@sealant/sdk-next 0.40.0-next.761 → 0.40.0-next.764

package/dist/client.js

@@ -7,7 +7,7 @@ import { makeWorkspace, registerHarnessExecutors, toRuntimeInfo, toWorkspaceImag
 import { buildCreateWorkspaceRequest } from "./internal/blueprint.js";
 import { resolveInternalConfig } from "./internal/config.js";
 import { parseTtlSeconds } from "./internal/duration.js";
-import { readFeatures, requireConnectedAccountDefaults } from "./internal/features.js";
+import { readFeatures, requireConnectedAccountDefaults, requireConnectedAccountLoginClass, } from "./internal/features.js";
 import { imageSpecKey } from "./internal/image-key.js";
 import { buildInferenceRespondRequest, mapInferenceResponse } from "./internal/inference.js";
 import { requireSshUser } from "./internal/process-user.js";
@@ -35,6 +35,7 @@ const mapConnectedAccount = (wire) => ({
     credential: wire.credential,
     isDefault: wire.isDefault ?? wire.name === "default",
     ...(wire.credentialRevision === undefined ? {} : { credentialRevision: wire.credentialRevision }),
+    ...(wire.login === undefined ? {} : { login: wire.login }),
 });
 // Wire the run-execution implementations into the Workspace facade (the injection point exists to
 // break the workspace <-> run-harness import cycle; the client is the composition root).
@@ -244,10 +245,20 @@ export class Sealant {
             const wire = await this.#runtime.run(listConnectedAccountsOp(this.#ctx.config.hostLocal.ownerUserId));
             return wire.items.map(mapConnectedAccount);
         },
+        listWithHistory: async () => {
+            const wire = await this.#runtime.run(listConnectedAccountsOp(this.#ctx.config.hostLocal.ownerUserId));
+            return {
+                accounts: wire.items.map(mapConnectedAccount),
+                ...(wire.hasApiKeyHistory === undefined ? {} : { hasApiKeyHistory: wire.hasApiKeyHistory }),
+            };
+        },
         connect: async (options) => {
             if (options.accountId !== undefined || options.makeDefault !== undefined) {
                 await requireConnectedAccountDefaults(this.#ctx);
             }
+            if (options.login !== undefined) {
+                await requireConnectedAccountLoginClass(this.#ctx);
+            }
             const wire = await this.#runtime.run(createConnectedAccountOp({
                 ownerUserId: this.#ctx.config.hostLocal.ownerUserId,
                 provider: options.provider,
@@ -255,6 +266,7 @@ export class Sealant {
                 ...(options.name === undefined ? {} : { name: options.name }),
                 ...(options.accountId === undefined ? {} : { accountId: options.accountId }),
                 ...(options.makeDefault === undefined ? {} : { makeDefault: options.makeDefault }),
+                ...(options.login === undefined ? {} : { login: options.login }),
             }));
             return mapConnectedAccount(wire);
         },

package/dist/effect/api-client.d.ts

@@ -76,6 +76,12 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             }>;
             readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
             readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
+            readonly login: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"subscription">;
+            }>, import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"api-key">;
+                readonly suffix: import("effect/Schema").String;
+            }>]>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ConnectedAccountNotFoundError | typeof import("@sealant/api-contracts").ConnectedAccountInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly createConnectedAccount: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"createConnectedAccount", "POST", "/v1/connected-accounts/", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
             readonly ownerUserId: import("effect/Schema").String;
@@ -83,6 +89,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly name: import("effect/Schema").optional<import("effect/Schema").String>;
             readonly accountId: import("effect/Schema").optional<import("effect/Schema").String>;
             readonly makeDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+            readonly login: import("effect/Schema").optional<import("effect/Schema").Literals<readonly ["subscription", "api-key"]>>;
             readonly secret: import("effect/Schema").String;
         }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
             readonly connectedAccountId: import("effect/Schema").String;
@@ -104,6 +111,12 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             }>;
             readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
             readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
+            readonly login: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"subscription">;
+            }>, import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"api-key">;
+                readonly suffix: import("effect/Schema").String;
+            }>]>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ConnectedAccountBadRequestError | typeof import("@sealant/api-contracts").ConnectedAccountNotFoundError | typeof import("@sealant/api-contracts").ConnectedAccountConflictError | typeof import("@sealant/api-contracts").ConnectedAccountServiceUnavailableError | typeof import("@sealant/api-contracts").ConnectedAccountInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly listConnectedAccounts: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"listConnectedAccounts", "GET", "/v1/connected-accounts/", never, import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
             readonly ownerUserId: import("effect/Schema").String;
@@ -128,7 +141,14 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 }>;
                 readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                 readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
-            }>>;
+                readonly login: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+                    readonly kind: import("effect/Schema").Literal<"subscription">;
+                }>, import("effect/Schema").Struct<{
+                    readonly kind: import("effect/Schema").Literal<"api-key">;
+                    readonly suffix: import("effect/Schema").String;
+                }>]>>;
+            }>>;
+            readonly hasApiKeyHistory: import("effect/Schema").optional<import("effect/Schema").Boolean>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ConnectedAccountInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly markConnectedAccountInvalid: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"markConnectedAccountInvalid", "POST", "/v1/connected-accounts/:connectedAccountId/mark-invalid", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
             readonly connectedAccountId: import("effect/Schema").String;
@@ -155,6 +175,12 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             }>;
             readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
             readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
+            readonly login: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"subscription">;
+            }>, import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"api-key">;
+                readonly suffix: import("effect/Schema").String;
+            }>]>>;
             readonly outcome: import("effect/Schema").optional<import("effect/Schema").Literals<readonly ["marked", "superseded"]>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ConnectedAccountNotFoundError | typeof import("@sealant/api-contracts").ConnectedAccountInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly setConnectedAccountDefault: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"setConnectedAccountDefault", "PUT", "/v1/connected-accounts/defaults/:provider", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
@@ -182,6 +208,12 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             }>;
             readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
             readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
+            readonly login: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"subscription">;
+            }>, import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"api-key">;
+                readonly suffix: import("effect/Schema").String;
+            }>]>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ConnectedAccountNotFoundError | typeof import("@sealant/api-contracts").ConnectedAccountConflictError | typeof import("@sealant/api-contracts").ConnectedAccountInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
     };
     readonly github: {
@@ -381,6 +413,12 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                     }>;
                     readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                     readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
+                    readonly login: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+                        readonly kind: import("effect/Schema").Literal<"subscription">;
+                    }>, import("effect/Schema").Struct<{
+                        readonly kind: import("effect/Schema").Literal<"api-key">;
+                        readonly suffix: import("effect/Schema").String;
+                    }>]>>;
                 }>;
             }>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ProfileNotFoundError | typeof import("@sealant/api-contracts").ProfileInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
@@ -430,6 +468,12 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                     }>;
                     readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                     readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
+                    readonly login: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+                        readonly kind: import("effect/Schema").Literal<"subscription">;
+                    }>, import("effect/Schema").Struct<{
+                        readonly kind: import("effect/Schema").Literal<"api-key">;
+                        readonly suffix: import("effect/Schema").String;
+                    }>]>>;
                 }>;
             }>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ProfileBadRequestError | typeof import("@sealant/api-contracts").ProfileNotFoundError | typeof import("@sealant/api-contracts").ProfileConflictError | typeof import("@sealant/api-contracts").ProfileInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
@@ -985,6 +1029,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly personBinding: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                 readonly sshKeyRemovalEndsConnections: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                 readonly connectedAccountDefaults: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+                readonly connectedAccountLoginClass: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                 readonly kubernetesPersonLayout: import("effect/Schema").optional<import("effect/Schema").Boolean>;
             }>>;
         }>>, never, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
@@ -1895,6 +1940,12 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             }>;
             readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
             readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
+            readonly login: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"subscription">;
+            }>, import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"api-key">;
+                readonly suffix: import("effect/Schema").String;
+            }>]>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ConnectedAccountNotFoundError | typeof import("@sealant/api-contracts").ConnectedAccountInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly createConnectedAccount: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"createConnectedAccount", "POST", "/v1/connected-accounts/", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
             readonly ownerUserId: import("effect/Schema").String;
@@ -1902,6 +1953,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly name: import("effect/Schema").optional<import("effect/Schema").String>;
             readonly accountId: import("effect/Schema").optional<import("effect/Schema").String>;
             readonly makeDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+            readonly login: import("effect/Schema").optional<import("effect/Schema").Literals<readonly ["subscription", "api-key"]>>;
             readonly secret: import("effect/Schema").String;
         }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
             readonly connectedAccountId: import("effect/Schema").String;
@@ -1923,6 +1975,12 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             }>;
             readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
             readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
+            readonly login: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"subscription">;
+            }>, import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"api-key">;
+                readonly suffix: import("effect/Schema").String;
+            }>]>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ConnectedAccountBadRequestError | typeof import("@sealant/api-contracts").ConnectedAccountNotFoundError | typeof import("@sealant/api-contracts").ConnectedAccountConflictError | typeof import("@sealant/api-contracts").ConnectedAccountServiceUnavailableError | typeof import("@sealant/api-contracts").ConnectedAccountInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly listConnectedAccounts: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"listConnectedAccounts", "GET", "/v1/connected-accounts/", never, import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
             readonly ownerUserId: import("effect/Schema").String;
@@ -1947,7 +2005,14 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 }>;
                 readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                 readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
-            }>>;
+                readonly login: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+                    readonly kind: import("effect/Schema").Literal<"subscription">;
+                }>, import("effect/Schema").Struct<{
+                    readonly kind: import("effect/Schema").Literal<"api-key">;
+                    readonly suffix: import("effect/Schema").String;
+                }>]>>;
+            }>>;
+            readonly hasApiKeyHistory: import("effect/Schema").optional<import("effect/Schema").Boolean>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ConnectedAccountInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly markConnectedAccountInvalid: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"markConnectedAccountInvalid", "POST", "/v1/connected-accounts/:connectedAccountId/mark-invalid", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
             readonly connectedAccountId: import("effect/Schema").String;
@@ -1974,6 +2039,12 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             }>;
             readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
             readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
+            readonly login: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"subscription">;
+            }>, import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"api-key">;
+                readonly suffix: import("effect/Schema").String;
+            }>]>>;
             readonly outcome: import("effect/Schema").optional<import("effect/Schema").Literals<readonly ["marked", "superseded"]>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ConnectedAccountNotFoundError | typeof import("@sealant/api-contracts").ConnectedAccountInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly setConnectedAccountDefault: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"setConnectedAccountDefault", "PUT", "/v1/connected-accounts/defaults/:provider", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
@@ -2001,6 +2072,12 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             }>;
             readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
             readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
+            readonly login: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"subscription">;
+            }>, import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"api-key">;
+                readonly suffix: import("effect/Schema").String;
+            }>]>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ConnectedAccountNotFoundError | typeof import("@sealant/api-contracts").ConnectedAccountConflictError | typeof import("@sealant/api-contracts").ConnectedAccountInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
     };
     readonly github: {
@@ -2200,6 +2277,12 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                     }>;
                     readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                     readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
+                    readonly login: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+                        readonly kind: import("effect/Schema").Literal<"subscription">;
+                    }>, import("effect/Schema").Struct<{
+                        readonly kind: import("effect/Schema").Literal<"api-key">;
+                        readonly suffix: import("effect/Schema").String;
+                    }>]>>;
                 }>;
             }>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ProfileNotFoundError | typeof import("@sealant/api-contracts").ProfileInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
@@ -2249,6 +2332,12 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                     }>;
                     readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                     readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
+                    readonly login: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+                        readonly kind: import("effect/Schema").Literal<"subscription">;
+                    }>, import("effect/Schema").Struct<{
+                        readonly kind: import("effect/Schema").Literal<"api-key">;
+                        readonly suffix: import("effect/Schema").String;
+                    }>]>>;
                 }>;
             }>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ProfileBadRequestError | typeof import("@sealant/api-contracts").ProfileNotFoundError | typeof import("@sealant/api-contracts").ProfileConflictError | typeof import("@sealant/api-contracts").ProfileInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
@@ -2804,6 +2893,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly personBinding: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                 readonly sshKeyRemovalEndsConnections: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                 readonly connectedAccountDefaults: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+                readonly connectedAccountLoginClass: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                 readonly kubernetesPersonLayout: import("effect/Schema").optional<import("effect/Schema").Boolean>;
             }>>;
         }>>, never, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;

package/dist/effect/operations.d.ts

@@ -1111,7 +1111,14 @@ export declare const listConnectedAccountsOp: (ownerUserId: string) => Effect.Ef
         };
         readonly isDefault?: boolean | undefined;
         readonly credentialRevision?: number | undefined;
+        readonly login?: {
+            readonly kind: "subscription";
+        } | {
+            readonly kind: "api-key";
+            readonly suffix: string;
+        } | undefined;
     }[];
+    readonly hasApiKeyHistory?: boolean | undefined;
 }, import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("effect/Schema").SchemaError, SealantApiClient>;
 export declare const createConnectedAccountOp: (payload: {
     readonly ownerUserId: string;
@@ -1119,6 +1126,7 @@ export declare const createConnectedAccountOp: (payload: {
     readonly name?: string | undefined;
     readonly accountId?: string | undefined;
     readonly makeDefault?: boolean | undefined;
+    readonly login?: "api-key" | "subscription" | undefined;
     readonly secret: string;
 }) => Effect.Effect<{
     readonly connectedAccountId: string;
@@ -1142,6 +1150,12 @@ export declare const createConnectedAccountOp: (payload: {
     };
     readonly isDefault?: boolean | undefined;
     readonly credentialRevision?: number | undefined;
+    readonly login?: {
+        readonly kind: "subscription";
+    } | {
+        readonly kind: "api-key";
+        readonly suffix: string;
+    } | undefined;
 }, import("@sealant/api-contracts").ConnectedAccountBadRequestError | import("@sealant/api-contracts").ConnectedAccountConflictError | import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("@sealant/api-contracts").ConnectedAccountNotFoundError | import("@sealant/api-contracts").ConnectedAccountServiceUnavailableError | import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("effect/Schema").SchemaError, SealantApiClient>;
 export declare const archiveConnectedAccountOp: (connectedAccountId: string, ownerUserId: string) => Effect.Effect<{
     readonly connectedAccountId: string;
@@ -1165,6 +1179,12 @@ export declare const archiveConnectedAccountOp: (connectedAccountId: string, own
     };
     readonly isDefault?: boolean | undefined;
     readonly credentialRevision?: number | undefined;
+    readonly login?: {
+        readonly kind: "subscription";
+    } | {
+        readonly kind: "api-key";
+        readonly suffix: string;
+    } | undefined;
 }, import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("@sealant/api-contracts").ConnectedAccountNotFoundError | import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("effect/Schema").SchemaError, SealantApiClient>;
 export declare const setConnectedAccountDefaultOp: (provider: "claude" | "codex" | "github", payload: {
     readonly ownerUserId: string;
@@ -1191,6 +1211,12 @@ export declare const setConnectedAccountDefaultOp: (provider: "claude" | "codex"
     };
     readonly isDefault?: boolean | undefined;
     readonly credentialRevision?: number | undefined;
+    readonly login?: {
+        readonly kind: "subscription";
+    } | {
+        readonly kind: "api-key";
+        readonly suffix: string;
+    } | undefined;
 }, import("@sealant/api-contracts").ConnectedAccountConflictError | import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("@sealant/api-contracts").ConnectedAccountNotFoundError | import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("effect/Schema").SchemaError, SealantApiClient>;
 export declare const markConnectedAccountInvalidOp: (connectedAccountId: string, payload: {
     readonly ownerUserId: string;
@@ -1217,6 +1243,12 @@ export declare const markConnectedAccountInvalidOp: (connectedAccountId: string,
     };
     readonly isDefault?: boolean | undefined;
     readonly credentialRevision?: number | undefined;
+    readonly login?: {
+        readonly kind: "subscription";
+    } | {
+        readonly kind: "api-key";
+        readonly suffix: string;
+    } | undefined;
     readonly outcome?: "marked" | "superseded" | undefined;
 }, import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("@sealant/api-contracts").ConnectedAccountNotFoundError | import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("effect/Schema").SchemaError, SealantApiClient>;
 export declare const inferenceRespondOp: (payload: {
@@ -1280,6 +1312,7 @@ export declare const getIndexOp: () => Effect.Effect<{
         readonly personBinding?: boolean | undefined;
         readonly sshKeyRemovalEndsConnections?: boolean | undefined;
         readonly connectedAccountDefaults?: boolean | undefined;
+        readonly connectedAccountLoginClass?: boolean | undefined;
         readonly kubernetesPersonLayout?: boolean | undefined;
     } | undefined;
 }, import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("effect/Schema").SchemaError, SealantApiClient>;

package/dist/errors.d.ts

@@ -1,4 +1,5 @@
 import type { ForwardRefusalReason } from "@sealant/api-contracts";
+import type { ForwardResetCause } from "./types.js";
 /**
  * Public SDK errors. The Effect core fails on a typed `Schema.TaggedError` channel; the facade maps
  * every tagged failure onto one of these PLAIN `Error` subclasses (a single `_tag` switch) so the
@@ -82,3 +83,11 @@ export declare class SealantNotImplementedError extends SealantError {
     readonly name = "SealantNotImplementedError";
     constructor(operation: string);
 }
+/** A bounded forward was reset after it opened. Its streams error with this. */
+export declare class ForwardResetError extends SealantError {
+    readonly name: string;
+    readonly reason: ForwardResetCause;
+    /** The reason Core sent, when this SDK does not know it (`unrecognized-reset`). */
+    readonly wireReason?: string;
+    constructor(reason: ForwardResetCause, wireReason?: string);
+}

package/dist/errors.js

@@ -85,3 +85,16 @@ export class SealantNotImplementedError extends SealantError {
         super(`${operation} is part of the Sealant SDK surface but is not implemented in this build yet.`, { code: "not_implemented" });
     }
 }
+/** A bounded forward was reset after it opened. Its streams error with this. */
+export class ForwardResetError extends SealantError {
+    name = "ForwardResetError";
+    reason;
+    /** The reason Core sent, when this SDK does not know it (`unrecognized-reset`). */
+    wireReason;
+    constructor(reason, wireReason) {
+        super(`The forward was reset: ${wireReason ?? reason}.`, { code: "ForwardResetError" });
+        this.reason = reason;
+        if (wireReason !== undefined)
+            this.wireReason = wireReason;
+    }
+}

package/dist/facade/bounded-forward.d.ts

@@ -0,0 +1,7 @@
+import type { BoundedWorkspaceForward } from "../types.js";
+export declare const boundedForward: (ws: WebSocket, binding: {
+    readonly kind: "port";
+} | {
+    readonly kind: "session";
+    readonly session: string;
+}, onWindowOpen: () => void) => BoundedWorkspaceForward;

package/dist/facade/bounded-forward.js

@@ -0,0 +1,191 @@
+import { CountQueuingStrategy, ReadableStream, WritableStream, } from "node:stream/web";
+import { FORWARD_V2_MAX_FRAME_BYTES, ForwardFlow, forwardFrames, forwardResetReasonSchema, } from "@sealant/api-contracts";
+import { Schema } from "effect";
+import { ForwardResetError } from "../errors.js";
+const isKnownReset = Schema.is(forwardResetReasonSchema);
+const SOCKET_HIGH_WATER_BYTES = FORWARD_V2_MAX_FRAME_BYTES;
+/** A WHATWG socket has no drain event, so a held `progress` checks again this often. */
+const HELD_PROGRESS_RETRY_MS = 10;
+export const boundedForward = (ws, binding, onWindowOpen) => {
+    const flow = new ForwardFlow();
+    const unread = [];
+    const closed = Promise.withResolvers();
+    let state = { kind: "open" };
+    let windowOpen = false;
+    let finReceived = false;
+    let reader;
+    let writer;
+    let pendingRead;
+    let creditWaiter;
+    let progressRetry;
+    const sendText = (frame) => ws.send(JSON.stringify(frame));
+    const wakeReader = () => {
+        const waiter = pendingRead;
+        pendingRead = undefined;
+        waiter?.();
+    };
+    const wakeWriter = () => {
+        const waiter = creditWaiter;
+        creditWaiter = undefined;
+        waiter?.();
+    };
+    const settle = (next, close) => {
+        if (state.kind !== "open")
+            return;
+        state = next;
+        clearTimeout(progressRetry);
+        closed.resolve(close);
+        if (next.kind === "failed") {
+            writer?.error(next.error);
+            if (next.readable === "errored")
+                reader?.error(next.error);
+        }
+        wakeReader();
+        wakeWriter();
+    };
+    const resetBy = (reason, wireReason) => settle({ kind: "failed", error: new ForwardResetError(reason, wireReason), readable: "errored" }, { kind: "reset", reason, ...(wireReason === undefined ? {} : { wireReason }) });
+    const reset = (reason) => {
+        if (state.kind !== "open")
+            return;
+        if (ws.readyState === WebSocket.OPEN)
+            sendText({ t: "reset", reason });
+        resetBy(reason);
+        ws.close();
+    };
+    const endedByWorkspace = () => {
+        if (flow.delivered && creditWaiter === undefined) {
+            return settle({ kind: "ended" }, { kind: "end" });
+        }
+        settle({
+            kind: "failed",
+            error: new ForwardResetError("workspace-ended"),
+            readable: "drains-what-arrived",
+        }, { kind: "reset", reason: "workspace-ended" });
+    };
+    const sendProgress = () => {
+        if (state.kind !== "open" || ws.readyState !== WebSocket.OPEN || !flow.progressDue)
+            return;
+        if (ws.bufferedAmount > SOCKET_HIGH_WATER_BYTES) {
+            progressRetry ??= setTimeout(() => {
+                progressRetry = undefined;
+                sendProgress();
+            }, HELD_PROGRESS_RETRY_MS);
+            return;
+        }
+        const progress = flow.takeProgress();
+        if (progress !== undefined)
+            sendText(progress);
+    };
+    const deliver = (controller, chunk) => {
+        controller.enqueue(chunk);
+        flow.consumed(chunk.byteLength);
+        sendProgress();
+    };
+    const onInbound = (frame) => {
+        const inbound = flow.receive(frame);
+        switch (inbound.kind) {
+            case "data":
+                if (pendingRead === undefined || reader === undefined) {
+                    unread.push(inbound.data);
+                    return;
+                }
+                deliver(reader, inbound.data);
+                return wakeReader();
+            case "progress":
+                if (!windowOpen) {
+                    windowOpen = true;
+                    onWindowOpen();
+                }
+                return wakeWriter();
+            case "fin":
+                finReceived = true;
+                if (unread.length === 0)
+                    reader?.close();
+                wakeReader();
+                return endedByWorkspace();
+            case "reset": {
+                const known = isKnownReset(inbound.reason);
+                resetBy(known ? inbound.reason : "unrecognized-reset", known ? undefined : inbound.reason);
+                return ws.close();
+            }
+            case "violation":
+                return reset(inbound.reason);
+        }
+    };
+    ws.addEventListener("message", (event) => {
+        if (state.kind !== "open")
+            return;
+        if (event.data instanceof ArrayBuffer)
+            onInbound(new Uint8Array(event.data));
+        else if (typeof event.data === "string")
+            onInbound(event.data);
+    });
+    ws.addEventListener("close", () => resetBy("connection-lost"));
+    const readable = new ReadableStream({
+        start: (controller) => {
+            reader = controller;
+        },
+        pull: (controller) => {
+            const chunk = unread.shift();
+            if (chunk === undefined) {
+                return new Promise((resolve) => {
+                    pendingRead = resolve;
+                });
+            }
+            deliver(controller, chunk);
+            if (finReceived && unread.length === 0)
+                controller.close();
+        },
+        cancel: () => reset("aborted"),
+    }, { highWaterMark: 0 });
+    const waitForCredit = (fits) => new Promise((resolve, reject) => {
+        const check = () => {
+            if (state.kind === "failed")
+                return reject(state.error);
+            if (state.kind === "ended")
+                return reject(new ForwardResetError("workspace-ended"));
+            if (fits())
+                return resolve();
+            creditWaiter = check;
+        };
+        check();
+    });
+    const holdReadyUntilCredit = () => waitForCredit(() => flow.canSend(1));
+    const writable = new WritableStream({
+        start: (controller) => {
+            writer = controller;
+            // The sink's own `abort` runs only after a write waiting for credit settles. Node has had
+            // `signal` since 18; its types still lack it.
+            const signal = "signal" in controller ? controller.signal : undefined;
+            if (!(signal instanceof AbortSignal))
+                return;
+            signal.addEventListener("abort", () => {
+                // The stream is already erroring: erroring it again from here breaks Node's abort.
+                writer = undefined;
+                reset("aborted");
+            });
+        },
+        write: async (chunk) => {
+            for (const frame of forwardFrames(chunk)) {
+                await waitForCredit(() => flow.canSend(frame.byteLength));
+                flow.sent(frame.byteLength);
+                // A copy: a WHATWG socket refuses a view of a SharedArrayBuffer.
+                ws.send(new Uint8Array(frame));
+            }
+            await holdReadyUntilCredit();
+        },
+        close: () => {
+            if (state.kind === "open")
+                sendText(flow.fin());
+        },
+        abort: () => reset("aborted"),
+    }, new CountQueuingStrategy({ highWaterMark: 1 }));
+    sendText(flow.open());
+    return {
+        readable,
+        writable,
+        binding,
+        closed: closed.promise,
+        close: () => reset("aborted"),
+    };
+};

package/dist/facade/forward.d.ts

@@ -1,18 +1,9 @@
-import { type ForwardBinding } from "@sealant/api-contracts";
-import type { WorkspaceForward, WorkspaceForwardOptions } from "../types.js";
+import type { BoundedForwardTarget, BoundedWorkspaceForward, BoundedWorkspaceForwardOptions, WorkspaceForward, WorkspaceForwardOptions } from "../types.js";
 export interface ForwardEndpoint {
     readonly baseUrl: string;
     readonly apiKey: string | undefined;
     readonly ownerUserId: string;
 }
 export declare const openForward: (endpoint: ForwardEndpoint, workspaceId: string, port: number, options?: WorkspaceForwardOptions | undefined) => Promise<WorkspaceForward>;
-export interface ForwardV2Options {
-    readonly host?: "127.0.0.1" | "localhost" | "docker";
-    readonly signal?: AbortSignal;
-    readonly deadlineMs?: number;
-}
-export interface OpenedForwardV2 {
-    readonly binding: ForwardBinding;
-    readonly forward: WorkspaceForward;
-}
-export declare const openForwardV2: (endpoint: ForwardEndpoint, workspaceId: string, port: number, options?: ForwardV2Options | undefined) => Promise<OpenedForwardV2>;
+export type ForwardV2Options = BoundedForwardTarget & Pick<BoundedWorkspaceForwardOptions, "signal" | "deadlineMs">;
+export declare const openForwardV2: (endpoint: ForwardEndpoint, workspaceId: string, port: number, options?: ForwardV2Options | undefined) => Promise<BoundedWorkspaceForward>;

package/dist/facade/forward.js

@@ -1,6 +1,7 @@
-import { FORWARD_V2_MAX_FRAME_BYTES, FORWARD_V2_SUBPROTOCOL, forwardOpenFrameSchema, forwardRefusalReasonSchema, } from "@sealant/api-contracts";
+import { FORWARD_REFUSAL_STATUS, FORWARD_V2_SUBPROTOCOL, forwardOpenFrameSchema, forwardRefusalReasonSchema, } from "@sealant/api-contracts";
 import { Option, Schema } from "effect";
 import { ForwardDialError } from "../errors.js";
+import { boundedForward } from "./bounded-forward.js";
 const forwardUrl = (endpoint, path, query) => {
     const url = new URL(path, endpoint.baseUrl);
     url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
@@ -16,7 +17,7 @@ const forwardUrl = (endpoint, path, query) => {
     }
     return url;
 };
-const bridgeForward = (ws, maxFrameBytes = Number.POSITIVE_INFINITY) => {
+const bridgeForward = (ws) => {
     const pending = [];
     let wake;
     let finished = false;
@@ -30,7 +31,7 @@ const bridgeForward = (ws, maxFrameBytes = Number.POSITIVE_INFINITY) => {
         wake?.();
     };
     ws.addEventListener("close", () => finish("closed"));
-    const receive = (event) => {
+    ws.addEventListener("message", (event) => {
         if (typeof event.data === "string") {
             try {
                 const frame = JSON.parse(event.data);
@@ -43,7 +44,7 @@ const bridgeForward = (ws, maxFrameBytes = Number.POSITIVE_INFINITY) => {
         }
         pending.push(new Uint8Array(event.data));
         wake?.();
-    };
+    });
     const output = {
         [Symbol.asyncIterator]: () => ({
             next: async () => {
@@ -63,14 +64,10 @@ const bridgeForward = (ws, maxFrameBytes = Number.POSITIVE_INFINITY) => {
             },
         }),
     };
-    const forward = {
+    return {
         send: (input) => {
-            let offset = 0;
-            do {
-                // Copy into a plain ArrayBuffer-backed view (WebSocket.send rejects SharedArrayBuffer views).
-                ws.send(new Uint8Array(input.subarray(offset, offset + maxFrameBytes)).buffer);
-                offset += maxFrameBytes;
-            } while (offset < input.byteLength);
+            // Copy into a plain ArrayBuffer-backed view (WebSocket.send rejects SharedArrayBuffer views).
+            ws.send(new Uint8Array(input).buffer);
         },
         eof: () => {
             ws.send(JSON.stringify({ t: "eof" }));
@@ -82,7 +79,6 @@ const bridgeForward = (ws, maxFrameBytes = Number.POSITIVE_INFINITY) => {
             ws.close();
         },
     };
-    return { forward, receive };
 };
 export const openForward = (endpoint, workspaceId, port, options) => {
     const url = forwardUrl(endpoint, `/v1/workspaces/${workspaceId}/forward`, {
@@ -93,8 +89,7 @@ export const openForward = (endpoint, workspaceId, port, options) => {
     return new Promise((resolve, reject) => {
         const ws = new WebSocket(url);
         ws.binaryType = "arraybuffer";
-        const { forward, receive } = bridgeForward(ws);
-        ws.addEventListener("message", receive);
+        const forward = bridgeForward(ws);
         ws.addEventListener("open", () => resolve(forward), { once: true });
         ws.addEventListener("error", () => reject(new Error(`workspace forward failed: could not connect to ${url.host} (is anything listening on 127.0.0.1:${port} in the workspace?)`)), { once: true });
     });
@@ -136,11 +131,13 @@ const failedHandshakeError = async (url, origin, signal) => {
 };
 export const openForwardV2 = (endpoint, workspaceId, port, options) => {
     const host = options?.host ?? "127.0.0.1";
+    const session = options?.session;
     const signal = options?.signal;
     const deadlineMs = options?.deadlineMs ?? FORWARD_V2_OPEN_DEADLINE_MS;
     const url = forwardUrl(endpoint, `/v1/workspaces/${workspaceId}/forward/v2`, {
         port: String(port),
         host,
+        session,
     });
     const origin = new URL(endpoint.baseUrl).origin;
     return new Promise((resolve, reject) => {
@@ -148,7 +145,6 @@ export const openForwardV2 = (endpoint, workspaceId, port, options) => {
             return reject(signal.reason);
         const ws = new WebSocket(url, FORWARD_V2_SUBPROTOCOL);
         ws.binaryType = "arraybuffer";
-        const { forward, receive } = bridgeForward(ws, FORWARD_V2_MAX_FRAME_BYTES);
         const probing = new AbortController();
         let phase = "handshake";
         const settle = (next) => {
@@ -178,8 +174,6 @@ export const openForwardV2 = (endpoint, workspaceId, port, options) => {
             }
         });
         ws.addEventListener("message", (event) => {
-            if (phase === "open")
-                return receive(event);
             if (phase !== "awaiting-answer")
                 return;
             const frame = typeof event.data === "string" ? decodeOpenFrame(event.data) : Option.none();
@@ -188,11 +182,22 @@ export const openForwardV2 = (endpoint, workspaceId, port, options) => {
             }
             if (frame.value.t === "refused")
                 return fail(refusalError(frame.value));
-            settle("open");
-            resolve({ binding: frame.value.binding, forward });
+            const { binding } = frame.value;
+            if (session !== undefined && (binding.kind !== "session" || binding.session !== session)) {
+                return fail(new ForwardDialError({
+                    reason: "binding-unsupported",
+                    status: FORWARD_REFUSAL_STATUS["binding-unsupported"],
+                    message: `${origin} opened the forward without binding it to session ${session}.`,
+                }));
+            }
+            phase = "awaiting-window";
+            const forward = boundedForward(ws, binding, () => {
+                settle("open");
+                resolve(forward);
+            });
         });
         ws.addEventListener("close", () => {
-            if (phase === "awaiting-answer") {
+            if (phase === "awaiting-answer" || phase === "awaiting-window") {
                 return fail(new ForwardDialError({
                     reason: "transport-unavailable",
                     message: `The forward's connection to ${origin} closed before the control plane answered.`,

package/dist/facade/workspace.js

@@ -7,7 +7,7 @@ import { elapsed } from "../internal/clock.js";
 import { mapAccountRef } from "../internal/credentials.js";
 import { parseTtlSeconds } from "../internal/duration.js";
 import { requireProcessUser } from "../internal/process-user.js";
-import { openForward } from "./forward.js";
+import { openForward, openForwardV2 } from "./forward.js";
 import { makeInteractiveSession } from "./session.js";
 /** The wire runtime as the SDK reports it. */
 export const toRuntimeInfo = (runtime) => ({
@@ -295,6 +295,22 @@ const olderControlPlaneRefusal = (argv, error) => {
     });
 };
 export const makeWorkspace = (ctx, init) => {
+    const endpoint = {
+        baseUrl: ctx.config.baseUrl,
+        apiKey: ctx.config.apiKey,
+        ownerUserId: ctx.config.hostLocal.ownerUserId,
+    };
+    function forward(port, options) {
+        if (options?.flow === "bounded") {
+            return openForwardV2(endpoint, init.id, port, options);
+        }
+        if (options !== undefined && "session" in options) {
+            return Promise.reject(new SealantError('A forward bound to a session needs flow: "bounded".', {
+                code: "invalid_options",
+            }));
+        }
+        return openForward(endpoint, init.id, port, options);
+    }
     const openSession = async (argv, options) => {
         // The contract's own rule, checked before anything is asked, with the same value-free reason.
         const refused = sessionArgvIssue(argv);
@@ -801,11 +817,7 @@ export const makeWorkspace = (ctx, init) => {
         sshAsRoot: async () => {
             await ctx.runtime.run(clearWorkspaceSshUserOp(init.id, { ownerUserId: ctx.config.hostLocal.ownerUserId }));
         },
-        forward: (port, options) => openForward({
-            baseUrl: ctx.config.baseUrl,
-            apiKey: ctx.config.apiKey,
-            ownerUserId: ctx.config.hostLocal.ownerUserId,
-        }, init.id, port, options),
+        forward,
     };
     return workspace;
 };

package/dist/index.d.ts

@@ -16,7 +16,7 @@
  */
 export { Sealant } from "./client.js";
 export { claudeCode, codex, customHarness, opencode, pi } from "./harness.js";
-export { ForwardDialError, type ForwardDialFailure, type ForwardDialReason, SealantApiError, SealantError, SealantNotImplementedError, SealantRuntimeError, } from "./errors.js";
+export { ForwardDialError, type ForwardDialFailure, type ForwardDialReason, ForwardResetError, SealantApiError, SealantError, SealantNotImplementedError, SealantRuntimeError, } from "./errors.js";
 export type * from "./types.js";
 export { findWorkspaceEnvReservedRule, findWorkspaceSecretEnvReservedRule, formatWorkspaceEnvIssue, parseWorkspaceEnv, parseWorkspaceSecretEnv, WORKSPACE_ENV_MAX_ENTRIES, WORKSPACE_ENV_MAX_NAME_LENGTH, WORKSPACE_ENV_MAX_TOTAL_BYTES, WORKSPACE_ENV_MAX_VALUE_BYTES, WORKSPACE_ENV_NAME_PATTERN, WORKSPACE_ENV_SECRET_MARKERS, } from "@sealant/api-contracts/workspace-environment";
 export type { WorkspaceEnvIssue, WorkspaceEnvParseResult, WorkspaceEnvReservedRule, } from "@sealant/api-contracts/workspace-environment";

package/dist/index.js

@@ -16,7 +16,7 @@
  */
 export { Sealant } from "./client.js";
 export { claudeCode, codex, customHarness, opencode, pi } from "./harness.js";
-export { ForwardDialError, SealantApiError, SealantError, SealantNotImplementedError, SealantRuntimeError, } from "./errors.js";
+export { ForwardDialError, ForwardResetError, SealantApiError, SealantError, SealantNotImplementedError, SealantRuntimeError, } from "./errors.js";
 // The workspace environment policy (`CreateOptions.env` validation) is public API: downstream
 // products validate at their own boundaries with the exact rules the platform enforces.
 export { findWorkspaceEnvReservedRule, findWorkspaceSecretEnvReservedRule, formatWorkspaceEnvIssue, parseWorkspaceEnv, parseWorkspaceSecretEnv, WORKSPACE_ENV_MAX_ENTRIES, WORKSPACE_ENV_MAX_NAME_LENGTH, WORKSPACE_ENV_MAX_TOTAL_BYTES, WORKSPACE_ENV_MAX_VALUE_BYTES, WORKSPACE_ENV_NAME_PATTERN, WORKSPACE_ENV_SECRET_MARKERS, } from "@sealant/api-contracts/workspace-environment";

package/dist/internal/features.d.ts

@@ -17,6 +17,7 @@ export declare const toFeatures: (index: {
         readonly personBinding?: boolean | undefined;
         readonly sshKeyRemovalEndsConnections?: boolean | undefined;
         readonly connectedAccountDefaults?: boolean | undefined;
+        readonly connectedAccountLoginClass?: boolean | undefined;
         readonly kubernetesPersonLayout?: boolean | undefined;
     } | undefined;
 }) => SealantFeatures;
@@ -26,3 +27,4 @@ export declare const toFeatures: (index: {
  */
 export declare const readFeatures: (ctx: SdkContext) => Promise<SealantFeatures>;
 export declare const requireConnectedAccountDefaults: (ctx: SdkContext) => Promise<void>;
+export declare const requireConnectedAccountLoginClass: (ctx: SdkContext) => Promise<void>;

package/dist/internal/features.js

@@ -21,6 +21,7 @@ export const toFeatures = (index) => {
         personBinding: features?.personBinding === true,
         sshKeyRemovalEndsConnections: features?.sshKeyRemovalEndsConnections === true,
         connectedAccountDefaults: features?.connectedAccountDefaults === true,
+        connectedAccountLoginClass: features?.connectedAccountLoginClass === true,
         kubernetesPersonLayout: features?.kubernetesPersonLayout === true,
     };
 };
@@ -50,3 +51,9 @@ export const requireConnectedAccountDefaults = async (ctx) => {
         throw new SealantError("This control plane cannot choose a default connected account or target one by id (it does not report the feature, or could not be asked); nothing was sent.", { code: "connected-account-defaults-unsupported" });
     }
 };
+export const requireConnectedAccountLoginClass = async (ctx) => {
+    const supported = await readFeatures(ctx).then((features) => features.connectedAccountLoginClass, () => false);
+    if (!supported) {
+        throw new SealantError("This control plane cannot check a connect's login class (it does not report the feature, or could not be asked), and would store the secret whatever it is; nothing was sent.", { code: "connected-account-login-class-unsupported" });
+    }
+};

package/dist/types.d.ts

@@ -14,6 +14,8 @@
  * compile against a stable contract from day one (unimplemented paths reject with
  * `SealantNotImplementedError` at runtime, see `./errors.js`).
  */
+import type { ReadableStream as NodeReadableStream, WritableStream as NodeWritableStream } from "node:stream/web";
+import type { ConnectedAccountLogin, ConnectedAccountLoginClass, ForwardBinding, ForwardResetReason } from "@sealant/api-contracts";
 /**
  * Public client configuration. Intentionally minimal: a base URL and an API key. Host-local
  * concerns required by the current slice (owner identity, registry, direct database access) live in
@@ -1160,7 +1162,13 @@ export interface Workspace {
      * workspace-private set: the container's loopback (default), or `docker` —
      * the workspace-scoped Docker sidecar's alias, where `docker compose`
      * publishes its ports.
+     *
+     * With `flow: "bounded"`, a TCP forward whose two directions are bounded: the workspace's
+     * producer is held back while `readable` is not read, and `writable` holds back its writer while
+     * the workspace does not take the bytes. It resolves once Core and the workspace runtime have
+     * opened it, and rejects with a {@link ForwardDialError} that says why when they did not.
      */
+    forward(port: number, options: BoundedWorkspaceForwardOptions): Promise<BoundedWorkspaceForward>;
     forward(port: number, options?: WorkspaceForwardOptions): Promise<WorkspaceForward>;
 }
 /**
@@ -1178,7 +1186,7 @@ export interface WorkspaceCredentials {
      * (missing, not a directory, reached through a symbolic link, or a login directory linking out
      * of it), `home-busy` (another write into it is still running: retry), `workspace-not-running`,
      * `connected-account-invalid`, `connected-account-unsupported` (a Codex account named for pi or
-     * opencode that is not a ChatGPT login); with
+     * opencode that is not a ChatGPT login, or a Claude API key, which cannot be placed yet); with
      * `WorkspaceNotFoundError` for an account `onBehalfOf` cannot name; with
      * `WorkspaceBadGatewayError` when the executor did not confirm the write. The body code is
      * `SealantApiError.reason`; a refused account is `reason` `connected-account-missing` (404) or
@@ -1405,6 +1413,12 @@ export interface SealantFeatures {
      * `default`.
      */
     readonly connectedAccountDefaults: boolean;
+    /**
+     * `login` on `connect()` (a secret of the other login class is refused), Claude and Codex API
+     * keys beside a subscription, `ConnectedAccount.login`, and `hasApiKeyHistory` from
+     * `connectedAccounts.listWithHistory()`.
+     */
+    readonly connectedAccountLoginClass: boolean;
     /**
      * `ownerMap` is taken on Kubernetes (runc): each person's `sudo` works in the Pod, and images the
      * cluster builds record the probe a per-person launch checks. From an older control plane a
@@ -1442,6 +1456,10 @@ export interface WorkspaceCredentialsHomeOptions {
 }
 /** Options for {@link Workspace.forward}. */
 export interface WorkspaceForwardOptions {
+    /** Only a bounded forward has a `flow`. */
+    readonly flow?: never;
+    /** Only a bounded forward can be bound to a session. */
+    readonly session?: never;
     /** Target inside the workspace: its loopback (default) or the Docker sidecar. */
     readonly host?: "127.0.0.1" | "localhost" | "docker";
     /**
@@ -1469,6 +1487,64 @@ export interface WorkspaceForward {
     /** Tear the forward down. */
     close(): void;
 }
+/**
+ * Where a bounded forward goes: the port on the workspace's loopback (default) or on the Docker
+ * sidecar, whatever holds it; or, with `session`, the port on the loopback only when a process of
+ * that session holds it. A bound forward resets with `owner-exited` once the session's leader exits.
+ */
+export type BoundedForwardTarget = {
+    readonly host?: "127.0.0.1" | "localhost" | "docker";
+    readonly session?: never;
+} | {
+    readonly host?: "127.0.0.1" | "localhost";
+    readonly session: string;
+};
+/** Options for a bounded {@link Workspace.forward}. TCP only. */
+export type BoundedWorkspaceForwardOptions = BoundedForwardTarget & {
+    readonly flow: "bounded";
+    /** Gives up opening the forward; an open forward ignores it. */
+    readonly signal?: AbortSignal;
+    /** How long opening may take before it rejects, in milliseconds. 30 000 by default. */
+    readonly deadlineMs?: number;
+};
+/**
+ * Why a bounded forward was reset: a reason either side sent, `connection-lost` when the socket
+ * closed with neither a `fin` nor a reset, `unrecognized-reset` when Core sent a reason newer than
+ * this SDK (kept in `wireReason`), or `workspace-ended` when the workspace ended the forward before
+ * it took everything written to it. A write after the workspace ended fails with `workspace-ended`
+ * too.
+ */
+export type ForwardResetCause = ForwardResetReason | "connection-lost" | "unrecognized-reset" | "workspace-ended";
+/**
+ * How a bounded forward ended: the workspace closed its side after it took everything written to
+ * it (`end`), or the forward was reset.
+ */
+export type BoundedWorkspaceForwardClose = {
+    readonly kind: "end";
+} | {
+    readonly kind: "reset";
+    readonly reason: ForwardResetCause;
+    readonly wireReason?: string;
+};
+/**
+ * A bounded forward. Reading `readable` is what lets the workspace send more; `writer.ready` waits
+ * while the workspace can take no more; `writable.close()` half-closes toward the workspace. Wrap
+ * it as a Node stream with `Duplex.fromWeb(forward)`. The streams are typed as `node:stream/web`'s,
+ * which `Duplex.fromWeb` accepts also where the DOM's stream types are loaded.
+ *
+ * A reset fails both streams with a `ForwardResetError`, at once: data the workspace sent that was
+ * not read yet is dropped. When the workspace ends first, `readable` still yields all it sent, and
+ * the writer fails with `workspace-ended` only if something written did not reach the workspace.
+ */
+export interface BoundedWorkspaceForward {
+    readonly readable: NodeReadableStream<Uint8Array>;
+    readonly writable: NodeWritableStream<Uint8Array>;
+    /** What the forward is bound to. */
+    readonly binding: ForwardBinding;
+    readonly closed: Promise<BoundedWorkspaceForwardClose>;
+    /** Resets both directions. */
+    close(): void;
+}
 export interface RunOptions {
     /** Cancel the run by aborting this signal. */
     readonly signal?: AbortSignal;
@@ -2107,12 +2183,16 @@ export interface ConnectedAccountCredential {
     readonly lastRefreshAt: string | null;
     readonly lastRefreshOutcome: "refreshed" | "fresh" | "failed" | null;
 }
+export type { ConnectedAccountLogin, ConnectedAccountLoginClass };
 export interface ConnectedAccount {
     readonly connectedAccountId: string;
     readonly ownerUserId: string;
     readonly provider: ConnectedAccountProvider;
     readonly name: string;
-    /** Provider-shaped payload kind: oauth-token | credentials-json | auth-json | gh-cli-token. */
+    /**
+     * Provider-shaped payload kind: oauth-token | credentials-json | auth-json | gh-cli-token |
+     * api-key.
+     */
     readonly kind: string;
     readonly status: ConnectedAccountStatus;
     /** Non-secret display data (token suffix, codex account email, github login + scopes). */
@@ -2132,14 +2212,31 @@ export interface ConnectedAccount {
      * from a control plane without `connectedAccountDefaults`.
      */
     readonly credentialRevision?: number;
+    /** Claude and Codex only: the account's login class. Absent from an older control plane. */
+    readonly login?: ConnectedAccountLogin;
+}
+/** The owner's accounts, and whether they ever connected an API key. */
+export interface ConnectedAccountList {
+    readonly accounts: readonly ConnectedAccount[];
+    /**
+     * Whether the owner ever connected an API key, archived ones included. Absent from a control
+     * plane that does not report it.
+     */
+    readonly hasApiKeyHistory?: boolean;
 }
 interface ConnectConnectedAccountBase {
     readonly provider: ConnectedAccountProvider;
     /**
-     * Provider-shaped plaintext, passed through and sealed server-side: a Claude setup token or
-     * verbatim `.credentials.json`, verbatim Codex `auth.json`, or a GitHub token. Never logged.
+     * Provider-shaped plaintext, passed through and sealed server-side: a Claude setup token, API key
+     * or verbatim `.credentials.json`, a verbatim Codex `auth.json` or an OpenAI API key, or a GitHub
+     * token. Never logged.
      */
     readonly secret: string;
+    /**
+     * Claude and Codex: the login class `secret` must be. A secret of the other class is refused
+     * before anything is stored. Needs `features().connectedAccountLoginClass`.
+     */
+    readonly login?: ConnectedAccountLoginClass;
     /**
      * Make the connected account the owner's default for the provider. A first account is the default
      * without it. Needs `features().connectedAccountDefaults`.
@@ -2150,8 +2247,10 @@ interface ConnectConnectedAccountBase {
  * Which account a connect writes. A person's first account for a provider is named `default`
  * whatever `name` says. After that, `name` replaces the account of that name or makes a new one,
  * and `name: "default"` replaces the chosen default. With neither `name` nor `accountId` (or
- * `default` while none is chosen), an only account is replaced, and with several the call fails
- * with `reason` `connected-account-ambiguous` and the candidates in `candidateAccountIds`.
+ * `default` while none is chosen), the only account of the secret's login class is replaced, so a
+ * key never replaces a subscription; with none of that class a new one is made (named `api-key` or
+ * `subscription`), and with several the call fails with `reason` `connected-account-ambiguous` and
+ * the candidates in `candidateAccountIds`.
  */
 export type ConnectConnectedAccountOptions = ConnectConnectedAccountBase & ({
     readonly name?: string;
@@ -2184,6 +2283,8 @@ export interface MarkConnectedAccountInvalidResult {
  */
 export interface ConnectedAccountsNamespace {
     list(): Promise<readonly ConnectedAccount[]>;
+    /** The same accounts as `list`, with whether the owner ever connected an API key. */
+    listWithHistory(): Promise<ConnectedAccountList>;
     connect(options: ConnectConnectedAccountOptions): Promise<ConnectedAccount>;
     /**
      * Soft-archives the account; uniform not-found for "does not exist" and "not yours". Archiving
@@ -2241,4 +2342,3 @@ export interface SshKeysNamespace {
     /** Archives the key; the gateway stops resolving it. */
     remove(sshKeyId: string): Promise<SshKey>;
 }
-export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealant/sdk-next",
-  "version": "0.40.0-next.761",
+  "version": "0.40.0-next.764",
   "description": "The fluent public SDK for Sealant — create a workspace, run a harness, replay the record.",
   "license": "Apache-2.0",
   "repository": {
@@ -26,12 +26,12 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@sealant/api-contracts": "npm:@sealant/api-contracts-next@0.40.0-next.761"
+    "@sealant/api-contracts": "npm:@sealant/api-contracts-next@0.40.0-next.764"
   },
   "peerDependencies": {
     "effect": "^4.0.5"
   },
-  "gitHead": "3c4e8a0fe207247b1940197389924f330769ffb8",
+  "gitHead": "4d306e5cd66c40f162f7346370edd82930c1bc02",
   "publishConfig": {
     "access": "public"
   }