@sealant/sdk-next 0.40.0-next.769 → 0.40.0-next.770

package/dist/client.d.ts

@@ -1,6 +1,12 @@
+import { type ScopesNamespace } from "./scopes.js";
 import type { AccessTokensNamespace, ConnectedAccountsNamespace, CreateOptions, InferenceNamespace, ListOptions, Run, SealantFeatures, SshKeysNamespace, Workspace, WorkspaceCreateState, WorkspaceImageInspection, WorkspaceSshNamespace, SealantConfig, UsersNamespace } from "./types.js";
 export declare class Sealant {
     #private;
+    /**
+     * Owners that are projects, not people: ensure one per project and name its members. With a
+     * service key; `actAs` gives a client for one scope that cannot reach a credential or a harness.
+     */
+    readonly scopes: ScopesNamespace;
     constructor(config: SealantConfig);
     /** The configured control-plane base URL. */
     get baseUrl(): string;

package/dist/client.js

@@ -12,6 +12,7 @@ import { imageSpecKey } from "./internal/image-key.js";
 import { buildInferenceRespondRequest, mapInferenceResponse } from "./internal/inference.js";
 import { requireSshUser } from "./internal/process-user.js";
 import { mapSshKey, mapWorkspaceSshInfo } from "./internal/ssh.js";
+import { makeScopes } from "./scopes.js";
 /** An idempotent create's state as the SDK reports it (an unknown wire state fails closed). */
 const toCreateState = (wire) => ({
     idempotencyKey: wire.idempotencyKey,
@@ -44,6 +45,11 @@ export class Sealant {
     #config;
     #runtime;
     #ctx;
+    /**
+     * Owners that are projects, not people: ensure one per project and name its members. With a
+     * service key; `actAs` gives a client for one scope that cannot reach a credential or a harness.
+     */
+    scopes;
     constructor(config) {
         if (config.baseUrl.trim().length === 0) {
             throw new SealantError("Sealant requires a non-empty `baseUrl`.", { code: "invalid_config" });
@@ -52,6 +58,7 @@ export class Sealant {
         this.#config = config;
         this.#runtime = makeSdkRuntime(internalConfig);
         this.#ctx = { runtime: this.#runtime, config: internalConfig };
+        this.scopes = makeScopes(this.#runtime);
     }
     /** The configured control-plane base URL. */
     get baseUrl() {

package/dist/effect/api-client.d.ts

@@ -540,6 +540,51 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly key: import("effect/Schema").String;
             readonly createdAt: import("effect/Schema").String;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ResourceDomainForbiddenError | typeof import("@sealant/api-contracts").ResourceDomainNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
+        readonly getResourceDomainMember: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"getResourceDomainMember", "GET", "/v1/resource-domains/:resourceDomainId/members/:userId", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+            readonly resourceDomainId: import("effect/Schema").String;
+            readonly userId: import("effect/Schema").String;
+        }>>, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly userId: import("effect/Schema").String;
+            readonly state: import("effect/Schema").Literals<readonly ["member", "revoked"]>;
+            readonly version: import("effect/Schema").Int;
+            readonly updatedAt: import("effect/Schema").String;
+        }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ResourceDomainForbiddenError | typeof import("@sealant/api-contracts").ResourceDomainNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainPersonNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainMemberNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
+        readonly grantResourceDomainMember: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"grantResourceDomainMember", "POST", "/v1/resource-domains/:resourceDomainId/members/:userId/grant", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+            readonly resourceDomainId: import("effect/Schema").String;
+            readonly userId: import("effect/Schema").String;
+        }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly version: import("effect/Schema").Int;
+        }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly userId: import("effect/Schema").String;
+            readonly state: import("effect/Schema").Literals<readonly ["member", "revoked"]>;
+            readonly version: import("effect/Schema").Int;
+            readonly updatedAt: import("effect/Schema").String;
+        }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ResourceDomainForbiddenError | typeof import("@sealant/api-contracts").ResourceDomainNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainPersonNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainMemberVersionConflictError | typeof import("@sealant/api-contracts").ResourceDomainInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
+        readonly listResourceDomainMembers: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"listResourceDomainMembers", "GET", "/v1/resource-domains/:resourceDomainId/members", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+            readonly resourceDomainId: import("effect/Schema").String;
+        }>>, import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+            readonly limit: import("effect/Schema").optional<import("effect/Schema").FiniteFromString>;
+            readonly cursor: import("effect/Schema").optional<import("effect/Schema").String>;
+        }>>, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly items: import("effect/Schema").$Array<import("effect/Schema").Struct<{
+                readonly userId: import("effect/Schema").String;
+                readonly state: import("effect/Schema").Literals<readonly ["member", "revoked"]>;
+                readonly version: import("effect/Schema").Int;
+                readonly updatedAt: import("effect/Schema").String;
+            }>>;
+            readonly nextCursor: import("effect/Schema").optional<import("effect/Schema").String>;
+        }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ResourceDomainForbiddenError | typeof import("@sealant/api-contracts").ResourceDomainNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
+        readonly revokeResourceDomainMember: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"revokeResourceDomainMember", "POST", "/v1/resource-domains/:resourceDomainId/members/:userId/revoke", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+            readonly resourceDomainId: import("effect/Schema").String;
+            readonly userId: import("effect/Schema").String;
+        }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly version: import("effect/Schema").Int;
+        }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly userId: import("effect/Schema").String;
+            readonly state: import("effect/Schema").Literals<readonly ["member", "revoked"]>;
+            readonly version: import("effect/Schema").Int;
+            readonly updatedAt: import("effect/Schema").String;
+        }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ResourceDomainForbiddenError | typeof import("@sealant/api-contracts").ResourceDomainNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainPersonNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainMemberVersionConflictError | typeof import("@sealant/api-contracts").ResourceDomainInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
     };
     readonly runs: {
         readonly createRun: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"createRun", "POST", "/v1/runs/", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
@@ -2502,6 +2547,51 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly key: import("effect/Schema").String;
             readonly createdAt: import("effect/Schema").String;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ResourceDomainForbiddenError | typeof import("@sealant/api-contracts").ResourceDomainNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
+        readonly getResourceDomainMember: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"getResourceDomainMember", "GET", "/v1/resource-domains/:resourceDomainId/members/:userId", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+            readonly resourceDomainId: import("effect/Schema").String;
+            readonly userId: import("effect/Schema").String;
+        }>>, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly userId: import("effect/Schema").String;
+            readonly state: import("effect/Schema").Literals<readonly ["member", "revoked"]>;
+            readonly version: import("effect/Schema").Int;
+            readonly updatedAt: import("effect/Schema").String;
+        }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ResourceDomainForbiddenError | typeof import("@sealant/api-contracts").ResourceDomainNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainPersonNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainMemberNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
+        readonly grantResourceDomainMember: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"grantResourceDomainMember", "POST", "/v1/resource-domains/:resourceDomainId/members/:userId/grant", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+            readonly resourceDomainId: import("effect/Schema").String;
+            readonly userId: import("effect/Schema").String;
+        }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly version: import("effect/Schema").Int;
+        }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly userId: import("effect/Schema").String;
+            readonly state: import("effect/Schema").Literals<readonly ["member", "revoked"]>;
+            readonly version: import("effect/Schema").Int;
+            readonly updatedAt: import("effect/Schema").String;
+        }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ResourceDomainForbiddenError | typeof import("@sealant/api-contracts").ResourceDomainNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainPersonNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainMemberVersionConflictError | typeof import("@sealant/api-contracts").ResourceDomainInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
+        readonly listResourceDomainMembers: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"listResourceDomainMembers", "GET", "/v1/resource-domains/:resourceDomainId/members", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+            readonly resourceDomainId: import("effect/Schema").String;
+        }>>, import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+            readonly limit: import("effect/Schema").optional<import("effect/Schema").FiniteFromString>;
+            readonly cursor: import("effect/Schema").optional<import("effect/Schema").String>;
+        }>>, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly items: import("effect/Schema").$Array<import("effect/Schema").Struct<{
+                readonly userId: import("effect/Schema").String;
+                readonly state: import("effect/Schema").Literals<readonly ["member", "revoked"]>;
+                readonly version: import("effect/Schema").Int;
+                readonly updatedAt: import("effect/Schema").String;
+            }>>;
+            readonly nextCursor: import("effect/Schema").optional<import("effect/Schema").String>;
+        }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ResourceDomainForbiddenError | typeof import("@sealant/api-contracts").ResourceDomainNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
+        readonly revokeResourceDomainMember: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"revokeResourceDomainMember", "POST", "/v1/resource-domains/:resourceDomainId/members/:userId/revoke", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+            readonly resourceDomainId: import("effect/Schema").String;
+            readonly userId: import("effect/Schema").String;
+        }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly version: import("effect/Schema").Int;
+        }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly userId: import("effect/Schema").String;
+            readonly state: import("effect/Schema").Literals<readonly ["member", "revoked"]>;
+            readonly version: import("effect/Schema").Int;
+            readonly updatedAt: import("effect/Schema").String;
+        }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ResourceDomainForbiddenError | typeof import("@sealant/api-contracts").ResourceDomainNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainPersonNotFoundError | typeof import("@sealant/api-contracts").ResourceDomainMemberVersionConflictError | typeof import("@sealant/api-contracts").ResourceDomainInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
     };
     readonly runs: {
         readonly createRun: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"createRun", "POST", "/v1/runs/", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{

package/dist/effect/operations.d.ts

@@ -1434,3 +1434,48 @@ export declare const archiveSshKeyOp: (sshKeyId: string, ownerUserId: string) =>
     readonly fingerprint: string;
     readonly createdAt: string;
 }, import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("effect/Schema").SchemaError | import("@sealant/api-contracts").SshKeyInternalServerError | import("@sealant/api-contracts").SshKeyNotFoundError, SealantApiClient>;
+export declare const ensureResourceDomainOp: (key: string) => Effect.Effect<{
+    readonly resourceDomainId: string;
+    readonly key: string;
+    readonly createdAt: string;
+    readonly created: boolean;
+}, import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("@sealant/api-contracts").ResourceDomainForbiddenError | import("@sealant/api-contracts").ResourceDomainInternalServerError | import("effect/Schema").SchemaError, SealantApiClient>;
+export declare const getResourceDomainOp: (resourceDomainId: string) => Effect.Effect<{
+    readonly resourceDomainId: string;
+    readonly key: string;
+    readonly createdAt: string;
+}, import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("@sealant/api-contracts").ResourceDomainForbiddenError | import("@sealant/api-contracts").ResourceDomainInternalServerError | import("@sealant/api-contracts").ResourceDomainNotFoundError | import("effect/Schema").SchemaError, SealantApiClient>;
+export declare const grantResourceDomainMemberOp: (resourceDomainId: string, userId: string, payload: {
+    readonly version: number;
+}) => Effect.Effect<{
+    readonly userId: string;
+    readonly state: "member" | "revoked";
+    readonly version: number;
+    readonly updatedAt: string;
+}, import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("@sealant/api-contracts").ResourceDomainForbiddenError | import("@sealant/api-contracts").ResourceDomainInternalServerError | import("@sealant/api-contracts").ResourceDomainMemberVersionConflictError | import("@sealant/api-contracts").ResourceDomainNotFoundError | import("@sealant/api-contracts").ResourceDomainPersonNotFoundError | import("effect/Schema").SchemaError, SealantApiClient>;
+export declare const revokeResourceDomainMemberOp: (resourceDomainId: string, userId: string, payload: {
+    readonly version: number;
+}) => Effect.Effect<{
+    readonly userId: string;
+    readonly state: "member" | "revoked";
+    readonly version: number;
+    readonly updatedAt: string;
+}, import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("@sealant/api-contracts").ResourceDomainForbiddenError | import("@sealant/api-contracts").ResourceDomainInternalServerError | import("@sealant/api-contracts").ResourceDomainMemberVersionConflictError | import("@sealant/api-contracts").ResourceDomainNotFoundError | import("@sealant/api-contracts").ResourceDomainPersonNotFoundError | import("effect/Schema").SchemaError, SealantApiClient>;
+export declare const getResourceDomainMemberOp: (resourceDomainId: string, userId: string) => Effect.Effect<{
+    readonly userId: string;
+    readonly state: "member" | "revoked";
+    readonly version: number;
+    readonly updatedAt: string;
+}, import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("@sealant/api-contracts").ResourceDomainForbiddenError | import("@sealant/api-contracts").ResourceDomainInternalServerError | import("@sealant/api-contracts").ResourceDomainMemberNotFoundError | import("@sealant/api-contracts").ResourceDomainNotFoundError | import("@sealant/api-contracts").ResourceDomainPersonNotFoundError | import("effect/Schema").SchemaError, SealantApiClient>;
+export declare const listResourceDomainMembersOp: (resourceDomainId: string, query: {
+    readonly limit?: number | undefined;
+    readonly cursor?: string | undefined;
+}) => Effect.Effect<{
+    readonly items: readonly {
+        readonly userId: string;
+        readonly state: "member" | "revoked";
+        readonly version: number;
+        readonly updatedAt: string;
+    }[];
+    readonly nextCursor?: string | undefined;
+}, import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("@sealant/api-contracts").ResourceDomainForbiddenError | import("@sealant/api-contracts").ResourceDomainInternalServerError | import("@sealant/api-contracts").ResourceDomainNotFoundError | import("effect/Schema").SchemaError, SealantApiClient>;

package/dist/effect/operations.js

@@ -86,3 +86,16 @@ export const getSetupStateOp = () => Effect.flatMap(SealantApiClient, (client) =
 export const createSshKeyOp = (payload) => Effect.flatMap(SealantApiClient, (client) => client.sshKeys.createSshKey({ payload }));
 export const listSshKeysOp = (ownerUserId) => Effect.flatMap(SealantApiClient, (client) => client.sshKeys.listSshKeys({ query: { ownerUserId } }));
 export const archiveSshKeyOp = (sshKeyId, ownerUserId) => Effect.flatMap(SealantApiClient, (client) => client.sshKeys.archiveSshKey({ params: { sshKeyId }, query: { ownerUserId } }));
+// ---- resource domains (the SDK's scopes) ----
+export const ensureResourceDomainOp = (key) => Effect.flatMap(SealantApiClient, (client) => client.resourceDomains.ensureResourceDomain({ payload: { key } }));
+export const getResourceDomainOp = (resourceDomainId) => Effect.flatMap(SealantApiClient, (client) => client.resourceDomains.getResourceDomain({ params: { resourceDomainId } }));
+export const grantResourceDomainMemberOp = (resourceDomainId, userId, payload) => Effect.flatMap(SealantApiClient, (client) => client.resourceDomains.grantResourceDomainMember({
+    params: { resourceDomainId, userId },
+    payload,
+}));
+export const revokeResourceDomainMemberOp = (resourceDomainId, userId, payload) => Effect.flatMap(SealantApiClient, (client) => client.resourceDomains.revokeResourceDomainMember({
+    params: { resourceDomainId, userId },
+    payload,
+}));
+export const getResourceDomainMemberOp = (resourceDomainId, userId) => Effect.flatMap(SealantApiClient, (client) => client.resourceDomains.getResourceDomainMember({ params: { resourceDomainId, userId } }));
+export const listResourceDomainMembersOp = (resourceDomainId, query) => Effect.flatMap(SealantApiClient, (client) => client.resourceDomains.listResourceDomainMembers({ params: { resourceDomainId }, query }));

package/dist/index.d.ts

@@ -18,5 +18,6 @@ export { Sealant } from "./client.js";
 export { claudeCode, codex, customHarness, opencode, pi } from "./harness.js";
 export { ForwardDialError, type ForwardDialFailure, type ForwardDialReason, ForwardResetError, SealantApiError, SealantError, SealantNotImplementedError, SealantRuntimeError, } from "./errors.js";
 export type * from "./types.js";
+export type { EnsuredScope, ScopeClient, ScopeInfo, ScopeMember, ScopeMemberDecision, ScopeMemberPage, ScopeMembers, ScopesNamespace, } from "./scopes.js";
 export { findWorkspaceEnvReservedRule, findWorkspaceSecretEnvReservedRule, formatWorkspaceEnvIssue, parseWorkspaceEnv, parseWorkspaceSecretEnv, WORKSPACE_ENV_MAX_ENTRIES, WORKSPACE_ENV_MAX_NAME_LENGTH, WORKSPACE_ENV_MAX_TOTAL_BYTES, WORKSPACE_ENV_MAX_VALUE_BYTES, WORKSPACE_ENV_NAME_PATTERN, WORKSPACE_ENV_SECRET_MARKERS, } from "@sealant/api-contracts/workspace-environment";
 export type { WorkspaceEnvIssue, WorkspaceEnvParseResult, WorkspaceEnvReservedRule, } from "@sealant/api-contracts/workspace-environment";

package/dist/scopes.d.ts

@@ -0,0 +1,71 @@
+import type { SdkRuntime } from "./effect/runtime.js";
+export interface ScopeInfo {
+    /** `rdm:<uuid>`. No person field of the API accepts it. */
+    readonly id: string;
+    /** `<application>:<name>`, unique across every application. */
+    readonly key: string;
+    readonly createdAt: string;
+}
+export interface EnsuredScope extends ScopeInfo {
+    /** True when this call created the scope. */
+    readonly created: boolean;
+}
+/**
+ * The application's latest decision about one person in a scope. A revoked member keeps its row,
+ * so its version stays readable.
+ */
+export interface ScopeMember {
+    readonly userId: string;
+    readonly state: "member" | "revoked";
+    readonly version: number;
+    readonly updatedAt: string;
+}
+/**
+ * `version` is the application's own number for its decision about this person, rising with each
+ * decision it makes (its record's revision, say). The scope keeps the highest. The same version
+ * with the same state is a repeat and answers the member unchanged. The same version with the
+ * other state, or a lower one, rejects (409, `ResourceDomainMemberVersionConflictError`, whose
+ * `current` is the decision that stands) and changes nothing. So a delayed grant never undoes a
+ * newer revoke, and nothing needs reading first.
+ */
+export interface ScopeMemberDecision {
+    readonly version: number;
+}
+/** A page of a scope's members. `nextCursor` is present when more follow. */
+export interface ScopeMemberPage {
+    readonly items: readonly ScopeMember[];
+    readonly nextCursor?: string;
+}
+export interface ScopeMembers {
+    grant(userId: string, decision: ScopeMemberDecision): Promise<ScopeMember>;
+    revoke(userId: string, decision: ScopeMemberDecision): Promise<ScopeMember>;
+    /**
+     * One person's decision. Rejects with 404 `ResourceDomainMemberNotFoundError` when there is none,
+     * `ResourceDomainPersonNotFoundError` when the person does not exist.
+     */
+    get(userId: string): Promise<ScopeMember>;
+    /**
+     * A page of the people with a decision in the scope, revoked ones included, by user id: `limit`
+     * of them (100 unless named, at most 500), after the previous page's `nextCursor` as `cursor`.
+     */
+    list(options?: {
+        readonly limit?: number;
+        readonly cursor?: string;
+    }): Promise<ScopeMemberPage>;
+}
+/** A client acting as one scope. It has no method that could reach a credential or a harness. */
+export interface ScopeClient {
+    readonly id: string;
+    get(): Promise<ScopeInfo>;
+    readonly members: ScopeMembers;
+}
+export interface ScopesNamespace {
+    /** The scope with this key, created on the first call; later and concurrent calls answer it. */
+    ensure(options: {
+        readonly key: string;
+    }): Promise<EnsuredScope>;
+    get(scopeId: string): Promise<ScopeInfo>;
+    /** A client for this scope alone, and the only way to its members. Nothing is checked until its first call. */
+    actAs(scopeId: string): ScopeClient;
+}
+export declare const makeScopes: (runtime: SdkRuntime) => ScopesNamespace;

package/dist/scopes.js

@@ -0,0 +1,31 @@
+import { ensureResourceDomainOp, getResourceDomainMemberOp, getResourceDomainOp, grantResourceDomainMemberOp, listResourceDomainMembersOp, revokeResourceDomainMemberOp, } from "./effect/operations.js";
+const toScope = (wire) => ({
+    id: wire.resourceDomainId,
+    key: wire.key,
+    createdAt: wire.createdAt,
+});
+export const makeScopes = (runtime) => {
+    const get = async (scopeId) => toScope(await runtime.run(getResourceDomainOp(scopeId)));
+    return {
+        ensure: async ({ key }) => {
+            const wire = await runtime.run(ensureResourceDomainOp(key));
+            return { ...toScope(wire), created: wire.created };
+        },
+        get,
+        actAs: (scopeId) => ({
+            id: scopeId,
+            get: () => get(scopeId),
+            members: {
+                grant: (userId, decision) => runtime.run(grantResourceDomainMemberOp(scopeId, userId, { version: decision.version })),
+                revoke: (userId, decision) => runtime.run(revokeResourceDomainMemberOp(scopeId, userId, { version: decision.version })),
+                get: (userId) => runtime.run(getResourceDomainMemberOp(scopeId, userId)),
+                list: async (options) => {
+                    const page = await runtime.run(listResourceDomainMembersOp(scopeId, { ...options }));
+                    return page.nextCursor === undefined
+                        ? { items: page.items }
+                        : { items: page.items, nextCursor: page.nextCursor };
+                },
+            },
+        }),
+    };
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealant/sdk-next",
-  "version": "0.40.0-next.769",
+  "version": "0.40.0-next.770",
   "description": "The fluent public SDK for Sealant — create a workspace, run a harness, replay the record.",
   "license": "Apache-2.0",
   "repository": {
@@ -26,12 +26,12 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@sealant/api-contracts": "npm:@sealant/api-contracts-next@0.40.0-next.769"
+    "@sealant/api-contracts": "npm:@sealant/api-contracts-next@0.40.0-next.770"
   },
   "peerDependencies": {
     "effect": "^4.0.5"
   },
-  "gitHead": "ab6f8d9ccf2f282c542e388b994099cae91c1354",
+  "gitHead": "1e8b4f1153f5107504649c863c305cd31f424d58",
   "publishConfig": {
     "access": "public"
   }