@tearleads/client-sdk 0.1.48 → 0.1.50

package/internal/validators/response/principal.d.ts

@@ -1356,6 +1356,128 @@ export declare const CommitOrganizationGroupPolicyResponseSchema: z.ZodType<{
             version: number;
         };
     };
+    memberPolicy?: {
+        containerMutations: {
+            createdAt: string;
+            manifestHead: {
+                epoch: number;
+                manifestHash: string;
+            };
+            organizationId: string;
+            parentId: string | null;
+            referencedPrincipalHeads: {
+                principalType: "group";
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                stateHash: string;
+                version: number;
+            }[];
+            updatedAt: string;
+            accessManifest: {
+                event: {
+                    body: unknown;
+                    event: Record<string, unknown>;
+                    eventHash: string;
+                };
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            };
+            containerId: string;
+            containerKek: {
+                accessManifestHash: string;
+                containerId: string;
+                containerKeyEpoch: number;
+                containerKeyEpochId: string;
+                containerManifestHistory: {
+                    event: {
+                        body: unknown;
+                        event: Record<string, unknown>;
+                        eventHash: string;
+                    };
+                    manifest: Record<string, unknown>;
+                    manifestHash: string;
+                    state: Record<string, unknown>;
+                }[];
+                keyEpoch: Record<string, unknown>;
+                keyEpochHash: string;
+                keyring: {
+                    containerId: string;
+                    containerKeyEpochId: string;
+                    iv: string;
+                    sealed: string;
+                    sealingSuite: string;
+                    version: number;
+                } | null;
+                keyTargetHash: string;
+                parentContainerKeyEpochId: string | null;
+                recipientTargets: Record<string, unknown>[];
+                wraps: Record<string, unknown>[];
+            };
+            systemSlot?: string | null | undefined;
+        }[];
+        currentGrants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        currentMemberEnvelopes: {
+            envelopes: {
+                kemCipherText: string;
+                memberKeyFingerprint: string;
+                userId: string;
+                wrappedKey: string;
+            }[];
+            epoch: number;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+            createdAt: string;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentProjection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        currentState: {
+            createdAt: string;
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            stateHash: string;
+            version: number;
+        };
+    } | undefined;
 }, {
     groupPolicy: {
         containerMutations: {
@@ -1601,6 +1723,128 @@ export declare const CommitOrganizationGroupPolicyResponseSchema: z.ZodType<{
             version: number;
         };
     };
+    memberPolicy?: {
+        containerMutations: {
+            createdAt: string;
+            manifestHead: {
+                epoch: number;
+                manifestHash: string;
+            };
+            organizationId: string;
+            parentId: string | null;
+            referencedPrincipalHeads: {
+                principalType: "group";
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                stateHash: string;
+                version: number;
+            }[];
+            updatedAt: string;
+            accessManifest: {
+                event: {
+                    body: unknown;
+                    event: Record<string, unknown>;
+                    eventHash: string;
+                };
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            };
+            containerId: string;
+            containerKek: {
+                accessManifestHash: string;
+                containerId: string;
+                containerKeyEpoch: number;
+                containerKeyEpochId: string;
+                containerManifestHistory: {
+                    event: {
+                        body: unknown;
+                        event: Record<string, unknown>;
+                        eventHash: string;
+                    };
+                    manifest: Record<string, unknown>;
+                    manifestHash: string;
+                    state: Record<string, unknown>;
+                }[];
+                keyEpoch: Record<string, unknown>;
+                keyEpochHash: string;
+                keyring: {
+                    containerId: string;
+                    containerKeyEpochId: string;
+                    iv: string;
+                    sealed: string;
+                    sealingSuite: string;
+                    version: number;
+                } | null;
+                keyTargetHash: string;
+                parentContainerKeyEpochId: string | null;
+                recipientTargets: Record<string, unknown>[];
+                wraps: Record<string, unknown>[];
+            };
+            systemSlot?: string | null | undefined;
+        }[];
+        currentGrants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        currentMemberEnvelopes: {
+            envelopes: {
+                kemCipherText: string;
+                memberKeyFingerprint: string;
+                userId: string;
+                wrappedKey: string;
+            }[];
+            epoch: number;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+            createdAt: string;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentProjection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        currentState: {
+            createdAt: string;
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            stateHash: string;
+            version: number;
+        };
+    } | undefined;
 }, z.core.$ZodTypeInternals<{
     groupPolicy: {
         containerMutations: {
@@ -1846,6 +2090,128 @@ export declare const CommitOrganizationGroupPolicyResponseSchema: z.ZodType<{
             version: number;
         };
     };
+    memberPolicy?: {
+        containerMutations: {
+            createdAt: string;
+            manifestHead: {
+                epoch: number;
+                manifestHash: string;
+            };
+            organizationId: string;
+            parentId: string | null;
+            referencedPrincipalHeads: {
+                principalType: "group";
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                stateHash: string;
+                version: number;
+            }[];
+            updatedAt: string;
+            accessManifest: {
+                event: {
+                    body: unknown;
+                    event: Record<string, unknown>;
+                    eventHash: string;
+                };
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            };
+            containerId: string;
+            containerKek: {
+                accessManifestHash: string;
+                containerId: string;
+                containerKeyEpoch: number;
+                containerKeyEpochId: string;
+                containerManifestHistory: {
+                    event: {
+                        body: unknown;
+                        event: Record<string, unknown>;
+                        eventHash: string;
+                    };
+                    manifest: Record<string, unknown>;
+                    manifestHash: string;
+                    state: Record<string, unknown>;
+                }[];
+                keyEpoch: Record<string, unknown>;
+                keyEpochHash: string;
+                keyring: {
+                    containerId: string;
+                    containerKeyEpochId: string;
+                    iv: string;
+                    sealed: string;
+                    sealingSuite: string;
+                    version: number;
+                } | null;
+                keyTargetHash: string;
+                parentContainerKeyEpochId: string | null;
+                recipientTargets: Record<string, unknown>[];
+                wraps: Record<string, unknown>[];
+            };
+            systemSlot?: string | null | undefined;
+        }[];
+        currentGrants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        currentMemberEnvelopes: {
+            envelopes: {
+                kemCipherText: string;
+                memberKeyFingerprint: string;
+                userId: string;
+                wrappedKey: string;
+            }[];
+            epoch: number;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+            createdAt: string;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentProjection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        currentState: {
+            createdAt: string;
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            stateHash: string;
+            version: number;
+        };
+    } | undefined;
 }, {
     groupPolicy: {
         containerMutations: {
@@ -2091,6 +2457,128 @@ export declare const CommitOrganizationGroupPolicyResponseSchema: z.ZodType<{
             version: number;
         };
     };
+    memberPolicy?: {
+        containerMutations: {
+            createdAt: string;
+            manifestHead: {
+                epoch: number;
+                manifestHash: string;
+            };
+            organizationId: string;
+            parentId: string | null;
+            referencedPrincipalHeads: {
+                principalType: "group";
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                stateHash: string;
+                version: number;
+            }[];
+            updatedAt: string;
+            accessManifest: {
+                event: {
+                    body: unknown;
+                    event: Record<string, unknown>;
+                    eventHash: string;
+                };
+                manifest: Record<string, unknown>;
+                manifestHash: string;
+                state: Record<string, unknown>;
+            };
+            containerId: string;
+            containerKek: {
+                accessManifestHash: string;
+                containerId: string;
+                containerKeyEpoch: number;
+                containerKeyEpochId: string;
+                containerManifestHistory: {
+                    event: {
+                        body: unknown;
+                        event: Record<string, unknown>;
+                        eventHash: string;
+                    };
+                    manifest: Record<string, unknown>;
+                    manifestHash: string;
+                    state: Record<string, unknown>;
+                }[];
+                keyEpoch: Record<string, unknown>;
+                keyEpochHash: string;
+                keyring: {
+                    containerId: string;
+                    containerKeyEpochId: string;
+                    iv: string;
+                    sealed: string;
+                    sealingSuite: string;
+                    version: number;
+                } | null;
+                keyTargetHash: string;
+                parentContainerKeyEpochId: string | null;
+                recipientTargets: Record<string, unknown>[];
+                wraps: Record<string, unknown>[];
+            };
+            systemSlot?: string | null | undefined;
+        }[];
+        currentGrants: {
+            accessLevel: "admin" | "read" | "write";
+            containerId: string;
+        }[];
+        currentMemberEnvelopes: {
+            envelopes: {
+                kemCipherText: string;
+                memberKeyFingerprint: string;
+                userId: string;
+                wrappedKey: string;
+            }[];
+            epoch: number;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentPayload: {
+            cipherSuite: "aes-256-gcm";
+            ciphertext: string;
+            ciphertextHash: string;
+            createdAt: string;
+            principalId: string;
+            principalType: "group" | "organization";
+            stateHash: string;
+        };
+        currentProjection: {
+            role: "member" | "admin";
+            userId: string;
+        }[];
+        currentState: {
+            createdAt: string;
+            encapsulationPublicKey: string;
+            externalAuthority: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                principalId: string;
+                principalType: "group";
+                stateHash: string;
+                version: number;
+            } | null;
+            grantCount: number;
+            grantRoot: string;
+            keyEpoch: number;
+            keyFingerprint: string;
+            memberCount: number;
+            memberEnvelopesRoot: string;
+            membershipMode: "projection";
+            membershipRoot: string;
+            payloadCiphertextHash: string;
+            prevStateHash: string | null;
+            principalId: string;
+            principalType: "group" | "organization";
+            projectionRoot: string;
+            signature: string;
+            signedAt: string;
+            signerUserId: string;
+            signerUserKeyFingerprint: string;
+            stateHash: string;
+            version: number;
+        };
+    } | undefined;
 }>>;
 export type CommitOrganizationGroupPolicyResponse = z.infer<typeof CommitOrganizationGroupPolicyResponseSchema>;
 export declare const PrincipalPolicyErrorResponseSchema: z.ZodType<{

package/internal/validators/response/principal.js

@@ -25,6 +25,7 @@ export const PrincipalPolicyMutationResponseSchema = loosePlainObject({
 });
 export const CommitOrganizationGroupPolicyResponseSchema = loosePlainObject({
     groupPolicy: PrincipalPolicyMutationResponseSchema,
+    memberPolicy: PrincipalPolicyMutationResponseSchema.optional(),
     organizationPolicy: PrincipalPolicyMutationResponseSchema,
 });
 export const PrincipalPolicyErrorResponseSchema = BillingErrorResponseSchema;

package/internal/validators/response/principal.js.map

@@ -1 +1 @@
-{"version":3,"file":"principal.js","sourceRoot":"","sources":["principal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,MAAM,SAAS,CAAC;AACxD,OAAO,EAAE,kCAAkC,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,+BAA+B,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,+CAA+C,EAAE,MAAM,iCAAiC,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,sCAAsC,EAAE,MAAM,sBAAsB,CAAC;AAE9E,OAAO,EACL,6CAA6C,EAC7C,qCAAqC,EACrC,4CAA4C,EAC5C,uCAAuC,EACvC,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAEL,6CAA6C,EAC7C,yCAAyC,EACzC,wCAAwC,EACxC,+BAA+B,EAC/B,wBAAwB,EAExB,qCAAqC,EAErC,qCAAqC,EAErC,qCAAqC,EAErC,4CAA4C,EAE5C,uCAAuC,EAEvC,6CAA6C,EAE7C,mCAAmC,EAEnC,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,MAAM,CAAC,MAAM,mCAAmC,GAAG;IACjD,aAAa,EAAE,WAAW,CAAC,qCAAqC,CAAC;IACjE,sBAAsB,EAAE,6CAA6C;IACrE,cAAc,EAAE,mCAAmC;IACnD,iBAAiB,EAAE,WAAW,CAAC,uCAAuC,CAAC;IACvE,YAAY,EAAE,4BAA4B;CAC3C,CAAC;AAEF,MAAM,CAAC,MAAM,mCAAmC,GAAG,gBAAgB,CAAC;IAClE,GAAG,mCAAmC;IACtC,cAAc,EAAE,WAAW,CAAC,4CAA4C,CAAC;CAC1E,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,qCAAqC,GAAG,gBAAgB,CAAC;IACpE,GAAG,mCAAmC;IACtC,kBAAkB,EAAE,WAAW,CAAC,+BAA+B,CAAC;CACjE,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,2CAA2C,GAAG,gBAAgB,CAAC;IAC1E,WAAW,EAAE,qCAAqC;IAClD,kBAAkB,EAAE,qCAAqC;CAC1D,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,kCAAkC,GAAG,0BAA0B,CAAC;AAM7E;;;;;GAKG;AACH,MAAM,qDAAqD,GAAG,gBAAgB,CAAC;IAC7E,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,+CAA+C,CAAC;IAChE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,oBAAoB,EAAE,WAAW,CAC/B,oBAAoB,EACpB,6BAA6B,CAC9B;CACF,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,CAAC,KAAK,CAAC;IACzE,kCAAkC;IAClC,qDAAqD;CACtD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uCAAuC,GAAG,gBAAgB,CAAC;IACtE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,cAAc,EAAE,WAAW,CACzB,sCAAsC,EACtC,kCAAkC,CACnC;CACF,CAAC,CAAC;AAMH,MAAM,UAAU,+BAA+B,CAC7C,KAAc;IAEd,OAAO,mCAAmC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,KAAc;IAEd,OAAO,qCAAqC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,KAAc;IAEd,OAAO,2CAA2C,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,KAAc;IAEd,OAAO,uCAAuC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC1E,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { arraySchema, loosePlainObject, nonEmptyStringSchema } from \"../schema\";\nimport { MAX_ROTATION_CONTAINER_REKEYS } from \"../util\";\nimport { PRINCIPAL_POLICY_REPAIR_HEAD_LIMIT } from \"../util/principalHistoryWire\";\nimport { ContainerMutationResponseSchema } from \"./container\";\nimport { CONTAINER_DESCENDANT_REKEYS_REQUIRED_ERROR_CODE } from \"./descendantRekeysRequiredError\";\nimport { BillingErrorResponseSchema } from \"./organizationBilling\";\nimport { ReferencedPrincipalStateResponseSchema } from \"./principalReference\";\n\nimport {\n  CurrentPrincipalMemberEnvelopesResponseSchema,\n  PrincipalContainerGrantResponseSchema,\n  PrincipalPolicyStateChainEntryResponseSchema,\n  PrincipalProjectionMemberResponseSchema,\n  PrincipalStatePayloadResponseSchema,\n  PrincipalStateResponseSchema,\n} from \"./principalSnapshot\";\n\nexport {\n  type CurrentPrincipalMemberEnvelopesResponse,\n  CurrentPrincipalMemberEnvelopesResponseSchema,\n  isCurrentPrincipalMemberEnvelopesResponse,\n  isPrincipalPolicyStateChainEntryResponse,\n  isPrincipalStatePayloadResponse,\n  isPrincipalStateResponse,\n  type PrincipalContainerGrantResponse,\n  PrincipalContainerGrantResponseSchema,\n  type PrincipalMemberEnvelopeResponse,\n  PrincipalMemberEnvelopeResponseSchema,\n  type PrincipalPolicySnapshotResponse,\n  PrincipalPolicySnapshotResponseSchema,\n  type PrincipalPolicyStateChainEntryResponse,\n  PrincipalPolicyStateChainEntryResponseSchema,\n  type PrincipalProjectionMemberResponse,\n  PrincipalProjectionMemberResponseSchema,\n  type PrincipalStateExternalAuthorityResponse,\n  PrincipalStateExternalAuthorityResponseSchema,\n  type PrincipalStatePayloadResponse,\n  PrincipalStatePayloadResponseSchema,\n  type PrincipalStateResponse,\n  PrincipalStateResponseSchema,\n} from \"./principalSnapshot\";\n\nexport const principalPolicyCurrentResponseShape = {\n  currentGrants: arraySchema(PrincipalContainerGrantResponseSchema),\n  currentMemberEnvelopes: CurrentPrincipalMemberEnvelopesResponseSchema,\n  currentPayload: PrincipalStatePayloadResponseSchema,\n  currentProjection: arraySchema(PrincipalProjectionMemberResponseSchema),\n  currentState: PrincipalStateResponseSchema,\n};\n\nexport const PrincipalPolicyBundleResponseSchema = loosePlainObject({\n  ...principalPolicyCurrentResponseShape,\n  previousStates: arraySchema(PrincipalPolicyStateChainEntryResponseSchema),\n});\n\nexport type PrincipalPolicyBundleResponse = z.infer<\n  typeof PrincipalPolicyBundleResponseSchema\n>;\n\nexport const PrincipalPolicyMutationResponseSchema = loosePlainObject({\n  ...principalPolicyCurrentResponseShape,\n  containerMutations: arraySchema(ContainerMutationResponseSchema),\n});\n\nexport type PrincipalPolicyMutationResponse = z.infer<\n  typeof PrincipalPolicyMutationResponseSchema\n>;\n\nexport const CommitOrganizationGroupPolicyResponseSchema = loosePlainObject({\n  groupPolicy: PrincipalPolicyMutationResponseSchema,\n  organizationPolicy: PrincipalPolicyMutationResponseSchema,\n});\n\nexport type CommitOrganizationGroupPolicyResponse = z.infer<\n  typeof CommitOrganizationGroupPolicyResponseSchema\n>;\n\nexport const PrincipalPolicyErrorResponseSchema = BillingErrorResponseSchema;\n\nexport type PrincipalPolicyErrorResponse = z.infer<\n  typeof PrincipalPolicyErrorResponseSchema\n>;\n\n/**\n * A group policy change rematerializes its granted containers, and a rekey or\n * revoke among them is a rotation like any other: one that would leave a level\n * above a directly granted container pinned to a retired epoch is refused, and\n * this names the descendant rekeys the batch must carry, parent-first.\n */\nconst PrincipalPolicyDescendantRekeysRequiredResponseSchema = loosePlainObject({\n  code: z.literal(CONTAINER_DESCENDANT_REKEYS_REQUIRED_ERROR_CODE),\n  error: z.string().min(1),\n  requiredContainerIds: arraySchema(\n    nonEmptyStringSchema,\n    MAX_ROTATION_CONTAINER_REKEYS,\n  ),\n});\n\n/**\n * The commit's conflict envelope alone: only a group commit carries container\n * mutations, so only it can be refused for what they strand. The principal\n * policy read and the organization policy write keep the plain envelope.\n */\nexport const CommitOrganizationGroupPolicyConflictResponseSchema = z.union([\n  PrincipalPolicyErrorResponseSchema,\n  PrincipalPolicyDescendantRekeysRequiredResponseSchema,\n]);\n\nexport const PrincipalPolicyStaleErrorResponseSchema = loosePlainObject({\n  code: z.literal(\"principal_policy_stale\"),\n  error: z.string().min(1),\n  principalHeads: arraySchema(\n    ReferencedPrincipalStateResponseSchema,\n    PRINCIPAL_POLICY_REPAIR_HEAD_LIMIT,\n  ),\n});\n\nexport type PrincipalPolicyStaleErrorResponse = z.infer<\n  typeof PrincipalPolicyStaleErrorResponseSchema\n>;\n\nexport function isPrincipalPolicyBundleResponse(\n  value: unknown,\n): value is PrincipalPolicyBundleResponse {\n  return PrincipalPolicyBundleResponseSchema.safeParse(value).success;\n}\n\nexport function isPrincipalPolicyMutationResponse(\n  value: unknown,\n): value is PrincipalPolicyMutationResponse {\n  return PrincipalPolicyMutationResponseSchema.safeParse(value).success;\n}\n\nexport function isCommitOrganizationGroupPolicyResponse(\n  value: unknown,\n): value is CommitOrganizationGroupPolicyResponse {\n  return CommitOrganizationGroupPolicyResponseSchema.safeParse(value).success;\n}\n\nexport function isPrincipalPolicyStaleErrorResponse(\n  value: unknown,\n): value is PrincipalPolicyStaleErrorResponse {\n  return PrincipalPolicyStaleErrorResponseSchema.safeParse(value).success;\n}\n"]}
+{"version":3,"file":"principal.js","sourceRoot":"","sources":["principal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,MAAM,SAAS,CAAC;AACxD,OAAO,EAAE,kCAAkC,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,+BAA+B,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,+CAA+C,EAAE,MAAM,iCAAiC,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,sCAAsC,EAAE,MAAM,sBAAsB,CAAC;AAE9E,OAAO,EACL,6CAA6C,EAC7C,qCAAqC,EACrC,4CAA4C,EAC5C,uCAAuC,EACvC,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAEL,6CAA6C,EAC7C,yCAAyC,EACzC,wCAAwC,EACxC,+BAA+B,EAC/B,wBAAwB,EAExB,qCAAqC,EAErC,qCAAqC,EAErC,qCAAqC,EAErC,4CAA4C,EAE5C,uCAAuC,EAEvC,6CAA6C,EAE7C,mCAAmC,EAEnC,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,MAAM,CAAC,MAAM,mCAAmC,GAAG;IACjD,aAAa,EAAE,WAAW,CAAC,qCAAqC,CAAC;IACjE,sBAAsB,EAAE,6CAA6C;IACrE,cAAc,EAAE,mCAAmC;IACnD,iBAAiB,EAAE,WAAW,CAAC,uCAAuC,CAAC;IACvE,YAAY,EAAE,4BAA4B;CAC3C,CAAC;AAEF,MAAM,CAAC,MAAM,mCAAmC,GAAG,gBAAgB,CAAC;IAClE,GAAG,mCAAmC;IACtC,cAAc,EAAE,WAAW,CAAC,4CAA4C,CAAC;CAC1E,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,qCAAqC,GAAG,gBAAgB,CAAC;IACpE,GAAG,mCAAmC;IACtC,kBAAkB,EAAE,WAAW,CAAC,+BAA+B,CAAC;CACjE,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,2CAA2C,GAAG,gBAAgB,CAAC;IAC1E,WAAW,EAAE,qCAAqC;IAClD,YAAY,EAAE,qCAAqC,CAAC,QAAQ,EAAE;IAC9D,kBAAkB,EAAE,qCAAqC;CAC1D,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,kCAAkC,GAAG,0BAA0B,CAAC;AAM7E;;;;;GAKG;AACH,MAAM,qDAAqD,GAAG,gBAAgB,CAAC;IAC7E,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,+CAA+C,CAAC;IAChE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,oBAAoB,EAAE,WAAW,CAC/B,oBAAoB,EACpB,6BAA6B,CAC9B;CACF,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,CAAC,KAAK,CAAC;IACzE,kCAAkC;IAClC,qDAAqD;CACtD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uCAAuC,GAAG,gBAAgB,CAAC;IACtE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,cAAc,EAAE,WAAW,CACzB,sCAAsC,EACtC,kCAAkC,CACnC;CACF,CAAC,CAAC;AAMH,MAAM,UAAU,+BAA+B,CAC7C,KAAc;IAEd,OAAO,mCAAmC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,KAAc;IAEd,OAAO,qCAAqC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,KAAc;IAEd,OAAO,2CAA2C,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,KAAc;IAEd,OAAO,uCAAuC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC1E,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { arraySchema, loosePlainObject, nonEmptyStringSchema } from \"../schema\";\nimport { MAX_ROTATION_CONTAINER_REKEYS } from \"../util\";\nimport { PRINCIPAL_POLICY_REPAIR_HEAD_LIMIT } from \"../util/principalHistoryWire\";\nimport { ContainerMutationResponseSchema } from \"./container\";\nimport { CONTAINER_DESCENDANT_REKEYS_REQUIRED_ERROR_CODE } from \"./descendantRekeysRequiredError\";\nimport { BillingErrorResponseSchema } from \"./organizationBilling\";\nimport { ReferencedPrincipalStateResponseSchema } from \"./principalReference\";\n\nimport {\n  CurrentPrincipalMemberEnvelopesResponseSchema,\n  PrincipalContainerGrantResponseSchema,\n  PrincipalPolicyStateChainEntryResponseSchema,\n  PrincipalProjectionMemberResponseSchema,\n  PrincipalStatePayloadResponseSchema,\n  PrincipalStateResponseSchema,\n} from \"./principalSnapshot\";\n\nexport {\n  type CurrentPrincipalMemberEnvelopesResponse,\n  CurrentPrincipalMemberEnvelopesResponseSchema,\n  isCurrentPrincipalMemberEnvelopesResponse,\n  isPrincipalPolicyStateChainEntryResponse,\n  isPrincipalStatePayloadResponse,\n  isPrincipalStateResponse,\n  type PrincipalContainerGrantResponse,\n  PrincipalContainerGrantResponseSchema,\n  type PrincipalMemberEnvelopeResponse,\n  PrincipalMemberEnvelopeResponseSchema,\n  type PrincipalPolicySnapshotResponse,\n  PrincipalPolicySnapshotResponseSchema,\n  type PrincipalPolicyStateChainEntryResponse,\n  PrincipalPolicyStateChainEntryResponseSchema,\n  type PrincipalProjectionMemberResponse,\n  PrincipalProjectionMemberResponseSchema,\n  type PrincipalStateExternalAuthorityResponse,\n  PrincipalStateExternalAuthorityResponseSchema,\n  type PrincipalStatePayloadResponse,\n  PrincipalStatePayloadResponseSchema,\n  type PrincipalStateResponse,\n  PrincipalStateResponseSchema,\n} from \"./principalSnapshot\";\n\nexport const principalPolicyCurrentResponseShape = {\n  currentGrants: arraySchema(PrincipalContainerGrantResponseSchema),\n  currentMemberEnvelopes: CurrentPrincipalMemberEnvelopesResponseSchema,\n  currentPayload: PrincipalStatePayloadResponseSchema,\n  currentProjection: arraySchema(PrincipalProjectionMemberResponseSchema),\n  currentState: PrincipalStateResponseSchema,\n};\n\nexport const PrincipalPolicyBundleResponseSchema = loosePlainObject({\n  ...principalPolicyCurrentResponseShape,\n  previousStates: arraySchema(PrincipalPolicyStateChainEntryResponseSchema),\n});\n\nexport type PrincipalPolicyBundleResponse = z.infer<\n  typeof PrincipalPolicyBundleResponseSchema\n>;\n\nexport const PrincipalPolicyMutationResponseSchema = loosePlainObject({\n  ...principalPolicyCurrentResponseShape,\n  containerMutations: arraySchema(ContainerMutationResponseSchema),\n});\n\nexport type PrincipalPolicyMutationResponse = z.infer<\n  typeof PrincipalPolicyMutationResponseSchema\n>;\n\nexport const CommitOrganizationGroupPolicyResponseSchema = loosePlainObject({\n  groupPolicy: PrincipalPolicyMutationResponseSchema,\n  memberPolicy: PrincipalPolicyMutationResponseSchema.optional(),\n  organizationPolicy: PrincipalPolicyMutationResponseSchema,\n});\n\nexport type CommitOrganizationGroupPolicyResponse = z.infer<\n  typeof CommitOrganizationGroupPolicyResponseSchema\n>;\n\nexport const PrincipalPolicyErrorResponseSchema = BillingErrorResponseSchema;\n\nexport type PrincipalPolicyErrorResponse = z.infer<\n  typeof PrincipalPolicyErrorResponseSchema\n>;\n\n/**\n * A group policy change rematerializes its granted containers, and a rekey or\n * revoke among them is a rotation like any other: one that would leave a level\n * above a directly granted container pinned to a retired epoch is refused, and\n * this names the descendant rekeys the batch must carry, parent-first.\n */\nconst PrincipalPolicyDescendantRekeysRequiredResponseSchema = loosePlainObject({\n  code: z.literal(CONTAINER_DESCENDANT_REKEYS_REQUIRED_ERROR_CODE),\n  error: z.string().min(1),\n  requiredContainerIds: arraySchema(\n    nonEmptyStringSchema,\n    MAX_ROTATION_CONTAINER_REKEYS,\n  ),\n});\n\n/**\n * The commit's conflict envelope alone: only a group commit carries container\n * mutations, so only it can be refused for what they strand. The principal\n * policy read and the organization policy write keep the plain envelope.\n */\nexport const CommitOrganizationGroupPolicyConflictResponseSchema = z.union([\n  PrincipalPolicyErrorResponseSchema,\n  PrincipalPolicyDescendantRekeysRequiredResponseSchema,\n]);\n\nexport const PrincipalPolicyStaleErrorResponseSchema = loosePlainObject({\n  code: z.literal(\"principal_policy_stale\"),\n  error: z.string().min(1),\n  principalHeads: arraySchema(\n    ReferencedPrincipalStateResponseSchema,\n    PRINCIPAL_POLICY_REPAIR_HEAD_LIMIT,\n  ),\n});\n\nexport type PrincipalPolicyStaleErrorResponse = z.infer<\n  typeof PrincipalPolicyStaleErrorResponseSchema\n>;\n\nexport function isPrincipalPolicyBundleResponse(\n  value: unknown,\n): value is PrincipalPolicyBundleResponse {\n  return PrincipalPolicyBundleResponseSchema.safeParse(value).success;\n}\n\nexport function isPrincipalPolicyMutationResponse(\n  value: unknown,\n): value is PrincipalPolicyMutationResponse {\n  return PrincipalPolicyMutationResponseSchema.safeParse(value).success;\n}\n\nexport function isCommitOrganizationGroupPolicyResponse(\n  value: unknown,\n): value is CommitOrganizationGroupPolicyResponse {\n  return CommitOrganizationGroupPolicyResponseSchema.safeParse(value).success;\n}\n\nexport function isPrincipalPolicyStaleErrorResponse(\n  value: unknown,\n): value is PrincipalPolicyStaleErrorResponse {\n  return PrincipalPolicyStaleErrorResponseSchema.safeParse(value).success;\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tearleads/client-sdk",
-  "version": "0.1.48",
+  "version": "0.1.50",
   "description": "React-free Tearleads client runtime: local SQLite persistence, keys, sync, encrypted blobs, and domain workflows.",
   "license": "UNLICENSED",
   "repository": {

package/workflows/containers/child/rekeyProjection.d.ts

@@ -1,5 +1,5 @@
 import type { ContainerWriterProjectionResponse } from "../../../internal/validators/response/index.js";
-import type { MaterializedContainerRekeyPlan } from "../../../data/containers/shared/types.js";
+import type { MaterializedContainerRekeyPlan, MaterializedContainerSharePlan } from "../../../data/containers/shared/types.js";
 export declare function isSpeculativeContainerWriterProjection(projection: ContainerWriterProjectionResponse): boolean;
 /**
  * What any rotation plan (rekey, revoke, move) holds in common: enough to say
@@ -39,3 +39,8 @@ export declare function containerWriterProjectionFromRekeyPlan(input: {
  * container. Null when the descendant does not sit below that container.
  */
 export declare function rebaseContainerWriterProjection(descendant: ContainerWriterProjectionResponse, rotated: Pick<ContainerWriterProjectionResponse, "containerKeks" | "path" | "policyEvidence">): ContainerWriterProjectionResponse | null;
+/** A grant keeps its key epoch while advancing the manifest and recipient wraps. */
+export declare function containerWriterProjectionFromSharePlan(input: {
+    plan: MaterializedContainerSharePlan["plan"];
+    previousProjection: ContainerWriterProjectionResponse;
+}): Promise<ContainerWriterProjectionResponse>;

package/workflows/containers/child/rekeyProjection.js

@@ -107,4 +107,45 @@ export function rebaseContainerWriterProjection(descendant, rotated) {
     speculativeProjections.add(projection);
     return projection;
 }
+/** A grant keeps its key epoch while advancing the manifest and recipient wraps. */
+export async function containerWriterProjectionFromSharePlan(input) {
+    const { plan, previousProjection } = input;
+    const previous = previousProjection.path.at(-1);
+    const kek = previousProjection.containerKeks.at(-1);
+    if (!previous ||
+        !kek ||
+        previous.manifestHash !== plan.previousManifest.manifestHash ||
+        kek.containerId !== plan.containerId)
+        throw new Error("Container grant projection predecessor mismatch");
+    const targets = recipientTargets({ wraps: plan.wraps });
+    const projection = {
+        ...previousProjection,
+        path: [
+            ...previousProjection.path.slice(0, -1),
+            {
+                event: {
+                    body: readCanonicalRecord(plan.body, "Container grant body"),
+                    event: readCanonicalRecord(plan.event, "Container grant event"),
+                    eventHash: plan.eventHash,
+                },
+                manifest: readCanonicalRecord(plan.manifest, "Container grant manifest"),
+                manifestHash: plan.manifestHash,
+                state: readCanonicalRecord(plan.state, "Container grant state"),
+            },
+        ],
+        containerKeks: [
+            ...previousProjection.containerKeks.slice(0, -1),
+            {
+                ...kek,
+                accessManifestHash: plan.manifestHash,
+                containerManifestHistory: [previous, ...kek.containerManifestHistory],
+                keyTargetHash: await computeContainerKekRecipientTargetHash(targets),
+                recipientTargets: readCanonicalRecords(targets, "Container grant targets"),
+                wraps: readCanonicalRecords(plan.wraps, "Container grant wraps"),
+            },
+        ],
+    };
+    speculativeProjections.add(projection);
+    return projection;
+}
 //# sourceMappingURL=rekeyProjection.js.map