@sealant/api-contracts-next 0.40.0-next.764 → 0.40.0-next.765

package/dist/core-api/system.d.ts

@@ -63,6 +63,8 @@ export declare const systemIndexResponseSchema: Schema.Struct<{
          * `sudo` work, and the Kubernetes image builder records the image probe the launch checks.
          */
         readonly kubernetesPersonLayout: Schema.optional<Schema.Boolean>;
+        /** Credential homes answer placement receipts; a put takes `live`; prune exists. */
+        readonly credentialPlacements: Schema.optional<Schema.Boolean>;
     }>>;
 }>;
 export type SystemIndexResponse = typeof systemIndexResponseSchema.Type;
@@ -153,6 +155,8 @@ export declare const SystemGroup: HttpApiGroup.HttpApiGroup<"system", HttpApiEnd
          * `sudo` work, and the Kubernetes image builder records the image probe the launch checks.
          */
         readonly kubernetesPersonLayout: Schema.optional<Schema.Boolean>;
+        /** Credential homes answer placement receipts; a put takes `live`; prune exists. */
+        readonly credentialPlacements: Schema.optional<Schema.Boolean>;
     }>>;
 }>>, never, never, never> | HttpApiEndpoint.HttpApiEndpoint<"getSetupState", "GET", "/v1/system/setup-state", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
     readonly needsSetup: Schema.Boolean;

package/dist/core-api/system.js

@@ -64,6 +64,8 @@ export const systemIndexResponseSchema = Schema.Struct({
          * `sudo` work, and the Kubernetes image builder records the image probe the launch checks.
          */
         kubernetesPersonLayout: Schema.optional(Schema.Boolean),
+        /** Credential homes answer placement receipts; a put takes `live`; prune exists. */
+        credentialPlacements: Schema.optional(Schema.Boolean),
     })),
 });
 export const systemHealthResponseSchema = Schema.Struct({

package/dist/core-api/workspaces.d.ts

@@ -857,8 +857,36 @@ export declare const putWorkspaceCredentialsRequestSchema: Schema.Struct<{
      * of the whole put failing. Every other refusal still fails the put. Default false.
      */
     readonly partial: Schema.optional<Schema.Boolean>;
+    /**
+     * The placements the person's running processes hold in this home: a provider whose slot one of
+     * them holds is not written over with another login. Absent, nothing is held.
+     */
+    readonly live: Schema.optional<Schema.$Array<Schema.String>>;
 }>;
 export type PutWorkspaceCredentialsRequest = typeof putWorkspaceCredentialsRequestSchema.Type;
+/** One login written into one home: its id stays the same while a refresh moves its revision. */
+export declare const credentialPlacementReceiptSchema: Schema.Struct<{
+    readonly placementId: Schema.String;
+    readonly accountId: Schema.String;
+    readonly revision: Schema.Int;
+    readonly login: Schema.Struct<{
+        readonly kind: Schema.Literal<"subscription">;
+    }>;
+    readonly pinned: Schema.Boolean;
+}>;
+export type CredentialPlacementReceipt = typeof credentialPlacementReceiptSchema.Type;
+/** A receipt tagged with the home provider whose slot it occupies. */
+export declare const workspaceCredentialPlacementReceiptSchema: Schema.Struct<{
+    readonly placementId: Schema.String;
+    readonly accountId: Schema.String;
+    readonly revision: Schema.Int;
+    readonly login: Schema.Struct<{
+        readonly kind: Schema.Literal<"subscription">;
+    }>;
+    readonly pinned: Schema.Boolean;
+    readonly provider: Schema.Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
+}>;
+export type WorkspaceCredentialPlacementReceipt = typeof workspaceCredentialPlacementReceiptSchema.Type;
 /** One account whose copy a home holds. */
 export declare const workspaceHomeAccountSchema: Schema.Struct<{
     readonly connectedAccountId: Schema.String;
@@ -871,6 +899,17 @@ export declare const workspaceCredentialHomeSchema: Schema.Struct<{
     readonly home: Schema.String;
     /** The one person whose logins the home holds. */
     readonly onBehalfOfUserId: Schema.String;
+    /** The logins written there, one receipt each. Absent from a server without placements. */
+    readonly placements: Schema.optional<Schema.$Array<Schema.Struct<{
+        readonly placementId: Schema.String;
+        readonly accountId: Schema.String;
+        readonly revision: Schema.Int;
+        readonly login: Schema.Struct<{
+            readonly kind: Schema.Literal<"subscription">;
+        }>;
+        readonly pinned: Schema.Boolean;
+        readonly provider: Schema.Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
+    }>>>;
     /** By provider; a provider the home holds no login for is absent. */
     readonly accounts: Schema.Struct<{
         readonly claude: Schema.optional<Schema.Struct<{
@@ -924,6 +963,17 @@ export declare const putWorkspaceCredentialsResponseSchema: Schema.Struct<{
         readonly home: Schema.String;
         /** The one person whose logins the home holds. */
         readonly onBehalfOfUserId: Schema.String;
+        /** The logins written there, one receipt each. Absent from a server without placements. */
+        readonly placements: Schema.optional<Schema.$Array<Schema.Struct<{
+            readonly placementId: Schema.String;
+            readonly accountId: Schema.String;
+            readonly revision: Schema.Int;
+            readonly login: Schema.Struct<{
+                readonly kind: Schema.Literal<"subscription">;
+            }>;
+            readonly pinned: Schema.Boolean;
+            readonly provider: Schema.Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
+        }>>>;
         /** By provider; a provider the home holds no login for is absent. */
         readonly accounts: Schema.Struct<{
             readonly claude: Schema.optional<Schema.Struct<{
@@ -968,6 +1018,65 @@ export declare const putWorkspaceCredentialsResponseSchema: Schema.Struct<{
     }>>>;
 }>;
 export type PutWorkspaceCredentialsResponse = typeof putWorkspaceCredentialsResponseSchema.Type;
+/** Remove every login of one home that is neither live nor the ready one of the person's default. */
+export declare const pruneWorkspaceCredentialsRequestSchema: Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+    readonly home: Schema.String;
+    readonly live: Schema.$Array<Schema.String>;
+}>;
+export type PruneWorkspaceCredentialsRequest = typeof pruneWorkspaceCredentialsRequestSchema.Type;
+export declare const pruneWorkspaceCredentialsResponseSchema: Schema.Struct<{
+    readonly workspaceId: Schema.String;
+    readonly runId: Schema.String;
+    /** Absent when the home holds nothing (any more). */
+    readonly home: Schema.optional<Schema.Struct<{
+        readonly home: Schema.String;
+        /** The one person whose logins the home holds. */
+        readonly onBehalfOfUserId: Schema.String;
+        /** The logins written there, one receipt each. Absent from a server without placements. */
+        readonly placements: Schema.optional<Schema.$Array<Schema.Struct<{
+            readonly placementId: Schema.String;
+            readonly accountId: Schema.String;
+            readonly revision: Schema.Int;
+            readonly login: Schema.Struct<{
+                readonly kind: Schema.Literal<"subscription">;
+            }>;
+            readonly pinned: Schema.Boolean;
+            readonly provider: Schema.Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
+        }>>>;
+        /** By provider; a provider the home holds no login for is absent. */
+        readonly accounts: Schema.Struct<{
+            readonly claude: Schema.optional<Schema.Struct<{
+                readonly connectedAccountId: Schema.String;
+                /** The account's name under its provider, as it is now. */
+                readonly name: Schema.String;
+            }>>;
+            readonly codex: Schema.optional<Schema.Struct<{
+                readonly connectedAccountId: Schema.String;
+                /** The account's name under its provider, as it is now. */
+                readonly name: Schema.String;
+            }>>;
+            readonly github: Schema.optional<Schema.Struct<{
+                readonly connectedAccountId: Schema.String;
+                /** The account's name under its provider, as it is now. */
+                readonly name: Schema.String;
+            }>>;
+            /** The Codex account pi's ChatGPT login is made from. */
+            readonly pi: Schema.optional<Schema.Struct<{
+                readonly connectedAccountId: Schema.String;
+                /** The account's name under its provider, as it is now. */
+                readonly name: Schema.String;
+            }>>;
+            /** The Codex account opencode's ChatGPT login is made from. */
+            readonly opencode: Schema.optional<Schema.Struct<{
+                readonly connectedAccountId: Schema.String;
+                /** The account's name under its provider, as it is now. */
+                readonly name: Schema.String;
+            }>>;
+        }>;
+    }>>;
+}>;
+export type PruneWorkspaceCredentialsResponse = typeof pruneWorkspaceCredentialsResponseSchema.Type;
 /** Release one home: its login files are removed and its record deleted. */
 export declare const releaseWorkspaceCredentialsQuerySchema: Schema.Struct<{
     readonly ownerUserId: Schema.String;
@@ -994,6 +1103,17 @@ export declare const listWorkspaceCredentialsResponseSchema: Schema.Struct<{
         readonly home: Schema.String;
         /** The one person whose logins the home holds. */
         readonly onBehalfOfUserId: Schema.String;
+        /** The logins written there, one receipt each. Absent from a server without placements. */
+        readonly placements: Schema.optional<Schema.$Array<Schema.Struct<{
+            readonly placementId: Schema.String;
+            readonly accountId: Schema.String;
+            readonly revision: Schema.Int;
+            readonly login: Schema.Struct<{
+                readonly kind: Schema.Literal<"subscription">;
+            }>;
+            readonly pinned: Schema.Boolean;
+            readonly provider: Schema.Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
+        }>>>;
         /** By provider; a provider the home holds no login for is absent. */
         readonly accounts: Schema.Struct<{
             readonly claude: Schema.optional<Schema.Struct<{
@@ -2712,6 +2832,17 @@ export declare const WorkspacesGroup: HttpApiGroup.HttpApiGroup<"workspaces", Ht
         readonly home: Schema.String;
         /** The one person whose logins the home holds. */
         readonly onBehalfOfUserId: Schema.String;
+        /** The logins written there, one receipt each. Absent from a server without placements. */
+        readonly placements: Schema.optional<Schema.$Array<Schema.Struct<{
+            readonly placementId: Schema.String;
+            readonly accountId: Schema.String;
+            readonly revision: Schema.Int;
+            readonly login: Schema.Struct<{
+                readonly kind: Schema.Literal<"subscription">;
+            }>;
+            readonly pinned: Schema.Boolean;
+            readonly provider: Schema.Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
+        }>>>;
         /** By provider; a provider the home holds no login for is absent. */
         readonly accounts: Schema.Struct<{
             readonly claude: Schema.optional<Schema.Struct<{
@@ -2849,7 +2980,63 @@ export declare const WorkspacesGroup: HttpApiGroup.HttpApiGroup<"workspaces", Ht
         readonly finishedAt: Schema.optional<Schema.String>;
         readonly expiresAt: Schema.optional<Schema.String>;
     }>>;
-}>>, Schema.toCodecJson<typeof WorkspaceBadRequestError | typeof WorkspaceInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"putWorkspaceCredentials", "POST", "/:workspaceId/credentials", Schema.toCodecStringTree<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof WorkspaceBadRequestError | typeof WorkspaceInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"pruneWorkspaceCredentials", "POST", "/:workspaceId/credentials/prune", Schema.toCodecStringTree<Schema.Struct<{
+    readonly workspaceId: Schema.String;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+    readonly home: Schema.String;
+    readonly live: Schema.$Array<Schema.String>;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    readonly workspaceId: Schema.String;
+    readonly runId: Schema.String;
+    /** Absent when the home holds nothing (any more). */
+    readonly home: Schema.optional<Schema.Struct<{
+        readonly home: Schema.String;
+        /** The one person whose logins the home holds. */
+        readonly onBehalfOfUserId: Schema.String;
+        /** The logins written there, one receipt each. Absent from a server without placements. */
+        readonly placements: Schema.optional<Schema.$Array<Schema.Struct<{
+            readonly placementId: Schema.String;
+            readonly accountId: Schema.String;
+            readonly revision: Schema.Int;
+            readonly login: Schema.Struct<{
+                readonly kind: Schema.Literal<"subscription">;
+            }>;
+            readonly pinned: Schema.Boolean;
+            readonly provider: Schema.Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
+        }>>>;
+        /** By provider; a provider the home holds no login for is absent. */
+        readonly accounts: Schema.Struct<{
+            readonly claude: Schema.optional<Schema.Struct<{
+                readonly connectedAccountId: Schema.String;
+                /** The account's name under its provider, as it is now. */
+                readonly name: Schema.String;
+            }>>;
+            readonly codex: Schema.optional<Schema.Struct<{
+                readonly connectedAccountId: Schema.String;
+                /** The account's name under its provider, as it is now. */
+                readonly name: Schema.String;
+            }>>;
+            readonly github: Schema.optional<Schema.Struct<{
+                readonly connectedAccountId: Schema.String;
+                /** The account's name under its provider, as it is now. */
+                readonly name: Schema.String;
+            }>>;
+            /** The Codex account pi's ChatGPT login is made from. */
+            readonly pi: Schema.optional<Schema.Struct<{
+                readonly connectedAccountId: Schema.String;
+                /** The account's name under its provider, as it is now. */
+                readonly name: Schema.String;
+            }>>;
+            /** The Codex account opencode's ChatGPT login is made from. */
+            readonly opencode: Schema.optional<Schema.Struct<{
+                readonly connectedAccountId: Schema.String;
+                /** The account's name under its provider, as it is now. */
+                readonly name: Schema.String;
+            }>>;
+        }>;
+    }>>;
+}>>, Schema.toCodecJson<typeof WorkspaceBadRequestError | typeof WorkspaceForbiddenError | typeof WorkspaceNotFoundError | typeof WorkspaceConflictError | typeof WorkspaceBadGatewayError | typeof WorkspaceServiceUnavailableError | typeof WorkspaceInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"putWorkspaceCredentials", "POST", "/:workspaceId/credentials", Schema.toCodecStringTree<Schema.Struct<{
     readonly workspaceId: Schema.String;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
     /** The workspace's owner (owner scope; uniform 404 otherwise). */
@@ -2891,6 +3078,11 @@ export declare const WorkspacesGroup: HttpApiGroup.HttpApiGroup<"workspaces", Ht
      * of the whole put failing. Every other refusal still fails the put. Default false.
      */
     readonly partial: Schema.optional<Schema.Boolean>;
+    /**
+     * The placements the person's running processes hold in this home: a provider whose slot one of
+     * them holds is not written over with another login. Absent, nothing is held.
+     */
+    readonly live: Schema.optional<Schema.$Array<Schema.String>>;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
     readonly workspaceId: Schema.String;
     /** The launch attempt whose executor was written. */
@@ -2900,6 +3092,17 @@ export declare const WorkspacesGroup: HttpApiGroup.HttpApiGroup<"workspaces", Ht
         readonly home: Schema.String;
         /** The one person whose logins the home holds. */
         readonly onBehalfOfUserId: Schema.String;
+        /** The logins written there, one receipt each. Absent from a server without placements. */
+        readonly placements: Schema.optional<Schema.$Array<Schema.Struct<{
+            readonly placementId: Schema.String;
+            readonly accountId: Schema.String;
+            readonly revision: Schema.Int;
+            readonly login: Schema.Struct<{
+                readonly kind: Schema.Literal<"subscription">;
+            }>;
+            readonly pinned: Schema.Boolean;
+            readonly provider: Schema.Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
+        }>>>;
         /** By provider; a provider the home holds no login for is absent. */
         readonly accounts: Schema.Struct<{
             readonly claude: Schema.optional<Schema.Struct<{

package/dist/core-api/workspaces.js

@@ -735,6 +735,24 @@ export const putWorkspaceCredentialsRequestSchema = Schema.Struct({
      * of the whole put failing. Every other refusal still fails the put. Default false.
      */
     partial: Schema.optional(Schema.Boolean),
+    /**
+     * The placements the person's running processes hold in this home: a provider whose slot one of
+     * them holds is not written over with another login. Absent, nothing is held.
+     */
+    live: Schema.optional(Schema.Array(NonEmptyString)),
+});
+/** One login written into one home: its id stays the same while a refresh moves its revision. */
+export const credentialPlacementReceiptSchema = Schema.Struct({
+    placementId: NonEmptyString,
+    accountId: NonEmptyString,
+    revision: Schema.Int.check(Schema.isGreaterThan(0)),
+    login: Schema.Struct({ kind: Schema.Literal("subscription") }),
+    pinned: Schema.Boolean,
+});
+/** A receipt tagged with the home provider whose slot it occupies. */
+export const workspaceCredentialPlacementReceiptSchema = Schema.Struct({
+    provider: Schema.Literals(workspaceCredentialHomeProviders),
+    ...credentialPlacementReceiptSchema.fields,
 });
 /** One account whose copy a home holds. */
 export const workspaceHomeAccountSchema = Schema.Struct({
@@ -747,6 +765,8 @@ export const workspaceCredentialHomeSchema = Schema.Struct({
     home: NonEmptyString,
     /** The one person whose logins the home holds. */
     onBehalfOfUserId: NonEmptyString,
+    /** The logins written there, one receipt each. Absent from a server without placements. */
+    placements: Schema.optional(Schema.Array(workspaceCredentialPlacementReceiptSchema)),
     /** By provider; a provider the home holds no login for is absent. */
     accounts: Schema.Struct({
         claude: Schema.optional(workspaceHomeAccountSchema),
@@ -778,6 +798,18 @@ export const putWorkspaceCredentialsResponseSchema = Schema.Struct({
     /** A partial put's left-out providers, in the order named (empty when all were written). */
     skipped: Schema.optional(Schema.Array(workspaceCredentialSkipSchema)),
 });
+/** Remove every login of one home that is neither live nor the ready one of the person's default. */
+export const pruneWorkspaceCredentialsRequestSchema = Schema.Struct({
+    ownerUserId: NonEmptyString,
+    home: NonEmptyString,
+    live: Schema.Array(NonEmptyString),
+});
+export const pruneWorkspaceCredentialsResponseSchema = Schema.Struct({
+    workspaceId: NonEmptyString,
+    runId: NonEmptyString,
+    /** Absent when the home holds nothing (any more). */
+    home: Schema.optional(workspaceCredentialHomeSchema),
+});
 /** Release one home: its login files are removed and its record deleted. */
 export const releaseWorkspaceCredentialsQuerySchema = Schema.Struct({
     ownerUserId: NonEmptyString,
@@ -1459,6 +1491,20 @@ HttpApiEndpoint.delete("releaseWorkspaceCredentials", "/:workspaceId/credentials
         WorkspaceServiceUnavailableError,
         WorkspaceInternalServerError,
     ],
+}))
+    .add(HttpApiEndpoint.post("pruneWorkspaceCredentials", "/:workspaceId/credentials/prune", {
+    params: workspaceIdParams,
+    payload: pruneWorkspaceCredentialsRequestSchema,
+    success: pruneWorkspaceCredentialsResponseSchema,
+    error: [
+        WorkspaceBadRequestError,
+        WorkspaceForbiddenError,
+        WorkspaceNotFoundError,
+        WorkspaceConflictError,
+        WorkspaceBadGatewayError,
+        WorkspaceServiceUnavailableError,
+        WorkspaceInternalServerError,
+    ],
 }))
     .add(HttpApiEndpoint.get("listWorkspaceCredentials", "/:workspaceId/credentials", {
     params: workspaceIdParams,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealant/api-contracts-next",
-  "version": "0.40.0-next.764",
+  "version": "0.40.0-next.765",
   "description": "Contract-first HTTP API definitions for Sealant services",
   "license": "Apache-2.0",
   "repository": {
@@ -36,7 +36,7 @@
   "peerDependencies": {
     "effect": "^4.0.5"
   },
-  "gitHead": "4d306e5cd66c40f162f7346370edd82930c1bc02",
+  "gitHead": "9802ef32e54645b875272fecf15d036bf7f095e1",
   "publishConfig": {
     "access": "public"
   }