@sealant/sdk 0.25.2 → 0.26.0

package/dist/effect/api-client.d.ts

@@ -1080,6 +1080,22 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
         }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").UserInternalServerError | import("@sealant/api-contracts").UserNotFoundError), [Mode] extends ["response-only"] ? never : never>;
     };
     readonly workspaces: {
+        readonly bindWorkspace: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
+            readonly params: {
+                readonly workspaceId: string;
+            };
+            readonly payload: {
+                readonly ownerUserId: string;
+                readonly mountPath?: string | undefined;
+                readonly subpath: string;
+            };
+            readonly responseMode?: Mode;
+        }) => Effect.Effect<HttpApiClient.Client.Response<{
+            readonly binds: readonly {
+                readonly mountPath: string;
+                readonly subpath: string;
+            }[];
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly createWorkspace: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly headers: {
                 readonly "idempotency-key"?: string | undefined;
@@ -2450,6 +2466,22 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
         }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").UserInternalServerError | import("@sealant/api-contracts").UserNotFoundError), [Mode] extends ["response-only"] ? never : never>;
     };
     readonly workspaces: {
+        readonly bindWorkspace: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
+            readonly params: {
+                readonly workspaceId: string;
+            };
+            readonly payload: {
+                readonly ownerUserId: string;
+                readonly mountPath?: string | undefined;
+                readonly subpath: string;
+            };
+            readonly responseMode?: Mode;
+        }) => Effect.Effect<HttpApiClient.Client.Response<{
+            readonly binds: readonly {
+                readonly mountPath: string;
+                readonly subpath: string;
+            }[];
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly createWorkspace: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly headers: {
                 readonly "idempotency-key"?: string | undefined;

package/dist/effect/operations.d.ts

@@ -135,6 +135,16 @@ export declare const execWorkspaceOp: (workspaceId: string, payload: {
     readonly createdAt: string;
     readonly updatedAt: string;
 }, import("effect/unstable/http/HttpClientError").HttpClientError | import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError, SealantApiClient>;
+export declare const bindWorkspaceOp: (workspaceId: string, payload: {
+    readonly ownerUserId: string;
+    readonly mountPath?: string | undefined;
+    readonly subpath: string;
+}) => Effect.Effect<{
+    readonly binds: readonly {
+        readonly mountPath: string;
+        readonly subpath: string;
+    }[];
+}, import("effect/unstable/http/HttpClientError").HttpClientError | import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError, SealantApiClient>;
 export declare const stopWorkspaceOp: (workspaceId: string, payload: {
     readonly ownerUserId: string;
 }) => Effect.Effect<{

package/dist/effect/operations.js

@@ -11,6 +11,7 @@ export const getWorkspaceOp = (workspaceId, ownerUserId) => Effect.flatMap(Seala
 }));
 export const listWorkspacesOp = (query) => Effect.flatMap(SealantApiClient, (client) => client.workspaces.listWorkspaces({ query }));
 export const execWorkspaceOp = (workspaceId, payload) => Effect.flatMap(SealantApiClient, (client) => client.workspaces.execWorkspace({ params: { workspaceId }, payload }));
+export const bindWorkspaceOp = (workspaceId, payload) => Effect.flatMap(SealantApiClient, (client) => client.workspaces.bindWorkspace({ params: { workspaceId }, payload }));
 export const stopWorkspaceOp = (workspaceId, payload) => Effect.flatMap(SealantApiClient, (client) => client.workspaces.stopWorkspace({ params: { workspaceId }, payload }));
 export const restartWorkspaceOp = (workspaceId, payload) => Effect.flatMap(SealantApiClient, (client) => client.workspaces.restartWorkspace({ params: { workspaceId }, payload }));
 export const expireWorkspaceOp = (workspaceId, payload) => Effect.flatMap(SealantApiClient, (client) => client.workspaces.expireWorkspace({ params: { workspaceId }, payload }));

package/dist/facade/workspace.js

@@ -1,5 +1,5 @@
 import { execWorkspace } from "../effect/exec-workspace.js";
-import { createSessionOp, expireWorkspaceOp, getSessionOp, getWorkspaceOp, listSessionsOp, restartWorkspaceOp, stopWorkspaceOp, } from "../effect/operations.js";
+import { bindWorkspaceOp, createSessionOp, expireWorkspaceOp, getSessionOp, getWorkspaceOp, listSessionsOp, restartWorkspaceOp, stopWorkspaceOp, } from "../effect/operations.js";
 import { SealantError, SealantNotImplementedError } from "../errors.js";
 import { parseTtlSeconds } from "../internal/duration.js";
 import { makeInteractiveSession } from "./session.js";
@@ -120,6 +120,14 @@ export const makeWorkspace = (ctx, init) => {
         harness,
         sessions,
         exec: (argv, options) => execWorkspace(ctx, init, argv, options),
+        bind: async (options) => {
+            const result = await ctx.runtime.run(bindWorkspaceOp(init.id, {
+                ownerUserId: ctx.config.hostLocal.ownerUserId,
+                ...(options.mountPath === undefined ? {} : { mountPath: options.mountPath }),
+                subpath: options.subpath,
+            }));
+            return result.binds.map((bind) => ({ mountPath: bind.mountPath, subpath: bind.subpath }));
+        },
         // Poll-backed lifecycle stream: emit a coarse event on each status transition until the workspace
         // reaches a terminal/ready state. Swaps to SSE over Postgres LISTEN/NOTIFY in Stage 5 (same shape).
         events: () => {

package/dist/internal/blueprint.js

@@ -2,7 +2,9 @@
  * Lowers the fluent `create({ repository, harness })` options into the existing
  * `createWorkspaceRequestSchema` the control plane accepts — entirely client-side, so the slice needs
  * no contract change. The public `repository` is the SOURCE git repo (it becomes
- * `spec.sources.workspace.url`); the contract's `repository`/`tag` are the OCI push coordinates, which
+ * `spec.sources.workspace.url`); the contract's `repository`/`tag` name the create for the build
+ * job's own records — the worker publishes the image under plan-keyed coordinates (one repository
+ * per OS family, one tag per plan hash), so this name never reaches the registry — and
  * we derive. `customization.enableSealantd` is forced on (it bakes + launches the daemon the run path
  * connects to), the runtime target is `auto` (the deployment's default adapter — Docker on self-host, Kubernetes
  * when the worker is configured for a cluster), and the
@@ -54,13 +56,17 @@ export const buildCreateWorkspaceRequest = (options, config) => {
         (options.dotfiles.archives === undefined || options.dotfiles.archives.length === 0)) {
         throw new SealantError("`dotfiles` requires a `repository`, at least one entry in `archives`, or both.", { code: "invalid_create_options" });
     }
-    const sourceName = options.repository ?? options.source?.path ?? "workspace";
+    const sourceName = options.repository ??
+        (options.source?.kind === "standby" ? options.source.rootPath : options.source?.path) ??
+        "workspace";
     const tail = sourceName
         .split("/")
         .filter((s) => s.length > 0)
         .pop() ?? sourceName;
     const credentials = mapWorkspaceCredentials(options.credentials);
-    const linkedWorktreeMount = options.source === undefined ? null : discoverLinkedWorktreeMetadataMount(options.source.path);
+    const linkedWorktreeMount = options.source === undefined || options.source.kind === "standby"
+        ? null
+        : discoverLinkedWorktreeMetadataMount(options.source.path);
     const explicitMounts = options.mounts ?? [];
     const existingMetadataMount = linkedWorktreeMount === null
         ? undefined
@@ -142,7 +148,9 @@ export const buildCreateWorkspaceRequest = (options, config) => {
                     // Omitted ref = the repository's default branch, resolved by the clone itself.
                     ...(options.ref === undefined ? {} : { ref: options.ref }),
                 }
-                : { kind: "mount", hostPath: options.source?.path },
+                : options.source?.kind === "standby"
+                    ? { kind: "standby", rootPath: options.source.rootPath }
+                    : { kind: "mount", hostPath: options.source?.path },
             ...(dotfilesRepository === undefined
                 ? {}
                 : {
@@ -166,6 +174,7 @@ export const buildCreateWorkspaceRequest = (options, config) => {
                         mountPath: mount.mountPath,
                         // Omitted = the blueprint's default (read-only). Only an explicit choice is sent.
                         ...(mount.readOnly === undefined ? {} : { readOnly: mount.readOnly }),
+                        ...(mount.bindable === undefined ? {} : { bindable: mount.bindable }),
                     })),
                 }),
         },

package/dist/internal/linked-worktree.d.ts

@@ -2,6 +2,7 @@ export interface LinkedWorktreeMetadataMount {
     readonly hostPath: string;
     readonly mountPath: string;
     readonly readOnly: false;
+    readonly bindable?: false;
 }
 /**
  * A linked Git worktree carries a `.git` POINTER FILE rather than its repository metadata. Docker

package/dist/types.d.ts

@@ -117,6 +117,19 @@ export interface WorkspaceMountSource {
     /** Absolute, normalized host path (no `..` segments). */
     readonly path: string;
 }
+/**
+ * A STANDBY workspace (sealantd ADR-0014): the caller-owned ROOT directory — a project's
+ * worktrees directory — is mounted hidden, and the working directory does not exist until
+ * `workspace.bind({ subpath })` points it at one of the root's subdirectories. This is what lets a
+ * pool of ready workspaces serve ANY worktree of a project, and lets one workspace be re-pointed.
+ * Same allowlist as a mount source. The worktrees' shared git metadata (the bare repository the
+ * `.git` files point at) must ride as an explicit extra mount at its own absolute path.
+ */
+export interface WorkspaceStandbySource {
+    readonly kind: "standby";
+    /** Absolute, normalized host path of the root (no `..` segments). */
+    readonly rootPath: string;
+}
 /**
  * An ADDITIONAL caller-owned host directory bind-mounted beside the primary source — sibling
  * repositories, reference clones, scratch material the workspace should see without adopting.
@@ -132,6 +145,23 @@ export interface WorkspaceExtraMount {
     readonly mountPath: string;
     /** Defaults to `true`. Pass `false` deliberately — writes to extra mounts are unrecorded. */
     readonly readOnly?: boolean;
+    /**
+     * Bindable (sealantd ADR-0014): `hostPath` is a ROOT mounted hidden, and `mountPath` becomes a
+     * symlink `workspace.bind({ mountPath, subpath })` points at one of the root's subdirectories.
+     * A sibling repository's worktrees directory, bound to one worktree at first use.
+     */
+    readonly bindable?: boolean;
+}
+/** One live binding: `mountPath` points at `<root>/<subpath>`. */
+export interface WorkspaceBind {
+    readonly mountPath: string;
+    readonly subpath: string;
+}
+export interface WorkspaceBindOptions {
+    /** The bindable mount to point; defaults to the working directory (a standby source). */
+    readonly mountPath?: string;
+    /** Relative path under the mount's root; an empty string unbinds. */
+    readonly subpath: string;
 }
 /** How a dotfiles tree is applied inside the workspace. */
 export type WorkspaceDotfilesManager = "auto" | "chezmoi" | "stow" | "copy";
@@ -200,8 +230,8 @@ export interface CreateOptions {
      * Exactly one of `repository` or `source` must be provided.
      */
     readonly repository?: string;
-    /** Alternative to `repository`: source the workspace from a caller-owned mount. */
-    readonly source?: WorkspaceMountSource;
+    /** Alternative to `repository`: source the workspace from a caller-owned mount, or a standby root. */
+    readonly source?: WorkspaceMountSource | WorkspaceStandbySource;
     /** Additional read-only-by-default mounts beside the primary source (see `WorkspaceExtraMount`). */
     readonly mounts?: readonly WorkspaceExtraMount[];
     /** The harness to run inside the workspace. */
@@ -341,6 +371,12 @@ export interface Workspace {
      * run record like any other process. `argv[0]` is the executable, the rest its arguments.
      */
     exec(argv: readonly string[], options?: WorkspaceExecOptions): Promise<WorkspaceExecResult>;
+    /**
+     * Point a standby working directory, or a bindable extra mount, at one subdirectory of its root
+     * (sealantd ADR-0014). Synchronous: resolves once the daemon applied it. Returns every live
+     * binding, which each relaunch re-applies.
+     */
+    bind(options: WorkspaceBindOptions): Promise<readonly WorkspaceBind[]>;
     /** Interactive PTY sessions: open new ones, reattach to existing ones by id. */
     readonly sessions: WorkspaceSessions;
     /** Lifecycle events as an async stream. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealant/sdk",
-  "version": "0.25.2",
+  "version": "0.26.0",
   "description": "The fluent public SDK for Sealant — create a workspace, run a harness, replay the record.",
   "license": "Apache-2.0",
   "repository": {
@@ -26,7 +26,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@sealant/api-contracts": "^0.25.2"
+    "@sealant/api-contracts": "^0.26.0"
   },
   "devDependencies": {
     "@effect/vitest": "4.0.0-beta.85",