@sealant/sdk 0.5.2 → 0.7.1

package/dist/client.d.ts

@@ -1,4 +1,4 @@
-import type { CreateOptions, InferenceNamespace, ListOptions, Run, Workspace, SealantConfig } from "./types.js";
+import type { AccessTokensNamespace, CreateOptions, InferenceNamespace, ListOptions, Run, Workspace, SealantConfig } from "./types.js";
 export declare class Sealant {
     #private;
     constructor(config: SealantConfig);
@@ -15,6 +15,13 @@ export declare class Sealant {
      * calls. Tool calls park server-side; execute them here and `respond()` with the results.
      */
     readonly inference: InferenceNamespace;
+    /**
+     * Scoped bearer tokens for the session surface — `session:read` / `session:input` /
+     * `workspace:exec`. The returned secret is shown once; hand it to a client as its `apiKey` and
+     * the session endpoints enforce exactly those scopes (a read-stream token can stream but is
+     * rejected for input and exec).
+     */
+    readonly accessTokens: AccessTokensNamespace;
     /** Runs by id — so a record can be replayed long after its workspace is gone. */
     readonly runs: {
         get: (runId: string) => Promise<Run>;

package/dist/client.js

@@ -10,7 +10,7 @@
  * stable surface and reject with `SealantNotImplementedError` so callers can compile and wire
  * against the final shape today.
  */
-import { createWorkspaceOp, getRunOp, getWorkspaceOp, inferenceRespondOp, listWorkspacesOp, } from "./effect/operations.js";
+import { createAccessTokenOp, createWorkspaceOp, getRunOp, getWorkspaceOp, inferenceRespondOp, listWorkspacesOp, } from "./effect/operations.js";
 import { runHarness, startHarness } from "./effect/run-harness.js";
 import { makeSdkRuntime } from "./effect/runtime.js";
 import { SealantError } from "./errors.js";
@@ -18,6 +18,7 @@ import { makeRun } from "./facade/run.js";
 import { makeWorkspace, registerHarnessExecutors } from "./facade/workspace.js";
 import { buildCreateWorkspaceRequest } from "./internal/blueprint.js";
 import { resolveInternalConfig } from "./internal/config.js";
+import { parseTtlSeconds } from "./internal/duration.js";
 import { buildInferenceRespondRequest, mapInferenceResponse } from "./internal/inference.js";
 // Wire the run-execution implementations into the Workspace facade (the injection point exists to
 // break the workspace <-> run-harness import cycle; the client is the composition root).
@@ -102,6 +103,30 @@ export class Sealant {
             return mapInferenceResponse(wire);
         },
     };
+    /**
+     * Scoped bearer tokens for the session surface — `session:read` / `session:input` /
+     * `workspace:exec`. The returned secret is shown once; hand it to a client as its `apiKey` and
+     * the session endpoints enforce exactly those scopes (a read-stream token can stream but is
+     * rejected for input and exec).
+     */
+    accessTokens = {
+        create: async (options) => {
+            const wire = await this.#runtime.run(createAccessTokenOp({
+                ownerUserId: this.#ctx.config.hostLocal.ownerUserId,
+                scopes: [...options.scopes],
+                ...(options.name === undefined ? {} : { name: options.name }),
+                ...(options.workspaceId === undefined ? {} : { workspaceId: options.workspaceId }),
+                ...(options.ttl === undefined ? {} : { ttlSeconds: parseTtlSeconds(options.ttl) }),
+            }));
+            return {
+                tokenId: wire.tokenId,
+                token: wire.token,
+                scopes: [...wire.scopes],
+                ...(wire.workspaceId === undefined ? {} : { workspaceId: wire.workspaceId }),
+                ...(wire.expiresAt === undefined ? {} : { expiresAt: wire.expiresAt }),
+            };
+        },
+    };
     /** Runs by id — so a record can be replayed long after its workspace is gone. */
     runs = {
         get: async (runId) => {