@sealant/sdk 0.20.2 → 0.22.0

package/dist/client.d.ts

@@ -1,4 +1,4 @@
-import type { AccessTokensNamespace, CreateOptions, InferenceNamespace, ListOptions, Run, Workspace, SealantConfig } from "./types.js";
+import type { AccessTokensNamespace, ConnectedAccountsNamespace, CreateOptions, InferenceNamespace, ListOptions, Run, Workspace, SealantConfig, UsersNamespace } from "./types.js";
 export declare class Sealant {
     #private;
     constructor(config: SealantConfig);
@@ -21,6 +21,10 @@ export declare class Sealant {
      * the session endpoints enforce exactly those scopes (a read-stream token can stream but is
      * rejected for input and exec).
      */
+    /** Identity rows for products that own their own login (one client per user afterwards). */
+    readonly users: UsersNamespace;
+    /** This client's owner's Claude / Codex / GitHub accounts. Secrets go in; none come out. */
+    readonly connectedAccounts: ConnectedAccountsNamespace;
     readonly accessTokens: AccessTokensNamespace;
     /** Runs by id — so a record can be replayed long after its workspace is gone. */
     readonly runs: {

package/dist/client.js

@@ -1,16 +1,4 @@
-/**
- * `Sealant` — the public client and the import users reach for.
- *
- *   import { Sealant, opencode } from "@sealant/sdk"
- *   const sealant = new Sealant({ baseUrl: "http://localhost:8080" })
- *
- * This is the plain-Promise facade over the Effect core: an app `Layer` built once in the
- * constructor providing the wire client derived from `@sealant/api-contracts`. Everything is a plain
- * HTTP call to `baseUrl`. Operations whose endpoints have not landed yet stay TYPED against the
- * stable surface and reject with `SealantNotImplementedError` so callers can compile and wire
- * against the final shape today.
- */
-import { createAccessTokenOp, createWorkspaceOp, getRunOp, getWorkspaceOp, inferenceRespondOp, listWorkspacesOp, } from "./effect/operations.js";
+import { archiveConnectedAccountOp, createAccessTokenOp, createConnectedAccountOp, createWorkspaceOp, ensureUserOp, getRunOp, getUserOp, getWorkspaceOp, inferenceRespondOp, listConnectedAccountsOp, listWorkspacesOp, } from "./effect/operations.js";
 import { runHarness, startHarness } from "./effect/run-harness.js";
 import { makeSdkRuntime } from "./effect/runtime.js";
 import { SealantError } from "./errors.js";
@@ -20,6 +8,19 @@ import { buildCreateWorkspaceRequest } from "./internal/blueprint.js";
 import { resolveInternalConfig } from "./internal/config.js";
 import { parseTtlSeconds } from "./internal/duration.js";
 import { buildInferenceRespondRequest, mapInferenceResponse } from "./internal/inference.js";
+const mapConnectedAccount = (wire) => ({
+    connectedAccountId: wire.connectedAccountId,
+    ownerUserId: wire.ownerUserId,
+    provider: wire.provider,
+    name: wire.name,
+    kind: wire.kind,
+    status: wire.status,
+    metadata: wire.metadata,
+    connectedAt: wire.connectedAt,
+    updatedAt: wire.updatedAt,
+    lastUsedAt: wire.lastUsedAt,
+    lastSyncedAt: wire.lastSyncedAt,
+});
 // Wire the run-execution implementations into the Workspace facade (the injection point exists to
 // break the workspace <-> run-harness import cycle; the client is the composition root).
 registerHarnessExecutors({ run: runHarness, start: startHarness });
@@ -72,7 +73,7 @@ export class Sealant {
             return workspace.ready();
         },
         get: async (id) => {
-            const details = await this.#runtime.run(getWorkspaceOp(id));
+            const details = await this.#runtime.run(getWorkspaceOp(id, this.#ctx.config.hostLocal.ownerUserId));
             return makeWorkspace(this.#ctx, {
                 id: details.workspaceId,
                 name: details.name,
@@ -109,6 +110,47 @@ export class Sealant {
      * the session endpoints enforce exactly those scopes (a read-stream token can stream but is
      * rejected for input and exec).
      */
+    /** Identity rows for products that own their own login (one client per user afterwards). */
+    users = {
+        ensure: async (options) => {
+            const wire = await this.#runtime.run(ensureUserOp({
+                email: options.email,
+                name: options.name,
+                ...(options.userId === undefined ? {} : { userId: options.userId }),
+            }));
+            return {
+                userId: wire.userId,
+                email: wire.email,
+                name: wire.name,
+                createdAt: wire.createdAt,
+                created: wire.created,
+            };
+        },
+        get: async (userId) => {
+            const wire = await this.#runtime.run(getUserOp(userId));
+            return { userId: wire.userId, email: wire.email, name: wire.name, createdAt: wire.createdAt };
+        },
+    };
+    /** This client's owner's Claude / Codex / GitHub accounts. Secrets go in; none come out. */
+    connectedAccounts = {
+        list: async () => {
+            const wire = await this.#runtime.run(listConnectedAccountsOp(this.#ctx.config.hostLocal.ownerUserId));
+            return wire.items.map(mapConnectedAccount);
+        },
+        connect: async (options) => {
+            const wire = await this.#runtime.run(createConnectedAccountOp({
+                ownerUserId: this.#ctx.config.hostLocal.ownerUserId,
+                provider: options.provider,
+                secret: options.secret,
+                ...(options.name === undefined ? {} : { name: options.name }),
+            }));
+            return mapConnectedAccount(wire);
+        },
+        disconnect: async (connectedAccountId) => {
+            const wire = await this.#runtime.run(archiveConnectedAccountOp(connectedAccountId, this.#ctx.config.hostLocal.ownerUserId));
+            return mapConnectedAccount(wire);
+        },
+    };
     accessTokens = {
         create: async (options) => {
             const wire = await this.#runtime.run(createAccessTokenOp({
@@ -130,7 +172,7 @@ export class Sealant {
     /** Runs by id — so a record can be replayed long after its workspace is gone. */
     runs = {
         get: async (runId) => {
-            const wire = await this.#runtime.run(getRunOp(runId));
+            const wire = await this.#runtime.run(getRunOp(runId, this.#ctx.config.hostLocal.ownerUserId));
             return makeRun(this.#ctx, { wire });
         },
     };

package/dist/effect/api-client.d.ts

@@ -537,6 +537,9 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly params: {
                 readonly runId: string;
             };
+            readonly query: {
+                readonly ownerUserId?: string | undefined;
+            };
             readonly responseMode?: Mode;
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly runId: string;
@@ -566,6 +569,9 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly params: {
                 readonly runId: string;
             };
+            readonly query: {
+                readonly ownerUserId?: string | undefined;
+            };
             readonly responseMode?: Mode;
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly files: readonly {
@@ -580,6 +586,9 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly runId: string;
                 readonly sequence: string;
             };
+            readonly query: {
+                readonly ownerUserId?: string | undefined;
+            };
             readonly responseMode?: Mode;
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly eventId: string;
@@ -603,6 +612,9 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly params: {
                 readonly runId: string;
             };
+            readonly query: {
+                readonly ownerUserId?: string | undefined;
+            };
             readonly responseMode?: Mode;
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly runId: string;
@@ -624,6 +636,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly runId: string;
             };
             readonly query: {
+                readonly ownerUserId?: string | undefined;
                 readonly processId: string;
                 readonly stream: "pty" | "stderr" | "stdout";
                 readonly atSequence?: string | undefined;
@@ -642,6 +655,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly runId: string;
             };
             readonly query: {
+                readonly ownerUserId?: string | undefined;
                 readonly fromSequence?: string | undefined;
                 readonly toSequence?: string | undefined;
                 readonly limit?: string | undefined;
@@ -758,6 +772,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly cwd?: string | undefined;
             readonly cols: number;
             readonly rows: number;
+            readonly mode?: "pipe" | "pty" | undefined;
             readonly exitCode?: number | undefined;
             readonly exitSignal?: number | undefined;
             readonly errorMessage?: string | undefined;
@@ -783,6 +798,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly cols?: number | undefined;
                 readonly rows?: number | undefined;
                 readonly term?: string | undefined;
+                readonly mode?: "pipe" | "pty" | undefined;
                 readonly metadata?: {
                     readonly [x: string]: unknown;
                 } | undefined;
@@ -798,6 +814,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly cwd?: string | undefined;
             readonly cols: number;
             readonly rows: number;
+            readonly mode?: "pipe" | "pty" | undefined;
             readonly exitCode?: number | undefined;
             readonly exitSignal?: number | undefined;
             readonly errorMessage?: string | undefined;
@@ -829,6 +846,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly cwd?: string | undefined;
             readonly cols: number;
             readonly rows: number;
+            readonly mode?: "pipe" | "pty" | undefined;
             readonly exitCode?: number | undefined;
             readonly exitSignal?: number | undefined;
             readonly errorMessage?: string | undefined;
@@ -883,6 +901,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly cwd?: string | undefined;
                 readonly cols: number;
                 readonly rows: number;
+                readonly mode?: "pipe" | "pty" | undefined;
                 readonly exitCode?: number | undefined;
                 readonly exitSignal?: number | undefined;
                 readonly errorMessage?: string | undefined;
@@ -1033,6 +1052,33 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly status: "ok";
         }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
     };
+    readonly users: {
+        readonly ensureUser: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
+            readonly payload: {
+                readonly email: string;
+                readonly name: string;
+                readonly userId?: string | undefined;
+            };
+            readonly responseMode?: Mode;
+        }) => Effect.Effect<HttpApiClient.Client.Response<{
+            readonly userId: string;
+            readonly email: string;
+            readonly name: string;
+            readonly createdAt: string;
+            readonly created: boolean;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").UserBadRequestError | import("@sealant/api-contracts").UserInternalServerError), [Mode] extends ["response-only"] ? never : never>;
+        readonly getUser: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
+            readonly params: {
+                readonly userId: string;
+            };
+            readonly responseMode?: Mode;
+        }) => Effect.Effect<HttpApiClient.Client.Response<{
+            readonly userId: string;
+            readonly email: string;
+            readonly name: string;
+            readonly createdAt: string;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").UserInternalServerError | import("@sealant/api-contracts").UserNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+    };
     readonly workspaces: {
         readonly createWorkspace: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly headers: {
@@ -1131,6 +1177,9 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly params: {
                 readonly workspaceId: string;
             };
+            readonly query: {
+                readonly ownerUserId?: string | undefined;
+            };
             readonly responseMode?: Mode;
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly workspaceId: string;
@@ -1858,6 +1907,9 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly params: {
                 readonly runId: string;
             };
+            readonly query: {
+                readonly ownerUserId?: string | undefined;
+            };
             readonly responseMode?: Mode;
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly runId: string;
@@ -1887,6 +1939,9 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly params: {
                 readonly runId: string;
             };
+            readonly query: {
+                readonly ownerUserId?: string | undefined;
+            };
             readonly responseMode?: Mode;
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly files: readonly {
@@ -1901,6 +1956,9 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly runId: string;
                 readonly sequence: string;
             };
+            readonly query: {
+                readonly ownerUserId?: string | undefined;
+            };
             readonly responseMode?: Mode;
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly eventId: string;
@@ -1924,6 +1982,9 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly params: {
                 readonly runId: string;
             };
+            readonly query: {
+                readonly ownerUserId?: string | undefined;
+            };
             readonly responseMode?: Mode;
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly runId: string;
@@ -1945,6 +2006,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly runId: string;
             };
             readonly query: {
+                readonly ownerUserId?: string | undefined;
                 readonly processId: string;
                 readonly stream: "pty" | "stderr" | "stdout";
                 readonly atSequence?: string | undefined;
@@ -1963,6 +2025,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly runId: string;
             };
             readonly query: {
+                readonly ownerUserId?: string | undefined;
                 readonly fromSequence?: string | undefined;
                 readonly toSequence?: string | undefined;
                 readonly limit?: string | undefined;
@@ -2079,6 +2142,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly cwd?: string | undefined;
             readonly cols: number;
             readonly rows: number;
+            readonly mode?: "pipe" | "pty" | undefined;
             readonly exitCode?: number | undefined;
             readonly exitSignal?: number | undefined;
             readonly errorMessage?: string | undefined;
@@ -2104,6 +2168,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly cols?: number | undefined;
                 readonly rows?: number | undefined;
                 readonly term?: string | undefined;
+                readonly mode?: "pipe" | "pty" | undefined;
                 readonly metadata?: {
                     readonly [x: string]: unknown;
                 } | undefined;
@@ -2119,6 +2184,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly cwd?: string | undefined;
             readonly cols: number;
             readonly rows: number;
+            readonly mode?: "pipe" | "pty" | undefined;
             readonly exitCode?: number | undefined;
             readonly exitSignal?: number | undefined;
             readonly errorMessage?: string | undefined;
@@ -2150,6 +2216,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly cwd?: string | undefined;
             readonly cols: number;
             readonly rows: number;
+            readonly mode?: "pipe" | "pty" | undefined;
             readonly exitCode?: number | undefined;
             readonly exitSignal?: number | undefined;
             readonly errorMessage?: string | undefined;
@@ -2204,6 +2271,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly cwd?: string | undefined;
                 readonly cols: number;
                 readonly rows: number;
+                readonly mode?: "pipe" | "pty" | undefined;
                 readonly exitCode?: number | undefined;
                 readonly exitSignal?: number | undefined;
                 readonly errorMessage?: string | undefined;
@@ -2354,6 +2422,33 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly status: "ok";
         }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
     };
+    readonly users: {
+        readonly ensureUser: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
+            readonly payload: {
+                readonly email: string;
+                readonly name: string;
+                readonly userId?: string | undefined;
+            };
+            readonly responseMode?: Mode;
+        }) => Effect.Effect<HttpApiClient.Client.Response<{
+            readonly userId: string;
+            readonly email: string;
+            readonly name: string;
+            readonly createdAt: string;
+            readonly created: boolean;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").UserBadRequestError | import("@sealant/api-contracts").UserInternalServerError), [Mode] extends ["response-only"] ? never : never>;
+        readonly getUser: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
+            readonly params: {
+                readonly userId: string;
+            };
+            readonly responseMode?: Mode;
+        }) => Effect.Effect<HttpApiClient.Client.Response<{
+            readonly userId: string;
+            readonly email: string;
+            readonly name: string;
+            readonly createdAt: string;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").UserInternalServerError | import("@sealant/api-contracts").UserNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+    };
     readonly workspaces: {
         readonly createWorkspace: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly headers: {
@@ -2452,6 +2547,9 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly params: {
                 readonly workspaceId: string;
             };
+            readonly query: {
+                readonly ownerUserId?: string | undefined;
+            };
             readonly responseMode?: Mode;
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly workspaceId: string;

package/dist/effect/exec-workspace.js

@@ -37,7 +37,7 @@ const execWorkspaceEffect = (ctx, init, argv, options) => Effect.gen(function* (
             }));
         }
         yield* Effect.sleep(POLL_INTERVAL);
-        wire = yield* getRunOp(runId);
+        wire = yield* getRunOp(runId, ctx.config.hostLocal.ownerUserId);
     }
     // Exec framing: "completed" means every command executed and was recorded — anything else means
     // the machinery broke and the exit code cannot be trusted, which IS the error case.
@@ -48,7 +48,7 @@ const execWorkspaceEffect = (ctx, init, argv, options) => Effect.gen(function* (
     const processId = findCommandProcessId(started, executable);
     const stdout = processId === undefined ? "" : yield* readScrollback(runId, processId, "stdout");
     const stderr = processId === undefined ? "" : yield* readScrollback(runId, processId, "stderr");
-    const changes = toRunChangesData(yield* getRunChangesOp(runId));
+    const changes = toRunChangesData(yield* getRunChangesOp(runId, ctx.config.hostLocal.ownerUserId));
     return {
         exitCode: wire.exitCode ?? -1,
         stdout,

package/dist/effect/index.d.ts

@@ -24,4 +24,4 @@ export { makeSdkRuntime } from "./runtime.js";
 export type { SdkRuntime, SdkServices } from "./runtime.js";
 export { resolveInternalConfig } from "../internal/config.js";
 export type { SealantHostLocalConfig, SealantInternalConfig } from "../internal/config.js";
-export { InferenceBadRequestError, InferenceConflictError, InferenceInternalServerError, InferenceNotFoundError, InferenceUnavailableError, RunBadRequestError, RunInternalServerError, RunNotFoundError, WorkspaceBadGatewayError, WorkspaceBadRequestError, WorkspaceConflictError, WorkspaceForbiddenError, WorkspaceInternalServerError, WorkspaceNotFoundError, WorkspaceServiceUnavailableError, WorkspaceUnauthorizedError, } from "@sealant/api-contracts";
+export { ConnectedAccountBadRequestError, ConnectedAccountConflictError, ConnectedAccountInternalServerError, ConnectedAccountNotFoundError, ConnectedAccountServiceUnavailableError, InferenceBadRequestError, InferenceConflictError, InferenceInternalServerError, InferenceNotFoundError, InferenceUnavailableError, RunBadRequestError, RunInternalServerError, RunNotFoundError, UserBadRequestError, UserInternalServerError, UserNotFoundError, WorkspaceBadGatewayError, WorkspaceBadRequestError, WorkspaceConflictError, WorkspaceForbiddenError, WorkspaceInternalServerError, WorkspaceNotFoundError, WorkspaceServiceUnavailableError, WorkspaceUnauthorizedError, } from "@sealant/api-contracts";

package/dist/effect/index.js

@@ -28,4 +28,4 @@ export { resolveInternalConfig } from "../internal/config.js";
 // The typed contract errors carried on the client's failure channel (workspaces + runs +
 // inference — the groups the operations above call). Re-exported so Effect consumers don't need to
 // depend on the contracts package directly to `Effect.catchTag` a failure.
-export { InferenceBadRequestError, InferenceConflictError, InferenceInternalServerError, InferenceNotFoundError, InferenceUnavailableError, RunBadRequestError, RunInternalServerError, RunNotFoundError, WorkspaceBadGatewayError, WorkspaceBadRequestError, WorkspaceConflictError, WorkspaceForbiddenError, WorkspaceInternalServerError, WorkspaceNotFoundError, WorkspaceServiceUnavailableError, WorkspaceUnauthorizedError, } from "@sealant/api-contracts";
+export { ConnectedAccountBadRequestError, ConnectedAccountConflictError, ConnectedAccountInternalServerError, ConnectedAccountNotFoundError, ConnectedAccountServiceUnavailableError, InferenceBadRequestError, InferenceConflictError, InferenceInternalServerError, InferenceNotFoundError, InferenceUnavailableError, RunBadRequestError, RunInternalServerError, RunNotFoundError, UserBadRequestError, UserInternalServerError, UserNotFoundError, WorkspaceBadGatewayError, WorkspaceBadRequestError, WorkspaceConflictError, WorkspaceForbiddenError, WorkspaceInternalServerError, WorkspaceNotFoundError, WorkspaceServiceUnavailableError, WorkspaceUnauthorizedError, } from "@sealant/api-contracts";

package/dist/effect/operations.d.ts

@@ -37,7 +37,7 @@ export declare const createWorkspaceOp: (payload: {
     readonly repository: string;
     readonly tag: string;
 }, import("effect/unstable/http/HttpClientError").HttpClientError | import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError, SealantApiClient>;
-export declare const getWorkspaceOp: (workspaceId: string) => Effect.Effect<{
+export declare const getWorkspaceOp: (workspaceId: string, ownerUserId?: string | undefined) => Effect.Effect<{
     readonly workspaceId: string;
     readonly name: string;
     readonly ownerUserId: string;
@@ -194,7 +194,7 @@ export declare const createRunOp: (payload: {
     readonly createdAt: string;
     readonly updatedAt: string;
 }, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RunBadRequestError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError, SealantApiClient>;
-export declare const getRunOp: (runId: string) => Effect.Effect<{
+export declare const getRunOp: (runId: string, ownerUserId?: string | undefined) => Effect.Effect<{
     readonly runId: string;
     readonly workspaceId: string;
     readonly attemptId?: string | undefined;
@@ -284,6 +284,7 @@ export declare const updateRunOp: (runId: string, payload: {
     readonly updatedAt: string;
 }, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RunBadRequestError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError, SealantApiClient>;
 export declare const getRunTimelineOp: (runId: string, query: {
+    readonly ownerUserId?: string | undefined;
     readonly fromSequence?: string | undefined;
     readonly toSequence?: string | undefined;
     readonly limit?: string | undefined;
@@ -300,6 +301,7 @@ export declare const getRunTimelineOp: (runId: string, query: {
     readonly confidence: number;
 }[], import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RunBadRequestError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError, SealantApiClient>;
 export declare const getRunScrollbackOp: (runId: string, query: {
+    readonly ownerUserId?: string | undefined;
     readonly processId: string;
     readonly stream: "pty" | "stderr" | "stdout";
     readonly atSequence?: string | undefined;
@@ -311,7 +313,7 @@ export declare const getRunScrollbackOp: (runId: string, query: {
     readonly byteCount: number;
     readonly contentBase64: string;
 }, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RunBadRequestError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError, SealantApiClient>;
-export declare const getRunLossOp: (runId: string) => Effect.Effect<{
+export declare const getRunLossOp: (runId: string, ownerUserId?: string | undefined) => Effect.Effect<{
     readonly runId: string;
     readonly droppedEventCount: string;
     readonly sequenceGapCount: number;
@@ -326,7 +328,7 @@ export declare const getRunLossOp: (runId: string) => Effect.Effect<{
         readonly reason?: string | undefined;
     }[];
 }, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError, SealantApiClient>;
-export declare const getRunChangesOp: (runId: string) => Effect.Effect<{
+export declare const getRunChangesOp: (runId: string, ownerUserId?: string | undefined) => Effect.Effect<{
     readonly files: readonly {
         readonly path: string;
         readonly change: "added" | "deleted" | "modified" | "renamed";
@@ -345,6 +347,7 @@ export declare const createSessionOp: (payload: {
     readonly cols?: number | undefined;
     readonly rows?: number | undefined;
     readonly term?: string | undefined;
+    readonly mode?: "pipe" | "pty" | undefined;
     readonly metadata?: {
         readonly [x: string]: unknown;
     } | undefined;
@@ -358,6 +361,7 @@ export declare const createSessionOp: (payload: {
     readonly cwd?: string | undefined;
     readonly cols: number;
     readonly rows: number;
+    readonly mode?: "pipe" | "pty" | undefined;
     readonly exitCode?: number | undefined;
     readonly exitSignal?: number | undefined;
     readonly errorMessage?: string | undefined;
@@ -378,6 +382,7 @@ export declare const getSessionOp: (sessionId: string, ownerUserId?: string | un
     readonly cwd?: string | undefined;
     readonly cols: number;
     readonly rows: number;
+    readonly mode?: "pipe" | "pty" | undefined;
     readonly exitCode?: number | undefined;
     readonly exitSignal?: number | undefined;
     readonly errorMessage?: string | undefined;
@@ -404,6 +409,7 @@ export declare const listSessionsOp: (query: {
         readonly cwd?: string | undefined;
         readonly cols: number;
         readonly rows: number;
+        readonly mode?: "pipe" | "pty" | undefined;
         readonly exitCode?: number | undefined;
         readonly exitSignal?: number | undefined;
         readonly errorMessage?: string | undefined;
@@ -459,6 +465,7 @@ export declare const closeSessionOp: (sessionId: string, payload: {
     readonly cwd?: string | undefined;
     readonly cols: number;
     readonly rows: number;
+    readonly mode?: "pipe" | "pty" | undefined;
     readonly exitCode?: number | undefined;
     readonly exitSignal?: number | undefined;
     readonly errorMessage?: string | undefined;
@@ -486,6 +493,75 @@ export declare const createAccessTokenOp: (payload: {
     readonly createdAt: string;
     readonly token: string;
 }, import("@sealant/api-contracts").AccessTokenBadRequestError | import("@sealant/api-contracts").AccessTokenInternalServerError | import("@sealant/api-contracts").AccessTokenNotFoundError | import("effect/unstable/http/HttpClientError").HttpClientError | import("effect/Schema").SchemaError, SealantApiClient>;
+export declare const ensureUserOp: (payload: {
+    readonly email: string;
+    readonly name: string;
+    readonly userId?: string | undefined;
+}) => Effect.Effect<{
+    readonly userId: string;
+    readonly email: string;
+    readonly name: string;
+    readonly createdAt: string;
+    readonly created: boolean;
+}, import("effect/unstable/http/HttpClientError").HttpClientError | import("effect/Schema").SchemaError | import("@sealant/api-contracts").UserBadRequestError | import("@sealant/api-contracts").UserInternalServerError, SealantApiClient>;
+export declare const getUserOp: (userId: string) => Effect.Effect<{
+    readonly userId: string;
+    readonly email: string;
+    readonly name: string;
+    readonly createdAt: string;
+}, import("effect/unstable/http/HttpClientError").HttpClientError | import("effect/Schema").SchemaError | import("@sealant/api-contracts").UserInternalServerError | import("@sealant/api-contracts").UserNotFoundError, SealantApiClient>;
+export declare const listConnectedAccountsOp: (ownerUserId: string) => Effect.Effect<{
+    readonly items: readonly {
+        readonly connectedAccountId: string;
+        readonly ownerUserId: string;
+        readonly provider: "claude" | "codex" | "github";
+        readonly name: string;
+        readonly kind: string;
+        readonly status: "active" | "archived" | "invalid";
+        readonly metadata: {
+            readonly [x: string]: unknown;
+        };
+        readonly connectedAt: string;
+        readonly updatedAt: string;
+        readonly lastUsedAt: string | null;
+        readonly lastSyncedAt: string | null;
+    }[];
+}, import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("effect/unstable/http/HttpClientError").HttpClientError | import("effect/Schema").SchemaError, SealantApiClient>;
+export declare const createConnectedAccountOp: (payload: {
+    readonly ownerUserId: string;
+    readonly provider: "claude" | "codex" | "github";
+    readonly name?: string | undefined;
+    readonly secret: string;
+}) => Effect.Effect<{
+    readonly connectedAccountId: string;
+    readonly ownerUserId: string;
+    readonly provider: "claude" | "codex" | "github";
+    readonly name: string;
+    readonly kind: string;
+    readonly status: "active" | "archived" | "invalid";
+    readonly metadata: {
+        readonly [x: string]: unknown;
+    };
+    readonly connectedAt: string;
+    readonly updatedAt: string;
+    readonly lastUsedAt: string | null;
+    readonly lastSyncedAt: string | null;
+}, import("@sealant/api-contracts").ConnectedAccountBadRequestError | import("@sealant/api-contracts").ConnectedAccountConflictError | import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("@sealant/api-contracts").ConnectedAccountNotFoundError | import("@sealant/api-contracts").ConnectedAccountServiceUnavailableError | import("effect/unstable/http/HttpClientError").HttpClientError | import("effect/Schema").SchemaError, SealantApiClient>;
+export declare const archiveConnectedAccountOp: (connectedAccountId: string, ownerUserId: string) => Effect.Effect<{
+    readonly connectedAccountId: string;
+    readonly ownerUserId: string;
+    readonly provider: "claude" | "codex" | "github";
+    readonly name: string;
+    readonly kind: string;
+    readonly status: "active" | "archived" | "invalid";
+    readonly metadata: {
+        readonly [x: string]: unknown;
+    };
+    readonly connectedAt: string;
+    readonly updatedAt: string;
+    readonly lastUsedAt: string | null;
+    readonly lastSyncedAt: string | null;
+}, import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("@sealant/api-contracts").ConnectedAccountNotFoundError | import("effect/unstable/http/HttpClientError").HttpClientError | import("effect/Schema").SchemaError, SealantApiClient>;
 export declare const inferenceRespondOp: (payload: {
     readonly ownerUserId: string;
     readonly credentials?: {

package/dist/effect/operations.js

@@ -5,7 +5,10 @@ export const createWorkspaceOp = (payload, idempotencyKey) => Effect.flatMap(Sea
     payload,
     headers: idempotencyKey === undefined ? {} : { "idempotency-key": idempotencyKey },
 }));
-export const getWorkspaceOp = (workspaceId) => Effect.flatMap(SealantApiClient, (client) => client.workspaces.getWorkspace({ params: { workspaceId } }));
+export const getWorkspaceOp = (workspaceId, ownerUserId) => Effect.flatMap(SealantApiClient, (client) => client.workspaces.getWorkspace({
+    params: { workspaceId },
+    query: ownerUserId === undefined ? {} : { ownerUserId },
+}));
 export const listWorkspacesOp = (query) => Effect.flatMap(SealantApiClient, (client) => client.workspaces.listWorkspaces({ query }));
 export const execWorkspaceOp = (workspaceId, payload) => Effect.flatMap(SealantApiClient, (client) => client.workspaces.execWorkspace({ params: { workspaceId }, payload }));
 export const stopWorkspaceOp = (workspaceId, payload) => Effect.flatMap(SealantApiClient, (client) => client.workspaces.stopWorkspace({ params: { workspaceId }, payload }));
@@ -13,13 +16,14 @@ export const restartWorkspaceOp = (workspaceId, payload) => Effect.flatMap(Seala
 export const expireWorkspaceOp = (workspaceId, payload) => Effect.flatMap(SealantApiClient, (client) => client.workspaces.expireWorkspace({ params: { workspaceId }, payload }));
 // ---- runs ----
 export const createRunOp = (payload) => Effect.flatMap(SealantApiClient, (client) => client.runs.createRun({ payload }));
-export const getRunOp = (runId) => Effect.flatMap(SealantApiClient, (client) => client.runs.getRun({ params: { runId } }));
+const ownerQuery = (ownerUserId) => ownerUserId === undefined ? {} : { ownerUserId };
+export const getRunOp = (runId, ownerUserId) => Effect.flatMap(SealantApiClient, (client) => client.runs.getRun({ params: { runId }, query: ownerQuery(ownerUserId) }));
 export const listRunsOp = (query) => Effect.flatMap(SealantApiClient, (client) => client.runs.listRuns({ query }));
 export const updateRunOp = (runId, payload) => Effect.flatMap(SealantApiClient, (client) => client.runs.updateRun({ params: { runId }, payload }));
 export const getRunTimelineOp = (runId, query) => Effect.flatMap(SealantApiClient, (client) => Effect.map(client.runs.getRunTimeline({ params: { runId }, query }), (r) => r.items));
 export const getRunScrollbackOp = (runId, query) => Effect.flatMap(SealantApiClient, (client) => client.runs.getRunScrollback({ params: { runId }, query }));
-export const getRunLossOp = (runId) => Effect.flatMap(SealantApiClient, (client) => client.runs.getRunLoss({ params: { runId } }));
-export const getRunChangesOp = (runId) => Effect.flatMap(SealantApiClient, (client) => client.runs.getRunChanges({ params: { runId } }));
+export const getRunLossOp = (runId, ownerUserId) => Effect.flatMap(SealantApiClient, (client) => client.runs.getRunLoss({ params: { runId }, query: ownerQuery(ownerUserId) }));
+export const getRunChangesOp = (runId, ownerUserId) => Effect.flatMap(SealantApiClient, (client) => client.runs.getRunChanges({ params: { runId }, query: ownerQuery(ownerUserId) }));
 // ---- sessions ----
 export const createSessionOp = (payload) => Effect.flatMap(SealantApiClient, (client) => client.sessions.createSession({ payload, headers: {} }));
 export const getSessionOp = (sessionId, ownerUserId) => Effect.flatMap(SealantApiClient, (client) => client.sessions.getSession({
@@ -35,5 +39,15 @@ export const signalSessionOp = (sessionId, payload) => Effect.flatMap(SealantApi
 export const closeSessionOp = (sessionId, payload) => Effect.flatMap(SealantApiClient, (client) => client.sessions.closeSession({ params: { sessionId }, headers: {}, payload }));
 // ---- access tokens ----
 export const createAccessTokenOp = (payload) => Effect.flatMap(SealantApiClient, (client) => client.accessTokens.createAccessToken({ payload }));
+// ---- users ----
+export const ensureUserOp = (payload) => Effect.flatMap(SealantApiClient, (client) => client.users.ensureUser({ payload }));
+export const getUserOp = (userId) => Effect.flatMap(SealantApiClient, (client) => client.users.getUser({ params: { userId } }));
+// ---- connected accounts ----
+export const listConnectedAccountsOp = (ownerUserId) => Effect.flatMap(SealantApiClient, (client) => client.connectedAccounts.listConnectedAccounts({ query: { ownerUserId } }));
+export const createConnectedAccountOp = (payload) => Effect.flatMap(SealantApiClient, (client) => client.connectedAccounts.createConnectedAccount({ payload }));
+export const archiveConnectedAccountOp = (connectedAccountId, ownerUserId) => Effect.flatMap(SealantApiClient, (client) => client.connectedAccounts.archiveConnectedAccount({
+    params: { connectedAccountId },
+    query: { ownerUserId },
+}));
 // ---- inference ----
 export const inferenceRespondOp = (payload) => Effect.flatMap(SealantApiClient, (client) => client.inference.respond({ payload }));

package/dist/effect/run-harness.js

@@ -38,7 +38,7 @@ const createHarnessRunEffect = (ctx, init, prompt, options) => Effect.gen(functi
             ...metadata,
         });
     }
-    const details = yield* getWorkspaceOp(init.id);
+    const details = yield* getWorkspaceOp(init.id, ctx.config.hostLocal.ownerUserId);
     const spec = details.spec;
     const harnessId = spec?.harness?.id;
     if (harnessId === undefined) {
@@ -66,10 +66,10 @@ const runHarnessEffect = (ctx, init, prompt, options) => Effect.gen(function* ()
             }));
         }
         yield* Effect.sleep(POLL_INTERVAL);
-        wire = yield* getRunOp(runId);
+        wire = yield* getRunOp(runId, ctx.config.hostLocal.ownerUserId);
     }
     // Read the changes the run produced (captured server-side).
-    const changes = toRunChangesData(yield* getRunChangesOp(runId));
+    const changes = toRunChangesData(yield* getRunChangesOp(runId, ctx.config.hostLocal.ownerUserId));
     return makeRun(ctx, { wire, changes });
 });
 /** The BLOCKING `harness.run()` implementation, registered into the Workspace facade by the client. */

package/dist/facade/record.js

@@ -135,7 +135,10 @@ export const renderTranscript = (commands) => {
     return `${blocks.join("\n\n")}\n`;
 };
 export const makeRunRecord = (ctx, runId) => {
-    const fetchTimeline = (from) => ctx.runtime.run(getRunTimelineOp(runId, from === undefined ? {} : { fromSequence: from.toString() }));
+    const fetchTimeline = (from) => ctx.runtime.run(getRunTimelineOp(runId, {
+        ownerUserId: ctx.config.hostLocal.ownerUserId,
+        ...(from === undefined ? {} : { fromSequence: from.toString() }),
+    }));
     return {
         runId,
         replay: async (options) => {
@@ -171,7 +174,10 @@ export const makeRunRecord = (ctx, runId) => {
                 let from = options?.from;
                 const deadline = Date.now() + STREAM_TIMEOUT_MS;
                 for (;;) {
-                    const wire = await ctxRun.run(getRunTimelineOp(runId, from === undefined ? {} : { fromSequence: from.toString() }));
+                    const wire = await ctxRun.run(getRunTimelineOp(runId, {
+                        ownerUserId: ctx.config.hostLocal.ownerUserId,
+                        ...(from === undefined ? {} : { fromSequence: from.toString() }),
+                    }));
                     for (const entry of wire) {
                         const mapped = toTimelineEntry(entry);
                         yield mapped;
@@ -179,9 +185,12 @@ export const makeRunRecord = (ctx, runId) => {
                     }
                     // Stop once the run is terminal — with one final drain to catch entries written between the
                     // last timeline fetch and the status check.
-                    const run = await ctxRun.run(getRunOp(runId));
+                    const run = await ctxRun.run(getRunOp(runId, ctx.config.hostLocal.ownerUserId));
                     if (TERMINAL_RUN_STATUSES.has(run.status)) {
-                        const tail = await ctxRun.run(getRunTimelineOp(runId, from === undefined ? {} : { fromSequence: from.toString() }));
+                        const tail = await ctxRun.run(getRunTimelineOp(runId, {
+                            ownerUserId: ctx.config.hostLocal.ownerUserId,
+                            ...(from === undefined ? {} : { fromSequence: from.toString() }),
+                        }));
                         for (const entry of tail) {
                             yield toTimelineEntry(entry);
                         }
@@ -208,7 +217,11 @@ export const makeRunRecord = (ctx, runId) => {
         scrollback: (processId, stream) => {
             const run = ctx.runtime;
             async function* iterate() {
-                const response = await run.run(getRunScrollbackOp(runId, { processId, stream }));
+                const response = await run.run(getRunScrollbackOp(runId, {
+                    ownerUserId: ctx.config.hostLocal.ownerUserId,
+                    processId,
+                    stream,
+                }));
                 const bytes = Buffer.from(response.contentBase64, "base64");
                 if (bytes.byteLength > 0) {
                     yield new Uint8Array(bytes.buffer, bytes.byteOffset, bytes.byteLength);
@@ -216,9 +229,9 @@ export const makeRunRecord = (ctx, runId) => {
             }
             return iterate();
         },
-        loss: async () => toLossReport(await ctx.runtime.run(getRunLossOp(runId))),
+        loss: async () => toLossReport(await ctx.runtime.run(getRunLossOp(runId, ctx.config.hostLocal.ownerUserId))),
         summary: async () => {
-            const run = await ctx.runtime.run(getRunOp(runId));
+            const run = await ctx.runtime.run(getRunOp(runId, ctx.config.hostLocal.ownerUserId));
             const timeline = await fetchTimeline();
             const durationMs = run.startedAt !== undefined && run.finishedAt !== undefined
                 ? new Date(run.finishedAt).getTime() - new Date(run.startedAt).getTime()

package/dist/facade/run.js

@@ -46,11 +46,12 @@ export const makeRun = (ctx, init) => {
                     });
                 }
                 await delay(WAIT_POLL_INTERVAL_MS);
-                current = await ctx.runtime.run(getRunOp(runId));
+                current = await ctx.runtime.run(getRunOp(runId, ctx.config.hostLocal.ownerUserId));
             }
             // Settle the changes: a handle from `harness.start()` or `runs.get()` has none captured yet,
             // so read the server-side capture now that the run is terminal.
-            const settledChanges = changesData ?? toRunChangesData(await ctx.runtime.run(getRunChangesOp(runId)));
+            const settledChanges = changesData ??
+                toRunChangesData(await ctx.runtime.run(getRunChangesOp(runId, ctx.config.hostLocal.ownerUserId)));
             return makeRun(ctx, { wire: current, changes: settledChanges });
         },
     };

package/dist/facade/session.d.ts

@@ -10,6 +10,7 @@ export declare const makeInteractiveSession: (ctx: SdkContext, wire: {
     readonly cwd?: string | undefined;
     readonly cols: number;
     readonly rows: number;
+    readonly mode?: "pipe" | "pty" | undefined;
     readonly exitCode?: number | undefined;
     readonly exitSignal?: number | undefined;
     readonly errorMessage?: string | undefined;

package/dist/facade/session.js

@@ -202,6 +202,7 @@ export const makeInteractiveSession = (ctx, wire) => {
         id: sessionId,
         workspaceId: wire.workspaceId,
         runId: wire.runId,
+        mode: wire.mode ?? "pty",
         send: async (input) => {
             const bytes = typeof input === "string" ? new TextEncoder().encode(input) : input;
             await ctx.runtime.run(sendSessionInputOp(sessionId, {

package/dist/facade/workspace.js

@@ -34,6 +34,7 @@ export const makeWorkspace = (ctx, init) => {
             ...(options?.cols === undefined ? {} : { cols: options.cols }),
             ...(options?.rows === undefined ? {} : { rows: options.rows }),
             ...(options?.term === undefined ? {} : { term: options.term }),
+            ...(options?.mode === undefined ? {} : { mode: options.mode }),
             ...(options?.metadata === undefined ? {} : { metadata: { ...options.metadata } }),
         }));
         return makeInteractiveSession(ctx, created);
@@ -62,7 +63,7 @@ export const makeWorkspace = (ctx, init) => {
         if (init.harness !== undefined) {
             return [init.harness.launchCommand ?? init.harness.id];
         }
-        const details = await ctx.runtime.run(getWorkspaceOp(init.id));
+        const details = await ctx.runtime.run(getWorkspaceOp(init.id, ctx.config.hostLocal.ownerUserId));
         const spec = details.spec;
         const harnessId = spec?.harness?.id;
         if (harnessId === undefined) {
@@ -92,13 +93,13 @@ export const makeWorkspace = (ctx, init) => {
         id: init.id,
         name: init.name,
         status: async () => {
-            const details = await ctx.runtime.run(getWorkspaceOp(init.id));
+            const details = await ctx.runtime.run(getWorkspaceOp(init.id, ctx.config.hostLocal.ownerUserId));
             return details.status;
         },
         ready: async () => {
             const deadline = Date.now() + READY_TIMEOUT_MS;
             for (;;) {
-                const details = await ctx.runtime.run(getWorkspaceOp(init.id));
+                const details = await ctx.runtime.run(getWorkspaceOp(init.id, ctx.config.hostLocal.ownerUserId));
                 // Gate on the coarse "ready" status, which the control plane now emits ONLY after the
                 // in-workspace daemon's control socket is accepting (readiness probe in the launch path).
                 // This is honest: when ready() resolves, harness.run() can connect without racing the socket.
@@ -127,7 +128,7 @@ export const makeWorkspace = (ctx, init) => {
                 let lastStatus;
                 const deadline = Date.now() + READY_TIMEOUT_MS;
                 for (;;) {
-                    const details = await ctxRun.run(getWorkspaceOp(init.id));
+                    const details = await ctxRun.run(getWorkspaceOp(init.id, ctx.config.hostLocal.ownerUserId));
                     if (details.status !== lastStatus) {
                         lastStatus = details.status;
                         yield {
@@ -155,7 +156,7 @@ export const makeWorkspace = (ctx, init) => {
             await ctx.runtime.run(stopWorkspaceOp(init.id, { ownerUserId }));
             const deadline = Date.now() + STOP_TIMEOUT_MS;
             for (;;) {
-                const details = await ctx.runtime.run(getWorkspaceOp(init.id));
+                const details = await ctx.runtime.run(getWorkspaceOp(init.id, ctx.config.hostLocal.ownerUserId));
                 if (details.status === "stopped") {
                     return;
                 }

package/dist/internal/config.d.ts

@@ -3,9 +3,9 @@
  *
  * The PUBLIC surface (`SealantConfig` in `../types.ts`) is intentionally minimal: `{ baseUrl, apiKey }`.
  * The SDK is now a thin HTTP client (run execution + telemetry moved server-side), so the only
- * host-local concerns left are a pre-auth owner principal and the registry id used on create/run
- * payloads. These live HERE — resolved from the environment with docker-compose defaults — so they
- * never leak into the published `SealantConfig`, and they disappear entirely once auth lands.
+ * host-local concerns left are the owner principal and the registry id used on create/run
+ * payloads. The owner comes from `SealantConfig.ownerUserId` when a product acts on behalf of a
+ * specific user (one client per user), else from the environment with docker-compose defaults.
  */
 import type { SealantConfig } from "../types.js";
 export interface SealantHostLocalConfig {

package/dist/internal/config.js

@@ -11,7 +11,7 @@ export const resolveInternalConfig = (config) => ({
     apiKey: config.apiKey,
     fetch: config.fetch,
     hostLocal: {
-        ownerUserId: env("SEALANT_OWNER_USER_ID") ?? DEFAULT_OWNER_USER_ID,
+        ownerUserId: config.ownerUserId ?? env("SEALANT_OWNER_USER_ID") ?? DEFAULT_OWNER_USER_ID,
         registryId: env("SEALANT_REGISTRY_ID") ?? DEFAULT_REGISTRY_ID,
     },
 });

package/dist/types.d.ts

@@ -23,8 +23,18 @@
 export interface SealantConfig {
     /** Base URL of the Sealant control-plane API (e.g. `http://localhost:8080`). */
     readonly baseUrl: string;
-    /** Bearer token for authenticated deployments. Optional for a localhost demo with no auth. */
+    /**
+     * Bearer secret for authenticated deployments: a SERVICE KEY (`SEALANT_SERVICE_KEYS` on the
+     * control plane — lets this client act on behalf of any `ownerUserId`) or a scoped user access
+     * token (session surface only). Optional for a localhost demo with no auth.
+     */
     readonly apiKey?: string;
+    /**
+     * The user every call is attributed to. A product that owns its own login builds ONE client per
+     * user with that user's Sealant id (see `users.ensure`). Defaults to `SEALANT_OWNER_USER_ID`,
+     * then `usr_local`.
+     */
+    readonly ownerUserId?: string;
     /** Override the `fetch` implementation (tests, custom agents, proxies). */
     readonly fetch?: typeof fetch;
 }
@@ -367,14 +377,24 @@ export interface RunOptions {
     readonly metadata?: Readonly<Record<string, unknown>>;
 }
 /** Options for opening an interactive PTY session. */
+/**
+ * How a session's leader is wired. `pty` (default) allocates a pseudoterminal — interactive
+ * shells and TUIs. `pipe` gives the leader plain stdio pipes and no tty — the shape for processes
+ * that speak a byte protocol over stdin/stdout (JSON-RPC / NDJSON servers such as
+ * `codex app-server`): `send` feeds stdin, `output`/`attach` carry stdout byte-exact, stderr is
+ * recorded as diagnostics only, and `resize` is rejected.
+ */
+export type SessionMode = "pty" | "pipe";
 export interface SessionOptions {
     /** Working directory inside the workspace (defaults to the repository root). */
     readonly cwd?: string;
-    /** Extra environment for the PTY process (not for secrets — use `credentials`). */
+    /** Extra environment for the session process (not for secrets — use `credentials`). */
     readonly env?: Readonly<Record<string, string>>;
     readonly cols?: number;
     readonly rows?: number;
     readonly term?: string;
+    /** Leader wiring; defaults to `pty`. `cols`/`rows`/`term` are ignored for `pipe`. */
+    readonly mode?: SessionMode;
     /** Opaque correlation bag, stored verbatim and echoed on reads. */
     readonly metadata?: Readonly<Record<string, unknown>>;
 }
@@ -705,7 +725,9 @@ export interface InteractiveSession {
     readonly workspaceId: string;
     /** The run recording this session — its record is the durable, replayable evidence. */
     readonly runId: string;
-    /** Send keystrokes. Strings are UTF-8-encoded; bytes pass through untouched. */
+    /** Leader wiring: a pseudoterminal or plain stdio pipes. */
+    readonly mode: SessionMode;
+    /** Send input: keystrokes to a PTY, bytes to a pipe leader's stdin. Strings are UTF-8-encoded. */
     send(input: string | Uint8Array): Promise<void>;
     /**
      * Byte-exact output as a RESUMABLE stream: recorded history from `from` (inclusive; default the
@@ -716,7 +738,7 @@ export interface InteractiveSession {
         readonly from?: bigint;
         readonly signal?: AbortSignal;
     }): AsyncIterable<SessionOutputChunk>;
-    /** Resize the PTY. */
+    /** Resize the PTY. Rejected for `pipe` sessions, which have no terminal. */
     resize(cols: number, rows: number): Promise<void>;
     /** Deliver a POSIX signal to the session's process (e.g. 2 = SIGINT). */
     signal(signal: number): Promise<void>;
@@ -881,3 +903,65 @@ export interface InferenceContinueOptions {
 export interface InferenceNamespace {
     respond(options: InferenceRespondOptions | InferenceContinueOptions): Promise<InferenceResponse>;
 }
+export interface SealantUser {
+    readonly userId: string;
+    readonly email: string;
+    readonly name: string;
+    readonly createdAt: string;
+}
+export interface EnsureUserOptions {
+    readonly email: string;
+    readonly name: string;
+    /** Caller-chosen id for a NEW user; ignored when the email already exists. */
+    readonly userId?: string;
+}
+export interface EnsuredUser extends SealantUser {
+    /** True when this call created the user. */
+    readonly created: boolean;
+}
+/**
+ * Identity rows for products that own their own login. `ensure` is idempotent on email: call it on
+ * every sign-in and build the per-user client with the returned `userId` as `ownerUserId`.
+ */
+export interface UsersNamespace {
+    ensure(options: EnsureUserOptions): Promise<EnsuredUser>;
+    get(userId: string): Promise<SealantUser>;
+}
+export type ConnectedAccountProvider = "claude" | "codex" | "github";
+export type ConnectedAccountStatus = "active" | "invalid" | "archived";
+/** A connected account as every surface sees it — NEVER carries secret material. */
+export interface ConnectedAccount {
+    readonly connectedAccountId: string;
+    readonly ownerUserId: string;
+    readonly provider: ConnectedAccountProvider;
+    readonly name: string;
+    /** Provider-shaped payload kind: oauth-token | credentials-json | auth-json | gh-cli-token. */
+    readonly kind: string;
+    readonly status: ConnectedAccountStatus;
+    /** Non-secret display data (token suffix, codex account email, github login + scopes). */
+    readonly metadata: Readonly<Record<string, unknown>>;
+    readonly connectedAt: string;
+    readonly updatedAt: string;
+    readonly lastUsedAt: string | null;
+    readonly lastSyncedAt: string | null;
+}
+export interface ConnectConnectedAccountOptions {
+    readonly provider: ConnectedAccountProvider;
+    /**
+     * Provider-shaped plaintext, passed through and sealed server-side: a Claude setup token or
+     * verbatim `.credentials.json`, verbatim Codex `auth.json`, or a GitHub token. Never logged.
+     */
+    readonly secret: string;
+    /** Account name under the provider; defaults to `default` (the one `credentials: { x: true }` picks). */
+    readonly name?: string;
+}
+/**
+ * The owner's connected provider accounts. `connect` upserts on (provider, name), so reconnecting
+ * swaps the sealed credential in place. Secrets flow one way — in; no call returns them.
+ */
+export interface ConnectedAccountsNamespace {
+    list(): Promise<readonly ConnectedAccount[]>;
+    connect(options: ConnectConnectedAccountOptions): Promise<ConnectedAccount>;
+    /** Soft-archives the account; uniform not-found for "does not exist" and "not yours". */
+    disconnect(connectedAccountId: string): Promise<ConnectedAccount>;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealant/sdk",
-  "version": "0.20.2",
+  "version": "0.22.0",
   "description": "The fluent public SDK for Sealant — create a workspace, run a harness, replay the record.",
   "license": "Apache-2.0",
   "repository": {
@@ -26,7 +26,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@sealant/api-contracts": "^0.20.2"
+    "@sealant/api-contracts": "^0.22.0"
   },
   "devDependencies": {
     "@effect/vitest": "4.0.0-beta.85",