@sealant/api-contracts-next 0.40.0-next.761 → 0.40.0-next.764

package/dist/core-api/connected-accounts.d.ts

@@ -21,6 +21,17 @@ export declare const connectedAccountCredentialSchema: Schema.Struct<{
     readonly lastRefreshOutcome: Schema.NullOr<Schema.Literals<readonly ["refreshed", "fresh", "failed"]>>;
 }>;
 export type ConnectedAccountCredential = typeof connectedAccountCredentialSchema.Type;
+/** What the person pays with: their subscription's login, or an API key billed per token. */
+export declare const connectedAccountLoginClassSchema: Schema.Literals<readonly ["subscription", "api-key"]>;
+export type ConnectedAccountLoginClass = typeof connectedAccountLoginClassSchema.Type;
+/** A Claude or Codex account's login class; a key with its last four characters. */
+export declare const connectedAccountLoginSchema: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"subscription">;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"api-key">;
+    readonly suffix: Schema.String;
+}>]>;
+export type ConnectedAccountLogin = typeof connectedAccountLoginSchema.Type;
 export declare const connectedAccountSummarySchema: Schema.Struct<{
     readonly connectedAccountId: Schema.String;
     readonly ownerUserId: Schema.String;
@@ -51,6 +62,13 @@ export declare const connectedAccountSummarySchema: Schema.Struct<{
      * stores different bytes. Absent from older control planes.
      */
     readonly credentialRevision: Schema.optional<Schema.Int>;
+    /** Claude and Codex only: the account's login class. Absent from older control planes. */
+    readonly login: Schema.optional<Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"subscription">;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"api-key">;
+        readonly suffix: Schema.String;
+    }>]>>;
 }>;
 export type ConnectedAccountSummary = typeof connectedAccountSummarySchema.Type;
 export declare const createConnectedAccountRequestSchema: Schema.Struct<{
@@ -60,14 +78,21 @@ export declare const createConnectedAccountRequestSchema: Schema.Struct<{
      * The account to connect or replace by name; a new name is a new account, and `default` names
      * the owner's chosen default. The owner's first account for the provider is named `default`
      * whatever this says. With neither `name` nor `accountId` (or `default` while none is chosen),
-     * the owner's only account is replaced, and with several the connect is refused (`409`,
-     * `connected-account-ambiguous`, with `candidateAccountIds`).
+     * the owner's only account of the secret's login class is replaced, so a key never replaces a
+     * subscription. With none of that class a new account is made, named `api-key` or
+     * `subscription` (with a number when the name is taken), and with several the connect is
+     * refused (`409`, `connected-account-ambiguous`, with `candidateAccountIds`).
      */
     readonly name: Schema.optional<Schema.String>;
     /** Replace this account (the owner's, of `provider`). Not with `name`. */
     readonly accountId: Schema.optional<Schema.String>;
     /** Make the connected account the owner's default for the provider, in the same write. */
     readonly makeDefault: Schema.optional<Schema.Boolean>;
+    /**
+     * Claude and Codex only: the login class the caller expects the secret to be. A secret of the
+     * other class is refused (`400`) before anything is stored.
+     */
+    readonly login: Schema.optional<Schema.Literals<readonly ["subscription", "api-key"]>>;
     readonly secret: Schema.String;
 }>;
 export type CreateConnectedAccountRequest = typeof createConnectedAccountRequestSchema.Type;
@@ -106,7 +131,19 @@ export declare const listConnectedAccountsResponseSchema: Schema.Struct<{
          * stores different bytes. Absent from older control planes.
          */
         readonly credentialRevision: Schema.optional<Schema.Int>;
+        /** Claude and Codex only: the account's login class. Absent from older control planes. */
+        readonly login: Schema.optional<Schema.Union<readonly [Schema.Struct<{
+            readonly kind: Schema.Literal<"subscription">;
+        }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"api-key">;
+            readonly suffix: Schema.String;
+        }>]>>;
     }>>;
+    /**
+     * Whether the owner ever connected an API key, archived ones included, so a surface keeps saying
+     * which login a turn spent after the key is gone. Absent from older control planes.
+     */
+    readonly hasApiKeyHistory: Schema.optional<Schema.Boolean>;
 }>;
 export type ListConnectedAccountsResponse = typeof listConnectedAccountsResponseSchema.Type;
 export declare const markConnectedAccountInvalidRequestSchema: Schema.Struct<{
@@ -148,6 +185,13 @@ export declare const markConnectedAccountInvalidResponseSchema: Schema.Struct<{
      * stores different bytes. Absent from older control planes.
      */
     readonly credentialRevision: Schema.optional<Schema.Int>;
+    /** Claude and Codex only: the account's login class. Absent from older control planes. */
+    readonly login: Schema.optional<Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"subscription">;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"api-key">;
+        readonly suffix: Schema.String;
+    }>]>>;
     /** `marked`: the account is now invalid. `superseded`: a newer credential, left as it was. */
     readonly outcome: Schema.optional<Schema.Literals<readonly ["marked", "superseded"]>>;
 }>;
@@ -224,6 +268,13 @@ export declare const ConnectedAccountsGroup: HttpApiGroup.HttpApiGroup<"connecte
      * stores different bytes. Absent from older control planes.
      */
     readonly credentialRevision: Schema.optional<Schema.Int>;
+    /** Claude and Codex only: the account's login class. Absent from older control planes. */
+    readonly login: Schema.optional<Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"subscription">;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"api-key">;
+        readonly suffix: Schema.String;
+    }>]>>;
 }>>, Schema.toCodecJson<typeof ConnectedAccountNotFoundError | typeof ConnectedAccountInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"createConnectedAccount", "POST", "/", never, never, Schema.toCodecJson<Schema.Struct<{
     readonly ownerUserId: Schema.String;
     readonly provider: Schema.Literals<readonly ["claude", "codex", "github"]>;
@@ -231,14 +282,21 @@ export declare const ConnectedAccountsGroup: HttpApiGroup.HttpApiGroup<"connecte
      * The account to connect or replace by name; a new name is a new account, and `default` names
      * the owner's chosen default. The owner's first account for the provider is named `default`
      * whatever this says. With neither `name` nor `accountId` (or `default` while none is chosen),
-     * the owner's only account is replaced, and with several the connect is refused (`409`,
-     * `connected-account-ambiguous`, with `candidateAccountIds`).
+     * the owner's only account of the secret's login class is replaced, so a key never replaces a
+     * subscription. With none of that class a new account is made, named `api-key` or
+     * `subscription` (with a number when the name is taken), and with several the connect is
+     * refused (`409`, `connected-account-ambiguous`, with `candidateAccountIds`).
      */
     readonly name: Schema.optional<Schema.String>;
     /** Replace this account (the owner's, of `provider`). Not with `name`. */
     readonly accountId: Schema.optional<Schema.String>;
     /** Make the connected account the owner's default for the provider, in the same write. */
     readonly makeDefault: Schema.optional<Schema.Boolean>;
+    /**
+     * Claude and Codex only: the login class the caller expects the secret to be. A secret of the
+     * other class is refused (`400`) before anything is stored.
+     */
+    readonly login: Schema.optional<Schema.Literals<readonly ["subscription", "api-key"]>>;
     readonly secret: Schema.String;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
     readonly connectedAccountId: Schema.String;
@@ -270,6 +328,13 @@ export declare const ConnectedAccountsGroup: HttpApiGroup.HttpApiGroup<"connecte
      * stores different bytes. Absent from older control planes.
      */
     readonly credentialRevision: Schema.optional<Schema.Int>;
+    /** Claude and Codex only: the account's login class. Absent from older control planes. */
+    readonly login: Schema.optional<Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"subscription">;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"api-key">;
+        readonly suffix: Schema.String;
+    }>]>>;
 }>>, Schema.toCodecJson<typeof ConnectedAccountBadRequestError | typeof ConnectedAccountNotFoundError | typeof ConnectedAccountConflictError | typeof ConnectedAccountServiceUnavailableError | typeof ConnectedAccountInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"listConnectedAccounts", "GET", "/", never, Schema.toCodecStringTree<Schema.Struct<{
     readonly ownerUserId: Schema.String;
 }>>, never, never, Schema.toCodecJson<Schema.Struct<{
@@ -303,7 +368,19 @@ export declare const ConnectedAccountsGroup: HttpApiGroup.HttpApiGroup<"connecte
          * stores different bytes. Absent from older control planes.
          */
         readonly credentialRevision: Schema.optional<Schema.Int>;
+        /** Claude and Codex only: the account's login class. Absent from older control planes. */
+        readonly login: Schema.optional<Schema.Union<readonly [Schema.Struct<{
+            readonly kind: Schema.Literal<"subscription">;
+        }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"api-key">;
+            readonly suffix: Schema.String;
+        }>]>>;
     }>>;
+    /**
+     * Whether the owner ever connected an API key, archived ones included, so a surface keeps saying
+     * which login a turn spent after the key is gone. Absent from older control planes.
+     */
+    readonly hasApiKeyHistory: Schema.optional<Schema.Boolean>;
 }>>, Schema.toCodecJson<typeof ConnectedAccountInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"markConnectedAccountInvalid", "POST", "/:connectedAccountId/mark-invalid", Schema.toCodecStringTree<Schema.Struct<{
     readonly connectedAccountId: Schema.String;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
@@ -343,6 +420,13 @@ export declare const ConnectedAccountsGroup: HttpApiGroup.HttpApiGroup<"connecte
      * stores different bytes. Absent from older control planes.
      */
     readonly credentialRevision: Schema.optional<Schema.Int>;
+    /** Claude and Codex only: the account's login class. Absent from older control planes. */
+    readonly login: Schema.optional<Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"subscription">;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"api-key">;
+        readonly suffix: Schema.String;
+    }>]>>;
     /** `marked`: the account is now invalid. `superseded`: a newer credential, left as it was. */
     readonly outcome: Schema.optional<Schema.Literals<readonly ["marked", "superseded"]>>;
 }>>, Schema.toCodecJson<typeof ConnectedAccountNotFoundError | typeof ConnectedAccountInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"setConnectedAccountDefault", "PUT", "/defaults/:provider", Schema.toCodecStringTree<Schema.Struct<{
@@ -380,5 +464,12 @@ export declare const ConnectedAccountsGroup: HttpApiGroup.HttpApiGroup<"connecte
      * stores different bytes. Absent from older control planes.
      */
     readonly credentialRevision: Schema.optional<Schema.Int>;
+    /** Claude and Codex only: the account's login class. Absent from older control planes. */
+    readonly login: Schema.optional<Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"subscription">;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"api-key">;
+        readonly suffix: Schema.String;
+    }>]>>;
 }>>, Schema.toCodecJson<typeof ConnectedAccountNotFoundError | typeof ConnectedAccountConflictError | typeof ConnectedAccountInternalServerError>, never, never>, false>;
 export {};

package/dist/core-api/connected-accounts.js

@@ -36,12 +36,20 @@ export const connectedAccountCredentialSchema = Schema.Struct({
     /** What that attempt did: `refreshed`, `fresh` (nothing to do), or `failed`. */
     lastRefreshOutcome: Schema.NullOr(Schema.Literals(["refreshed", "fresh", "failed"])),
 });
+/** What the person pays with: their subscription's login, or an API key billed per token. */
+export const connectedAccountLoginClassSchema = Schema.Literals(["subscription", "api-key"]);
+/** A Claude or Codex account's login class; a key with its last four characters. */
+export const connectedAccountLoginSchema = Schema.Union([
+    Schema.Struct({ kind: Schema.Literal("subscription") }),
+    Schema.Struct({ kind: Schema.Literal("api-key"), suffix: NonEmptyString }),
+]);
 export const connectedAccountSummarySchema = Schema.Struct({
     connectedAccountId: NonEmptyString,
     ownerUserId: NonEmptyString,
     provider: connectedAccountProviderSchema,
     name: NonEmptyString,
-    // "oauth-token" | "credentials-json" (claude) | "auth-json" (codex) | "gh-cli-token" (github).
+    // "oauth-token" | "credentials-json" (claude) | "auth-json" (codex) | "gh-cli-token" (github) |
+    // "api-key" (claude, codex).
     kind: NonEmptyString,
     status: connectedAccountStatusSchema,
     // NON-secret display/ops data (claude token suffix, codex account id/email, github login+scopes).
@@ -59,6 +67,8 @@ export const connectedAccountSummarySchema = Schema.Struct({
      * stores different bytes. Absent from older control planes.
      */
     credentialRevision: Schema.optional(Schema.Int),
+    /** Claude and Codex only: the account's login class. Absent from older control planes. */
+    login: Schema.optional(connectedAccountLoginSchema),
 });
 export const createConnectedAccountRequestSchema = Schema.Struct({
     ownerUserId: NonEmptyString,
@@ -67,17 +77,25 @@ export const createConnectedAccountRequestSchema = Schema.Struct({
      * The account to connect or replace by name; a new name is a new account, and `default` names
      * the owner's chosen default. The owner's first account for the provider is named `default`
      * whatever this says. With neither `name` nor `accountId` (or `default` while none is chosen),
-     * the owner's only account is replaced, and with several the connect is refused (`409`,
-     * `connected-account-ambiguous`, with `candidateAccountIds`).
+     * the owner's only account of the secret's login class is replaced, so a key never replaces a
+     * subscription. With none of that class a new account is made, named `api-key` or
+     * `subscription` (with a number when the name is taken), and with several the connect is
+     * refused (`409`, `connected-account-ambiguous`, with `candidateAccountIds`).
      */
     name: Schema.optional(NonEmptyString),
     /** Replace this account (the owner's, of `provider`). Not with `name`. */
     accountId: Schema.optional(NonEmptyString),
     /** Make the connected account the owner's default for the provider, in the same write. */
     makeDefault: Schema.optional(Schema.Boolean),
-    // Provider-shaped plaintext: claude setup-token or verbatim .credentials.json contents /
-    // verbatim codex auth.json contents / github token. Encrypted server-side; never stored or
-    // echoed back as-is. Not trimmed here — pasted credential files are stored verbatim.
+    /**
+     * Claude and Codex only: the login class the caller expects the secret to be. A secret of the
+     * other class is refused (`400`) before anything is stored.
+     */
+    login: Schema.optional(connectedAccountLoginClassSchema),
+    // Provider-shaped plaintext: claude setup-token, API key or verbatim .credentials.json contents /
+    // verbatim codex auth.json contents or an OpenAI API key / github token. Encrypted server-side;
+    // never stored or echoed back as-is. Not trimmed here — pasted credential files are stored
+    // verbatim.
     secret: Schema.String.check(Schema.isNonEmpty()),
 });
 export const listConnectedAccountsQuerySchema = Schema.Struct({
@@ -85,6 +103,11 @@ export const listConnectedAccountsQuerySchema = Schema.Struct({
 });
 export const listConnectedAccountsResponseSchema = Schema.Struct({
     items: Schema.Array(connectedAccountSummarySchema),
+    /**
+     * Whether the owner ever connected an API key, archived ones included, so a surface keeps saying
+     * which login a turn spent after the key is gone. Absent from older control planes.
+     */
+    hasApiKeyHistory: Schema.optional(Schema.Boolean),
 });
 export const markConnectedAccountInvalidRequestSchema = Schema.Struct({
     ownerUserId: NonEmptyString,