@sealant/sdk 0.21.0 → 0.23.0

package/dist/client.d.ts

@@ -1,4 +1,4 @@
-import type { AccessTokensNamespace, CreateOptions, InferenceNamespace, ListOptions, Run, Workspace, SealantConfig } from "./types.js";
+import type { AccessTokensNamespace, ConnectedAccountsNamespace, CreateOptions, InferenceNamespace, ListOptions, Run, Workspace, SealantConfig, UsersNamespace } from "./types.js";
 export declare class Sealant {
     #private;
     constructor(config: SealantConfig);
@@ -21,6 +21,10 @@ export declare class Sealant {
      * the session endpoints enforce exactly those scopes (a read-stream token can stream but is
      * rejected for input and exec).
      */
+    /** Identity rows for products that own their own login (one client per user afterwards). */
+    readonly users: UsersNamespace;
+    /** This client's owner's Claude / Codex / GitHub accounts. Secrets go in; none come out. */
+    readonly connectedAccounts: ConnectedAccountsNamespace;
     readonly accessTokens: AccessTokensNamespace;
     /** Runs by id — so a record can be replayed long after its workspace is gone. */
     readonly runs: {

package/dist/client.js

@@ -1,16 +1,4 @@
-/**
- * `Sealant` — the public client and the import users reach for.
- *
- *   import { Sealant, opencode } from "@sealant/sdk"
- *   const sealant = new Sealant({ baseUrl: "http://localhost:8080" })
- *
- * This is the plain-Promise facade over the Effect core: an app `Layer` built once in the
- * constructor providing the wire client derived from `@sealant/api-contracts`. Everything is a plain
- * HTTP call to `baseUrl`. Operations whose endpoints have not landed yet stay TYPED against the
- * stable surface and reject with `SealantNotImplementedError` so callers can compile and wire
- * against the final shape today.
- */
-import { createAccessTokenOp, createWorkspaceOp, getRunOp, getWorkspaceOp, inferenceRespondOp, listWorkspacesOp, } from "./effect/operations.js";
+import { archiveConnectedAccountOp, createAccessTokenOp, createConnectedAccountOp, createWorkspaceOp, ensureUserOp, getRunOp, getUserOp, getWorkspaceOp, inferenceRespondOp, listConnectedAccountsOp, listWorkspacesOp, } from "./effect/operations.js";
 import { runHarness, startHarness } from "./effect/run-harness.js";
 import { makeSdkRuntime } from "./effect/runtime.js";
 import { SealantError } from "./errors.js";
@@ -20,6 +8,19 @@ import { buildCreateWorkspaceRequest } from "./internal/blueprint.js";
 import { resolveInternalConfig } from "./internal/config.js";
 import { parseTtlSeconds } from "./internal/duration.js";
 import { buildInferenceRespondRequest, mapInferenceResponse } from "./internal/inference.js";
+const mapConnectedAccount = (wire) => ({
+    connectedAccountId: wire.connectedAccountId,
+    ownerUserId: wire.ownerUserId,
+    provider: wire.provider,
+    name: wire.name,
+    kind: wire.kind,
+    status: wire.status,
+    metadata: wire.metadata,
+    connectedAt: wire.connectedAt,
+    updatedAt: wire.updatedAt,
+    lastUsedAt: wire.lastUsedAt,
+    lastSyncedAt: wire.lastSyncedAt,
+});
 // Wire the run-execution implementations into the Workspace facade (the injection point exists to
 // break the workspace <-> run-harness import cycle; the client is the composition root).
 registerHarnessExecutors({ run: runHarness, start: startHarness });
@@ -72,7 +73,7 @@ export class Sealant {
             return workspace.ready();
         },
         get: async (id) => {
-            const details = await this.#runtime.run(getWorkspaceOp(id));
+            const details = await this.#runtime.run(getWorkspaceOp(id, this.#ctx.config.hostLocal.ownerUserId));
             return makeWorkspace(this.#ctx, {
                 id: details.workspaceId,
                 name: details.name,
@@ -109,6 +110,47 @@ export class Sealant {
      * the session endpoints enforce exactly those scopes (a read-stream token can stream but is
      * rejected for input and exec).
      */
+    /** Identity rows for products that own their own login (one client per user afterwards). */
+    users = {
+        ensure: async (options) => {
+            const wire = await this.#runtime.run(ensureUserOp({
+                email: options.email,
+                name: options.name,
+                ...(options.userId === undefined ? {} : { userId: options.userId }),
+            }));
+            return {
+                userId: wire.userId,
+                email: wire.email,
+                name: wire.name,
+                createdAt: wire.createdAt,
+                created: wire.created,
+            };
+        },
+        get: async (userId) => {
+            const wire = await this.#runtime.run(getUserOp(userId));
+            return { userId: wire.userId, email: wire.email, name: wire.name, createdAt: wire.createdAt };
+        },
+    };
+    /** This client's owner's Claude / Codex / GitHub accounts. Secrets go in; none come out. */
+    connectedAccounts = {
+        list: async () => {
+            const wire = await this.#runtime.run(listConnectedAccountsOp(this.#ctx.config.hostLocal.ownerUserId));
+            return wire.items.map(mapConnectedAccount);
+        },
+        connect: async (options) => {
+            const wire = await this.#runtime.run(createConnectedAccountOp({
+                ownerUserId: this.#ctx.config.hostLocal.ownerUserId,
+                provider: options.provider,
+                secret: options.secret,
+                ...(options.name === undefined ? {} : { name: options.name }),
+            }));
+            return mapConnectedAccount(wire);
+        },
+        disconnect: async (connectedAccountId) => {
+            const wire = await this.#runtime.run(archiveConnectedAccountOp(connectedAccountId, this.#ctx.config.hostLocal.ownerUserId));
+            return mapConnectedAccount(wire);
+        },
+    };
     accessTokens = {
         create: async (options) => {
             const wire = await this.#runtime.run(createAccessTokenOp({
@@ -130,7 +172,7 @@ export class Sealant {
     /** Runs by id — so a record can be replayed long after its workspace is gone. */
     runs = {
         get: async (runId) => {
-            const wire = await this.#runtime.run(getRunOp(runId));
+            const wire = await this.#runtime.run(getRunOp(runId, this.#ctx.config.hostLocal.ownerUserId));
             return makeRun(this.#ctx, { wire });
         },
     };

package/dist/effect/api-client.d.ts

@@ -537,6 +537,9 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly params: {
                 readonly runId: string;
             };
+            readonly query: {
+                readonly ownerUserId?: string | undefined;
+            };
             readonly responseMode?: Mode;
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly runId: string;
@@ -566,6 +569,9 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly params: {
                 readonly runId: string;
             };
+            readonly query: {
+                readonly ownerUserId?: string | undefined;
+            };
             readonly responseMode?: Mode;
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly files: readonly {
@@ -580,6 +586,9 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly runId: string;
                 readonly sequence: string;
             };
+            readonly query: {
+                readonly ownerUserId?: string | undefined;
+            };
             readonly responseMode?: Mode;
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly eventId: string;
@@ -603,6 +612,9 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly params: {
                 readonly runId: string;
             };
+            readonly query: {
+                readonly ownerUserId?: string | undefined;
+            };
             readonly responseMode?: Mode;
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly runId: string;
@@ -624,6 +636,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly runId: string;
             };
             readonly query: {
+                readonly ownerUserId?: string | undefined;
                 readonly processId: string;
                 readonly stream: "pty" | "stderr" | "stdout";
                 readonly atSequence?: string | undefined;
@@ -642,6 +655,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly runId: string;
             };
             readonly query: {
+                readonly ownerUserId?: string | undefined;
                 readonly fromSequence?: string | undefined;
                 readonly toSequence?: string | undefined;
                 readonly limit?: string | undefined;
@@ -1038,6 +1052,33 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly status: "ok";
         }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
     };
+    readonly users: {
+        readonly ensureUser: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
+            readonly payload: {
+                readonly email: string;
+                readonly name: string;
+                readonly userId?: string | undefined;
+            };
+            readonly responseMode?: Mode;
+        }) => Effect.Effect<HttpApiClient.Client.Response<{
+            readonly userId: string;
+            readonly email: string;
+            readonly name: string;
+            readonly createdAt: string;
+            readonly created: boolean;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").UserBadRequestError | import("@sealant/api-contracts").UserInternalServerError), [Mode] extends ["response-only"] ? never : never>;
+        readonly getUser: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
+            readonly params: {
+                readonly userId: string;
+            };
+            readonly responseMode?: Mode;
+        }) => Effect.Effect<HttpApiClient.Client.Response<{
+            readonly userId: string;
+            readonly email: string;
+            readonly name: string;
+            readonly createdAt: string;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").UserInternalServerError | import("@sealant/api-contracts").UserNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+    };
     readonly workspaces: {
         readonly createWorkspace: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly headers: {
@@ -1136,6 +1177,9 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly params: {
                 readonly workspaceId: string;
             };
+            readonly query: {
+                readonly ownerUserId?: string | undefined;
+            };
             readonly responseMode?: Mode;
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly workspaceId: string;
@@ -1863,6 +1907,9 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly params: {
                 readonly runId: string;
             };
+            readonly query: {
+                readonly ownerUserId?: string | undefined;
+            };
             readonly responseMode?: Mode;
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly runId: string;
@@ -1892,6 +1939,9 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly params: {
                 readonly runId: string;
             };
+            readonly query: {
+                readonly ownerUserId?: string | undefined;
+            };
             readonly responseMode?: Mode;
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly files: readonly {
@@ -1906,6 +1956,9 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly runId: string;
                 readonly sequence: string;
             };
+            readonly query: {
+                readonly ownerUserId?: string | undefined;
+            };
             readonly responseMode?: Mode;
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly eventId: string;
@@ -1929,6 +1982,9 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly params: {
                 readonly runId: string;
             };
+            readonly query: {
+                readonly ownerUserId?: string | undefined;
+            };
             readonly responseMode?: Mode;
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly runId: string;
@@ -1950,6 +2006,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly runId: string;
             };
             readonly query: {
+                readonly ownerUserId?: string | undefined;
                 readonly processId: string;
                 readonly stream: "pty" | "stderr" | "stdout";
                 readonly atSequence?: string | undefined;
@@ -1968,6 +2025,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly runId: string;
             };
             readonly query: {
+                readonly ownerUserId?: string | undefined;
                 readonly fromSequence?: string | undefined;
                 readonly toSequence?: string | undefined;
                 readonly limit?: string | undefined;
@@ -2364,6 +2422,33 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly status: "ok";
         }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
     };
+    readonly users: {
+        readonly ensureUser: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
+            readonly payload: {
+                readonly email: string;
+                readonly name: string;
+                readonly userId?: string | undefined;
+            };
+            readonly responseMode?: Mode;
+        }) => Effect.Effect<HttpApiClient.Client.Response<{
+            readonly userId: string;
+            readonly email: string;
+            readonly name: string;
+            readonly createdAt: string;
+            readonly created: boolean;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").UserBadRequestError | import("@sealant/api-contracts").UserInternalServerError), [Mode] extends ["response-only"] ? never : never>;
+        readonly getUser: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
+            readonly params: {
+                readonly userId: string;
+            };
+            readonly responseMode?: Mode;
+        }) => Effect.Effect<HttpApiClient.Client.Response<{
+            readonly userId: string;
+            readonly email: string;
+            readonly name: string;
+            readonly createdAt: string;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").UserInternalServerError | import("@sealant/api-contracts").UserNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+    };
     readonly workspaces: {
         readonly createWorkspace: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly headers: {
@@ -2462,6 +2547,9 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly params: {
                 readonly workspaceId: string;
             };
+            readonly query: {
+                readonly ownerUserId?: string | undefined;
+            };
             readonly responseMode?: Mode;
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly workspaceId: string;

package/dist/effect/exec-workspace.js

@@ -37,7 +37,7 @@ const execWorkspaceEffect = (ctx, init, argv, options) => Effect.gen(function* (
             }));
         }
         yield* Effect.sleep(POLL_INTERVAL);
-        wire = yield* getRunOp(runId);
+        wire = yield* getRunOp(runId, ctx.config.hostLocal.ownerUserId);
     }
     // Exec framing: "completed" means every command executed and was recorded — anything else means
     // the machinery broke and the exit code cannot be trusted, which IS the error case.
@@ -48,7 +48,7 @@ const execWorkspaceEffect = (ctx, init, argv, options) => Effect.gen(function* (
     const processId = findCommandProcessId(started, executable);
     const stdout = processId === undefined ? "" : yield* readScrollback(runId, processId, "stdout");
     const stderr = processId === undefined ? "" : yield* readScrollback(runId, processId, "stderr");
-    const changes = toRunChangesData(yield* getRunChangesOp(runId));
+    const changes = toRunChangesData(yield* getRunChangesOp(runId, ctx.config.hostLocal.ownerUserId));
     return {
         exitCode: wire.exitCode ?? -1,
         stdout,

package/dist/effect/index.d.ts

@@ -24,4 +24,4 @@ export { makeSdkRuntime } from "./runtime.js";
 export type { SdkRuntime, SdkServices } from "./runtime.js";
 export { resolveInternalConfig } from "../internal/config.js";
 export type { SealantHostLocalConfig, SealantInternalConfig } from "../internal/config.js";
-export { InferenceBadRequestError, InferenceConflictError, InferenceInternalServerError, InferenceNotFoundError, InferenceUnavailableError, RunBadRequestError, RunInternalServerError, RunNotFoundError, WorkspaceBadGatewayError, WorkspaceBadRequestError, WorkspaceConflictError, WorkspaceForbiddenError, WorkspaceInternalServerError, WorkspaceNotFoundError, WorkspaceServiceUnavailableError, WorkspaceUnauthorizedError, } from "@sealant/api-contracts";
+export { ConnectedAccountBadRequestError, ConnectedAccountConflictError, ConnectedAccountInternalServerError, ConnectedAccountNotFoundError, ConnectedAccountServiceUnavailableError, InferenceBadRequestError, InferenceConflictError, InferenceInternalServerError, InferenceNotFoundError, InferenceUnavailableError, RunBadRequestError, RunInternalServerError, RunNotFoundError, UserBadRequestError, UserInternalServerError, UserNotFoundError, WorkspaceBadGatewayError, WorkspaceBadRequestError, WorkspaceConflictError, WorkspaceForbiddenError, WorkspaceInternalServerError, WorkspaceNotFoundError, WorkspaceServiceUnavailableError, WorkspaceUnauthorizedError, } from "@sealant/api-contracts";

package/dist/effect/index.js

@@ -28,4 +28,4 @@ export { resolveInternalConfig } from "../internal/config.js";
 // The typed contract errors carried on the client's failure channel (workspaces + runs +
 // inference — the groups the operations above call). Re-exported so Effect consumers don't need to
 // depend on the contracts package directly to `Effect.catchTag` a failure.
-export { InferenceBadRequestError, InferenceConflictError, InferenceInternalServerError, InferenceNotFoundError, InferenceUnavailableError, RunBadRequestError, RunInternalServerError, RunNotFoundError, WorkspaceBadGatewayError, WorkspaceBadRequestError, WorkspaceConflictError, WorkspaceForbiddenError, WorkspaceInternalServerError, WorkspaceNotFoundError, WorkspaceServiceUnavailableError, WorkspaceUnauthorizedError, } from "@sealant/api-contracts";
+export { ConnectedAccountBadRequestError, ConnectedAccountConflictError, ConnectedAccountInternalServerError, ConnectedAccountNotFoundError, ConnectedAccountServiceUnavailableError, InferenceBadRequestError, InferenceConflictError, InferenceInternalServerError, InferenceNotFoundError, InferenceUnavailableError, RunBadRequestError, RunInternalServerError, RunNotFoundError, UserBadRequestError, UserInternalServerError, UserNotFoundError, WorkspaceBadGatewayError, WorkspaceBadRequestError, WorkspaceConflictError, WorkspaceForbiddenError, WorkspaceInternalServerError, WorkspaceNotFoundError, WorkspaceServiceUnavailableError, WorkspaceUnauthorizedError, } from "@sealant/api-contracts";

package/dist/effect/operations.d.ts

@@ -37,7 +37,7 @@ export declare const createWorkspaceOp: (payload: {
     readonly repository: string;
     readonly tag: string;
 }, import("effect/unstable/http/HttpClientError").HttpClientError | import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError, SealantApiClient>;
-export declare const getWorkspaceOp: (workspaceId: string) => Effect.Effect<{
+export declare const getWorkspaceOp: (workspaceId: string, ownerUserId?: string | undefined) => Effect.Effect<{
     readonly workspaceId: string;
     readonly name: string;
     readonly ownerUserId: string;
@@ -194,7 +194,7 @@ export declare const createRunOp: (payload: {
     readonly createdAt: string;
     readonly updatedAt: string;
 }, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RunBadRequestError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError, SealantApiClient>;
-export declare const getRunOp: (runId: string) => Effect.Effect<{
+export declare const getRunOp: (runId: string, ownerUserId?: string | undefined) => Effect.Effect<{
     readonly runId: string;
     readonly workspaceId: string;
     readonly attemptId?: string | undefined;
@@ -284,6 +284,7 @@ export declare const updateRunOp: (runId: string, payload: {
     readonly updatedAt: string;
 }, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RunBadRequestError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError, SealantApiClient>;
 export declare const getRunTimelineOp: (runId: string, query: {
+    readonly ownerUserId?: string | undefined;
     readonly fromSequence?: string | undefined;
     readonly toSequence?: string | undefined;
     readonly limit?: string | undefined;
@@ -300,6 +301,7 @@ export declare const getRunTimelineOp: (runId: string, query: {
     readonly confidence: number;
 }[], import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RunBadRequestError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError, SealantApiClient>;
 export declare const getRunScrollbackOp: (runId: string, query: {
+    readonly ownerUserId?: string | undefined;
     readonly processId: string;
     readonly stream: "pty" | "stderr" | "stdout";
     readonly atSequence?: string | undefined;
@@ -311,7 +313,7 @@ export declare const getRunScrollbackOp: (runId: string, query: {
     readonly byteCount: number;
     readonly contentBase64: string;
 }, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RunBadRequestError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError, SealantApiClient>;
-export declare const getRunLossOp: (runId: string) => Effect.Effect<{
+export declare const getRunLossOp: (runId: string, ownerUserId?: string | undefined) => Effect.Effect<{
     readonly runId: string;
     readonly droppedEventCount: string;
     readonly sequenceGapCount: number;
@@ -326,7 +328,7 @@ export declare const getRunLossOp: (runId: string) => Effect.Effect<{
         readonly reason?: string | undefined;
     }[];
 }, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError, SealantApiClient>;
-export declare const getRunChangesOp: (runId: string) => Effect.Effect<{
+export declare const getRunChangesOp: (runId: string, ownerUserId?: string | undefined) => Effect.Effect<{
     readonly files: readonly {
         readonly path: string;
         readonly change: "added" | "deleted" | "modified" | "renamed";
@@ -491,6 +493,75 @@ export declare const createAccessTokenOp: (payload: {
     readonly createdAt: string;
     readonly token: string;
 }, import("@sealant/api-contracts").AccessTokenBadRequestError | import("@sealant/api-contracts").AccessTokenInternalServerError | import("@sealant/api-contracts").AccessTokenNotFoundError | import("effect/unstable/http/HttpClientError").HttpClientError | import("effect/Schema").SchemaError, SealantApiClient>;
+export declare const ensureUserOp: (payload: {
+    readonly email: string;
+    readonly name: string;
+    readonly userId?: string | undefined;
+}) => Effect.Effect<{
+    readonly userId: string;
+    readonly email: string;
+    readonly name: string;
+    readonly createdAt: string;
+    readonly created: boolean;
+}, import("effect/unstable/http/HttpClientError").HttpClientError | import("effect/Schema").SchemaError | import("@sealant/api-contracts").UserBadRequestError | import("@sealant/api-contracts").UserInternalServerError, SealantApiClient>;
+export declare const getUserOp: (userId: string) => Effect.Effect<{
+    readonly userId: string;
+    readonly email: string;
+    readonly name: string;
+    readonly createdAt: string;
+}, import("effect/unstable/http/HttpClientError").HttpClientError | import("effect/Schema").SchemaError | import("@sealant/api-contracts").UserInternalServerError | import("@sealant/api-contracts").UserNotFoundError, SealantApiClient>;
+export declare const listConnectedAccountsOp: (ownerUserId: string) => Effect.Effect<{
+    readonly items: readonly {
+        readonly connectedAccountId: string;
+        readonly ownerUserId: string;
+        readonly provider: "claude" | "codex" | "github";
+        readonly name: string;
+        readonly kind: string;
+        readonly status: "active" | "archived" | "invalid";
+        readonly metadata: {
+            readonly [x: string]: unknown;
+        };
+        readonly connectedAt: string;
+        readonly updatedAt: string;
+        readonly lastUsedAt: string | null;
+        readonly lastSyncedAt: string | null;
+    }[];
+}, import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("effect/unstable/http/HttpClientError").HttpClientError | import("effect/Schema").SchemaError, SealantApiClient>;
+export declare const createConnectedAccountOp: (payload: {
+    readonly ownerUserId: string;
+    readonly provider: "claude" | "codex" | "github";
+    readonly name?: string | undefined;
+    readonly secret: string;
+}) => Effect.Effect<{
+    readonly connectedAccountId: string;
+    readonly ownerUserId: string;
+    readonly provider: "claude" | "codex" | "github";
+    readonly name: string;
+    readonly kind: string;
+    readonly status: "active" | "archived" | "invalid";
+    readonly metadata: {
+        readonly [x: string]: unknown;
+    };
+    readonly connectedAt: string;
+    readonly updatedAt: string;
+    readonly lastUsedAt: string | null;
+    readonly lastSyncedAt: string | null;
+}, import("@sealant/api-contracts").ConnectedAccountBadRequestError | import("@sealant/api-contracts").ConnectedAccountConflictError | import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("@sealant/api-contracts").ConnectedAccountNotFoundError | import("@sealant/api-contracts").ConnectedAccountServiceUnavailableError | import("effect/unstable/http/HttpClientError").HttpClientError | import("effect/Schema").SchemaError, SealantApiClient>;
+export declare const archiveConnectedAccountOp: (connectedAccountId: string, ownerUserId: string) => Effect.Effect<{
+    readonly connectedAccountId: string;
+    readonly ownerUserId: string;
+    readonly provider: "claude" | "codex" | "github";
+    readonly name: string;
+    readonly kind: string;
+    readonly status: "active" | "archived" | "invalid";
+    readonly metadata: {
+        readonly [x: string]: unknown;
+    };
+    readonly connectedAt: string;
+    readonly updatedAt: string;
+    readonly lastUsedAt: string | null;
+    readonly lastSyncedAt: string | null;
+}, import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("@sealant/api-contracts").ConnectedAccountNotFoundError | import("effect/unstable/http/HttpClientError").HttpClientError | import("effect/Schema").SchemaError, SealantApiClient>;
 export declare const inferenceRespondOp: (payload: {
     readonly ownerUserId: string;
     readonly credentials?: {

package/dist/effect/operations.js

@@ -5,7 +5,10 @@ export const createWorkspaceOp = (payload, idempotencyKey) => Effect.flatMap(Sea
     payload,
     headers: idempotencyKey === undefined ? {} : { "idempotency-key": idempotencyKey },
 }));
-export const getWorkspaceOp = (workspaceId) => Effect.flatMap(SealantApiClient, (client) => client.workspaces.getWorkspace({ params: { workspaceId } }));
+export const getWorkspaceOp = (workspaceId, ownerUserId) => Effect.flatMap(SealantApiClient, (client) => client.workspaces.getWorkspace({
+    params: { workspaceId },
+    query: ownerUserId === undefined ? {} : { ownerUserId },
+}));
 export const listWorkspacesOp = (query) => Effect.flatMap(SealantApiClient, (client) => client.workspaces.listWorkspaces({ query }));
 export const execWorkspaceOp = (workspaceId, payload) => Effect.flatMap(SealantApiClient, (client) => client.workspaces.execWorkspace({ params: { workspaceId }, payload }));
 export const stopWorkspaceOp = (workspaceId, payload) => Effect.flatMap(SealantApiClient, (client) => client.workspaces.stopWorkspace({ params: { workspaceId }, payload }));
@@ -13,13 +16,14 @@ export const restartWorkspaceOp = (workspaceId, payload) => Effect.flatMap(Seala
 export const expireWorkspaceOp = (workspaceId, payload) => Effect.flatMap(SealantApiClient, (client) => client.workspaces.expireWorkspace({ params: { workspaceId }, payload }));
 // ---- runs ----
 export const createRunOp = (payload) => Effect.flatMap(SealantApiClient, (client) => client.runs.createRun({ payload }));
-export const getRunOp = (runId) => Effect.flatMap(SealantApiClient, (client) => client.runs.getRun({ params: { runId } }));
+const ownerQuery = (ownerUserId) => ownerUserId === undefined ? {} : { ownerUserId };
+export const getRunOp = (runId, ownerUserId) => Effect.flatMap(SealantApiClient, (client) => client.runs.getRun({ params: { runId }, query: ownerQuery(ownerUserId) }));
 export const listRunsOp = (query) => Effect.flatMap(SealantApiClient, (client) => client.runs.listRuns({ query }));
 export const updateRunOp = (runId, payload) => Effect.flatMap(SealantApiClient, (client) => client.runs.updateRun({ params: { runId }, payload }));
 export const getRunTimelineOp = (runId, query) => Effect.flatMap(SealantApiClient, (client) => Effect.map(client.runs.getRunTimeline({ params: { runId }, query }), (r) => r.items));
 export const getRunScrollbackOp = (runId, query) => Effect.flatMap(SealantApiClient, (client) => client.runs.getRunScrollback({ params: { runId }, query }));
-export const getRunLossOp = (runId) => Effect.flatMap(SealantApiClient, (client) => client.runs.getRunLoss({ params: { runId } }));
-export const getRunChangesOp = (runId) => Effect.flatMap(SealantApiClient, (client) => client.runs.getRunChanges({ params: { runId } }));
+export const getRunLossOp = (runId, ownerUserId) => Effect.flatMap(SealantApiClient, (client) => client.runs.getRunLoss({ params: { runId }, query: ownerQuery(ownerUserId) }));
+export const getRunChangesOp = (runId, ownerUserId) => Effect.flatMap(SealantApiClient, (client) => client.runs.getRunChanges({ params: { runId }, query: ownerQuery(ownerUserId) }));
 // ---- sessions ----
 export const createSessionOp = (payload) => Effect.flatMap(SealantApiClient, (client) => client.sessions.createSession({ payload, headers: {} }));
 export const getSessionOp = (sessionId, ownerUserId) => Effect.flatMap(SealantApiClient, (client) => client.sessions.getSession({
@@ -35,5 +39,15 @@ export const signalSessionOp = (sessionId, payload) => Effect.flatMap(SealantApi
 export const closeSessionOp = (sessionId, payload) => Effect.flatMap(SealantApiClient, (client) => client.sessions.closeSession({ params: { sessionId }, headers: {}, payload }));
 // ---- access tokens ----
 export const createAccessTokenOp = (payload) => Effect.flatMap(SealantApiClient, (client) => client.accessTokens.createAccessToken({ payload }));
+// ---- users ----
+export const ensureUserOp = (payload) => Effect.flatMap(SealantApiClient, (client) => client.users.ensureUser({ payload }));
+export const getUserOp = (userId) => Effect.flatMap(SealantApiClient, (client) => client.users.getUser({ params: { userId } }));
+// ---- connected accounts ----
+export const listConnectedAccountsOp = (ownerUserId) => Effect.flatMap(SealantApiClient, (client) => client.connectedAccounts.listConnectedAccounts({ query: { ownerUserId } }));
+export const createConnectedAccountOp = (payload) => Effect.flatMap(SealantApiClient, (client) => client.connectedAccounts.createConnectedAccount({ payload }));
+export const archiveConnectedAccountOp = (connectedAccountId, ownerUserId) => Effect.flatMap(SealantApiClient, (client) => client.connectedAccounts.archiveConnectedAccount({
+    params: { connectedAccountId },
+    query: { ownerUserId },
+}));
 // ---- inference ----
 export const inferenceRespondOp = (payload) => Effect.flatMap(SealantApiClient, (client) => client.inference.respond({ payload }));

package/dist/effect/run-harness.js

@@ -38,7 +38,7 @@ const createHarnessRunEffect = (ctx, init, prompt, options) => Effect.gen(functi
             ...metadata,
         });
     }
-    const details = yield* getWorkspaceOp(init.id);
+    const details = yield* getWorkspaceOp(init.id, ctx.config.hostLocal.ownerUserId);
     const spec = details.spec;
     const harnessId = spec?.harness?.id;
     if (harnessId === undefined) {
@@ -66,10 +66,10 @@ const runHarnessEffect = (ctx, init, prompt, options) => Effect.gen(function* ()
             }));
         }
         yield* Effect.sleep(POLL_INTERVAL);
-        wire = yield* getRunOp(runId);
+        wire = yield* getRunOp(runId, ctx.config.hostLocal.ownerUserId);
     }
     // Read the changes the run produced (captured server-side).
-    const changes = toRunChangesData(yield* getRunChangesOp(runId));
+    const changes = toRunChangesData(yield* getRunChangesOp(runId, ctx.config.hostLocal.ownerUserId));
     return makeRun(ctx, { wire, changes });
 });
 /** The BLOCKING `harness.run()` implementation, registered into the Workspace facade by the client. */

package/dist/facade/record.js

@@ -135,7 +135,10 @@ export const renderTranscript = (commands) => {
     return `${blocks.join("\n\n")}\n`;
 };
 export const makeRunRecord = (ctx, runId) => {
-    const fetchTimeline = (from) => ctx.runtime.run(getRunTimelineOp(runId, from === undefined ? {} : { fromSequence: from.toString() }));
+    const fetchTimeline = (from) => ctx.runtime.run(getRunTimelineOp(runId, {
+        ownerUserId: ctx.config.hostLocal.ownerUserId,
+        ...(from === undefined ? {} : { fromSequence: from.toString() }),
+    }));
     return {
         runId,
         replay: async (options) => {
@@ -171,7 +174,10 @@ export const makeRunRecord = (ctx, runId) => {
                 let from = options?.from;
                 const deadline = Date.now() + STREAM_TIMEOUT_MS;
                 for (;;) {
-                    const wire = await ctxRun.run(getRunTimelineOp(runId, from === undefined ? {} : { fromSequence: from.toString() }));
+                    const wire = await ctxRun.run(getRunTimelineOp(runId, {
+                        ownerUserId: ctx.config.hostLocal.ownerUserId,
+                        ...(from === undefined ? {} : { fromSequence: from.toString() }),
+                    }));
                     for (const entry of wire) {
                         const mapped = toTimelineEntry(entry);
                         yield mapped;
@@ -179,9 +185,12 @@ export const makeRunRecord = (ctx, runId) => {
                     }
                     // Stop once the run is terminal — with one final drain to catch entries written between the
                     // last timeline fetch and the status check.
-                    const run = await ctxRun.run(getRunOp(runId));
+                    const run = await ctxRun.run(getRunOp(runId, ctx.config.hostLocal.ownerUserId));
                     if (TERMINAL_RUN_STATUSES.has(run.status)) {
-                        const tail = await ctxRun.run(getRunTimelineOp(runId, from === undefined ? {} : { fromSequence: from.toString() }));
+                        const tail = await ctxRun.run(getRunTimelineOp(runId, {
+                            ownerUserId: ctx.config.hostLocal.ownerUserId,
+                            ...(from === undefined ? {} : { fromSequence: from.toString() }),
+                        }));
                         for (const entry of tail) {
                             yield toTimelineEntry(entry);
                         }
@@ -208,7 +217,11 @@ export const makeRunRecord = (ctx, runId) => {
         scrollback: (processId, stream) => {
             const run = ctx.runtime;
             async function* iterate() {
-                const response = await run.run(getRunScrollbackOp(runId, { processId, stream }));
+                const response = await run.run(getRunScrollbackOp(runId, {
+                    ownerUserId: ctx.config.hostLocal.ownerUserId,
+                    processId,
+                    stream,
+                }));
                 const bytes = Buffer.from(response.contentBase64, "base64");
                 if (bytes.byteLength > 0) {
                     yield new Uint8Array(bytes.buffer, bytes.byteOffset, bytes.byteLength);
@@ -216,9 +229,9 @@ export const makeRunRecord = (ctx, runId) => {
             }
             return iterate();
         },
-        loss: async () => toLossReport(await ctx.runtime.run(getRunLossOp(runId))),
+        loss: async () => toLossReport(await ctx.runtime.run(getRunLossOp(runId, ctx.config.hostLocal.ownerUserId))),
         summary: async () => {
-            const run = await ctx.runtime.run(getRunOp(runId));
+            const run = await ctx.runtime.run(getRunOp(runId, ctx.config.hostLocal.ownerUserId));
             const timeline = await fetchTimeline();
             const durationMs = run.startedAt !== undefined && run.finishedAt !== undefined
                 ? new Date(run.finishedAt).getTime() - new Date(run.startedAt).getTime()

package/dist/facade/run.js

@@ -46,11 +46,12 @@ export const makeRun = (ctx, init) => {
                     });
                 }
                 await delay(WAIT_POLL_INTERVAL_MS);
-                current = await ctx.runtime.run(getRunOp(runId));
+                current = await ctx.runtime.run(getRunOp(runId, ctx.config.hostLocal.ownerUserId));
             }
             // Settle the changes: a handle from `harness.start()` or `runs.get()` has none captured yet,
             // so read the server-side capture now that the run is terminal.
-            const settledChanges = changesData ?? toRunChangesData(await ctx.runtime.run(getRunChangesOp(runId)));
+            const settledChanges = changesData ??
+                toRunChangesData(await ctx.runtime.run(getRunChangesOp(runId, ctx.config.hostLocal.ownerUserId)));
             return makeRun(ctx, { wire: current, changes: settledChanges });
         },
     };

package/dist/facade/session.js

@@ -3,18 +3,19 @@ import { closeSessionOp, getSessionOp, getSessionOutputOp, resizeSessionOp, send
  * Open the held-WebSocket terminal attachment (the data plane). One socket:
  * binary frames are PTY bytes in both directions, text frames are control
  * JSON (`{"t":"resize",...}` up, `{"t":"end"}` down). Auth rides the connect —
- * `?token=` for apiKey clients (WebSocket cannot set headers), `?ownerUserId=`
- * for host-local — and never repeats per event.
+ * `?ownerUserId=` always, plus `?token=` for apiKey clients (WebSocket cannot
+ * set headers; a service principal needs the owner assertion *and* its key) —
+ * and never repeats per event.
  */
 const openAttachment = (ctx, sessionId, options) => {
     const config = ctx.config;
     const url = new URL(`/v1/sessions/${sessionId}/attach`, config.baseUrl);
     url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
     url.searchParams.set("from", (options?.from ?? 0n).toString());
-    if (config.apiKey === undefined) {
-        url.searchParams.set("ownerUserId", config.hostLocal.ownerUserId);
-    }
-    else {
+    // The owner assertion always rides the URL; a service principal needs it *alongside* its key,
+    // and WebSocket cannot carry headers, so the key rides the URL too.
+    url.searchParams.set("ownerUserId", config.hostLocal.ownerUserId);
+    if (config.apiKey !== undefined) {
         url.searchParams.set("token", config.apiKey);
     }
     return new Promise((resolve, reject) => {
@@ -126,9 +127,7 @@ async function* streamOverSse(ctx, sessionId, from, signal) {
     const fetchImpl = config.fetch ?? fetch;
     const url = new URL(`/v1/sessions/${sessionId}/output/stream`, config.baseUrl);
     url.searchParams.set("from", from.toString());
-    if (config.apiKey === undefined) {
-        url.searchParams.set("ownerUserId", config.hostLocal.ownerUserId);
-    }
+    url.searchParams.set("ownerUserId", config.hostLocal.ownerUserId);
     const response = await fetchImpl(url, {
         headers: {
             accept: "text/event-stream",

package/dist/facade/workspace.js

@@ -63,7 +63,7 @@ export const makeWorkspace = (ctx, init) => {
         if (init.harness !== undefined) {
             return [init.harness.launchCommand ?? init.harness.id];
         }
-        const details = await ctx.runtime.run(getWorkspaceOp(init.id));
+        const details = await ctx.runtime.run(getWorkspaceOp(init.id, ctx.config.hostLocal.ownerUserId));
         const spec = details.spec;
         const harnessId = spec?.harness?.id;
         if (harnessId === undefined) {
@@ -93,13 +93,13 @@ export const makeWorkspace = (ctx, init) => {
         id: init.id,
         name: init.name,
         status: async () => {
-            const details = await ctx.runtime.run(getWorkspaceOp(init.id));
+            const details = await ctx.runtime.run(getWorkspaceOp(init.id, ctx.config.hostLocal.ownerUserId));
             return details.status;
         },
         ready: async () => {
             const deadline = Date.now() + READY_TIMEOUT_MS;
             for (;;) {
-                const details = await ctx.runtime.run(getWorkspaceOp(init.id));
+                const details = await ctx.runtime.run(getWorkspaceOp(init.id, ctx.config.hostLocal.ownerUserId));
                 // Gate on the coarse "ready" status, which the control plane now emits ONLY after the
                 // in-workspace daemon's control socket is accepting (readiness probe in the launch path).
                 // This is honest: when ready() resolves, harness.run() can connect without racing the socket.
@@ -128,7 +128,7 @@ export const makeWorkspace = (ctx, init) => {
                 let lastStatus;
                 const deadline = Date.now() + READY_TIMEOUT_MS;
                 for (;;) {
-                    const details = await ctxRun.run(getWorkspaceOp(init.id));
+                    const details = await ctxRun.run(getWorkspaceOp(init.id, ctx.config.hostLocal.ownerUserId));
                     if (details.status !== lastStatus) {
                         lastStatus = details.status;
                         yield {
@@ -156,7 +156,7 @@ export const makeWorkspace = (ctx, init) => {
             await ctx.runtime.run(stopWorkspaceOp(init.id, { ownerUserId }));
             const deadline = Date.now() + STOP_TIMEOUT_MS;
             for (;;) {
-                const details = await ctx.runtime.run(getWorkspaceOp(init.id));
+                const details = await ctx.runtime.run(getWorkspaceOp(init.id, ctx.config.hostLocal.ownerUserId));
                 if (details.status === "stopped") {
                     return;
                 }
@@ -214,10 +214,10 @@ const openForward = (ctx, workspaceId, port, options) => {
     if (options?.protocol === "udp") {
         url.searchParams.set("protocol", "udp");
     }
-    if (config.apiKey === undefined) {
-        url.searchParams.set("ownerUserId", config.hostLocal.ownerUserId);
-    }
-    else {
+    // The owner assertion always rides the URL (a service principal needs it alongside its
+    // key, and WebSocket cannot carry headers — same contract as the session attach).
+    url.searchParams.set("ownerUserId", config.hostLocal.ownerUserId);
+    if (config.apiKey !== undefined) {
         url.searchParams.set("token", config.apiKey);
     }
     return new Promise((resolve, reject) => {

package/dist/internal/blueprint.js

@@ -4,7 +4,8 @@
  * no contract change. The public `repository` is the SOURCE git repo (it becomes
  * `spec.sources.workspace.url`); the contract's `repository`/`tag` are the OCI push coordinates, which
  * we derive. `customization.enableSealantd` is forced on (it bakes + launches the daemon the run path
- * connects to), the runtime target is pinned to docker (the only bridgeable adapter today), and the
+ * connects to), the runtime target is `auto` (the deployment's default adapter — Docker on self-host, Kubernetes
+ * when the worker is configured for a cluster), and the
  * foreground is a keepalive so the workspace idles with the daemon up and the harness is exec'd on
  * demand by `run()` rather than launched at boot. `options.credentials`, if present, is lowered via
  * `mapWorkspaceCredentials` (see `./credentials.js`) and folded into `spec.credentials`; the control
@@ -182,7 +183,9 @@ export const buildCreateWorkspaceRequest = (options, config) => {
             os: options.baseImage !== undefined
                 ? { family: "custom", mode: "require", baseImage: options.baseImage }
                 : { family: options.os ?? "fedora", mode: "prefer" },
-            runtime: { family: "docker", mode: "require" },
+            // `auto` = the deployment's DEFAULT_RUNTIME_ADAPTER. SDK callers don't know (and must not
+            // care) whether the control plane runs workspaces as containers or Pods.
+            runtime: { family: "auto", mode: "prefer" },
         },
         lifecycle: {
             startup: { foreground: { kind: "command", run: "sleep infinity", shell: "bash" } },

package/dist/internal/config.d.ts

@@ -3,9 +3,9 @@
  *
  * The PUBLIC surface (`SealantConfig` in `../types.ts`) is intentionally minimal: `{ baseUrl, apiKey }`.
  * The SDK is now a thin HTTP client (run execution + telemetry moved server-side), so the only
- * host-local concerns left are a pre-auth owner principal and the registry id used on create/run
- * payloads. These live HERE — resolved from the environment with docker-compose defaults — so they
- * never leak into the published `SealantConfig`, and they disappear entirely once auth lands.
+ * host-local concerns left are the owner principal and the registry id used on create/run
+ * payloads. The owner comes from `SealantConfig.ownerUserId` when a product acts on behalf of a
+ * specific user (one client per user), else from the environment with docker-compose defaults.
  */
 import type { SealantConfig } from "../types.js";
 export interface SealantHostLocalConfig {

package/dist/internal/config.js

@@ -11,7 +11,7 @@ export const resolveInternalConfig = (config) => ({
     apiKey: config.apiKey,
     fetch: config.fetch,
     hostLocal: {
-        ownerUserId: env("SEALANT_OWNER_USER_ID") ?? DEFAULT_OWNER_USER_ID,
+        ownerUserId: config.ownerUserId ?? env("SEALANT_OWNER_USER_ID") ?? DEFAULT_OWNER_USER_ID,
         registryId: env("SEALANT_REGISTRY_ID") ?? DEFAULT_REGISTRY_ID,
     },
 });

package/dist/types.d.ts

@@ -23,8 +23,18 @@
 export interface SealantConfig {
     /** Base URL of the Sealant control-plane API (e.g. `http://localhost:8080`). */
     readonly baseUrl: string;
-    /** Bearer token for authenticated deployments. Optional for a localhost demo with no auth. */
+    /**
+     * Bearer secret for authenticated deployments: a SERVICE KEY (`SEALANT_SERVICE_KEYS` on the
+     * control plane — lets this client act on behalf of any `ownerUserId`) or a scoped user access
+     * token (session surface only). Optional for a localhost demo with no auth.
+     */
     readonly apiKey?: string;
+    /**
+     * The user every call is attributed to. A product that owns its own login builds ONE client per
+     * user with that user's Sealant id (see `users.ensure`). Defaults to `SEALANT_OWNER_USER_ID`,
+     * then `usr_local`.
+     */
+    readonly ownerUserId?: string;
     /** Override the `fetch` implementation (tests, custom agents, proxies). */
     readonly fetch?: typeof fetch;
 }
@@ -893,3 +903,65 @@ export interface InferenceContinueOptions {
 export interface InferenceNamespace {
     respond(options: InferenceRespondOptions | InferenceContinueOptions): Promise<InferenceResponse>;
 }
+export interface SealantUser {
+    readonly userId: string;
+    readonly email: string;
+    readonly name: string;
+    readonly createdAt: string;
+}
+export interface EnsureUserOptions {
+    readonly email: string;
+    readonly name: string;
+    /** Caller-chosen id for a NEW user; ignored when the email already exists. */
+    readonly userId?: string;
+}
+export interface EnsuredUser extends SealantUser {
+    /** True when this call created the user. */
+    readonly created: boolean;
+}
+/**
+ * Identity rows for products that own their own login. `ensure` is idempotent on email: call it on
+ * every sign-in and build the per-user client with the returned `userId` as `ownerUserId`.
+ */
+export interface UsersNamespace {
+    ensure(options: EnsureUserOptions): Promise<EnsuredUser>;
+    get(userId: string): Promise<SealantUser>;
+}
+export type ConnectedAccountProvider = "claude" | "codex" | "github";
+export type ConnectedAccountStatus = "active" | "invalid" | "archived";
+/** A connected account as every surface sees it — NEVER carries secret material. */
+export interface ConnectedAccount {
+    readonly connectedAccountId: string;
+    readonly ownerUserId: string;
+    readonly provider: ConnectedAccountProvider;
+    readonly name: string;
+    /** Provider-shaped payload kind: oauth-token | credentials-json | auth-json | gh-cli-token. */
+    readonly kind: string;
+    readonly status: ConnectedAccountStatus;
+    /** Non-secret display data (token suffix, codex account email, github login + scopes). */
+    readonly metadata: Readonly<Record<string, unknown>>;
+    readonly connectedAt: string;
+    readonly updatedAt: string;
+    readonly lastUsedAt: string | null;
+    readonly lastSyncedAt: string | null;
+}
+export interface ConnectConnectedAccountOptions {
+    readonly provider: ConnectedAccountProvider;
+    /**
+     * Provider-shaped plaintext, passed through and sealed server-side: a Claude setup token or
+     * verbatim `.credentials.json`, verbatim Codex `auth.json`, or a GitHub token. Never logged.
+     */
+    readonly secret: string;
+    /** Account name under the provider; defaults to `default` (the one `credentials: { x: true }` picks). */
+    readonly name?: string;
+}
+/**
+ * The owner's connected provider accounts. `connect` upserts on (provider, name), so reconnecting
+ * swaps the sealed credential in place. Secrets flow one way — in; no call returns them.
+ */
+export interface ConnectedAccountsNamespace {
+    list(): Promise<readonly ConnectedAccount[]>;
+    connect(options: ConnectConnectedAccountOptions): Promise<ConnectedAccount>;
+    /** Soft-archives the account; uniform not-found for "does not exist" and "not yours". */
+    disconnect(connectedAccountId: string): Promise<ConnectedAccount>;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealant/sdk",
-  "version": "0.21.0",
+  "version": "0.23.0",
   "description": "The fluent public SDK for Sealant — create a workspace, run a harness, replay the record.",
   "license": "Apache-2.0",
   "repository": {
@@ -26,7 +26,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@sealant/api-contracts": "^0.21.0"
+    "@sealant/api-contracts": "^0.23.0"
   },
   "devDependencies": {
     "@effect/vitest": "4.0.0-beta.85",