@sealant/api-contracts-next 0.39.0-next.706 → 0.39.0-next.707

package/dist/core-api/sessions.d.ts

@@ -38,8 +38,9 @@ export type SessionMode = typeof sessionModeSchema.Type;
  * Only a person Mend made: a uid in 40001–49999 whose primary group is `mend` (40000), never root,
  * on a workspace whose sealantd reports `exec.user`. Anything else is refused before anything
  * starts (`409`, `user-unsupported`). sealantd checks the passwd entry it resolves again and starts
- * a process only as one of the executor's people (its owner map's uids, or the range), so editing
- * `/etc/passwd` with `sudo` cannot widen it. Absent: the workspace's own user, as before.
+ * a process only as one of its owner map's people or a person in Mend's reserved range (a uid in
+ * 40001–49999 whose primary group is 40000); root, root's group and anyone outside the range are
+ * refused, so editing `/etc/passwd` with `sudo` cannot reach root or a system user. Absent: the workspace's own user, as before.
  */
 export declare const workspaceProcessUserSchema: Schema.String;
 export type WorkspaceProcessUser = typeof workspaceProcessUserSchema.Type;

package/dist/core-api/sessions.js

@@ -36,8 +36,9 @@ export const sessionModeSchema = Schema.Literals(["pty", "pipe"]);
  * Only a person Mend made: a uid in 40001–49999 whose primary group is `mend` (40000), never root,
  * on a workspace whose sealantd reports `exec.user`. Anything else is refused before anything
  * starts (`409`, `user-unsupported`). sealantd checks the passwd entry it resolves again and starts
- * a process only as one of the executor's people (its owner map's uids, or the range), so editing
- * `/etc/passwd` with `sudo` cannot widen it. Absent: the workspace's own user, as before.
+ * a process only as one of its owner map's people or a person in Mend's reserved range (a uid in
+ * 40001–49999 whose primary group is 40000); root, root's group and anyone outside the range are
+ * refused, so editing `/etc/passwd` with `sudo` cannot reach root or a system user. Absent: the workspace's own user, as before.
  */
 export const workspaceProcessUserSchema = Schema.String.check(Schema.isPattern(/^(?:[a-z_][a-z0-9_-]{0,31}|[0-9]{1,10})$/));
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealant/api-contracts-next",
-  "version": "0.39.0-next.706",
+  "version": "0.39.0-next.707",
   "description": "Contract-first HTTP API definitions for Sealant services",
   "license": "Apache-2.0",
   "repository": {
@@ -32,7 +32,7 @@
   "peerDependencies": {
     "effect": ">=4.0.0-beta.85 <5"
   },
-  "gitHead": "cb310e9f9e850db78edf0f7f8fb1c3de42df1238",
+  "gitHead": "96be22f72c8c417278955d4a479e3f6690fa9dca",
   "publishConfig": {
     "access": "public"
   }