@tearleads/client-sdk 0.1.47 → 0.1.49

package/internal/validators/request/principal.d.ts

@@ -1008,6 +1008,89 @@ export declare const CommitOrganizationGroupPolicyRequestSchema: z.ZodType<{
             userRecipientKeys?: Record<string, unknown>[] | undefined;
         }[] | undefined;
     };
+    memberPolicy?: {
+        encryptedPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+        };
+        grants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        memberEnvelopes: {
+            kemCipherText: string;
+            memberKeyFingerprint: string;
+            userId: string;
+            wrappedKey: string;
+        }[];
+        projection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        state: {
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            version: number;
+        };
+        containerMutations?: {
+            body: unknown;
+            event: Record<string, unknown>;
+            expectedManifestHash: string;
+            keyEpoch: Record<string, unknown>;
+            keyring: Record<string, unknown> | null;
+            manifest: Record<string, unknown>;
+            predecessorBridge: Record<string, unknown> | null;
+            principalPolicies: Record<string, unknown>[];
+            wraps: Record<string, unknown>[];
+            containerManifestHistoryRefs?: {
+                containerId: string;
+                manifestHash: string;
+            }[] | undefined;
+            destinationParentContainerPathRefs?: {
+                containerId: string;
+                manifestHash: string;
+            }[] | undefined;
+            parentContainerPathRefs?: {
+                containerId: string;
+                manifestHash: string;
+            }[] | undefined;
+            parentKekState?: Record<string, unknown> | null | undefined;
+            previousContainerPathRefs?: {
+                containerId: string;
+                manifestHash: string;
+            }[] | undefined;
+            previousManifestRef?: {
+                containerId: string;
+                manifestHash: string;
+            } | null | undefined;
+            userRecipientKeys?: Record<string, unknown>[] | undefined;
+        }[] | undefined;
+    } | undefined;
 }, {
     groupPolicy: {
         encryptedPayload: {
@@ -1175,6 +1258,89 @@ export declare const CommitOrganizationGroupPolicyRequestSchema: z.ZodType<{
             userRecipientKeys?: Record<string, unknown>[] | undefined;
         }[] | undefined;
     };
+    memberPolicy?: {
+        encryptedPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+        };
+        grants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        memberEnvelopes: {
+            kemCipherText: string;
+            memberKeyFingerprint: string;
+            userId: string;
+            wrappedKey: string;
+        }[];
+        projection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        state: {
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            version: number;
+        };
+        containerMutations?: {
+            body: unknown;
+            event: Record<string, unknown>;
+            expectedManifestHash: string;
+            keyEpoch: Record<string, unknown>;
+            keyring: Record<string, unknown> | null;
+            manifest: Record<string, unknown>;
+            predecessorBridge: Record<string, unknown> | null;
+            principalPolicies: Record<string, unknown>[];
+            wraps: Record<string, unknown>[];
+            containerManifestHistoryRefs?: {
+                containerId: string;
+                manifestHash: string;
+            }[] | undefined;
+            destinationParentContainerPathRefs?: {
+                containerId: string;
+                manifestHash: string;
+            }[] | undefined;
+            parentContainerPathRefs?: {
+                containerId: string;
+                manifestHash: string;
+            }[] | undefined;
+            parentKekState?: Record<string, unknown> | null | undefined;
+            previousContainerPathRefs?: {
+                containerId: string;
+                manifestHash: string;
+            }[] | undefined;
+            previousManifestRef?: {
+                containerId: string;
+                manifestHash: string;
+            } | null | undefined;
+            userRecipientKeys?: Record<string, unknown>[] | undefined;
+        }[] | undefined;
+    } | undefined;
 }, z.core.$ZodTypeInternals<{
     groupPolicy: {
         encryptedPayload: {
@@ -1342,6 +1508,89 @@ export declare const CommitOrganizationGroupPolicyRequestSchema: z.ZodType<{
             userRecipientKeys?: Record<string, unknown>[] | undefined;
         }[] | undefined;
     };
+    memberPolicy?: {
+        encryptedPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+        };
+        grants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        memberEnvelopes: {
+            kemCipherText: string;
+            memberKeyFingerprint: string;
+            userId: string;
+            wrappedKey: string;
+        }[];
+        projection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        state: {
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            version: number;
+        };
+        containerMutations?: {
+            body: unknown;
+            event: Record<string, unknown>;
+            expectedManifestHash: string;
+            keyEpoch: Record<string, unknown>;
+            keyring: Record<string, unknown> | null;
+            manifest: Record<string, unknown>;
+            predecessorBridge: Record<string, unknown> | null;
+            principalPolicies: Record<string, unknown>[];
+            wraps: Record<string, unknown>[];
+            containerManifestHistoryRefs?: {
+                containerId: string;
+                manifestHash: string;
+            }[] | undefined;
+            destinationParentContainerPathRefs?: {
+                containerId: string;
+                manifestHash: string;
+            }[] | undefined;
+            parentContainerPathRefs?: {
+                containerId: string;
+                manifestHash: string;
+            }[] | undefined;
+            parentKekState?: Record<string, unknown> | null | undefined;
+            previousContainerPathRefs?: {
+                containerId: string;
+                manifestHash: string;
+            }[] | undefined;
+            previousManifestRef?: {
+                containerId: string;
+                manifestHash: string;
+            } | null | undefined;
+            userRecipientKeys?: Record<string, unknown>[] | undefined;
+        }[] | undefined;
+    } | undefined;
 }, {
     groupPolicy: {
         encryptedPayload: {
@@ -1509,6 +1758,89 @@ export declare const CommitOrganizationGroupPolicyRequestSchema: z.ZodType<{
             userRecipientKeys?: Record<string, unknown>[] | undefined;
         }[] | undefined;
     };
+    memberPolicy?: {
+        encryptedPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+        };
+        grants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        memberEnvelopes: {
+            kemCipherText: string;
+            memberKeyFingerprint: string;
+            userId: string;
+            wrappedKey: string;
+        }[];
+        projection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        state: {
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            version: number;
+        };
+        containerMutations?: {
+            body: unknown;
+            event: Record<string, unknown>;
+            expectedManifestHash: string;
+            keyEpoch: Record<string, unknown>;
+            keyring: Record<string, unknown> | null;
+            manifest: Record<string, unknown>;
+            predecessorBridge: Record<string, unknown> | null;
+            principalPolicies: Record<string, unknown>[];
+            wraps: Record<string, unknown>[];
+            containerManifestHistoryRefs?: {
+                containerId: string;
+                manifestHash: string;
+            }[] | undefined;
+            destinationParentContainerPathRefs?: {
+                containerId: string;
+                manifestHash: string;
+            }[] | undefined;
+            parentContainerPathRefs?: {
+                containerId: string;
+                manifestHash: string;
+            }[] | undefined;
+            parentKekState?: Record<string, unknown> | null | undefined;
+            previousContainerPathRefs?: {
+                containerId: string;
+                manifestHash: string;
+            }[] | undefined;
+            previousManifestRef?: {
+                containerId: string;
+                manifestHash: string;
+            } | null | undefined;
+            userRecipientKeys?: Record<string, unknown>[] | undefined;
+        }[] | undefined;
+    } | undefined;
 }>>;
 export type CommitOrganizationGroupPolicyRequest = z.infer<typeof CommitOrganizationGroupPolicyRequestSchema>;
 export declare function isPutPrincipalPolicyRequest(value: unknown): value is PutPrincipalPolicyRequest;

package/internal/validators/request/principal.js

@@ -72,6 +72,7 @@ export const OrganizationPrincipalPolicyRequestSchema = loosePlainObject({
 });
 export const CommitOrganizationGroupPolicyRequestSchema = loosePlainObject({
     groupPolicy: PutPrincipalPolicyRequestSchema,
+    memberPolicy: PutPrincipalPolicyRequestSchema.optional(),
     organizationPolicy: OrganizationPrincipalPolicyRequestSchema,
 });
 export function isPutPrincipalPolicyRequest(value) {

package/internal/validators/request/principal.js.map

@@ -1 +1 @@
-{"version":3,"file":"principal.js","sourceRoot":"","sources":["principal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EACL,WAAW,EACX,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAE7D,MAAM,sCAAsC,GAAG,gBAAgB,CAAC;IAC9D,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,EAAE,kBAAkB;CAC3B,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,oCAAoC,GAAG,gBAAgB,CAAC;IACnE,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAClD,WAAW,EAAE,kBAAkB;CAChC,CAAC,CAAC;AAMH,MAAM,4CAA4C,GAAG,gBAAgB,CAAC;IACpE,QAAQ,EAAE,4BAA4B,CAAC,MAAM,CAAC,gBAAgB,CAAC;IAC/D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,WAAW,EAAE,kBAAkB;IAC/B,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,OAAO,EAAE,4BAA4B,CAAC,MAAM,CAAC,gBAAgB,CAAC;CAC/D,CAAC,CAAC;AAEH,MAAM,2BAA2B,GAAG,gBAAgB,CAAC;IACnD,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE;IAClC,iBAAiB,EAAE,4CAA4C,CAAC,QAAQ,EAAE;IAC1E,UAAU,EAAE,wBAAwB;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,4BAA4B,CAAC,MAAM,CAAC,gBAAgB,CAAC;IAC/D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,WAAW,EAAE,wBAAwB;IACrC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IACvC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;IACjC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,WAAW,EAAE,kBAAkB;IAC/B,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACnD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,0BAA0B,CAClC,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,mBAAmB,EAAE;QACrC,OAAO,EAAE,oBAAoB,kBAAkB,EAAE;KAClD,CAAC,EACF,EAAE,OAAO,EAAE,2BAA2B,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAChE;IACD,YAAY,EAAE,kBAAkB;IAChC,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE;IACpC,OAAO,EAAE,4BAA4B,CAAC,MAAM,CAAC,gBAAgB,CAAC;CAC/D,CAAC,CAAC;AAIH,MAAM,2CAA2C,GAAG,gBAAgB,CAAC;IACnE,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;CAC3B,CAAC,CAAC;AAMH,MAAM,oCAAoC,GAAG,gBAAgB,CAAC;IAC5D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,MAAM,EAAE,kBAAkB;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,+BAA+B,GAAG,gBAAgB,CAAC;IAC9D,kBAAkB,EAAE,WAAW,CAAC,8BAA8B,CAAC,CAAC,QAAQ,EAAE;IAC1E,gBAAgB,EAAE,2CAA2C;IAC7D,MAAM,EAAE,WAAW,CAAC,oCAAoC,CAAC;IACzD,eAAe,EAAE,WAAW,CAAC,oCAAoC,CAAC;IAClE,UAAU,EAAE,WAAW,CAAC,sCAAsC,CAAC;IAC/D,KAAK,EAAE,2BAA2B;CACnC,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,wCAAwC,GAAG,gBAAgB,CAAC;IACvE,kBAAkB,EAAE,WAAW,CAAC,8BAA8B,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7E,gBAAgB,EAAE,2CAA2C;IAC7D,MAAM,EAAE,WAAW,CAAC,oCAAoC,CAAC;IACzD,eAAe,EAAE,WAAW,CAAC,oCAAoC,CAAC;IAClE,UAAU,EAAE,WAAW,CAAC,sCAAsC,CAAC;IAC/D,KAAK,EAAE,2BAA2B;CACnC,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,0CAA0C,GAAG,gBAAgB,CAAC;IACzE,WAAW,EAAE,+BAA+B;IAC5C,kBAAkB,EAAE,wCAAwC;CAC7D,CAAC,CAAC;AAMH,MAAM,UAAU,2BAA2B,CACzC,KAAc;IAEd,OAAO,+BAA+B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,KAAc;IAEd,OAAO,wCAAwC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,KAAc;IAEd,OAAO,0CAA0C,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC7E,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { registerJsonSchemaFragment } from \"../jsonSchema\";\nimport {\n  arraySchema,\n  boundedPositiveIntegerSchema,\n  loosePlainObject,\n  nonNegativeIntegerSchema,\n  uuidV4StringSchema,\n} from \"../schema\";\nimport {\n  CANONICAL_SIGNED_AT_PATTERN,\n  isCanonicalSignedAt,\n  SIGNED_AT_CONTRACT,\n} from \"../util\";\nimport { ContainerMutationRequestSchema } from \"./container\";\n\nconst PrincipalProjectionMemberRequestSchema = loosePlainObject({\n  role: z.literal([\"member\", \"admin\"]),\n  userId: uuidV4StringSchema,\n});\n\nexport type PrincipalProjectionMemberRequest = z.infer<\n  typeof PrincipalProjectionMemberRequestSchema\n>;\n\nexport const PrincipalContainerGrantRequestSchema = loosePlainObject({\n  accessLevel: z.literal([\"admin\", \"read\", \"write\"]),\n  containerId: uuidV4StringSchema,\n});\n\nexport type PrincipalContainerGrantRequest = z.infer<\n  typeof PrincipalContainerGrantRequestSchema\n>;\n\nconst PrincipalStateExternalAuthorityRequestSchema = loosePlainObject({\n  keyEpoch: boundedPositiveIntegerSchema(Number.MAX_SAFE_INTEGER),\n  keyFingerprint: z.string(),\n  principalId: uuidV4StringSchema,\n  principalType: z.literal(\"group\"),\n  stateHash: z.string(),\n  version: boundedPositiveIntegerSchema(Number.MAX_SAFE_INTEGER),\n});\n\nconst PrincipalStateRequestSchema = loosePlainObject({\n  encapsulationPublicKey: z.string(),\n  externalAuthority: PrincipalStateExternalAuthorityRequestSchema.nullable(),\n  grantCount: nonNegativeIntegerSchema,\n  grantRoot: z.string(),\n  keyEpoch: boundedPositiveIntegerSchema(Number.MAX_SAFE_INTEGER),\n  keyFingerprint: z.string(),\n  memberCount: nonNegativeIntegerSchema,\n  memberEnvelopesRoot: z.string(),\n  membershipMode: z.literal(\"projection\"),\n  membershipRoot: z.string(),\n  payloadCiphertextHash: z.string(),\n  prevStateHash: z.string().nullable(),\n  principalId: uuidV4StringSchema,\n  principalType: z.literal([\"group\", \"organization\"]),\n  projectionRoot: z.string(),\n  signature: z.string(),\n  signedAt: registerJsonSchemaFragment(\n    z.string().refine(isCanonicalSignedAt, {\n      message: `signedAt must be ${SIGNED_AT_CONTRACT}`,\n    }),\n    { pattern: CANONICAL_SIGNED_AT_PATTERN.source, type: \"string\" },\n  ),\n  signerUserId: uuidV4StringSchema,\n  signerUserKeyFingerprint: z.string(),\n  version: boundedPositiveIntegerSchema(Number.MAX_SAFE_INTEGER),\n});\n\nexport type PrincipalStateRequest = z.infer<typeof PrincipalStateRequestSchema>;\n\nconst PrincipalStateEncryptedPayloadRequestSchema = loosePlainObject({\n  cipherSuite: z.literal(\"aes-256-gcm\"),\n  ciphertext: z.string(),\n  ciphertextHash: z.string(),\n});\n\nexport type PrincipalStateEncryptedPayloadRequest = z.infer<\n  typeof PrincipalStateEncryptedPayloadRequestSchema\n>;\n\nconst PrincipalMemberEnvelopeRequestSchema = loosePlainObject({\n  kemCipherText: z.string(),\n  memberKeyFingerprint: z.string(),\n  userId: uuidV4StringSchema,\n  wrappedKey: z.string(),\n});\n\nexport type PrincipalMemberEnvelopeRequest = z.infer<\n  typeof PrincipalMemberEnvelopeRequestSchema\n>;\n\nexport const PutPrincipalPolicyRequestSchema = loosePlainObject({\n  containerMutations: arraySchema(ContainerMutationRequestSchema).optional(),\n  encryptedPayload: PrincipalStateEncryptedPayloadRequestSchema,\n  grants: arraySchema(PrincipalContainerGrantRequestSchema),\n  memberEnvelopes: arraySchema(PrincipalMemberEnvelopeRequestSchema),\n  projection: arraySchema(PrincipalProjectionMemberRequestSchema),\n  state: PrincipalStateRequestSchema,\n});\n\nexport type PutPrincipalPolicyRequest = z.infer<\n  typeof PutPrincipalPolicyRequestSchema\n>;\n\nexport const OrganizationPrincipalPolicyRequestSchema = loosePlainObject({\n  containerMutations: arraySchema(ContainerMutationRequestSchema, 0).optional(),\n  encryptedPayload: PrincipalStateEncryptedPayloadRequestSchema,\n  grants: arraySchema(PrincipalContainerGrantRequestSchema),\n  memberEnvelopes: arraySchema(PrincipalMemberEnvelopeRequestSchema),\n  projection: arraySchema(PrincipalProjectionMemberRequestSchema),\n  state: PrincipalStateRequestSchema,\n});\n\nexport type OrganizationPrincipalPolicyRequest = z.infer<\n  typeof OrganizationPrincipalPolicyRequestSchema\n>;\n\nexport const CommitOrganizationGroupPolicyRequestSchema = loosePlainObject({\n  groupPolicy: PutPrincipalPolicyRequestSchema,\n  organizationPolicy: OrganizationPrincipalPolicyRequestSchema,\n});\n\nexport type CommitOrganizationGroupPolicyRequest = z.infer<\n  typeof CommitOrganizationGroupPolicyRequestSchema\n>;\n\nexport function isPutPrincipalPolicyRequest(\n  value: unknown,\n): value is PutPrincipalPolicyRequest {\n  return PutPrincipalPolicyRequestSchema.safeParse(value).success;\n}\n\nexport function isOrganizationPrincipalPolicyRequest(\n  value: unknown,\n): value is OrganizationPrincipalPolicyRequest {\n  return OrganizationPrincipalPolicyRequestSchema.safeParse(value).success;\n}\n\nexport function isCommitOrganizationGroupPolicyRequest(\n  value: unknown,\n): value is CommitOrganizationGroupPolicyRequest {\n  return CommitOrganizationGroupPolicyRequestSchema.safeParse(value).success;\n}\n"]}
+{"version":3,"file":"principal.js","sourceRoot":"","sources":["principal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EACL,WAAW,EACX,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAE7D,MAAM,sCAAsC,GAAG,gBAAgB,CAAC;IAC9D,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,EAAE,kBAAkB;CAC3B,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,oCAAoC,GAAG,gBAAgB,CAAC;IACnE,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAClD,WAAW,EAAE,kBAAkB;CAChC,CAAC,CAAC;AAMH,MAAM,4CAA4C,GAAG,gBAAgB,CAAC;IACpE,QAAQ,EAAE,4BAA4B,CAAC,MAAM,CAAC,gBAAgB,CAAC;IAC/D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,WAAW,EAAE,kBAAkB;IAC/B,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,OAAO,EAAE,4BAA4B,CAAC,MAAM,CAAC,gBAAgB,CAAC;CAC/D,CAAC,CAAC;AAEH,MAAM,2BAA2B,GAAG,gBAAgB,CAAC;IACnD,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE;IAClC,iBAAiB,EAAE,4CAA4C,CAAC,QAAQ,EAAE;IAC1E,UAAU,EAAE,wBAAwB;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,4BAA4B,CAAC,MAAM,CAAC,gBAAgB,CAAC;IAC/D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,WAAW,EAAE,wBAAwB;IACrC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IACvC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;IACjC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,WAAW,EAAE,kBAAkB;IAC/B,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACnD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,0BAA0B,CAClC,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,mBAAmB,EAAE;QACrC,OAAO,EAAE,oBAAoB,kBAAkB,EAAE;KAClD,CAAC,EACF,EAAE,OAAO,EAAE,2BAA2B,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAChE;IACD,YAAY,EAAE,kBAAkB;IAChC,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE;IACpC,OAAO,EAAE,4BAA4B,CAAC,MAAM,CAAC,gBAAgB,CAAC;CAC/D,CAAC,CAAC;AAIH,MAAM,2CAA2C,GAAG,gBAAgB,CAAC;IACnE,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;CAC3B,CAAC,CAAC;AAMH,MAAM,oCAAoC,GAAG,gBAAgB,CAAC;IAC5D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,MAAM,EAAE,kBAAkB;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,+BAA+B,GAAG,gBAAgB,CAAC;IAC9D,kBAAkB,EAAE,WAAW,CAAC,8BAA8B,CAAC,CAAC,QAAQ,EAAE;IAC1E,gBAAgB,EAAE,2CAA2C;IAC7D,MAAM,EAAE,WAAW,CAAC,oCAAoC,CAAC;IACzD,eAAe,EAAE,WAAW,CAAC,oCAAoC,CAAC;IAClE,UAAU,EAAE,WAAW,CAAC,sCAAsC,CAAC;IAC/D,KAAK,EAAE,2BAA2B;CACnC,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,wCAAwC,GAAG,gBAAgB,CAAC;IACvE,kBAAkB,EAAE,WAAW,CAAC,8BAA8B,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7E,gBAAgB,EAAE,2CAA2C;IAC7D,MAAM,EAAE,WAAW,CAAC,oCAAoC,CAAC;IACzD,eAAe,EAAE,WAAW,CAAC,oCAAoC,CAAC;IAClE,UAAU,EAAE,WAAW,CAAC,sCAAsC,CAAC;IAC/D,KAAK,EAAE,2BAA2B;CACnC,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,0CAA0C,GAAG,gBAAgB,CAAC;IACzE,WAAW,EAAE,+BAA+B;IAC5C,YAAY,EAAE,+BAA+B,CAAC,QAAQ,EAAE;IACxD,kBAAkB,EAAE,wCAAwC;CAC7D,CAAC,CAAC;AAMH,MAAM,UAAU,2BAA2B,CACzC,KAAc;IAEd,OAAO,+BAA+B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,KAAc;IAEd,OAAO,wCAAwC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,KAAc;IAEd,OAAO,0CAA0C,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC7E,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { registerJsonSchemaFragment } from \"../jsonSchema\";\nimport {\n  arraySchema,\n  boundedPositiveIntegerSchema,\n  loosePlainObject,\n  nonNegativeIntegerSchema,\n  uuidV4StringSchema,\n} from \"../schema\";\nimport {\n  CANONICAL_SIGNED_AT_PATTERN,\n  isCanonicalSignedAt,\n  SIGNED_AT_CONTRACT,\n} from \"../util\";\nimport { ContainerMutationRequestSchema } from \"./container\";\n\nconst PrincipalProjectionMemberRequestSchema = loosePlainObject({\n  role: z.literal([\"member\", \"admin\"]),\n  userId: uuidV4StringSchema,\n});\n\nexport type PrincipalProjectionMemberRequest = z.infer<\n  typeof PrincipalProjectionMemberRequestSchema\n>;\n\nexport const PrincipalContainerGrantRequestSchema = loosePlainObject({\n  accessLevel: z.literal([\"admin\", \"read\", \"write\"]),\n  containerId: uuidV4StringSchema,\n});\n\nexport type PrincipalContainerGrantRequest = z.infer<\n  typeof PrincipalContainerGrantRequestSchema\n>;\n\nconst PrincipalStateExternalAuthorityRequestSchema = loosePlainObject({\n  keyEpoch: boundedPositiveIntegerSchema(Number.MAX_SAFE_INTEGER),\n  keyFingerprint: z.string(),\n  principalId: uuidV4StringSchema,\n  principalType: z.literal(\"group\"),\n  stateHash: z.string(),\n  version: boundedPositiveIntegerSchema(Number.MAX_SAFE_INTEGER),\n});\n\nconst PrincipalStateRequestSchema = loosePlainObject({\n  encapsulationPublicKey: z.string(),\n  externalAuthority: PrincipalStateExternalAuthorityRequestSchema.nullable(),\n  grantCount: nonNegativeIntegerSchema,\n  grantRoot: z.string(),\n  keyEpoch: boundedPositiveIntegerSchema(Number.MAX_SAFE_INTEGER),\n  keyFingerprint: z.string(),\n  memberCount: nonNegativeIntegerSchema,\n  memberEnvelopesRoot: z.string(),\n  membershipMode: z.literal(\"projection\"),\n  membershipRoot: z.string(),\n  payloadCiphertextHash: z.string(),\n  prevStateHash: z.string().nullable(),\n  principalId: uuidV4StringSchema,\n  principalType: z.literal([\"group\", \"organization\"]),\n  projectionRoot: z.string(),\n  signature: z.string(),\n  signedAt: registerJsonSchemaFragment(\n    z.string().refine(isCanonicalSignedAt, {\n      message: `signedAt must be ${SIGNED_AT_CONTRACT}`,\n    }),\n    { pattern: CANONICAL_SIGNED_AT_PATTERN.source, type: \"string\" },\n  ),\n  signerUserId: uuidV4StringSchema,\n  signerUserKeyFingerprint: z.string(),\n  version: boundedPositiveIntegerSchema(Number.MAX_SAFE_INTEGER),\n});\n\nexport type PrincipalStateRequest = z.infer<typeof PrincipalStateRequestSchema>;\n\nconst PrincipalStateEncryptedPayloadRequestSchema = loosePlainObject({\n  cipherSuite: z.literal(\"aes-256-gcm\"),\n  ciphertext: z.string(),\n  ciphertextHash: z.string(),\n});\n\nexport type PrincipalStateEncryptedPayloadRequest = z.infer<\n  typeof PrincipalStateEncryptedPayloadRequestSchema\n>;\n\nconst PrincipalMemberEnvelopeRequestSchema = loosePlainObject({\n  kemCipherText: z.string(),\n  memberKeyFingerprint: z.string(),\n  userId: uuidV4StringSchema,\n  wrappedKey: z.string(),\n});\n\nexport type PrincipalMemberEnvelopeRequest = z.infer<\n  typeof PrincipalMemberEnvelopeRequestSchema\n>;\n\nexport const PutPrincipalPolicyRequestSchema = loosePlainObject({\n  containerMutations: arraySchema(ContainerMutationRequestSchema).optional(),\n  encryptedPayload: PrincipalStateEncryptedPayloadRequestSchema,\n  grants: arraySchema(PrincipalContainerGrantRequestSchema),\n  memberEnvelopes: arraySchema(PrincipalMemberEnvelopeRequestSchema),\n  projection: arraySchema(PrincipalProjectionMemberRequestSchema),\n  state: PrincipalStateRequestSchema,\n});\n\nexport type PutPrincipalPolicyRequest = z.infer<\n  typeof PutPrincipalPolicyRequestSchema\n>;\n\nexport const OrganizationPrincipalPolicyRequestSchema = loosePlainObject({\n  containerMutations: arraySchema(ContainerMutationRequestSchema, 0).optional(),\n  encryptedPayload: PrincipalStateEncryptedPayloadRequestSchema,\n  grants: arraySchema(PrincipalContainerGrantRequestSchema),\n  memberEnvelopes: arraySchema(PrincipalMemberEnvelopeRequestSchema),\n  projection: arraySchema(PrincipalProjectionMemberRequestSchema),\n  state: PrincipalStateRequestSchema,\n});\n\nexport type OrganizationPrincipalPolicyRequest = z.infer<\n  typeof OrganizationPrincipalPolicyRequestSchema\n>;\n\nexport const CommitOrganizationGroupPolicyRequestSchema = loosePlainObject({\n  groupPolicy: PutPrincipalPolicyRequestSchema,\n  memberPolicy: PutPrincipalPolicyRequestSchema.optional(),\n  organizationPolicy: OrganizationPrincipalPolicyRequestSchema,\n});\n\nexport type CommitOrganizationGroupPolicyRequest = z.infer<\n  typeof CommitOrganizationGroupPolicyRequestSchema\n>;\n\nexport function isPutPrincipalPolicyRequest(\n  value: unknown,\n): value is PutPrincipalPolicyRequest {\n  return PutPrincipalPolicyRequestSchema.safeParse(value).success;\n}\n\nexport function isOrganizationPrincipalPolicyRequest(\n  value: unknown,\n): value is OrganizationPrincipalPolicyRequest {\n  return OrganizationPrincipalPolicyRequestSchema.safeParse(value).success;\n}\n\nexport function isCommitOrganizationGroupPolicyRequest(\n  value: unknown,\n): value is CommitOrganizationGroupPolicyRequest {\n  return CommitOrganizationGroupPolicyRequestSchema.safeParse(value).success;\n}\n"]}