@tearleads/client-sdk 0.1.18 → 0.1.20

package/internal/validators/response/principal.d.ts

@@ -2144,426 +2144,46 @@ export declare const CommitOrganizationGroupPolicyConflictResponseSchema: z.ZodU
 export declare const PrincipalPolicyStaleErrorResponseSchema: z.ZodType<{
     code: "principal_policy_stale";
     error: string;
-    principalPolicies: {
-        previousStates: {
-            grants: {
-                accessLevel: "admin" | "read" | "write";
-                containerId: string;
-            }[];
-            projection: {
-                role: "member" | "admin";
-                userId: string;
-            }[];
-            state: {
-                createdAt: string;
-                encapsulationPublicKey: string;
-                externalAuthority: {
-                    keyEpoch: number;
-                    keyFingerprint: string;
-                    principalId: string;
-                    principalType: "group";
-                    stateHash: string;
-                    version: number;
-                } | null;
-                grantCount: number;
-                grantRoot: string;
-                keyEpoch: number;
-                keyFingerprint: string;
-                memberCount: number;
-                memberEnvelopesRoot: string;
-                membershipMode: "projection";
-                membershipRoot: string;
-                payloadCiphertextHash: string;
-                prevStateHash: string | null;
-                principalId: string;
-                principalType: "group" | "organization";
-                projectionRoot: string;
-                signature: string;
-                signedAt: string;
-                signerUserId: string;
-                signerUserKeyFingerprint: string;
-                stateHash: string;
-                version: number;
-            };
-        }[];
-        currentGrants: {
-            accessLevel: "admin" | "read" | "write";
-            containerId: string;
-        }[];
-        currentMemberEnvelopes: {
-            envelopes: {
-                kemCipherText: string;
-                memberKeyFingerprint: string;
-                userId: string;
-                wrappedKey: string;
-            }[];
-            epoch: number;
-            principalId: string;
-            principalType: "group" | "organization";
-            stateHash: string;
-        };
-        currentPayload: {
-            cipherSuite: "aes-256-gcm";
-            ciphertext: string;
-            ciphertextHash: string;
-            createdAt: string;
-            principalId: string;
-            principalType: "group" | "organization";
-            stateHash: string;
-        };
-        currentProjection: {
-            role: "member" | "admin";
-            userId: string;
-        }[];
-        currentState: {
-            createdAt: string;
-            encapsulationPublicKey: string;
-            externalAuthority: {
-                keyEpoch: number;
-                keyFingerprint: string;
-                principalId: string;
-                principalType: "group";
-                stateHash: string;
-                version: number;
-            } | null;
-            grantCount: number;
-            grantRoot: string;
-            keyEpoch: number;
-            keyFingerprint: string;
-            memberCount: number;
-            memberEnvelopesRoot: string;
-            membershipMode: "projection";
-            membershipRoot: string;
-            payloadCiphertextHash: string;
-            prevStateHash: string | null;
-            principalId: string;
-            principalType: "group" | "organization";
-            projectionRoot: string;
-            signature: string;
-            signedAt: string;
-            signerUserId: string;
-            signerUserKeyFingerprint: string;
-            stateHash: string;
-            version: number;
-        };
+    principalHeads: {
+        keyEpoch: number;
+        keyFingerprint: string;
+        principalId: string;
+        principalType: "group" | "organization";
+        stateHash: string;
+        version: number;
     }[];
 }, {
     code: "principal_policy_stale";
     error: string;
-    principalPolicies: {
-        previousStates: {
-            grants: {
-                accessLevel: "admin" | "read" | "write";
-                containerId: string;
-            }[];
-            projection: {
-                role: "member" | "admin";
-                userId: string;
-            }[];
-            state: {
-                createdAt: string;
-                encapsulationPublicKey: string;
-                externalAuthority: {
-                    keyEpoch: number;
-                    keyFingerprint: string;
-                    principalId: string;
-                    principalType: "group";
-                    stateHash: string;
-                    version: number;
-                } | null;
-                grantCount: number;
-                grantRoot: string;
-                keyEpoch: number;
-                keyFingerprint: string;
-                memberCount: number;
-                memberEnvelopesRoot: string;
-                membershipMode: "projection";
-                membershipRoot: string;
-                payloadCiphertextHash: string;
-                prevStateHash: string | null;
-                principalId: string;
-                principalType: "group" | "organization";
-                projectionRoot: string;
-                signature: string;
-                signedAt: string;
-                signerUserId: string;
-                signerUserKeyFingerprint: string;
-                stateHash: string;
-                version: number;
-            };
-        }[];
-        currentGrants: {
-            accessLevel: "admin" | "read" | "write";
-            containerId: string;
-        }[];
-        currentMemberEnvelopes: {
-            envelopes: {
-                kemCipherText: string;
-                memberKeyFingerprint: string;
-                userId: string;
-                wrappedKey: string;
-            }[];
-            epoch: number;
-            principalId: string;
-            principalType: "group" | "organization";
-            stateHash: string;
-        };
-        currentPayload: {
-            cipherSuite: "aes-256-gcm";
-            ciphertext: string;
-            ciphertextHash: string;
-            createdAt: string;
-            principalId: string;
-            principalType: "group" | "organization";
-            stateHash: string;
-        };
-        currentProjection: {
-            role: "member" | "admin";
-            userId: string;
-        }[];
-        currentState: {
-            createdAt: string;
-            encapsulationPublicKey: string;
-            externalAuthority: {
-                keyEpoch: number;
-                keyFingerprint: string;
-                principalId: string;
-                principalType: "group";
-                stateHash: string;
-                version: number;
-            } | null;
-            grantCount: number;
-            grantRoot: string;
-            keyEpoch: number;
-            keyFingerprint: string;
-            memberCount: number;
-            memberEnvelopesRoot: string;
-            membershipMode: "projection";
-            membershipRoot: string;
-            payloadCiphertextHash: string;
-            prevStateHash: string | null;
-            principalId: string;
-            principalType: "group" | "organization";
-            projectionRoot: string;
-            signature: string;
-            signedAt: string;
-            signerUserId: string;
-            signerUserKeyFingerprint: string;
-            stateHash: string;
-            version: number;
-        };
+    principalHeads: {
+        keyEpoch: number;
+        keyFingerprint: string;
+        principalId: string;
+        principalType: "group" | "organization";
+        stateHash: string;
+        version: number;
     }[];
 }, z.core.$ZodTypeInternals<{
     code: "principal_policy_stale";
     error: string;
-    principalPolicies: {
-        previousStates: {
-            grants: {
-                accessLevel: "admin" | "read" | "write";
-                containerId: string;
-            }[];
-            projection: {
-                role: "member" | "admin";
-                userId: string;
-            }[];
-            state: {
-                createdAt: string;
-                encapsulationPublicKey: string;
-                externalAuthority: {
-                    keyEpoch: number;
-                    keyFingerprint: string;
-                    principalId: string;
-                    principalType: "group";
-                    stateHash: string;
-                    version: number;
-                } | null;
-                grantCount: number;
-                grantRoot: string;
-                keyEpoch: number;
-                keyFingerprint: string;
-                memberCount: number;
-                memberEnvelopesRoot: string;
-                membershipMode: "projection";
-                membershipRoot: string;
-                payloadCiphertextHash: string;
-                prevStateHash: string | null;
-                principalId: string;
-                principalType: "group" | "organization";
-                projectionRoot: string;
-                signature: string;
-                signedAt: string;
-                signerUserId: string;
-                signerUserKeyFingerprint: string;
-                stateHash: string;
-                version: number;
-            };
-        }[];
-        currentGrants: {
-            accessLevel: "admin" | "read" | "write";
-            containerId: string;
-        }[];
-        currentMemberEnvelopes: {
-            envelopes: {
-                kemCipherText: string;
-                memberKeyFingerprint: string;
-                userId: string;
-                wrappedKey: string;
-            }[];
-            epoch: number;
-            principalId: string;
-            principalType: "group" | "organization";
-            stateHash: string;
-        };
-        currentPayload: {
-            cipherSuite: "aes-256-gcm";
-            ciphertext: string;
-            ciphertextHash: string;
-            createdAt: string;
-            principalId: string;
-            principalType: "group" | "organization";
-            stateHash: string;
-        };
-        currentProjection: {
-            role: "member" | "admin";
-            userId: string;
-        }[];
-        currentState: {
-            createdAt: string;
-            encapsulationPublicKey: string;
-            externalAuthority: {
-                keyEpoch: number;
-                keyFingerprint: string;
-                principalId: string;
-                principalType: "group";
-                stateHash: string;
-                version: number;
-            } | null;
-            grantCount: number;
-            grantRoot: string;
-            keyEpoch: number;
-            keyFingerprint: string;
-            memberCount: number;
-            memberEnvelopesRoot: string;
-            membershipMode: "projection";
-            membershipRoot: string;
-            payloadCiphertextHash: string;
-            prevStateHash: string | null;
-            principalId: string;
-            principalType: "group" | "organization";
-            projectionRoot: string;
-            signature: string;
-            signedAt: string;
-            signerUserId: string;
-            signerUserKeyFingerprint: string;
-            stateHash: string;
-            version: number;
-        };
+    principalHeads: {
+        keyEpoch: number;
+        keyFingerprint: string;
+        principalId: string;
+        principalType: "group" | "organization";
+        stateHash: string;
+        version: number;
     }[];
 }, {
     code: "principal_policy_stale";
     error: string;
-    principalPolicies: {
-        previousStates: {
-            grants: {
-                accessLevel: "admin" | "read" | "write";
-                containerId: string;
-            }[];
-            projection: {
-                role: "member" | "admin";
-                userId: string;
-            }[];
-            state: {
-                createdAt: string;
-                encapsulationPublicKey: string;
-                externalAuthority: {
-                    keyEpoch: number;
-                    keyFingerprint: string;
-                    principalId: string;
-                    principalType: "group";
-                    stateHash: string;
-                    version: number;
-                } | null;
-                grantCount: number;
-                grantRoot: string;
-                keyEpoch: number;
-                keyFingerprint: string;
-                memberCount: number;
-                memberEnvelopesRoot: string;
-                membershipMode: "projection";
-                membershipRoot: string;
-                payloadCiphertextHash: string;
-                prevStateHash: string | null;
-                principalId: string;
-                principalType: "group" | "organization";
-                projectionRoot: string;
-                signature: string;
-                signedAt: string;
-                signerUserId: string;
-                signerUserKeyFingerprint: string;
-                stateHash: string;
-                version: number;
-            };
-        }[];
-        currentGrants: {
-            accessLevel: "admin" | "read" | "write";
-            containerId: string;
-        }[];
-        currentMemberEnvelopes: {
-            envelopes: {
-                kemCipherText: string;
-                memberKeyFingerprint: string;
-                userId: string;
-                wrappedKey: string;
-            }[];
-            epoch: number;
-            principalId: string;
-            principalType: "group" | "organization";
-            stateHash: string;
-        };
-        currentPayload: {
-            cipherSuite: "aes-256-gcm";
-            ciphertext: string;
-            ciphertextHash: string;
-            createdAt: string;
-            principalId: string;
-            principalType: "group" | "organization";
-            stateHash: string;
-        };
-        currentProjection: {
-            role: "member" | "admin";
-            userId: string;
-        }[];
-        currentState: {
-            createdAt: string;
-            encapsulationPublicKey: string;
-            externalAuthority: {
-                keyEpoch: number;
-                keyFingerprint: string;
-                principalId: string;
-                principalType: "group";
-                stateHash: string;
-                version: number;
-            } | null;
-            grantCount: number;
-            grantRoot: string;
-            keyEpoch: number;
-            keyFingerprint: string;
-            memberCount: number;
-            memberEnvelopesRoot: string;
-            membershipMode: "projection";
-            membershipRoot: string;
-            payloadCiphertextHash: string;
-            prevStateHash: string | null;
-            principalId: string;
-            principalType: "group" | "organization";
-            projectionRoot: string;
-            signature: string;
-            signedAt: string;
-            signerUserId: string;
-            signerUserKeyFingerprint: string;
-            stateHash: string;
-            version: number;
-        };
+    principalHeads: {
+        keyEpoch: number;
+        keyFingerprint: string;
+        principalId: string;
+        principalType: "group" | "organization";
+        stateHash: string;
+        version: number;
     }[];
 }>>;
 export type PrincipalPolicyStaleErrorResponse = z.infer<typeof PrincipalPolicyStaleErrorResponseSchema>;

package/internal/validators/response/principal.js

@@ -1,9 +1,11 @@
 import { z } from "zod";
 import { arraySchema, loosePlainObject, nonEmptyStringSchema } from "../schema.js";
 import { MAX_ROTATION_CONTAINER_REKEYS } from "../util/index.js";
+import { PRINCIPAL_POLICY_REPAIR_HEAD_LIMIT } from "../util/principalHistoryWire.js";
 import { ContainerMutationResponseSchema } from "./container.js";
 import { CONTAINER_DESCENDANT_REKEYS_REQUIRED_ERROR_CODE } from "./descendantRekeysRequiredError.js";
 import { BillingErrorResponseSchema } from "./organizationBilling.js";
+import { ReferencedPrincipalStateResponseSchema } from "./principalReference.js";
 import { CurrentPrincipalMemberEnvelopesResponseSchema, PrincipalContainerGrantResponseSchema, PrincipalPolicyStateChainEntryResponseSchema, PrincipalProjectionMemberResponseSchema, PrincipalStatePayloadResponseSchema, PrincipalStateResponseSchema, } from "./principalSnapshot.js";
 export { CurrentPrincipalMemberEnvelopesResponseSchema, isCurrentPrincipalMemberEnvelopesResponse, isPrincipalPolicyStateChainEntryResponse, isPrincipalStatePayloadResponse, isPrincipalStateResponse, PrincipalContainerGrantResponseSchema, PrincipalMemberEnvelopeResponseSchema, PrincipalPolicySnapshotResponseSchema, PrincipalPolicyStateChainEntryResponseSchema, PrincipalProjectionMemberResponseSchema, PrincipalStateExternalAuthorityResponseSchema, PrincipalStatePayloadResponseSchema, PrincipalStateResponseSchema, } from "./principalSnapshot.js";
 export const principalPolicyCurrentResponseShape = {
@@ -49,7 +51,7 @@ export const CommitOrganizationGroupPolicyConflictResponseSchema = z.union([
 export const PrincipalPolicyStaleErrorResponseSchema = loosePlainObject({
     code: z.literal("principal_policy_stale"),
     error: z.string().min(1),
-    principalPolicies: arraySchema(PrincipalPolicyBundleResponseSchema),
+    principalHeads: arraySchema(ReferencedPrincipalStateResponseSchema, PRINCIPAL_POLICY_REPAIR_HEAD_LIMIT),
 });
 export function isPrincipalPolicyBundleResponse(value) {
     return PrincipalPolicyBundleResponseSchema.safeParse(value).success;

package/internal/validators/response/principal.js.map

@@ -1 +1 @@
-{"version":3,"file":"principal.js","sourceRoot":"","sources":["principal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,MAAM,SAAS,CAAC;AACxD,OAAO,EAAE,+BAA+B,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,+CAA+C,EAAE,MAAM,iCAAiC,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAEnE,OAAO,EACL,6CAA6C,EAC7C,qCAAqC,EACrC,4CAA4C,EAC5C,uCAAuC,EACvC,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAEL,6CAA6C,EAC7C,yCAAyC,EACzC,wCAAwC,EACxC,+BAA+B,EAC/B,wBAAwB,EAExB,qCAAqC,EAErC,qCAAqC,EAErC,qCAAqC,EAErC,4CAA4C,EAE5C,uCAAuC,EAEvC,6CAA6C,EAE7C,mCAAmC,EAEnC,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,MAAM,CAAC,MAAM,mCAAmC,GAAG;IACjD,aAAa,EAAE,WAAW,CAAC,qCAAqC,CAAC;IACjE,sBAAsB,EAAE,6CAA6C;IACrE,cAAc,EAAE,mCAAmC;IACnD,iBAAiB,EAAE,WAAW,CAAC,uCAAuC,CAAC;IACvE,YAAY,EAAE,4BAA4B;CAC3C,CAAC;AAEF,MAAM,CAAC,MAAM,mCAAmC,GAAG,gBAAgB,CAAC;IAClE,GAAG,mCAAmC;IACtC,cAAc,EAAE,WAAW,CAAC,4CAA4C,CAAC;CAC1E,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,qCAAqC,GAAG,gBAAgB,CAAC;IACpE,GAAG,mCAAmC;IACtC,kBAAkB,EAAE,WAAW,CAAC,+BAA+B,CAAC;CACjE,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,2CAA2C,GAAG,gBAAgB,CAAC;IAC1E,WAAW,EAAE,qCAAqC;IAClD,kBAAkB,EAAE,qCAAqC;CAC1D,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,kCAAkC,GAAG,0BAA0B,CAAC;AAM7E;;;;;GAKG;AACH,MAAM,qDAAqD,GAAG,gBAAgB,CAAC;IAC7E,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,+CAA+C,CAAC;IAChE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,oBAAoB,EAAE,WAAW,CAC/B,oBAAoB,EACpB,6BAA6B,CAC9B;CACF,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,CAAC,KAAK,CAAC;IACzE,kCAAkC;IAClC,qDAAqD;CACtD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uCAAuC,GAAG,gBAAgB,CAAC;IACtE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,iBAAiB,EAAE,WAAW,CAAC,mCAAmC,CAAC;CACpE,CAAC,CAAC;AAMH,MAAM,UAAU,+BAA+B,CAC7C,KAAc;IAEd,OAAO,mCAAmC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,KAAc;IAEd,OAAO,qCAAqC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,KAAc;IAEd,OAAO,2CAA2C,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,KAAc;IAEd,OAAO,uCAAuC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC1E,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { arraySchema, loosePlainObject, nonEmptyStringSchema } from \"../schema\";\nimport { MAX_ROTATION_CONTAINER_REKEYS } from \"../util\";\nimport { ContainerMutationResponseSchema } from \"./container\";\nimport { CONTAINER_DESCENDANT_REKEYS_REQUIRED_ERROR_CODE } from \"./descendantRekeysRequiredError\";\nimport { BillingErrorResponseSchema } from \"./organizationBilling\";\n\nimport {\n  CurrentPrincipalMemberEnvelopesResponseSchema,\n  PrincipalContainerGrantResponseSchema,\n  PrincipalPolicyStateChainEntryResponseSchema,\n  PrincipalProjectionMemberResponseSchema,\n  PrincipalStatePayloadResponseSchema,\n  PrincipalStateResponseSchema,\n} from \"./principalSnapshot\";\n\nexport {\n  type CurrentPrincipalMemberEnvelopesResponse,\n  CurrentPrincipalMemberEnvelopesResponseSchema,\n  isCurrentPrincipalMemberEnvelopesResponse,\n  isPrincipalPolicyStateChainEntryResponse,\n  isPrincipalStatePayloadResponse,\n  isPrincipalStateResponse,\n  type PrincipalContainerGrantResponse,\n  PrincipalContainerGrantResponseSchema,\n  type PrincipalMemberEnvelopeResponse,\n  PrincipalMemberEnvelopeResponseSchema,\n  type PrincipalPolicySnapshotResponse,\n  PrincipalPolicySnapshotResponseSchema,\n  type PrincipalPolicyStateChainEntryResponse,\n  PrincipalPolicyStateChainEntryResponseSchema,\n  type PrincipalProjectionMemberResponse,\n  PrincipalProjectionMemberResponseSchema,\n  type PrincipalStateExternalAuthorityResponse,\n  PrincipalStateExternalAuthorityResponseSchema,\n  type PrincipalStatePayloadResponse,\n  PrincipalStatePayloadResponseSchema,\n  type PrincipalStateResponse,\n  PrincipalStateResponseSchema,\n} from \"./principalSnapshot\";\n\nexport const principalPolicyCurrentResponseShape = {\n  currentGrants: arraySchema(PrincipalContainerGrantResponseSchema),\n  currentMemberEnvelopes: CurrentPrincipalMemberEnvelopesResponseSchema,\n  currentPayload: PrincipalStatePayloadResponseSchema,\n  currentProjection: arraySchema(PrincipalProjectionMemberResponseSchema),\n  currentState: PrincipalStateResponseSchema,\n};\n\nexport const PrincipalPolicyBundleResponseSchema = loosePlainObject({\n  ...principalPolicyCurrentResponseShape,\n  previousStates: arraySchema(PrincipalPolicyStateChainEntryResponseSchema),\n});\n\nexport type PrincipalPolicyBundleResponse = z.infer<\n  typeof PrincipalPolicyBundleResponseSchema\n>;\n\nexport const PrincipalPolicyMutationResponseSchema = loosePlainObject({\n  ...principalPolicyCurrentResponseShape,\n  containerMutations: arraySchema(ContainerMutationResponseSchema),\n});\n\nexport type PrincipalPolicyMutationResponse = z.infer<\n  typeof PrincipalPolicyMutationResponseSchema\n>;\n\nexport const CommitOrganizationGroupPolicyResponseSchema = loosePlainObject({\n  groupPolicy: PrincipalPolicyMutationResponseSchema,\n  organizationPolicy: PrincipalPolicyMutationResponseSchema,\n});\n\nexport type CommitOrganizationGroupPolicyResponse = z.infer<\n  typeof CommitOrganizationGroupPolicyResponseSchema\n>;\n\nexport const PrincipalPolicyErrorResponseSchema = BillingErrorResponseSchema;\n\nexport type PrincipalPolicyErrorResponse = z.infer<\n  typeof PrincipalPolicyErrorResponseSchema\n>;\n\n/**\n * A group policy change rematerializes its granted containers, and a rekey or\n * revoke among them is a rotation like any other: one that would leave a level\n * above a directly granted container pinned to a retired epoch is refused, and\n * this names the descendant rekeys the batch must carry, parent-first.\n */\nconst PrincipalPolicyDescendantRekeysRequiredResponseSchema = loosePlainObject({\n  code: z.literal(CONTAINER_DESCENDANT_REKEYS_REQUIRED_ERROR_CODE),\n  error: z.string().min(1),\n  requiredContainerIds: arraySchema(\n    nonEmptyStringSchema,\n    MAX_ROTATION_CONTAINER_REKEYS,\n  ),\n});\n\n/**\n * The commit's conflict envelope alone: only a group commit carries container\n * mutations, so only it can be refused for what they strand. The principal\n * policy read and the organization policy write keep the plain envelope.\n */\nexport const CommitOrganizationGroupPolicyConflictResponseSchema = z.union([\n  PrincipalPolicyErrorResponseSchema,\n  PrincipalPolicyDescendantRekeysRequiredResponseSchema,\n]);\n\nexport const PrincipalPolicyStaleErrorResponseSchema = loosePlainObject({\n  code: z.literal(\"principal_policy_stale\"),\n  error: z.string().min(1),\n  principalPolicies: arraySchema(PrincipalPolicyBundleResponseSchema),\n});\n\nexport type PrincipalPolicyStaleErrorResponse = z.infer<\n  typeof PrincipalPolicyStaleErrorResponseSchema\n>;\n\nexport function isPrincipalPolicyBundleResponse(\n  value: unknown,\n): value is PrincipalPolicyBundleResponse {\n  return PrincipalPolicyBundleResponseSchema.safeParse(value).success;\n}\n\nexport function isPrincipalPolicyMutationResponse(\n  value: unknown,\n): value is PrincipalPolicyMutationResponse {\n  return PrincipalPolicyMutationResponseSchema.safeParse(value).success;\n}\n\nexport function isCommitOrganizationGroupPolicyResponse(\n  value: unknown,\n): value is CommitOrganizationGroupPolicyResponse {\n  return CommitOrganizationGroupPolicyResponseSchema.safeParse(value).success;\n}\n\nexport function isPrincipalPolicyStaleErrorResponse(\n  value: unknown,\n): value is PrincipalPolicyStaleErrorResponse {\n  return PrincipalPolicyStaleErrorResponseSchema.safeParse(value).success;\n}\n"]}
+{"version":3,"file":"principal.js","sourceRoot":"","sources":["principal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,MAAM,SAAS,CAAC;AACxD,OAAO,EAAE,kCAAkC,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,+BAA+B,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,+CAA+C,EAAE,MAAM,iCAAiC,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,sCAAsC,EAAE,MAAM,sBAAsB,CAAC;AAE9E,OAAO,EACL,6CAA6C,EAC7C,qCAAqC,EACrC,4CAA4C,EAC5C,uCAAuC,EACvC,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAEL,6CAA6C,EAC7C,yCAAyC,EACzC,wCAAwC,EACxC,+BAA+B,EAC/B,wBAAwB,EAExB,qCAAqC,EAErC,qCAAqC,EAErC,qCAAqC,EAErC,4CAA4C,EAE5C,uCAAuC,EAEvC,6CAA6C,EAE7C,mCAAmC,EAEnC,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,MAAM,CAAC,MAAM,mCAAmC,GAAG;IACjD,aAAa,EAAE,WAAW,CAAC,qCAAqC,CAAC;IACjE,sBAAsB,EAAE,6CAA6C;IACrE,cAAc,EAAE,mCAAmC;IACnD,iBAAiB,EAAE,WAAW,CAAC,uCAAuC,CAAC;IACvE,YAAY,EAAE,4BAA4B;CAC3C,CAAC;AAEF,MAAM,CAAC,MAAM,mCAAmC,GAAG,gBAAgB,CAAC;IAClE,GAAG,mCAAmC;IACtC,cAAc,EAAE,WAAW,CAAC,4CAA4C,CAAC;CAC1E,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,qCAAqC,GAAG,gBAAgB,CAAC;IACpE,GAAG,mCAAmC;IACtC,kBAAkB,EAAE,WAAW,CAAC,+BAA+B,CAAC;CACjE,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,2CAA2C,GAAG,gBAAgB,CAAC;IAC1E,WAAW,EAAE,qCAAqC;IAClD,kBAAkB,EAAE,qCAAqC;CAC1D,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,kCAAkC,GAAG,0BAA0B,CAAC;AAM7E;;;;;GAKG;AACH,MAAM,qDAAqD,GAAG,gBAAgB,CAAC;IAC7E,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,+CAA+C,CAAC;IAChE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,oBAAoB,EAAE,WAAW,CAC/B,oBAAoB,EACpB,6BAA6B,CAC9B;CACF,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,CAAC,KAAK,CAAC;IACzE,kCAAkC;IAClC,qDAAqD;CACtD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uCAAuC,GAAG,gBAAgB,CAAC;IACtE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,cAAc,EAAE,WAAW,CACzB,sCAAsC,EACtC,kCAAkC,CACnC;CACF,CAAC,CAAC;AAMH,MAAM,UAAU,+BAA+B,CAC7C,KAAc;IAEd,OAAO,mCAAmC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,KAAc;IAEd,OAAO,qCAAqC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,KAAc;IAEd,OAAO,2CAA2C,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,KAAc;IAEd,OAAO,uCAAuC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC1E,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { arraySchema, loosePlainObject, nonEmptyStringSchema } from \"../schema\";\nimport { MAX_ROTATION_CONTAINER_REKEYS } from \"../util\";\nimport { PRINCIPAL_POLICY_REPAIR_HEAD_LIMIT } from \"../util/principalHistoryWire\";\nimport { ContainerMutationResponseSchema } from \"./container\";\nimport { CONTAINER_DESCENDANT_REKEYS_REQUIRED_ERROR_CODE } from \"./descendantRekeysRequiredError\";\nimport { BillingErrorResponseSchema } from \"./organizationBilling\";\nimport { ReferencedPrincipalStateResponseSchema } from \"./principalReference\";\n\nimport {\n  CurrentPrincipalMemberEnvelopesResponseSchema,\n  PrincipalContainerGrantResponseSchema,\n  PrincipalPolicyStateChainEntryResponseSchema,\n  PrincipalProjectionMemberResponseSchema,\n  PrincipalStatePayloadResponseSchema,\n  PrincipalStateResponseSchema,\n} from \"./principalSnapshot\";\n\nexport {\n  type CurrentPrincipalMemberEnvelopesResponse,\n  CurrentPrincipalMemberEnvelopesResponseSchema,\n  isCurrentPrincipalMemberEnvelopesResponse,\n  isPrincipalPolicyStateChainEntryResponse,\n  isPrincipalStatePayloadResponse,\n  isPrincipalStateResponse,\n  type PrincipalContainerGrantResponse,\n  PrincipalContainerGrantResponseSchema,\n  type PrincipalMemberEnvelopeResponse,\n  PrincipalMemberEnvelopeResponseSchema,\n  type PrincipalPolicySnapshotResponse,\n  PrincipalPolicySnapshotResponseSchema,\n  type PrincipalPolicyStateChainEntryResponse,\n  PrincipalPolicyStateChainEntryResponseSchema,\n  type PrincipalProjectionMemberResponse,\n  PrincipalProjectionMemberResponseSchema,\n  type PrincipalStateExternalAuthorityResponse,\n  PrincipalStateExternalAuthorityResponseSchema,\n  type PrincipalStatePayloadResponse,\n  PrincipalStatePayloadResponseSchema,\n  type PrincipalStateResponse,\n  PrincipalStateResponseSchema,\n} from \"./principalSnapshot\";\n\nexport const principalPolicyCurrentResponseShape = {\n  currentGrants: arraySchema(PrincipalContainerGrantResponseSchema),\n  currentMemberEnvelopes: CurrentPrincipalMemberEnvelopesResponseSchema,\n  currentPayload: PrincipalStatePayloadResponseSchema,\n  currentProjection: arraySchema(PrincipalProjectionMemberResponseSchema),\n  currentState: PrincipalStateResponseSchema,\n};\n\nexport const PrincipalPolicyBundleResponseSchema = loosePlainObject({\n  ...principalPolicyCurrentResponseShape,\n  previousStates: arraySchema(PrincipalPolicyStateChainEntryResponseSchema),\n});\n\nexport type PrincipalPolicyBundleResponse = z.infer<\n  typeof PrincipalPolicyBundleResponseSchema\n>;\n\nexport const PrincipalPolicyMutationResponseSchema = loosePlainObject({\n  ...principalPolicyCurrentResponseShape,\n  containerMutations: arraySchema(ContainerMutationResponseSchema),\n});\n\nexport type PrincipalPolicyMutationResponse = z.infer<\n  typeof PrincipalPolicyMutationResponseSchema\n>;\n\nexport const CommitOrganizationGroupPolicyResponseSchema = loosePlainObject({\n  groupPolicy: PrincipalPolicyMutationResponseSchema,\n  organizationPolicy: PrincipalPolicyMutationResponseSchema,\n});\n\nexport type CommitOrganizationGroupPolicyResponse = z.infer<\n  typeof CommitOrganizationGroupPolicyResponseSchema\n>;\n\nexport const PrincipalPolicyErrorResponseSchema = BillingErrorResponseSchema;\n\nexport type PrincipalPolicyErrorResponse = z.infer<\n  typeof PrincipalPolicyErrorResponseSchema\n>;\n\n/**\n * A group policy change rematerializes its granted containers, and a rekey or\n * revoke among them is a rotation like any other: one that would leave a level\n * above a directly granted container pinned to a retired epoch is refused, and\n * this names the descendant rekeys the batch must carry, parent-first.\n */\nconst PrincipalPolicyDescendantRekeysRequiredResponseSchema = loosePlainObject({\n  code: z.literal(CONTAINER_DESCENDANT_REKEYS_REQUIRED_ERROR_CODE),\n  error: z.string().min(1),\n  requiredContainerIds: arraySchema(\n    nonEmptyStringSchema,\n    MAX_ROTATION_CONTAINER_REKEYS,\n  ),\n});\n\n/**\n * The commit's conflict envelope alone: only a group commit carries container\n * mutations, so only it can be refused for what they strand. The principal\n * policy read and the organization policy write keep the plain envelope.\n */\nexport const CommitOrganizationGroupPolicyConflictResponseSchema = z.union([\n  PrincipalPolicyErrorResponseSchema,\n  PrincipalPolicyDescendantRekeysRequiredResponseSchema,\n]);\n\nexport const PrincipalPolicyStaleErrorResponseSchema = loosePlainObject({\n  code: z.literal(\"principal_policy_stale\"),\n  error: z.string().min(1),\n  principalHeads: arraySchema(\n    ReferencedPrincipalStateResponseSchema,\n    PRINCIPAL_POLICY_REPAIR_HEAD_LIMIT,\n  ),\n});\n\nexport type PrincipalPolicyStaleErrorResponse = z.infer<\n  typeof PrincipalPolicyStaleErrorResponseSchema\n>;\n\nexport function isPrincipalPolicyBundleResponse(\n  value: unknown,\n): value is PrincipalPolicyBundleResponse {\n  return PrincipalPolicyBundleResponseSchema.safeParse(value).success;\n}\n\nexport function isPrincipalPolicyMutationResponse(\n  value: unknown,\n): value is PrincipalPolicyMutationResponse {\n  return PrincipalPolicyMutationResponseSchema.safeParse(value).success;\n}\n\nexport function isCommitOrganizationGroupPolicyResponse(\n  value: unknown,\n): value is CommitOrganizationGroupPolicyResponse {\n  return CommitOrganizationGroupPolicyResponseSchema.safeParse(value).success;\n}\n\nexport function isPrincipalPolicyStaleErrorResponse(\n  value: unknown,\n): value is PrincipalPolicyStaleErrorResponse {\n  return PrincipalPolicyStaleErrorResponseSchema.safeParse(value).success;\n}\n"]}

package/internal/validators/util/index.d.ts

@@ -5,7 +5,7 @@ export { MAX_CONTAINER_PATH_LENGTH } from "./containerLimits.js";
 export { MAX_DOCUMENT_SYNC_AUTHORIZATION_PATH_REFS, MAX_DOCUMENT_SYNC_AUTHORIZATION_PATHS, MAX_DOCUMENT_SYNC_CONTENT_KEY_TARGETS, MAX_DOCUMENT_SYNC_OUTGOING_UPDATES, MAX_DOCUMENT_SYNC_PULL_CURSOR_LENGTH, MAX_DOCUMENT_SYNC_REQUEST_BYTES, MAX_DOCUMENT_SYNC_RESPONSE_ENVELOPE_BYTES, MAX_DOCUMENT_SYNC_RESPONSE_PAGE_BYTES, MAX_DOCUMENT_SYNC_RESPONSE_PAGE_UPDATES, MAX_DOCUMENT_SYNC_RESPONSE_UPDATE_PAGE_BYTES, } from "./documentSyncLimits.js";
 export { isSerializedKeyEnvelope, isSerializedKeyEnvelopeArray, type SerializedKeyEnvelope, } from "./keyEnvelope.js";
 export { isOrganizationReplacementAuthorization, type OrganizationReplacementAuthorization, OrganizationReplacementAuthorizationSchema, } from "./organizationReplacement.js";
-export { PRINCIPAL_POLICY_HISTORY_PAGE_LIMIT } from "./principalHistoryWire.js";
+export { PRINCIPAL_POLICY_HISTORY_PAGE_LIMIT, PRINCIPAL_POLICY_REPAIR_HEAD_LIMIT, } from "./principalHistoryWire.js";
 export { PROJECTION_HISTORY_HINT_CHARACTERS, ProjectionHistoryHeadersSchema, type ProjectionHistoryPrefix, ProjectionHistoryPrefixesSchema, parseProjectionHistoryHints, } from "./projectionHistoryWire.js";
 export { hasArrayProperty, hasBooleanProperty, hasNonEmptyStringProperty, hasNullableNumberProperty, hasNullableStringProperty, hasNumberProperty, hasObjectProperty, hasOptionalStringProperty, hasPositiveIntegerProperty, hasPropertyValue, hasStringProperty, isNonEmptyStringArray, isOptionalRecordArray, isOptionalRecordArrayArray, isRecordArray, isRecordArrayArray, isStringArray, } from "./properties.js";
 export { AUTH_CHALLENGE_HEX_LENGTH, isAuthChallengeHexString, isByteArray, isByteArrayOfLength, isSha256HexString, ML_DSA87_PUBLIC_KEY_BYTES, ML_DSA87_SIGNATURE_BYTES, ML_KEM1024_PUBLIC_KEY_BYTES, SHA256_HEX_LENGTH, } from "./protocol.js";

package/internal/validators/util/index.js

@@ -5,7 +5,7 @@ export { MAX_CONTAINER_PATH_LENGTH } from "./containerLimits.js";
 export { MAX_DOCUMENT_SYNC_AUTHORIZATION_PATH_REFS, MAX_DOCUMENT_SYNC_AUTHORIZATION_PATHS, MAX_DOCUMENT_SYNC_CONTENT_KEY_TARGETS, MAX_DOCUMENT_SYNC_OUTGOING_UPDATES, MAX_DOCUMENT_SYNC_PULL_CURSOR_LENGTH, MAX_DOCUMENT_SYNC_REQUEST_BYTES, MAX_DOCUMENT_SYNC_RESPONSE_ENVELOPE_BYTES, MAX_DOCUMENT_SYNC_RESPONSE_PAGE_BYTES, MAX_DOCUMENT_SYNC_RESPONSE_PAGE_UPDATES, MAX_DOCUMENT_SYNC_RESPONSE_UPDATE_PAGE_BYTES, } from "./documentSyncLimits.js";
 export { isSerializedKeyEnvelope, isSerializedKeyEnvelopeArray, } from "./keyEnvelope.js";
 export { isOrganizationReplacementAuthorization, OrganizationReplacementAuthorizationSchema, } from "./organizationReplacement.js";
-export { PRINCIPAL_POLICY_HISTORY_PAGE_LIMIT } from "./principalHistoryWire.js";
+export { PRINCIPAL_POLICY_HISTORY_PAGE_LIMIT, PRINCIPAL_POLICY_REPAIR_HEAD_LIMIT, } from "./principalHistoryWire.js";
 export { PROJECTION_HISTORY_HINT_CHARACTERS, ProjectionHistoryHeadersSchema, ProjectionHistoryPrefixesSchema, parseProjectionHistoryHints, } from "./projectionHistoryWire.js";
 export { hasArrayProperty, hasBooleanProperty, hasNonEmptyStringProperty, hasNullableNumberProperty, hasNullableStringProperty, hasNumberProperty, hasObjectProperty, hasOptionalStringProperty, hasPositiveIntegerProperty, hasPropertyValue, hasStringProperty, isNonEmptyStringArray, isOptionalRecordArray, isOptionalRecordArrayArray, isRecordArray, isRecordArrayArray, isStringArray, } from "./properties.js";
 export { AUTH_CHALLENGE_HEX_LENGTH, isAuthChallengeHexString, isByteArray, isByteArrayOfLength, isSha256HexString, ML_DSA87_PUBLIC_KEY_BYTES, ML_DSA87_SIGNATURE_BYTES, ML_KEM1024_PUBLIC_KEY_BYTES, SHA256_HEX_LENGTH, } from "./protocol.js";

package/internal/validators/util/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,mCAAmC,EAGnC,sCAAsC,EACtC,8BAA8B,EAC9B,+BAA+B,EAC/B,0BAA0B,EAC1B,+BAA+B,EAC/B,kCAAkC,EAClC,uCAAuC,GACxC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,6BAA6B,EAAE,MAAM,QAAQ,CAAC;AACvD,OAAO,EACL,4BAA4B,EAC5B,uCAAuC,EACvC,mCAAmC,EACnC,mCAAmC,EACnC,+BAA+B,EAC/B,uBAAuB,EACvB,2BAA2B,EAC3B,6BAA6B,EAC7B,8CAA8C,EAC9C,gDAAgD,EAChD,wCAAwC,EACxC,yCAAyC,EACzC,8BAA8B,GAC/B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EACL,yCAAyC,EACzC,qCAAqC,EACrC,qCAAqC,EACrC,kCAAkC,EAClC,oCAAoC,EACpC,+BAA+B,EAC/B,yCAAyC,EACzC,qCAAqC,EACrC,uCAAuC,EACvC,4CAA4C,GAC7C,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,uBAAuB,EACvB,4BAA4B,GAE7B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sCAAsC,EAEtC,0CAA0C,GAC3C,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,mCAAmC,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EACL,kCAAkC,EAClC,8BAA8B,EAE9B,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,EACzB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,EACzB,0BAA0B,EAC1B,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,0BAA0B,EAC1B,aAAa,EACb,kBAAkB,EAClB,aAAa,GACd,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EACjB,yBAAyB,EACzB,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC","sourcesContent":["export {\n  type AccessEventBundleWireResponse,\n  AccessEventBundleWireResponseSchema,\n  type AccessManifestBundleWire,\n  type AccessManifestBundleWireResponse,\n  AccessManifestBundleWireResponseSchema,\n  AccessManifestBundleWireSchema,\n  isAccessEventBundleWireResponse,\n  isAccessManifestBundleWire,\n  isAccessManifestBundleWireArray,\n  isAccessManifestBundleWireResponse,\n  isOptionalAccessManifestBundleWireArray,\n} from \"./accessManifestBundle\";\nexport { MAX_MULTIPART_BLOB_PART_BYTES } from \"./blob\";\nexport {\n  CONTAINER_KEK_LOG_PAGE_LIMIT,\n  CONTAINER_KEK_LOG_PRINCIPAL_SCOPE_LIMIT,\n  CONTAINER_KEK_WRAPS_PER_EPOCH_LIMIT,\n  ContainerKekKeyringWireRecordSchema,\n  isContainerKekKeyringWireRecord,\n  MAX_CONTAINER_KEY_EPOCH,\n  MAX_INLINE_CONTAINER_REKEYS,\n  MAX_ROTATION_CONTAINER_REKEYS,\n  MAX_SEALED_CONTAINER_KEK_KEYRING_BASE64_LENGTH,\n  SEALED_CONTAINER_KEK_KEYRING_AEAD_OVERHEAD_BYTES,\n  SEALED_CONTAINER_KEK_KEYRING_ENTRY_BYTES,\n  SEALED_CONTAINER_KEK_KEYRING_HEADER_BYTES,\n  sealedContainerKekKeyringBytes,\n} from \"./containerKekKeyringWire\";\nexport { MAX_CONTAINER_PATH_LENGTH } from \"./containerLimits\";\nexport {\n  MAX_DOCUMENT_SYNC_AUTHORIZATION_PATH_REFS,\n  MAX_DOCUMENT_SYNC_AUTHORIZATION_PATHS,\n  MAX_DOCUMENT_SYNC_CONTENT_KEY_TARGETS,\n  MAX_DOCUMENT_SYNC_OUTGOING_UPDATES,\n  MAX_DOCUMENT_SYNC_PULL_CURSOR_LENGTH,\n  MAX_DOCUMENT_SYNC_REQUEST_BYTES,\n  MAX_DOCUMENT_SYNC_RESPONSE_ENVELOPE_BYTES,\n  MAX_DOCUMENT_SYNC_RESPONSE_PAGE_BYTES,\n  MAX_DOCUMENT_SYNC_RESPONSE_PAGE_UPDATES,\n  MAX_DOCUMENT_SYNC_RESPONSE_UPDATE_PAGE_BYTES,\n} from \"./documentSyncLimits\";\nexport {\n  isSerializedKeyEnvelope,\n  isSerializedKeyEnvelopeArray,\n  type SerializedKeyEnvelope,\n} from \"./keyEnvelope\";\nexport {\n  isOrganizationReplacementAuthorization,\n  type OrganizationReplacementAuthorization,\n  OrganizationReplacementAuthorizationSchema,\n} from \"./organizationReplacement\";\nexport { PRINCIPAL_POLICY_HISTORY_PAGE_LIMIT } from \"./principalHistoryWire\";\nexport {\n  PROJECTION_HISTORY_HINT_CHARACTERS,\n  ProjectionHistoryHeadersSchema,\n  type ProjectionHistoryPrefix,\n  ProjectionHistoryPrefixesSchema,\n  parseProjectionHistoryHints,\n} from \"./projectionHistoryWire\";\nexport {\n  hasArrayProperty,\n  hasBooleanProperty,\n  hasNonEmptyStringProperty,\n  hasNullableNumberProperty,\n  hasNullableStringProperty,\n  hasNumberProperty,\n  hasObjectProperty,\n  hasOptionalStringProperty,\n  hasPositiveIntegerProperty,\n  hasPropertyValue,\n  hasStringProperty,\n  isNonEmptyStringArray,\n  isOptionalRecordArray,\n  isOptionalRecordArrayArray,\n  isRecordArray,\n  isRecordArrayArray,\n  isStringArray,\n} from \"./properties\";\nexport {\n  AUTH_CHALLENGE_HEX_LENGTH,\n  isAuthChallengeHexString,\n  isByteArray,\n  isByteArrayOfLength,\n  isSha256HexString,\n  ML_DSA87_PUBLIC_KEY_BYTES,\n  ML_DSA87_SIGNATURE_BYTES,\n  ML_KEM1024_PUBLIC_KEY_BYTES,\n  SHA256_HEX_LENGTH,\n} from \"./protocol\";\nexport {\n  CANONICAL_SIGNED_AT_PATTERN,\n  isCanonicalSignedAt,\n  MAX_SIGNED_AT_YEAR,\n  MIN_SIGNED_AT_YEAR,\n  SIGNED_AT_CONTRACT,\n} from \"./signedAt\";\nexport { isUuidV4String } from \"./uuid\";\nexport { isWalLsnString, parseWalLsn } from \"./walLsn\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,mCAAmC,EAGnC,sCAAsC,EACtC,8BAA8B,EAC9B,+BAA+B,EAC/B,0BAA0B,EAC1B,+BAA+B,EAC/B,kCAAkC,EAClC,uCAAuC,GACxC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,6BAA6B,EAAE,MAAM,QAAQ,CAAC;AACvD,OAAO,EACL,4BAA4B,EAC5B,uCAAuC,EACvC,mCAAmC,EACnC,mCAAmC,EACnC,+BAA+B,EAC/B,uBAAuB,EACvB,2BAA2B,EAC3B,6BAA6B,EAC7B,8CAA8C,EAC9C,gDAAgD,EAChD,wCAAwC,EACxC,yCAAyC,EACzC,8BAA8B,GAC/B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EACL,yCAAyC,EACzC,qCAAqC,EACrC,qCAAqC,EACrC,kCAAkC,EAClC,oCAAoC,EACpC,+BAA+B,EAC/B,yCAAyC,EACzC,qCAAqC,EACrC,uCAAuC,EACvC,4CAA4C,GAC7C,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,uBAAuB,EACvB,4BAA4B,GAE7B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sCAAsC,EAEtC,0CAA0C,GAC3C,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,mCAAmC,EACnC,kCAAkC,GACnC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,kCAAkC,EAClC,8BAA8B,EAE9B,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,EACzB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,EACzB,0BAA0B,EAC1B,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,0BAA0B,EAC1B,aAAa,EACb,kBAAkB,EAClB,aAAa,GACd,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EACjB,yBAAyB,EACzB,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC","sourcesContent":["export {\n  type AccessEventBundleWireResponse,\n  AccessEventBundleWireResponseSchema,\n  type AccessManifestBundleWire,\n  type AccessManifestBundleWireResponse,\n  AccessManifestBundleWireResponseSchema,\n  AccessManifestBundleWireSchema,\n  isAccessEventBundleWireResponse,\n  isAccessManifestBundleWire,\n  isAccessManifestBundleWireArray,\n  isAccessManifestBundleWireResponse,\n  isOptionalAccessManifestBundleWireArray,\n} from \"./accessManifestBundle\";\nexport { MAX_MULTIPART_BLOB_PART_BYTES } from \"./blob\";\nexport {\n  CONTAINER_KEK_LOG_PAGE_LIMIT,\n  CONTAINER_KEK_LOG_PRINCIPAL_SCOPE_LIMIT,\n  CONTAINER_KEK_WRAPS_PER_EPOCH_LIMIT,\n  ContainerKekKeyringWireRecordSchema,\n  isContainerKekKeyringWireRecord,\n  MAX_CONTAINER_KEY_EPOCH,\n  MAX_INLINE_CONTAINER_REKEYS,\n  MAX_ROTATION_CONTAINER_REKEYS,\n  MAX_SEALED_CONTAINER_KEK_KEYRING_BASE64_LENGTH,\n  SEALED_CONTAINER_KEK_KEYRING_AEAD_OVERHEAD_BYTES,\n  SEALED_CONTAINER_KEK_KEYRING_ENTRY_BYTES,\n  SEALED_CONTAINER_KEK_KEYRING_HEADER_BYTES,\n  sealedContainerKekKeyringBytes,\n} from \"./containerKekKeyringWire\";\nexport { MAX_CONTAINER_PATH_LENGTH } from \"./containerLimits\";\nexport {\n  MAX_DOCUMENT_SYNC_AUTHORIZATION_PATH_REFS,\n  MAX_DOCUMENT_SYNC_AUTHORIZATION_PATHS,\n  MAX_DOCUMENT_SYNC_CONTENT_KEY_TARGETS,\n  MAX_DOCUMENT_SYNC_OUTGOING_UPDATES,\n  MAX_DOCUMENT_SYNC_PULL_CURSOR_LENGTH,\n  MAX_DOCUMENT_SYNC_REQUEST_BYTES,\n  MAX_DOCUMENT_SYNC_RESPONSE_ENVELOPE_BYTES,\n  MAX_DOCUMENT_SYNC_RESPONSE_PAGE_BYTES,\n  MAX_DOCUMENT_SYNC_RESPONSE_PAGE_UPDATES,\n  MAX_DOCUMENT_SYNC_RESPONSE_UPDATE_PAGE_BYTES,\n} from \"./documentSyncLimits\";\nexport {\n  isSerializedKeyEnvelope,\n  isSerializedKeyEnvelopeArray,\n  type SerializedKeyEnvelope,\n} from \"./keyEnvelope\";\nexport {\n  isOrganizationReplacementAuthorization,\n  type OrganizationReplacementAuthorization,\n  OrganizationReplacementAuthorizationSchema,\n} from \"./organizationReplacement\";\nexport {\n  PRINCIPAL_POLICY_HISTORY_PAGE_LIMIT,\n  PRINCIPAL_POLICY_REPAIR_HEAD_LIMIT,\n} from \"./principalHistoryWire\";\nexport {\n  PROJECTION_HISTORY_HINT_CHARACTERS,\n  ProjectionHistoryHeadersSchema,\n  type ProjectionHistoryPrefix,\n  ProjectionHistoryPrefixesSchema,\n  parseProjectionHistoryHints,\n} from \"./projectionHistoryWire\";\nexport {\n  hasArrayProperty,\n  hasBooleanProperty,\n  hasNonEmptyStringProperty,\n  hasNullableNumberProperty,\n  hasNullableStringProperty,\n  hasNumberProperty,\n  hasObjectProperty,\n  hasOptionalStringProperty,\n  hasPositiveIntegerProperty,\n  hasPropertyValue,\n  hasStringProperty,\n  isNonEmptyStringArray,\n  isOptionalRecordArray,\n  isOptionalRecordArrayArray,\n  isRecordArray,\n  isRecordArrayArray,\n  isStringArray,\n} from \"./properties\";\nexport {\n  AUTH_CHALLENGE_HEX_LENGTH,\n  isAuthChallengeHexString,\n  isByteArray,\n  isByteArrayOfLength,\n  isSha256HexString,\n  ML_DSA87_PUBLIC_KEY_BYTES,\n  ML_DSA87_SIGNATURE_BYTES,\n  ML_KEM1024_PUBLIC_KEY_BYTES,\n  SHA256_HEX_LENGTH,\n} from \"./protocol\";\nexport {\n  CANONICAL_SIGNED_AT_PATTERN,\n  isCanonicalSignedAt,\n  MAX_SIGNED_AT_YEAR,\n  MIN_SIGNED_AT_YEAR,\n  SIGNED_AT_CONTRACT,\n} from \"./signedAt\";\nexport { isUuidV4String } from \"./uuid\";\nexport { isWalLsnString, parseWalLsn } from \"./walLsn\";\n"]}

package/internal/validators/util/principalHistoryWire.d.ts

@@ -1,2 +1,4 @@
 /** Per-response history depth; never a limit on the lifetime of a policy. */
 export declare const PRINCIPAL_POLICY_HISTORY_PAGE_LIMIT = 32;
+/** Maximum advisory heads in one stale-policy repair response. */
+export declare const PRINCIPAL_POLICY_REPAIR_HEAD_LIMIT = 16;

package/internal/validators/util/principalHistoryWire.js

@@ -1,3 +1,5 @@
 /** Per-response history depth; never a limit on the lifetime of a policy. */
 export const PRINCIPAL_POLICY_HISTORY_PAGE_LIMIT = 32;
+/** Maximum advisory heads in one stale-policy repair response. */
+export const PRINCIPAL_POLICY_REPAIR_HEAD_LIMIT = 16;
 //# sourceMappingURL=principalHistoryWire.js.map

package/internal/validators/util/principalHistoryWire.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalHistoryWire.js","sourceRoot":"","sources":["principalHistoryWire.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,MAAM,CAAC,MAAM,mCAAmC,GAAG,EAAE,CAAC","sourcesContent":["/** Per-response history depth; never a limit on the lifetime of a policy. */\nexport const PRINCIPAL_POLICY_HISTORY_PAGE_LIMIT = 32;\n"]}
+{"version":3,"file":"principalHistoryWire.js","sourceRoot":"","sources":["principalHistoryWire.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,MAAM,CAAC,MAAM,mCAAmC,GAAG,EAAE,CAAC;AAEtD,kEAAkE;AAClE,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,CAAC","sourcesContent":["/** Per-response history depth; never a limit on the lifetime of a policy. */\nexport const PRINCIPAL_POLICY_HISTORY_PAGE_LIMIT = 32;\n\n/** Maximum advisory heads in one stale-policy repair response. */\nexport const PRINCIPAL_POLICY_REPAIR_HEAD_LIMIT = 16;\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tearleads/client-sdk",
-  "version": "0.1.18",
+  "version": "0.1.20",
   "description": "React-free Tearleads client runtime: local SQLite persistence, keys, sync, encrypted blobs, and domain workflows.",
   "license": "UNLICENSED",
   "repository": {
@@ -33,8 +33,8 @@
     "@noble/hashes": "^2.4.0",
     "@noble/post-quantum": "^0.7.1",
     "@scure/bip39": "^2.4.0",
-    "drizzle-orm": "^0.45.2",
-    "loro-crdt": "^1.16.0",
-    "zod": "^4.5.4"
+    "drizzle-orm": "^0.45.3",
+    "loro-crdt": "^1.16.4",
+    "zod": "^4.6.5"
   }
 }