@sealant/sdk 0.26.1 → 0.28.0

package/README.md

@@ -122,7 +122,11 @@ const workspace = await sealant.workspaces.create({
 
 `services.docker` installs the Docker client in the image and starts a disposable, workspace-scoped
 rootless daemon at launch. The workspace receives `DOCKER_HOST`; Sealant never mounts the host
-Docker socket. GitHub credentials provide both `GH_TOKEN` and `GITHUB_TOKEN` to the workspace.
+Docker socket. On Kubernetes the daemon is a sidecar of a user-namespaced workspace Pod and the
+operator has to enable it (`workspaces.docker.enabled`); an install that cannot serve it refuses
+`create` with the stable code `workspace-docker-unsupported` (HTTP 422) — map that code to explain
+the gap beside your Docker switch instead of surfacing a launch failure later. GitHub credentials
+provide both `GH_TOKEN` and `GITHUB_TOKEN` to the workspace.
 
 ## Workspace environment variables
 

package/dist/effect/api-client.d.ts

@@ -1138,7 +1138,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly registryId: string;
             readonly repository: string;
             readonly tag: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceRuntimeEnvReferencesUnsupportedError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceDockerServiceUnsupportedError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceRuntimeEnvReferencesUnsupportedError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError), [Mode] extends ["response-only"] ? never : never>;
         readonly execWorkspace: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -2524,7 +2524,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly registryId: string;
             readonly repository: string;
             readonly tag: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceRuntimeEnvReferencesUnsupportedError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceDockerServiceUnsupportedError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceRuntimeEnvReferencesUnsupportedError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError), [Mode] extends ["response-only"] ? never : never>;
         readonly execWorkspace: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;

package/dist/effect/operations.d.ts

@@ -36,7 +36,7 @@ export declare const createWorkspaceOp: (payload: {
     readonly registryId: string;
     readonly repository: string;
     readonly tag: string;
-}, import("effect/unstable/http/HttpClientError").HttpClientError | import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceRuntimeEnvReferencesUnsupportedError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError, SealantApiClient>;
+}, import("effect/unstable/http/HttpClientError").HttpClientError | import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceDockerServiceUnsupportedError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceRuntimeEnvReferencesUnsupportedError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError, SealantApiClient>;
 export declare const getWorkspaceOp: (workspaceId: string, ownerUserId?: string | undefined) => Effect.Effect<{
     readonly workspaceId: string;
     readonly name: string;

package/dist/types.d.ts

@@ -103,18 +103,19 @@ export interface WorkspaceCredentialsOptions {
 }
 /**
  * A workspace sourced from a CALLER-OWNED host directory instead of a fresh clone. The platform
- * bind-mounts `path` as the workspace working directory and treats it as caller-owned: writes
- * persist across workspace stop/restart/expiry, and the path is never reprovisioned or deleted.
- * When `path` is a linked Git worktree, the SDK also binds its shared Git metadata at the absolute
- * path named by the worktree's `.git` pointer. The metadata remains caller-owned and host-backed;
- * no repository data is copied into container-owned storage.
+ * mounts `path` as the workspace working directory and treats it as caller-owned: writes persist
+ * across workspace stop/restart/expiry, and the path is never reprovisioned or deleted. In strict
+ * Docker volume mode this is the canonical absolute path visible inside the application and worker
+ * containers, not Docker's private host volume directory. When `path` is a linked Git worktree, the
+ * SDK also mounts its shared Git metadata at the absolute path named by the worktree's `.git`
+ * pointer. No repository data is copied into workspace-container-owned storage.
  * The install must allowlist the path's root (`SEALANT_MOUNT_ALLOWED_STORE_ROOTS`); paths
  * outside the allowlist are rejected at create. Credentials and dotfiles options compose
  * unchanged. Clone-based workspaces remain the right shape for independent verification.
  */
 export interface WorkspaceMountSource {
     readonly kind: "mount";
-    /** Absolute, normalized host path (no `..` segments). */
+    /** Absolute, normalized deployment path (no `..` segments); container-visible in volume mode. */
     readonly path: string;
 }
 /**
@@ -127,7 +128,7 @@ export interface WorkspaceMountSource {
  */
 export interface WorkspaceStandbySource {
     readonly kind: "standby";
-    /** Absolute, normalized host path of the root (no `..` segments). */
+    /** Absolute, normalized deployment root (no `..` segments); container-visible in volume mode. */
     readonly rootPath: string;
 }
 /**
@@ -139,7 +140,7 @@ export interface WorkspaceStandbySource {
  * never reprovisioned, never cleaned.
  */
 export interface WorkspaceExtraMount {
-    /** Absolute, normalized host path (no `..` segments). */
+    /** Absolute, normalized deployment path (no `..` segments); container-visible in volume mode. */
     readonly hostPath: string;
     /** Absolute container path to mount at, outside the working directory (e.g. `/workspace/ref/x`). */
     readonly mountPath: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealant/sdk",
-  "version": "0.26.1",
+  "version": "0.28.0",
   "description": "The fluent public SDK for Sealant — create a workspace, run a harness, replay the record.",
   "license": "Apache-2.0",
   "repository": {
@@ -26,7 +26,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@sealant/api-contracts": "^0.26.1"
+    "@sealant/api-contracts": "^0.28.0"
   },
   "devDependencies": {
     "@effect/vitest": "4.0.0-beta.85",