@sealant/api-contracts-next 0.40.0-next.767 → 0.40.0-next.769

package/dist/core-api/control-plane.js

@@ -7,6 +7,7 @@ import { PackagesGroup } from "./packages.js";
 import { ProfilesGroup } from "./profiles.js";
 import { RegistriesGroup } from "./registries.js";
 import { RequestRefusal } from "./request-refusal.js";
+import { ResourceDomainsGroup } from "./resource-domains.js";
 import { RunsGroup } from "./runs.js";
 import { SessionsGroup } from "./sessions.js";
 import { SshKeysGroup } from "./ssh-keys.js";
@@ -27,6 +28,7 @@ export const ControlPlaneAPI = HttpApi.make("sealantControlPlaneApi")
     .add(RegistriesGroup.prefix("/v1/registries"))
     .add(GitHubGroup.prefix("/v1/github"))
     .add(UsersGroup.prefix("/v1/users"))
+    .add(ResourceDomainsGroup.prefix("/v1/resource-domains"))
     // Last, so it reaches every endpoint above (`HttpApi.middleware` skips endpoints added after it).
     .middleware(RequestRefusal)
     .annotate(OpenApi.Title, "Sealant Control Plane API")

package/dist/core-api/github.js

@@ -1,5 +1,6 @@
 import { Schema } from "effect";
 import { HttpApi, HttpApiEndpoint, HttpApiGroup, HttpApiSchema, OpenApi } from "effect/http-api";
+import { PersonId } from "./person-id.js";
 // These literal sets mirror the control-plane DB enums (packages/db `control-plane.ts`). They are
 // INLINED here so the public contract package carries NO @sealant/db dependency — which keeps
 // consumers like @sealant/sdk free of drizzle/pg. Keep them in sync with the db schema.
@@ -17,17 +18,17 @@ export const messageResponseSchema = Schema.Struct({
     message: Schema.String,
 });
 export const githubInstallationsQuerySchema = Schema.Struct({
-    userId: NonEmptyString,
+    userId: PersonId,
 });
 export const githubInstallationRepositoriesQuerySchema = Schema.Struct({
-    userId: NonEmptyString,
+    userId: PersonId,
     search: Schema.optional(NonEmptyString),
 });
 export const syncGitHubInstallationQuerySchema = Schema.Struct({
-    userId: NonEmptyString,
+    userId: PersonId,
 });
 export const importGitHubInstallationRequestSchema = Schema.Struct({
-    userId: NonEmptyString,
+    userId: PersonId,
     externalInstallationId: NonEmptyString,
 });
 export const githubWebhookHeadersSchema = Schema.Struct({

package/dist/core-api/inference.js

@@ -22,6 +22,7 @@
 import { Schema } from "effect";
 import { HttpApiEndpoint, HttpApiGroup, HttpApiSchema, OpenApi } from "effect/http-api";
 import { BudgetExceededError } from "./budgets.js";
+import { PersonId } from "./person-id.js";
 const NonEmptyString = Schema.String.check(Schema.isNonEmpty(), Schema.isTrimmed());
 /**
  * Connected-account selection — the same reference shape as workspace creation: values are account
@@ -55,7 +56,7 @@ export const inferenceToolResultSchema = Schema.Struct({
  *   authenticated when it started; credential fields must be absent.
  */
 export const inferenceRespondRequestSchema = Schema.Struct({
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     credentials: Schema.optional(inferenceCredentialsSchema),
     prompt: Schema.optional(Schema.String.check(Schema.isNonEmpty())),
     system: Schema.optional(Schema.String),

package/dist/core-api/person-id.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The ids that name a person, and the one rule that keeps a resource domain out of them.
+ *
+ * A resource domain (`resource-domains.ts`) is an owner that is not a person: it never holds a
+ * login or a provider credential and never runs a harness. Core mints every resource domain id
+ * with {@link RESOURCE_DOMAIN_ID_PREFIX}, and no `user` row may carry it (a database check), so
+ * the spelling alone tells the two apart. Every field and header that names a person (`ownerUserId`,
+ * `onBehalfOfUserId`, `userId`, the SSH gateway's `principalId`) is a {@link PersonId}: a domain id there is refused with a `400`
+ * `RequestRefusedError` while the request is decoded, before any handler runs. A test walks every
+ * endpoint of the control plane API and fails on a person field that is not one.
+ */
+import { Schema } from "effect";
+export declare const RESOURCE_DOMAIN_ID_PREFIX = "rdm:";
+export declare const isResourceDomainId: (id: string) => boolean;
+/** Why an id cannot name a person, after the field's name. Never quotes the id. */
+export declare const NOT_A_PERSON = "names a resource domain, which never holds a login or a provider credential and never runs a harness";
+export declare const PersonId: Schema.String;

package/dist/core-api/person-id.js

@@ -0,0 +1,17 @@
+/**
+ * The ids that name a person, and the one rule that keeps a resource domain out of them.
+ *
+ * A resource domain (`resource-domains.ts`) is an owner that is not a person: it never holds a
+ * login or a provider credential and never runs a harness. Core mints every resource domain id
+ * with {@link RESOURCE_DOMAIN_ID_PREFIX}, and no `user` row may carry it (a database check), so
+ * the spelling alone tells the two apart. Every field and header that names a person (`ownerUserId`,
+ * `onBehalfOfUserId`, `userId`, the SSH gateway's `principalId`) is a {@link PersonId}: a domain id there is refused with a `400`
+ * `RequestRefusedError` while the request is decoded, before any handler runs. A test walks every
+ * endpoint of the control plane API and fails on a person field that is not one.
+ */
+import { Schema } from "effect";
+export const RESOURCE_DOMAIN_ID_PREFIX = "rdm:";
+export const isResourceDomainId = (id) => id.startsWith(RESOURCE_DOMAIN_ID_PREFIX);
+/** Why an id cannot name a person, after the field's name. Never quotes the id. */
+export const NOT_A_PERSON = "names a resource domain, which never holds a login or a provider credential and never runs a harness";
+export const PersonId = Schema.String.check(Schema.isNonEmpty(), Schema.isTrimmed(), Schema.makeFilter((id) => (isResourceDomainId(id) ? NOT_A_PERSON : undefined)));

package/dist/core-api/profiles.js

@@ -1,6 +1,7 @@
 import { Schema } from "effect";
 import { HttpApiEndpoint, HttpApiGroup, OpenApi } from "effect/http-api";
 import { connectedAccountProviderSchema, connectedAccountSummarySchema, } from "./connected-accounts.js";
+import { PersonId } from "./person-id.js";
 const NonEmptyString = Schema.String.check(Schema.isNonEmpty(), Schema.isTrimmed());
 /*
 Minimal profiles surface: list a user's profiles and manage the per-provider connected-account
@@ -11,7 +12,7 @@ Bindings embed account summaries only — never secret material.
 export const profileStatusSchema = Schema.Literals(["active", "archived"]);
 export const profileSummarySchema = Schema.Struct({
     profileId: NonEmptyString,
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     slug: NonEmptyString,
     name: NonEmptyString,
     description: Schema.NullOr(Schema.String),
@@ -21,7 +22,7 @@ export const profileSummarySchema = Schema.Struct({
     updatedAt: Schema.String,
 });
 export const listProfilesQuerySchema = Schema.Struct({
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
 });
 export const listProfilesResponseSchema = Schema.Struct({
     items: Schema.Array(profileSummarySchema),
@@ -36,7 +37,7 @@ export const listProfileCredentialBindingsResponseSchema = Schema.Struct({
     items: Schema.Array(profileCredentialBindingWithAccountSchema),
 });
 export const setProfileCredentialBindingRequestSchema = Schema.Struct({
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     provider: connectedAccountProviderSchema,
     /**
      * The account to bind: its id, or `default` for the owner's chosen default for `provider` (an

package/dist/core-api/resource-domains.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Resource domains: an owner that is a project, not a person.
+ *
+ * An application (Mend) keeps one domain per project for the things the project owns rather than
+ * any one person: its services, volumes and network. A domain outlives every person, and it never
+ * holds a login or a provider credential and never runs a harness. Its id (`rdm:<uuid>`) can never
+ * name a person: every person field of this API is a `PersonId`, which refuses it.
+ *
+ * `ensureResourceDomain` is idempotent on `key`, `<application>:<name>` (Mend:
+ * `mend:<installation>:project:<project>`): the first call creates the domain and every later or
+ * concurrent call answers the same one. Keys are global, and every service key may name any of
+ * them; the application prefix keeps applications apart by convention, not by authority.
+ *
+ * Only a service key reaches these routes. Any other bearer is refused by the transport with `401`
+ * before a handler runs. A deployment served without authentication (the development exception)
+ * serves them as it serves every other route. A request body is decoded strictly: a field the contract does not declare (an
+ * owner, a credential) is refused with `400` instead of being dropped.
+ */
+import { Schema } from "effect";
+import { HttpApiEndpoint, HttpApiGroup } from "effect/http-api";
+export declare const resourceDomainSchema: Schema.Struct<{
+    readonly resourceDomainId: Schema.String;
+    readonly key: Schema.String;
+    readonly createdAt: Schema.String;
+}>;
+export type ResourceDomainWire = typeof resourceDomainSchema.Type;
+export declare const ensureResourceDomainRequestSchema: Schema.Struct<{
+    readonly key: Schema.String;
+}>;
+export type EnsureResourceDomainRequest = typeof ensureResourceDomainRequestSchema.Type;
+export declare const ensureResourceDomainResponseSchema: Schema.Struct<{
+    readonly resourceDomainId: Schema.String;
+    readonly key: Schema.String;
+    readonly createdAt: Schema.String;
+    /** True when this call created the domain. */
+    readonly created: Schema.Boolean;
+}>;
+export type EnsureResourceDomainResponse = typeof ensureResourceDomainResponseSchema.Type;
+declare const ResourceDomainForbiddenError_base: Schema.Class<ResourceDomainForbiddenError, Schema.TaggedStruct<"ResourceDomainForbiddenError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class ResourceDomainForbiddenError extends ResourceDomainForbiddenError_base {
+}
+declare const ResourceDomainNotFoundError_base: Schema.Class<ResourceDomainNotFoundError, Schema.TaggedStruct<"ResourceDomainNotFoundError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class ResourceDomainNotFoundError extends ResourceDomainNotFoundError_base {
+}
+declare const ResourceDomainInternalServerError_base: Schema.Class<ResourceDomainInternalServerError, Schema.TaggedStruct<"ResourceDomainInternalServerError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class ResourceDomainInternalServerError extends ResourceDomainInternalServerError_base {
+}
+export declare const ResourceDomainsGroup: HttpApiGroup.HttpApiGroup<"resourceDomains", HttpApiEndpoint.HttpApiEndpoint<"ensureResourceDomain", "POST", "/", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly key: Schema.String;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    readonly resourceDomainId: Schema.String;
+    readonly key: Schema.String;
+    readonly createdAt: Schema.String;
+    /** True when this call created the domain. */
+    readonly created: Schema.Boolean;
+}>>, Schema.toCodecJson<typeof ResourceDomainForbiddenError | typeof ResourceDomainInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"getResourceDomain", "GET", "/:resourceDomainId", Schema.toCodecStringTree<Schema.Struct<{
+    readonly resourceDomainId: Schema.String;
+}>>, never, never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly resourceDomainId: Schema.String;
+    readonly key: Schema.String;
+    readonly createdAt: Schema.String;
+}>>, Schema.toCodecJson<typeof ResourceDomainForbiddenError | typeof ResourceDomainNotFoundError | typeof ResourceDomainInternalServerError>, never, never>, false>;
+export {};

package/dist/core-api/resource-domains.js

@@ -0,0 +1,61 @@
+/**
+ * Resource domains: an owner that is a project, not a person.
+ *
+ * An application (Mend) keeps one domain per project for the things the project owns rather than
+ * any one person: its services, volumes and network. A domain outlives every person, and it never
+ * holds a login or a provider credential and never runs a harness. Its id (`rdm:<uuid>`) can never
+ * name a person: every person field of this API is a `PersonId`, which refuses it.
+ *
+ * `ensureResourceDomain` is idempotent on `key`, `<application>:<name>` (Mend:
+ * `mend:<installation>:project:<project>`): the first call creates the domain and every later or
+ * concurrent call answers the same one. Keys are global, and every service key may name any of
+ * them; the application prefix keeps applications apart by convention, not by authority.
+ *
+ * Only a service key reaches these routes. Any other bearer is refused by the transport with `401`
+ * before a handler runs. A deployment served without authentication (the development exception)
+ * serves them as it serves every other route. A request body is decoded strictly: a field the contract does not declare (an
+ * owner, a credential) is refused with `400` instead of being dropped.
+ */
+import { Schema } from "effect";
+import { HttpApi, HttpApiEndpoint, HttpApiGroup, OpenApi } from "effect/http-api";
+import { RESOURCE_DOMAIN_ID_PREFIX } from "./person-id.js";
+const RESOURCE_DOMAIN_ID_PATTERN = new RegExp(`^${RESOURCE_DOMAIN_ID_PREFIX}[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$`);
+const RESOURCE_DOMAIN_KEY_PATTERN = /^[a-z][a-z0-9-]{0,31}:[A-Za-z0-9._:/@+=-]{1,223}$/;
+const ResourceDomainId = Schema.String.check(Schema.makeFilter((id) => RESOURCE_DOMAIN_ID_PATTERN.test(id) ? undefined : "must be a resource domain id (rdm:<uuid>)"));
+const ResourceDomainKey = Schema.String.check(Schema.makeFilter((key) => RESOURCE_DOMAIN_KEY_PATTERN.test(key)
+    ? undefined
+    : "must be <application>:<name>: a lower-case application name (letters, digits, '-'), a colon, then at most 223 letters, digits, '.', '_', ':', '/', '@', '+', '=' or '-'"));
+export const resourceDomainSchema = Schema.Struct({
+    resourceDomainId: ResourceDomainId,
+    key: ResourceDomainKey,
+    createdAt: Schema.String,
+});
+export const ensureResourceDomainRequestSchema = Schema.Struct({ key: ResourceDomainKey });
+export const ensureResourceDomainResponseSchema = Schema.Struct({
+    ...resourceDomainSchema.fields,
+    /** True when this call created the domain. */
+    created: Schema.Boolean,
+});
+export class ResourceDomainForbiddenError extends Schema.TaggedError()("ResourceDomainForbiddenError", { message: Schema.String }, { httpApiStatus: 403 }) {
+}
+export class ResourceDomainNotFoundError extends Schema.TaggedError()("ResourceDomainNotFoundError", { message: Schema.String }, { httpApiStatus: 404 }) {
+}
+export class ResourceDomainInternalServerError extends Schema.TaggedError()("ResourceDomainInternalServerError", { message: Schema.String }, { httpApiStatus: 500 }) {
+}
+export const ResourceDomainsGroup = HttpApiGroup.make("resourceDomains")
+    .add(HttpApiEndpoint.post("ensureResourceDomain", "/", {
+    payload: ensureResourceDomainRequestSchema,
+    success: ensureResourceDomainResponseSchema,
+    error: [ResourceDomainForbiddenError, ResourceDomainInternalServerError],
+}))
+    .add(HttpApiEndpoint.get("getResourceDomain", "/:resourceDomainId", {
+    params: Schema.Struct({ resourceDomainId: ResourceDomainId }),
+    success: resourceDomainSchema,
+    error: [
+        ResourceDomainForbiddenError,
+        ResourceDomainNotFoundError,
+        ResourceDomainInternalServerError,
+    ],
+}))
+    .annotate(HttpApi.PayloadParseOptions, { onExcessProperty: "error" })
+    .annotate(OpenApi.Description, "Owners that are projects, not people: they never hold a login or a provider credential.");

package/dist/core-api/runs.js

@@ -12,6 +12,7 @@
 import { Schema } from "effect";
 import { HttpApiEndpoint, HttpApiGroup, HttpApiSchema, OpenApi } from "effect/http-api";
 import { BudgetExceededError } from "./budgets.js";
+import { PersonId } from "./person-id.js";
 const NonEmptyString = Schema.String.check(Schema.isNonEmpty(), Schema.isTrimmed());
 export const runStatusSchema = Schema.Literals([
     "queued",
@@ -46,7 +47,7 @@ export const runSchema = Schema.Struct({
     runId: NonEmptyString,
     workspaceId: NonEmptyString,
     attemptId: Schema.optional(NonEmptyString),
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     harnessId: NonEmptyString,
     mode: runModeSchema,
     status: runStatusSchema,
@@ -80,7 +81,7 @@ export const runFileChangeSchema = Schema.Struct({
 export const createRunRequestSchema = Schema.Struct({
     workspaceId: NonEmptyString,
     harnessId: NonEmptyString,
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     mode: Schema.optional(runModeSchema),
     prompt: Schema.optional(Schema.String),
     attemptId: Schema.optional(NonEmptyString),
@@ -96,7 +97,7 @@ export const createRunRequestSchema = Schema.Struct({
 });
 export const updateRunRequestSchema = Schema.Struct({
     /** The run's owner. Required by the control plane: an update that names no owner finds no run. */
-    ownerUserId: Schema.optional(NonEmptyString),
+    ownerUserId: Schema.optional(PersonId),
     status: Schema.optional(runStatusSchema),
     exitCode: Schema.optional(Schema.Number),
     errorMessage: Schema.optional(Schema.String),
@@ -109,7 +110,7 @@ export const updateRunRequestSchema = Schema.Struct({
 });
 export const listRunsQuerySchema = Schema.Struct({
     workspaceId: Schema.optional(NonEmptyString),
-    ownerUserId: Schema.optional(NonEmptyString),
+    ownerUserId: Schema.optional(PersonId),
     status: Schema.optional(runStatusSchema),
     limit: Schema.optional(NonEmptyString),
 });
@@ -136,10 +137,10 @@ export const timelineEntrySchema = Schema.Struct({
  * names no owner finds no run.
  */
 export const runOwnerQuerySchema = Schema.Struct({
-    ownerUserId: Schema.optional(NonEmptyString),
+    ownerUserId: Schema.optional(PersonId),
 });
 export const getRunTimelineQuerySchema = Schema.Struct({
-    ownerUserId: Schema.optional(NonEmptyString),
+    ownerUserId: Schema.optional(PersonId),
     fromSequence: Schema.optional(NonEmptyString),
     toSequence: Schema.optional(NonEmptyString),
     limit: Schema.optional(NonEmptyString),
@@ -183,7 +184,7 @@ export const runEventSchema = Schema.Struct({
 // Execution record — scrollback (byte-exact terminal output)
 // ---------------------------------------------------------------------------------------------
 export const getRunScrollbackQuerySchema = Schema.Struct({
-    ownerUserId: Schema.optional(NonEmptyString),
+    ownerUserId: Schema.optional(PersonId),
     processId: NonEmptyString,
     stream: ioStreamSchema,
     atSequence: Schema.optional(NonEmptyString),

package/dist/core-api/sessions.js

@@ -15,6 +15,7 @@
  */
 import { Schema } from "effect";
 import { HttpApiEndpoint, HttpApiGroup, HttpApiSchema, OpenApi } from "effect/http-api";
+import { PersonId } from "./person-id.js";
 const NonEmptyString = Schema.String.check(Schema.isNonEmpty(), Schema.isTrimmed());
 export const sessionStatusSchema = Schema.Literals(["starting", "running", "exited", "failed"]);
 export const sessionAuthorizationHeadersSchema = Schema.Struct({
@@ -113,7 +114,7 @@ export const sessionArgvIssue = (argv) => {
 export const sessionArgvSchema = Schema.Array(Schema.String).check(Schema.makeFilter(sessionArgvIssue));
 export const createSessionRequestSchema = Schema.Struct({
     workspaceId: NonEmptyString,
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     /**
      * argv[0] is the program the session runs; the rest its arguments, passed to it as an argv array,
      * never through a shell. See `sessionArgvIssue` for what is refused.
@@ -151,7 +152,7 @@ export const sessionSchema = Schema.Struct({
     workspaceId: NonEmptyString,
     /** The interactive run recording this session; its record is the durable evidence. */
     runId: NonEmptyString,
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     status: sessionStatusSchema,
     /**
      * Only `argv[0]`, the program: Sealant never stores a session's arguments, because they can carry
@@ -181,7 +182,7 @@ export const sessionSchema = Schema.Struct({
     endedAt: Schema.optional(Schema.String),
 });
 export const listSessionsQuerySchema = Schema.Struct({
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     workspaceId: Schema.optional(NonEmptyString),
     status: Schema.optional(sessionStatusSchema),
     limit: Schema.optional(NonEmptyString),
@@ -190,22 +191,22 @@ export const listSessionsResponseSchema = Schema.Struct({
     items: Schema.Array(sessionSchema),
 });
 export const sessionInputRequestSchema = Schema.Struct({
-    ownerUserId: Schema.optional(NonEmptyString),
+    ownerUserId: Schema.optional(PersonId),
     /** Base64-encoded keystrokes (bytes, not text — binary-safe). */
     dataBase64: NonEmptyString,
 });
 export const sessionResizeRequestSchema = Schema.Struct({
-    ownerUserId: Schema.optional(NonEmptyString),
+    ownerUserId: Schema.optional(PersonId),
     cols: Schema.Int.check(Schema.isGreaterThan(0)),
     rows: Schema.Int.check(Schema.isGreaterThan(0)),
 });
 export const sessionSignalRequestSchema = Schema.Struct({
-    ownerUserId: Schema.optional(NonEmptyString),
+    ownerUserId: Schema.optional(PersonId),
     /** POSIX signal number (e.g. 2 = SIGINT, 15 = SIGTERM). */
     signal: Schema.Int.check(Schema.isGreaterThan(0)),
 });
 export const closeSessionRequestSchema = Schema.Struct({
-    ownerUserId: Schema.optional(NonEmptyString),
+    ownerUserId: Schema.optional(PersonId),
 });
 /**
  * Byte-exact session output by sequence range. `from` is INCLUSIVE (omit = from the beginning);
@@ -213,7 +214,7 @@ export const closeSessionRequestSchema = Schema.Struct({
  * as-recorded: redacted upstream by the daemon, PTY output stream only.
  */
 export const getSessionOutputQuerySchema = Schema.Struct({
-    ownerUserId: Schema.optional(NonEmptyString),
+    ownerUserId: Schema.optional(PersonId),
     from: Schema.optional(NonEmptyString),
     limit: Schema.optional(NonEmptyString),
 });
@@ -299,7 +300,7 @@ HttpApiEndpoint.post("createSessionAsUser", "/as-user", {
 HttpApiEndpoint.get("getSession", "/:sessionId", {
     params: sessionIdParams,
     headers: sessionAuthorizationHeadersSchema,
-    query: Schema.Struct({ ownerUserId: Schema.optional(NonEmptyString) }),
+    query: Schema.Struct({ ownerUserId: Schema.optional(PersonId) }),
     success: sessionSchema,
     error: [
         SessionBadRequestError,

package/dist/core-api/ssh-keys.js

@@ -1,5 +1,6 @@
 import { Schema } from "effect";
 import { HttpApiEndpoint, HttpApiGroup, HttpApiSchema, OpenApi } from "effect/http-api";
+import { PersonId } from "./person-id.js";
 const NonEmptyString = Schema.String.check(Schema.isNonEmpty(), Schema.isTrimmed());
 /*
 User SSH public keys. Two audiences:
@@ -15,21 +16,21 @@ export const sshKeyGatewayHeadersSchema = Schema.Struct({
 export const createSshKeyRequestSchema = Schema.Struct({
     // Same trust model as createWorkspace: the internal API trusts the caller-supplied owner; the web
     // server injects the session user id.
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     name: Schema.optional(NonEmptyString),
     // Raw `<algorithm> <base64> [comment]` line; the API normalizes and fingerprints it.
     publicKey: NonEmptyString,
 });
 export const sshKeySummarySchema = Schema.Struct({
     sshKeyId: NonEmptyString,
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     name: NonEmptyString,
     algorithm: NonEmptyString,
     fingerprint: NonEmptyString,
     createdAt: Schema.String,
 });
 export const listSshKeysQuerySchema = Schema.Struct({
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
 });
 export const listSshKeysResponseSchema = Schema.Struct({
     items: Schema.Array(sshKeySummarySchema),
@@ -41,7 +42,7 @@ export const resolveSshPrincipalRequestSchema = Schema.Struct({
     publicKeyBase64: NonEmptyString,
 });
 export const resolveSshPrincipalResponseSchema = Schema.Struct({
-    principalId: NonEmptyString,
+    principalId: PersonId,
     sshKeyId: NonEmptyString,
     fingerprint: NonEmptyString,
 });

package/dist/core-api/users.js

@@ -8,9 +8,10 @@
  */
 import { Schema } from "effect";
 import { HttpApiEndpoint, HttpApiGroup, OpenApi } from "effect/http-api";
+import { PersonId } from "./person-id.js";
 const NonEmptyString = Schema.String.check(Schema.isNonEmpty(), Schema.isTrimmed());
 export const userSchema = Schema.Struct({
-    userId: NonEmptyString,
+    userId: PersonId,
     email: NonEmptyString,
     name: NonEmptyString,
     createdAt: Schema.String,
@@ -20,7 +21,7 @@ export const ensureUserRequestSchema = Schema.Struct({
     email: NonEmptyString,
     name: NonEmptyString,
     /** Caller-chosen id for a NEW user (`usr_…`); ignored when the email already exists. */
-    userId: Schema.optional(NonEmptyString),
+    userId: Schema.optional(PersonId),
 });
 export const ensureUserResponseSchema = Schema.Struct({
     ...userSchema.fields,
@@ -38,7 +39,7 @@ export const personBindingSchema = Schema.Struct({
     home: NonEmptyString,
 });
 export const bindUserPersonResponseSchema = Schema.Struct({
-    userId: NonEmptyString,
+    userId: PersonId,
     person: personBindingSchema,
     /** True when this call made the binding; false when it was already exactly this. */
     created: Schema.Boolean,
@@ -59,7 +60,7 @@ export class UserNotFoundError extends Schema.TaggedError()("UserNotFoundError",
 }
 export class UserInternalServerError extends Schema.TaggedError()("UserInternalServerError", { message: Schema.String }, { httpApiStatus: 500 }) {
 }
-const userIdParams = Schema.Struct({ userId: NonEmptyString });
+const userIdParams = Schema.Struct({ userId: PersonId });
 export const UsersGroup = HttpApiGroup.make("users")
     .add(HttpApiEndpoint.post("ensureUser", "/", {
     payload: ensureUserRequestSchema,

package/dist/core-api/workspace-forward.d.ts

@@ -19,7 +19,7 @@ export declare const FORWARD_V2_SUBPROTOCOL = "sealant.forward.v2";
 export declare const FORWARD_V2_MAX_FRAME_BYTES: number;
 /** Ends the socket after a `refused` frame. It says nothing about why: the frame's reason does. */
 export declare const FORWARD_REFUSED_CLOSE_CODE = 4400;
-export declare const forwardRefusalReasonSchema: Schema.Literals<readonly ["workspace-not-ready", "runtime-unreachable", "runtime-untargetable", "connection-refused", "name-unresolved", "network-unreachable", "dial-timeout", "dial-failed", "not-found", "unauthorized", "forbidden", "budget-exceeded", "invalid-target", "owner-required", "internal", "owner-exited", "peer-mismatch", "binding-unverifiable", "binding-unsupported"]>;
+export declare const forwardRefusalReasonSchema: Schema.Literals<readonly ["workspace-not-ready", "runtime-unreachable", "runtime-untargetable", "connection-refused", "name-unresolved", "network-unreachable", "dial-timeout", "dial-failed", "not-found", "unauthorized", "forbidden", "budget-exceeded", "invalid-target", "owner-required", "not-a-person", "internal", "owner-exited", "peer-mismatch", "binding-unverifiable", "binding-unsupported"]>;
 export type ForwardRefusalReason = typeof forwardRefusalReasonSchema.Type;
 /** The HTTP status each refusal would have had before the upgrade. Callers branch on the reason. */
 export declare const FORWARD_REFUSAL_STATUS: {
@@ -37,6 +37,8 @@ export declare const FORWARD_REFUSAL_STATUS: {
     readonly "budget-exceeded": 429;
     readonly "invalid-target": 400;
     readonly "owner-required": 400;
+    /** The asserted owner is a resource domain, which never opens a forward. */
+    readonly "not-a-person": 400;
     readonly internal: 500;
     readonly "owner-exited": 409;
     readonly "peer-mismatch": 409;
@@ -76,7 +78,7 @@ export declare const forwardRefusedFrameSchema: Schema.Struct<{
     readonly status: Schema.Int;
 }>;
 export type ForwardRefusedFrame = typeof forwardRefusedFrameSchema.Type;
-export declare const forwardRefusedFrame: (reason: "binding-unsupported" | "binding-unverifiable" | "budget-exceeded" | "connection-refused" | "dial-failed" | "dial-timeout" | "forbidden" | "internal" | "invalid-target" | "name-unresolved" | "network-unreachable" | "not-found" | "owner-exited" | "owner-required" | "peer-mismatch" | "runtime-unreachable" | "runtime-untargetable" | "unauthorized" | "workspace-not-ready", message: string) => {
+export declare const forwardRefusedFrame: (reason: "binding-unsupported" | "binding-unverifiable" | "budget-exceeded" | "connection-refused" | "dial-failed" | "dial-timeout" | "forbidden" | "internal" | "invalid-target" | "name-unresolved" | "network-unreachable" | "not-a-person" | "not-found" | "owner-exited" | "owner-required" | "peer-mismatch" | "runtime-unreachable" | "runtime-untargetable" | "unauthorized" | "workspace-not-ready", message: string) => {
     readonly t: "refused";
     readonly reason: string;
     readonly message: string;

package/dist/core-api/workspace-forward.js

@@ -34,6 +34,7 @@ export const forwardRefusalReasonSchema = Schema.Literals([
     "budget-exceeded",
     "invalid-target",
     "owner-required",
+    "not-a-person",
     "internal",
     "owner-exited",
     "peer-mismatch",
@@ -56,6 +57,8 @@ export const FORWARD_REFUSAL_STATUS = {
     "budget-exceeded": 429,
     "invalid-target": 400,
     "owner-required": 400,
+    /** The asserted owner is a resource domain, which never opens a forward. */
+    "not-a-person": 400,
     internal: 500,
     "owner-exited": 409,
     "peer-mismatch": 409,