@sealant/sdk 0.24.1 → 0.25.1

package/dist/client.d.ts

@@ -1,4 +1,4 @@
-import type { AccessTokensNamespace, ConnectedAccountsNamespace, CreateOptions, InferenceNamespace, ListOptions, Run, Workspace, SealantConfig, UsersNamespace } from "./types.js";
+import type { AccessTokensNamespace, ConnectedAccountsNamespace, CreateOptions, InferenceNamespace, ListOptions, Run, SshKeysNamespace, Workspace, WorkspaceSshNamespace, SealantConfig, UsersNamespace } from "./types.js";
 export declare class Sealant {
     #private;
     constructor(config: SealantConfig);
@@ -25,6 +25,17 @@ export declare class Sealant {
     readonly users: UsersNamespace;
     /** This client's owner's Claude / Codex / GitHub accounts. Secrets go in; none come out. */
     readonly connectedAccounts: ConnectedAccountsNamespace;
+    /**
+     * Where workspace SSH connects for this deployment — how an editor (VS Code Remote-SSH) or
+     * plain `ssh` reaches a workspace. Destination: `<usernamePrefix>-<workspaceId>@<host>:<port>`;
+     * the gateway authorizes each connection from the offered key's owning account.
+     */
+    readonly workspaceSsh: WorkspaceSshNamespace;
+    /**
+     * The owner's SSH public keys — what the workspace SSH gateway resolves a connection to.
+     * `ensure` is idempotent: re-offering the same key returns the existing row.
+     */
+    readonly sshKeys: SshKeysNamespace;
     readonly accessTokens: AccessTokensNamespace;
     /** Runs by id — so a record can be replayed long after its workspace is gone. */
     readonly runs: {

package/dist/client.js

@@ -1,4 +1,4 @@
-import { archiveConnectedAccountOp, createAccessTokenOp, createConnectedAccountOp, createWorkspaceOp, ensureUserOp, getRunOp, getUserOp, getWorkspaceOp, inferenceRespondOp, listConnectedAccountsOp, listWorkspacesOp, } from "./effect/operations.js";
+import { archiveConnectedAccountOp, archiveSshKeyOp, createAccessTokenOp, createConnectedAccountOp, createSshKeyOp, createWorkspaceOp, ensureUserOp, getRunOp, getSetupStateOp, getUserOp, getWorkspaceOp, inferenceRespondOp, listConnectedAccountsOp, listSshKeysOp, listWorkspacesOp, } from "./effect/operations.js";
 import { runHarness, startHarness } from "./effect/run-harness.js";
 import { makeSdkRuntime } from "./effect/runtime.js";
 import { SealantError } from "./errors.js";
@@ -8,6 +8,7 @@ import { buildCreateWorkspaceRequest } from "./internal/blueprint.js";
 import { resolveInternalConfig } from "./internal/config.js";
 import { parseTtlSeconds } from "./internal/duration.js";
 import { buildInferenceRespondRequest, mapInferenceResponse } from "./internal/inference.js";
+import { mapSshKey, mapWorkspaceSshInfo } from "./internal/ssh.js";
 const mapConnectedAccount = (wire) => ({
     connectedAccountId: wire.connectedAccountId,
     ownerUserId: wire.ownerUserId,
@@ -151,6 +152,33 @@ export class Sealant {
             return mapConnectedAccount(wire);
         },
     };
+    /**
+     * Where workspace SSH connects for this deployment — how an editor (VS Code Remote-SSH) or
+     * plain `ssh` reaches a workspace. Destination: `<usernamePrefix>-<workspaceId>@<host>:<port>`;
+     * the gateway authorizes each connection from the offered key's owning account.
+     */
+    workspaceSsh = {
+        info: async () => {
+            const wire = await this.#runtime.run(getSetupStateOp());
+            return mapWorkspaceSshInfo(wire);
+        },
+    };
+    /**
+     * The owner's SSH public keys — what the workspace SSH gateway resolves a connection to.
+     * `ensure` is idempotent: re-offering the same key returns the existing row.
+     */
+    sshKeys = {
+        ensure: async (options) => mapSshKey(await this.#runtime.run(createSshKeyOp({
+            ownerUserId: this.#ctx.config.hostLocal.ownerUserId,
+            publicKey: options.publicKey,
+            ...(options.name === undefined ? {} : { name: options.name }),
+        }))),
+        list: async () => {
+            const wire = await this.#runtime.run(listSshKeysOp(this.#ctx.config.hostLocal.ownerUserId));
+            return wire.items.map(mapSshKey);
+        },
+        remove: async (sshKeyId) => mapSshKey(await this.#runtime.run(archiveSshKeyOp(sshKeyId, this.#ctx.config.hostLocal.ownerUserId))),
+    };
     accessTokens = {
         create: async (options) => {
             const wire = await this.#runtime.run(createAccessTokenOp({

package/dist/effect/operations.d.ts

@@ -607,3 +607,41 @@ export declare const inferenceRespondOp: (payload: {
         readonly outputTokens: number;
     } | undefined;
 }, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").InferenceBadRequestError | import("@sealant/api-contracts").InferenceConflictError | import("@sealant/api-contracts").InferenceInternalServerError | import("@sealant/api-contracts").InferenceNotFoundError | import("@sealant/api-contracts").InferenceUnavailableError | import("effect/Schema").SchemaError, SealantApiClient>;
+export declare const getSetupStateOp: () => Effect.Effect<{
+    readonly needsSetup: boolean;
+    readonly sshGateway: {
+        readonly host: string;
+        readonly port: number;
+        readonly usernamePrefix: string;
+    } | null;
+}, import("effect/unstable/http/HttpClientError").HttpClientError | import("effect/Schema").SchemaError | import("@sealant/api-contracts").SystemInternalServerError, SealantApiClient>;
+export declare const createSshKeyOp: (payload: {
+    readonly ownerUserId: string;
+    readonly name?: string | undefined;
+    readonly publicKey: string;
+}) => Effect.Effect<{
+    readonly sshKeyId: string;
+    readonly ownerUserId: string;
+    readonly name: string;
+    readonly algorithm: string;
+    readonly fingerprint: string;
+    readonly createdAt: string;
+}, import("effect/unstable/http/HttpClientError").HttpClientError | import("effect/Schema").SchemaError | import("@sealant/api-contracts").SshKeyBadRequestError | import("@sealant/api-contracts").SshKeyConflictError | import("@sealant/api-contracts").SshKeyInternalServerError | import("@sealant/api-contracts").SshKeyNotFoundError, SealantApiClient>;
+export declare const listSshKeysOp: (ownerUserId: string) => Effect.Effect<{
+    readonly items: readonly {
+        readonly sshKeyId: string;
+        readonly ownerUserId: string;
+        readonly name: string;
+        readonly algorithm: string;
+        readonly fingerprint: string;
+        readonly createdAt: string;
+    }[];
+}, import("effect/unstable/http/HttpClientError").HttpClientError | import("effect/Schema").SchemaError | import("@sealant/api-contracts").SshKeyInternalServerError, SealantApiClient>;
+export declare const archiveSshKeyOp: (sshKeyId: string, ownerUserId: string) => Effect.Effect<{
+    readonly sshKeyId: string;
+    readonly ownerUserId: string;
+    readonly name: string;
+    readonly algorithm: string;
+    readonly fingerprint: string;
+    readonly createdAt: string;
+}, import("effect/unstable/http/HttpClientError").HttpClientError | import("effect/Schema").SchemaError | import("@sealant/api-contracts").SshKeyInternalServerError | import("@sealant/api-contracts").SshKeyNotFoundError, SealantApiClient>;

package/dist/effect/operations.js

@@ -51,3 +51,9 @@ export const archiveConnectedAccountOp = (connectedAccountId, ownerUserId) => Ef
 }));
 // ---- inference ----
 export const inferenceRespondOp = (payload) => Effect.flatMap(SealantApiClient, (client) => client.inference.respond({ payload }));
+// ---- system ----
+export const getSetupStateOp = () => Effect.flatMap(SealantApiClient, (client) => client.system.getSetupState({}));
+// ---- ssh keys ----
+export const createSshKeyOp = (payload) => Effect.flatMap(SealantApiClient, (client) => client.sshKeys.createSshKey({ payload }));
+export const listSshKeysOp = (ownerUserId) => Effect.flatMap(SealantApiClient, (client) => client.sshKeys.listSshKeys({ query: { ownerUserId } }));
+export const archiveSshKeyOp = (sshKeyId, ownerUserId) => Effect.flatMap(SealantApiClient, (client) => client.sshKeys.archiveSshKey({ params: { sshKeyId }, query: { ownerUserId } }));

package/dist/internal/ssh.d.ts

@@ -0,0 +1,17 @@
+import type { SshKey, WorkspaceSshInfo } from "../types.js";
+export declare const mapWorkspaceSshInfo: (wire: {
+    readonly needsSetup: boolean;
+    readonly sshGateway: {
+        readonly host: string;
+        readonly port: number;
+        readonly usernamePrefix: string;
+    } | null;
+}) => WorkspaceSshInfo | null;
+export declare const mapSshKey: (wire: {
+    readonly sshKeyId: string;
+    readonly ownerUserId: string;
+    readonly name: string;
+    readonly algorithm: string;
+    readonly fingerprint: string;
+    readonly createdAt: string;
+}) => SshKey;

package/dist/internal/ssh.js

@@ -0,0 +1,15 @@
+export const mapWorkspaceSshInfo = (wire) => wire.sshGateway === null
+    ? null
+    : {
+        host: wire.sshGateway.host,
+        port: wire.sshGateway.port,
+        usernamePrefix: wire.sshGateway.usernamePrefix,
+    };
+export const mapSshKey = (wire) => ({
+    sshKeyId: wire.sshKeyId,
+    ownerUserId: wire.ownerUserId,
+    name: wire.name,
+    algorithm: wire.algorithm,
+    fingerprint: wire.fingerprint,
+    createdAt: wire.createdAt,
+});

package/dist/types.d.ts

@@ -996,3 +996,45 @@ export interface ConnectedAccountsNamespace {
     /** Soft-archives the account; uniform not-found for "does not exist" and "not yours". */
     disconnect(connectedAccountId: string): Promise<ConnectedAccount>;
 }
+/** Connect coordinates for the deployment's workspace SSH gateway. */
+export interface WorkspaceSshInfo {
+    readonly host: string;
+    readonly port: number;
+    /** The SSH username is `<usernamePrefix>-<workspaceId>`; the key names the account. */
+    readonly usernamePrefix: string;
+}
+/**
+ * Where workspace SSH connects for this deployment. Consumers build the destination
+ * `<usernamePrefix>-<workspaceId>@<host>:<port>` themselves — nothing here is secret; the
+ * gateway authorizes each connection from the offered key's owning account.
+ */
+export interface WorkspaceSshNamespace {
+    /** Gateway connect coordinates, or null when the deployment exposes no workspace SSH gateway. */
+    info(): Promise<WorkspaceSshInfo | null>;
+}
+/** A registered SSH public key as every surface sees it — never carries the key material back. */
+export interface SshKey {
+    readonly sshKeyId: string;
+    readonly ownerUserId: string;
+    readonly name: string;
+    readonly algorithm: string;
+    readonly fingerprint: string;
+    readonly createdAt: string;
+}
+export interface EnsureSshKeyOptions {
+    /** Raw `<algorithm> <base64> [comment]` line; normalized and fingerprinted server-side. */
+    readonly publicKey: string;
+    /** Display name; defaults to the key comment, else `<algorithm> <fingerprint prefix>`. */
+    readonly name?: string;
+}
+/**
+ * The owner's SSH public keys — what the workspace SSH gateway resolves a connection to.
+ * `ensure` is idempotent per owner: re-offering the same key returns the existing row; a key
+ * active on another account is refused (active fingerprints are globally unique).
+ */
+export interface SshKeysNamespace {
+    ensure(options: EnsureSshKeyOptions): Promise<SshKey>;
+    list(): Promise<readonly SshKey[]>;
+    /** Archives the key; the gateway stops resolving it. */
+    remove(sshKeyId: string): Promise<SshKey>;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealant/sdk",
-  "version": "0.24.1",
+  "version": "0.25.1",
   "description": "The fluent public SDK for Sealant — create a workspace, run a harness, replay the record.",
   "license": "Apache-2.0",
   "repository": {
@@ -26,7 +26,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@sealant/api-contracts": "^0.24.1"
+    "@sealant/api-contracts": "^0.25.1"
   },
   "devDependencies": {
     "@effect/vitest": "4.0.0-beta.85",