@sealant/api-contracts-next 0.0.0-next.0 → 0.39.0-next.682

package/dist/core-api/connected-accounts.d.ts

@@ -0,0 +1,226 @@
+import { Schema } from "effect";
+import { HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi";
+export declare const connectedAccountProviderSchema: Schema.Literals<readonly ["claude", "codex", "github"]>;
+export type ConnectedAccountProvider = typeof connectedAccountProviderSchema.Type;
+export declare const connectedAccountStatusSchema: Schema.Literals<readonly ["active", "invalid", "archived"]>;
+export type ConnectedAccountStatus = typeof connectedAccountStatusSchema.Type;
+/**
+ * What the control plane observed about a credential's life, so a consumer can say "expired" as an
+ * observation instead of parsing a payload it must never see. Every field is null when nothing was
+ * observed: a setup token has no expiry, a row connected before this shipped has no stored one, and
+ * an account that has never been swept has no refresh outcome.
+ */
+export declare const connectedAccountCredentialSchema: Schema.Struct<{
+    /** When the access token expires. Hours, for a Claude session credential. */
+    readonly accessExpiresAt: Schema.NullOr<Schema.String>;
+    /** When the grant itself expires, after which reconnecting is the only way back. */
+    readonly refreshExpiresAt: Schema.NullOr<Schema.String>;
+    /** When the platform last rotated or checked this credential. */
+    readonly lastRefreshAt: Schema.NullOr<Schema.String>;
+    /** What that attempt did: `refreshed`, `fresh` (nothing to do), or `failed`. */
+    readonly lastRefreshOutcome: Schema.NullOr<Schema.Literals<readonly ["refreshed", "fresh", "failed"]>>;
+}>;
+export type ConnectedAccountCredential = typeof connectedAccountCredentialSchema.Type;
+export declare const connectedAccountSummarySchema: Schema.Struct<{
+    readonly connectedAccountId: Schema.String;
+    readonly ownerUserId: Schema.String;
+    readonly provider: Schema.Literals<readonly ["claude", "codex", "github"]>;
+    readonly name: Schema.String;
+    readonly kind: Schema.String;
+    readonly status: Schema.Literals<readonly ["active", "invalid", "archived"]>;
+    readonly metadata: Schema.$Record<Schema.String, Schema.Unknown>;
+    readonly connectedAt: Schema.String;
+    readonly updatedAt: Schema.String;
+    readonly lastUsedAt: Schema.NullOr<Schema.String>;
+    readonly lastSyncedAt: Schema.NullOr<Schema.String>;
+    /** Freshness as the control plane observed it; see the schema above for what null means. */
+    readonly credential: Schema.Struct<{
+        /** When the access token expires. Hours, for a Claude session credential. */
+        readonly accessExpiresAt: Schema.NullOr<Schema.String>;
+        /** When the grant itself expires, after which reconnecting is the only way back. */
+        readonly refreshExpiresAt: Schema.NullOr<Schema.String>;
+        /** When the platform last rotated or checked this credential. */
+        readonly lastRefreshAt: Schema.NullOr<Schema.String>;
+        /** What that attempt did: `refreshed`, `fresh` (nothing to do), or `failed`. */
+        readonly lastRefreshOutcome: Schema.NullOr<Schema.Literals<readonly ["refreshed", "fresh", "failed"]>>;
+    }>;
+}>;
+export type ConnectedAccountSummary = typeof connectedAccountSummarySchema.Type;
+export declare const createConnectedAccountRequestSchema: Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+    readonly provider: Schema.Literals<readonly ["claude", "codex", "github"]>;
+    readonly name: Schema.optional<Schema.String>;
+    readonly secret: Schema.String;
+}>;
+export type CreateConnectedAccountRequest = typeof createConnectedAccountRequestSchema.Type;
+export declare const listConnectedAccountsQuerySchema: Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+}>;
+export type ListConnectedAccountsQuery = typeof listConnectedAccountsQuerySchema.Type;
+export declare const listConnectedAccountsResponseSchema: Schema.Struct<{
+    readonly items: Schema.$Array<Schema.Struct<{
+        readonly connectedAccountId: Schema.String;
+        readonly ownerUserId: Schema.String;
+        readonly provider: Schema.Literals<readonly ["claude", "codex", "github"]>;
+        readonly name: Schema.String;
+        readonly kind: Schema.String;
+        readonly status: Schema.Literals<readonly ["active", "invalid", "archived"]>;
+        readonly metadata: Schema.$Record<Schema.String, Schema.Unknown>;
+        readonly connectedAt: Schema.String;
+        readonly updatedAt: Schema.String;
+        readonly lastUsedAt: Schema.NullOr<Schema.String>;
+        readonly lastSyncedAt: Schema.NullOr<Schema.String>;
+        /** Freshness as the control plane observed it; see the schema above for what null means. */
+        readonly credential: Schema.Struct<{
+            /** When the access token expires. Hours, for a Claude session credential. */
+            readonly accessExpiresAt: Schema.NullOr<Schema.String>;
+            /** When the grant itself expires, after which reconnecting is the only way back. */
+            readonly refreshExpiresAt: Schema.NullOr<Schema.String>;
+            /** When the platform last rotated or checked this credential. */
+            readonly lastRefreshAt: Schema.NullOr<Schema.String>;
+            /** What that attempt did: `refreshed`, `fresh` (nothing to do), or `failed`. */
+            readonly lastRefreshOutcome: Schema.NullOr<Schema.Literals<readonly ["refreshed", "fresh", "failed"]>>;
+        }>;
+    }>>;
+}>;
+export type ListConnectedAccountsResponse = typeof listConnectedAccountsResponseSchema.Type;
+export declare const markConnectedAccountInvalidRequestSchema: Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+}>;
+export type MarkConnectedAccountInvalidRequest = typeof markConnectedAccountInvalidRequestSchema.Type;
+declare const ConnectedAccountBadRequestError_base: Schema.Class<ConnectedAccountBadRequestError, Schema.TaggedStruct<"ConnectedAccountBadRequestError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class ConnectedAccountBadRequestError extends ConnectedAccountBadRequestError_base {
+}
+declare const ConnectedAccountNotFoundError_base: Schema.Class<ConnectedAccountNotFoundError, Schema.TaggedStruct<"ConnectedAccountNotFoundError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class ConnectedAccountNotFoundError extends ConnectedAccountNotFoundError_base {
+}
+declare const ConnectedAccountConflictError_base: Schema.Class<ConnectedAccountConflictError, Schema.TaggedStruct<"ConnectedAccountConflictError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class ConnectedAccountConflictError extends ConnectedAccountConflictError_base {
+}
+declare const ConnectedAccountServiceUnavailableError_base: Schema.Class<ConnectedAccountServiceUnavailableError, Schema.TaggedStruct<"ConnectedAccountServiceUnavailableError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class ConnectedAccountServiceUnavailableError extends ConnectedAccountServiceUnavailableError_base {
+}
+declare const ConnectedAccountInternalServerError_base: Schema.Class<ConnectedAccountInternalServerError, Schema.TaggedStruct<"ConnectedAccountInternalServerError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class ConnectedAccountInternalServerError extends ConnectedAccountInternalServerError_base {
+}
+export declare const ConnectedAccountsGroup: HttpApiGroup.HttpApiGroup<"connectedAccounts", HttpApiEndpoint.HttpApiEndpoint<"archiveConnectedAccount", "DELETE", "/:connectedAccountId", HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly connectedAccountId: Schema.String;
+}>>, HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+}>>, HttpApiEndpoint.Json<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly connectedAccountId: Schema.String;
+    readonly ownerUserId: Schema.String;
+    readonly provider: Schema.Literals<readonly ["claude", "codex", "github"]>;
+    readonly name: Schema.String;
+    readonly kind: Schema.String;
+    readonly status: Schema.Literals<readonly ["active", "invalid", "archived"]>;
+    readonly metadata: Schema.$Record<Schema.String, Schema.Unknown>;
+    readonly connectedAt: Schema.String;
+    readonly updatedAt: Schema.String;
+    readonly lastUsedAt: Schema.NullOr<Schema.String>;
+    readonly lastSyncedAt: Schema.NullOr<Schema.String>;
+    /** Freshness as the control plane observed it; see the schema above for what null means. */
+    readonly credential: Schema.Struct<{
+        /** When the access token expires. Hours, for a Claude session credential. */
+        readonly accessExpiresAt: Schema.NullOr<Schema.String>;
+        /** When the grant itself expires, after which reconnecting is the only way back. */
+        readonly refreshExpiresAt: Schema.NullOr<Schema.String>;
+        /** When the platform last rotated or checked this credential. */
+        readonly lastRefreshAt: Schema.NullOr<Schema.String>;
+        /** What that attempt did: `refreshed`, `fresh` (nothing to do), or `failed`. */
+        readonly lastRefreshOutcome: Schema.NullOr<Schema.Literals<readonly ["refreshed", "fresh", "failed"]>>;
+    }>;
+}>>, HttpApiEndpoint.Json<typeof ConnectedAccountNotFoundError | typeof ConnectedAccountInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"createConnectedAccount", "POST", "/", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+    readonly provider: Schema.Literals<readonly ["claude", "codex", "github"]>;
+    readonly name: Schema.optional<Schema.String>;
+    readonly secret: Schema.String;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly connectedAccountId: Schema.String;
+    readonly ownerUserId: Schema.String;
+    readonly provider: Schema.Literals<readonly ["claude", "codex", "github"]>;
+    readonly name: Schema.String;
+    readonly kind: Schema.String;
+    readonly status: Schema.Literals<readonly ["active", "invalid", "archived"]>;
+    readonly metadata: Schema.$Record<Schema.String, Schema.Unknown>;
+    readonly connectedAt: Schema.String;
+    readonly updatedAt: Schema.String;
+    readonly lastUsedAt: Schema.NullOr<Schema.String>;
+    readonly lastSyncedAt: Schema.NullOr<Schema.String>;
+    /** Freshness as the control plane observed it; see the schema above for what null means. */
+    readonly credential: Schema.Struct<{
+        /** When the access token expires. Hours, for a Claude session credential. */
+        readonly accessExpiresAt: Schema.NullOr<Schema.String>;
+        /** When the grant itself expires, after which reconnecting is the only way back. */
+        readonly refreshExpiresAt: Schema.NullOr<Schema.String>;
+        /** When the platform last rotated or checked this credential. */
+        readonly lastRefreshAt: Schema.NullOr<Schema.String>;
+        /** What that attempt did: `refreshed`, `fresh` (nothing to do), or `failed`. */
+        readonly lastRefreshOutcome: Schema.NullOr<Schema.Literals<readonly ["refreshed", "fresh", "failed"]>>;
+    }>;
+}>>, HttpApiEndpoint.Json<typeof ConnectedAccountBadRequestError | typeof ConnectedAccountNotFoundError | typeof ConnectedAccountConflictError | typeof ConnectedAccountServiceUnavailableError | typeof ConnectedAccountInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"listConnectedAccounts", "GET", "/", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly items: Schema.$Array<Schema.Struct<{
+        readonly connectedAccountId: Schema.String;
+        readonly ownerUserId: Schema.String;
+        readonly provider: Schema.Literals<readonly ["claude", "codex", "github"]>;
+        readonly name: Schema.String;
+        readonly kind: Schema.String;
+        readonly status: Schema.Literals<readonly ["active", "invalid", "archived"]>;
+        readonly metadata: Schema.$Record<Schema.String, Schema.Unknown>;
+        readonly connectedAt: Schema.String;
+        readonly updatedAt: Schema.String;
+        readonly lastUsedAt: Schema.NullOr<Schema.String>;
+        readonly lastSyncedAt: Schema.NullOr<Schema.String>;
+        /** Freshness as the control plane observed it; see the schema above for what null means. */
+        readonly credential: Schema.Struct<{
+            /** When the access token expires. Hours, for a Claude session credential. */
+            readonly accessExpiresAt: Schema.NullOr<Schema.String>;
+            /** When the grant itself expires, after which reconnecting is the only way back. */
+            readonly refreshExpiresAt: Schema.NullOr<Schema.String>;
+            /** When the platform last rotated or checked this credential. */
+            readonly lastRefreshAt: Schema.NullOr<Schema.String>;
+            /** What that attempt did: `refreshed`, `fresh` (nothing to do), or `failed`. */
+            readonly lastRefreshOutcome: Schema.NullOr<Schema.Literals<readonly ["refreshed", "fresh", "failed"]>>;
+        }>;
+    }>>;
+}>>, HttpApiEndpoint.Json<typeof ConnectedAccountInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"markConnectedAccountInvalid", "POST", "/:connectedAccountId/mark-invalid", HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly connectedAccountId: Schema.String;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly connectedAccountId: Schema.String;
+    readonly ownerUserId: Schema.String;
+    readonly provider: Schema.Literals<readonly ["claude", "codex", "github"]>;
+    readonly name: Schema.String;
+    readonly kind: Schema.String;
+    readonly status: Schema.Literals<readonly ["active", "invalid", "archived"]>;
+    readonly metadata: Schema.$Record<Schema.String, Schema.Unknown>;
+    readonly connectedAt: Schema.String;
+    readonly updatedAt: Schema.String;
+    readonly lastUsedAt: Schema.NullOr<Schema.String>;
+    readonly lastSyncedAt: Schema.NullOr<Schema.String>;
+    /** Freshness as the control plane observed it; see the schema above for what null means. */
+    readonly credential: Schema.Struct<{
+        /** When the access token expires. Hours, for a Claude session credential. */
+        readonly accessExpiresAt: Schema.NullOr<Schema.String>;
+        /** When the grant itself expires, after which reconnecting is the only way back. */
+        readonly refreshExpiresAt: Schema.NullOr<Schema.String>;
+        /** When the platform last rotated or checked this credential. */
+        readonly lastRefreshAt: Schema.NullOr<Schema.String>;
+        /** What that attempt did: `refreshed`, `fresh` (nothing to do), or `failed`. */
+        readonly lastRefreshOutcome: Schema.NullOr<Schema.Literals<readonly ["refreshed", "fresh", "failed"]>>;
+    }>;
+}>>, HttpApiEndpoint.Json<typeof ConnectedAccountNotFoundError | typeof ConnectedAccountInternalServerError>, never, never>, false>;
+export {};

package/dist/core-api/connected-accounts.js

@@ -0,0 +1,128 @@
+import { Schema } from "effect";
+import { HttpApiEndpoint, HttpApiGroup, HttpApiSchema, OpenApi } from "effect/unstable/httpapi";
+const NonEmptyString = Schema.String.check(Schema.isNonEmpty(), Schema.isTrimmed());
+/*
+Connected provider accounts (Claude / Codex / GitHub credentials). Same trust model as ssh-keys:
+the internal API trusts the caller-supplied `ownerUserId`; the web tRPC proxy and the CLI inject
+the session/configured user inside the deployment's trust boundary.
+
+Secret material flows exactly one way: `createConnectedAccountRequestSchema.secret` carries the
+provider-shaped plaintext INTO the API, where it is validated, encrypted (AES-256-GCM via
+@sealant/credentials), and stored sealed. NO endpoint ever returns secret material — summaries
+expose only non-secret metadata (token suffix, codex account id/email, github login+scopes).
+`markConnectedAccountInvalid` is the internal 401-feedback hook (worker/sync-back observed the
+provider rejecting the credential).
+*/
+export const connectedAccountProviderSchema = Schema.Literals(["claude", "codex", "github"]);
+export const connectedAccountStatusSchema = Schema.Literals(["active", "invalid", "archived"]);
+/**
+ * What the control plane observed about a credential's life, so a consumer can say "expired" as an
+ * observation instead of parsing a payload it must never see. Every field is null when nothing was
+ * observed: a setup token has no expiry, a row connected before this shipped has no stored one, and
+ * an account that has never been swept has no refresh outcome.
+ */
+export const connectedAccountCredentialSchema = Schema.Struct({
+    /** When the access token expires. Hours, for a Claude session credential. */
+    accessExpiresAt: Schema.NullOr(Schema.String),
+    /** When the grant itself expires, after which reconnecting is the only way back. */
+    refreshExpiresAt: Schema.NullOr(Schema.String),
+    /** When the platform last rotated or checked this credential. */
+    lastRefreshAt: Schema.NullOr(Schema.String),
+    /** What that attempt did: `refreshed`, `fresh` (nothing to do), or `failed`. */
+    lastRefreshOutcome: Schema.NullOr(Schema.Literals(["refreshed", "fresh", "failed"])),
+});
+export const connectedAccountSummarySchema = Schema.Struct({
+    connectedAccountId: NonEmptyString,
+    ownerUserId: NonEmptyString,
+    provider: connectedAccountProviderSchema,
+    name: NonEmptyString,
+    // "oauth-token" | "credentials-json" (claude) | "auth-json" (codex) | "gh-cli-token" (github).
+    kind: NonEmptyString,
+    status: connectedAccountStatusSchema,
+    // NON-secret display/ops data (claude token suffix, codex account id/email, github login+scopes).
+    metadata: Schema.Record(Schema.String, Schema.Unknown),
+    connectedAt: Schema.String,
+    updatedAt: Schema.String,
+    lastUsedAt: Schema.NullOr(Schema.String),
+    lastSyncedAt: Schema.NullOr(Schema.String),
+    /** Freshness as the control plane observed it; see the schema above for what null means. */
+    credential: connectedAccountCredentialSchema,
+});
+export const createConnectedAccountRequestSchema = Schema.Struct({
+    ownerUserId: NonEmptyString,
+    provider: connectedAccountProviderSchema,
+    // Multiple accounts per provider are allowed; defaults to "default".
+    name: Schema.optional(NonEmptyString),
+    // Provider-shaped plaintext: claude setup-token or verbatim .credentials.json contents /
+    // verbatim codex auth.json contents / github token. Encrypted server-side; never stored or
+    // echoed back as-is. Not trimmed here — pasted credential files are stored verbatim.
+    secret: Schema.String.check(Schema.isNonEmpty()),
+});
+export const listConnectedAccountsQuerySchema = Schema.Struct({
+    ownerUserId: NonEmptyString,
+});
+export const listConnectedAccountsResponseSchema = Schema.Struct({
+    items: Schema.Array(connectedAccountSummarySchema),
+});
+export const markConnectedAccountInvalidRequestSchema = Schema.Struct({
+    ownerUserId: NonEmptyString,
+});
+export class ConnectedAccountBadRequestError extends Schema.TaggedErrorClass()("ConnectedAccountBadRequestError", {
+    message: Schema.String,
+}, { httpApiStatus: 400 }) {
+}
+export class ConnectedAccountNotFoundError extends Schema.TaggedErrorClass()("ConnectedAccountNotFoundError", {
+    message: Schema.String,
+}, { httpApiStatus: 404 }) {
+}
+export class ConnectedAccountConflictError extends Schema.TaggedErrorClass()("ConnectedAccountConflictError", {
+    message: Schema.String,
+}, { httpApiStatus: 409 }) {
+}
+export class ConnectedAccountServiceUnavailableError extends Schema.TaggedErrorClass()("ConnectedAccountServiceUnavailableError", {
+    message: Schema.String,
+}, { httpApiStatus: 503 }) {
+}
+export class ConnectedAccountInternalServerError extends Schema.TaggedErrorClass()("ConnectedAccountInternalServerError", {
+    message: Schema.String,
+}, { httpApiStatus: 500 }) {
+}
+const connectedAccountIdParams = Schema.Struct({ connectedAccountId: NonEmptyString });
+export const ConnectedAccountsGroup = HttpApiGroup.make("connectedAccounts")
+    .add(
+// Connect/replace: upserts on (owner, provider, name), so reconnecting swaps the sealed
+// payload in place instead of erroring.
+HttpApiEndpoint.post("createConnectedAccount", "/", {
+    payload: createConnectedAccountRequestSchema,
+    success: connectedAccountSummarySchema.pipe(HttpApiSchema.status(201)),
+    error: [
+        ConnectedAccountBadRequestError,
+        ConnectedAccountNotFoundError,
+        ConnectedAccountConflictError,
+        ConnectedAccountServiceUnavailableError,
+        ConnectedAccountInternalServerError,
+    ],
+}))
+    .add(HttpApiEndpoint.get("listConnectedAccounts", "/", {
+    query: listConnectedAccountsQuerySchema,
+    success: listConnectedAccountsResponseSchema,
+    error: [ConnectedAccountInternalServerError],
+}))
+    .add(
+// Soft archive; uniform 404 for "does not exist" and "not yours".
+HttpApiEndpoint.delete("archiveConnectedAccount", "/:connectedAccountId", {
+    params: connectedAccountIdParams,
+    query: listConnectedAccountsQuerySchema,
+    success: connectedAccountSummarySchema,
+    error: [ConnectedAccountNotFoundError, ConnectedAccountInternalServerError],
+}))
+    .add(
+// Internal feedback hook: the worker observed the provider rejecting this credential (401),
+// so surfaces should prompt a re-auth.
+HttpApiEndpoint.post("markConnectedAccountInvalid", "/:connectedAccountId/mark-invalid", {
+    params: connectedAccountIdParams,
+    payload: markConnectedAccountInvalidRequestSchema,
+    success: connectedAccountSummarySchema,
+    error: [ConnectedAccountNotFoundError, ConnectedAccountInternalServerError],
+}))
+    .annotate(OpenApi.Description, "Connected provider accounts (Claude / Codex / GitHub credentials). Secret material is never returned by any endpoint.");