@sealant/sdk-next 0.40.0-next.759 → 0.40.0-next.760

package/README.md

@@ -359,10 +359,13 @@ const workspace = await sealant.workspaces.create({
   are one directory name (letters, digits, `.`, `_`, `-`, at most 128, not starting with `.` or
   `-`), no id and no uid twice, at most 256 people.
 - Launched only on an image whose probe reports `restore.owner_map` from its sealantd
-  (`personLayout`); on any other image, or one with no probe, the launch fails with
-  `owner-map-unsupported` before anything starts. Refused at create on Cloudflare, and on
-  Kubernetes, whose Pods run with `allowPrivilegeEscalation: false`, so no person's `sudo` could
-  work there.
+  (`personLayout`). On an image whose sealantd does not report it, the launch fails with
+  `owner-map-unsupported` before anything starts; on one with no probe, or a probe Core cannot read,
+  it fails with `owner-map-unverified`. Refused at create on Cloudflare. On Kubernetes it runs under
+  runc: a per-person Pod may escalate, so each person's `sudo` works, and the cluster's image
+  builder reads the probe back from the pushed image. Under gVisor (`ociRuntime: "runsc"`) it is
+  refused. `features().kubernetesPersonLayout` says whether the control plane takes it on
+  Kubernetes.
 - The map is the executor's for its life: the daemon reads it at boot. A standby's claim
   (`capture.replan()`) and a recovery restore under the map it booted with. Pass
   `capture.replan({ expectedOwnerMap })` (or `null` for none) to have the claim refused

package/dist/effect/api-client.d.ts

@@ -985,6 +985,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly personBinding: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                 readonly sshKeyRemovalEndsConnections: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                 readonly connectedAccountDefaults: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+                readonly kubernetesPersonLayout: import("effect/Schema").optional<import("effect/Schema").Boolean>;
             }>>;
         }>>, never, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly getSetupState: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"getSetupState", "GET", "/v1/system/setup-state", never, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
@@ -2803,6 +2804,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly personBinding: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                 readonly sshKeyRemovalEndsConnections: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                 readonly connectedAccountDefaults: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+                readonly kubernetesPersonLayout: import("effect/Schema").optional<import("effect/Schema").Boolean>;
             }>>;
         }>>, never, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly getSetupState: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"getSetupState", "GET", "/v1/system/setup-state", never, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{

package/dist/effect/operations.d.ts

@@ -1280,6 +1280,7 @@ export declare const getIndexOp: () => Effect.Effect<{
         readonly personBinding?: boolean | undefined;
         readonly sshKeyRemovalEndsConnections?: boolean | undefined;
         readonly connectedAccountDefaults?: boolean | undefined;
+        readonly kubernetesPersonLayout?: boolean | undefined;
     } | undefined;
 }, import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("effect/Schema").SchemaError, SealantApiClient>;
 export declare const getSetupStateOp: () => Effect.Effect<{

package/dist/internal/features.d.ts

@@ -17,6 +17,7 @@ export declare const toFeatures: (index: {
         readonly personBinding?: boolean | undefined;
         readonly sshKeyRemovalEndsConnections?: boolean | undefined;
         readonly connectedAccountDefaults?: boolean | undefined;
+        readonly kubernetesPersonLayout?: boolean | undefined;
     } | undefined;
 }) => SealantFeatures;
 /**

package/dist/internal/features.js

@@ -21,6 +21,7 @@ export const toFeatures = (index) => {
         personBinding: features?.personBinding === true,
         sshKeyRemovalEndsConnections: features?.sshKeyRemovalEndsConnections === true,
         connectedAccountDefaults: features?.connectedAccountDefaults === true,
+        kubernetesPersonLayout: features?.kubernetesPersonLayout === true,
     };
 };
 /**

package/dist/types.d.ts

@@ -242,10 +242,11 @@ export interface WorkspaceCaptureSource {
      * leaves no-new-privileges unset so every person's `sudo` works. Fixed for the executor's life:
      * the daemon reads it at boot, so a standby's claim (`capture.replan()`) and a recovery restore
      * under the map it booted with (`replan({ expectedOwnerMap })` refuses a mismatch). Refused on
-     * Cloudflare and Kubernetes (no person's `sudo` works under `allowPrivilegeEscalation: false`),
-     * and at launch (`owner-map-unsupported`, nothing started) on an image whose probe does not
-     * report `restore.owner_map`. The workspace creator's choice of privilege; only this field sets
-     * it.
+     * Cloudflare, and on Kubernetes under gVisor (`ociRuntime: "runsc"`); under runc a per-person Pod
+     * may escalate, so each person's `sudo` works. Refused at launch, with nothing started, on an
+     * image whose sealantd does not report `restore.owner_map` (`owner-map-unsupported`) and on one
+     * with no probe Core can read (`owner-map-unverified`). The workspace creator's choice of
+     * privilege; only this field sets it.
      */
     readonly ownerMap?: WorkspaceCaptureOwnerMap;
 }
@@ -1404,6 +1405,12 @@ export interface SealantFeatures {
      * `default`.
      */
     readonly connectedAccountDefaults: boolean;
+    /**
+     * `ownerMap` is taken on Kubernetes (runc): each person's `sudo` works in the Pod, and images the
+     * cluster builds record the probe a per-person launch checks. From an older control plane a
+     * create with `ownerMap` on Kubernetes is refused.
+     */
+    readonly kubernetesPersonLayout: boolean;
 }
 /** A published workspace image. */
 export interface WorkspaceImage {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealant/sdk-next",
-  "version": "0.40.0-next.759",
+  "version": "0.40.0-next.760",
   "description": "The fluent public SDK for Sealant — create a workspace, run a harness, replay the record.",
   "license": "Apache-2.0",
   "repository": {
@@ -26,12 +26,12 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@sealant/api-contracts": "npm:@sealant/api-contracts-next@0.40.0-next.759"
+    "@sealant/api-contracts": "npm:@sealant/api-contracts-next@0.40.0-next.760"
   },
   "peerDependencies": {
     "effect": "^4.0.5"
   },
-  "gitHead": "2e8d2c658ec3dda4ba925f6734a7fdda3919ca7d",
+  "gitHead": "eb43ab8076dbdd584f026d068c478078a294d570",
   "publishConfig": {
     "access": "public"
   }