@sealant/sdk-next 0.40.0-next.763 → 0.40.0-next.764

package/dist/client.js

@@ -7,7 +7,7 @@ import { makeWorkspace, registerHarnessExecutors, toRuntimeInfo, toWorkspaceImag
 import { buildCreateWorkspaceRequest } from "./internal/blueprint.js";
 import { resolveInternalConfig } from "./internal/config.js";
 import { parseTtlSeconds } from "./internal/duration.js";
-import { readFeatures, requireConnectedAccountDefaults } from "./internal/features.js";
+import { readFeatures, requireConnectedAccountDefaults, requireConnectedAccountLoginClass, } from "./internal/features.js";
 import { imageSpecKey } from "./internal/image-key.js";
 import { buildInferenceRespondRequest, mapInferenceResponse } from "./internal/inference.js";
 import { requireSshUser } from "./internal/process-user.js";
@@ -35,6 +35,7 @@ const mapConnectedAccount = (wire) => ({
     credential: wire.credential,
     isDefault: wire.isDefault ?? wire.name === "default",
     ...(wire.credentialRevision === undefined ? {} : { credentialRevision: wire.credentialRevision }),
+    ...(wire.login === undefined ? {} : { login: wire.login }),
 });
 // Wire the run-execution implementations into the Workspace facade (the injection point exists to
 // break the workspace <-> run-harness import cycle; the client is the composition root).
@@ -244,10 +245,20 @@ export class Sealant {
             const wire = await this.#runtime.run(listConnectedAccountsOp(this.#ctx.config.hostLocal.ownerUserId));
             return wire.items.map(mapConnectedAccount);
         },
+        listWithHistory: async () => {
+            const wire = await this.#runtime.run(listConnectedAccountsOp(this.#ctx.config.hostLocal.ownerUserId));
+            return {
+                accounts: wire.items.map(mapConnectedAccount),
+                ...(wire.hasApiKeyHistory === undefined ? {} : { hasApiKeyHistory: wire.hasApiKeyHistory }),
+            };
+        },
         connect: async (options) => {
             if (options.accountId !== undefined || options.makeDefault !== undefined) {
                 await requireConnectedAccountDefaults(this.#ctx);
             }
+            if (options.login !== undefined) {
+                await requireConnectedAccountLoginClass(this.#ctx);
+            }
             const wire = await this.#runtime.run(createConnectedAccountOp({
                 ownerUserId: this.#ctx.config.hostLocal.ownerUserId,
                 provider: options.provider,
@@ -255,6 +266,7 @@ export class Sealant {
                 ...(options.name === undefined ? {} : { name: options.name }),
                 ...(options.accountId === undefined ? {} : { accountId: options.accountId }),
                 ...(options.makeDefault === undefined ? {} : { makeDefault: options.makeDefault }),
+                ...(options.login === undefined ? {} : { login: options.login }),
             }));
             return mapConnectedAccount(wire);
         },

package/dist/effect/api-client.d.ts

@@ -76,6 +76,12 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             }>;
             readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
             readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
+            readonly login: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"subscription">;
+            }>, import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"api-key">;
+                readonly suffix: import("effect/Schema").String;
+            }>]>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ConnectedAccountNotFoundError | typeof import("@sealant/api-contracts").ConnectedAccountInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly createConnectedAccount: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"createConnectedAccount", "POST", "/v1/connected-accounts/", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
             readonly ownerUserId: import("effect/Schema").String;
@@ -83,6 +89,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly name: import("effect/Schema").optional<import("effect/Schema").String>;
             readonly accountId: import("effect/Schema").optional<import("effect/Schema").String>;
             readonly makeDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+            readonly login: import("effect/Schema").optional<import("effect/Schema").Literals<readonly ["subscription", "api-key"]>>;
             readonly secret: import("effect/Schema").String;
         }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
             readonly connectedAccountId: import("effect/Schema").String;
@@ -104,6 +111,12 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             }>;
             readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
             readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
+            readonly login: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"subscription">;
+            }>, import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"api-key">;
+                readonly suffix: import("effect/Schema").String;
+            }>]>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ConnectedAccountBadRequestError | typeof import("@sealant/api-contracts").ConnectedAccountNotFoundError | typeof import("@sealant/api-contracts").ConnectedAccountConflictError | typeof import("@sealant/api-contracts").ConnectedAccountServiceUnavailableError | typeof import("@sealant/api-contracts").ConnectedAccountInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly listConnectedAccounts: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"listConnectedAccounts", "GET", "/v1/connected-accounts/", never, import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
             readonly ownerUserId: import("effect/Schema").String;
@@ -128,7 +141,14 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 }>;
                 readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                 readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
-            }>>;
+                readonly login: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+                    readonly kind: import("effect/Schema").Literal<"subscription">;
+                }>, import("effect/Schema").Struct<{
+                    readonly kind: import("effect/Schema").Literal<"api-key">;
+                    readonly suffix: import("effect/Schema").String;
+                }>]>>;
+            }>>;
+            readonly hasApiKeyHistory: import("effect/Schema").optional<import("effect/Schema").Boolean>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ConnectedAccountInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly markConnectedAccountInvalid: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"markConnectedAccountInvalid", "POST", "/v1/connected-accounts/:connectedAccountId/mark-invalid", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
             readonly connectedAccountId: import("effect/Schema").String;
@@ -155,6 +175,12 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             }>;
             readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
             readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
+            readonly login: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"subscription">;
+            }>, import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"api-key">;
+                readonly suffix: import("effect/Schema").String;
+            }>]>>;
             readonly outcome: import("effect/Schema").optional<import("effect/Schema").Literals<readonly ["marked", "superseded"]>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ConnectedAccountNotFoundError | typeof import("@sealant/api-contracts").ConnectedAccountInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly setConnectedAccountDefault: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"setConnectedAccountDefault", "PUT", "/v1/connected-accounts/defaults/:provider", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
@@ -182,6 +208,12 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             }>;
             readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
             readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
+            readonly login: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"subscription">;
+            }>, import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"api-key">;
+                readonly suffix: import("effect/Schema").String;
+            }>]>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ConnectedAccountNotFoundError | typeof import("@sealant/api-contracts").ConnectedAccountConflictError | typeof import("@sealant/api-contracts").ConnectedAccountInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
     };
     readonly github: {
@@ -381,6 +413,12 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                     }>;
                     readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                     readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
+                    readonly login: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+                        readonly kind: import("effect/Schema").Literal<"subscription">;
+                    }>, import("effect/Schema").Struct<{
+                        readonly kind: import("effect/Schema").Literal<"api-key">;
+                        readonly suffix: import("effect/Schema").String;
+                    }>]>>;
                 }>;
             }>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ProfileNotFoundError | typeof import("@sealant/api-contracts").ProfileInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
@@ -430,6 +468,12 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                     }>;
                     readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                     readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
+                    readonly login: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+                        readonly kind: import("effect/Schema").Literal<"subscription">;
+                    }>, import("effect/Schema").Struct<{
+                        readonly kind: import("effect/Schema").Literal<"api-key">;
+                        readonly suffix: import("effect/Schema").String;
+                    }>]>>;
                 }>;
             }>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ProfileBadRequestError | typeof import("@sealant/api-contracts").ProfileNotFoundError | typeof import("@sealant/api-contracts").ProfileConflictError | typeof import("@sealant/api-contracts").ProfileInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
@@ -985,6 +1029,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly personBinding: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                 readonly sshKeyRemovalEndsConnections: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                 readonly connectedAccountDefaults: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+                readonly connectedAccountLoginClass: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                 readonly kubernetesPersonLayout: import("effect/Schema").optional<import("effect/Schema").Boolean>;
             }>>;
         }>>, never, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
@@ -1895,6 +1940,12 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             }>;
             readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
             readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
+            readonly login: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"subscription">;
+            }>, import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"api-key">;
+                readonly suffix: import("effect/Schema").String;
+            }>]>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ConnectedAccountNotFoundError | typeof import("@sealant/api-contracts").ConnectedAccountInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly createConnectedAccount: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"createConnectedAccount", "POST", "/v1/connected-accounts/", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
             readonly ownerUserId: import("effect/Schema").String;
@@ -1902,6 +1953,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly name: import("effect/Schema").optional<import("effect/Schema").String>;
             readonly accountId: import("effect/Schema").optional<import("effect/Schema").String>;
             readonly makeDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+            readonly login: import("effect/Schema").optional<import("effect/Schema").Literals<readonly ["subscription", "api-key"]>>;
             readonly secret: import("effect/Schema").String;
         }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
             readonly connectedAccountId: import("effect/Schema").String;
@@ -1923,6 +1975,12 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             }>;
             readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
             readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
+            readonly login: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"subscription">;
+            }>, import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"api-key">;
+                readonly suffix: import("effect/Schema").String;
+            }>]>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ConnectedAccountBadRequestError | typeof import("@sealant/api-contracts").ConnectedAccountNotFoundError | typeof import("@sealant/api-contracts").ConnectedAccountConflictError | typeof import("@sealant/api-contracts").ConnectedAccountServiceUnavailableError | typeof import("@sealant/api-contracts").ConnectedAccountInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly listConnectedAccounts: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"listConnectedAccounts", "GET", "/v1/connected-accounts/", never, import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
             readonly ownerUserId: import("effect/Schema").String;
@@ -1947,7 +2005,14 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 }>;
                 readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                 readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
-            }>>;
+                readonly login: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+                    readonly kind: import("effect/Schema").Literal<"subscription">;
+                }>, import("effect/Schema").Struct<{
+                    readonly kind: import("effect/Schema").Literal<"api-key">;
+                    readonly suffix: import("effect/Schema").String;
+                }>]>>;
+            }>>;
+            readonly hasApiKeyHistory: import("effect/Schema").optional<import("effect/Schema").Boolean>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ConnectedAccountInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly markConnectedAccountInvalid: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"markConnectedAccountInvalid", "POST", "/v1/connected-accounts/:connectedAccountId/mark-invalid", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
             readonly connectedAccountId: import("effect/Schema").String;
@@ -1974,6 +2039,12 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             }>;
             readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
             readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
+            readonly login: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"subscription">;
+            }>, import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"api-key">;
+                readonly suffix: import("effect/Schema").String;
+            }>]>>;
             readonly outcome: import("effect/Schema").optional<import("effect/Schema").Literals<readonly ["marked", "superseded"]>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ConnectedAccountNotFoundError | typeof import("@sealant/api-contracts").ConnectedAccountInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly setConnectedAccountDefault: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"setConnectedAccountDefault", "PUT", "/v1/connected-accounts/defaults/:provider", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
@@ -2001,6 +2072,12 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             }>;
             readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
             readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
+            readonly login: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"subscription">;
+            }>, import("effect/Schema").Struct<{
+                readonly kind: import("effect/Schema").Literal<"api-key">;
+                readonly suffix: import("effect/Schema").String;
+            }>]>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ConnectedAccountNotFoundError | typeof import("@sealant/api-contracts").ConnectedAccountConflictError | typeof import("@sealant/api-contracts").ConnectedAccountInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
     };
     readonly github: {
@@ -2200,6 +2277,12 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                     }>;
                     readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                     readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
+                    readonly login: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+                        readonly kind: import("effect/Schema").Literal<"subscription">;
+                    }>, import("effect/Schema").Struct<{
+                        readonly kind: import("effect/Schema").Literal<"api-key">;
+                        readonly suffix: import("effect/Schema").String;
+                    }>]>>;
                 }>;
             }>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ProfileNotFoundError | typeof import("@sealant/api-contracts").ProfileInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
@@ -2249,6 +2332,12 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                     }>;
                     readonly isDefault: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                     readonly credentialRevision: import("effect/Schema").optional<import("effect/Schema").Int>;
+                    readonly login: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+                        readonly kind: import("effect/Schema").Literal<"subscription">;
+                    }>, import("effect/Schema").Struct<{
+                        readonly kind: import("effect/Schema").Literal<"api-key">;
+                        readonly suffix: import("effect/Schema").String;
+                    }>]>>;
                 }>;
             }>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").ProfileBadRequestError | typeof import("@sealant/api-contracts").ProfileNotFoundError | typeof import("@sealant/api-contracts").ProfileConflictError | typeof import("@sealant/api-contracts").ProfileInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
@@ -2804,6 +2893,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly personBinding: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                 readonly sshKeyRemovalEndsConnections: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                 readonly connectedAccountDefaults: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+                readonly connectedAccountLoginClass: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                 readonly kubernetesPersonLayout: import("effect/Schema").optional<import("effect/Schema").Boolean>;
             }>>;
         }>>, never, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;

package/dist/effect/operations.d.ts

@@ -1111,7 +1111,14 @@ export declare const listConnectedAccountsOp: (ownerUserId: string) => Effect.Ef
         };
         readonly isDefault?: boolean | undefined;
         readonly credentialRevision?: number | undefined;
+        readonly login?: {
+            readonly kind: "subscription";
+        } | {
+            readonly kind: "api-key";
+            readonly suffix: string;
+        } | undefined;
     }[];
+    readonly hasApiKeyHistory?: boolean | undefined;
 }, import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("effect/Schema").SchemaError, SealantApiClient>;
 export declare const createConnectedAccountOp: (payload: {
     readonly ownerUserId: string;
@@ -1119,6 +1126,7 @@ export declare const createConnectedAccountOp: (payload: {
     readonly name?: string | undefined;
     readonly accountId?: string | undefined;
     readonly makeDefault?: boolean | undefined;
+    readonly login?: "api-key" | "subscription" | undefined;
     readonly secret: string;
 }) => Effect.Effect<{
     readonly connectedAccountId: string;
@@ -1142,6 +1150,12 @@ export declare const createConnectedAccountOp: (payload: {
     };
     readonly isDefault?: boolean | undefined;
     readonly credentialRevision?: number | undefined;
+    readonly login?: {
+        readonly kind: "subscription";
+    } | {
+        readonly kind: "api-key";
+        readonly suffix: string;
+    } | undefined;
 }, import("@sealant/api-contracts").ConnectedAccountBadRequestError | import("@sealant/api-contracts").ConnectedAccountConflictError | import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("@sealant/api-contracts").ConnectedAccountNotFoundError | import("@sealant/api-contracts").ConnectedAccountServiceUnavailableError | import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("effect/Schema").SchemaError, SealantApiClient>;
 export declare const archiveConnectedAccountOp: (connectedAccountId: string, ownerUserId: string) => Effect.Effect<{
     readonly connectedAccountId: string;
@@ -1165,6 +1179,12 @@ export declare const archiveConnectedAccountOp: (connectedAccountId: string, own
     };
     readonly isDefault?: boolean | undefined;
     readonly credentialRevision?: number | undefined;
+    readonly login?: {
+        readonly kind: "subscription";
+    } | {
+        readonly kind: "api-key";
+        readonly suffix: string;
+    } | undefined;
 }, import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("@sealant/api-contracts").ConnectedAccountNotFoundError | import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("effect/Schema").SchemaError, SealantApiClient>;
 export declare const setConnectedAccountDefaultOp: (provider: "claude" | "codex" | "github", payload: {
     readonly ownerUserId: string;
@@ -1191,6 +1211,12 @@ export declare const setConnectedAccountDefaultOp: (provider: "claude" | "codex"
     };
     readonly isDefault?: boolean | undefined;
     readonly credentialRevision?: number | undefined;
+    readonly login?: {
+        readonly kind: "subscription";
+    } | {
+        readonly kind: "api-key";
+        readonly suffix: string;
+    } | undefined;
 }, import("@sealant/api-contracts").ConnectedAccountConflictError | import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("@sealant/api-contracts").ConnectedAccountNotFoundError | import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("effect/Schema").SchemaError, SealantApiClient>;
 export declare const markConnectedAccountInvalidOp: (connectedAccountId: string, payload: {
     readonly ownerUserId: string;
@@ -1217,6 +1243,12 @@ export declare const markConnectedAccountInvalidOp: (connectedAccountId: string,
     };
     readonly isDefault?: boolean | undefined;
     readonly credentialRevision?: number | undefined;
+    readonly login?: {
+        readonly kind: "subscription";
+    } | {
+        readonly kind: "api-key";
+        readonly suffix: string;
+    } | undefined;
     readonly outcome?: "marked" | "superseded" | undefined;
 }, import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("@sealant/api-contracts").ConnectedAccountNotFoundError | import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("effect/Schema").SchemaError, SealantApiClient>;
 export declare const inferenceRespondOp: (payload: {
@@ -1280,6 +1312,7 @@ export declare const getIndexOp: () => Effect.Effect<{
         readonly personBinding?: boolean | undefined;
         readonly sshKeyRemovalEndsConnections?: boolean | undefined;
         readonly connectedAccountDefaults?: boolean | undefined;
+        readonly connectedAccountLoginClass?: boolean | undefined;
         readonly kubernetesPersonLayout?: boolean | undefined;
     } | undefined;
 }, import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("effect/Schema").SchemaError, SealantApiClient>;

package/dist/internal/features.d.ts

@@ -17,6 +17,7 @@ export declare const toFeatures: (index: {
         readonly personBinding?: boolean | undefined;
         readonly sshKeyRemovalEndsConnections?: boolean | undefined;
         readonly connectedAccountDefaults?: boolean | undefined;
+        readonly connectedAccountLoginClass?: boolean | undefined;
         readonly kubernetesPersonLayout?: boolean | undefined;
     } | undefined;
 }) => SealantFeatures;
@@ -26,3 +27,4 @@ export declare const toFeatures: (index: {
  */
 export declare const readFeatures: (ctx: SdkContext) => Promise<SealantFeatures>;
 export declare const requireConnectedAccountDefaults: (ctx: SdkContext) => Promise<void>;
+export declare const requireConnectedAccountLoginClass: (ctx: SdkContext) => Promise<void>;

package/dist/internal/features.js

@@ -21,6 +21,7 @@ export const toFeatures = (index) => {
         personBinding: features?.personBinding === true,
         sshKeyRemovalEndsConnections: features?.sshKeyRemovalEndsConnections === true,
         connectedAccountDefaults: features?.connectedAccountDefaults === true,
+        connectedAccountLoginClass: features?.connectedAccountLoginClass === true,
         kubernetesPersonLayout: features?.kubernetesPersonLayout === true,
     };
 };
@@ -50,3 +51,9 @@ export const requireConnectedAccountDefaults = async (ctx) => {
         throw new SealantError("This control plane cannot choose a default connected account or target one by id (it does not report the feature, or could not be asked); nothing was sent.", { code: "connected-account-defaults-unsupported" });
     }
 };
+export const requireConnectedAccountLoginClass = async (ctx) => {
+    const supported = await readFeatures(ctx).then((features) => features.connectedAccountLoginClass, () => false);
+    if (!supported) {
+        throw new SealantError("This control plane cannot check a connect's login class (it does not report the feature, or could not be asked), and would store the secret whatever it is; nothing was sent.", { code: "connected-account-login-class-unsupported" });
+    }
+};

package/dist/types.d.ts

@@ -15,7 +15,7 @@
  * `SealantNotImplementedError` at runtime, see `./errors.js`).
  */
 import type { ReadableStream as NodeReadableStream, WritableStream as NodeWritableStream } from "node:stream/web";
-import type { ForwardBinding, ForwardResetReason } from "@sealant/api-contracts";
+import type { ConnectedAccountLogin, ConnectedAccountLoginClass, ForwardBinding, ForwardResetReason } from "@sealant/api-contracts";
 /**
  * Public client configuration. Intentionally minimal: a base URL and an API key. Host-local
  * concerns required by the current slice (owner identity, registry, direct database access) live in
@@ -1186,7 +1186,7 @@ export interface WorkspaceCredentials {
      * (missing, not a directory, reached through a symbolic link, or a login directory linking out
      * of it), `home-busy` (another write into it is still running: retry), `workspace-not-running`,
      * `connected-account-invalid`, `connected-account-unsupported` (a Codex account named for pi or
-     * opencode that is not a ChatGPT login); with
+     * opencode that is not a ChatGPT login, or a Claude API key, which cannot be placed yet); with
      * `WorkspaceNotFoundError` for an account `onBehalfOf` cannot name; with
      * `WorkspaceBadGatewayError` when the executor did not confirm the write. The body code is
      * `SealantApiError.reason`; a refused account is `reason` `connected-account-missing` (404) or
@@ -1413,6 +1413,12 @@ export interface SealantFeatures {
      * `default`.
      */
     readonly connectedAccountDefaults: boolean;
+    /**
+     * `login` on `connect()` (a secret of the other login class is refused), Claude and Codex API
+     * keys beside a subscription, `ConnectedAccount.login`, and `hasApiKeyHistory` from
+     * `connectedAccounts.listWithHistory()`.
+     */
+    readonly connectedAccountLoginClass: boolean;
     /**
      * `ownerMap` is taken on Kubernetes (runc): each person's `sudo` works in the Pod, and images the
      * cluster builds record the probe a per-person launch checks. From an older control plane a
@@ -2177,12 +2183,16 @@ export interface ConnectedAccountCredential {
     readonly lastRefreshAt: string | null;
     readonly lastRefreshOutcome: "refreshed" | "fresh" | "failed" | null;
 }
+export type { ConnectedAccountLogin, ConnectedAccountLoginClass };
 export interface ConnectedAccount {
     readonly connectedAccountId: string;
     readonly ownerUserId: string;
     readonly provider: ConnectedAccountProvider;
     readonly name: string;
-    /** Provider-shaped payload kind: oauth-token | credentials-json | auth-json | gh-cli-token. */
+    /**
+     * Provider-shaped payload kind: oauth-token | credentials-json | auth-json | gh-cli-token |
+     * api-key.
+     */
     readonly kind: string;
     readonly status: ConnectedAccountStatus;
     /** Non-secret display data (token suffix, codex account email, github login + scopes). */
@@ -2202,14 +2212,31 @@ export interface ConnectedAccount {
      * from a control plane without `connectedAccountDefaults`.
      */
     readonly credentialRevision?: number;
+    /** Claude and Codex only: the account's login class. Absent from an older control plane. */
+    readonly login?: ConnectedAccountLogin;
+}
+/** The owner's accounts, and whether they ever connected an API key. */
+export interface ConnectedAccountList {
+    readonly accounts: readonly ConnectedAccount[];
+    /**
+     * Whether the owner ever connected an API key, archived ones included. Absent from a control
+     * plane that does not report it.
+     */
+    readonly hasApiKeyHistory?: boolean;
 }
 interface ConnectConnectedAccountBase {
     readonly provider: ConnectedAccountProvider;
     /**
-     * Provider-shaped plaintext, passed through and sealed server-side: a Claude setup token or
-     * verbatim `.credentials.json`, verbatim Codex `auth.json`, or a GitHub token. Never logged.
+     * Provider-shaped plaintext, passed through and sealed server-side: a Claude setup token, API key
+     * or verbatim `.credentials.json`, a verbatim Codex `auth.json` or an OpenAI API key, or a GitHub
+     * token. Never logged.
      */
     readonly secret: string;
+    /**
+     * Claude and Codex: the login class `secret` must be. A secret of the other class is refused
+     * before anything is stored. Needs `features().connectedAccountLoginClass`.
+     */
+    readonly login?: ConnectedAccountLoginClass;
     /**
      * Make the connected account the owner's default for the provider. A first account is the default
      * without it. Needs `features().connectedAccountDefaults`.
@@ -2220,8 +2247,10 @@ interface ConnectConnectedAccountBase {
  * Which account a connect writes. A person's first account for a provider is named `default`
  * whatever `name` says. After that, `name` replaces the account of that name or makes a new one,
  * and `name: "default"` replaces the chosen default. With neither `name` nor `accountId` (or
- * `default` while none is chosen), an only account is replaced, and with several the call fails
- * with `reason` `connected-account-ambiguous` and the candidates in `candidateAccountIds`.
+ * `default` while none is chosen), the only account of the secret's login class is replaced, so a
+ * key never replaces a subscription; with none of that class a new one is made (named `api-key` or
+ * `subscription`), and with several the call fails with `reason` `connected-account-ambiguous` and
+ * the candidates in `candidateAccountIds`.
  */
 export type ConnectConnectedAccountOptions = ConnectConnectedAccountBase & ({
     readonly name?: string;
@@ -2254,6 +2283,8 @@ export interface MarkConnectedAccountInvalidResult {
  */
 export interface ConnectedAccountsNamespace {
     list(): Promise<readonly ConnectedAccount[]>;
+    /** The same accounts as `list`, with whether the owner ever connected an API key. */
+    listWithHistory(): Promise<ConnectedAccountList>;
     connect(options: ConnectConnectedAccountOptions): Promise<ConnectedAccount>;
     /**
      * Soft-archives the account; uniform not-found for "does not exist" and "not yours". Archiving
@@ -2311,4 +2342,3 @@ export interface SshKeysNamespace {
     /** Archives the key; the gateway stops resolving it. */
     remove(sshKeyId: string): Promise<SshKey>;
 }
-export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealant/sdk-next",
-  "version": "0.40.0-next.763",
+  "version": "0.40.0-next.764",
   "description": "The fluent public SDK for Sealant — create a workspace, run a harness, replay the record.",
   "license": "Apache-2.0",
   "repository": {
@@ -26,12 +26,12 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@sealant/api-contracts": "npm:@sealant/api-contracts-next@0.40.0-next.763"
+    "@sealant/api-contracts": "npm:@sealant/api-contracts-next@0.40.0-next.764"
   },
   "peerDependencies": {
     "effect": "^4.0.5"
   },
-  "gitHead": "c741e10743b2c553b526f93565c256fe8fa4bd8b",
+  "gitHead": "4d306e5cd66c40f162f7346370edd82930c1bc02",
   "publishConfig": {
     "access": "public"
   }