@sealant/api-contracts-next 0.40.0-next.768 → 0.40.0-next.770

package/dist/core-api/control-plane.js

@@ -7,6 +7,7 @@ import { PackagesGroup } from "./packages.js";
 import { ProfilesGroup } from "./profiles.js";
 import { RegistriesGroup } from "./registries.js";
 import { RequestRefusal } from "./request-refusal.js";
+import { ResourceDomainsGroup } from "./resource-domains.js";
 import { RunsGroup } from "./runs.js";
 import { SessionsGroup } from "./sessions.js";
 import { SshKeysGroup } from "./ssh-keys.js";
@@ -27,6 +28,7 @@ export const ControlPlaneAPI = HttpApi.make("sealantControlPlaneApi")
     .add(RegistriesGroup.prefix("/v1/registries"))
     .add(GitHubGroup.prefix("/v1/github"))
     .add(UsersGroup.prefix("/v1/users"))
+    .add(ResourceDomainsGroup.prefix("/v1/resource-domains"))
     // Last, so it reaches every endpoint above (`HttpApi.middleware` skips endpoints added after it).
     .middleware(RequestRefusal)
     .annotate(OpenApi.Title, "Sealant Control Plane API")

package/dist/core-api/github.js

@@ -1,5 +1,6 @@
 import { Schema } from "effect";
 import { HttpApi, HttpApiEndpoint, HttpApiGroup, HttpApiSchema, OpenApi } from "effect/http-api";
+import { PersonId } from "./person-id.js";
 // These literal sets mirror the control-plane DB enums (packages/db `control-plane.ts`). They are
 // INLINED here so the public contract package carries NO @sealant/db dependency — which keeps
 // consumers like @sealant/sdk free of drizzle/pg. Keep them in sync with the db schema.
@@ -17,17 +18,17 @@ export const messageResponseSchema = Schema.Struct({
     message: Schema.String,
 });
 export const githubInstallationsQuerySchema = Schema.Struct({
-    userId: NonEmptyString,
+    userId: PersonId,
 });
 export const githubInstallationRepositoriesQuerySchema = Schema.Struct({
-    userId: NonEmptyString,
+    userId: PersonId,
     search: Schema.optional(NonEmptyString),
 });
 export const syncGitHubInstallationQuerySchema = Schema.Struct({
-    userId: NonEmptyString,
+    userId: PersonId,
 });
 export const importGitHubInstallationRequestSchema = Schema.Struct({
-    userId: NonEmptyString,
+    userId: PersonId,
     externalInstallationId: NonEmptyString,
 });
 export const githubWebhookHeadersSchema = Schema.Struct({

package/dist/core-api/inference.js

@@ -22,6 +22,7 @@
 import { Schema } from "effect";
 import { HttpApiEndpoint, HttpApiGroup, HttpApiSchema, OpenApi } from "effect/http-api";
 import { BudgetExceededError } from "./budgets.js";
+import { PersonId } from "./person-id.js";
 const NonEmptyString = Schema.String.check(Schema.isNonEmpty(), Schema.isTrimmed());
 /**
  * Connected-account selection — the same reference shape as workspace creation: values are account
@@ -55,7 +56,7 @@ export const inferenceToolResultSchema = Schema.Struct({
  *   authenticated when it started; credential fields must be absent.
  */
 export const inferenceRespondRequestSchema = Schema.Struct({
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     credentials: Schema.optional(inferenceCredentialsSchema),
     prompt: Schema.optional(Schema.String.check(Schema.isNonEmpty())),
     system: Schema.optional(Schema.String),

package/dist/core-api/person-id.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The ids that name a person, and the one rule that keeps a resource domain out of them.
+ *
+ * A resource domain (`resource-domains.ts`) is an owner that is not a person: it never holds a
+ * login or a provider credential and never runs a harness. Core mints every resource domain id
+ * with {@link RESOURCE_DOMAIN_ID_PREFIX}, and no `user` row may carry it (a database check), so
+ * the spelling alone tells the two apart. Every field and header that names a person (`ownerUserId`,
+ * `onBehalfOfUserId`, `userId`, the SSH gateway's `principalId`) is a {@link PersonId}: a domain id there is refused with a `400`
+ * `RequestRefusedError` while the request is decoded, before any handler runs. A test walks every
+ * endpoint of the control plane API and fails on a person field that is not one.
+ */
+import { Schema } from "effect";
+export declare const RESOURCE_DOMAIN_ID_PREFIX = "rdm:";
+export declare const isResourceDomainId: (id: string) => boolean;
+/** Why an id cannot name a person, after the field's name. Never quotes the id. */
+export declare const NOT_A_PERSON = "names a resource domain, which never holds a login or a provider credential and never runs a harness";
+export declare const PersonId: Schema.String;

package/dist/core-api/person-id.js

@@ -0,0 +1,17 @@
+/**
+ * The ids that name a person, and the one rule that keeps a resource domain out of them.
+ *
+ * A resource domain (`resource-domains.ts`) is an owner that is not a person: it never holds a
+ * login or a provider credential and never runs a harness. Core mints every resource domain id
+ * with {@link RESOURCE_DOMAIN_ID_PREFIX}, and no `user` row may carry it (a database check), so
+ * the spelling alone tells the two apart. Every field and header that names a person (`ownerUserId`,
+ * `onBehalfOfUserId`, `userId`, the SSH gateway's `principalId`) is a {@link PersonId}: a domain id there is refused with a `400`
+ * `RequestRefusedError` while the request is decoded, before any handler runs. A test walks every
+ * endpoint of the control plane API and fails on a person field that is not one.
+ */
+import { Schema } from "effect";
+export const RESOURCE_DOMAIN_ID_PREFIX = "rdm:";
+export const isResourceDomainId = (id) => id.startsWith(RESOURCE_DOMAIN_ID_PREFIX);
+/** Why an id cannot name a person, after the field's name. Never quotes the id. */
+export const NOT_A_PERSON = "names a resource domain, which never holds a login or a provider credential and never runs a harness";
+export const PersonId = Schema.String.check(Schema.isNonEmpty(), Schema.isTrimmed(), Schema.makeFilter((id) => (isResourceDomainId(id) ? NOT_A_PERSON : undefined)));

package/dist/core-api/profiles.js

@@ -1,6 +1,7 @@
 import { Schema } from "effect";
 import { HttpApiEndpoint, HttpApiGroup, OpenApi } from "effect/http-api";
 import { connectedAccountProviderSchema, connectedAccountSummarySchema, } from "./connected-accounts.js";
+import { PersonId } from "./person-id.js";
 const NonEmptyString = Schema.String.check(Schema.isNonEmpty(), Schema.isTrimmed());
 /*
 Minimal profiles surface: list a user's profiles and manage the per-provider connected-account
@@ -11,7 +12,7 @@ Bindings embed account summaries only — never secret material.
 export const profileStatusSchema = Schema.Literals(["active", "archived"]);
 export const profileSummarySchema = Schema.Struct({
     profileId: NonEmptyString,
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     slug: NonEmptyString,
     name: NonEmptyString,
     description: Schema.NullOr(Schema.String),
@@ -21,7 +22,7 @@ export const profileSummarySchema = Schema.Struct({
     updatedAt: Schema.String,
 });
 export const listProfilesQuerySchema = Schema.Struct({
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
 });
 export const listProfilesResponseSchema = Schema.Struct({
     items: Schema.Array(profileSummarySchema),
@@ -36,7 +37,7 @@ export const listProfileCredentialBindingsResponseSchema = Schema.Struct({
     items: Schema.Array(profileCredentialBindingWithAccountSchema),
 });
 export const setProfileCredentialBindingRequestSchema = Schema.Struct({
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     provider: connectedAccountProviderSchema,
     /**
      * The account to bind: its id, or `default` for the owner's chosen default for `provider` (an

package/dist/core-api/resource-domains.d.ts

@@ -0,0 +1,184 @@
+/**
+ * Resource domains: an owner that is a project, not a person.
+ *
+ * An application (Mend) keeps one domain per project for the things the project owns rather than
+ * any one person: its services, volumes and network. A domain outlives every person, and it never
+ * holds a login or a provider credential and never runs a harness. Its id (`rdm:<uuid>`) can never
+ * name a person: every person field of this API is a `PersonId`, which refuses it.
+ *
+ * `ensureResourceDomain` is idempotent on `key`, `<application>:<name>` (Mend:
+ * `mend:<installation>:project:<project>`): the first call creates the domain and every later or
+ * concurrent call answers the same one. Keys are global, and every service key may name any of
+ * them; the application prefix keeps applications apart by convention, not by authority.
+ *
+ * Only a service key reaches these routes. Any other bearer is refused by the transport with `401`
+ * before a handler runs. A deployment served without authentication (the development exception)
+ * serves them as it serves every other route. A request body is decoded strictly: a field the contract does not declare (an
+ * owner, a credential) is refused with `400` instead of being dropped.
+ *
+ * Members are the people the application lets reach the domain. A grant or a revoke carries
+ * `version`, the application's own number for its decision about this person, rising with each
+ * decision it makes (its record's revision, say). Core writes the decision only over a lower
+ * version. The same version with the same state is a repeat, answered with the member unchanged.
+ * The same version with the other state, or a lower one, is stale: `409`, carrying the decision
+ * that stands. So a delayed grant never undoes a newer revoke, whatever order decisions arrive in
+ * and however often each is retried, and the application never reads before it writes. A revoke
+ * keeps the member's row, with its version. One member reads at `GET …/members/:userId`, and the
+ * list pages by user id: `limit` (100 unless named, at most 500) and the previous page's
+ * `nextCursor` as `cursor`.
+ */
+import { Schema } from "effect";
+import { HttpApiEndpoint, HttpApiGroup } from "effect/http-api";
+export declare const resourceDomainSchema: Schema.Struct<{
+    readonly resourceDomainId: Schema.String;
+    readonly key: Schema.String;
+    readonly createdAt: Schema.String;
+}>;
+export type ResourceDomainWire = typeof resourceDomainSchema.Type;
+export declare const ensureResourceDomainRequestSchema: Schema.Struct<{
+    readonly key: Schema.String;
+}>;
+export type EnsureResourceDomainRequest = typeof ensureResourceDomainRequestSchema.Type;
+export declare const ensureResourceDomainResponseSchema: Schema.Struct<{
+    readonly resourceDomainId: Schema.String;
+    readonly key: Schema.String;
+    readonly createdAt: Schema.String;
+    /** True when this call created the domain. */
+    readonly created: Schema.Boolean;
+}>;
+export type EnsureResourceDomainResponse = typeof ensureResourceDomainResponseSchema.Type;
+export declare const resourceDomainMemberSchema: Schema.Struct<{
+    readonly userId: Schema.String;
+    readonly state: Schema.Literals<readonly ["member", "revoked"]>;
+    readonly version: Schema.Int;
+    readonly updatedAt: Schema.String;
+}>;
+export type ResourceDomainMemberWire = typeof resourceDomainMemberSchema.Type;
+export declare const resourceDomainMemberDecisionSchema: Schema.Struct<{
+    /** The application's own version of this decision, rising with each decision it makes. */
+    readonly version: Schema.Int;
+}>;
+export type ResourceDomainMemberDecisionRequest = typeof resourceDomainMemberDecisionSchema.Type;
+/** At most this many members a page, and this many when the request names no `limit`. */
+export declare const RESOURCE_DOMAIN_MEMBERS_PAGE: {
+    readonly default: 100;
+    readonly max: 500;
+};
+export declare const listResourceDomainMembersQuerySchema: Schema.Struct<{
+    readonly limit: Schema.optional<Schema.FiniteFromString>;
+    /** A previous page's `nextCursor`: the page starts after it. */
+    readonly cursor: Schema.optional<Schema.String>;
+}>;
+export type ListResourceDomainMembersQuery = typeof listResourceDomainMembersQuerySchema.Type;
+export declare const listResourceDomainMembersResponseSchema: Schema.Struct<{
+    readonly items: Schema.$Array<Schema.Struct<{
+        readonly userId: Schema.String;
+        readonly state: Schema.Literals<readonly ["member", "revoked"]>;
+        readonly version: Schema.Int;
+        readonly updatedAt: Schema.String;
+    }>>;
+    /** Present when more members follow: pass it as `cursor` for the next page. */
+    readonly nextCursor: Schema.optional<Schema.String>;
+}>;
+export type ListResourceDomainMembersResponse = typeof listResourceDomainMembersResponseSchema.Type;
+declare const ResourceDomainForbiddenError_base: Schema.Class<ResourceDomainForbiddenError, Schema.TaggedStruct<"ResourceDomainForbiddenError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class ResourceDomainForbiddenError extends ResourceDomainForbiddenError_base {
+}
+declare const ResourceDomainNotFoundError_base: Schema.Class<ResourceDomainNotFoundError, Schema.TaggedStruct<"ResourceDomainNotFoundError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class ResourceDomainNotFoundError extends ResourceDomainNotFoundError_base {
+}
+declare const ResourceDomainPersonNotFoundError_base: Schema.Class<ResourceDomainPersonNotFoundError, Schema.TaggedStruct<"ResourceDomainPersonNotFoundError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** The person a member route names does not exist (the domain does). */
+export declare class ResourceDomainPersonNotFoundError extends ResourceDomainPersonNotFoundError_base {
+}
+declare const ResourceDomainMemberNotFoundError_base: Schema.Class<ResourceDomainMemberNotFoundError, Schema.TaggedStruct<"ResourceDomainMemberNotFoundError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** The person exists, and the application has made no decision about them in the domain. */
+export declare class ResourceDomainMemberNotFoundError extends ResourceDomainMemberNotFoundError_base {
+}
+declare const ResourceDomainMemberVersionConflictError_base: Schema.Class<ResourceDomainMemberVersionConflictError, Schema.TaggedStruct<"ResourceDomainMemberVersionConflictError", {
+    readonly message: Schema.String;
+    readonly current: Schema.Struct<{
+        readonly state: Schema.Literals<readonly ["member", "revoked"]>;
+        readonly version: Schema.Int;
+    }>;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * A decision at least as new stands, so this one changed nothing. `current` is the decision that
+ * stands; the message quotes nothing the request sent.
+ */
+export declare class ResourceDomainMemberVersionConflictError extends ResourceDomainMemberVersionConflictError_base {
+}
+declare const ResourceDomainInternalServerError_base: Schema.Class<ResourceDomainInternalServerError, Schema.TaggedStruct<"ResourceDomainInternalServerError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class ResourceDomainInternalServerError extends ResourceDomainInternalServerError_base {
+}
+export declare const ResourceDomainsGroup: HttpApiGroup.HttpApiGroup<"resourceDomains", HttpApiEndpoint.HttpApiEndpoint<"ensureResourceDomain", "POST", "/", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly key: Schema.String;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    readonly resourceDomainId: Schema.String;
+    readonly key: Schema.String;
+    readonly createdAt: Schema.String;
+    /** True when this call created the domain. */
+    readonly created: Schema.Boolean;
+}>>, Schema.toCodecJson<typeof ResourceDomainForbiddenError | typeof ResourceDomainInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"getResourceDomain", "GET", "/:resourceDomainId", Schema.toCodecStringTree<Schema.Struct<{
+    readonly resourceDomainId: Schema.String;
+}>>, never, never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly resourceDomainId: Schema.String;
+    readonly key: Schema.String;
+    readonly createdAt: Schema.String;
+}>>, Schema.toCodecJson<typeof ResourceDomainForbiddenError | typeof ResourceDomainNotFoundError | typeof ResourceDomainInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"getResourceDomainMember", "GET", "/:resourceDomainId/members/:userId", Schema.toCodecStringTree<Schema.Struct<{
+    readonly resourceDomainId: Schema.String;
+    readonly userId: Schema.String;
+}>>, never, never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly userId: Schema.String;
+    readonly state: Schema.Literals<readonly ["member", "revoked"]>;
+    readonly version: Schema.Int;
+    readonly updatedAt: Schema.String;
+}>>, Schema.toCodecJson<typeof ResourceDomainForbiddenError | typeof ResourceDomainNotFoundError | typeof ResourceDomainPersonNotFoundError | typeof ResourceDomainMemberNotFoundError | typeof ResourceDomainInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"grantResourceDomainMember", "POST", "/:resourceDomainId/members/:userId/grant", Schema.toCodecStringTree<Schema.Struct<{
+    readonly resourceDomainId: Schema.String;
+    readonly userId: Schema.String;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    /** The application's own version of this decision, rising with each decision it makes. */
+    readonly version: Schema.Int;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    readonly userId: Schema.String;
+    readonly state: Schema.Literals<readonly ["member", "revoked"]>;
+    readonly version: Schema.Int;
+    readonly updatedAt: Schema.String;
+}>>, Schema.toCodecJson<typeof ResourceDomainForbiddenError | typeof ResourceDomainNotFoundError | typeof ResourceDomainPersonNotFoundError | typeof ResourceDomainMemberVersionConflictError | typeof ResourceDomainInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"listResourceDomainMembers", "GET", "/:resourceDomainId/members", Schema.toCodecStringTree<Schema.Struct<{
+    readonly resourceDomainId: Schema.String;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+    readonly limit: Schema.optional<Schema.FiniteFromString>;
+    /** A previous page's `nextCursor`: the page starts after it. */
+    readonly cursor: Schema.optional<Schema.String>;
+}>>, never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly items: Schema.$Array<Schema.Struct<{
+        readonly userId: Schema.String;
+        readonly state: Schema.Literals<readonly ["member", "revoked"]>;
+        readonly version: Schema.Int;
+        readonly updatedAt: Schema.String;
+    }>>;
+    /** Present when more members follow: pass it as `cursor` for the next page. */
+    readonly nextCursor: Schema.optional<Schema.String>;
+}>>, Schema.toCodecJson<typeof ResourceDomainForbiddenError | typeof ResourceDomainNotFoundError | typeof ResourceDomainInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"revokeResourceDomainMember", "POST", "/:resourceDomainId/members/:userId/revoke", Schema.toCodecStringTree<Schema.Struct<{
+    readonly resourceDomainId: Schema.String;
+    readonly userId: Schema.String;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    /** The application's own version of this decision, rising with each decision it makes. */
+    readonly version: Schema.Int;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    readonly userId: Schema.String;
+    readonly state: Schema.Literals<readonly ["member", "revoked"]>;
+    readonly version: Schema.Int;
+    readonly updatedAt: Schema.String;
+}>>, Schema.toCodecJson<typeof ResourceDomainForbiddenError | typeof ResourceDomainNotFoundError | typeof ResourceDomainPersonNotFoundError | typeof ResourceDomainMemberVersionConflictError | typeof ResourceDomainInternalServerError>, never, never>, false>;
+export {};

package/dist/core-api/resource-domains.js

@@ -0,0 +1,152 @@
+/**
+ * Resource domains: an owner that is a project, not a person.
+ *
+ * An application (Mend) keeps one domain per project for the things the project owns rather than
+ * any one person: its services, volumes and network. A domain outlives every person, and it never
+ * holds a login or a provider credential and never runs a harness. Its id (`rdm:<uuid>`) can never
+ * name a person: every person field of this API is a `PersonId`, which refuses it.
+ *
+ * `ensureResourceDomain` is idempotent on `key`, `<application>:<name>` (Mend:
+ * `mend:<installation>:project:<project>`): the first call creates the domain and every later or
+ * concurrent call answers the same one. Keys are global, and every service key may name any of
+ * them; the application prefix keeps applications apart by convention, not by authority.
+ *
+ * Only a service key reaches these routes. Any other bearer is refused by the transport with `401`
+ * before a handler runs. A deployment served without authentication (the development exception)
+ * serves them as it serves every other route. A request body is decoded strictly: a field the contract does not declare (an
+ * owner, a credential) is refused with `400` instead of being dropped.
+ *
+ * Members are the people the application lets reach the domain. A grant or a revoke carries
+ * `version`, the application's own number for its decision about this person, rising with each
+ * decision it makes (its record's revision, say). Core writes the decision only over a lower
+ * version. The same version with the same state is a repeat, answered with the member unchanged.
+ * The same version with the other state, or a lower one, is stale: `409`, carrying the decision
+ * that stands. So a delayed grant never undoes a newer revoke, whatever order decisions arrive in
+ * and however often each is retried, and the application never reads before it writes. A revoke
+ * keeps the member's row, with its version. One member reads at `GET …/members/:userId`, and the
+ * list pages by user id: `limit` (100 unless named, at most 500) and the previous page's
+ * `nextCursor` as `cursor`.
+ */
+import { Schema } from "effect";
+import { HttpApi, HttpApiEndpoint, HttpApiGroup, OpenApi } from "effect/http-api";
+import { PersonId, RESOURCE_DOMAIN_ID_PREFIX } from "./person-id.js";
+const RESOURCE_DOMAIN_ID_PATTERN = new RegExp(`^${RESOURCE_DOMAIN_ID_PREFIX}[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$`);
+const RESOURCE_DOMAIN_KEY_PATTERN = /^[a-z][a-z0-9-]{0,31}:[A-Za-z0-9._:/@+=-]{1,223}$/;
+const ResourceDomainId = Schema.String.check(Schema.makeFilter((id) => RESOURCE_DOMAIN_ID_PATTERN.test(id) ? undefined : "must be a resource domain id (rdm:<uuid>)"));
+const ResourceDomainKey = Schema.String.check(Schema.makeFilter((key) => RESOURCE_DOMAIN_KEY_PATTERN.test(key)
+    ? undefined
+    : "must be <application>:<name>: a lower-case application name (letters, digits, '-'), a colon, then at most 223 letters, digits, '.', '_', ':', '/', '@', '+', '=' or '-'"));
+export const resourceDomainSchema = Schema.Struct({
+    resourceDomainId: ResourceDomainId,
+    key: ResourceDomainKey,
+    createdAt: Schema.String,
+});
+export const ensureResourceDomainRequestSchema = Schema.Struct({ key: ResourceDomainKey });
+export const ensureResourceDomainResponseSchema = Schema.Struct({
+    ...resourceDomainSchema.fields,
+    /** True when this call created the domain. */
+    created: Schema.Boolean,
+});
+const MemberVersion = Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER }));
+const MemberState = Schema.Literals(["member", "revoked"]);
+export const resourceDomainMemberSchema = Schema.Struct({
+    userId: PersonId,
+    state: MemberState,
+    version: MemberVersion,
+    updatedAt: Schema.String,
+});
+export const resourceDomainMemberDecisionSchema = Schema.Struct({
+    /** The application's own version of this decision, rising with each decision it makes. */
+    version: MemberVersion,
+});
+/** At most this many members a page, and this many when the request names no `limit`. */
+export const RESOURCE_DOMAIN_MEMBERS_PAGE = { default: 100, max: 500 };
+export const listResourceDomainMembersQuerySchema = Schema.Struct({
+    limit: Schema.optional(Schema.FiniteFromString.check(Schema.isInt(), Schema.isBetween({ minimum: 1, maximum: RESOURCE_DOMAIN_MEMBERS_PAGE.max }))),
+    /** A previous page's `nextCursor`: the page starts after it. */
+    cursor: Schema.optional(Schema.String.check(Schema.isNonEmpty())),
+});
+export const listResourceDomainMembersResponseSchema = Schema.Struct({
+    items: Schema.Array(resourceDomainMemberSchema),
+    /** Present when more members follow: pass it as `cursor` for the next page. */
+    nextCursor: Schema.optional(Schema.String),
+});
+export class ResourceDomainForbiddenError extends Schema.TaggedError()("ResourceDomainForbiddenError", { message: Schema.String }, { httpApiStatus: 403 }) {
+}
+export class ResourceDomainNotFoundError extends Schema.TaggedError()("ResourceDomainNotFoundError", { message: Schema.String }, { httpApiStatus: 404 }) {
+}
+/** The person a member route names does not exist (the domain does). */
+export class ResourceDomainPersonNotFoundError extends Schema.TaggedError()("ResourceDomainPersonNotFoundError", { message: Schema.String }, { httpApiStatus: 404 }) {
+}
+/** The person exists, and the application has made no decision about them in the domain. */
+export class ResourceDomainMemberNotFoundError extends Schema.TaggedError()("ResourceDomainMemberNotFoundError", { message: Schema.String }, { httpApiStatus: 404 }) {
+}
+/**
+ * A decision at least as new stands, so this one changed nothing. `current` is the decision that
+ * stands; the message quotes nothing the request sent.
+ */
+export class ResourceDomainMemberVersionConflictError extends Schema.TaggedError()("ResourceDomainMemberVersionConflictError", {
+    message: Schema.String,
+    current: Schema.Struct({ state: MemberState, version: MemberVersion }),
+}, { httpApiStatus: 409 }) {
+}
+export class ResourceDomainInternalServerError extends Schema.TaggedError()("ResourceDomainInternalServerError", { message: Schema.String }, { httpApiStatus: 500 }) {
+}
+const memberParams = Schema.Struct({ resourceDomainId: ResourceDomainId, userId: PersonId });
+const memberErrors = [
+    ResourceDomainForbiddenError,
+    ResourceDomainNotFoundError,
+    ResourceDomainPersonNotFoundError,
+    ResourceDomainMemberVersionConflictError,
+    ResourceDomainInternalServerError,
+];
+export const ResourceDomainsGroup = HttpApiGroup.make("resourceDomains")
+    .add(HttpApiEndpoint.post("ensureResourceDomain", "/", {
+    payload: ensureResourceDomainRequestSchema,
+    success: ensureResourceDomainResponseSchema,
+    error: [ResourceDomainForbiddenError, ResourceDomainInternalServerError],
+}))
+    .add(HttpApiEndpoint.get("getResourceDomain", "/:resourceDomainId", {
+    params: Schema.Struct({ resourceDomainId: ResourceDomainId }),
+    success: resourceDomainSchema,
+    error: [
+        ResourceDomainForbiddenError,
+        ResourceDomainNotFoundError,
+        ResourceDomainInternalServerError,
+    ],
+}))
+    .add(HttpApiEndpoint.post("grantResourceDomainMember", "/:resourceDomainId/members/:userId/grant", {
+    params: memberParams,
+    payload: resourceDomainMemberDecisionSchema,
+    success: resourceDomainMemberSchema,
+    error: memberErrors,
+}))
+    .add(HttpApiEndpoint.post("revokeResourceDomainMember", "/:resourceDomainId/members/:userId/revoke", {
+    params: memberParams,
+    payload: resourceDomainMemberDecisionSchema,
+    success: resourceDomainMemberSchema,
+    error: memberErrors,
+}))
+    .add(HttpApiEndpoint.get("getResourceDomainMember", "/:resourceDomainId/members/:userId", {
+    params: memberParams,
+    success: resourceDomainMemberSchema,
+    error: [
+        ResourceDomainForbiddenError,
+        ResourceDomainNotFoundError,
+        ResourceDomainPersonNotFoundError,
+        ResourceDomainMemberNotFoundError,
+        ResourceDomainInternalServerError,
+    ],
+}))
+    .add(HttpApiEndpoint.get("listResourceDomainMembers", "/:resourceDomainId/members", {
+    params: Schema.Struct({ resourceDomainId: ResourceDomainId }),
+    query: listResourceDomainMembersQuerySchema,
+    success: listResourceDomainMembersResponseSchema,
+    error: [
+        ResourceDomainForbiddenError,
+        ResourceDomainNotFoundError,
+        ResourceDomainInternalServerError,
+    ],
+}))
+    .annotate(HttpApi.PayloadParseOptions, { onExcessProperty: "error" })
+    .annotate(OpenApi.Description, "Owners that are projects, not people: they never hold a login or a provider credential.");

package/dist/core-api/runs.js

@@ -12,6 +12,7 @@
 import { Schema } from "effect";
 import { HttpApiEndpoint, HttpApiGroup, HttpApiSchema, OpenApi } from "effect/http-api";
 import { BudgetExceededError } from "./budgets.js";
+import { PersonId } from "./person-id.js";
 const NonEmptyString = Schema.String.check(Schema.isNonEmpty(), Schema.isTrimmed());
 export const runStatusSchema = Schema.Literals([
     "queued",
@@ -46,7 +47,7 @@ export const runSchema = Schema.Struct({
     runId: NonEmptyString,
     workspaceId: NonEmptyString,
     attemptId: Schema.optional(NonEmptyString),
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     harnessId: NonEmptyString,
     mode: runModeSchema,
     status: runStatusSchema,
@@ -80,7 +81,7 @@ export const runFileChangeSchema = Schema.Struct({
 export const createRunRequestSchema = Schema.Struct({
     workspaceId: NonEmptyString,
     harnessId: NonEmptyString,
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     mode: Schema.optional(runModeSchema),
     prompt: Schema.optional(Schema.String),
     attemptId: Schema.optional(NonEmptyString),
@@ -96,7 +97,7 @@ export const createRunRequestSchema = Schema.Struct({
 });
 export const updateRunRequestSchema = Schema.Struct({
     /** The run's owner. Required by the control plane: an update that names no owner finds no run. */
-    ownerUserId: Schema.optional(NonEmptyString),
+    ownerUserId: Schema.optional(PersonId),
     status: Schema.optional(runStatusSchema),
     exitCode: Schema.optional(Schema.Number),
     errorMessage: Schema.optional(Schema.String),
@@ -109,7 +110,7 @@ export const updateRunRequestSchema = Schema.Struct({
 });
 export const listRunsQuerySchema = Schema.Struct({
     workspaceId: Schema.optional(NonEmptyString),
-    ownerUserId: Schema.optional(NonEmptyString),
+    ownerUserId: Schema.optional(PersonId),
     status: Schema.optional(runStatusSchema),
     limit: Schema.optional(NonEmptyString),
 });
@@ -136,10 +137,10 @@ export const timelineEntrySchema = Schema.Struct({
  * names no owner finds no run.
  */
 export const runOwnerQuerySchema = Schema.Struct({
-    ownerUserId: Schema.optional(NonEmptyString),
+    ownerUserId: Schema.optional(PersonId),
 });
 export const getRunTimelineQuerySchema = Schema.Struct({
-    ownerUserId: Schema.optional(NonEmptyString),
+    ownerUserId: Schema.optional(PersonId),
     fromSequence: Schema.optional(NonEmptyString),
     toSequence: Schema.optional(NonEmptyString),
     limit: Schema.optional(NonEmptyString),
@@ -183,7 +184,7 @@ export const runEventSchema = Schema.Struct({
 // Execution record — scrollback (byte-exact terminal output)
 // ---------------------------------------------------------------------------------------------
 export const getRunScrollbackQuerySchema = Schema.Struct({
-    ownerUserId: Schema.optional(NonEmptyString),
+    ownerUserId: Schema.optional(PersonId),
     processId: NonEmptyString,
     stream: ioStreamSchema,
     atSequence: Schema.optional(NonEmptyString),

package/dist/core-api/sessions.js

@@ -15,6 +15,7 @@
  */
 import { Schema } from "effect";
 import { HttpApiEndpoint, HttpApiGroup, HttpApiSchema, OpenApi } from "effect/http-api";
+import { PersonId } from "./person-id.js";
 const NonEmptyString = Schema.String.check(Schema.isNonEmpty(), Schema.isTrimmed());
 export const sessionStatusSchema = Schema.Literals(["starting", "running", "exited", "failed"]);
 export const sessionAuthorizationHeadersSchema = Schema.Struct({
@@ -113,7 +114,7 @@ export const sessionArgvIssue = (argv) => {
 export const sessionArgvSchema = Schema.Array(Schema.String).check(Schema.makeFilter(sessionArgvIssue));
 export const createSessionRequestSchema = Schema.Struct({
     workspaceId: NonEmptyString,
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     /**
      * argv[0] is the program the session runs; the rest its arguments, passed to it as an argv array,
      * never through a shell. See `sessionArgvIssue` for what is refused.
@@ -151,7 +152,7 @@ export const sessionSchema = Schema.Struct({
     workspaceId: NonEmptyString,
     /** The interactive run recording this session; its record is the durable evidence. */
     runId: NonEmptyString,
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     status: sessionStatusSchema,
     /**
      * Only `argv[0]`, the program: Sealant never stores a session's arguments, because they can carry
@@ -181,7 +182,7 @@ export const sessionSchema = Schema.Struct({
     endedAt: Schema.optional(Schema.String),
 });
 export const listSessionsQuerySchema = Schema.Struct({
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     workspaceId: Schema.optional(NonEmptyString),
     status: Schema.optional(sessionStatusSchema),
     limit: Schema.optional(NonEmptyString),
@@ -190,22 +191,22 @@ export const listSessionsResponseSchema = Schema.Struct({
     items: Schema.Array(sessionSchema),
 });
 export const sessionInputRequestSchema = Schema.Struct({
-    ownerUserId: Schema.optional(NonEmptyString),
+    ownerUserId: Schema.optional(PersonId),
     /** Base64-encoded keystrokes (bytes, not text — binary-safe). */
     dataBase64: NonEmptyString,
 });
 export const sessionResizeRequestSchema = Schema.Struct({
-    ownerUserId: Schema.optional(NonEmptyString),
+    ownerUserId: Schema.optional(PersonId),
     cols: Schema.Int.check(Schema.isGreaterThan(0)),
     rows: Schema.Int.check(Schema.isGreaterThan(0)),
 });
 export const sessionSignalRequestSchema = Schema.Struct({
-    ownerUserId: Schema.optional(NonEmptyString),
+    ownerUserId: Schema.optional(PersonId),
     /** POSIX signal number (e.g. 2 = SIGINT, 15 = SIGTERM). */
     signal: Schema.Int.check(Schema.isGreaterThan(0)),
 });
 export const closeSessionRequestSchema = Schema.Struct({
-    ownerUserId: Schema.optional(NonEmptyString),
+    ownerUserId: Schema.optional(PersonId),
 });
 /**
  * Byte-exact session output by sequence range. `from` is INCLUSIVE (omit = from the beginning);
@@ -213,7 +214,7 @@ export const closeSessionRequestSchema = Schema.Struct({
  * as-recorded: redacted upstream by the daemon, PTY output stream only.
  */
 export const getSessionOutputQuerySchema = Schema.Struct({
-    ownerUserId: Schema.optional(NonEmptyString),
+    ownerUserId: Schema.optional(PersonId),
     from: Schema.optional(NonEmptyString),
     limit: Schema.optional(NonEmptyString),
 });
@@ -299,7 +300,7 @@ HttpApiEndpoint.post("createSessionAsUser", "/as-user", {
 HttpApiEndpoint.get("getSession", "/:sessionId", {
     params: sessionIdParams,
     headers: sessionAuthorizationHeadersSchema,
-    query: Schema.Struct({ ownerUserId: Schema.optional(NonEmptyString) }),
+    query: Schema.Struct({ ownerUserId: Schema.optional(PersonId) }),
     success: sessionSchema,
     error: [
         SessionBadRequestError,