@sealant/sdk 0.22.0 → 0.23.0

package/dist/facade/session.js

@@ -3,18 +3,19 @@ import { closeSessionOp, getSessionOp, getSessionOutputOp, resizeSessionOp, send
  * Open the held-WebSocket terminal attachment (the data plane). One socket:
  * binary frames are PTY bytes in both directions, text frames are control
  * JSON (`{"t":"resize",...}` up, `{"t":"end"}` down). Auth rides the connect —
- * `?token=` for apiKey clients (WebSocket cannot set headers), `?ownerUserId=`
- * for host-local — and never repeats per event.
+ * `?ownerUserId=` always, plus `?token=` for apiKey clients (WebSocket cannot
+ * set headers; a service principal needs the owner assertion *and* its key) —
+ * and never repeats per event.
  */
 const openAttachment = (ctx, sessionId, options) => {
     const config = ctx.config;
     const url = new URL(`/v1/sessions/${sessionId}/attach`, config.baseUrl);
     url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
     url.searchParams.set("from", (options?.from ?? 0n).toString());
-    if (config.apiKey === undefined) {
-        url.searchParams.set("ownerUserId", config.hostLocal.ownerUserId);
-    }
-    else {
+    // The owner assertion always rides the URL; a service principal needs it *alongside* its key,
+    // and WebSocket cannot carry headers, so the key rides the URL too.
+    url.searchParams.set("ownerUserId", config.hostLocal.ownerUserId);
+    if (config.apiKey !== undefined) {
         url.searchParams.set("token", config.apiKey);
     }
     return new Promise((resolve, reject) => {
@@ -126,9 +127,7 @@ async function* streamOverSse(ctx, sessionId, from, signal) {
     const fetchImpl = config.fetch ?? fetch;
     const url = new URL(`/v1/sessions/${sessionId}/output/stream`, config.baseUrl);
     url.searchParams.set("from", from.toString());
-    if (config.apiKey === undefined) {
-        url.searchParams.set("ownerUserId", config.hostLocal.ownerUserId);
-    }
+    url.searchParams.set("ownerUserId", config.hostLocal.ownerUserId);
     const response = await fetchImpl(url, {
         headers: {
             accept: "text/event-stream",

package/dist/facade/workspace.js

@@ -214,10 +214,10 @@ const openForward = (ctx, workspaceId, port, options) => {
     if (options?.protocol === "udp") {
         url.searchParams.set("protocol", "udp");
     }
-    if (config.apiKey === undefined) {
-        url.searchParams.set("ownerUserId", config.hostLocal.ownerUserId);
-    }
-    else {
+    // The owner assertion always rides the URL (a service principal needs it alongside its
+    // key, and WebSocket cannot carry headers — same contract as the session attach).
+    url.searchParams.set("ownerUserId", config.hostLocal.ownerUserId);
+    if (config.apiKey !== undefined) {
         url.searchParams.set("token", config.apiKey);
     }
     return new Promise((resolve, reject) => {

package/dist/internal/blueprint.js

@@ -4,7 +4,8 @@
  * no contract change. The public `repository` is the SOURCE git repo (it becomes
  * `spec.sources.workspace.url`); the contract's `repository`/`tag` are the OCI push coordinates, which
  * we derive. `customization.enableSealantd` is forced on (it bakes + launches the daemon the run path
- * connects to), the runtime target is pinned to docker (the only bridgeable adapter today), and the
+ * connects to), the runtime target is `auto` (the deployment's default adapter — Docker on self-host, Kubernetes
+ * when the worker is configured for a cluster), and the
  * foreground is a keepalive so the workspace idles with the daemon up and the harness is exec'd on
  * demand by `run()` rather than launched at boot. `options.credentials`, if present, is lowered via
  * `mapWorkspaceCredentials` (see `./credentials.js`) and folded into `spec.credentials`; the control
@@ -182,7 +183,9 @@ export const buildCreateWorkspaceRequest = (options, config) => {
             os: options.baseImage !== undefined
                 ? { family: "custom", mode: "require", baseImage: options.baseImage }
                 : { family: options.os ?? "fedora", mode: "prefer" },
-            runtime: { family: "docker", mode: "require" },
+            // `auto` = the deployment's DEFAULT_RUNTIME_ADAPTER. SDK callers don't know (and must not
+            // care) whether the control plane runs workspaces as containers or Pods.
+            runtime: { family: "auto", mode: "prefer" },
         },
         lifecycle: {
             startup: { foreground: { kind: "command", run: "sleep infinity", shell: "bash" } },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealant/sdk",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "description": "The fluent public SDK for Sealant — create a workspace, run a harness, replay the record.",
   "license": "Apache-2.0",
   "repository": {
@@ -26,7 +26,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@sealant/api-contracts": "^0.22.0"
+    "@sealant/api-contracts": "^0.23.0"
   },
   "devDependencies": {
     "@effect/vitest": "4.0.0-beta.85",