@sealant/api-contracts-next 0.40.0-next.768 → 0.40.0-next.770

package/dist/core-api/ssh-keys.js

@@ -1,5 +1,6 @@
 import { Schema } from "effect";
 import { HttpApiEndpoint, HttpApiGroup, HttpApiSchema, OpenApi } from "effect/http-api";
+import { PersonId } from "./person-id.js";
 const NonEmptyString = Schema.String.check(Schema.isNonEmpty(), Schema.isTrimmed());
 /*
 User SSH public keys. Two audiences:
@@ -15,21 +16,21 @@ export const sshKeyGatewayHeadersSchema = Schema.Struct({
 export const createSshKeyRequestSchema = Schema.Struct({
     // Same trust model as createWorkspace: the internal API trusts the caller-supplied owner; the web
     // server injects the session user id.
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     name: Schema.optional(NonEmptyString),
     // Raw `<algorithm> <base64> [comment]` line; the API normalizes and fingerprints it.
     publicKey: NonEmptyString,
 });
 export const sshKeySummarySchema = Schema.Struct({
     sshKeyId: NonEmptyString,
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     name: NonEmptyString,
     algorithm: NonEmptyString,
     fingerprint: NonEmptyString,
     createdAt: Schema.String,
 });
 export const listSshKeysQuerySchema = Schema.Struct({
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
 });
 export const listSshKeysResponseSchema = Schema.Struct({
     items: Schema.Array(sshKeySummarySchema),
@@ -41,7 +42,7 @@ export const resolveSshPrincipalRequestSchema = Schema.Struct({
     publicKeyBase64: NonEmptyString,
 });
 export const resolveSshPrincipalResponseSchema = Schema.Struct({
-    principalId: NonEmptyString,
+    principalId: PersonId,
     sshKeyId: NonEmptyString,
     fingerprint: NonEmptyString,
 });

package/dist/core-api/users.js

@@ -8,9 +8,10 @@
  */
 import { Schema } from "effect";
 import { HttpApiEndpoint, HttpApiGroup, OpenApi } from "effect/http-api";
+import { PersonId } from "./person-id.js";
 const NonEmptyString = Schema.String.check(Schema.isNonEmpty(), Schema.isTrimmed());
 export const userSchema = Schema.Struct({
-    userId: NonEmptyString,
+    userId: PersonId,
     email: NonEmptyString,
     name: NonEmptyString,
     createdAt: Schema.String,
@@ -20,7 +21,7 @@ export const ensureUserRequestSchema = Schema.Struct({
     email: NonEmptyString,
     name: NonEmptyString,
     /** Caller-chosen id for a NEW user (`usr_…`); ignored when the email already exists. */
-    userId: Schema.optional(NonEmptyString),
+    userId: Schema.optional(PersonId),
 });
 export const ensureUserResponseSchema = Schema.Struct({
     ...userSchema.fields,
@@ -38,7 +39,7 @@ export const personBindingSchema = Schema.Struct({
     home: NonEmptyString,
 });
 export const bindUserPersonResponseSchema = Schema.Struct({
-    userId: NonEmptyString,
+    userId: PersonId,
     person: personBindingSchema,
     /** True when this call made the binding; false when it was already exactly this. */
     created: Schema.Boolean,
@@ -59,7 +60,7 @@ export class UserNotFoundError extends Schema.TaggedError()("UserNotFoundError",
 }
 export class UserInternalServerError extends Schema.TaggedError()("UserInternalServerError", { message: Schema.String }, { httpApiStatus: 500 }) {
 }
-const userIdParams = Schema.Struct({ userId: NonEmptyString });
+const userIdParams = Schema.Struct({ userId: PersonId });
 export const UsersGroup = HttpApiGroup.make("users")
     .add(HttpApiEndpoint.post("ensureUser", "/", {
     payload: ensureUserRequestSchema,

package/dist/core-api/workspace-forward.d.ts

@@ -19,7 +19,7 @@ export declare const FORWARD_V2_SUBPROTOCOL = "sealant.forward.v2";
 export declare const FORWARD_V2_MAX_FRAME_BYTES: number;
 /** Ends the socket after a `refused` frame. It says nothing about why: the frame's reason does. */
 export declare const FORWARD_REFUSED_CLOSE_CODE = 4400;
-export declare const forwardRefusalReasonSchema: Schema.Literals<readonly ["workspace-not-ready", "runtime-unreachable", "runtime-untargetable", "connection-refused", "name-unresolved", "network-unreachable", "dial-timeout", "dial-failed", "not-found", "unauthorized", "forbidden", "budget-exceeded", "invalid-target", "owner-required", "internal", "owner-exited", "peer-mismatch", "binding-unverifiable", "binding-unsupported"]>;
+export declare const forwardRefusalReasonSchema: Schema.Literals<readonly ["workspace-not-ready", "runtime-unreachable", "runtime-untargetable", "connection-refused", "name-unresolved", "network-unreachable", "dial-timeout", "dial-failed", "not-found", "unauthorized", "forbidden", "budget-exceeded", "invalid-target", "owner-required", "not-a-person", "internal", "owner-exited", "peer-mismatch", "binding-unverifiable", "binding-unsupported"]>;
 export type ForwardRefusalReason = typeof forwardRefusalReasonSchema.Type;
 /** The HTTP status each refusal would have had before the upgrade. Callers branch on the reason. */
 export declare const FORWARD_REFUSAL_STATUS: {
@@ -37,6 +37,8 @@ export declare const FORWARD_REFUSAL_STATUS: {
     readonly "budget-exceeded": 429;
     readonly "invalid-target": 400;
     readonly "owner-required": 400;
+    /** The asserted owner is a resource domain, which never opens a forward. */
+    readonly "not-a-person": 400;
     readonly internal: 500;
     readonly "owner-exited": 409;
     readonly "peer-mismatch": 409;
@@ -76,7 +78,7 @@ export declare const forwardRefusedFrameSchema: Schema.Struct<{
     readonly status: Schema.Int;
 }>;
 export type ForwardRefusedFrame = typeof forwardRefusedFrameSchema.Type;
-export declare const forwardRefusedFrame: (reason: "binding-unsupported" | "binding-unverifiable" | "budget-exceeded" | "connection-refused" | "dial-failed" | "dial-timeout" | "forbidden" | "internal" | "invalid-target" | "name-unresolved" | "network-unreachable" | "not-found" | "owner-exited" | "owner-required" | "peer-mismatch" | "runtime-unreachable" | "runtime-untargetable" | "unauthorized" | "workspace-not-ready", message: string) => {
+export declare const forwardRefusedFrame: (reason: "binding-unsupported" | "binding-unverifiable" | "budget-exceeded" | "connection-refused" | "dial-failed" | "dial-timeout" | "forbidden" | "internal" | "invalid-target" | "name-unresolved" | "network-unreachable" | "not-a-person" | "not-found" | "owner-exited" | "owner-required" | "peer-mismatch" | "runtime-unreachable" | "runtime-untargetable" | "unauthorized" | "workspace-not-ready", message: string) => {
     readonly t: "refused";
     readonly reason: string;
     readonly message: string;

package/dist/core-api/workspace-forward.js

@@ -34,6 +34,7 @@ export const forwardRefusalReasonSchema = Schema.Literals([
     "budget-exceeded",
     "invalid-target",
     "owner-required",
+    "not-a-person",
     "internal",
     "owner-exited",
     "peer-mismatch",
@@ -56,6 +57,8 @@ export const FORWARD_REFUSAL_STATUS = {
     "budget-exceeded": 429,
     "invalid-target": 400,
     "owner-required": 400,
+    /** The asserted owner is a resource domain, which never opens a forward. */
+    "not-a-person": 400,
     internal: 500,
     "owner-exited": 409,
     "peer-mismatch": 409,

package/dist/core-api/workspaces.js

@@ -2,6 +2,7 @@ import { Schema } from "effect";
 import { HttpApiEndpoint, HttpApiGroup, HttpApiSchema, OpenApi } from "effect/http-api";
 import { BudgetExceededError } from "./budgets.js";
 import { connectedAccountProviderSchema } from "./connected-accounts.js";
+import { PersonId } from "./person-id.js";
 import { runCommandSchema, runSchema } from "./runs.js";
 import { workspaceProcessUserSchema } from "./sessions.js";
 const NonEmptyString = Schema.String.check(Schema.isNonEmpty(), Schema.isTrimmed());
@@ -136,7 +137,7 @@ export const createWorkspaceCredentialsSchema = Schema.Struct({
     github: Schema.optional(NonEmptyString),
 });
 export const createWorkspaceRequestSchema = Schema.Struct({
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     registryId: NonEmptyString,
     repository: NonEmptyString,
     tag: NonEmptyString,
@@ -203,7 +204,7 @@ export const execRunHarnessId = "exec";
  * "can I trust these exit codes", not "did the checks pass".
  */
 export const execWorkspaceRequestSchema = Schema.Struct({
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     /** Commands execute sequentially in the workspace, each recorded like any other process. */
     commands: Schema.Array(runCommandSchema).check(Schema.isNonEmpty(), Schema.isMaxLength(32)),
     /**
@@ -273,9 +274,9 @@ export const applyWorkspaceDotfilesArchiveSchema = Schema.Struct({
  */
 export const applyWorkspaceDotfilesRequestSchema = Schema.Struct({
     /** The workspace's owner (owner scope; uniform 404 otherwise). */
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     /** The Sealant user whose dotfiles these are: recorded on the run (`metadata.dotfiles`). */
-    onBehalfOfUserId: NonEmptyString,
+    onBehalfOfUserId: PersonId,
     /** The Linux user to apply as (a login name or a uid); never root. */
     user: workspaceProcessUserSchema,
     /** The user's passwd home: absolute, normalised, never under `/workspace`. */
@@ -306,7 +307,7 @@ export const workspaceDotfilesConflictCodes = [
  * unbinds. The reply is the workspace's full set of live bindings, which every relaunch re-applies.
  */
 export const bindWorkspaceRequestSchema = Schema.Struct({
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     mountPath: Schema.optional(NonEmptyString),
     subpath: Schema.String,
 });
@@ -332,7 +333,7 @@ export const workspaceCaptureFlushKindSchema = Schema.Literals(["final", "suspen
  * `kind: "suspend"` (the default) is a checkpoint: the executor keeps running.
  */
 export const flushWorkspaceCaptureRequestSchema = Schema.Struct({
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     /** `final` or `suspend` (the default). */
     kind: Schema.optional(workspaceCaptureFlushKindSchema),
     /** How long the daemon may take before it answers, in milliseconds. Absent: its own default. */
@@ -348,7 +349,7 @@ export const flushWorkspaceCaptureRequestSchema = Schema.Struct({
  * what a drain polls to show `saving · N left` and to know when the executor may go away.
  */
 export const getWorkspaceCaptureStatusQuerySchema = Schema.Struct({
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
 });
 export const captureClassSchema = Schema.Literals(["small", "bulk"]);
 /** One capture class's snaps (sealantd `CaptureClassSnaps`). */
@@ -503,7 +504,7 @@ export const workspaceCaptureStatusSchema = Schema.Struct({
  * answer named the worktree and epoch already in force.
  */
 export const replanWorkspaceCaptureRequestSchema = Schema.Struct({
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     /**
      * The owner map the claim needs (a capture source's `ownerMap`), or `null` for none. The daemon
      * reads its map only at boot, so a re-plan restores under the map the executor was launched
@@ -532,7 +533,7 @@ export const workspaceCaptureReplannedSchema = Schema.Struct({
 export const renameWorkspaceRequestSchema = Schema.Struct({
     name: NonEmptyString,
     /** The workspace's owner. Required by the control plane: a rename that names none finds nothing. */
-    ownerUserId: Schema.optional(NonEmptyString),
+    ownerUserId: Schema.optional(PersonId),
 });
 /**
  * `DELETE /v1/workspaces/:id/ssh-user`: the gateway runs the workspace's SSH sessions as root from
@@ -540,12 +541,12 @@ export const renameWorkspaceRequestSchema = Schema.Struct({
  */
 export const clearWorkspaceSshUserQuerySchema = Schema.Struct({
     /** The workspace's owner. Required by the control plane: a request that names none finds nothing. */
-    ownerUserId: Schema.optional(NonEmptyString),
+    ownerUserId: Schema.optional(PersonId),
 });
 // Lifecycle actions are owner-scoped like execWorkspace: ownerUserId rides in the payload and a
 // mismatch yields a uniform 404 (existence is not leaked).
 export const stopWorkspaceRequestSchema = Schema.Struct({
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     /**
      * End the workspace WITHOUT saving its unsaved captures. A capture-sourced workspace is
      * otherwise drained before it stops, and kept running for as long as its work cannot be
@@ -615,7 +616,7 @@ export const stopWorkspaceResponseSchema = Schema.Struct({
 });
 /** Owner-scoped: ask the control plane to recover the workspace's retained executor now. */
 export const recoverWorkspaceRequestSchema = Schema.Struct({
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
 });
 /**
  * `requested`: the workspace's executor is retained (its disk holds work not confirmed saved) and
@@ -629,7 +630,7 @@ export const recoverWorkspaceResponseSchema = Schema.Struct({
     recoverable: Schema.optional(Schema.Boolean),
 });
 export const restartWorkspaceRequestSchema = Schema.Struct({
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
 });
 export const restartWorkspaceResponseSchema = Schema.Struct({
     workspaceId: NonEmptyString,
@@ -643,7 +644,7 @@ export const restartWorkspaceResponseSchema = Schema.Struct({
  * image published for that plan answers. Nothing is created, built or reserved.
  */
 export const inspectWorkspaceImageRequestSchema = Schema.Struct({
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     registryId: NonEmptyString,
     /** The spec a create would send (`CreateWorkspaceRequest.spec`). */
     spec: Schema.Unknown,
@@ -697,9 +698,9 @@ export const workspaceCredentialHomeAccountProvider = { claude: "claude", codex:
  */
 export const putWorkspaceCredentialsRequestSchema = Schema.Struct({
     /** The workspace's owner (owner scope; uniform 404 otherwise). */
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     /** The person whose logins the home holds: every named account must be theirs. */
-    onBehalfOfUserId: NonEmptyString,
+    onBehalfOfUserId: PersonId,
     /**
      * Absolute path of the home inside the executor: a person's home, a conversation home, or
      * `/root`. Normalised, never under `/workspace`, and reached without a symbolic link. It must
@@ -776,7 +777,7 @@ export const workspaceHomeAccountSchema = Schema.Struct({
 export const workspaceCredentialHomeSchema = Schema.Struct({
     home: NonEmptyString,
     /** The one person whose logins the home holds. */
-    onBehalfOfUserId: NonEmptyString,
+    onBehalfOfUserId: PersonId,
     /** The logins written there, one receipt each. Absent from a server without placements. */
     placements: Schema.optional(Schema.Array(workspaceCredentialPlacementReceiptSchema)),
     /**
@@ -817,7 +818,7 @@ export const putWorkspaceCredentialsResponseSchema = Schema.Struct({
 });
 /** Remove every login of one home that is neither live nor the ready one of the person's default. */
 export const pruneWorkspaceCredentialsRequestSchema = Schema.Struct({
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     home: NonEmptyString,
     live: Schema.Array(NonEmptyString),
 });
@@ -829,7 +830,7 @@ export const pruneWorkspaceCredentialsResponseSchema = Schema.Struct({
 });
 /** Release one home: its login files are removed and its record deleted. */
 export const releaseWorkspaceCredentialsQuerySchema = Schema.Struct({
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     home: NonEmptyString,
 });
 export const releaseWorkspaceCredentialsResponseSchema = Schema.Struct({
@@ -840,7 +841,7 @@ export const releaseWorkspaceCredentialsResponseSchema = Schema.Struct({
     released: Schema.Boolean,
 });
 export const listWorkspaceCredentialsQuerySchema = Schema.Struct({
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
 });
 /** The homes of the workspace's running executor, oldest first. */
 export const listWorkspaceCredentialsResponseSchema = Schema.Struct({
@@ -869,7 +870,7 @@ export const workspaceCredentialsConflictCodes = [
     "home-busy",
 ];
 export const expireWorkspaceRequestSchema = Schema.Struct({
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     // Seconds from now until the workspace expires; null clears the TTL (never expires); omitted =
     // expire immediately (the reaper stops it on its next tick).
     ttlSeconds: Schema.optional(Schema.NullOr(Schema.Int.check(Schema.isGreaterThan(0)))),
@@ -927,11 +928,11 @@ export const workspaceCreateStateSchema = Schema.Struct({
     launchId: Schema.optional(NonEmptyString),
 });
 export const getWorkspaceCreateQuerySchema = Schema.Struct({
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
 });
 /** Owner-scoped: cancel the create with this key, so it never commits. */
 export const cancelWorkspaceCreateRequestSchema = Schema.Struct({
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
 });
 /**
  * Where a workspace that is not ready yet is in its launch:
@@ -963,7 +964,7 @@ export const workspacePhaseSchema = Schema.Struct({
 export const workspaceSummarySchema = Schema.Struct({
     workspaceId: NonEmptyString,
     name: NonEmptyString,
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     status: workspaceStatusSchema,
     registryId: Schema.optional(NonEmptyString),
     repository: Schema.optional(NonEmptyString),
@@ -1061,7 +1062,7 @@ export const workspaceCaptureDrainSchema = Schema.Struct({
 export const workspaceDetailsSchema = Schema.Struct({
     workspaceId: NonEmptyString,
     name: NonEmptyString,
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     status: workspaceStatusSchema,
     registryId: Schema.optional(NonEmptyString),
     repository: Schema.optional(NonEmptyString),
@@ -1090,10 +1091,10 @@ export const workspaceDetailsSchema = Schema.Struct({
  * Optional on the wire for older callers; the control plane requires it.
  */
 export const getWorkspaceQuerySchema = Schema.Struct({
-    ownerUserId: Schema.optional(NonEmptyString),
+    ownerUserId: Schema.optional(PersonId),
 });
 export const listWorkspacesQuerySchema = Schema.Struct({
-    ownerUserId: NonEmptyString,
+    ownerUserId: PersonId,
     status: Schema.optional(workspaceStatusSchema),
     limit: Schema.optional(NonEmptyString),
     /** Only the owner's workspace created with this `idempotencyKey` (none or one item). */
@@ -1103,7 +1104,7 @@ export const listWorkspacesResponseSchema = Schema.Struct({
     items: Schema.Array(workspaceSummarySchema),
 });
 export const listWorkspaceAttemptsQuerySchema = Schema.Struct({
-    ownerUserId: Schema.optional(NonEmptyString),
+    ownerUserId: Schema.optional(PersonId),
     limit: Schema.optional(NonEmptyString),
 });
 export const workspaceAttemptSummarySchema = Schema.Struct({
@@ -1128,7 +1129,7 @@ export const listWorkspaceAttemptsResponseSchema = Schema.Struct({
     items: Schema.Array(workspaceAttemptSummarySchema),
 });
 export const listWorkspaceEventsQuerySchema = Schema.Struct({
-    ownerUserId: Schema.optional(NonEmptyString),
+    ownerUserId: Schema.optional(PersonId),
     limit: Schema.optional(NonEmptyString),
 });
 export const workspaceEventTypeSchema = Schema.Literals([
@@ -1162,7 +1163,7 @@ export const workspaceGatewayHeadersSchema = Schema.Struct({
     "x-sealant-gateway-token": Schema.optional(NonEmptyString),
     // Identifies the client principal (the SSH key's owner). The API authorizes principal x workspace
     // before returning a control target (gateway-spec §3.4).
-    "x-sealant-principal-id": Schema.optional(NonEmptyString),
+    "x-sealant-principal-id": Schema.optional(PersonId),
     // `1` from a gateway that runs a workspace's SSH sessions as its `sshUser`. A workspace with a
     // user answers no target to a gateway without it, which would run the session as root.
     "x-sealant-gateway-ssh-user": Schema.optional(NonEmptyString),

package/dist/index.d.ts

@@ -3,6 +3,7 @@ export * from "./core-api/control-plane.js";
 export * from "./core-api/github.js";
 export * from "./core-api/inference.js";
 export * from "./core-api/packages.js";
+export * from "./core-api/person-id.js";
 export * from "./core-api/profiles.js";
 export * from "./core-api/record-events.js";
 export * from "./core-api/budgets.js";
@@ -10,6 +11,7 @@ export * from "./core-api/oci-names.js";
 export * from "./core-api/registries.js";
 export * from "./core-api/runs.js";
 export * from "./core-api/request-refusal.js";
+export * from "./core-api/resource-domains.js";
 export * from "./core-api/sessions.js";
 export * from "./core-api/access-tokens.js";
 export * from "./core-api/workspaces.js";

package/dist/index.js

@@ -3,6 +3,7 @@ export * from "./core-api/control-plane.js";
 export * from "./core-api/github.js";
 export * from "./core-api/inference.js";
 export * from "./core-api/packages.js";
+export * from "./core-api/person-id.js";
 export * from "./core-api/profiles.js";
 export * from "./core-api/record-events.js";
 export * from "./core-api/budgets.js";
@@ -10,6 +11,7 @@ export * from "./core-api/oci-names.js";
 export * from "./core-api/registries.js";
 export * from "./core-api/runs.js";
 export * from "./core-api/request-refusal.js";
+export * from "./core-api/resource-domains.js";
 export * from "./core-api/sessions.js";
 export * from "./core-api/access-tokens.js";
 export * from "./core-api/workspaces.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealant/api-contracts-next",
-  "version": "0.40.0-next.768",
+  "version": "0.40.0-next.770",
   "description": "Contract-first HTTP API definitions for Sealant services",
   "license": "Apache-2.0",
   "repository": {
@@ -36,7 +36,7 @@
   "peerDependencies": {
     "effect": "^4.0.5"
   },
-  "gitHead": "f1e27d77cf3498dcd6eab47bd2fa9619094b2b63",
+  "gitHead": "1e8b4f1153f5107504649c863c305cd31f424d58",
   "publishConfig": {
     "access": "public"
   }