyB,CACvC,KAAc;IAEd,OAAO,6BAA6B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAChE,CAAC;AAED,MAAM,sCAAsC,GAAG;IAC7C,cAAc,EAAE,sCAAsC;IACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,YAAY,EAAE,gBAAgB,CAAC;QAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;KACzB,CAAC;IACF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,wBAAwB,EAAE,WAAW,CACnC,0CAA0C,CAC3C;IACD,UAAU,EAAE,yBAAyB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC;AAEF,oFAAoF;AACpF,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,+BAA+B,EAAE,GACvE,sCAAsC,CAAC;AAEzC,MAAM,8BAA8B,GAAG;IACrC,cAAc;IACd,WAAW;IACX,YAAY,EAAE,0BAA0B;IACxC,GAAG,+BAA+B;CACnC,CAAC;AAEF,MAAM,CAAC,MAAM,+BAA+B,GAAG,gBAAgB,CAC7D,8BAA8B,CAC/B,CAAC;AAMF,iFAAiF;AACjF,MAAM,CAAC,MAAM,+BAA+B,GAAG,gBAAgB,CAAC;IAC9D,GAAG,8BAA8B;IACjC,eAAe,EAAE,WAAW,CAAC,+BAA+B,CAAC,CAAC,QAAQ,EAAE;CACzE,CAAC,CAAC;AAMH,MAAM,UAAU,2BAA2B,CACzC,KAAc;IAEd,OAAO,+BAA+B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,MAAM,6BAA6B,GAAG,gBAAgB,CAC3D,sCAAsC,CACvC,CAAC;AAKF,MAAM,UAAU,yBAAyB,CACvC,KAAc;IAEd,OAAO,6BAA6B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,MAAM,6BAA6B,GAAG,gBAAgB,CAAC;IAC5D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,6CAA6C,GACxD,oCAAoC,CAAC;AACvC,MAAM,CAAC,MAAM,4CAA4C,GAAG,gBAAgB,CAAC;IAC3E,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,6CAA6C,CAAC;IAC9D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,aAAa,EAAE,WAAW,CAAC,0BAA0B,CAAC;IACtD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,mBAAmB,CAAC,sCAAsC,CAAC;CAClE,CAAC;AACF,SAAS,yBAAyB,CAChC,UAAyD,EACzD,OAAwB;IAExB,8EAA8E;IAC9E,IACE,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC;QACvC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QAC9B,UAAU,CAAC,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI,CAAC,MAAM;QAE1D,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,yDAAyD;YAClE,IAAI,EAAE,CAAC,eAAe,CAAC;SACxB,CAAC,CAAC;AACP,CAAC;AACD,MAAM,CAAC,MAAM,iCAAiC,GAC5C,oCAAoC,CAClC,gBAAgB,CAAC,wBAAwB,CAAC,CAAC,WAAW,CACpD,yBAAyB,CAC1B,EACD,CAAC,+CAA+C,CAAC,CAClD,CAAC;AAIJ;;;GAGG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAClD,oCAAoC,CAClC,gBAAgB,CAAC;IACf,GAAG,wBAAwB;IAC3B,cAAc,EAAE,sCAAsC;CACvD,CAAC,CAAC,WAAW,CAAC,yBAAyB,CAAC,EACzC,CAAC,+CAA+C,CAAC,CAClD,CAAC;AAMJ,MAAM,4BAA4B,GAAG;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,aAAa,EAAE,WAAW,CAAC,8BAA8B,CAAC;IAC1D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,mBAAmB,CAAC,2BAA2B,CAAC;CACvD,CAAC;AACF,MAAM,CAAC,MAAM,qCAAqC,GAChD,oCAAoC,CAClC,gBAAgB,CAAC,4BAA4B,CAAC,CAAC,WAAW,CACxD,yBAAyB,CAC1B,EACD,CAAC,+CAA+C,CAAC,CAClD,CAAC;AAKJ;;;GAGG;AACH,MAAM,CAAC,MAAM,2CAA2C,GACtD,oCAAoC,CAClC,gBAAgB,CAAC;IACf,OAAO,EAAE,qBAAqB;IAC9B,cAAc,EAAE,4BAA4B;IAC5C,GAAG,4BAA4B;IAC/B,cAAc,EAAE,sCAAsC;CACvD,CAAC,CAAC,WAAW,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE;IACrC,yBAAyB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC/C,8BAA8B,CAC5B,UAAU,EACV,6BAA6B,CAAC,UAAU,CAAC,EACzC,OAAO,CACR,CAAC;AACJ,CAAC,CAAC,EACF;IACE,+CAA+C;IAC/C,yCAAyC;CAC1C,CACF,CAAC;AAMJ,MAAM,CAAC,MAAM,8BAA8B,GAAG,gBAAgB,CAAC;IAC7D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,wBAAwB;IAC/B,oBAAoB,EAAE,0BAA0B;IAChD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,uBAAuB,EAAE,oBAAoB;IAC7C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC9B,4BAA4B,EAAE,WAAW,CACvC,sCAAsC,CACvC;IACD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,UAAU,EAAE,yBAAyB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oCAAoC,GAAG,gBAAgB,CAAC;IACnE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,wBAAwB;IAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,4BAA4B,GAAG,gBAAgB,CAAC;IAC3D,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,KAAK,EAAE,WAAW,CAAC,8BAA8B,CAAC;IAClD,aAAa,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC7C,UAAU,EAAE,WAAW,CAAC,oCAAoC,CAAC;CAC9D,CAAC,CAAC;AAMH,MAAM,UAAU,wBAAwB,CACtC,KAAc;IAEd,OAAO,4BAA4B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,KAAc;IAEd,OAAO,+BAA+B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAAc;IAEd,OAAO,6BAA6B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,KAAc;IAEd,OAAO,uCAAuC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,KAAc;IAEd,OAAO,2CAA2C,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC9E,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { containerKekLogSingleKeyringRefinement } from \"../containerReadRefinements\";\nimport { ContainerSystemSlotSchema } from \"../containerSystemSlot\";\nimport { registerJsonSchemaRuntimeRefinements } from \"../jsonSchema\";\nimport { organizationProvisioningContainerKeyringRefinement } from \"../organizationProvisioningRefinements\";\nimport {\n  arraySchema,\n  loosePlainObject,\n  nonEmptyArraySchema,\n  nonEmptyStringSchema,\n  nonNegativeIntegerSchema,\n  plainObjectSchema,\n  positiveIntegerSchema,\n} from \"../schema\";\nimport {\n  AccessManifestBundleWireResponseSchema,\n  CONTAINER_KEK_LOG_PAGE_LIMIT,\n  CONTAINER_KEK_WRAPS_PER_EPOCH_LIMIT,\n  ContainerKekKeyringWireRecordSchema,\n} from \"../util\";\nimport {\n  containerWriterProjectionPathKekCountRefinement,\n  writerProjectionManifestBundlesRefinement,\n} from \"../writerProjectionRefinements\";\nimport { EffectiveAccessLevelSchema } from \"./accessLevel\";\nimport {\n  containerKeyingPathReferences,\n  ManifestBundlesSchema,\n  ManifestHashReferenceSchema,\n  OmittedManifestBundlesSchema,\n  refineManifestBundleReferences,\n} from \"./manifestBundleReferences\";\nimport {\n  ReferencedPrincipalStateResponseSchema,\n  ReferencedPrincipalStateResponseShape,\n} from \"./principalReference\";\nimport { ProjectionPolicyEvidenceResponseSchema } from \"./projectionPolicyEvidence\";\nimport { SyncWatermarkSchema } from \"./syncWatermark\";\n\nconst ContainerGrantPrincipalStateResponseSchema = loosePlainObject({\n  ...ReferencedPrincipalStateResponseShape,\n  principalType: z.literal(\"group\"),\n});\n\n/**\n * The container's sealed predecessor key history. Opening it under the\n * current KEK yields every retained historical KEK in one decrypt; the\n * bridge log behind it is served only by the rebuild read path.\n */\nconst ContainerKekKeyringWireResponseSchema =\n  ContainerKekKeyringWireRecordSchema;\n\nexport type ContainerKekKeyringWireResponse = z.infer<\n  typeof ContainerKekKeyringWireResponseSchema\n>;\n\nconst containerKekResponseShape = {\n  accessManifestHash: nonEmptyStringSchema,\n  containerId: z.string(),\n  containerKeyEpoch: positiveIntegerSchema,\n  containerKeyEpochId: nonEmptyStringSchema,\n  containerManifestHistory: arraySchema(AccessManifestBundleWireResponseSchema),\n  keyEpoch: plainObjectSchema,\n  keyEpochHash: nonEmptyStringSchema,\n  keyring: ContainerKekKeyringWireResponseSchema.nullable(),\n  keyTargetHash: nonEmptyStringSchema,\n  parentContainerKeyEpochId: z.string().nullable(),\n  recipientTargets: nonEmptyArraySchema(plainObjectSchema),\n  wraps: nonEmptyArraySchema(plainObjectSchema),\n};\n\nfunction refineContainerKekKeyring(\n  value: { readonly containerKeyEpoch: number; readonly keyring: unknown },\n  context: z.RefinementCtx,\n) {\n  if ((value.keyring === null) !== (value.containerKeyEpoch === 1)) {\n    context.addIssue({\n      code: \"custom\",\n      message: \"container keyring must be null exactly at epoch 1\",\n      path: [\"keyring\"],\n    });\n  }\n}\n\nconst ContainerKekResponseSchema = registerJsonSchemaRuntimeRefinements(\n  loosePlainObject(containerKekResponseShape).superRefine(\n    refineContainerKekKeyring,\n  ),\n  [organizationProvisioningContainerKeyringRefinement],\n);\n\n/** On the writer-projection wire, KEK history cites manifests by hash. */\nconst ContainerKekWireResponseSchema = registerJsonSchemaRuntimeRefinements(\n  loosePlainObject({\n    ...containerKekResponseShape,\n    containerManifestHistory: arraySchema(ManifestHashReferenceSchema),\n  }).superRefine(refineContainerKekKeyring),\n  [organizationProvisioningContainerKeyringRefinement],\n);\n\nexport type ContainerKekResponse = z.infer<typeof ContainerKekResponseSchema>;\n\n/**\n * The append-only rotation log for one container: every epoch with its\n * write-once bridge and sealed keyring. This is the rebuild/repair read\n * path — hot reads use the projection keyring instead.\n */\nexport const ContainerKekLogEpochResponseSchema = loosePlainObject({\n  accessManifestHash: nonEmptyStringSchema,\n  bridge: plainObjectSchema.nullable(),\n  containerKeyEpoch: positiveIntegerSchema,\n  containerKeyEpochId: nonEmptyStringSchema,\n  keyring: ContainerKekKeyringWireResponseSchema.nullable(),\n  parentContainerKeyEpochId: z.string().nullable(),\n  /**\n   * Retained recipient envelopes are the recovery backstop when a bridge is\n   * severed. The server and response guard apply this bound per epoch.\n   */\n  wraps: arraySchema(plainObjectSchema, CONTAINER_KEK_WRAPS_PER_EPOCH_LIMIT),\n});\n\nexport type ContainerKekLogEpochResponse = z.infer<\n  typeof ContainerKekLogEpochResponseSchema\n>;\n\nexport const ContainerKekLogResponseSchema =\n  registerJsonSchemaRuntimeRefinements(\n    loosePlainObject({\n      containerId: nonEmptyStringSchema,\n      epochs: arraySchema(\n        ContainerKekLogEpochResponseSchema,\n        CONTAINER_KEK_LOG_PAGE_LIMIT,\n      ),\n      /** True when epochs above this page's last remain unserved. */\n      hasMore: z.boolean(),\n    }).superRefine(({ epochs }, context) => {\n      if (epochs.filter((epoch) => epoch.keyring !== null).length > 1) {\n        context.addIssue({\n          code: \"custom\",\n          message: \"container KEK log pages contain at most one keyring\",\n          path: [\"epochs\"],\n        });\n      }\n    }),\n    [containerKekLogSingleKeyringRefinement],\n  );\n\nexport type ContainerKekLogResponse = z.infer<\n  typeof ContainerKekLogResponseSchema\n>;\n\nexport function isContainerKekLogResponse(\n  value: unknown,\n): value is ContainerKekLogResponse {\n  return ContainerKekLogResponseSchema.safeParse(value).success;\n}\n\nconst ContainerManifestMutationResponseShape = {\n  accessManifest: AccessManifestBundleWireResponseSchema,\n  containerId: z.string(),\n  createdAt: z.string(),\n  manifestHead: loosePlainObject({\n    epoch: z.number(),\n    manifestHash: z.string(),\n  }),\n  organizationId: z.string(),\n  parentId: z.string().nullable(),\n  referencedPrincipalHeads: arraySchema(\n    ContainerGrantPrincipalStateResponseSchema,\n  ),\n  systemSlot: ContainerSystemSlotSchema.nullable().optional(),\n  updatedAt: z.string(),\n};\n\n// Preserve the canonical generated field order while sharing the signed-head shape.\nconst { accessManifest, containerId, ...containerMutationResponseFields } =\n  ContainerManifestMutationResponseShape;\n\nconst containerMutationResponseShape = {\n  accessManifest,\n  containerId,\n  containerKek: ContainerKekResponseSchema,\n  ...containerMutationResponseFields,\n};\n\nexport const ContainerMutationResponseSchema = loosePlainObject(\n  containerMutationResponseShape,\n);\n\nexport type ContainerMutationResponse = z.infer<\n  typeof ContainerMutationResponseSchema\n>;\n\n/** A rotation's acknowledgement, plus one per carried rekey in request order. */\nexport const ContainerRotationResponseSchema = loosePlainObject({\n  ...containerMutationResponseShape,\n  containerRekeys: arraySchema(ContainerMutationResponseSchema).optional(),\n});\n\nexport type ContainerRotationResponse = z.infer<\n  typeof ContainerRotationResponseSchema\n>;\n\nexport function isContainerRotationResponse(\n  value: unknown,\n): value is ContainerRotationResponse {\n  return ContainerRotationResponseSchema.safeParse(value).success;\n}\n\nexport const ContainerReciteResponseSchema = loosePlainObject(\n  ContainerManifestMutationResponseShape,\n);\nexport type ContainerReciteResponse = z.infer<\n  typeof ContainerReciteResponseSchema\n>;\n\nexport function isContainerReciteResponse(\n  value: unknown,\n): value is ContainerReciteResponse {\n  return ContainerReciteResponseSchema.safeParse(value).success;\n}\n\nexport const ContainerDeleteResponseSchema = loosePlainObject({\n  containerId: z.string(),\n  deletedAt: z.string(),\n});\n\nexport type ContainerDeleteResponse = z.infer<\n  typeof ContainerDeleteResponseSchema\n>;\n\nexport const CONTAINER_PROJECTION_STATE_INVALID_ERROR_CODE =\n  \"container_projection_state_invalid\";\nexport const ContainerWriterProjectionErrorResponseSchema = loosePlainObject({\n  code: z.literal(CONTAINER_PROJECTION_STATE_INVALID_ERROR_CODE),\n  error: z.string(),\n});\n\nconst containerKeyingPathShape = {\n  containerId: z.string(),\n  containerKeks: arraySchema(ContainerKekResponseSchema),\n  organizationId: z.string(),\n  path: nonEmptyArraySchema(AccessManifestBundleWireResponseSchema),\n};\nfunction refineContainerKeyingPath(\n  projection: { containerKeks: unknown[]; path: unknown[] },\n  context: z.RefinementCtx,\n) {\n  // loosePlainObject can continue refinements after reporting malformed fields.\n  if (\n    Array.isArray(projection.containerKeks) &&\n    Array.isArray(projection.path) &&\n    projection.containerKeks.length !== projection.path.length\n  )\n    context.addIssue({\n      code: \"custom\",\n      message: \"container KEK count must match the manifest path length\",\n      path: [\"containerKeks\"],\n    });\n}\nexport const ContainerKeyingPathResponseSchema =\n  registerJsonSchemaRuntimeRefinements(\n    loosePlainObject(containerKeyingPathShape).superRefine(\n      refineContainerKeyingPath,\n    ),\n    [containerWriterProjectionPathKekCountRefinement],\n  );\nexport type ContainerKeyingPathResponse = z.infer<\n  typeof ContainerKeyingPathResponseSchema\n>;\n/**\n * The decoded projection a client verifies: every manifest position holds\n * its bundle. `decodeContainerWriterProjection` builds it from the wire.\n */\nexport const ContainerWriterProjectionResponseSchema =\n  registerJsonSchemaRuntimeRefinements(\n    loosePlainObject({\n      ...containerKeyingPathShape,\n      policyEvidence: ProjectionPolicyEvidenceResponseSchema,\n    }).superRefine(refineContainerKeyingPath),\n    [containerWriterProjectionPathKekCountRefinement],\n  );\n\nexport type ContainerWriterProjectionResponse = z.infer<\n  typeof ContainerWriterProjectionResponseSchema\n>;\n\nconst containerKeyingPathWireShape = {\n  containerId: z.string(),\n  containerKeks: arraySchema(ContainerKekWireResponseSchema),\n  organizationId: z.string(),\n  path: nonEmptyArraySchema(ManifestHashReferenceSchema),\n};\nexport const ContainerKeyingPathWireResponseSchema =\n  registerJsonSchemaRuntimeRefinements(\n    loosePlainObject(containerKeyingPathWireShape).superRefine(\n      refineContainerKeyingPath,\n    ),\n    [containerWriterProjectionPathKekCountRefinement],\n  );\nexport type ContainerKeyingPathWireResponse = z.infer<\n  typeof ContainerKeyingPathWireResponseSchema\n>;\n\n/**\n * The served shape: manifest positions cite `bundles` by hash, except hashes\n * the request declared already held, which `omittedBundles` lists instead.\n */\nexport const ContainerWriterProjectionWireResponseSchema =\n  registerJsonSchemaRuntimeRefinements(\n    loosePlainObject({\n      bundles: ManifestBundlesSchema,\n      omittedBundles: OmittedManifestBundlesSchema,\n      ...containerKeyingPathWireShape,\n      policyEvidence: ProjectionPolicyEvidenceResponseSchema,\n    }).superRefine((projection, context) => {\n      refineContainerKeyingPath(projection, context);\n      refineManifestBundleReferences(\n        projection,\n        containerKeyingPathReferences(projection),\n        context,\n      );\n    }),\n    [\n      containerWriterProjectionPathKekCountRefinement,\n      writerProjectionManifestBundlesRefinement,\n    ],\n  );\n\nexport type ContainerWriterProjectionWireResponse = z.infer<\n  typeof ContainerWriterProjectionWireResponseSchema\n>;\n\nexport const ContainerSummaryResponseSchema = loosePlainObject({\n  createdAt: z.string(),\n  depth: nonNegativeIntegerSchema,\n  effectiveAccessLevel: EffectiveAccessLevelSchema,\n  id: z.string(),\n  metadataAccessEpoch: z.number(),\n  metadataAccessStateHash: nonEmptyStringSchema,\n  metadataDocumentId: z.string(),\n  metadataReferencedPrincipals: arraySchema(\n    ReferencedPrincipalStateResponseSchema,\n  ),\n  organizationId: z.string(),\n  parentId: z.string().nullable(),\n  systemSlot: ContainerSystemSlotSchema.nullable().optional(),\n  updatedAt: z.string(),\n});\n\nexport type ContainerSummary = z.infer<typeof ContainerSummaryResponseSchema>;\n\nexport const ContainerSyncTombstoneResponseSchema = loosePlainObject({\n  containerId: z.string(),\n  depth: nonNegativeIntegerSchema,\n  parentId: z.string().nullable(),\n  reason: z.literal([\"access_revoked\", \"deleted\"]),\n  updatedAt: z.string(),\n});\n\nexport type ContainerSyncTombstone = z.infer<\n  typeof ContainerSyncTombstoneResponseSchema\n>;\n\nexport const ListContainersResponseSchema = loosePlainObject({\n  hasMore: z.boolean(),\n  items: arraySchema(ContainerSummaryResponseSchema),\n  nextWatermark: SyncWatermarkSchema.nullable(),\n  tombstones: arraySchema(ContainerSyncTombstoneResponseSchema),\n});\n\nexport type ListContainersResponse = z.infer<\n  typeof ListContainersResponseSchema\n>;\n\nexport function isListContainersResponse(\n  value: unknown,\n): value is ListContainersResponse {\n  return ListContainersResponseSchema.safeParse(value).success;\n}\n\nexport function isContainerMutationResponse(\n  value: unknown,\n): value is ContainerMutationResponse {\n  return ContainerMutationResponseSchema.safeParse(value).success;\n}\n\nexport function isContainerDeleteResponse(\n  value: unknown,\n): value is ContainerDeleteResponse {\n  return ContainerDeleteResponseSchema.safeParse(value).success;\n}\n\nexport function isContainerWriterProjectionResponse(\n  value: unknown,\n): value is ContainerWriterProjectionResponse {\n  return ContainerWriterProjectionResponseSchema.safeParse(value).success;\n}\n\nexport function isContainerWriterProjectionWireResponse(\n  value: unknown,\n): value is ContainerWriterProjectionWireResponse {\n  return ContainerWriterProjectionWireResponseSchema.safeParse(value).success;\n}\n"]}
+{"version":3,"file":"container.js","sourceRoot":"","sources":["container.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,sCAAsC,EAAE,MAAM,6BAA6B,CAAC;AACrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,oCAAoC,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,kDAAkD,EAAE,MAAM,wCAAwC,CAAC;AAC5G,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,sCAAsC,EACtC,4BAA4B,EAC5B,mCAAmC,EACnC,mCAAmC,GACpC,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,+CAA+C,EAC/C,yCAAyC,GAC1C,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,2BAA2B,EAC3B,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,sCAAsC,EACtC,qCAAqC,GACtC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,sCAAsC,EAAE,MAAM,4BAA4B,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD,MAAM,0CAA0C,GAAG,gBAAgB,CAAC;IAClE,GAAG,qCAAqC;IACxC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;CAClC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,qCAAqC,GACzC,mCAAmC,CAAC;AAMtC,MAAM,yBAAyB,GAAG;IAChC,kBAAkB,EAAE,oBAAoB;IACxC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,iBAAiB,EAAE,qBAAqB;IACxC,mBAAmB,EAAE,oBAAoB;IACzC,wBAAwB,EAAE,WAAW,CAAC,sCAAsC,CAAC;IAC7E,QAAQ,EAAE,iBAAiB;IAC3B,YAAY,EAAE,oBAAoB;IAClC,OAAO,EAAE,qCAAqC,CAAC,QAAQ,EAAE;IACzD,aAAa,EAAE,oBAAoB;IACnC,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChD,gBAAgB,EAAE,mBAAmB,CAAC,iBAAiB,CAAC;IACxD,KAAK,EAAE,mBAAmB,CAAC,iBAAiB,CAAC;CAC9C,CAAC;AAEF,SAAS,yBAAyB,CAChC,KAAwE,EACxE,OAAwB;IAExB,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,KAAK,CAAC,CAAC,EAAE,CAAC;QACjE,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,mDAAmD;YAC5D,IAAI,EAAE,CAAC,SAAS,CAAC;SAClB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,0BAA0B,GAAG,oCAAoC,CACrE,gBAAgB,CAAC,yBAAyB,CAAC,CAAC,WAAW,CACrD,yBAAyB,CAC1B,EACD,CAAC,kDAAkD,CAAC,CACrD,CAAC;AAEF,0EAA0E;AAC1E,MAAM,8BAA8B,GAAG,oCAAoC,CACzE,gBAAgB,CAAC;IACf,GAAG,yBAAyB;IAC5B,wBAAwB,EAAE,WAAW,CAAC,2BAA2B,CAAC;CACnE,CAAC,CAAC,WAAW,CAAC,yBAAyB,CAAC,EACzC,CAAC,kDAAkD,CAAC,CACrD,CAAC;AASF,MAAM,UAAU,uBAAuB,CACrC,KAAc;IAEd,OAAO,CACL,8BAA8B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO;QACvD,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,CAC7C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,YAAY,CAAC;IACzD,WAAW,EAAE,qBAAqB;IAClC,wBAAwB,EAAE,WAAW,CAAC,2BAA2B,CAAC;CACnE,CAAC,CAAC;AAMH,MAAM,UAAU,wBAAwB,CACtC,KAAc;IAEd,OAAO,4BAA4B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC/D,CAAC;AAED,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC;IAC5C,4BAA4B;IAC5B,8BAA8B;CAC/B,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,gBAAgB,CAAC;IACjE,kBAAkB,EAAE,oBAAoB;IACxC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACpC,iBAAiB,EAAE,qBAAqB;IACxC,mBAAmB,EAAE,oBAAoB;IACzC,OAAO,EAAE,qCAAqC,CAAC,QAAQ,EAAE;IACzD,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChD;;;OAGG;IACH,KAAK,EAAE,WAAW,CAAC,iBAAiB,EAAE,mCAAmC,CAAC;CAC3E,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,6BAA6B,GACxC,oCAAoC,CAClC,gBAAgB,CAAC;IACf,WAAW,EAAE,oBAAoB;IACjC,MAAM,EAAE,WAAW,CACjB,kCAAkC,EAClC,4BAA4B,CAC7B;IACD,+DAA+D;IAC/D,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE;IACrC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChE,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,qDAAqD;YAC9D,IAAI,EAAE,CAAC,QAAQ,CAAC;SACjB,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,EACF,CAAC,sCAAsC,CAAC,CACzC,CAAC;AAMJ,MAAM,UAAU,yBAAyB,CACvC,KAAc;IAEd,OAAO,6BAA6B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAChE,CAAC;AAED,MAAM,sCAAsC,GAAG;IAC7C,cAAc,EAAE,sCAAsC;IACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,YAAY,EAAE,gBAAgB,CAAC;QAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;KACzB,CAAC;IACF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,wBAAwB,EAAE,WAAW,CACnC,0CAA0C,CAC3C;IACD,UAAU,EAAE,yBAAyB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC;AAEF,oFAAoF;AACpF,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,+BAA+B,EAAE,GACvE,sCAAsC,CAAC;AAEzC,MAAM,8BAA8B,GAAG;IACrC,cAAc;IACd,WAAW;IACX,YAAY,EAAE,0BAA0B;IACxC,GAAG,+BAA+B;CACnC,CAAC;AAEF,MAAM,CAAC,MAAM,+BAA+B,GAAG,gBAAgB,CAC7D,8BAA8B,CAC/B,CAAC;AAMF,iFAAiF;AACjF,MAAM,CAAC,MAAM,+BAA+B,GAAG,gBAAgB,CAAC;IAC9D,GAAG,8BAA8B;IACjC,eAAe,EAAE,WAAW,CAAC,+BAA+B,CAAC,CAAC,QAAQ,EAAE;CACzE,CAAC,CAAC;AAMH,MAAM,UAAU,2BAA2B,CACzC,KAAc;IAEd,OAAO,+BAA+B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,MAAM,6BAA6B,GAAG,gBAAgB,CAC3D,sCAAsC,CACvC,CAAC;AAKF,MAAM,UAAU,yBAAyB,CACvC,KAAc;IAEd,OAAO,6BAA6B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,MAAM,6BAA6B,GAAG,gBAAgB,CAAC;IAC5D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,6CAA6C,GACxD,oCAAoC,CAAC;AACvC,MAAM,CAAC,MAAM,4CAA4C,GAAG,gBAAgB,CAAC;IAC3E,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,6CAA6C,CAAC;IAC9D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,aAAa,EAAE,WAAW,CAAC,0BAA0B,CAAC;IACtD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,mBAAmB,CAAC,sCAAsC,CAAC;CAClE,CAAC;AACF,SAAS,yBAAyB,CAChC,UAAyD,EACzD,OAAwB;IAExB,8EAA8E;IAC9E,IACE,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC;QACvC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QAC9B,UAAU,CAAC,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI,CAAC,MAAM;QAE1D,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,yDAAyD;YAClE,IAAI,EAAE,CAAC,eAAe,CAAC;SACxB,CAAC,CAAC;AACP,CAAC;AACD,MAAM,CAAC,MAAM,iCAAiC,GAC5C,oCAAoC,CAClC,gBAAgB,CAAC,wBAAwB,CAAC,CAAC,WAAW,CACpD,yBAAyB,CAC1B,EACD,CAAC,+CAA+C,CAAC,CAClD,CAAC;AAIJ;;;GAGG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAClD,oCAAoC,CAClC,gBAAgB,CAAC;IACf,GAAG,wBAAwB;IAC3B,cAAc,EAAE,sCAAsC;CACvD,CAAC,CAAC,WAAW,CAAC,yBAAyB,CAAC,EACzC,CAAC,+CAA+C,CAAC,CAClD,CAAC;AAMJ,MAAM,4BAA4B,GAAG;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,aAAa,EAAE,WAAW,CAAC,6BAA6B,CAAC;IACzD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,mBAAmB,CAAC,2BAA2B,CAAC;CACvD,CAAC;AACF,MAAM,CAAC,MAAM,qCAAqC,GAChD,oCAAoC,CAClC,gBAAgB,CAAC,4BAA4B,CAAC,CAAC,WAAW,CACxD,yBAAyB,CAC1B,EACD,CAAC,+CAA+C,CAAC,CAClD,CAAC;AAKJ;;;GAGG;AACH,MAAM,CAAC,MAAM,2CAA2C,GACtD,oCAAoC,CAClC,gBAAgB,CAAC;IACf,OAAO,EAAE,qBAAqB;IAC9B,cAAc,EAAE,4BAA4B;IAC5C,GAAG,4BAA4B;IAC/B,cAAc,EAAE,sCAAsC;CACvD,CAAC,CAAC,WAAW,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE;IACrC,yBAAyB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC/C,8BAA8B,CAC5B,UAAU,EACV,6BAA6B,CAAC,UAAU,CAAC,EACzC,OAAO,CACR,CAAC;AACJ,CAAC,CAAC,EACF;IACE,+CAA+C;IAC/C,yCAAyC;CAC1C,CACF,CAAC;AAMJ,MAAM,CAAC,MAAM,8BAA8B,GAAG,gBAAgB,CAAC;IAC7D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,wBAAwB;IAC/B,oBAAoB,EAAE,0BAA0B;IAChD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,uBAAuB,EAAE,oBAAoB;IAC7C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC9B,4BAA4B,EAAE,WAAW,CACvC,sCAAsC,CACvC;IACD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,UAAU,EAAE,yBAAyB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oCAAoC,GAAG,gBAAgB,CAAC;IACnE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,wBAAwB;IAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,4BAA4B,GAAG,gBAAgB,CAAC;IAC3D,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,KAAK,EAAE,WAAW,CAAC,8BAA8B,CAAC;IAClD,aAAa,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC7C,UAAU,EAAE,WAAW,CAAC,oCAAoC,CAAC;CAC9D,CAAC,CAAC;AAMH,MAAM,UAAU,wBAAwB,CACtC,KAAc;IAEd,OAAO,4BAA4B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,KAAc;IAEd,OAAO,+BAA+B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAAc;IAEd,OAAO,6BAA6B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,KAAc;IAEd,OAAO,uCAAuC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,KAAc;IAEd,OAAO,2CAA2C,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC9E,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { containerKekLogSingleKeyringRefinement } from \"../containerReadRefinements\";\nimport { ContainerSystemSlotSchema } from \"../containerSystemSlot\";\nimport { registerJsonSchemaRuntimeRefinements } from \"../jsonSchema\";\nimport { organizationProvisioningContainerKeyringRefinement } from \"../organizationProvisioningRefinements\";\nimport {\n  arraySchema,\n  loosePlainObject,\n  nonEmptyArraySchema,\n  nonEmptyStringSchema,\n  nonNegativeIntegerSchema,\n  plainObjectSchema,\n  positiveIntegerSchema,\n  sha256HexStringSchema,\n} from \"../schema\";\nimport {\n  AccessManifestBundleWireResponseSchema,\n  CONTAINER_KEK_LOG_PAGE_LIMIT,\n  CONTAINER_KEK_WRAPS_PER_EPOCH_LIMIT,\n  ContainerKekKeyringWireRecordSchema,\n} from \"../util\";\nimport {\n  containerWriterProjectionPathKekCountRefinement,\n  writerProjectionManifestBundlesRefinement,\n} from \"../writerProjectionRefinements\";\nimport { EffectiveAccessLevelSchema } from \"./accessLevel\";\nimport {\n  containerKeyingPathReferences,\n  ManifestBundlesSchema,\n  ManifestHashReferenceSchema,\n  OmittedManifestBundlesSchema,\n  refineManifestBundleReferences,\n} from \"./manifestBundleReferences\";\nimport {\n  ReferencedPrincipalStateResponseSchema,\n  ReferencedPrincipalStateResponseShape,\n} from \"./principalReference\";\nimport { ProjectionPolicyEvidenceResponseSchema } from \"./projectionPolicyEvidence\";\nimport { SyncWatermarkSchema } from \"./syncWatermark\";\n\nconst ContainerGrantPrincipalStateResponseSchema = loosePlainObject({\n  ...ReferencedPrincipalStateResponseShape,\n  principalType: z.literal(\"group\"),\n});\n\n/**\n * The container's sealed predecessor key history. Opening it under the\n * current KEK yields every retained historical KEK in one decrypt; the\n * bridge log behind it is served only by the rebuild read path.\n */\nconst ContainerKekKeyringWireResponseSchema =\n  ContainerKekKeyringWireRecordSchema;\n\nexport type ContainerKekKeyringWireResponse = z.infer<\n  typeof ContainerKekKeyringWireResponseSchema\n>;\n\nconst containerKekResponseShape = {\n  accessManifestHash: nonEmptyStringSchema,\n  containerId: z.string(),\n  containerKeyEpoch: positiveIntegerSchema,\n  containerKeyEpochId: nonEmptyStringSchema,\n  containerManifestHistory: arraySchema(AccessManifestBundleWireResponseSchema),\n  keyEpoch: plainObjectSchema,\n  keyEpochHash: nonEmptyStringSchema,\n  keyring: ContainerKekKeyringWireResponseSchema.nullable(),\n  keyTargetHash: nonEmptyStringSchema,\n  parentContainerKeyEpochId: z.string().nullable(),\n  recipientTargets: nonEmptyArraySchema(plainObjectSchema),\n  wraps: nonEmptyArraySchema(plainObjectSchema),\n};\n\nfunction refineContainerKekKeyring(\n  value: { readonly containerKeyEpoch: number; readonly keyring: unknown },\n  context: z.RefinementCtx,\n) {\n  if ((value.keyring === null) !== (value.containerKeyEpoch === 1)) {\n    context.addIssue({\n      code: \"custom\",\n      message: \"container keyring must be null exactly at epoch 1\",\n      path: [\"keyring\"],\n    });\n  }\n}\n\nconst ContainerKekResponseSchema = registerJsonSchemaRuntimeRefinements(\n  loosePlainObject(containerKekResponseShape).superRefine(\n    refineContainerKekKeyring,\n  ),\n  [organizationProvisioningContainerKeyringRefinement],\n);\n\n/** On the writer-projection wire, KEK history cites manifests by hash. */\nconst ContainerKekWireResponseSchema = registerJsonSchemaRuntimeRefinements(\n  loosePlainObject({\n    ...containerKekResponseShape,\n    containerManifestHistory: arraySchema(ManifestHashReferenceSchema),\n  }).superRefine(refineContainerKekKeyring),\n  [organizationProvisioningContainerKeyringRefinement],\n);\n\nexport type ContainerKekResponse = z.infer<typeof ContainerKekResponseSchema>;\n\n/** One KEK level as served in full, its manifest history cited by hash. */\nexport type ContainerKekWireLevel = z.infer<\n  typeof ContainerKekWireResponseSchema\n>;\n\nexport function isContainerKekWireLevel(\n  value: unknown,\n): value is ContainerKekWireLevel {\n  return (\n    ContainerKekWireResponseSchema.safeParse(value).success &&\n    !Object.hasOwn(Object(value), \"levelDigest\")\n  );\n}\n\n/**\n * A KEK level the request declared held (`k:` hint), replaced by the digest\n * of its canonical wire bytes. It keeps the level's manifest citations, so\n * the response's bundle bookkeeping stays exact; the client refills the\n * level from those exact held bytes before anything reads it.\n */\nexport const CitedContainerKekLevelSchema = z.strictObject({\n  levelDigest: sha256HexStringSchema,\n  containerManifestHistory: arraySchema(ManifestHashReferenceSchema),\n});\n\nexport type CitedContainerKekLevel = z.infer<\n  typeof CitedContainerKekLevelSchema\n>;\n\nexport function isCitedContainerKekLevel(\n  value: unknown,\n): value is CitedContainerKekLevel {\n  return CitedContainerKekLevelSchema.safeParse(value).success;\n}\n\nconst ServedContainerKekLevelSchema = z.union([\n  CitedContainerKekLevelSchema,\n  ContainerKekWireResponseSchema,\n]);\n\n/**\n * The append-only rotation log for one container: every epoch with its\n * write-once bridge and sealed keyring. This is the rebuild/repair read\n * path — hot reads use the projection keyring instead.\n */\nexport const ContainerKekLogEpochResponseSchema = loosePlainObject({\n  accessManifestHash: nonEmptyStringSchema,\n  bridge: plainObjectSchema.nullable(),\n  containerKeyEpoch: positiveIntegerSchema,\n  containerKeyEpochId: nonEmptyStringSchema,\n  keyring: ContainerKekKeyringWireResponseSchema.nullable(),\n  parentContainerKeyEpochId: z.string().nullable(),\n  /**\n   * Retained recipient envelopes are the recovery backstop when a bridge is\n   * severed. The server and response guard apply this bound per epoch.\n   */\n  wraps: arraySchema(plainObjectSchema, CONTAINER_KEK_WRAPS_PER_EPOCH_LIMIT),\n});\n\nexport type ContainerKekLogEpochResponse = z.infer<\n  typeof ContainerKekLogEpochResponseSchema\n>;\n\nexport const ContainerKekLogResponseSchema =\n  registerJsonSchemaRuntimeRefinements(\n    loosePlainObject({\n      containerId: nonEmptyStringSchema,\n      epochs: arraySchema(\n        ContainerKekLogEpochResponseSchema,\n        CONTAINER_KEK_LOG_PAGE_LIMIT,\n      ),\n      /** True when epochs above this page's last remain unserved. */\n      hasMore: z.boolean(),\n    }).superRefine(({ epochs }, context) => {\n      if (epochs.filter((epoch) => epoch.keyring !== null).length > 1) {\n        context.addIssue({\n          code: \"custom\",\n          message: \"container KEK log pages contain at most one keyring\",\n          path: [\"epochs\"],\n        });\n      }\n    }),\n    [containerKekLogSingleKeyringRefinement],\n  );\n\nexport type ContainerKekLogResponse = z.infer<\n  typeof ContainerKekLogResponseSchema\n>;\n\nexport function isContainerKekLogResponse(\n  value: unknown,\n): value is ContainerKekLogResponse {\n  return ContainerKekLogResponseSchema.safeParse(value).success;\n}\n\nconst ContainerManifestMutationResponseShape = {\n  accessManifest: AccessManifestBundleWireResponseSchema,\n  containerId: z.string(),\n  createdAt: z.string(),\n  manifestHead: loosePlainObject({\n    epoch: z.number(),\n    manifestHash: z.string(),\n  }),\n  organizationId: z.string(),\n  parentId: z.string().nullable(),\n  referencedPrincipalHeads: arraySchema(\n    ContainerGrantPrincipalStateResponseSchema,\n  ),\n  systemSlot: ContainerSystemSlotSchema.nullable().optional(),\n  updatedAt: z.string(),\n};\n\n// Preserve the canonical generated field order while sharing the signed-head shape.\nconst { accessManifest, containerId, ...containerMutationResponseFields } =\n  ContainerManifestMutationResponseShape;\n\nconst containerMutationResponseShape = {\n  accessManifest,\n  containerId,\n  containerKek: ContainerKekResponseSchema,\n  ...containerMutationResponseFields,\n};\n\nexport const ContainerMutationResponseSchema = loosePlainObject(\n  containerMutationResponseShape,\n);\n\nexport type ContainerMutationResponse = z.infer<\n  typeof ContainerMutationResponseSchema\n>;\n\n/** A rotation's acknowledgement, plus one per carried rekey in request order. */\nexport const ContainerRotationResponseSchema = loosePlainObject({\n  ...containerMutationResponseShape,\n  containerRekeys: arraySchema(ContainerMutationResponseSchema).optional(),\n});\n\nexport type ContainerRotationResponse = z.infer<\n  typeof ContainerRotationResponseSchema\n>;\n\nexport function isContainerRotationResponse(\n  value: unknown,\n): value is ContainerRotationResponse {\n  return ContainerRotationResponseSchema.safeParse(value).success;\n}\n\nexport const ContainerReciteResponseSchema = loosePlainObject(\n  ContainerManifestMutationResponseShape,\n);\nexport type ContainerReciteResponse = z.infer<\n  typeof ContainerReciteResponseSchema\n>;\n\nexport function isContainerReciteResponse(\n  value: unknown,\n): value is ContainerReciteResponse {\n  return ContainerReciteResponseSchema.safeParse(value).success;\n}\n\nexport const ContainerDeleteResponseSchema = loosePlainObject({\n  containerId: z.string(),\n  deletedAt: z.string(),\n});\n\nexport type ContainerDeleteResponse = z.infer<\n  typeof ContainerDeleteResponseSchema\n>;\n\nexport const CONTAINER_PROJECTION_STATE_INVALID_ERROR_CODE =\n  \"container_projection_state_invalid\";\nexport const ContainerWriterProjectionErrorResponseSchema = loosePlainObject({\n  code: z.literal(CONTAINER_PROJECTION_STATE_INVALID_ERROR_CODE),\n  error: z.string(),\n});\n\nconst containerKeyingPathShape = {\n  containerId: z.string(),\n  containerKeks: arraySchema(ContainerKekResponseSchema),\n  organizationId: z.string(),\n  path: nonEmptyArraySchema(AccessManifestBundleWireResponseSchema),\n};\nfunction refineContainerKeyingPath(\n  projection: { containerKeks: unknown[]; path: unknown[] },\n  context: z.RefinementCtx,\n) {\n  // loosePlainObject can continue refinements after reporting malformed fields.\n  if (\n    Array.isArray(projection.containerKeks) &&\n    Array.isArray(projection.path) &&\n    projection.containerKeks.length !== projection.path.length\n  )\n    context.addIssue({\n      code: \"custom\",\n      message: \"container KEK count must match the manifest path length\",\n      path: [\"containerKeks\"],\n    });\n}\nexport const ContainerKeyingPathResponseSchema =\n  registerJsonSchemaRuntimeRefinements(\n    loosePlainObject(containerKeyingPathShape).superRefine(\n      refineContainerKeyingPath,\n    ),\n    [containerWriterProjectionPathKekCountRefinement],\n  );\nexport type ContainerKeyingPathResponse = z.infer<\n  typeof ContainerKeyingPathResponseSchema\n>;\n/**\n * The decoded projection a client verifies: every manifest position holds\n * its bundle. `decodeContainerWriterProjection` builds it from the wire.\n */\nexport const ContainerWriterProjectionResponseSchema =\n  registerJsonSchemaRuntimeRefinements(\n    loosePlainObject({\n      ...containerKeyingPathShape,\n      policyEvidence: ProjectionPolicyEvidenceResponseSchema,\n    }).superRefine(refineContainerKeyingPath),\n    [containerWriterProjectionPathKekCountRefinement],\n  );\n\nexport type ContainerWriterProjectionResponse = z.infer<\n  typeof ContainerWriterProjectionResponseSchema\n>;\n\nconst containerKeyingPathWireShape = {\n  containerId: z.string(),\n  containerKeks: arraySchema(ServedContainerKekLevelSchema),\n  organizationId: z.string(),\n  path: nonEmptyArraySchema(ManifestHashReferenceSchema),\n};\nexport const ContainerKeyingPathWireResponseSchema =\n  registerJsonSchemaRuntimeRefinements(\n    loosePlainObject(containerKeyingPathWireShape).superRefine(\n      refineContainerKeyingPath,\n    ),\n    [containerWriterProjectionPathKekCountRefinement],\n  );\nexport type ContainerKeyingPathWireResponse = z.infer<\n  typeof ContainerKeyingPathWireResponseSchema\n>;\n\n/**\n * The served shape: manifest positions cite `bundles` by hash, except hashes\n * the request declared already held, which `omittedBundles` lists instead.\n */\nexport const ContainerWriterProjectionWireResponseSchema =\n  registerJsonSchemaRuntimeRefinements(\n    loosePlainObject({\n      bundles: ManifestBundlesSchema,\n      omittedBundles: OmittedManifestBundlesSchema,\n      ...containerKeyingPathWireShape,\n      policyEvidence: ProjectionPolicyEvidenceResponseSchema,\n    }).superRefine((projection, context) => {\n      refineContainerKeyingPath(projection, context);\n      refineManifestBundleReferences(\n        projection,\n        containerKeyingPathReferences(projection),\n        context,\n      );\n    }),\n    [\n      containerWriterProjectionPathKekCountRefinement,\n      writerProjectionManifestBundlesRefinement,\n    ],\n  );\n\nexport type ContainerWriterProjectionWireResponse = z.infer<\n  typeof ContainerWriterProjectionWireResponseSchema\n>;\n\nexport const ContainerSummaryResponseSchema = loosePlainObject({\n  createdAt: z.string(),\n  depth: nonNegativeIntegerSchema,\n  effectiveAccessLevel: EffectiveAccessLevelSchema,\n  id: z.string(),\n  metadataAccessEpoch: z.number(),\n  metadataAccessStateHash: nonEmptyStringSchema,\n  metadataDocumentId: z.string(),\n  metadataReferencedPrincipals: arraySchema(\n    ReferencedPrincipalStateResponseSchema,\n  ),\n  organizationId: z.string(),\n  parentId: z.string().nullable(),\n  systemSlot: ContainerSystemSlotSchema.nullable().optional(),\n  updatedAt: z.string(),\n});\n\nexport type ContainerSummary = z.infer<typeof ContainerSummaryResponseSchema>;\n\nexport const ContainerSyncTombstoneResponseSchema = loosePlainObject({\n  containerId: z.string(),\n  depth: nonNegativeIntegerSchema,\n  parentId: z.string().nullable(),\n  reason: z.literal([\"access_revoked\", \"deleted\"]),\n  updatedAt: z.string(),\n});\n\nexport type ContainerSyncTombstone = z.infer<\n  typeof ContainerSyncTombstoneResponseSchema\n>;\n\nexport const ListContainersResponseSchema = loosePlainObject({\n  hasMore: z.boolean(),\n  items: arraySchema(ContainerSummaryResponseSchema),\n  nextWatermark: SyncWatermarkSchema.nullable(),\n  tombstones: arraySchema(ContainerSyncTombstoneResponseSchema),\n});\n\nexport type ListContainersResponse = z.infer<\n  typeof ListContainersResponseSchema\n>;\n\nexport function isListContainersResponse(\n  value: unknown,\n): value is ListContainersResponse {\n  return ListContainersResponseSchema.safeParse(value).success;\n}\n\nexport function isContainerMutationResponse(\n  value: unknown,\n): value is ContainerMutationResponse {\n  return ContainerMutationResponseSchema.safeParse(value).success;\n}\n\nexport function isContainerDeleteResponse(\n  value: unknown,\n): value is ContainerDeleteResponse {\n  return ContainerDeleteResponseSchema.safeParse(value).success;\n}\n\nexport function isContainerWriterProjectionResponse(\n  value: unknown,\n): value is ContainerWriterProjectionResponse {\n  return ContainerWriterProjectionResponseSchema.safeParse(value).success;\n}\n\nexport function isContainerWriterProjectionWireResponse(\n  value: unknown,\n): value is ContainerWriterProjectionWireResponse {\n  return ContainerWriterProjectionWireResponseSchema.safeParse(value).success;\n}\n"]}