@tearleads/client-sdk 0.1.41 → 0.1.43

package/internal/validators/response/container.js

@@ -5,9 +5,9 @@ import { registerJsonSchemaRuntimeRefinements } from "../jsonSchema.js";
 import { organizationProvisioningContainerKeyringRefinement } from "../organizationProvisioningRefinements.js";
 import { arraySchema, loosePlainObject, nonEmptyArraySchema, nonEmptyStringSchema, nonNegativeIntegerSchema, plainObjectSchema, positiveIntegerSchema, } from "../schema.js";
 import { AccessManifestBundleWireResponseSchema, CONTAINER_KEK_LOG_PAGE_LIMIT, CONTAINER_KEK_WRAPS_PER_EPOCH_LIMIT, ContainerKekKeyringWireRecordSchema, } from "../util/index.js";
-import { ProjectionHistoryPrefixesSchema } from "../util/projectionHistoryWire.js";
-import { containerWriterProjectionPathKekCountRefinement } from "../writerProjectionRefinements.js";
+import { containerWriterProjectionPathKekCountRefinement, writerProjectionManifestBundlesRefinement, } from "../writerProjectionRefinements.js";
 import { EffectiveAccessLevelSchema } from "./accessLevel.js";
+import { containerKeyingPathReferences, ManifestBundlesSchema, ManifestHashReferenceSchema, OmittedManifestBundlesSchema, refineManifestBundleReferences, } from "./manifestBundleReferences.js";
 import { ReferencedPrincipalStateResponseSchema, ReferencedPrincipalStateResponseShape, } from "./principalReference.js";
 import { ProjectionPolicyEvidenceResponseSchema } from "./projectionPolicyEvidence.js";
 import { SyncWatermarkSchema } from "./syncWatermark.js";
@@ -35,7 +35,7 @@ const containerKekResponseShape = {
     recipientTargets: nonEmptyArraySchema(plainObjectSchema),
     wraps: nonEmptyArraySchema(plainObjectSchema),
 };
-const ContainerKekResponseSchema = registerJsonSchemaRuntimeRefinements(loosePlainObject(containerKekResponseShape).superRefine((value, context) => {
+function refineContainerKekKeyring(value, context) {
     if ((value.keyring === null) !== (value.containerKeyEpoch === 1)) {
         context.addIssue({
             code: "custom",
@@ -43,7 +43,13 @@ const ContainerKekResponseSchema = registerJsonSchemaRuntimeRefinements(loosePla
             path: ["keyring"],
         });
     }
-}), [organizationProvisioningContainerKeyringRefinement]);
+}
+const ContainerKekResponseSchema = registerJsonSchemaRuntimeRefinements(loosePlainObject(containerKekResponseShape).superRefine(refineContainerKekKeyring), [organizationProvisioningContainerKeyringRefinement]);
+/** On the writer-projection wire, KEK history cites manifests by hash. */
+const ContainerKekWireResponseSchema = registerJsonSchemaRuntimeRefinements(loosePlainObject({
+    ...containerKekResponseShape,
+    containerManifestHistory: arraySchema(ManifestHashReferenceSchema),
+}).superRefine(refineContainerKekKeyring), [organizationProvisioningContainerKeyringRefinement]);
 /**
  * The append-only rotation log for one container: every epoch with its
  * write-once bridge and sealed keyring. This is the rebuild/repair read
@@ -141,11 +147,37 @@ function refineContainerKeyingPath(projection, context) {
         });
 }
 export const ContainerKeyingPathResponseSchema = registerJsonSchemaRuntimeRefinements(loosePlainObject(containerKeyingPathShape).superRefine(refineContainerKeyingPath), [containerWriterProjectionPathKekCountRefinement]);
+/**
+ * The decoded projection a client verifies: every manifest position holds
+ * its bundle. `decodeContainerWriterProjection` builds it from the wire.
+ */
 export const ContainerWriterProjectionResponseSchema = registerJsonSchemaRuntimeRefinements(loosePlainObject({
     ...containerKeyingPathShape,
     policyEvidence: ProjectionPolicyEvidenceResponseSchema,
-    historyPrefixes: ProjectionHistoryPrefixesSchema.optional(),
 }).superRefine(refineContainerKeyingPath), [containerWriterProjectionPathKekCountRefinement]);
+const containerKeyingPathWireShape = {
+    containerId: z.string(),
+    containerKeks: arraySchema(ContainerKekWireResponseSchema),
+    organizationId: z.string(),
+    path: nonEmptyArraySchema(ManifestHashReferenceSchema),
+};
+export const ContainerKeyingPathWireResponseSchema = registerJsonSchemaRuntimeRefinements(loosePlainObject(containerKeyingPathWireShape).superRefine(refineContainerKeyingPath), [containerWriterProjectionPathKekCountRefinement]);
+/**
+ * The served shape: manifest positions cite `bundles` by hash, except hashes
+ * the request declared already held, which `omittedBundles` lists instead.
+ */
+export const ContainerWriterProjectionWireResponseSchema = registerJsonSchemaRuntimeRefinements(loosePlainObject({
+    bundles: ManifestBundlesSchema,
+    omittedBundles: OmittedManifestBundlesSchema,
+    ...containerKeyingPathWireShape,
+    policyEvidence: ProjectionPolicyEvidenceResponseSchema,
+}).superRefine((projection, context) => {
+    refineContainerKeyingPath(projection, context);
+    refineManifestBundleReferences(projection, containerKeyingPathReferences(projection), context);
+}), [
+    containerWriterProjectionPathKekCountRefinement,
+    writerProjectionManifestBundlesRefinement,
+]);
 export const ContainerSummaryResponseSchema = loosePlainObject({
     createdAt: z.string(),
     depth: nonNegativeIntegerSchema,
@@ -185,4 +217,7 @@ export function isContainerDeleteResponse(value) {
 export function isContainerWriterProjectionResponse(value) {
     return ContainerWriterProjectionResponseSchema.safeParse(value).success;
 }
+export function isContainerWriterProjectionWireResponse(value) {
+    return ContainerWriterProjectionWireResponseSchema.safeParse(value).success;
+}
 //# sourceMappingURL=container.js.map

package/internal/validators/response/container.js.map

@@ -1 +1 @@
-{"version":3,"file":"container.js","sourceRoot":"","sources":["container.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,sCAAsC,EAAE,MAAM,6BAA6B,CAAC;AACrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,oCAAoC,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,kDAAkD,EAAE,MAAM,wCAAwC,CAAC;AAC5G,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,sCAAsC,EACtC,4BAA4B,EAC5B,mCAAmC,EACnC,mCAAmC,GACpC,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,EAAE,+CAA+C,EAAE,MAAM,gCAAgC,CAAC;AACjG,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EACL,sCAAsC,EACtC,qCAAqC,GACtC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,sCAAsC,EAAE,MAAM,4BAA4B,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD,MAAM,0CAA0C,GAAG,gBAAgB,CAAC;IAClE,GAAG,qCAAqC;IACxC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;CAClC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,qCAAqC,GACzC,mCAAmC,CAAC;AAMtC,MAAM,yBAAyB,GAAG;IAChC,kBAAkB,EAAE,oBAAoB;IACxC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,iBAAiB,EAAE,qBAAqB;IACxC,mBAAmB,EAAE,oBAAoB;IACzC,wBAAwB,EAAE,WAAW,CAAC,sCAAsC,CAAC;IAC7E,QAAQ,EAAE,iBAAiB;IAC3B,YAAY,EAAE,oBAAoB;IAClC,OAAO,EAAE,qCAAqC,CAAC,QAAQ,EAAE;IACzD,aAAa,EAAE,oBAAoB;IACnC,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChD,gBAAgB,EAAE,mBAAmB,CAAC,iBAAiB,CAAC;IACxD,KAAK,EAAE,mBAAmB,CAAC,iBAAiB,CAAC;CAC9C,CAAC;AAEF,MAAM,0BAA0B,GAAG,oCAAoC,CACrE,gBAAgB,CAAC,yBAAyB,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACzE,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,KAAK,CAAC,CAAC,EAAE,CAAC;QACjE,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,mDAAmD;YAC5D,IAAI,EAAE,CAAC,SAAS,CAAC;SAClB,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,EACF,CAAC,kDAAkD,CAAC,CACrD,CAAC;AAIF;;;;GAIG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,gBAAgB,CAAC;IACjE,kBAAkB,EAAE,oBAAoB;IACxC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACpC,iBAAiB,EAAE,qBAAqB;IACxC,mBAAmB,EAAE,oBAAoB;IACzC,OAAO,EAAE,qCAAqC,CAAC,QAAQ,EAAE;IACzD,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChD;;;OAGG;IACH,KAAK,EAAE,WAAW,CAAC,iBAAiB,EAAE,mCAAmC,CAAC;CAC3E,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,6BAA6B,GACxC,oCAAoC,CAClC,gBAAgB,CAAC;IACf,WAAW,EAAE,oBAAoB;IACjC,MAAM,EAAE,WAAW,CACjB,kCAAkC,EAClC,4BAA4B,CAC7B;IACD,+DAA+D;IAC/D,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE;IACrC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChE,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,qDAAqD;YAC9D,IAAI,EAAE,CAAC,QAAQ,CAAC;SACjB,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,EACF,CAAC,sCAAsC,CAAC,CACzC,CAAC;AAMJ,MAAM,UAAU,yBAAyB,CACvC,KAAc;IAEd,OAAO,6BAA6B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAChE,CAAC;AAED,MAAM,sCAAsC,GAAG;IAC7C,cAAc,EAAE,sCAAsC;IACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,YAAY,EAAE,gBAAgB,CAAC;QAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;KACzB,CAAC;IACF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,wBAAwB,EAAE,WAAW,CACnC,0CAA0C,CAC3C;IACD,UAAU,EAAE,yBAAyB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC;AAEF,oFAAoF;AACpF,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,+BAA+B,EAAE,GACvE,sCAAsC,CAAC;AAEzC,MAAM,8BAA8B,GAAG;IACrC,cAAc;IACd,WAAW;IACX,YAAY,EAAE,0BAA0B;IACxC,GAAG,+BAA+B;CACnC,CAAC;AAEF,MAAM,CAAC,MAAM,+BAA+B,GAAG,gBAAgB,CAC7D,8BAA8B,CAC/B,CAAC;AAMF,iFAAiF;AACjF,MAAM,CAAC,MAAM,+BAA+B,GAAG,gBAAgB,CAAC;IAC9D,GAAG,8BAA8B;IACjC,eAAe,EAAE,WAAW,CAAC,+BAA+B,CAAC,CAAC,QAAQ,EAAE;CACzE,CAAC,CAAC;AAMH,MAAM,UAAU,2BAA2B,CACzC,KAAc;IAEd,OAAO,+BAA+B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,MAAM,6BAA6B,GAAG,gBAAgB,CAC3D,sCAAsC,CACvC,CAAC;AAKF,MAAM,UAAU,yBAAyB,CACvC,KAAc;IAEd,OAAO,6BAA6B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,MAAM,6BAA6B,GAAG,gBAAgB,CAAC;IAC5D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,6CAA6C,GACxD,oCAAoC,CAAC;AACvC,MAAM,CAAC,MAAM,4CAA4C,GAAG,gBAAgB,CAAC;IAC3E,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,6CAA6C,CAAC;IAC9D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,aAAa,EAAE,WAAW,CAAC,0BAA0B,CAAC;IACtD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,mBAAmB,CAAC,sCAAsC,CAAC;CAClE,CAAC;AACF,SAAS,yBAAyB,CAChC,UAAyD,EACzD,OAAwB;IAExB,8EAA8E;IAC9E,IACE,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC;QACvC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QAC9B,UAAU,CAAC,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI,CAAC,MAAM;QAE1D,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,yDAAyD;YAClE,IAAI,EAAE,CAAC,eAAe,CAAC;SACxB,CAAC,CAAC;AACP,CAAC;AACD,MAAM,CAAC,MAAM,iCAAiC,GAC5C,oCAAoC,CAClC,gBAAgB,CAAC,wBAAwB,CAAC,CAAC,WAAW,CACpD,yBAAyB,CAC1B,EACD,CAAC,+CAA+C,CAAC,CAClD,CAAC;AAIJ,MAAM,CAAC,MAAM,uCAAuC,GAClD,oCAAoC,CAClC,gBAAgB,CAAC;IACf,GAAG,wBAAwB;IAC3B,cAAc,EAAE,sCAAsC;IACtD,eAAe,EAAE,+BAA+B,CAAC,QAAQ,EAAE;CAC5D,CAAC,CAAC,WAAW,CAAC,yBAAyB,CAAC,EACzC,CAAC,+CAA+C,CAAC,CAClD,CAAC;AAMJ,MAAM,CAAC,MAAM,8BAA8B,GAAG,gBAAgB,CAAC;IAC7D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,wBAAwB;IAC/B,oBAAoB,EAAE,0BAA0B;IAChD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,uBAAuB,EAAE,oBAAoB;IAC7C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC9B,4BAA4B,EAAE,WAAW,CACvC,sCAAsC,CACvC;IACD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,UAAU,EAAE,yBAAyB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oCAAoC,GAAG,gBAAgB,CAAC;IACnE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,wBAAwB;IAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,4BAA4B,GAAG,gBAAgB,CAAC;IAC3D,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,KAAK,EAAE,WAAW,CAAC,8BAA8B,CAAC;IAClD,aAAa,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC7C,UAAU,EAAE,WAAW,CAAC,oCAAoC,CAAC;CAC9D,CAAC,CAAC;AAMH,MAAM,UAAU,wBAAwB,CACtC,KAAc;IAEd,OAAO,4BAA4B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,KAAc;IAEd,OAAO,+BAA+B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAAc;IAEd,OAAO,6BAA6B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,KAAc;IAEd,OAAO,uCAAuC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC1E,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { containerKekLogSingleKeyringRefinement } from \"../containerReadRefinements\";\nimport { ContainerSystemSlotSchema } from \"../containerSystemSlot\";\nimport { registerJsonSchemaRuntimeRefinements } from \"../jsonSchema\";\nimport { organizationProvisioningContainerKeyringRefinement } from \"../organizationProvisioningRefinements\";\nimport {\n  arraySchema,\n  loosePlainObject,\n  nonEmptyArraySchema,\n  nonEmptyStringSchema,\n  nonNegativeIntegerSchema,\n  plainObjectSchema,\n  positiveIntegerSchema,\n} from \"../schema\";\nimport {\n  AccessManifestBundleWireResponseSchema,\n  CONTAINER_KEK_LOG_PAGE_LIMIT,\n  CONTAINER_KEK_WRAPS_PER_EPOCH_LIMIT,\n  ContainerKekKeyringWireRecordSchema,\n} from \"../util\";\nimport { ProjectionHistoryPrefixesSchema } from \"../util/projectionHistoryWire\";\nimport { containerWriterProjectionPathKekCountRefinement } from \"../writerProjectionRefinements\";\nimport { EffectiveAccessLevelSchema } from \"./accessLevel\";\nimport {\n  ReferencedPrincipalStateResponseSchema,\n  ReferencedPrincipalStateResponseShape,\n} from \"./principalReference\";\nimport { ProjectionPolicyEvidenceResponseSchema } from \"./projectionPolicyEvidence\";\nimport { SyncWatermarkSchema } from \"./syncWatermark\";\n\nconst ContainerGrantPrincipalStateResponseSchema = loosePlainObject({\n  ...ReferencedPrincipalStateResponseShape,\n  principalType: z.literal(\"group\"),\n});\n\n/**\n * The container's sealed predecessor key history. Opening it under the\n * current KEK yields every retained historical KEK in one decrypt; the\n * bridge log behind it is served only by the rebuild read path.\n */\nconst ContainerKekKeyringWireResponseSchema =\n  ContainerKekKeyringWireRecordSchema;\n\nexport type ContainerKekKeyringWireResponse = z.infer<\n  typeof ContainerKekKeyringWireResponseSchema\n>;\n\nconst containerKekResponseShape = {\n  accessManifestHash: nonEmptyStringSchema,\n  containerId: z.string(),\n  containerKeyEpoch: positiveIntegerSchema,\n  containerKeyEpochId: nonEmptyStringSchema,\n  containerManifestHistory: arraySchema(AccessManifestBundleWireResponseSchema),\n  keyEpoch: plainObjectSchema,\n  keyEpochHash: nonEmptyStringSchema,\n  keyring: ContainerKekKeyringWireResponseSchema.nullable(),\n  keyTargetHash: nonEmptyStringSchema,\n  parentContainerKeyEpochId: z.string().nullable(),\n  recipientTargets: nonEmptyArraySchema(plainObjectSchema),\n  wraps: nonEmptyArraySchema(plainObjectSchema),\n};\n\nconst ContainerKekResponseSchema = registerJsonSchemaRuntimeRefinements(\n  loosePlainObject(containerKekResponseShape).superRefine((value, context) => {\n    if ((value.keyring === null) !== (value.containerKeyEpoch === 1)) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"container keyring must be null exactly at epoch 1\",\n        path: [\"keyring\"],\n      });\n    }\n  }),\n  [organizationProvisioningContainerKeyringRefinement],\n);\n\nexport type ContainerKekResponse = z.infer<typeof ContainerKekResponseSchema>;\n\n/**\n * The append-only rotation log for one container: every epoch with its\n * write-once bridge and sealed keyring. This is the rebuild/repair read\n * path — hot reads use the projection keyring instead.\n */\nexport const ContainerKekLogEpochResponseSchema = loosePlainObject({\n  accessManifestHash: nonEmptyStringSchema,\n  bridge: plainObjectSchema.nullable(),\n  containerKeyEpoch: positiveIntegerSchema,\n  containerKeyEpochId: nonEmptyStringSchema,\n  keyring: ContainerKekKeyringWireResponseSchema.nullable(),\n  parentContainerKeyEpochId: z.string().nullable(),\n  /**\n   * Retained recipient envelopes are the recovery backstop when a bridge is\n   * severed. The server and response guard apply this bound per epoch.\n   */\n  wraps: arraySchema(plainObjectSchema, CONTAINER_KEK_WRAPS_PER_EPOCH_LIMIT),\n});\n\nexport type ContainerKekLogEpochResponse = z.infer<\n  typeof ContainerKekLogEpochResponseSchema\n>;\n\nexport const ContainerKekLogResponseSchema =\n  registerJsonSchemaRuntimeRefinements(\n    loosePlainObject({\n      containerId: nonEmptyStringSchema,\n      epochs: arraySchema(\n        ContainerKekLogEpochResponseSchema,\n        CONTAINER_KEK_LOG_PAGE_LIMIT,\n      ),\n      /** True when epochs above this page's last remain unserved. */\n      hasMore: z.boolean(),\n    }).superRefine(({ epochs }, context) => {\n      if (epochs.filter((epoch) => epoch.keyring !== null).length > 1) {\n        context.addIssue({\n          code: \"custom\",\n          message: \"container KEK log pages contain at most one keyring\",\n          path: [\"epochs\"],\n        });\n      }\n    }),\n    [containerKekLogSingleKeyringRefinement],\n  );\n\nexport type ContainerKekLogResponse = z.infer<\n  typeof ContainerKekLogResponseSchema\n>;\n\nexport function isContainerKekLogResponse(\n  value: unknown,\n): value is ContainerKekLogResponse {\n  return ContainerKekLogResponseSchema.safeParse(value).success;\n}\n\nconst ContainerManifestMutationResponseShape = {\n  accessManifest: AccessManifestBundleWireResponseSchema,\n  containerId: z.string(),\n  createdAt: z.string(),\n  manifestHead: loosePlainObject({\n    epoch: z.number(),\n    manifestHash: z.string(),\n  }),\n  organizationId: z.string(),\n  parentId: z.string().nullable(),\n  referencedPrincipalHeads: arraySchema(\n    ContainerGrantPrincipalStateResponseSchema,\n  ),\n  systemSlot: ContainerSystemSlotSchema.nullable().optional(),\n  updatedAt: z.string(),\n};\n\n// Preserve the canonical generated field order while sharing the signed-head shape.\nconst { accessManifest, containerId, ...containerMutationResponseFields } =\n  ContainerManifestMutationResponseShape;\n\nconst containerMutationResponseShape = {\n  accessManifest,\n  containerId,\n  containerKek: ContainerKekResponseSchema,\n  ...containerMutationResponseFields,\n};\n\nexport const ContainerMutationResponseSchema = loosePlainObject(\n  containerMutationResponseShape,\n);\n\nexport type ContainerMutationResponse = z.infer<\n  typeof ContainerMutationResponseSchema\n>;\n\n/** A rotation's acknowledgement, plus one per carried rekey in request order. */\nexport const ContainerRotationResponseSchema = loosePlainObject({\n  ...containerMutationResponseShape,\n  containerRekeys: arraySchema(ContainerMutationResponseSchema).optional(),\n});\n\nexport type ContainerRotationResponse = z.infer<\n  typeof ContainerRotationResponseSchema\n>;\n\nexport function isContainerRotationResponse(\n  value: unknown,\n): value is ContainerRotationResponse {\n  return ContainerRotationResponseSchema.safeParse(value).success;\n}\n\nexport const ContainerReciteResponseSchema = loosePlainObject(\n  ContainerManifestMutationResponseShape,\n);\nexport type ContainerReciteResponse = z.infer<\n  typeof ContainerReciteResponseSchema\n>;\n\nexport function isContainerReciteResponse(\n  value: unknown,\n): value is ContainerReciteResponse {\n  return ContainerReciteResponseSchema.safeParse(value).success;\n}\n\nexport const ContainerDeleteResponseSchema = loosePlainObject({\n  containerId: z.string(),\n  deletedAt: z.string(),\n});\n\nexport type ContainerDeleteResponse = z.infer<\n  typeof ContainerDeleteResponseSchema\n>;\n\nexport const CONTAINER_PROJECTION_STATE_INVALID_ERROR_CODE =\n  \"container_projection_state_invalid\";\nexport const ContainerWriterProjectionErrorResponseSchema = loosePlainObject({\n  code: z.literal(CONTAINER_PROJECTION_STATE_INVALID_ERROR_CODE),\n  error: z.string(),\n});\n\nconst containerKeyingPathShape = {\n  containerId: z.string(),\n  containerKeks: arraySchema(ContainerKekResponseSchema),\n  organizationId: z.string(),\n  path: nonEmptyArraySchema(AccessManifestBundleWireResponseSchema),\n};\nfunction refineContainerKeyingPath(\n  projection: { containerKeks: unknown[]; path: unknown[] },\n  context: z.RefinementCtx,\n) {\n  // loosePlainObject can continue refinements after reporting malformed fields.\n  if (\n    Array.isArray(projection.containerKeks) &&\n    Array.isArray(projection.path) &&\n    projection.containerKeks.length !== projection.path.length\n  )\n    context.addIssue({\n      code: \"custom\",\n      message: \"container KEK count must match the manifest path length\",\n      path: [\"containerKeks\"],\n    });\n}\nexport const ContainerKeyingPathResponseSchema =\n  registerJsonSchemaRuntimeRefinements(\n    loosePlainObject(containerKeyingPathShape).superRefine(\n      refineContainerKeyingPath,\n    ),\n    [containerWriterProjectionPathKekCountRefinement],\n  );\nexport type ContainerKeyingPathResponse = z.infer<\n  typeof ContainerKeyingPathResponseSchema\n>;\nexport const ContainerWriterProjectionResponseSchema =\n  registerJsonSchemaRuntimeRefinements(\n    loosePlainObject({\n      ...containerKeyingPathShape,\n      policyEvidence: ProjectionPolicyEvidenceResponseSchema,\n      historyPrefixes: ProjectionHistoryPrefixesSchema.optional(),\n    }).superRefine(refineContainerKeyingPath),\n    [containerWriterProjectionPathKekCountRefinement],\n  );\n\nexport type ContainerWriterProjectionResponse = z.infer<\n  typeof ContainerWriterProjectionResponseSchema\n>;\n\nexport const ContainerSummaryResponseSchema = loosePlainObject({\n  createdAt: z.string(),\n  depth: nonNegativeIntegerSchema,\n  effectiveAccessLevel: EffectiveAccessLevelSchema,\n  id: z.string(),\n  metadataAccessEpoch: z.number(),\n  metadataAccessStateHash: nonEmptyStringSchema,\n  metadataDocumentId: z.string(),\n  metadataReferencedPrincipals: arraySchema(\n    ReferencedPrincipalStateResponseSchema,\n  ),\n  organizationId: z.string(),\n  parentId: z.string().nullable(),\n  systemSlot: ContainerSystemSlotSchema.nullable().optional(),\n  updatedAt: z.string(),\n});\n\nexport type ContainerSummary = z.infer<typeof ContainerSummaryResponseSchema>;\n\nexport const ContainerSyncTombstoneResponseSchema = loosePlainObject({\n  containerId: z.string(),\n  depth: nonNegativeIntegerSchema,\n  parentId: z.string().nullable(),\n  reason: z.literal([\"access_revoked\", \"deleted\"]),\n  updatedAt: z.string(),\n});\n\nexport type ContainerSyncTombstone = z.infer<\n  typeof ContainerSyncTombstoneResponseSchema\n>;\n\nexport const ListContainersResponseSchema = loosePlainObject({\n  hasMore: z.boolean(),\n  items: arraySchema(ContainerSummaryResponseSchema),\n  nextWatermark: SyncWatermarkSchema.nullable(),\n  tombstones: arraySchema(ContainerSyncTombstoneResponseSchema),\n});\n\nexport type ListContainersResponse = z.infer<\n  typeof ListContainersResponseSchema\n>;\n\nexport function isListContainersResponse(\n  value: unknown,\n): value is ListContainersResponse {\n  return ListContainersResponseSchema.safeParse(value).success;\n}\n\nexport function isContainerMutationResponse(\n  value: unknown,\n): value is ContainerMutationResponse {\n  return ContainerMutationResponseSchema.safeParse(value).success;\n}\n\nexport function isContainerDeleteResponse(\n  value: unknown,\n): value is ContainerDeleteResponse {\n  return ContainerDeleteResponseSchema.safeParse(value).success;\n}\n\nexport function isContainerWriterProjectionResponse(\n  value: unknown,\n): value is ContainerWriterProjectionResponse {\n  return ContainerWriterProjectionResponseSchema.safeParse(value).success;\n}\n"]}
+{"version":3,"file":"container.js","sourceRoot":"","sources":["container.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,sCAAsC,EAAE,MAAM,6BAA6B,CAAC;AACrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,oCAAoC,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,kDAAkD,EAAE,MAAM,wCAAwC,CAAC;AAC5G,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,sCAAsC,EACtC,4BAA4B,EAC5B,mCAAmC,EACnC,mCAAmC,GACpC,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,+CAA+C,EAC/C,yCAAyC,GAC1C,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,2BAA2B,EAC3B,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,sCAAsC,EACtC,qCAAqC,GACtC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,sCAAsC,EAAE,MAAM,4BAA4B,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD,MAAM,0CAA0C,GAAG,gBAAgB,CAAC;IAClE,GAAG,qCAAqC;IACxC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;CAClC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,qCAAqC,GACzC,mCAAmC,CAAC;AAMtC,MAAM,yBAAyB,GAAG;IAChC,kBAAkB,EAAE,oBAAoB;IACxC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,iBAAiB,EAAE,qBAAqB;IACxC,mBAAmB,EAAE,oBAAoB;IACzC,wBAAwB,EAAE,WAAW,CAAC,sCAAsC,CAAC;IAC7E,QAAQ,EAAE,iBAAiB;IAC3B,YAAY,EAAE,oBAAoB;IAClC,OAAO,EAAE,qCAAqC,CAAC,QAAQ,EAAE;IACzD,aAAa,EAAE,oBAAoB;IACnC,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChD,gBAAgB,EAAE,mBAAmB,CAAC,iBAAiB,CAAC;IACxD,KAAK,EAAE,mBAAmB,CAAC,iBAAiB,CAAC;CAC9C,CAAC;AAEF,SAAS,yBAAyB,CAChC,KAAwE,EACxE,OAAwB;IAExB,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,KAAK,CAAC,CAAC,EAAE,CAAC;QACjE,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,mDAAmD;YAC5D,IAAI,EAAE,CAAC,SAAS,CAAC;SAClB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,0BAA0B,GAAG,oCAAoC,CACrE,gBAAgB,CAAC,yBAAyB,CAAC,CAAC,WAAW,CACrD,yBAAyB,CAC1B,EACD,CAAC,kDAAkD,CAAC,CACrD,CAAC;AAEF,0EAA0E;AAC1E,MAAM,8BAA8B,GAAG,oCAAoC,CACzE,gBAAgB,CAAC;IACf,GAAG,yBAAyB;IAC5B,wBAAwB,EAAE,WAAW,CAAC,2BAA2B,CAAC;CACnE,CAAC,CAAC,WAAW,CAAC,yBAAyB,CAAC,EACzC,CAAC,kDAAkD,CAAC,CACrD,CAAC;AAIF;;;;GAIG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,gBAAgB,CAAC;IACjE,kBAAkB,EAAE,oBAAoB;IACxC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACpC,iBAAiB,EAAE,qBAAqB;IACxC,mBAAmB,EAAE,oBAAoB;IACzC,OAAO,EAAE,qCAAqC,CAAC,QAAQ,EAAE;IACzD,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChD;;;OAGG;IACH,KAAK,EAAE,WAAW,CAAC,iBAAiB,EAAE,mCAAmC,CAAC;CAC3E,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,6BAA6B,GACxC,oCAAoC,CAClC,gBAAgB,CAAC;IACf,WAAW,EAAE,oBAAoB;IACjC,MAAM,EAAE,WAAW,CACjB,kCAAkC,EAClC,4BAA4B,CAC7B;IACD,+DAA+D;IAC/D,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE;IACrC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChE,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,qDAAqD;YAC9D,IAAI,EAAE,CAAC,QAAQ,CAAC;SACjB,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,EACF,CAAC,sCAAsC,CAAC,CACzC,CAAC;AAMJ,MAAM,UAAU,yBAAyB,CACvC,KAAc;IAEd,OAAO,6BAA6B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAChE,CAAC;AAED,MAAM,sCAAsC,GAAG;IAC7C,cAAc,EAAE,sCAAsC;IACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,YAAY,EAAE,gBAAgB,CAAC;QAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;KACzB,CAAC;IACF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,wBAAwB,EAAE,WAAW,CACnC,0CAA0C,CAC3C;IACD,UAAU,EAAE,yBAAyB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC;AAEF,oFAAoF;AACpF,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,+BAA+B,EAAE,GACvE,sCAAsC,CAAC;AAEzC,MAAM,8BAA8B,GAAG;IACrC,cAAc;IACd,WAAW;IACX,YAAY,EAAE,0BAA0B;IACxC,GAAG,+BAA+B;CACnC,CAAC;AAEF,MAAM,CAAC,MAAM,+BAA+B,GAAG,gBAAgB,CAC7D,8BAA8B,CAC/B,CAAC;AAMF,iFAAiF;AACjF,MAAM,CAAC,MAAM,+BAA+B,GAAG,gBAAgB,CAAC;IAC9D,GAAG,8BAA8B;IACjC,eAAe,EAAE,WAAW,CAAC,+BAA+B,CAAC,CAAC,QAAQ,EAAE;CACzE,CAAC,CAAC;AAMH,MAAM,UAAU,2BAA2B,CACzC,KAAc;IAEd,OAAO,+BAA+B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,MAAM,6BAA6B,GAAG,gBAAgB,CAC3D,sCAAsC,CACvC,CAAC;AAKF,MAAM,UAAU,yBAAyB,CACvC,KAAc;IAEd,OAAO,6BAA6B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,MAAM,6BAA6B,GAAG,gBAAgB,CAAC;IAC5D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,6CAA6C,GACxD,oCAAoC,CAAC;AACvC,MAAM,CAAC,MAAM,4CAA4C,GAAG,gBAAgB,CAAC;IAC3E,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,6CAA6C,CAAC;IAC9D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,aAAa,EAAE,WAAW,CAAC,0BAA0B,CAAC;IACtD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,mBAAmB,CAAC,sCAAsC,CAAC;CAClE,CAAC;AACF,SAAS,yBAAyB,CAChC,UAAyD,EACzD,OAAwB;IAExB,8EAA8E;IAC9E,IACE,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC;QACvC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QAC9B,UAAU,CAAC,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI,CAAC,MAAM;QAE1D,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,yDAAyD;YAClE,IAAI,EAAE,CAAC,eAAe,CAAC;SACxB,CAAC,CAAC;AACP,CAAC;AACD,MAAM,CAAC,MAAM,iCAAiC,GAC5C,oCAAoC,CAClC,gBAAgB,CAAC,wBAAwB,CAAC,CAAC,WAAW,CACpD,yBAAyB,CAC1B,EACD,CAAC,+CAA+C,CAAC,CAClD,CAAC;AAIJ;;;GAGG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAClD,oCAAoC,CAClC,gBAAgB,CAAC;IACf,GAAG,wBAAwB;IAC3B,cAAc,EAAE,sCAAsC;CACvD,CAAC,CAAC,WAAW,CAAC,yBAAyB,CAAC,EACzC,CAAC,+CAA+C,CAAC,CAClD,CAAC;AAMJ,MAAM,4BAA4B,GAAG;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,aAAa,EAAE,WAAW,CAAC,8BAA8B,CAAC;IAC1D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,mBAAmB,CAAC,2BAA2B,CAAC;CACvD,CAAC;AACF,MAAM,CAAC,MAAM,qCAAqC,GAChD,oCAAoC,CAClC,gBAAgB,CAAC,4BAA4B,CAAC,CAAC,WAAW,CACxD,yBAAyB,CAC1B,EACD,CAAC,+CAA+C,CAAC,CAClD,CAAC;AAKJ;;;GAGG;AACH,MAAM,CAAC,MAAM,2CAA2C,GACtD,oCAAoC,CAClC,gBAAgB,CAAC;IACf,OAAO,EAAE,qBAAqB;IAC9B,cAAc,EAAE,4BAA4B;IAC5C,GAAG,4BAA4B;IAC/B,cAAc,EAAE,sCAAsC;CACvD,CAAC,CAAC,WAAW,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE;IACrC,yBAAyB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC/C,8BAA8B,CAC5B,UAAU,EACV,6BAA6B,CAAC,UAAU,CAAC,EACzC,OAAO,CACR,CAAC;AACJ,CAAC,CAAC,EACF;IACE,+CAA+C;IAC/C,yCAAyC;CAC1C,CACF,CAAC;AAMJ,MAAM,CAAC,MAAM,8BAA8B,GAAG,gBAAgB,CAAC;IAC7D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,wBAAwB;IAC/B,oBAAoB,EAAE,0BAA0B;IAChD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,uBAAuB,EAAE,oBAAoB;IAC7C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC9B,4BAA4B,EAAE,WAAW,CACvC,sCAAsC,CACvC;IACD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,UAAU,EAAE,yBAAyB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oCAAoC,GAAG,gBAAgB,CAAC;IACnE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,wBAAwB;IAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,4BAA4B,GAAG,gBAAgB,CAAC;IAC3D,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,KAAK,EAAE,WAAW,CAAC,8BAA8B,CAAC;IAClD,aAAa,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC7C,UAAU,EAAE,WAAW,CAAC,oCAAoC,CAAC;CAC9D,CAAC,CAAC;AAMH,MAAM,UAAU,wBAAwB,CACtC,KAAc;IAEd,OAAO,4BAA4B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,KAAc;IAEd,OAAO,+BAA+B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAAc;IAEd,OAAO,6BAA6B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,KAAc;IAEd,OAAO,uCAAuC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,KAAc;IAEd,OAAO,2CAA2C,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC9E,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { containerKekLogSingleKeyringRefinement } from \"../containerReadRefinements\";\nimport { ContainerSystemSlotSchema } from \"../containerSystemSlot\";\nimport { registerJsonSchemaRuntimeRefinements } from \"../jsonSchema\";\nimport { organizationProvisioningContainerKeyringRefinement } from \"../organizationProvisioningRefinements\";\nimport {\n  arraySchema,\n  loosePlainObject,\n  nonEmptyArraySchema,\n  nonEmptyStringSchema,\n  nonNegativeIntegerSchema,\n  plainObjectSchema,\n  positiveIntegerSchema,\n} from \"../schema\";\nimport {\n  AccessManifestBundleWireResponseSchema,\n  CONTAINER_KEK_LOG_PAGE_LIMIT,\n  CONTAINER_KEK_WRAPS_PER_EPOCH_LIMIT,\n  ContainerKekKeyringWireRecordSchema,\n} from \"../util\";\nimport {\n  containerWriterProjectionPathKekCountRefinement,\n  writerProjectionManifestBundlesRefinement,\n} from \"../writerProjectionRefinements\";\nimport { EffectiveAccessLevelSchema } from \"./accessLevel\";\nimport {\n  containerKeyingPathReferences,\n  ManifestBundlesSchema,\n  ManifestHashReferenceSchema,\n  OmittedManifestBundlesSchema,\n  refineManifestBundleReferences,\n} from \"./manifestBundleReferences\";\nimport {\n  ReferencedPrincipalStateResponseSchema,\n  ReferencedPrincipalStateResponseShape,\n} from \"./principalReference\";\nimport { ProjectionPolicyEvidenceResponseSchema } from \"./projectionPolicyEvidence\";\nimport { SyncWatermarkSchema } from \"./syncWatermark\";\n\nconst ContainerGrantPrincipalStateResponseSchema = loosePlainObject({\n  ...ReferencedPrincipalStateResponseShape,\n  principalType: z.literal(\"group\"),\n});\n\n/**\n * The container's sealed predecessor key history. Opening it under the\n * current KEK yields every retained historical KEK in one decrypt; the\n * bridge log behind it is served only by the rebuild read path.\n */\nconst ContainerKekKeyringWireResponseSchema =\n  ContainerKekKeyringWireRecordSchema;\n\nexport type ContainerKekKeyringWireResponse = z.infer<\n  typeof ContainerKekKeyringWireResponseSchema\n>;\n\nconst containerKekResponseShape = {\n  accessManifestHash: nonEmptyStringSchema,\n  containerId: z.string(),\n  containerKeyEpoch: positiveIntegerSchema,\n  containerKeyEpochId: nonEmptyStringSchema,\n  containerManifestHistory: arraySchema(AccessManifestBundleWireResponseSchema),\n  keyEpoch: plainObjectSchema,\n  keyEpochHash: nonEmptyStringSchema,\n  keyring: ContainerKekKeyringWireResponseSchema.nullable(),\n  keyTargetHash: nonEmptyStringSchema,\n  parentContainerKeyEpochId: z.string().nullable(),\n  recipientTargets: nonEmptyArraySchema(plainObjectSchema),\n  wraps: nonEmptyArraySchema(plainObjectSchema),\n};\n\nfunction refineContainerKekKeyring(\n  value: { readonly containerKeyEpoch: number; readonly keyring: unknown },\n  context: z.RefinementCtx,\n) {\n  if ((value.keyring === null) !== (value.containerKeyEpoch === 1)) {\n    context.addIssue({\n      code: \"custom\",\n      message: \"container keyring must be null exactly at epoch 1\",\n      path: [\"keyring\"],\n    });\n  }\n}\n\nconst ContainerKekResponseSchema = registerJsonSchemaRuntimeRefinements(\n  loosePlainObject(containerKekResponseShape).superRefine(\n    refineContainerKekKeyring,\n  ),\n  [organizationProvisioningContainerKeyringRefinement],\n);\n\n/** On the writer-projection wire, KEK history cites manifests by hash. */\nconst ContainerKekWireResponseSchema = registerJsonSchemaRuntimeRefinements(\n  loosePlainObject({\n    ...containerKekResponseShape,\n    containerManifestHistory: arraySchema(ManifestHashReferenceSchema),\n  }).superRefine(refineContainerKekKeyring),\n  [organizationProvisioningContainerKeyringRefinement],\n);\n\nexport type ContainerKekResponse = z.infer<typeof ContainerKekResponseSchema>;\n\n/**\n * The append-only rotation log for one container: every epoch with its\n * write-once bridge and sealed keyring. This is the rebuild/repair read\n * path — hot reads use the projection keyring instead.\n */\nexport const ContainerKekLogEpochResponseSchema = loosePlainObject({\n  accessManifestHash: nonEmptyStringSchema,\n  bridge: plainObjectSchema.nullable(),\n  containerKeyEpoch: positiveIntegerSchema,\n  containerKeyEpochId: nonEmptyStringSchema,\n  keyring: ContainerKekKeyringWireResponseSchema.nullable(),\n  parentContainerKeyEpochId: z.string().nullable(),\n  /**\n   * Retained recipient envelopes are the recovery backstop when a bridge is\n   * severed. The server and response guard apply this bound per epoch.\n   */\n  wraps: arraySchema(plainObjectSchema, CONTAINER_KEK_WRAPS_PER_EPOCH_LIMIT),\n});\n\nexport type ContainerKekLogEpochResponse = z.infer<\n  typeof ContainerKekLogEpochResponseSchema\n>;\n\nexport const ContainerKekLogResponseSchema =\n  registerJsonSchemaRuntimeRefinements(\n    loosePlainObject({\n      containerId: nonEmptyStringSchema,\n      epochs: arraySchema(\n        ContainerKekLogEpochResponseSchema,\n        CONTAINER_KEK_LOG_PAGE_LIMIT,\n      ),\n      /** True when epochs above this page's last remain unserved. */\n      hasMore: z.boolean(),\n    }).superRefine(({ epochs }, context) => {\n      if (epochs.filter((epoch) => epoch.keyring !== null).length > 1) {\n        context.addIssue({\n          code: \"custom\",\n          message: \"container KEK log pages contain at most one keyring\",\n          path: [\"epochs\"],\n        });\n      }\n    }),\n    [containerKekLogSingleKeyringRefinement],\n  );\n\nexport type ContainerKekLogResponse = z.infer<\n  typeof ContainerKekLogResponseSchema\n>;\n\nexport function isContainerKekLogResponse(\n  value: unknown,\n): value is ContainerKekLogResponse {\n  return ContainerKekLogResponseSchema.safeParse(value).success;\n}\n\nconst ContainerManifestMutationResponseShape = {\n  accessManifest: AccessManifestBundleWireResponseSchema,\n  containerId: z.string(),\n  createdAt: z.string(),\n  manifestHead: loosePlainObject({\n    epoch: z.number(),\n    manifestHash: z.string(),\n  }),\n  organizationId: z.string(),\n  parentId: z.string().nullable(),\n  referencedPrincipalHeads: arraySchema(\n    ContainerGrantPrincipalStateResponseSchema,\n  ),\n  systemSlot: ContainerSystemSlotSchema.nullable().optional(),\n  updatedAt: z.string(),\n};\n\n// Preserve the canonical generated field order while sharing the signed-head shape.\nconst { accessManifest, containerId, ...containerMutationResponseFields } =\n  ContainerManifestMutationResponseShape;\n\nconst containerMutationResponseShape = {\n  accessManifest,\n  containerId,\n  containerKek: ContainerKekResponseSchema,\n  ...containerMutationResponseFields,\n};\n\nexport const ContainerMutationResponseSchema = loosePlainObject(\n  containerMutationResponseShape,\n);\n\nexport type ContainerMutationResponse = z.infer<\n  typeof ContainerMutationResponseSchema\n>;\n\n/** A rotation's acknowledgement, plus one per carried rekey in request order. */\nexport const ContainerRotationResponseSchema = loosePlainObject({\n  ...containerMutationResponseShape,\n  containerRekeys: arraySchema(ContainerMutationResponseSchema).optional(),\n});\n\nexport type ContainerRotationResponse = z.infer<\n  typeof ContainerRotationResponseSchema\n>;\n\nexport function isContainerRotationResponse(\n  value: unknown,\n): value is ContainerRotationResponse {\n  return ContainerRotationResponseSchema.safeParse(value).success;\n}\n\nexport const ContainerReciteResponseSchema = loosePlainObject(\n  ContainerManifestMutationResponseShape,\n);\nexport type ContainerReciteResponse = z.infer<\n  typeof ContainerReciteResponseSchema\n>;\n\nexport function isContainerReciteResponse(\n  value: unknown,\n): value is ContainerReciteResponse {\n  return ContainerReciteResponseSchema.safeParse(value).success;\n}\n\nexport const ContainerDeleteResponseSchema = loosePlainObject({\n  containerId: z.string(),\n  deletedAt: z.string(),\n});\n\nexport type ContainerDeleteResponse = z.infer<\n  typeof ContainerDeleteResponseSchema\n>;\n\nexport const CONTAINER_PROJECTION_STATE_INVALID_ERROR_CODE =\n  \"container_projection_state_invalid\";\nexport const ContainerWriterProjectionErrorResponseSchema = loosePlainObject({\n  code: z.literal(CONTAINER_PROJECTION_STATE_INVALID_ERROR_CODE),\n  error: z.string(),\n});\n\nconst containerKeyingPathShape = {\n  containerId: z.string(),\n  containerKeks: arraySchema(ContainerKekResponseSchema),\n  organizationId: z.string(),\n  path: nonEmptyArraySchema(AccessManifestBundleWireResponseSchema),\n};\nfunction refineContainerKeyingPath(\n  projection: { containerKeks: unknown[]; path: unknown[] },\n  context: z.RefinementCtx,\n) {\n  // loosePlainObject can continue refinements after reporting malformed fields.\n  if (\n    Array.isArray(projection.containerKeks) &&\n    Array.isArray(projection.path) &&\n    projection.containerKeks.length !== projection.path.length\n  )\n    context.addIssue({\n      code: \"custom\",\n      message: \"container KEK count must match the manifest path length\",\n      path: [\"containerKeks\"],\n    });\n}\nexport const ContainerKeyingPathResponseSchema =\n  registerJsonSchemaRuntimeRefinements(\n    loosePlainObject(containerKeyingPathShape).superRefine(\n      refineContainerKeyingPath,\n    ),\n    [containerWriterProjectionPathKekCountRefinement],\n  );\nexport type ContainerKeyingPathResponse = z.infer<\n  typeof ContainerKeyingPathResponseSchema\n>;\n/**\n * The decoded projection a client verifies: every manifest position holds\n * its bundle. `decodeContainerWriterProjection` builds it from the wire.\n */\nexport const ContainerWriterProjectionResponseSchema =\n  registerJsonSchemaRuntimeRefinements(\n    loosePlainObject({\n      ...containerKeyingPathShape,\n      policyEvidence: ProjectionPolicyEvidenceResponseSchema,\n    }).superRefine(refineContainerKeyingPath),\n    [containerWriterProjectionPathKekCountRefinement],\n  );\n\nexport type ContainerWriterProjectionResponse = z.infer<\n  typeof ContainerWriterProjectionResponseSchema\n>;\n\nconst containerKeyingPathWireShape = {\n  containerId: z.string(),\n  containerKeks: arraySchema(ContainerKekWireResponseSchema),\n  organizationId: z.string(),\n  path: nonEmptyArraySchema(ManifestHashReferenceSchema),\n};\nexport const ContainerKeyingPathWireResponseSchema =\n  registerJsonSchemaRuntimeRefinements(\n    loosePlainObject(containerKeyingPathWireShape).superRefine(\n      refineContainerKeyingPath,\n    ),\n    [containerWriterProjectionPathKekCountRefinement],\n  );\nexport type ContainerKeyingPathWireResponse = z.infer<\n  typeof ContainerKeyingPathWireResponseSchema\n>;\n\n/**\n * The served shape: manifest positions cite `bundles` by hash, except hashes\n * the request declared already held, which `omittedBundles` lists instead.\n */\nexport const ContainerWriterProjectionWireResponseSchema =\n  registerJsonSchemaRuntimeRefinements(\n    loosePlainObject({\n      bundles: ManifestBundlesSchema,\n      omittedBundles: OmittedManifestBundlesSchema,\n      ...containerKeyingPathWireShape,\n      policyEvidence: ProjectionPolicyEvidenceResponseSchema,\n    }).superRefine((projection, context) => {\n      refineContainerKeyingPath(projection, context);\n      refineManifestBundleReferences(\n        projection,\n        containerKeyingPathReferences(projection),\n        context,\n      );\n    }),\n    [\n      containerWriterProjectionPathKekCountRefinement,\n      writerProjectionManifestBundlesRefinement,\n    ],\n  );\n\nexport type ContainerWriterProjectionWireResponse = z.infer<\n  typeof ContainerWriterProjectionWireResponseSchema\n>;\n\nexport const ContainerSummaryResponseSchema = loosePlainObject({\n  createdAt: z.string(),\n  depth: nonNegativeIntegerSchema,\n  effectiveAccessLevel: EffectiveAccessLevelSchema,\n  id: z.string(),\n  metadataAccessEpoch: z.number(),\n  metadataAccessStateHash: nonEmptyStringSchema,\n  metadataDocumentId: z.string(),\n  metadataReferencedPrincipals: arraySchema(\n    ReferencedPrincipalStateResponseSchema,\n  ),\n  organizationId: z.string(),\n  parentId: z.string().nullable(),\n  systemSlot: ContainerSystemSlotSchema.nullable().optional(),\n  updatedAt: z.string(),\n});\n\nexport type ContainerSummary = z.infer<typeof ContainerSummaryResponseSchema>;\n\nexport const ContainerSyncTombstoneResponseSchema = loosePlainObject({\n  containerId: z.string(),\n  depth: nonNegativeIntegerSchema,\n  parentId: z.string().nullable(),\n  reason: z.literal([\"access_revoked\", \"deleted\"]),\n  updatedAt: z.string(),\n});\n\nexport type ContainerSyncTombstone = z.infer<\n  typeof ContainerSyncTombstoneResponseSchema\n>;\n\nexport const ListContainersResponseSchema = loosePlainObject({\n  hasMore: z.boolean(),\n  items: arraySchema(ContainerSummaryResponseSchema),\n  nextWatermark: SyncWatermarkSchema.nullable(),\n  tombstones: arraySchema(ContainerSyncTombstoneResponseSchema),\n});\n\nexport type ListContainersResponse = z.infer<\n  typeof ListContainersResponseSchema\n>;\n\nexport function isListContainersResponse(\n  value: unknown,\n): value is ListContainersResponse {\n  return ListContainersResponseSchema.safeParse(value).success;\n}\n\nexport function isContainerMutationResponse(\n  value: unknown,\n): value is ContainerMutationResponse {\n  return ContainerMutationResponseSchema.safeParse(value).success;\n}\n\nexport function isContainerDeleteResponse(\n  value: unknown,\n): value is ContainerDeleteResponse {\n  return ContainerDeleteResponseSchema.safeParse(value).success;\n}\n\nexport function isContainerWriterProjectionResponse(\n  value: unknown,\n): value is ContainerWriterProjectionResponse {\n  return ContainerWriterProjectionResponseSchema.safeParse(value).success;\n}\n\nexport function isContainerWriterProjectionWireResponse(\n  value: unknown,\n): value is ContainerWriterProjectionWireResponse {\n  return ContainerWriterProjectionWireResponseSchema.safeParse(value).success;\n}\n"]}

package/internal/validators/response/documentMutation.d.ts

@@ -1248,11 +1248,6 @@ export declare const DocumentWriterProjectionResponseSchema: z.ZodType<{
         manifestHash: string;
         state: Record<string, unknown>;
     }[];
-    historyPrefixes?: {
-        key: string;
-        count: number;
-        digest: string;
-    }[] | undefined;
     contentKeyBundleStale?: true | undefined;
 }, {
     policyEvidence: {
@@ -1405,11 +1400,6 @@ export declare const DocumentWriterProjectionResponseSchema: z.ZodType<{
         manifestHash: string;
         state: Record<string, unknown>;
     }[];
-    historyPrefixes?: {
-        key: string;
-        count: number;
-        digest: string;
-    }[] | undefined;
     contentKeyBundleStale?: true | undefined;
 }, z.core.$ZodTypeInternals<{
     policyEvidence: {
@@ -1562,11 +1552,6 @@ export declare const DocumentWriterProjectionResponseSchema: z.ZodType<{
         manifestHash: string;
         state: Record<string, unknown>;
     }[];
-    historyPrefixes?: {
-        key: string;
-        count: number;
-        digest: string;
-    }[] | undefined;
     contentKeyBundleStale?: true | undefined;
 }, {
     policyEvidence: {
@@ -1719,14 +1704,448 @@ export declare const DocumentWriterProjectionResponseSchema: z.ZodType<{
         manifestHash: string;
         state: Record<string, unknown>;
     }[];
-    historyPrefixes?: {
-        key: string;
-        count: number;
-        digest: string;
-    }[] | undefined;
     contentKeyBundleStale?: true | undefined;
 }>>;
 export type DocumentWriterProjectionResponse = z.infer<typeof DocumentWriterProjectionResponseSchema>;
+/** The served shape; see ContainerWriterProjectionWireResponseSchema. */
+export declare const DocumentWriterProjectionWireResponseSchema: z.ZodType<{
+    bundles: Record<string, {
+        event: {
+            body: unknown;
+            event: Record<string, unknown>;
+            eventHash: string;
+        };
+        manifest: Record<string, unknown>;
+        manifestHash: string;
+        state: Record<string, unknown>;
+    }>;
+    omittedBundles: string[];
+    policyEvidence: {
+        organization: {
+            head: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group" | "organization";
+                stateHash: string;
+                version: number;
+            };
+            grant: string;
+        } | null;
+        organizationPayloads: {
+            reference: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group" | "organization";
+                stateHash: string;
+                version: number;
+            };
+            payload: {
+                cipherSuite: "aes-256-gcm";
+                ciphertext: string;
+                ciphertextHash: string;
+                createdAt: string;
+                principalId: string;
+                principalType: "group" | "organization";
+                stateHash: string;
+            };
+        }[];
+        groups: {
+            head: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group" | "organization";
+                stateHash: string;
+                version: number;
+            };
+            grant: string;
+        }[];
+    };
+    authorizingContainerPaths: {
+        containerId: string;
+        containerKeks: {
+            containerManifestHistory: string[];
+            accessManifestHash: string;
+            containerId: string;
+            containerKeyEpoch: number;
+            containerKeyEpochId: string;
+            keyEpoch: Record<string, unknown>;
+            keyEpochHash: string;
+            keyring: {
+                containerId: string;
+                containerKeyEpochId: string;
+                iv: string;
+                sealed: string;
+                sealingSuite: string;
+                version: number;
+            } | null;
+            keyTargetHash: string;
+            parentContainerKeyEpochId: string | null;
+            recipientTargets: Record<string, unknown>[];
+            wraps: Record<string, unknown>[];
+        }[];
+        organizationId: string;
+        path: string[];
+    }[];
+    contentKeyBundle: {
+        contentKeyEpoch: number;
+        documentId: string;
+        linkSetManifestHash: string;
+        targetHash: string;
+        targets: {
+            containerId: string;
+            containerKeyEpoch: number;
+            containerKeyEpochId: string;
+            containerManifestHash: string;
+            wrappedKey: string;
+            wrappingMetadata: Record<string, unknown>;
+        }[];
+    };
+    documentContainerManifestHistory: string[];
+    documentId: string;
+    documentKekTargets: {
+        documentId: string;
+        documentKeyTargetHash: string;
+        linkedContainerKeyEpochIds: string[];
+        linkedContainerManifestHashes: string[];
+        linkSetManifestHash: string;
+        targets: Record<string, unknown>[];
+    };
+    documentManifest: string;
+    documentManifestContainerPaths: string[][];
+    documentManifestHistory: string[];
+    contentKeyBundleStale?: true | undefined;
+}, {
+    bundles: Record<string, {
+        event: {
+            body: unknown;
+            event: Record<string, unknown>;
+            eventHash: string;
+        };
+        manifest: Record<string, unknown>;
+        manifestHash: string;
+        state: Record<string, unknown>;
+    }>;
+    omittedBundles: string[];
+    policyEvidence: {
+        organization: {
+            head: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group" | "organization";
+                stateHash: string;
+                version: number;
+            };
+            grant: string;
+        } | null;
+        organizationPayloads: {
+            reference: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group" | "organization";
+                stateHash: string;
+                version: number;
+            };
+            payload: {
+                cipherSuite: "aes-256-gcm";
+                ciphertext: string;
+                ciphertextHash: string;
+                createdAt: string;
+                principalId: string;
+                principalType: "group" | "organization";
+                stateHash: string;
+            };
+        }[];
+        groups: {
+            head: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group" | "organization";
+                stateHash: string;
+                version: number;
+            };
+            grant: string;
+        }[];
+    };
+    authorizingContainerPaths: {
+        containerId: string;
+        containerKeks: {
+            containerManifestHistory: string[];
+            accessManifestHash: string;
+            containerId: string;
+            containerKeyEpoch: number;
+            containerKeyEpochId: string;
+            keyEpoch: Record<string, unknown>;
+            keyEpochHash: string;
+            keyring: {
+                containerId: string;
+                containerKeyEpochId: string;
+                iv: string;
+                sealed: string;
+                sealingSuite: string;
+                version: number;
+            } | null;
+            keyTargetHash: string;
+            parentContainerKeyEpochId: string | null;
+            recipientTargets: Record<string, unknown>[];
+            wraps: Record<string, unknown>[];
+        }[];
+        organizationId: string;
+        path: string[];
+    }[];
+    contentKeyBundle: {
+        contentKeyEpoch: number;
+        documentId: string;
+        linkSetManifestHash: string;
+        targetHash: string;
+        targets: {
+            containerId: string;
+            containerKeyEpoch: number;
+            containerKeyEpochId: string;
+            containerManifestHash: string;
+            wrappedKey: string;
+            wrappingMetadata: Record<string, unknown>;
+        }[];
+    };
+    documentContainerManifestHistory: string[];
+    documentId: string;
+    documentKekTargets: {
+        documentId: string;
+        documentKeyTargetHash: string;
+        linkedContainerKeyEpochIds: string[];
+        linkedContainerManifestHashes: string[];
+        linkSetManifestHash: string;
+        targets: Record<string, unknown>[];
+    };
+    documentManifest: string;
+    documentManifestContainerPaths: string[][];
+    documentManifestHistory: string[];
+    contentKeyBundleStale?: true | undefined;
+}, z.core.$ZodTypeInternals<{
+    bundles: Record<string, {
+        event: {
+            body: unknown;
+            event: Record<string, unknown>;
+            eventHash: string;
+        };
+        manifest: Record<string, unknown>;
+        manifestHash: string;
+        state: Record<string, unknown>;
+    }>;
+    omittedBundles: string[];
+    policyEvidence: {
+        organization: {
+            head: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group" | "organization";
+                stateHash: string;
+                version: number;
+            };
+            grant: string;
+        } | null;
+        organizationPayloads: {
+            reference: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group" | "organization";
+                stateHash: string;
+                version: number;
+            };
+            payload: {
+                cipherSuite: "aes-256-gcm";
+                ciphertext: string;
+                ciphertextHash: string;
+                createdAt: string;
+                principalId: string;
+                principalType: "group" | "organization";
+                stateHash: string;
+            };
+        }[];
+        groups: {
+            head: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group" | "organization";
+                stateHash: string;
+                version: number;
+            };
+            grant: string;
+        }[];
+    };
+    authorizingContainerPaths: {
+        containerId: string;
+        containerKeks: {
+            containerManifestHistory: string[];
+            accessManifestHash: string;
+            containerId: string;
+            containerKeyEpoch: number;
+            containerKeyEpochId: string;
+            keyEpoch: Record<string, unknown>;
+            keyEpochHash: string;
+            keyring: {
+                containerId: string;
+                containerKeyEpochId: string;
+                iv: string;
+                sealed: string;
+                sealingSuite: string;
+                version: number;
+            } | null;
+            keyTargetHash: string;
+            parentContainerKeyEpochId: string | null;
+            recipientTargets: Record<string, unknown>[];
+            wraps: Record<string, unknown>[];
+        }[];
+        organizationId: string;
+        path: string[];
+    }[];
+    contentKeyBundle: {
+        contentKeyEpoch: number;
+        documentId: string;
+        linkSetManifestHash: string;
+        targetHash: string;
+        targets: {
+            containerId: string;
+            containerKeyEpoch: number;
+            containerKeyEpochId: string;
+            containerManifestHash: string;
+            wrappedKey: string;
+            wrappingMetadata: Record<string, unknown>;
+        }[];
+    };
+    documentContainerManifestHistory: string[];
+    documentId: string;
+    documentKekTargets: {
+        documentId: string;
+        documentKeyTargetHash: string;
+        linkedContainerKeyEpochIds: string[];
+        linkedContainerManifestHashes: string[];
+        linkSetManifestHash: string;
+        targets: Record<string, unknown>[];
+    };
+    documentManifest: string;
+    documentManifestContainerPaths: string[][];
+    documentManifestHistory: string[];
+    contentKeyBundleStale?: true | undefined;
+}, {
+    bundles: Record<string, {
+        event: {
+            body: unknown;
+            event: Record<string, unknown>;
+            eventHash: string;
+        };
+        manifest: Record<string, unknown>;
+        manifestHash: string;
+        state: Record<string, unknown>;
+    }>;
+    omittedBundles: string[];
+    policyEvidence: {
+        organization: {
+            head: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group" | "organization";
+                stateHash: string;
+                version: number;
+            };
+            grant: string;
+        } | null;
+        organizationPayloads: {
+            reference: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group" | "organization";
+                stateHash: string;
+                version: number;
+            };
+            payload: {
+                cipherSuite: "aes-256-gcm";
+                ciphertext: string;
+                ciphertextHash: string;
+                createdAt: string;
+                principalId: string;
+                principalType: "group" | "organization";
+                stateHash: string;
+            };
+        }[];
+        groups: {
+            head: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group" | "organization";
+                stateHash: string;
+                version: number;
+            };
+            grant: string;
+        }[];
+    };
+    authorizingContainerPaths: {
+        containerId: string;
+        containerKeks: {
+            containerManifestHistory: string[];
+            accessManifestHash: string;
+            containerId: string;
+            containerKeyEpoch: number;
+            containerKeyEpochId: string;
+            keyEpoch: Record<string, unknown>;
+            keyEpochHash: string;
+            keyring: {
+                containerId: string;
+                containerKeyEpochId: string;
+                iv: string;
+                sealed: string;
+                sealingSuite: string;
+                version: number;
+            } | null;
+            keyTargetHash: string;
+            parentContainerKeyEpochId: string | null;
+            recipientTargets: Record<string, unknown>[];
+            wraps: Record<string, unknown>[];
+        }[];
+        organizationId: string;
+        path: string[];
+    }[];
+    contentKeyBundle: {
+        contentKeyEpoch: number;
+        documentId: string;
+        linkSetManifestHash: string;
+        targetHash: string;
+        targets: {
+            containerId: string;
+            containerKeyEpoch: number;
+            containerKeyEpochId: string;
+            containerManifestHash: string;
+            wrappedKey: string;
+            wrappingMetadata: Record<string, unknown>;
+        }[];
+    };
+    documentContainerManifestHistory: string[];
+    documentId: string;
+    documentKekTargets: {
+        documentId: string;
+        documentKeyTargetHash: string;
+        linkedContainerKeyEpochIds: string[];
+        linkedContainerManifestHashes: string[];
+        linkSetManifestHash: string;
+        targets: Record<string, unknown>[];
+    };
+    documentManifest: string;
+    documentManifestContainerPaths: string[][];
+    documentManifestHistory: string[];
+    contentKeyBundleStale?: true | undefined;
+}>>;
+export type DocumentWriterProjectionWireResponse = z.infer<typeof DocumentWriterProjectionWireResponseSchema>;
 /**
  * Derives the KEK-target summary that corresponds to a content-key bundle,
  * preserving the bundle's served target order. Both the API (for stale-bundle
@@ -1743,3 +2162,4 @@ export declare function isDocumentPurgeResponse(value: unknown): value is Docume
 export declare function isDocumentPurgeProofResponse(value: unknown): value is DocumentPurgeProofResponse;
 export declare function isDocumentSyncResponse(value: unknown): value is DocumentSyncResponse;
 export declare function isDocumentWriterProjectionResponse(value: unknown): value is DocumentWriterProjectionResponse;
+export declare function isDocumentWriterProjectionWireResponse(value: unknown): value is DocumentWriterProjectionWireResponse;