@sealant/sdk-next 0.40.0-next.769 → 0.40.0-next.771

package/dist/client.d.ts

@@ -1,6 +1,12 @@
+import { type ScopesNamespace } from "./scopes.js";
 import type { AccessTokensNamespace, ConnectedAccountsNamespace, CreateOptions, InferenceNamespace, ListOptions, Run, SealantFeatures, SshKeysNamespace, Workspace, WorkspaceCreateState, WorkspaceImageInspection, WorkspaceSshNamespace, SealantConfig, UsersNamespace } from "./types.js";
 export declare class Sealant {
     #private;
+    /**
+     * Owners that are projects, not people: ensure one per project and name its members. With a
+     * service key; `actAs` gives a client for one scope that cannot reach a credential or a harness.
+     */
+    readonly scopes: ScopesNamespace;
     constructor(config: SealantConfig);
     /** The configured control-plane base URL. */
     get baseUrl(): string;

package/dist/client.js

@@ -12,6 +12,7 @@ import { imageSpecKey } from "./internal/image-key.js";
 import { buildInferenceRespondRequest, mapInferenceResponse } from "./internal/inference.js";
 import { requireSshUser } from "./internal/process-user.js";
 import { mapSshKey, mapWorkspaceSshInfo } from "./internal/ssh.js";
+import { makeScopes } from "./scopes.js";
 /** An idempotent create's state as the SDK reports it (an unknown wire state fails closed). */
 const toCreateState = (wire) => ({
     idempotencyKey: wire.idempotencyKey,
@@ -44,6 +45,11 @@ export class Sealant {
     #config;
     #runtime;
     #ctx;
+    /**
+     * Owners that are projects, not people: ensure one per project and name its members. With a
+     * service key; `actAs` gives a client for one scope that cannot reach a credential or a harness.
+     */
+    scopes;
     constructor(config) {
         if (config.baseUrl.trim().length === 0) {
             throw new SealantError("Sealant requires a non-empty `baseUrl`.", { code: "invalid_config" });
@@ -52,6 +58,7 @@ export class Sealant {
         this.#config = config;
         this.#runtime = makeSdkRuntime(internalConfig);
         this.#ctx = { runtime: this.#runtime, config: internalConfig };
+        this.scopes = makeScopes(this.#runtime);
     }
     /** The configured control-plane base URL. */
     get baseUrl() {

package/dist/effect/api-client.d.ts

@@ -527,12 +527,13 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
     readonly resourceDomains: {
         readonly ensureResourceDomain: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"ensureResourceDomain", "POST", "/v1/resource-domains/", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
             readonly key: import("effect/Schema").String;
+            readonly budget: import("effect/Schema").optional<import("effect/Schema").Struct<Record<"cpuMillicores" | "memoryBytes" | "storageBytes", import("effect/Schema").Int>>>;
         }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
             readonly resourceDomainId: import("effect/Schema").String;
             readonly key: import("effect/Schema").String;
             readonly createdAt: import("effect/Schema").String;
             readonly created: import("effect/Schema").Boolean;
-        }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ResourceDomainForbiddenError | typeof import("@sealant/api-contracts").ResourceDomainInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
+        }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ResourceDomainForbiddenError | typeof import("@sealant/api-contracts").ResourceDomainBudgetDiffersError | typeof import("@sealant/api-contracts").ResourceDomainInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly getResourceDomain: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"getResourceDomain", "GET", "/v1/resource-domains/:resourceDomainId", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
             readonly resourceDomainId: import("effect/Schema").String;
         }>>, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
@@ -540,6 +541,106 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly key: import("effect/Schema").String;
             readonly createdAt: import("effect/Schema").String;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ResourceDomainForbiddenError | typeof import("@sealant/api-contracts").ResourceDomainNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
+        readonly getResourceDomainBudget: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"getResourceDomainBudget", "GET", "/v1/resource-domains/:resourceDomainId/budget", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+            readonly resourceDomainId: import("effect/Schema").String;
+        }>>, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly revision: import("effect/Schema").Int;
+            readonly storageBytes: import("effect/Schema").Struct<{
+                readonly limit: import("effect/Schema").Int;
+                readonly used: import("effect/Schema").Int;
+                readonly reserved: import("effect/Schema").Int;
+                readonly warning: import("effect/Schema").Literals<readonly ["none", "80-percent", "95-percent", "full"]>;
+                readonly archived: import("effect/Schema").Int;
+                readonly protection: import("effect/Schema").Int;
+            }>;
+            readonly cpuMillicores: import("effect/Schema").Struct<{
+                readonly limit: import("effect/Schema").Int;
+                readonly used: import("effect/Schema").Int;
+                readonly reserved: import("effect/Schema").Int;
+                readonly warning: import("effect/Schema").Literals<readonly ["none", "80-percent", "95-percent", "full"]>;
+            }>;
+            readonly memoryBytes: import("effect/Schema").Struct<{
+                readonly limit: import("effect/Schema").Int;
+                readonly used: import("effect/Schema").Int;
+                readonly reserved: import("effect/Schema").Int;
+                readonly warning: import("effect/Schema").Literals<readonly ["none", "80-percent", "95-percent", "full"]>;
+            }>;
+        }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ResourceDomainForbiddenError | typeof import("@sealant/api-contracts").ResourceDomainNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
+        readonly getResourceDomainMember: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"getResourceDomainMember", "GET", "/v1/resource-domains/:resourceDomainId/members/:userId", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+            readonly resourceDomainId: import("effect/Schema").String;
+            readonly userId: import("effect/Schema").String;
+        }>>, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly userId: import("effect/Schema").String;
+            readonly state: import("effect/Schema").Literals<readonly ["member", "revoked"]>;
+            readonly version: import("effect/Schema").Int;
+            readonly updatedAt: import("effect/Schema").String;
+        }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ResourceDomainForbiddenError | typeof import("@sealant/api-contracts").ResourceDomainNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainPersonNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainMemberNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
+        readonly grantResourceDomainMember: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"grantResourceDomainMember", "POST", "/v1/resource-domains/:resourceDomainId/members/:userId/grant", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+            readonly resourceDomainId: import("effect/Schema").String;
+            readonly userId: import("effect/Schema").String;
+        }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly version: import("effect/Schema").Int;
+        }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly userId: import("effect/Schema").String;
+            readonly state: import("effect/Schema").Literals<readonly ["member", "revoked"]>;
+            readonly version: import("effect/Schema").Int;
+            readonly updatedAt: import("effect/Schema").String;
+        }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ResourceDomainForbiddenError | typeof import("@sealant/api-contracts").ResourceDomainNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainPersonNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainMemberVersionConflictError | typeof import("@sealant/api-contracts").ResourceDomainInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
+        readonly listResourceDomainMembers: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"listResourceDomainMembers", "GET", "/v1/resource-domains/:resourceDomainId/members", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+            readonly resourceDomainId: import("effect/Schema").String;
+        }>>, import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+            readonly limit: import("effect/Schema").optional<import("effect/Schema").FiniteFromString>;
+            readonly cursor: import("effect/Schema").optional<import("effect/Schema").String>;
+        }>>, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly items: import("effect/Schema").$Array<import("effect/Schema").Struct<{
+                readonly userId: import("effect/Schema").String;
+                readonly state: import("effect/Schema").Literals<readonly ["member", "revoked"]>;
+                readonly version: import("effect/Schema").Int;
+                readonly updatedAt: import("effect/Schema").String;
+            }>>;
+            readonly nextCursor: import("effect/Schema").optional<import("effect/Schema").String>;
+        }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ResourceDomainForbiddenError | typeof import("@sealant/api-contracts").ResourceDomainNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
+        readonly revokeResourceDomainMember: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"revokeResourceDomainMember", "POST", "/v1/resource-domains/:resourceDomainId/members/:userId/revoke", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+            readonly resourceDomainId: import("effect/Schema").String;
+            readonly userId: import("effect/Schema").String;
+        }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly version: import("effect/Schema").Int;
+        }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly userId: import("effect/Schema").String;
+            readonly state: import("effect/Schema").Literals<readonly ["member", "revoked"]>;
+            readonly version: import("effect/Schema").Int;
+            readonly updatedAt: import("effect/Schema").String;
+        }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ResourceDomainForbiddenError | typeof import("@sealant/api-contracts").ResourceDomainNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainPersonNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainMemberVersionConflictError | typeof import("@sealant/api-contracts").ResourceDomainInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
+        readonly setResourceDomainBudget: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"setResourceDomainBudget", "PUT", "/v1/resource-domains/:resourceDomainId/budget", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+            readonly resourceDomainId: import("effect/Schema").String;
+        }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly revision: import("effect/Schema").Int;
+            readonly cpuMillicores: import("effect/Schema").Int;
+            readonly memoryBytes: import("effect/Schema").Int;
+            readonly storageBytes: import("effect/Schema").Int;
+        }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly revision: import("effect/Schema").Int;
+            readonly storageBytes: import("effect/Schema").Struct<{
+                readonly limit: import("effect/Schema").Int;
+                readonly used: import("effect/Schema").Int;
+                readonly reserved: import("effect/Schema").Int;
+                readonly warning: import("effect/Schema").Literals<readonly ["none", "80-percent", "95-percent", "full"]>;
+                readonly archived: import("effect/Schema").Int;
+                readonly protection: import("effect/Schema").Int;
+            }>;
+            readonly cpuMillicores: import("effect/Schema").Struct<{
+                readonly limit: import("effect/Schema").Int;
+                readonly used: import("effect/Schema").Int;
+                readonly reserved: import("effect/Schema").Int;
+                readonly warning: import("effect/Schema").Literals<readonly ["none", "80-percent", "95-percent", "full"]>;
+            }>;
+            readonly memoryBytes: import("effect/Schema").Struct<{
+                readonly limit: import("effect/Schema").Int;
+                readonly used: import("effect/Schema").Int;
+                readonly reserved: import("effect/Schema").Int;
+                readonly warning: import("effect/Schema").Literals<readonly ["none", "80-percent", "95-percent", "full"]>;
+            }>;
+        }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ResourceDomainForbiddenError | typeof import("@sealant/api-contracts").ResourceDomainNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainBudgetRevisionConflictError | typeof import("@sealant/api-contracts").ResourceDomainInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
     };
     readonly runs: {
         readonly createRun: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"createRun", "POST", "/v1/runs/", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
@@ -2489,12 +2590,13 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
     readonly resourceDomains: {
         readonly ensureResourceDomain: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"ensureResourceDomain", "POST", "/v1/resource-domains/", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
             readonly key: import("effect/Schema").String;
+            readonly budget: import("effect/Schema").optional<import("effect/Schema").Struct<Record<"cpuMillicores" | "memoryBytes" | "storageBytes", import("effect/Schema").Int>>>;
         }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
             readonly resourceDomainId: import("effect/Schema").String;
             readonly key: import("effect/Schema").String;
             readonly createdAt: import("effect/Schema").String;
             readonly created: import("effect/Schema").Boolean;
-        }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ResourceDomainForbiddenError | typeof import("@sealant/api-contracts").ResourceDomainInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
+        }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ResourceDomainForbiddenError | typeof import("@sealant/api-contracts").ResourceDomainBudgetDiffersError | typeof import("@sealant/api-contracts").ResourceDomainInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly getResourceDomain: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"getResourceDomain", "GET", "/v1/resource-domains/:resourceDomainId", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
             readonly resourceDomainId: import("effect/Schema").String;
         }>>, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
@@ -2502,6 +2604,106 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly key: import("effect/Schema").String;
             readonly createdAt: import("effect/Schema").String;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ResourceDomainForbiddenError | typeof import("@sealant/api-contracts").ResourceDomainNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
+        readonly getResourceDomainBudget: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"getResourceDomainBudget", "GET", "/v1/resource-domains/:resourceDomainId/budget", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+            readonly resourceDomainId: import("effect/Schema").String;
+        }>>, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly revision: import("effect/Schema").Int;
+            readonly storageBytes: import("effect/Schema").Struct<{
+                readonly limit: import("effect/Schema").Int;
+                readonly used: import("effect/Schema").Int;
+                readonly reserved: import("effect/Schema").Int;
+                readonly warning: import("effect/Schema").Literals<readonly ["none", "80-percent", "95-percent", "full"]>;
+                readonly archived: import("effect/Schema").Int;
+                readonly protection: import("effect/Schema").Int;
+            }>;
+            readonly cpuMillicores: import("effect/Schema").Struct<{
+                readonly limit: import("effect/Schema").Int;
+                readonly used: import("effect/Schema").Int;
+                readonly reserved: import("effect/Schema").Int;
+                readonly warning: import("effect/Schema").Literals<readonly ["none", "80-percent", "95-percent", "full"]>;
+            }>;
+            readonly memoryBytes: import("effect/Schema").Struct<{
+                readonly limit: import("effect/Schema").Int;
+                readonly used: import("effect/Schema").Int;
+                readonly reserved: import("effect/Schema").Int;
+                readonly warning: import("effect/Schema").Literals<readonly ["none", "80-percent", "95-percent", "full"]>;
+            }>;
+        }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ResourceDomainForbiddenError | typeof import("@sealant/api-contracts").ResourceDomainNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
+        readonly getResourceDomainMember: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"getResourceDomainMember", "GET", "/v1/resource-domains/:resourceDomainId/members/:userId", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+            readonly resourceDomainId: import("effect/Schema").String;
+            readonly userId: import("effect/Schema").String;
+        }>>, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly userId: import("effect/Schema").String;
+            readonly state: import("effect/Schema").Literals<readonly ["member", "revoked"]>;
+            readonly version: import("effect/Schema").Int;
+            readonly updatedAt: import("effect/Schema").String;
+        }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ResourceDomainForbiddenError | typeof import("@sealant/api-contracts").ResourceDomainNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainPersonNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainMemberNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
+        readonly grantResourceDomainMember: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"grantResourceDomainMember", "POST", "/v1/resource-domains/:resourceDomainId/members/:userId/grant", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+            readonly resourceDomainId: import("effect/Schema").String;
+            readonly userId: import("effect/Schema").String;
+        }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly version: import("effect/Schema").Int;
+        }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly userId: import("effect/Schema").String;
+            readonly state: import("effect/Schema").Literals<readonly ["member", "revoked"]>;
+            readonly version: import("effect/Schema").Int;
+            readonly updatedAt: import("effect/Schema").String;
+        }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ResourceDomainForbiddenError | typeof import("@sealant/api-contracts").ResourceDomainNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainPersonNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainMemberVersionConflictError | typeof import("@sealant/api-contracts").ResourceDomainInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
+        readonly listResourceDomainMembers: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"listResourceDomainMembers", "GET", "/v1/resource-domains/:resourceDomainId/members", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+            readonly resourceDomainId: import("effect/Schema").String;
+        }>>, import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+            readonly limit: import("effect/Schema").optional<import("effect/Schema").FiniteFromString>;
+            readonly cursor: import("effect/Schema").optional<import("effect/Schema").String>;
+        }>>, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly items: import("effect/Schema").$Array<import("effect/Schema").Struct<{
+                readonly userId: import("effect/Schema").String;
+                readonly state: import("effect/Schema").Literals<readonly ["member", "revoked"]>;
+                readonly version: import("effect/Schema").Int;
+                readonly updatedAt: import("effect/Schema").String;
+            }>>;
+            readonly nextCursor: import("effect/Schema").optional<import("effect/Schema").String>;
+        }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ResourceDomainForbiddenError | typeof import("@sealant/api-contracts").ResourceDomainNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
+        readonly revokeResourceDomainMember: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"revokeResourceDomainMember", "POST", "/v1/resource-domains/:resourceDomainId/members/:userId/revoke", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+            readonly resourceDomainId: import("effect/Schema").String;
+            readonly userId: import("effect/Schema").String;
+        }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly version: import("effect/Schema").Int;
+        }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly userId: import("effect/Schema").String;
+            readonly state: import("effect/Schema").Literals<readonly ["member", "revoked"]>;
+            readonly version: import("effect/Schema").Int;
+            readonly updatedAt: import("effect/Schema").String;
+        }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ResourceDomainForbiddenError | typeof import("@sealant/api-contracts").ResourceDomainNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainPersonNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainMemberVersionConflictError | typeof import("@sealant/api-contracts").ResourceDomainInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
+        readonly setResourceDomainBudget: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"setResourceDomainBudget", "PUT", "/v1/resource-domains/:resourceDomainId/budget", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+            readonly resourceDomainId: import("effect/Schema").String;
+        }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly revision: import("effect/Schema").Int;
+            readonly cpuMillicores: import("effect/Schema").Int;
+            readonly memoryBytes: import("effect/Schema").Int;
+            readonly storageBytes: import("effect/Schema").Int;
+        }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly revision: import("effect/Schema").Int;
+            readonly storageBytes: import("effect/Schema").Struct<{
+                readonly limit: import("effect/Schema").Int;
+                readonly used: import("effect/Schema").Int;
+                readonly reserved: import("effect/Schema").Int;
+                readonly warning: import("effect/Schema").Literals<readonly ["none", "80-percent", "95-percent", "full"]>;
+                readonly archived: import("effect/Schema").Int;
+                readonly protection: import("effect/Schema").Int;
+            }>;
+            readonly cpuMillicores: import("effect/Schema").Struct<{
+                readonly limit: import("effect/Schema").Int;
+                readonly used: import("effect/Schema").Int;
+                readonly reserved: import("effect/Schema").Int;
+                readonly warning: import("effect/Schema").Literals<readonly ["none", "80-percent", "95-percent", "full"]>;
+            }>;
+            readonly memoryBytes: import("effect/Schema").Struct<{
+                readonly limit: import("effect/Schema").Int;
+                readonly used: import("effect/Schema").Int;
+                readonly reserved: import("effect/Schema").Int;
+                readonly warning: import("effect/Schema").Literals<readonly ["none", "80-percent", "95-percent", "full"]>;
+            }>;
+        }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ResourceDomainForbiddenError | typeof import("@sealant/api-contracts").ResourceDomainNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainBudgetRevisionConflictError | typeof import("@sealant/api-contracts").ResourceDomainInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
     };
     readonly runs: {
         readonly createRun: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"createRun", "POST", "/v1/runs/", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{

package/dist/effect/operations.d.ts

@@ -1434,3 +1434,103 @@ export declare const archiveSshKeyOp: (sshKeyId: string, ownerUserId: string) =>
     readonly fingerprint: string;
     readonly createdAt: string;
 }, import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("effect/Schema").SchemaError | import("@sealant/api-contracts").SshKeyInternalServerError | import("@sealant/api-contracts").SshKeyNotFoundError, SealantApiClient>;
+export declare const ensureResourceDomainOp: (key: string, budget?: {
+    readonly cpuMillicores: number;
+    readonly memoryBytes: number;
+    readonly storageBytes: number;
+} | undefined) => Effect.Effect<{
+    readonly resourceDomainId: string;
+    readonly key: string;
+    readonly createdAt: string;
+    readonly created: boolean;
+}, import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("@sealant/api-contracts").ResourceDomainBudgetDiffersError | import("@sealant/api-contracts").ResourceDomainForbiddenError | import("@sealant/api-contracts").ResourceDomainInternalServerError | import("effect/Schema").SchemaError, SealantApiClient>;
+export declare const getResourceDomainOp: (resourceDomainId: string) => Effect.Effect<{
+    readonly resourceDomainId: string;
+    readonly key: string;
+    readonly createdAt: string;
+}, import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("@sealant/api-contracts").ResourceDomainForbiddenError | import("@sealant/api-contracts").ResourceDomainInternalServerError | import("@sealant/api-contracts").ResourceDomainNotFoundError | import("effect/Schema").SchemaError, SealantApiClient>;
+export declare const grantResourceDomainMemberOp: (resourceDomainId: string, userId: string, payload: {
+    readonly version: number;
+}) => Effect.Effect<{
+    readonly userId: string;
+    readonly state: "member" | "revoked";
+    readonly version: number;
+    readonly updatedAt: string;
+}, import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("@sealant/api-contracts").ResourceDomainForbiddenError | import("@sealant/api-contracts").ResourceDomainInternalServerError | import("@sealant/api-contracts").ResourceDomainMemberVersionConflictError | import("@sealant/api-contracts").ResourceDomainNotFoundError | import("@sealant/api-contracts").ResourceDomainPersonNotFoundError | import("effect/Schema").SchemaError, SealantApiClient>;
+export declare const revokeResourceDomainMemberOp: (resourceDomainId: string, userId: string, payload: {
+    readonly version: number;
+}) => Effect.Effect<{
+    readonly userId: string;
+    readonly state: "member" | "revoked";
+    readonly version: number;
+    readonly updatedAt: string;
+}, import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("@sealant/api-contracts").ResourceDomainForbiddenError | import("@sealant/api-contracts").ResourceDomainInternalServerError | import("@sealant/api-contracts").ResourceDomainMemberVersionConflictError | import("@sealant/api-contracts").ResourceDomainNotFoundError | import("@sealant/api-contracts").ResourceDomainPersonNotFoundError | import("effect/Schema").SchemaError, SealantApiClient>;
+export declare const getResourceDomainMemberOp: (resourceDomainId: string, userId: string) => Effect.Effect<{
+    readonly userId: string;
+    readonly state: "member" | "revoked";
+    readonly version: number;
+    readonly updatedAt: string;
+}, import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("@sealant/api-contracts").ResourceDomainForbiddenError | import("@sealant/api-contracts").ResourceDomainInternalServerError | import("@sealant/api-contracts").ResourceDomainMemberNotFoundError | import("@sealant/api-contracts").ResourceDomainNotFoundError | import("@sealant/api-contracts").ResourceDomainPersonNotFoundError | import("effect/Schema").SchemaError, SealantApiClient>;
+export declare const listResourceDomainMembersOp: (resourceDomainId: string, query: {
+    readonly limit?: number | undefined;
+    readonly cursor?: string | undefined;
+}) => Effect.Effect<{
+    readonly items: readonly {
+        readonly userId: string;
+        readonly state: "member" | "revoked";
+        readonly version: number;
+        readonly updatedAt: string;
+    }[];
+    readonly nextCursor?: string | undefined;
+}, import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("@sealant/api-contracts").ResourceDomainForbiddenError | import("@sealant/api-contracts").ResourceDomainInternalServerError | import("@sealant/api-contracts").ResourceDomainNotFoundError | import("effect/Schema").SchemaError, SealantApiClient>;
+export declare const getResourceDomainBudgetOp: (resourceDomainId: string) => Effect.Effect<{
+    readonly revision: number;
+    readonly storageBytes: {
+        readonly limit: number;
+        readonly used: number;
+        readonly reserved: number;
+        readonly warning: "80-percent" | "95-percent" | "full" | "none";
+        readonly archived: number;
+        readonly protection: number;
+    };
+    readonly cpuMillicores: {
+        readonly limit: number;
+        readonly used: number;
+        readonly reserved: number;
+        readonly warning: "80-percent" | "95-percent" | "full" | "none";
+    };
+    readonly memoryBytes: {
+        readonly limit: number;
+        readonly used: number;
+        readonly reserved: number;
+        readonly warning: "80-percent" | "95-percent" | "full" | "none";
+    };
+}, import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("@sealant/api-contracts").ResourceDomainForbiddenError | import("@sealant/api-contracts").ResourceDomainInternalServerError | import("@sealant/api-contracts").ResourceDomainNotFoundError | import("effect/Schema").SchemaError, SealantApiClient>;
+export declare const setResourceDomainBudgetOp: (resourceDomainId: string, payload: {
+    readonly revision: number;
+    readonly cpuMillicores: number;
+    readonly memoryBytes: number;
+    readonly storageBytes: number;
+}) => Effect.Effect<{
+    readonly revision: number;
+    readonly storageBytes: {
+        readonly limit: number;
+        readonly used: number;
+        readonly reserved: number;
+        readonly warning: "80-percent" | "95-percent" | "full" | "none";
+        readonly archived: number;
+        readonly protection: number;
+    };
+    readonly cpuMillicores: {
+        readonly limit: number;
+        readonly used: number;
+        readonly reserved: number;
+        readonly warning: "80-percent" | "95-percent" | "full" | "none";
+    };
+    readonly memoryBytes: {
+        readonly limit: number;
+        readonly used: number;
+        readonly reserved: number;
+        readonly warning: "80-percent" | "95-percent" | "full" | "none";
+    };
+}, import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("@sealant/api-contracts").ResourceDomainBudgetRevisionConflictError | import("@sealant/api-contracts").ResourceDomainForbiddenError | import("@sealant/api-contracts").ResourceDomainInternalServerError | import("@sealant/api-contracts").ResourceDomainNotFoundError | import("effect/Schema").SchemaError, SealantApiClient>;

package/dist/effect/operations.js

@@ -86,3 +86,20 @@ export const getSetupStateOp = () => Effect.flatMap(SealantApiClient, (client) =
 export const createSshKeyOp = (payload) => Effect.flatMap(SealantApiClient, (client) => client.sshKeys.createSshKey({ payload }));
 export const listSshKeysOp = (ownerUserId) => Effect.flatMap(SealantApiClient, (client) => client.sshKeys.listSshKeys({ query: { ownerUserId } }));
 export const archiveSshKeyOp = (sshKeyId, ownerUserId) => Effect.flatMap(SealantApiClient, (client) => client.sshKeys.archiveSshKey({ params: { sshKeyId }, query: { ownerUserId } }));
+// ---- resource domains (the SDK's scopes) ----
+export const ensureResourceDomainOp = (key, budget) => Effect.flatMap(SealantApiClient, (client) => client.resourceDomains.ensureResourceDomain({
+    payload: budget === undefined ? { key } : { key, budget },
+}));
+export const getResourceDomainOp = (resourceDomainId) => Effect.flatMap(SealantApiClient, (client) => client.resourceDomains.getResourceDomain({ params: { resourceDomainId } }));
+export const grantResourceDomainMemberOp = (resourceDomainId, userId, payload) => Effect.flatMap(SealantApiClient, (client) => client.resourceDomains.grantResourceDomainMember({
+    params: { resourceDomainId, userId },
+    payload,
+}));
+export const revokeResourceDomainMemberOp = (resourceDomainId, userId, payload) => Effect.flatMap(SealantApiClient, (client) => client.resourceDomains.revokeResourceDomainMember({
+    params: { resourceDomainId, userId },
+    payload,
+}));
+export const getResourceDomainMemberOp = (resourceDomainId, userId) => Effect.flatMap(SealantApiClient, (client) => client.resourceDomains.getResourceDomainMember({ params: { resourceDomainId, userId } }));
+export const listResourceDomainMembersOp = (resourceDomainId, query) => Effect.flatMap(SealantApiClient, (client) => client.resourceDomains.listResourceDomainMembers({ params: { resourceDomainId }, query }));
+export const getResourceDomainBudgetOp = (resourceDomainId) => Effect.flatMap(SealantApiClient, (client) => client.resourceDomains.getResourceDomainBudget({ params: { resourceDomainId } }));
+export const setResourceDomainBudgetOp = (resourceDomainId, payload) => Effect.flatMap(SealantApiClient, (client) => client.resourceDomains.setResourceDomainBudget({ params: { resourceDomainId }, payload }));

package/dist/index.d.ts

@@ -18,5 +18,6 @@ export { Sealant } from "./client.js";
 export { claudeCode, codex, customHarness, opencode, pi } from "./harness.js";
 export { ForwardDialError, type ForwardDialFailure, type ForwardDialReason, ForwardResetError, SealantApiError, SealantError, SealantNotImplementedError, SealantRuntimeError, } from "./errors.js";
 export type * from "./types.js";
+export type { EnsuredScope, ScopeBudget, ScopeBudgetDimension, ScopeBudgetLimits, ScopeBudgets, ScopeClient, ScopeInfo, ScopeMember, ScopeMemberDecision, ScopeMemberPage, ScopeMembers, ScopesNamespace, } from "./scopes.js";
 export { findWorkspaceEnvReservedRule, findWorkspaceSecretEnvReservedRule, formatWorkspaceEnvIssue, parseWorkspaceEnv, parseWorkspaceSecretEnv, WORKSPACE_ENV_MAX_ENTRIES, WORKSPACE_ENV_MAX_NAME_LENGTH, WORKSPACE_ENV_MAX_TOTAL_BYTES, WORKSPACE_ENV_MAX_VALUE_BYTES, WORKSPACE_ENV_NAME_PATTERN, WORKSPACE_ENV_SECRET_MARKERS, } from "@sealant/api-contracts/workspace-environment";
 export type { WorkspaceEnvIssue, WorkspaceEnvParseResult, WorkspaceEnvReservedRule, } from "@sealant/api-contracts/workspace-environment";

package/dist/scopes.d.ts

@@ -0,0 +1,123 @@
+/**
+ * `sealant.scopes`: owners that are projects, not people (the control plane's resource domains).
+ *
+ * An application ensures one scope per project, by a global `<application>:<name>` key, and names
+ * the people who may reach it. A scope never holds a login or a provider credential and never runs
+ * a harness, so the client that acts as one (`actAs`) has no workspace, run, inference or
+ * credential methods at all. These calls need a service key and never use `ownerUserId`.
+ */
+import { type ResourceDomainBudgetDimension } from "@sealant/api-contracts";
+import type { SdkRuntime } from "./effect/runtime.js";
+export interface ScopeInfo {
+    /** `rdm:<uuid>`. No person field of the API accepts it. */
+    readonly id: string;
+    /** `<application>:<name>`, unique across every application. */
+    readonly key: string;
+    readonly createdAt: string;
+}
+export interface EnsuredScope extends ScopeInfo {
+    /** True when this call created the scope. */
+    readonly created: boolean;
+}
+/**
+ * The application's latest decision about one person in a scope. A revoked member keeps its row,
+ * so its version stays readable.
+ */
+export interface ScopeMember {
+    readonly userId: string;
+    readonly state: "member" | "revoked";
+    readonly version: number;
+    readonly updatedAt: string;
+}
+/**
+ * `version` is the application's own number for its decision about this person, rising with each
+ * decision it makes (its record's revision, say). The scope keeps the highest. The same version
+ * with the same state is a repeat and answers the member unchanged. The same version with the
+ * other state, or a lower one, rejects (409, `ResourceDomainMemberVersionConflictError`, whose
+ * `current` is the decision that stands) and changes nothing. So a delayed grant never undoes a
+ * newer revoke, and nothing needs reading first.
+ */
+export interface ScopeMemberDecision {
+    readonly version: number;
+}
+/** A page of a scope's members. `nextCursor` is present when more follow. */
+export interface ScopeMemberPage {
+    readonly items: readonly ScopeMember[];
+    readonly nextCursor?: string;
+}
+export interface ScopeMembers {
+    grant(userId: string, decision: ScopeMemberDecision): Promise<ScopeMember>;
+    revoke(userId: string, decision: ScopeMemberDecision): Promise<ScopeMember>;
+    /**
+     * One person's decision. Rejects with 404 `ResourceDomainMemberNotFoundError` when there is none,
+     * `ResourceDomainPersonNotFoundError` when the person does not exist.
+     */
+    get(userId: string): Promise<ScopeMember>;
+    /**
+     * A page of the people with a decision in the scope, revoked ones included, by user id: `limit`
+     * of them (100 unless named, at most 500), after the previous page's `nextCursor` as `cursor`.
+     */
+    list(options?: {
+        readonly limit?: number;
+        readonly cursor?: string;
+    }): Promise<ScopeMemberPage>;
+}
+/** Ceilings on what a scope's objects may hold (CPU millicores, memory and storage bytes). */
+export type ScopeBudgetLimits = {
+    readonly [D in ResourceDomainBudgetDimension]: number;
+};
+/**
+ * `used` (confirmed to exist) and `reserved` (admitted, not yet confirmed) both count against
+ * `limit`; `warning` is the highest share of it they reach.
+ */
+export interface ScopeBudgetDimension {
+    readonly limit: number;
+    readonly used: number;
+    readonly reserved: number;
+    readonly warning: "none" | "80-percent" | "95-percent" | "full";
+}
+/** Storage is one allowance, archived volumes and protection included; nothing is deleted to free it. */
+export type ScopeBudget = {
+    /** Name it to change the budget: a change made since refuses yours. */
+    readonly revision: number;
+} & {
+    readonly [D in ResourceDomainBudgetDimension]: ScopeBudgetDimension;
+} & {
+    readonly storageBytes: {
+        readonly archived: number;
+        readonly protection: number;
+    };
+};
+export interface ScopeBudgets {
+    get(): Promise<ScopeBudget>;
+    /**
+     * Replace the budget at the `revision` you read. A change since rejects (409,
+     * `ResourceDomainBudgetRevisionConflictError`). It answers the budget it wrote, and changes
+     * nothing the scope holds.
+     */
+    set(change: ScopeBudgetLimits & {
+        readonly revision: number;
+    }): Promise<ScopeBudget>;
+}
+/** A client acting as one scope. It has no method that could reach a credential or a harness. */
+export interface ScopeClient {
+    readonly id: string;
+    get(): Promise<ScopeInfo>;
+    readonly members: ScopeMembers;
+    readonly budget: ScopeBudgets;
+}
+export interface ScopesNamespace {
+    /**
+     * The scope with this key, created on the first call (with `budget`, or zero); later and
+     * concurrent calls answer it. Naming another budget rejects (409,
+     * `ResourceDomainBudgetDiffersError`, carrying the scope's id and its budget's revision).
+     */
+    ensure(options: {
+        readonly key: string;
+        readonly budget?: ScopeBudgetLimits;
+    }): Promise<EnsuredScope>;
+    get(scopeId: string): Promise<ScopeInfo>;
+    /** A client for this scope alone, and the only way to its members. Nothing is checked until its first call. */
+    actAs(scopeId: string): ScopeClient;
+}
+export declare const makeScopes: (runtime: SdkRuntime) => ScopesNamespace;

package/dist/scopes.js

@@ -0,0 +1,48 @@
+/**
+ * `sealant.scopes`: owners that are projects, not people (the control plane's resource domains).
+ *
+ * An application ensures one scope per project, by a global `<application>:<name>` key, and names
+ * the people who may reach it. A scope never holds a login or a provider credential and never runs
+ * a harness, so the client that acts as one (`actAs`) has no workspace, run, inference or
+ * credential methods at all. These calls need a service key and never use `ownerUserId`.
+ */
+import { RESOURCE_DOMAIN_BUDGET_DIMENSIONS, } from "@sealant/api-contracts";
+import * as Rec from "effect/Record";
+import { ensureResourceDomainOp, getResourceDomainBudgetOp, getResourceDomainMemberOp, getResourceDomainOp, grantResourceDomainMemberOp, listResourceDomainMembersOp, revokeResourceDomainMemberOp, setResourceDomainBudgetOp, } from "./effect/operations.js";
+const toScope = (wire) => ({
+    id: wire.resourceDomainId,
+    key: wire.key,
+    createdAt: wire.createdAt,
+});
+export const makeScopes = (runtime) => {
+    const get = async (scopeId) => toScope(await runtime.run(getResourceDomainOp(scopeId)));
+    return {
+        ensure: async ({ key, budget }) => {
+            const wire = await runtime.run(ensureResourceDomainOp(key, budget));
+            return { ...toScope(wire), created: wire.created };
+        },
+        get,
+        actAs: (scopeId) => ({
+            id: scopeId,
+            get: () => get(scopeId),
+            members: {
+                grant: (userId, decision) => runtime.run(grantResourceDomainMemberOp(scopeId, userId, { version: decision.version })),
+                revoke: (userId, decision) => runtime.run(revokeResourceDomainMemberOp(scopeId, userId, { version: decision.version })),
+                get: (userId) => runtime.run(getResourceDomainMemberOp(scopeId, userId)),
+                list: async (options) => {
+                    const page = await runtime.run(listResourceDomainMembersOp(scopeId, { ...options }));
+                    return page.nextCursor === undefined
+                        ? { items: page.items }
+                        : { items: page.items, nextCursor: page.nextCursor };
+                },
+            },
+            budget: {
+                get: () => runtime.run(getResourceDomainBudgetOp(scopeId)),
+                set: (change) => runtime.run(setResourceDomainBudgetOp(scopeId, {
+                    ...Rec.map(RESOURCE_DOMAIN_BUDGET_DIMENSIONS, (_, dimension) => change[dimension]),
+                    revision: change.revision,
+                })),
+            },
+        }),
+    };
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealant/sdk-next",
-  "version": "0.40.0-next.769",
+  "version": "0.40.0-next.771",
   "description": "The fluent public SDK for Sealant — create a workspace, run a harness, replay the record.",
   "license": "Apache-2.0",
   "repository": {
@@ -26,12 +26,12 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@sealant/api-contracts": "npm:@sealant/api-contracts-next@0.40.0-next.769"
+    "@sealant/api-contracts": "npm:@sealant/api-contracts-next@0.40.0-next.771"
   },
   "peerDependencies": {
     "effect": "^4.0.5"
   },
-  "gitHead": "ab6f8d9ccf2f282c542e388b994099cae91c1354",
+  "gitHead": "697e8d55f312105e4f52964dd5a7fb956c0c6d63",
   "publishConfig": {
     "access": "public"
   }