@sealant/api-contracts-next 0.39.0-next.719 → 0.39.0-next.721

package/dist/core-api/system.d.ts

@@ -40,6 +40,12 @@ export declare const systemIndexResponseSchema: Schema.Struct<{
         readonly workspaceSshUser: Schema.optional<Schema.Boolean>;
         /** `POST /v1/users/:id/person`: a user's person bound once (what `sshAsOwner` checks). */
         readonly personBinding: Schema.optional<Schema.Boolean>;
+        /**
+         * Removing an SSH key ends the gateway connections opened with it: none opens a new channel
+         * or forward once it is removed, and each ends within a minute (the gateway's re-check).
+         * From an older control plane they stay open until the workspace stops.
+         */
+        readonly sshKeyRemovalEndsConnections: Schema.optional<Schema.Boolean>;
     }>>;
 }>;
 export type SystemIndexResponse = typeof systemIndexResponseSchema.Type;
@@ -107,6 +113,12 @@ export declare const SystemGroup: HttpApiGroup.HttpApiGroup<"system", HttpApiEnd
         readonly workspaceSshUser: Schema.optional<Schema.Boolean>;
         /** `POST /v1/users/:id/person`: a user's person bound once (what `sshAsOwner` checks). */
         readonly personBinding: Schema.optional<Schema.Boolean>;
+        /**
+         * Removing an SSH key ends the gateway connections opened with it: none opens a new channel
+         * or forward once it is removed, and each ends within a minute (the gateway's re-check).
+         * From an older control plane they stay open until the workspace stops.
+         */
+        readonly sshKeyRemovalEndsConnections: Schema.optional<Schema.Boolean>;
     }>>;
 }>>, HttpApiEndpoint.Json<never>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"getSetupState", "GET", "/v1/system/setup-state", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
     readonly needsSetup: Schema.Boolean;

package/dist/core-api/system.js

@@ -41,6 +41,12 @@ export const systemIndexResponseSchema = Schema.Struct({
         workspaceSshUser: Schema.optional(Schema.Boolean),
         /** `POST /v1/users/:id/person`: a user's person bound once (what `sshAsOwner` checks). */
         personBinding: Schema.optional(Schema.Boolean),
+        /**
+         * Removing an SSH key ends the gateway connections opened with it: none opens a new channel
+         * or forward once it is removed, and each ends within a minute (the gateway's re-check).
+         * From an older control plane they stay open until the workspace stops.
+         */
+        sshKeyRemovalEndsConnections: Schema.optional(Schema.Boolean),
     })),
 });
 export const systemHealthResponseSchema = Schema.Struct({

package/dist/core-api/workspaces.d.ts

@@ -53,6 +53,12 @@ export declare const workspaceSshTargetSchema: Schema.Struct<{
      * (`x-sealant-gateway-ssh-user: 1`); a workspace with a user refuses any other gateway.
      */
     readonly sessionUser: Schema.NullOr<Schema.String>;
+    /**
+     * The key fingerprint the gateway named in `x-sealant-ssh-key-fingerprint`, echoed once the API
+     * found it still registered to the principal. Absent when the gateway named none. A gateway that
+     * named one refuses a target without it (an older API, which never checked the key).
+     */
+    readonly sshKeyFingerprint: Schema.optional<Schema.String>;
 }>;
 export type WorkspaceSshTarget = typeof workspaceSshTargetSchema.Type;
 /**
@@ -1745,6 +1751,7 @@ export declare const workspaceGatewayHeadersSchema: Schema.Struct<{
     readonly "x-sealant-gateway-token": Schema.optional<Schema.String>;
     readonly "x-sealant-principal-id": Schema.optional<Schema.String>;
     readonly "x-sealant-gateway-ssh-user": Schema.optional<Schema.String>;
+    readonly "x-sealant-ssh-key-fingerprint": Schema.optional<Schema.String>;
 }>;
 export type WorkspaceGatewayHeaders = typeof workspaceGatewayHeadersSchema.Type;
 declare const WorkspaceBadRequestError_base: Schema.Class<WorkspaceBadRequestError, Schema.TaggedStruct<"WorkspaceBadRequestError", {
@@ -1783,6 +1790,17 @@ declare const WorkspaceUnauthorizedError_base: Schema.Class<WorkspaceUnauthorize
 }>, import("effect/Cause").YieldableError>;
 export declare class WorkspaceUnauthorizedError extends WorkspaceUnauthorizedError_base {
 }
+declare const WorkspaceSshKeyNoLongerRegisteredError_base: Schema.Class<WorkspaceSshKeyNoLongerRegisteredError, Schema.TaggedStruct<"WorkspaceSshKeyNoLongerRegisteredError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * The SSH key the gateway named (`x-sealant-ssh-key-fingerprint`) is no longer registered to the
+ * principal: removed, or registered since to someone else. Its own tag, so the gateway ends the
+ * connections opened with the key on this refusal alone, never on another 401 (a gateway token
+ * mismatch while the API and the gateway roll).
+ */
+export declare class WorkspaceSshKeyNoLongerRegisteredError extends WorkspaceSshKeyNoLongerRegisteredError_base {
+}
 declare const WorkspaceSshOwnerRefusedError_base: Schema.Class<WorkspaceSshOwnerRefusedError, Schema.TaggedStruct<"WorkspaceSshOwnerRefusedError", {
     readonly message: Schema.String;
     readonly code: Schema.Literals<readonly ["ssh-owner-unbound", "ssh-owner-needs-owner-map", "ssh-owner-mismatch"]>;
@@ -2532,6 +2550,7 @@ export declare const WorkspacesGroup: HttpApiGroup.HttpApiGroup<"workspaces", Ht
     readonly "x-sealant-gateway-token": Schema.optional<Schema.String>;
     readonly "x-sealant-principal-id": Schema.optional<Schema.String>;
     readonly "x-sealant-gateway-ssh-user": Schema.optional<Schema.String>;
+    readonly "x-sealant-ssh-key-fingerprint": Schema.optional<Schema.String>;
 }>>, HttpApiEndpoint.Json<Schema.Struct<{
     readonly workspaceId: Schema.String;
     readonly attemptId: Schema.String;
@@ -2550,7 +2569,13 @@ export declare const WorkspacesGroup: HttpApiGroup.HttpApiGroup<"workspaces", Ht
      * (`x-sealant-gateway-ssh-user: 1`); a workspace with a user refuses any other gateway.
      */
     readonly sessionUser: Schema.NullOr<Schema.String>;
-}>>, HttpApiEndpoint.Json<typeof WorkspaceUnauthorizedError | typeof WorkspaceNotFoundError | typeof WorkspaceConflictError | typeof WorkspaceServiceUnavailableError | typeof WorkspaceInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"inspectWorkspaceImage", "POST", "/image", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    /**
+     * The key fingerprint the gateway named in `x-sealant-ssh-key-fingerprint`, echoed once the API
+     * found it still registered to the principal. Absent when the gateway named none. A gateway that
+     * named one refuses a target without it (an older API, which never checked the key).
+     */
+    readonly sshKeyFingerprint: Schema.optional<Schema.String>;
+}>>, HttpApiEndpoint.Json<typeof WorkspaceUnauthorizedError | typeof WorkspaceSshKeyNoLongerRegisteredError | typeof WorkspaceNotFoundError | typeof WorkspaceConflictError | typeof WorkspaceServiceUnavailableError | typeof WorkspaceInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"inspectWorkspaceImage", "POST", "/image", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
     readonly ownerUserId: Schema.String;
     readonly registryId: Schema.String;
     /** The spec a create would send (`CreateWorkspaceRequest.spec`). */

package/dist/core-api/workspaces.js

@@ -63,6 +63,12 @@ export const workspaceSshTargetSchema = Schema.Struct({
      * (`x-sealant-gateway-ssh-user: 1`); a workspace with a user refuses any other gateway.
      */
     sessionUser: Schema.NullOr(NonEmptyString),
+    /**
+     * The key fingerprint the gateway named in `x-sealant-ssh-key-fingerprint`, echoed once the API
+     * found it still registered to the principal. Absent when the gateway named none. A gateway that
+     * named one refuses a target without it (an older API, which never checked the key).
+     */
+    sshKeyFingerprint: Schema.optional(NonEmptyString),
 });
 /**
  * Whether an image can run Mend's per-person layout on a runtime (Mend ADR 0016): the verdict of
@@ -1109,6 +1115,10 @@ export const workspaceGatewayHeadersSchema = Schema.Struct({
     // `1` from a gateway that runs a workspace's SSH sessions as its `sshUser`. A workspace with a
     // user answers no target to a gateway without it, which would run the session as root.
     "x-sealant-gateway-ssh-user": Schema.optional(NonEmptyString),
+    // The fingerprint (`SHA256:…`) of the registered key the client logged in with. When it is
+    // named, the API answers a target only while that key is still registered to the principal, so
+    // removing a key ends what connections opened with it can still open.
+    "x-sealant-ssh-key-fingerprint": Schema.optional(NonEmptyString),
 });
 export class WorkspaceBadRequestError extends Schema.TaggedErrorClass()("WorkspaceBadRequestError", {
     message: Schema.String,
@@ -1142,6 +1152,16 @@ export class WorkspaceUnauthorizedError extends Schema.TaggedErrorClass()("Works
     message: Schema.String,
 }, { httpApiStatus: 401 }) {
 }
+/**
+ * The SSH key the gateway named (`x-sealant-ssh-key-fingerprint`) is no longer registered to the
+ * principal: removed, or registered since to someone else. Its own tag, so the gateway ends the
+ * connections opened with the key on this refusal alone, never on another 401 (a gateway token
+ * mismatch while the API and the gateway roll).
+ */
+export class WorkspaceSshKeyNoLongerRegisteredError extends Schema.TaggedErrorClass()("WorkspaceSshKeyNoLongerRegisteredError", {
+    message: Schema.String,
+}, { httpApiStatus: 401 }) {
+}
 /**
  * `sshAsOwner` refused: the owner is bound to no person (`ssh-owner-unbound`), the create carries no
  * capture owner map (`ssh-owner-needs-owner-map`), or the owner map or `credentialsHome` does not
@@ -1498,6 +1518,7 @@ HttpApiEndpoint.post("expireWorkspace", "/:workspaceId/expire", {
     success: workspaceSshTargetSchema,
     error: [
         WorkspaceUnauthorizedError,
+        WorkspaceSshKeyNoLongerRegisteredError,
         WorkspaceNotFoundError,
         WorkspaceConflictError,
         WorkspaceServiceUnavailableError,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealant/api-contracts-next",
-  "version": "0.39.0-next.719",
+  "version": "0.39.0-next.721",
   "description": "Contract-first HTTP API definitions for Sealant services",
   "license": "Apache-2.0",
   "repository": {
@@ -32,7 +32,7 @@
   "peerDependencies": {
     "effect": ">=4.0.0-beta.85 <5"
   },
-  "gitHead": "4e889f0fc04dcdc0b9f9aec81945225ac54516b9",
+  "gitHead": "cada0010b9b96ceb896f5cdc1e690bd0d1ab5d3f",
   "publishConfig": {
     "access": "public"
   }