@sealant/sdk-next 0.39.0-next.753 → 0.40.0-next.755

package/dist/client.js

@@ -1,4 +1,4 @@
-import { archiveConnectedAccountOp, archiveSshKeyOp, cancelWorkspaceCreateOp, createAccessTokenOp, createConnectedAccountOp, createSshKeyOp, createWorkspaceOp, ensureUserOp, getRunOp, getSetupStateOp, getUserOp, bindUserPersonOp, getWorkspaceCreateOp, getWorkspaceOp, inferenceRespondOp, inspectWorkspaceImageOp, listConnectedAccountsOp, listSshKeysOp, listWorkspacesOp, } from "./effect/operations.js";
+import { archiveConnectedAccountOp, archiveSshKeyOp, cancelWorkspaceCreateOp, createAccessTokenOp, createConnectedAccountOp, createSshKeyOp, createWorkspaceOp, ensureUserOp, getRunOp, getSetupStateOp, getUserOp, bindUserPersonOp, getWorkspaceCreateOp, getWorkspaceOp, inferenceRespondOp, inspectWorkspaceImageOp, listConnectedAccountsOp, listSshKeysOp, listWorkspacesOp, markConnectedAccountInvalidOp, setConnectedAccountDefaultOp, } from "./effect/operations.js";
 import { runHarness, startHarness } from "./effect/run-harness.js";
 import { makeSdkRuntime } from "./effect/runtime.js";
 import { SealantError } from "./errors.js";
@@ -7,7 +7,7 @@ import { makeWorkspace, registerHarnessExecutors, toRuntimeInfo, toWorkspaceImag
 import { buildCreateWorkspaceRequest } from "./internal/blueprint.js";
 import { resolveInternalConfig } from "./internal/config.js";
 import { parseTtlSeconds } from "./internal/duration.js";
-import { readFeatures } from "./internal/features.js";
+import { readFeatures, requireConnectedAccountDefaults } from "./internal/features.js";
 import { imageSpecKey } from "./internal/image-key.js";
 import { buildInferenceRespondRequest, mapInferenceResponse } from "./internal/inference.js";
 import { requireSshUser } from "./internal/process-user.js";
@@ -33,6 +33,8 @@ const mapConnectedAccount = (wire) => ({
     lastUsedAt: wire.lastUsedAt,
     lastSyncedAt: wire.lastSyncedAt,
     credential: wire.credential,
+    isDefault: wire.isDefault ?? wire.name === "default",
+    ...(wire.credentialRevision === undefined ? {} : { credentialRevision: wire.credentialRevision }),
 });
 // Wire the run-execution implementations into the Workspace facade (the injection point exists to
 // break the workspace <-> run-harness import cycle; the client is the composition root).
@@ -243,11 +245,16 @@ export class Sealant {
             return wire.items.map(mapConnectedAccount);
         },
         connect: async (options) => {
+            if (options.accountId !== undefined || options.makeDefault !== undefined) {
+                await requireConnectedAccountDefaults(this.#ctx);
+            }
             const wire = await this.#runtime.run(createConnectedAccountOp({
                 ownerUserId: this.#ctx.config.hostLocal.ownerUserId,
                 provider: options.provider,
                 secret: options.secret,
                 ...(options.name === undefined ? {} : { name: options.name }),
+                ...(options.accountId === undefined ? {} : { accountId: options.accountId }),
+                ...(options.makeDefault === undefined ? {} : { makeDefault: options.makeDefault }),
             }));
             return mapConnectedAccount(wire);
         },
@@ -255,6 +262,24 @@ export class Sealant {
             const wire = await this.#runtime.run(archiveConnectedAccountOp(connectedAccountId, this.#ctx.config.hostLocal.ownerUserId));
             return mapConnectedAccount(wire);
         },
+        setDefault: async (options) => {
+            await requireConnectedAccountDefaults(this.#ctx);
+            const wire = await this.#runtime.run(setConnectedAccountDefaultOp(options.provider, {
+                ownerUserId: this.#ctx.config.hostLocal.ownerUserId,
+                connectedAccountId: options.accountId,
+            }));
+            return mapConnectedAccount(wire);
+        },
+        markInvalid: async (connectedAccountId, options) => {
+            if (options?.revision !== undefined) {
+                await requireConnectedAccountDefaults(this.#ctx);
+            }
+            const wire = await this.#runtime.run(markConnectedAccountInvalidOp(connectedAccountId, {
+                ownerUserId: this.#ctx.config.hostLocal.ownerUserId,
+                ...(options?.revision === undefined ? {} : { revision: options.revision }),
+            }));
+            return { outcome: wire.outcome ?? "marked", account: mapConnectedAccount(wire) };
+        },
     };
     /**
      * Where workspace SSH connects for this deployment — how an editor (VS Code Remote-SSH) or

package/dist/effect/api-client.d.ts

@@ -74,11 +74,15 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly lastRefreshAt: import("effect/Schema").NullOr<import("effect/Schema").String>;
                 readonly lastRefreshOutcome: import("effect/Schema").NullOr<import("effect/Schema").Literals<readonly ["refreshed", "fresh", "failed"]>>;
             }>;
+            readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+            readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ConnectedAccountNotFoundError | typeof import("@sealant/api-contracts").ConnectedAccountInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly createConnectedAccount: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"createConnectedAccount", "POST", "/v1/connected-accounts/", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
             readonly ownerUserId: import("effect/Schema").String;
             readonly provider: import("effect/Schema").Literals<readonly ["claude", "codex", "github"]>;
             readonly name: import("effect/Schema").optional<import("effect/Schema").String>;
+            readonly accountId: import("effect/Schema").optional<import("effect/Schema").String>;
+            readonly makeDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
             readonly secret: import("effect/Schema").String;
         }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
             readonly connectedAccountId: import("effect/Schema").String;
@@ -98,6 +102,8 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly lastRefreshAt: import("effect/Schema").NullOr<import("effect/Schema").String>;
                 readonly lastRefreshOutcome: import("effect/Schema").NullOr<import("effect/Schema").Literals<readonly ["refreshed", "fresh", "failed"]>>;
             }>;
+            readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+            readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ConnectedAccountBadRequestError | typeof import("@sealant/api-contracts").ConnectedAccountNotFoundError | typeof import("@sealant/api-contracts").ConnectedAccountConflictError | typeof import("@sealant/api-contracts").ConnectedAccountServiceUnavailableError | typeof import("@sealant/api-contracts").ConnectedAccountInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly listConnectedAccounts: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"listConnectedAccounts", "GET", "/v1/connected-accounts/", never, import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
             readonly ownerUserId: import("effect/Schema").String;
@@ -120,12 +126,15 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                     readonly lastRefreshAt: import("effect/Schema").NullOr<import("effect/Schema").String>;
                     readonly lastRefreshOutcome: import("effect/Schema").NullOr<import("effect/Schema").Literals<readonly ["refreshed", "fresh", "failed"]>>;
                 }>;
+                readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+                readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
             }>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ConnectedAccountInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly markConnectedAccountInvalid: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"markConnectedAccountInvalid", "POST", "/v1/connected-accounts/:connectedAccountId/mark-invalid", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
             readonly connectedAccountId: import("effect/Schema").String;
         }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
             readonly ownerUserId: import("effect/Schema").String;
+            readonly revision: import("effect/Schema").optional<import("effect/Schema").Int>;
         }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
             readonly connectedAccountId: import("effect/Schema").String;
             readonly ownerUserId: import("effect/Schema").String;
@@ -144,7 +153,36 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly lastRefreshAt: import("effect/Schema").NullOr<import("effect/Schema").String>;
                 readonly lastRefreshOutcome: import("effect/Schema").NullOr<import("effect/Schema").Literals<readonly ["refreshed", "fresh", "failed"]>>;
             }>;
+            readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+            readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
+            readonly outcome: import("effect/Schema").optional<import("effect/Schema").Literals<readonly ["marked", "superseded"]>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ConnectedAccountNotFoundError | typeof import("@sealant/api-contracts").ConnectedAccountInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
+        readonly setConnectedAccountDefault: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"setConnectedAccountDefault", "PUT", "/v1/connected-accounts/defaults/:provider", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+            readonly provider: import("effect/Schema").Literals<readonly ["claude", "codex", "github"]>;
+        }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly ownerUserId: import("effect/Schema").String;
+            readonly connectedAccountId: import("effect/Schema").String;
+        }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly connectedAccountId: import("effect/Schema").String;
+            readonly ownerUserId: import("effect/Schema").String;
+            readonly provider: import("effect/Schema").Literals<readonly ["claude", "codex", "github"]>;
+            readonly name: import("effect/Schema").String;
+            readonly kind: import("effect/Schema").String;
+            readonly status: import("effect/Schema").Literals<readonly ["active", "invalid", "archived"]>;
+            readonly metadata: import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>;
+            readonly connectedAt: import("effect/Schema").String;
+            readonly updatedAt: import("effect/Schema").String;
+            readonly lastUsedAt: import("effect/Schema").NullOr<import("effect/Schema").String>;
+            readonly lastSyncedAt: import("effect/Schema").NullOr<import("effect/Schema").String>;
+            readonly credential: import("effect/Schema").Struct<{
+                readonly accessExpiresAt: import("effect/Schema").NullOr<import("effect/Schema").String>;
+                readonly refreshExpiresAt: import("effect/Schema").NullOr<import("effect/Schema").String>;
+                readonly lastRefreshAt: import("effect/Schema").NullOr<import("effect/Schema").String>;
+                readonly lastRefreshOutcome: import("effect/Schema").NullOr<import("effect/Schema").Literals<readonly ["refreshed", "fresh", "failed"]>>;
+            }>;
+            readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+            readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
+        }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ConnectedAccountNotFoundError | typeof import("@sealant/api-contracts").ConnectedAccountConflictError | typeof import("@sealant/api-contracts").ConnectedAccountInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
     };
     readonly github: {
         readonly handleWebhook: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"handleWebhook", "POST", "/v1/github/webhooks", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").String>, import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
@@ -341,6 +379,8 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                         readonly lastRefreshAt: import("effect/Schema").NullOr<import("effect/Schema").String>;
                         readonly lastRefreshOutcome: import("effect/Schema").NullOr<import("effect/Schema").Literals<readonly ["refreshed", "fresh", "failed"]>>;
                     }>;
+                    readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+                    readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
                 }>;
             }>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ProfileNotFoundError | typeof import("@sealant/api-contracts").ProfileInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
@@ -388,6 +428,8 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                         readonly lastRefreshAt: import("effect/Schema").NullOr<import("effect/Schema").String>;
                         readonly lastRefreshOutcome: import("effect/Schema").NullOr<import("effect/Schema").Literals<readonly ["refreshed", "fresh", "failed"]>>;
                     }>;
+                    readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+                    readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
                 }>;
             }>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ProfileBadRequestError | typeof import("@sealant/api-contracts").ProfileNotFoundError | typeof import("@sealant/api-contracts").ProfileConflictError | typeof import("@sealant/api-contracts").ProfileInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
@@ -942,6 +984,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly workspaceSshUser: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                 readonly personBinding: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                 readonly sshKeyRemovalEndsConnections: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+                readonly connectedAccountDefaults: import("effect/Schema").optional<import("effect/Schema").Boolean>;
             }>>;
         }>>, never, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly getSetupState: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"getSetupState", "GET", "/v1/system/setup-state", never, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
@@ -1849,11 +1892,15 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly lastRefreshAt: import("effect/Schema").NullOr<import("effect/Schema").String>;
                 readonly lastRefreshOutcome: import("effect/Schema").NullOr<import("effect/Schema").Literals<readonly ["refreshed", "fresh", "failed"]>>;
             }>;
+            readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+            readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ConnectedAccountNotFoundError | typeof import("@sealant/api-contracts").ConnectedAccountInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly createConnectedAccount: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"createConnectedAccount", "POST", "/v1/connected-accounts/", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
             readonly ownerUserId: import("effect/Schema").String;
             readonly provider: import("effect/Schema").Literals<readonly ["claude", "codex", "github"]>;
             readonly name: import("effect/Schema").optional<import("effect/Schema").String>;
+            readonly accountId: import("effect/Schema").optional<import("effect/Schema").String>;
+            readonly makeDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
             readonly secret: import("effect/Schema").String;
         }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
             readonly connectedAccountId: import("effect/Schema").String;
@@ -1873,6 +1920,8 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly lastRefreshAt: import("effect/Schema").NullOr<import("effect/Schema").String>;
                 readonly lastRefreshOutcome: import("effect/Schema").NullOr<import("effect/Schema").Literals<readonly ["refreshed", "fresh", "failed"]>>;
             }>;
+            readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+            readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ConnectedAccountBadRequestError | typeof import("@sealant/api-contracts").ConnectedAccountNotFoundError | typeof import("@sealant/api-contracts").ConnectedAccountConflictError | typeof import("@sealant/api-contracts").ConnectedAccountServiceUnavailableError | typeof import("@sealant/api-contracts").ConnectedAccountInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly listConnectedAccounts: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"listConnectedAccounts", "GET", "/v1/connected-accounts/", never, import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
             readonly ownerUserId: import("effect/Schema").String;
@@ -1895,12 +1944,15 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                     readonly lastRefreshAt: import("effect/Schema").NullOr<import("effect/Schema").String>;
                     readonly lastRefreshOutcome: import("effect/Schema").NullOr<import("effect/Schema").Literals<readonly ["refreshed", "fresh", "failed"]>>;
                 }>;
+                readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+                readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
             }>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ConnectedAccountInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly markConnectedAccountInvalid: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"markConnectedAccountInvalid", "POST", "/v1/connected-accounts/:connectedAccountId/mark-invalid", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
             readonly connectedAccountId: import("effect/Schema").String;
         }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
             readonly ownerUserId: import("effect/Schema").String;
+            readonly revision: import("effect/Schema").optional<import("effect/Schema").Int>;
         }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
             readonly connectedAccountId: import("effect/Schema").String;
             readonly ownerUserId: import("effect/Schema").String;
@@ -1919,7 +1971,36 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly lastRefreshAt: import("effect/Schema").NullOr<import("effect/Schema").String>;
                 readonly lastRefreshOutcome: import("effect/Schema").NullOr<import("effect/Schema").Literals<readonly ["refreshed", "fresh", "failed"]>>;
             }>;
+            readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+            readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
+            readonly outcome: import("effect/Schema").optional<import("effect/Schema").Literals<readonly ["marked", "superseded"]>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ConnectedAccountNotFoundError | typeof import("@sealant/api-contracts").ConnectedAccountInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
+        readonly setConnectedAccountDefault: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"setConnectedAccountDefault", "PUT", "/v1/connected-accounts/defaults/:provider", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+            readonly provider: import("effect/Schema").Literals<readonly ["claude", "codex", "github"]>;
+        }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly ownerUserId: import("effect/Schema").String;
+            readonly connectedAccountId: import("effect/Schema").String;
+        }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly connectedAccountId: import("effect/Schema").String;
+            readonly ownerUserId: import("effect/Schema").String;
+            readonly provider: import("effect/Schema").Literals<readonly ["claude", "codex", "github"]>;
+            readonly name: import("effect/Schema").String;
+            readonly kind: import("effect/Schema").String;
+            readonly status: import("effect/Schema").Literals<readonly ["active", "invalid", "archived"]>;
+            readonly metadata: import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>;
+            readonly connectedAt: import("effect/Schema").String;
+            readonly updatedAt: import("effect/Schema").String;
+            readonly lastUsedAt: import("effect/Schema").NullOr<import("effect/Schema").String>;
+            readonly lastSyncedAt: import("effect/Schema").NullOr<import("effect/Schema").String>;
+            readonly credential: import("effect/Schema").Struct<{
+                readonly accessExpiresAt: import("effect/Schema").NullOr<import("effect/Schema").String>;
+                readonly refreshExpiresAt: import("effect/Schema").NullOr<import("effect/Schema").String>;
+                readonly lastRefreshAt: import("effect/Schema").NullOr<import("effect/Schema").String>;
+                readonly lastRefreshOutcome: import("effect/Schema").NullOr<import("effect/Schema").Literals<readonly ["refreshed", "fresh", "failed"]>>;
+            }>;
+            readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+            readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
+        }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ConnectedAccountNotFoundError | typeof import("@sealant/api-contracts").ConnectedAccountConflictError | typeof import("@sealant/api-contracts").ConnectedAccountInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
     };
     readonly github: {
         readonly handleWebhook: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"handleWebhook", "POST", "/v1/github/webhooks", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").String>, import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
@@ -2116,6 +2197,8 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                         readonly lastRefreshAt: import("effect/Schema").NullOr<import("effect/Schema").String>;
                         readonly lastRefreshOutcome: import("effect/Schema").NullOr<import("effect/Schema").Literals<readonly ["refreshed", "fresh", "failed"]>>;
                     }>;
+                    readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+                    readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
                 }>;
             }>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ProfileNotFoundError | typeof import("@sealant/api-contracts").ProfileInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
@@ -2163,6 +2246,8 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                         readonly lastRefreshAt: import("effect/Schema").NullOr<import("effect/Schema").String>;
                         readonly lastRefreshOutcome: import("effect/Schema").NullOr<import("effect/Schema").Literals<readonly ["refreshed", "fresh", "failed"]>>;
                     }>;
+                    readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+                    readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
                 }>;
             }>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ProfileBadRequestError | typeof import("@sealant/api-contracts").ProfileNotFoundError | typeof import("@sealant/api-contracts").ProfileConflictError | typeof import("@sealant/api-contracts").ProfileInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
@@ -2717,6 +2802,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly workspaceSshUser: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                 readonly personBinding: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                 readonly sshKeyRemovalEndsConnections: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+                readonly connectedAccountDefaults: import("effect/Schema").optional<import("effect/Schema").Boolean>;
             }>>;
         }>>, never, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly getSetupState: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"getSetupState", "GET", "/v1/system/setup-state", never, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{

package/dist/effect/operations.d.ts

@@ -1109,12 +1109,16 @@ export declare const listConnectedAccountsOp: (ownerUserId: string) => Effect.Ef
             readonly lastRefreshAt: string | null;
             readonly lastRefreshOutcome: "failed" | "fresh" | "refreshed" | null;
         };
+        readonly isDefault?: boolean | undefined;
+        readonly credentialRevision?: number | undefined;
     }[];
 }, import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("effect/Schema").SchemaError, SealantApiClient>;
 export declare const createConnectedAccountOp: (payload: {
     readonly ownerUserId: string;
     readonly provider: "claude" | "codex" | "github";
     readonly name?: string | undefined;
+    readonly accountId?: string | undefined;
+    readonly makeDefault?: boolean | undefined;
     readonly secret: string;
 }) => Effect.Effect<{
     readonly connectedAccountId: string;
@@ -1136,6 +1140,8 @@ export declare const createConnectedAccountOp: (payload: {
         readonly lastRefreshAt: string | null;
         readonly lastRefreshOutcome: "failed" | "fresh" | "refreshed" | null;
     };
+    readonly isDefault?: boolean | undefined;
+    readonly credentialRevision?: number | undefined;
 }, import("@sealant/api-contracts").ConnectedAccountBadRequestError | import("@sealant/api-contracts").ConnectedAccountConflictError | import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("@sealant/api-contracts").ConnectedAccountNotFoundError | import("@sealant/api-contracts").ConnectedAccountServiceUnavailableError | import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("effect/Schema").SchemaError, SealantApiClient>;
 export declare const archiveConnectedAccountOp: (connectedAccountId: string, ownerUserId: string) => Effect.Effect<{
     readonly connectedAccountId: string;
@@ -1157,6 +1163,61 @@ export declare const archiveConnectedAccountOp: (connectedAccountId: string, own
         readonly lastRefreshAt: string | null;
         readonly lastRefreshOutcome: "failed" | "fresh" | "refreshed" | null;
     };
+    readonly isDefault?: boolean | undefined;
+    readonly credentialRevision?: number | undefined;
+}, import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("@sealant/api-contracts").ConnectedAccountNotFoundError | import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("effect/Schema").SchemaError, SealantApiClient>;
+export declare const setConnectedAccountDefaultOp: (provider: "claude" | "codex" | "github", payload: {
+    readonly ownerUserId: string;
+    readonly connectedAccountId: string;
+}) => Effect.Effect<{
+    readonly connectedAccountId: string;
+    readonly ownerUserId: string;
+    readonly provider: "claude" | "codex" | "github";
+    readonly name: string;
+    readonly kind: string;
+    readonly status: "active" | "archived" | "invalid";
+    readonly metadata: {
+        readonly [x: string]: unknown;
+    };
+    readonly connectedAt: string;
+    readonly updatedAt: string;
+    readonly lastUsedAt: string | null;
+    readonly lastSyncedAt: string | null;
+    readonly credential: {
+        readonly accessExpiresAt: string | null;
+        readonly refreshExpiresAt: string | null;
+        readonly lastRefreshAt: string | null;
+        readonly lastRefreshOutcome: "failed" | "fresh" | "refreshed" | null;
+    };
+    readonly isDefault?: boolean | undefined;
+    readonly credentialRevision?: number | undefined;
+}, import("@sealant/api-contracts").ConnectedAccountConflictError | import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("@sealant/api-contracts").ConnectedAccountNotFoundError | import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("effect/Schema").SchemaError, SealantApiClient>;
+export declare const markConnectedAccountInvalidOp: (connectedAccountId: string, payload: {
+    readonly ownerUserId: string;
+    readonly revision?: number | undefined;
+}) => Effect.Effect<{
+    readonly connectedAccountId: string;
+    readonly ownerUserId: string;
+    readonly provider: "claude" | "codex" | "github";
+    readonly name: string;
+    readonly kind: string;
+    readonly status: "active" | "archived" | "invalid";
+    readonly metadata: {
+        readonly [x: string]: unknown;
+    };
+    readonly connectedAt: string;
+    readonly updatedAt: string;
+    readonly lastUsedAt: string | null;
+    readonly lastSyncedAt: string | null;
+    readonly credential: {
+        readonly accessExpiresAt: string | null;
+        readonly refreshExpiresAt: string | null;
+        readonly lastRefreshAt: string | null;
+        readonly lastRefreshOutcome: "failed" | "fresh" | "refreshed" | null;
+    };
+    readonly isDefault?: boolean | undefined;
+    readonly credentialRevision?: number | undefined;
+    readonly outcome?: "marked" | "superseded" | undefined;
 }, import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("@sealant/api-contracts").ConnectedAccountNotFoundError | import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("effect/Schema").SchemaError, SealantApiClient>;
 export declare const inferenceRespondOp: (payload: {
     readonly ownerUserId: string;
@@ -1218,6 +1279,7 @@ export declare const getIndexOp: () => Effect.Effect<{
         readonly workspaceSshUser?: boolean | undefined;
         readonly personBinding?: boolean | undefined;
         readonly sshKeyRemovalEndsConnections?: boolean | undefined;
+        readonly connectedAccountDefaults?: boolean | undefined;
     } | undefined;
 }, import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("effect/Schema").SchemaError, SealantApiClient>;
 export declare const getSetupStateOp: () => Effect.Effect<{

package/dist/effect/operations.js

@@ -70,6 +70,11 @@ export const archiveConnectedAccountOp = (connectedAccountId, ownerUserId) => Ef
     params: { connectedAccountId },
     query: { ownerUserId },
 }));
+export const setConnectedAccountDefaultOp = (provider, payload) => Effect.flatMap(SealantApiClient, (client) => client.connectedAccounts.setConnectedAccountDefault({ params: { provider }, payload }));
+export const markConnectedAccountInvalidOp = (connectedAccountId, payload) => Effect.flatMap(SealantApiClient, (client) => client.connectedAccounts.markConnectedAccountInvalid({
+    params: { connectedAccountId },
+    payload,
+}));
 // ---- inference ----
 export const inferenceRespondOp = (payload) => Effect.flatMap(SealantApiClient, (client) => client.inference.respond({ payload }));
 // ---- system ----

package/dist/errors.d.ts

@@ -37,11 +37,14 @@ export declare class SealantApiError extends SealantError {
      * reason is about (`claude`, `codex`, `github`).
      */
     readonly provider?: string;
+    /** The accounts a `connected-account-ambiguous` connect could have meant. */
+    readonly candidateAccountIds?: readonly string[];
     constructor(message: string, options?: {
         readonly code?: string;
         readonly status?: number;
         readonly reason?: string;
         readonly provider?: string;
+        readonly candidateAccountIds?: readonly string[];
         readonly cause?: unknown;
     });
 }

package/dist/errors.js

@@ -39,6 +39,8 @@ export class SealantApiError extends SealantError {
      * reason is about (`claude`, `codex`, `github`).
      */
     provider;
+    /** The accounts a `connected-account-ambiguous` connect could have meant. */
+    candidateAccountIds;
     constructor(message, options) {
         super(message, {
             code: options?.code ?? "api_error",
@@ -53,6 +55,9 @@ export class SealantApiError extends SealantError {
         if (options?.provider !== undefined) {
             this.provider = options.provider;
         }
+        if (options?.candidateAccountIds !== undefined) {
+            this.candidateAccountIds = options.candidateAccountIds;
+        }
     }
 }
 /** The requested operation is part of the public surface but not yet implemented in this slice. */

package/dist/internal/credentials.d.ts

@@ -4,8 +4,7 @@
  * calls it and folds the result into the request it builds.
  *
  * SECURITY: this only ever moves account **references** (booleans/names/ids) — never token values or
- * other secret material. `true` resolves to the literal account name `"default"`; a string passes
- * through as the named account; `profile` becomes `profileId`.
+ * other secret material.
  */
 import type { WorkspaceCredentialsOptions } from "../types.js";
 /** The control-plane's workspace-create payload shape for connected-account credentials. */
@@ -15,7 +14,6 @@ export interface WorkspaceCredentialsPayload {
     readonly codex?: string;
     readonly github?: string;
 }
-/** `true` → the account named `default`; a string passes through; `false`/absent → none. */
 export declare const mapAccountRef: (value: string | boolean | undefined) => string | undefined;
 /**
  * Maps `WorkspaceCredentialsOptions` to the API payload shape, or `undefined` when no credentials were

package/dist/internal/credentials.js

@@ -1,5 +1,4 @@
 const DEFAULT_ACCOUNT_NAME = "default";
-/** `true` → the account named `default`; a string passes through; `false`/absent → none. */
 export const mapAccountRef = (value) => {
     if (value === undefined || value === false) {
         return undefined;

package/dist/internal/features.d.ts

@@ -16,6 +16,7 @@ export declare const toFeatures: (index: {
         readonly workspaceSshUser?: boolean | undefined;
         readonly personBinding?: boolean | undefined;
         readonly sshKeyRemovalEndsConnections?: boolean | undefined;
+        readonly connectedAccountDefaults?: boolean | undefined;
     } | undefined;
 }) => SealantFeatures;
 /**
@@ -23,3 +24,4 @@ export declare const toFeatures: (index: {
  * index could not be read; the failure is kept briefly, then the index is asked again.
  */
 export declare const readFeatures: (ctx: SdkContext) => Promise<SealantFeatures>;
+export declare const requireConnectedAccountDefaults: (ctx: SdkContext) => Promise<void>;

package/dist/internal/features.js

@@ -1,4 +1,5 @@
 import { getIndexOp } from "../effect/operations.js";
+import { SealantError } from "../errors.js";
 import { elapsed } from "./clock.js";
 /** How long an answer is kept: an upgraded control plane is noticed within this. */
 const ANSWER_TTL_MS = 5 * 60_000;
@@ -19,6 +20,7 @@ export const toFeatures = (index) => {
         workspaceSshUser: features?.workspaceSshUser === true,
         personBinding: features?.personBinding === true,
         sshKeyRemovalEndsConnections: features?.sshKeyRemovalEndsConnections === true,
+        connectedAccountDefaults: features?.connectedAccountDefaults === true,
     };
 };
 /**
@@ -41,3 +43,9 @@ export const readFeatures = (ctx) => {
     answers.set(ctx.runtime, fresh);
     return fresh.features;
 };
+export const requireConnectedAccountDefaults = async (ctx) => {
+    const supported = await readFeatures(ctx).then((features) => features.connectedAccountDefaults, () => false);
+    if (!supported) {
+        throw new SealantError("This control plane cannot choose a default connected account or target one by id (it does not report the feature, or could not be asked); nothing was sent.", { code: "connected-account-defaults-unsupported" });
+    }
+};

package/dist/internal/inference.js

@@ -1,10 +1,4 @@
-const DEFAULT_ACCOUNT_NAME = "default";
-const mapAccountRef = (value) => {
-    if (value === undefined || value === false) {
-        return undefined;
-    }
-    return value === true ? DEFAULT_ACCOUNT_NAME : value;
-};
+import { mapAccountRef } from "./credentials.js";
 export const buildInferenceRespondRequest = (options, ownerUserId) => {
     if ("sessionId" in options) {
         return {

package/dist/internal/map-error.js

@@ -37,11 +37,16 @@ export const toSealantError = (cause) => {
         const status = extractStatus(record);
         const reason = nonEmptyString(record?.["code"]);
         const provider = nonEmptyString(record?.["provider"]);
+        const candidates = record?.["candidateAccountIds"];
+        const candidateAccountIds = Array.isArray(candidates)
+            ? candidates.filter((id) => typeof id === "string")
+            : undefined;
         return new SealantApiError(message, {
             code: tag,
             ...(status === undefined ? {} : { status }),
             ...(reason === undefined ? {} : { reason }),
             ...(provider === undefined ? {} : { provider }),
+            ...(candidateAccountIds === undefined ? {} : { candidateAccountIds }),
             cause,
         });
     }

package/dist/types.d.ts

@@ -151,8 +151,8 @@ export type WorkspaceOs = "fedora" | "arch" | "nix" | "ubuntu";
  * harness inside the workspace authenticates as the caller's own Claude / Codex / GitHub identity
  * instead of running unauthenticated.
  *
- * For each provider: `true` means "my default account" (the one named `"default"`), and a `string`
- * names a specific connected account. `profile` names a profile slug/id whose bundled per-provider
+ * For each provider: `true` means "my default account" (the one I chose; see
+ * {@link ConnectedAccountsNamespace.setDefault}), and a `string` names a specific connected account. `profile` names a profile slug/id whose bundled per-provider
  * bindings apply first; any explicit `claude`/`codex`/`github` field wins over the profile's binding
  * for that provider.
  *
@@ -1395,6 +1395,12 @@ export interface SealantFeatures {
      * a minute; from an older control plane they stay open until the workspace stops.
      */
     readonly sshKeyRemovalEndsConnections: boolean;
+    /**
+     * A default account per provider is a choice: `connectedAccounts.setDefault()`, `accountId` and
+     * `makeDefault` on `connect()`. On an older control plane the default is the account named
+     * `default`.
+     */
+    readonly connectedAccountDefaults: boolean;
 }
 /** A published workspace image. */
 export interface WorkspaceImage {
@@ -2106,26 +2112,82 @@ export interface ConnectedAccount {
     readonly lastUsedAt: string | null;
     readonly lastSyncedAt: string | null;
     readonly credential: ConnectedAccountCredential;
+    /**
+     * Whether this is the owner's default for its provider, the one `true` selects. From a control
+     * plane without `connectedAccountDefaults`: whether it is named `default`.
+     */
+    readonly isDefault: boolean;
+    /**
+     * Which credential the account holds; it moves on whenever different bytes are stored. Absent
+     * from a control plane without `connectedAccountDefaults`.
+     */
+    readonly credentialRevision?: number;
 }
-export interface ConnectConnectedAccountOptions {
+interface ConnectConnectedAccountBase {
     readonly provider: ConnectedAccountProvider;
     /**
      * Provider-shaped plaintext, passed through and sealed server-side: a Claude setup token or
      * verbatim `.credentials.json`, verbatim Codex `auth.json`, or a GitHub token. Never logged.
      */
     readonly secret: string;
-    /** Account name under the provider; defaults to `default` (the one `credentials: { x: true }` picks). */
+    /**
+     * Make the connected account the owner's default for the provider. A first account is the default
+     * without it. Needs `features().connectedAccountDefaults`.
+     */
+    readonly makeDefault?: boolean;
+}
+/**
+ * Which account a connect writes. A person's first account for a provider is named `default`
+ * whatever `name` says. After that, `name` replaces the account of that name or makes a new one,
+ * and `name: "default"` replaces the chosen default. With neither `name` nor `accountId` (or
+ * `default` while none is chosen), an only account is replaced, and with several the call fails
+ * with `reason` `connected-account-ambiguous` and the candidates in `candidateAccountIds`.
+ */
+export type ConnectConnectedAccountOptions = ConnectConnectedAccountBase & ({
     readonly name?: string;
+    readonly accountId?: never;
+} | {
+    /** Replace this account. Needs `features().connectedAccountDefaults`. */
+    readonly accountId: string;
+    readonly name?: never;
+});
+export interface SetDefaultConnectedAccountOptions {
+    readonly provider: ConnectedAccountProvider;
+    /** One of the owner's active accounts of `provider`. */
+    readonly accountId: string;
+}
+export interface MarkConnectedAccountInvalidOptions {
+    /**
+     * The `credentialRevision` the refusal was seen on. Once the account holds a newer credential,
+     * nothing is marked and the outcome is `superseded`. Needs `features().connectedAccountDefaults`.
+     */
+    readonly revision?: number;
+}
+export interface MarkConnectedAccountInvalidResult {
+    /** `marked`: the account is now invalid. `superseded`: a newer credential, left as it was. */
+    readonly outcome: "marked" | "superseded";
+    readonly account: ConnectedAccount;
 }
 /**
- * The owner's connected provider accounts. `connect` upserts on (provider, name), so reconnecting
- * swaps the sealed credential in place. Secrets flow one way — in; no call returns them.
+ * The owner's connected provider accounts. Reconnecting swaps the sealed credential in place.
+ * Secrets flow one way — in; no call returns them.
  */
 export interface ConnectedAccountsNamespace {
     list(): Promise<readonly ConnectedAccount[]>;
     connect(options: ConnectConnectedAccountOptions): Promise<ConnectedAccount>;
-    /** Soft-archives the account; uniform not-found for "does not exist" and "not yours". */
+    /**
+     * Soft-archives the account; uniform not-found for "does not exist" and "not yours". Archiving
+     * the default leaves the owner without one for that provider: no other account is chosen.
+     */
     disconnect(connectedAccountId: string): Promise<ConnectedAccount>;
+    /**
+     * Make the account the owner's default for its provider, the one `true` selects. An invalid
+     * account is refused (`reason` `connected-account-invalid`). Choosing the default again changes
+     * nothing. Needs `features().connectedAccountDefaults`.
+     */
+    setDefault(options: SetDefaultConnectedAccountOptions): Promise<ConnectedAccount>;
+    /** Report that the provider refused the account's credential, so surfaces ask to reconnect it. */
+    markInvalid(connectedAccountId: string, options?: MarkConnectedAccountInvalidOptions): Promise<MarkConnectedAccountInvalidResult>;
 }
 /** Connect coordinates for the deployment's workspace SSH gateway. */
 export interface WorkspaceSshInfo {
@@ -2169,3 +2231,4 @@ export interface SshKeysNamespace {
     /** Archives the key; the gateway stops resolving it. */
     remove(sshKeyId: string): Promise<SshKey>;
 }
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealant/sdk-next",
-  "version": "0.39.0-next.753",
+  "version": "0.40.0-next.755",
   "description": "The fluent public SDK for Sealant — create a workspace, run a harness, replay the record.",
   "license": "Apache-2.0",
   "repository": {
@@ -26,12 +26,12 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@sealant/api-contracts": "npm:@sealant/api-contracts-next@0.39.0-next.753"
+    "@sealant/api-contracts": "npm:@sealant/api-contracts-next@0.40.0-next.755"
   },
   "peerDependencies": {
     "effect": "^4.0.5"
   },
-  "gitHead": "533ab3a73625171a4a555956e46793a744a9a100",
+  "gitHead": "f51aa3c26804adc254ee7d8706397737bf59a2b9",
   "publishConfig": {
     "access": "public"
   }