@sealant/sdk 0.8.1 → 0.10.0

package/dist/internal/blueprint.js

@@ -55,6 +55,16 @@ export const buildCreateWorkspaceRequest = (options, config) => {
                     ...(options.ref === undefined ? {} : { ref: options.ref }),
                 }
                 : { kind: "mount", hostPath: options.source?.path },
+            ...(options.mounts === undefined || options.mounts.length === 0
+                ? {}
+                : {
+                    mounts: options.mounts.map((mount) => ({
+                        hostPath: mount.hostPath,
+                        mountPath: mount.mountPath,
+                        // Omitted = the blueprint's default (read-only). Only an explicit choice is sent.
+                        ...(mount.readOnly === undefined ? {} : { readOnly: mount.readOnly }),
+                    })),
+                }),
         },
         harness: { id: options.harness.id },
         customization: { enableSealantd: true },

package/dist/types.d.ts

@@ -94,7 +94,7 @@ export interface WorkspaceCredentialsOptions {
  * A workspace sourced from a CALLER-OWNED host directory instead of a fresh clone. The platform
  * bind-mounts `path` as the workspace working directory and treats it as caller-owned: writes
  * persist across workspace stop/restart/expiry, and the path is never reprovisioned or deleted.
- * The install must allowlist the path's root (`SEALANT_WORKSPACE_MOUNT_ALLOWED_ROOTS`); paths
+ * The install must allowlist the path's root (`SEALANT_MOUNT_ALLOWED_STORE_ROOTS`); paths
  * outside the allowlist are rejected at create. Credentials and dotfiles options compose
  * unchanged. Clone-based workspaces remain the right shape for independent verification.
  */
@@ -103,6 +103,22 @@ export interface WorkspaceMountSource {
     /** Absolute, normalized host path (no `..` segments). */
     readonly path: string;
 }
+/**
+ * An ADDITIONAL caller-owned host directory bind-mounted beside the primary source — sibling
+ * repositories, reference clones, scratch material the workspace should see without adopting.
+ * Read-only by default: extra mounts widen what the workspace can see, not where its work product
+ * lands. Same allowlist as mount sources (`SEALANT_MOUNT_ALLOWED_STORE_ROOTS`); the container path
+ * must not overlap the working directory. Like the primary mount, the host path is caller-owned —
+ * never reprovisioned, never cleaned.
+ */
+export interface WorkspaceExtraMount {
+    /** Absolute, normalized host path (no `..` segments). */
+    readonly hostPath: string;
+    /** Absolute container path to mount at, outside the working directory (e.g. `/workspace/ref/x`). */
+    readonly mountPath: string;
+    /** Defaults to `true`. Pass `false` deliberately — writes to extra mounts are unrecorded. */
+    readonly readOnly?: boolean;
+}
 export interface CreateOptions {
     /**
      * Source git repository to build the workspace around (e.g. `"github.com/acme/billing-service"`).
@@ -111,6 +127,8 @@ export interface CreateOptions {
     readonly repository?: string;
     /** Alternative to `repository`: source the workspace from a caller-owned mount. */
     readonly source?: WorkspaceMountSource;
+    /** Additional read-only-by-default mounts beside the primary source (see `WorkspaceExtraMount`). */
+    readonly mounts?: readonly WorkspaceExtraMount[];
     /** The harness to run inside the workspace. */
     readonly harness: Harness;
     /** Git ref to check out (defaults to the repository's default branch; `repository` only). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealant/sdk",
-  "version": "0.8.1",
+  "version": "0.10.0",
   "description": "The fluent public SDK for Sealant — create a workspace, run a harness, replay the record.",
   "license": "Apache-2.0",
   "repository": {
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "effect": "^4.0.0-beta.85",
-    "@sealant/api-contracts": "^0.8.1"
+    "@sealant/api-contracts": "^0.10.0"
   },
   "devDependencies": {
     "@effect/vitest": "^4.0.0-beta.85",