@sealant/api-contracts-next 0.40.0-next.765 → 0.40.0-next.767

package/dist/core-api/control-plane.d.ts

@@ -962,6 +962,7 @@ export declare const ControlPlaneAPI: HttpApi.HttpApi<"sealantControlPlaneApi",
         readonly connectedAccountLoginClass: import("effect/Schema").optional<import("effect/Schema").Boolean>;
         readonly kubernetesPersonLayout: import("effect/Schema").optional<import("effect/Schema").Boolean>;
         readonly credentialPlacements: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+        readonly connectedAccountApiKeys: import("effect/Schema").optional<import("effect/Schema").Boolean>;
     }>>;
 }>>, never, RequestRefusal, never> | import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"getSetupState", "GET", "/v1/system/setup-state", never, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly needsSetup: import("effect/Schema").Boolean;
@@ -1533,9 +1534,13 @@ export declare const ControlPlaneAPI: HttpApi.HttpApi<"sealantControlPlaneApi",
             readonly placementId: import("effect/Schema").String;
             readonly accountId: import("effect/Schema").String;
             readonly revision: import("effect/Schema").Int;
-            readonly login: import("effect/Schema").Struct<{
+            readonly login: import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
                 readonly kind: import("effect/Schema").Literal<"subscription">;
-            }>;
+            }>, import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"api-key">;
+                readonly suffix: import("effect/Schema").String;
+                readonly keyPath: import("effect/Schema").optional<import("effect/Schema").String>;
+            }>]>;
             readonly pinned: import("effect/Schema").Boolean;
             readonly provider: import("effect/Schema").Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
         }>>>;
@@ -1651,9 +1656,13 @@ export declare const ControlPlaneAPI: HttpApi.HttpApi<"sealantControlPlaneApi",
             readonly placementId: import("effect/Schema").String;
             readonly accountId: import("effect/Schema").String;
             readonly revision: import("effect/Schema").Int;
-            readonly login: import("effect/Schema").Struct<{
+            readonly login: import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
                 readonly kind: import("effect/Schema").Literal<"subscription">;
-            }>;
+            }>, import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"api-key">;
+                readonly suffix: import("effect/Schema").String;
+                readonly keyPath: import("effect/Schema").optional<import("effect/Schema").String>;
+            }>]>;
             readonly pinned: import("effect/Schema").Boolean;
             readonly provider: import("effect/Schema").Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
         }>>>;
@@ -1705,9 +1714,13 @@ export declare const ControlPlaneAPI: HttpApi.HttpApi<"sealantControlPlaneApi",
             readonly placementId: import("effect/Schema").String;
             readonly accountId: import("effect/Schema").String;
             readonly revision: import("effect/Schema").Int;
-            readonly login: import("effect/Schema").Struct<{
+            readonly login: import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
                 readonly kind: import("effect/Schema").Literal<"subscription">;
-            }>;
+            }>, import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"api-key">;
+                readonly suffix: import("effect/Schema").String;
+                readonly keyPath: import("effect/Schema").optional<import("effect/Schema").String>;
+            }>]>;
             readonly pinned: import("effect/Schema").Boolean;
             readonly provider: import("effect/Schema").Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
         }>>>;

package/dist/core-api/system.d.ts

@@ -65,6 +65,12 @@ export declare const systemIndexResponseSchema: Schema.Struct<{
         readonly kubernetesPersonLayout: Schema.optional<Schema.Boolean>;
         /** Credential homes answer placement receipts; a put takes `live`; prune exists. */
         readonly credentialPlacements: Schema.optional<Schema.Boolean>;
+        /**
+         * Claude and Codex API keys are placed: a credentials put writes a Claude key into a home as
+         * a file of its own, whose receipt carries `keyPath` and the key's suffix, and a Codex key as
+         * Codex's own key file. A `$HOME` launch still refuses a Claude key.
+         */
+        readonly connectedAccountApiKeys: Schema.optional<Schema.Boolean>;
     }>>;
 }>;
 export type SystemIndexResponse = typeof systemIndexResponseSchema.Type;
@@ -157,6 +163,12 @@ export declare const SystemGroup: HttpApiGroup.HttpApiGroup<"system", HttpApiEnd
         readonly kubernetesPersonLayout: Schema.optional<Schema.Boolean>;
         /** Credential homes answer placement receipts; a put takes `live`; prune exists. */
         readonly credentialPlacements: Schema.optional<Schema.Boolean>;
+        /**
+         * Claude and Codex API keys are placed: a credentials put writes a Claude key into a home as
+         * a file of its own, whose receipt carries `keyPath` and the key's suffix, and a Codex key as
+         * Codex's own key file. A `$HOME` launch still refuses a Claude key.
+         */
+        readonly connectedAccountApiKeys: Schema.optional<Schema.Boolean>;
     }>>;
 }>>, never, never, never> | HttpApiEndpoint.HttpApiEndpoint<"getSetupState", "GET", "/v1/system/setup-state", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
     readonly needsSetup: Schema.Boolean;

package/dist/core-api/system.js

@@ -66,6 +66,12 @@ export const systemIndexResponseSchema = Schema.Struct({
         kubernetesPersonLayout: Schema.optional(Schema.Boolean),
         /** Credential homes answer placement receipts; a put takes `live`; prune exists. */
         credentialPlacements: Schema.optional(Schema.Boolean),
+        /**
+         * Claude and Codex API keys are placed: a credentials put writes a Claude key into a home as
+         * a file of its own, whose receipt carries `keyPath` and the key's suffix, and a Codex key as
+         * Codex's own key file. A `$HOME` launch still refuses a Claude key.
+         */
+        connectedAccountApiKeys: Schema.optional(Schema.Boolean),
     })),
 });
 export const systemHealthResponseSchema = Schema.Struct({

package/dist/core-api/workspaces.d.ts

@@ -864,14 +864,30 @@ export declare const putWorkspaceCredentialsRequestSchema: Schema.Struct<{
     readonly live: Schema.optional<Schema.$Array<Schema.String>>;
 }>;
 export type PutWorkspaceCredentialsRequest = typeof putWorkspaceCredentialsRequestSchema.Type;
+/**
+ * What a placed login spends. A key carries its last four characters; a Claude key also its file's
+ * absolute path, which Claude reads through an `apiKeyHelper` such as `cat <keyPath>`.
+ */
+export declare const credentialPlacementLoginSchema: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"subscription">;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"api-key">;
+    readonly suffix: Schema.String;
+    readonly keyPath: Schema.optional<Schema.String>;
+}>]>;
+export type CredentialPlacementLogin = typeof credentialPlacementLoginSchema.Type;
 /** One login written into one home: its id stays the same while a refresh moves its revision. */
 export declare const credentialPlacementReceiptSchema: Schema.Struct<{
     readonly placementId: Schema.String;
     readonly accountId: Schema.String;
     readonly revision: Schema.Int;
-    readonly login: Schema.Struct<{
+    readonly login: Schema.Union<readonly [Schema.Struct<{
         readonly kind: Schema.Literal<"subscription">;
-    }>;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"api-key">;
+        readonly suffix: Schema.String;
+        readonly keyPath: Schema.optional<Schema.String>;
+    }>]>;
     readonly pinned: Schema.Boolean;
 }>;
 export type CredentialPlacementReceipt = typeof credentialPlacementReceiptSchema.Type;
@@ -880,9 +896,13 @@ export declare const workspaceCredentialPlacementReceiptSchema: Schema.Struct<{
     readonly placementId: Schema.String;
     readonly accountId: Schema.String;
     readonly revision: Schema.Int;
-    readonly login: Schema.Struct<{
+    readonly login: Schema.Union<readonly [Schema.Struct<{
         readonly kind: Schema.Literal<"subscription">;
-    }>;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"api-key">;
+        readonly suffix: Schema.String;
+        readonly keyPath: Schema.optional<Schema.String>;
+    }>]>;
     readonly pinned: Schema.Boolean;
     readonly provider: Schema.Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
 }>;
@@ -904,14 +924,23 @@ export declare const workspaceCredentialHomeSchema: Schema.Struct<{
         readonly placementId: Schema.String;
         readonly accountId: Schema.String;
         readonly revision: Schema.Int;
-        readonly login: Schema.Struct<{
+        readonly login: Schema.Union<readonly [Schema.Struct<{
             readonly kind: Schema.Literal<"subscription">;
-        }>;
+        }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"api-key">;
+            readonly suffix: Schema.String;
+            readonly keyPath: Schema.optional<Schema.String>;
+        }>]>;
         readonly pinned: Schema.Boolean;
         readonly provider: Schema.Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
     }>>>;
-    /** By provider; a provider the home holds no login for is absent. */
+    /**
+     * By provider, the account whose login holds the provider's one file; a provider the home holds
+     * no such login for is absent. Claude keys are not here: each is a placement of its own, and the
+     * receipts in `placements` say which logins a home holds.
+     */
     readonly accounts: Schema.Struct<{
+        /** The account of Claude's subscription file, never a Claude key's. */
         readonly claude: Schema.optional<Schema.Struct<{
             readonly connectedAccountId: Schema.String;
             /** The account's name under its provider, as it is now. */
@@ -968,14 +997,23 @@ export declare const putWorkspaceCredentialsResponseSchema: Schema.Struct<{
             readonly placementId: Schema.String;
             readonly accountId: Schema.String;
             readonly revision: Schema.Int;
-            readonly login: Schema.Struct<{
+            readonly login: Schema.Union<readonly [Schema.Struct<{
                 readonly kind: Schema.Literal<"subscription">;
-            }>;
+            }>, Schema.Struct<{
+                readonly kind: Schema.Literal<"api-key">;
+                readonly suffix: Schema.String;
+                readonly keyPath: Schema.optional<Schema.String>;
+            }>]>;
             readonly pinned: Schema.Boolean;
             readonly provider: Schema.Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
         }>>>;
-        /** By provider; a provider the home holds no login for is absent. */
+        /**
+         * By provider, the account whose login holds the provider's one file; a provider the home holds
+         * no such login for is absent. Claude keys are not here: each is a placement of its own, and the
+         * receipts in `placements` say which logins a home holds.
+         */
         readonly accounts: Schema.Struct<{
+            /** The account of Claude's subscription file, never a Claude key's. */
             readonly claude: Schema.optional<Schema.Struct<{
                 readonly connectedAccountId: Schema.String;
                 /** The account's name under its provider, as it is now. */
@@ -1038,14 +1076,23 @@ export declare const pruneWorkspaceCredentialsResponseSchema: Schema.Struct<{
             readonly placementId: Schema.String;
             readonly accountId: Schema.String;
             readonly revision: Schema.Int;
-            readonly login: Schema.Struct<{
+            readonly login: Schema.Union<readonly [Schema.Struct<{
                 readonly kind: Schema.Literal<"subscription">;
-            }>;
+            }>, Schema.Struct<{
+                readonly kind: Schema.Literal<"api-key">;
+                readonly suffix: Schema.String;
+                readonly keyPath: Schema.optional<Schema.String>;
+            }>]>;
             readonly pinned: Schema.Boolean;
             readonly provider: Schema.Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
         }>>>;
-        /** By provider; a provider the home holds no login for is absent. */
+        /**
+         * By provider, the account whose login holds the provider's one file; a provider the home holds
+         * no such login for is absent. Claude keys are not here: each is a placement of its own, and the
+         * receipts in `placements` say which logins a home holds.
+         */
         readonly accounts: Schema.Struct<{
+            /** The account of Claude's subscription file, never a Claude key's. */
             readonly claude: Schema.optional<Schema.Struct<{
                 readonly connectedAccountId: Schema.String;
                 /** The account's name under its provider, as it is now. */
@@ -1108,14 +1155,23 @@ export declare const listWorkspaceCredentialsResponseSchema: Schema.Struct<{
             readonly placementId: Schema.String;
             readonly accountId: Schema.String;
             readonly revision: Schema.Int;
-            readonly login: Schema.Struct<{
+            readonly login: Schema.Union<readonly [Schema.Struct<{
                 readonly kind: Schema.Literal<"subscription">;
-            }>;
+            }>, Schema.Struct<{
+                readonly kind: Schema.Literal<"api-key">;
+                readonly suffix: Schema.String;
+                readonly keyPath: Schema.optional<Schema.String>;
+            }>]>;
             readonly pinned: Schema.Boolean;
             readonly provider: Schema.Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
         }>>>;
-        /** By provider; a provider the home holds no login for is absent. */
+        /**
+         * By provider, the account whose login holds the provider's one file; a provider the home holds
+         * no such login for is absent. Claude keys are not here: each is a placement of its own, and the
+         * receipts in `placements` say which logins a home holds.
+         */
         readonly accounts: Schema.Struct<{
+            /** The account of Claude's subscription file, never a Claude key's. */
             readonly claude: Schema.optional<Schema.Struct<{
                 readonly connectedAccountId: Schema.String;
                 /** The account's name under its provider, as it is now. */
@@ -2837,14 +2893,23 @@ export declare const WorkspacesGroup: HttpApiGroup.HttpApiGroup<"workspaces", Ht
             readonly placementId: Schema.String;
             readonly accountId: Schema.String;
             readonly revision: Schema.Int;
-            readonly login: Schema.Struct<{
+            readonly login: Schema.Union<readonly [Schema.Struct<{
                 readonly kind: Schema.Literal<"subscription">;
-            }>;
+            }>, Schema.Struct<{
+                readonly kind: Schema.Literal<"api-key">;
+                readonly suffix: Schema.String;
+                readonly keyPath: Schema.optional<Schema.String>;
+            }>]>;
             readonly pinned: Schema.Boolean;
             readonly provider: Schema.Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
         }>>>;
-        /** By provider; a provider the home holds no login for is absent. */
+        /**
+         * By provider, the account whose login holds the provider's one file; a provider the home holds
+         * no such login for is absent. Claude keys are not here: each is a placement of its own, and the
+         * receipts in `placements` say which logins a home holds.
+         */
         readonly accounts: Schema.Struct<{
+            /** The account of Claude's subscription file, never a Claude key's. */
             readonly claude: Schema.optional<Schema.Struct<{
                 readonly connectedAccountId: Schema.String;
                 /** The account's name under its provider, as it is now. */
@@ -2999,14 +3064,23 @@ export declare const WorkspacesGroup: HttpApiGroup.HttpApiGroup<"workspaces", Ht
             readonly placementId: Schema.String;
             readonly accountId: Schema.String;
             readonly revision: Schema.Int;
-            readonly login: Schema.Struct<{
+            readonly login: Schema.Union<readonly [Schema.Struct<{
                 readonly kind: Schema.Literal<"subscription">;
-            }>;
+            }>, Schema.Struct<{
+                readonly kind: Schema.Literal<"api-key">;
+                readonly suffix: Schema.String;
+                readonly keyPath: Schema.optional<Schema.String>;
+            }>]>;
             readonly pinned: Schema.Boolean;
             readonly provider: Schema.Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
         }>>>;
-        /** By provider; a provider the home holds no login for is absent. */
+        /**
+         * By provider, the account whose login holds the provider's one file; a provider the home holds
+         * no such login for is absent. Claude keys are not here: each is a placement of its own, and the
+         * receipts in `placements` say which logins a home holds.
+         */
         readonly accounts: Schema.Struct<{
+            /** The account of Claude's subscription file, never a Claude key's. */
             readonly claude: Schema.optional<Schema.Struct<{
                 readonly connectedAccountId: Schema.String;
                 /** The account's name under its provider, as it is now. */
@@ -3097,14 +3171,23 @@ export declare const WorkspacesGroup: HttpApiGroup.HttpApiGroup<"workspaces", Ht
             readonly placementId: Schema.String;
             readonly accountId: Schema.String;
             readonly revision: Schema.Int;
-            readonly login: Schema.Struct<{
+            readonly login: Schema.Union<readonly [Schema.Struct<{
                 readonly kind: Schema.Literal<"subscription">;
-            }>;
+            }>, Schema.Struct<{
+                readonly kind: Schema.Literal<"api-key">;
+                readonly suffix: Schema.String;
+                readonly keyPath: Schema.optional<Schema.String>;
+            }>]>;
             readonly pinned: Schema.Boolean;
             readonly provider: Schema.Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
         }>>>;
-        /** By provider; a provider the home holds no login for is absent. */
+        /**
+         * By provider, the account whose login holds the provider's one file; a provider the home holds
+         * no such login for is absent. Claude keys are not here: each is a placement of its own, and the
+         * receipts in `placements` say which logins a home holds.
+         */
         readonly accounts: Schema.Struct<{
+            /** The account of Claude's subscription file, never a Claude key's. */
             readonly claude: Schema.optional<Schema.Struct<{
                 readonly connectedAccountId: Schema.String;
                 /** The account's name under its provider, as it is now. */

package/dist/core-api/workspaces.js

@@ -741,12 +741,24 @@ export const putWorkspaceCredentialsRequestSchema = Schema.Struct({
      */
     live: Schema.optional(Schema.Array(NonEmptyString)),
 });
+/**
+ * What a placed login spends. A key carries its last four characters; a Claude key also its file's
+ * absolute path, which Claude reads through an `apiKeyHelper` such as `cat <keyPath>`.
+ */
+export const credentialPlacementLoginSchema = Schema.Union([
+    Schema.Struct({ kind: Schema.Literal("subscription") }),
+    Schema.Struct({
+        kind: Schema.Literal("api-key"),
+        suffix: NonEmptyString,
+        keyPath: Schema.optional(NonEmptyString),
+    }),
+]);
 /** One login written into one home: its id stays the same while a refresh moves its revision. */
 export const credentialPlacementReceiptSchema = Schema.Struct({
     placementId: NonEmptyString,
     accountId: NonEmptyString,
     revision: Schema.Int.check(Schema.isGreaterThan(0)),
-    login: Schema.Struct({ kind: Schema.Literal("subscription") }),
+    login: credentialPlacementLoginSchema,
     pinned: Schema.Boolean,
 });
 /** A receipt tagged with the home provider whose slot it occupies. */
@@ -767,8 +779,13 @@ export const workspaceCredentialHomeSchema = Schema.Struct({
     onBehalfOfUserId: NonEmptyString,
     /** The logins written there, one receipt each. Absent from a server without placements. */
     placements: Schema.optional(Schema.Array(workspaceCredentialPlacementReceiptSchema)),
-    /** By provider; a provider the home holds no login for is absent. */
+    /**
+     * By provider, the account whose login holds the provider's one file; a provider the home holds
+     * no such login for is absent. Claude keys are not here: each is a placement of its own, and the
+     * receipts in `placements` say which logins a home holds.
+     */
     accounts: Schema.Struct({
+        /** The account of Claude's subscription file, never a Claude key's. */
         claude: Schema.optional(workspaceHomeAccountSchema),
         codex: Schema.optional(workspaceHomeAccountSchema),
         github: Schema.optional(workspaceHomeAccountSchema),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealant/api-contracts-next",
-  "version": "0.40.0-next.765",
+  "version": "0.40.0-next.767",
   "description": "Contract-first HTTP API definitions for Sealant services",
   "license": "Apache-2.0",
   "repository": {
@@ -36,7 +36,7 @@
   "peerDependencies": {
     "effect": "^4.0.5"
   },
-  "gitHead": "9802ef32e54645b875272fecf15d036bf7f095e1",
+  "gitHead": "97076a88aa9305d64290508d681af72dfa89868f",
   "publishConfig": {
     "access": "public"
   }