@sealant/sdk 0.23.0 → 0.24.0

package/dist/effect/api-client.d.ts

@@ -1122,7 +1122,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly registryId: string;
             readonly repository: string;
             readonly tag: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceRuntimeEnvReferencesUnsupportedError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError), [Mode] extends ["response-only"] ? never : never>;
         readonly execWorkspace: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -1190,7 +1190,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly repository?: string | undefined;
             readonly tag?: string | undefined;
             readonly runtime?: {
-                readonly adapter: "docker" | "k3s" | "k8s";
+                readonly adapter: "cloudflare" | "docker" | "k3s" | "k8s";
                 readonly resourceId: string;
                 readonly reference: string;
                 readonly status: "failed" | "pending" | "ready" | "running" | "stopped";
@@ -1225,7 +1225,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly workspaceId: string;
             readonly attemptId: string;
             readonly runtime: {
-                readonly adapter: "docker" | "k3s" | "k8s";
+                readonly adapter: "cloudflare" | "docker" | "k3s" | "k8s";
                 readonly resourceId: string;
                 readonly reference: string;
                 readonly status: "failed" | "pending" | "ready" | "running" | "stopped";
@@ -1248,7 +1248,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly triggerType: "api" | "manual" | "retry" | "schedule";
                 readonly triggerRef?: string | undefined;
                 readonly runtime?: {
-                    readonly adapter: "docker" | "k3s" | "k8s";
+                    readonly adapter: "cloudflare" | "docker" | "k3s" | "k8s";
                     readonly resourceId: string;
                     readonly reference: string;
                     readonly status: "failed" | "pending" | "ready" | "running" | "stopped";
@@ -1309,7 +1309,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly repository?: string | undefined;
                 readonly tag?: string | undefined;
                 readonly runtime?: {
-                    readonly adapter: "docker" | "k3s" | "k8s";
+                    readonly adapter: "cloudflare" | "docker" | "k3s" | "k8s";
                     readonly resourceId: string;
                     readonly reference: string;
                     readonly status: "failed" | "pending" | "ready" | "running" | "stopped";
@@ -2492,7 +2492,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly registryId: string;
             readonly repository: string;
             readonly tag: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceRuntimeEnvReferencesUnsupportedError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError), [Mode] extends ["response-only"] ? never : never>;
         readonly execWorkspace: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -2560,7 +2560,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly repository?: string | undefined;
             readonly tag?: string | undefined;
             readonly runtime?: {
-                readonly adapter: "docker" | "k3s" | "k8s";
+                readonly adapter: "cloudflare" | "docker" | "k3s" | "k8s";
                 readonly resourceId: string;
                 readonly reference: string;
                 readonly status: "failed" | "pending" | "ready" | "running" | "stopped";
@@ -2595,7 +2595,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly workspaceId: string;
             readonly attemptId: string;
             readonly runtime: {
-                readonly adapter: "docker" | "k3s" | "k8s";
+                readonly adapter: "cloudflare" | "docker" | "k3s" | "k8s";
                 readonly resourceId: string;
                 readonly reference: string;
                 readonly status: "failed" | "pending" | "ready" | "running" | "stopped";
@@ -2618,7 +2618,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly triggerType: "api" | "manual" | "retry" | "schedule";
                 readonly triggerRef?: string | undefined;
                 readonly runtime?: {
-                    readonly adapter: "docker" | "k3s" | "k8s";
+                    readonly adapter: "cloudflare" | "docker" | "k3s" | "k8s";
                     readonly resourceId: string;
                     readonly reference: string;
                     readonly status: "failed" | "pending" | "ready" | "running" | "stopped";
@@ -2679,7 +2679,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly repository?: string | undefined;
                 readonly tag?: string | undefined;
                 readonly runtime?: {
-                    readonly adapter: "docker" | "k3s" | "k8s";
+                    readonly adapter: "cloudflare" | "docker" | "k3s" | "k8s";
                     readonly resourceId: string;
                     readonly reference: string;
                     readonly status: "failed" | "pending" | "ready" | "running" | "stopped";

package/dist/effect/operations.d.ts

@@ -36,7 +36,7 @@ export declare const createWorkspaceOp: (payload: {
     readonly registryId: string;
     readonly repository: string;
     readonly tag: string;
-}, import("effect/unstable/http/HttpClientError").HttpClientError | import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError, SealantApiClient>;
+}, import("effect/unstable/http/HttpClientError").HttpClientError | import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceRuntimeEnvReferencesUnsupportedError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError, SealantApiClient>;
 export declare const getWorkspaceOp: (workspaceId: string, ownerUserId?: string | undefined) => Effect.Effect<{
     readonly workspaceId: string;
     readonly name: string;
@@ -46,7 +46,7 @@ export declare const getWorkspaceOp: (workspaceId: string, ownerUserId?: string
     readonly repository?: string | undefined;
     readonly tag?: string | undefined;
     readonly runtime?: {
-        readonly adapter: "docker" | "k3s" | "k8s";
+        readonly adapter: "cloudflare" | "docker" | "k3s" | "k8s";
         readonly resourceId: string;
         readonly reference: string;
         readonly status: "failed" | "pending" | "ready" | "running" | "stopped";
@@ -82,7 +82,7 @@ export declare const listWorkspacesOp: (query: {
         readonly repository?: string | undefined;
         readonly tag?: string | undefined;
         readonly runtime?: {
-            readonly adapter: "docker" | "k3s" | "k8s";
+            readonly adapter: "cloudflare" | "docker" | "k3s" | "k8s";
             readonly resourceId: string;
             readonly reference: string;
             readonly status: "failed" | "pending" | "ready" | "running" | "stopped";

package/dist/internal/blueprint.js

@@ -124,6 +124,12 @@ export const buildCreateWorkspaceRequest = (options, config) => {
                 })),
             }),
         ...(userEnv === undefined || Object.keys(userEnv).length === 0 ? {} : { userEnv }),
+        ...(options.envFrom === undefined || options.envFrom.length === 0
+            ? {}
+            : { envFrom: options.envFrom.map(({ kind, name }) => ({ kind, name })) }),
+        ...(options.kubernetes?.serviceAccountName === undefined
+            ? {}
+            : { kubernetes: { serviceAccountName: options.kubernetes.serviceAccountName } }),
     };
     const spec = {
         version: "1",

package/dist/types.d.ts

@@ -188,6 +188,12 @@ export interface WorkspaceServicesOptions {
      */
     readonly docker?: boolean;
 }
+/** One cluster env source: a Kubernetes object whose keys become workspace environment. */
+export interface WorkspaceEnvFromSource {
+    readonly kind: "secret" | "configmap";
+    /** Kubernetes object name (DNS-1123 subdomain) in the platform's workspaces namespace. */
+    readonly name: string;
+}
 export interface CreateOptions {
     /**
      * Source git repository to build the workspace around (e.g. `"github.com/acme/billing-service"`).
@@ -255,6 +261,31 @@ export interface CreateOptions {
      * instead). Docker runtime only.
      */
     readonly secretEnv?: Readonly<Record<string, string>>;
+    /**
+     * Cluster env sources — Kubernetes runtimes only. Each entry names one Kubernetes `Secret` or
+     * `ConfigMap` in the platform's workspaces namespace whose KEYS become workspace environment,
+     * resolved by the platform worker at workspace creation (a launch keeps its snapshot across
+     * container restarts; rotation reaches only later launches). Ordered, last wins across kinds.
+     * Only objects the operator opted in with the `sealant.sh/workspace-env: "true"` label
+     * resolve; platform-managed objects are refused unconditionally. Explicit `env` / `secretEnv`
+     * and platform-owned names always win over bound keys; bound Secret values ride the transient
+     * secret channel and are masked in captured output. On a deployment whose workspaces do not
+     * run on Kubernetes, create is refused synchronously with the stable error code
+     * `runtime-env-references-unsupported` — no workspace is created.
+     */
+    readonly envFrom?: readonly WorkspaceEnvFromSource[];
+    /**
+     * Kubernetes-runtime-only settings. `serviceAccountName` is an explicit TRUST GRANT: the
+     * workspace Pod runs under it, and with IRSA / Workload Identity the session agent holds that
+     * role's full permissions for the whole session — bind a least-privilege role intended for
+     * untrusted code. Honored only against the install's allowlist
+     * (`SEALANT_K8S_ALLOWED_WORKSPACE_SERVICE_ACCOUNTS`); other names fail the launch readable.
+     * The Kubernetes API token is never automounted regardless. Non-Kubernetes deployments refuse
+     * at create time with `runtime-env-references-unsupported`.
+     */
+    readonly kubernetes?: {
+        readonly serviceAccountName?: string;
+    };
     /** Runtime-managed services that need more than installing an OS package. */
     readonly services?: WorkspaceServicesOptions;
     /** When true (default), resolve only once the workspace runtime is live. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealant/sdk",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "description": "The fluent public SDK for Sealant — create a workspace, run a harness, replay the record.",
   "license": "Apache-2.0",
   "repository": {
@@ -26,7 +26,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@sealant/api-contracts": "^0.23.0"
+    "@sealant/api-contracts": "^0.24.0"
   },
   "devDependencies": {
     "@effect/vitest": "4.0.0-beta.85",