@sealant/sdk-next 0.40.0-next.764 → 0.40.0-next.766

package/dist/effect/api-client.d.ts

@@ -1031,6 +1031,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly connectedAccountDefaults: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                 readonly connectedAccountLoginClass: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                 readonly kubernetesPersonLayout: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+                readonly credentialPlacements: import("effect/Schema").optional<import("effect/Schema").Boolean>;
             }>>;
         }>>, never, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly getSetupState: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"getSetupState", "GET", "/v1/system/setup-state", never, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
@@ -1624,6 +1625,16 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly homes: import("effect/Schema").$Array<import("effect/Schema").Struct<{
                 readonly home: import("effect/Schema").String;
                 readonly onBehalfOfUserId: import("effect/Schema").String;
+                readonly placements: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").Struct<{
+                    readonly placementId: import("effect/Schema").String;
+                    readonly accountId: import("effect/Schema").String;
+                    readonly revision: import("effect/Schema").Int;
+                    readonly login: import("effect/Schema").Struct<{
+                        readonly kind: import("effect/Schema").Literal<"subscription">;
+                    }>;
+                    readonly pinned: import("effect/Schema").Boolean;
+                    readonly provider: import("effect/Schema").Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
+                }>>>;
                 readonly accounts: import("effect/Schema").Struct<{
                     readonly claude: import("effect/Schema").optional<import("effect/Schema").Struct<{
                         readonly connectedAccountId: import("effect/Schema").String;
@@ -1723,6 +1734,52 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly expiresAt: import("effect/Schema").optional<import("effect/Schema").String>;
             }>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").WorkspaceBadRequestError | typeof import("@sealant/api-contracts").WorkspaceInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
+        readonly pruneWorkspaceCredentials: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"pruneWorkspaceCredentials", "POST", "/v1/workspaces/:workspaceId/credentials/prune", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+            readonly workspaceId: import("effect/Schema").String;
+        }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly ownerUserId: import("effect/Schema").String;
+            readonly home: import("effect/Schema").String;
+            readonly live: import("effect/Schema").$Array<import("effect/Schema").String>;
+        }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly workspaceId: import("effect/Schema").String;
+            readonly runId: import("effect/Schema").String;
+            readonly home: import("effect/Schema").optional<import("effect/Schema").Struct<{
+                readonly home: import("effect/Schema").String;
+                readonly onBehalfOfUserId: import("effect/Schema").String;
+                readonly placements: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").Struct<{
+                    readonly placementId: import("effect/Schema").String;
+                    readonly accountId: import("effect/Schema").String;
+                    readonly revision: import("effect/Schema").Int;
+                    readonly login: import("effect/Schema").Struct<{
+                        readonly kind: import("effect/Schema").Literal<"subscription">;
+                    }>;
+                    readonly pinned: import("effect/Schema").Boolean;
+                    readonly provider: import("effect/Schema").Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
+                }>>>;
+                readonly accounts: import("effect/Schema").Struct<{
+                    readonly claude: import("effect/Schema").optional<import("effect/Schema").Struct<{
+                        readonly connectedAccountId: import("effect/Schema").String;
+                        readonly name: import("effect/Schema").String;
+                    }>>;
+                    readonly codex: import("effect/Schema").optional<import("effect/Schema").Struct<{
+                        readonly connectedAccountId: import("effect/Schema").String;
+                        readonly name: import("effect/Schema").String;
+                    }>>;
+                    readonly github: import("effect/Schema").optional<import("effect/Schema").Struct<{
+                        readonly connectedAccountId: import("effect/Schema").String;
+                        readonly name: import("effect/Schema").String;
+                    }>>;
+                    readonly pi: import("effect/Schema").optional<import("effect/Schema").Struct<{
+                        readonly connectedAccountId: import("effect/Schema").String;
+                        readonly name: import("effect/Schema").String;
+                    }>>;
+                    readonly opencode: import("effect/Schema").optional<import("effect/Schema").Struct<{
+                        readonly connectedAccountId: import("effect/Schema").String;
+                        readonly name: import("effect/Schema").String;
+                    }>>;
+                }>;
+            }>>;
+        }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").WorkspaceBadRequestError | typeof import("@sealant/api-contracts").WorkspaceForbiddenError | typeof import("@sealant/api-contracts").WorkspaceNotFoundError | typeof import("@sealant/api-contracts").WorkspaceConflictError | typeof import("@sealant/api-contracts").WorkspaceBadGatewayError | typeof import("@sealant/api-contracts").WorkspaceServiceUnavailableError | typeof import("@sealant/api-contracts").WorkspaceInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly putWorkspaceCredentials: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"putWorkspaceCredentials", "POST", "/v1/workspaces/:workspaceId/credentials", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
             readonly workspaceId: import("effect/Schema").String;
         }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
@@ -1737,12 +1794,23 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly pi: import("effect/Schema").optional<import("effect/Schema").NullOr<import("effect/Schema").String>>;
             readonly opencode: import("effect/Schema").optional<import("effect/Schema").NullOr<import("effect/Schema").String>>;
             readonly partial: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+            readonly live: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
         }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
             readonly workspaceId: import("effect/Schema").String;
             readonly runId: import("effect/Schema").String;
             readonly home: import("effect/Schema").Struct<{
                 readonly home: import("effect/Schema").String;
                 readonly onBehalfOfUserId: import("effect/Schema").String;
+                readonly placements: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").Struct<{
+                    readonly placementId: import("effect/Schema").String;
+                    readonly accountId: import("effect/Schema").String;
+                    readonly revision: import("effect/Schema").Int;
+                    readonly login: import("effect/Schema").Struct<{
+                        readonly kind: import("effect/Schema").Literal<"subscription">;
+                    }>;
+                    readonly pinned: import("effect/Schema").Boolean;
+                    readonly provider: import("effect/Schema").Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
+                }>>>;
                 readonly accounts: import("effect/Schema").Struct<{
                     readonly claude: import("effect/Schema").optional<import("effect/Schema").Struct<{
                         readonly connectedAccountId: import("effect/Schema").String;
@@ -2895,6 +2963,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly connectedAccountDefaults: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                 readonly connectedAccountLoginClass: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                 readonly kubernetesPersonLayout: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+                readonly credentialPlacements: import("effect/Schema").optional<import("effect/Schema").Boolean>;
             }>>;
         }>>, never, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly getSetupState: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"getSetupState", "GET", "/v1/system/setup-state", never, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
@@ -3488,6 +3557,16 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly homes: import("effect/Schema").$Array<import("effect/Schema").Struct<{
                 readonly home: import("effect/Schema").String;
                 readonly onBehalfOfUserId: import("effect/Schema").String;
+                readonly placements: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").Struct<{
+                    readonly placementId: import("effect/Schema").String;
+                    readonly accountId: import("effect/Schema").String;
+                    readonly revision: import("effect/Schema").Int;
+                    readonly login: import("effect/Schema").Struct<{
+                        readonly kind: import("effect/Schema").Literal<"subscription">;
+                    }>;
+                    readonly pinned: import("effect/Schema").Boolean;
+                    readonly provider: import("effect/Schema").Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
+                }>>>;
                 readonly accounts: import("effect/Schema").Struct<{
                     readonly claude: import("effect/Schema").optional<import("effect/Schema").Struct<{
                         readonly connectedAccountId: import("effect/Schema").String;
@@ -3587,6 +3666,52 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly expiresAt: import("effect/Schema").optional<import("effect/Schema").String>;
             }>>;
         }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").WorkspaceBadRequestError | typeof import("@sealant/api-contracts").WorkspaceInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
+        readonly pruneWorkspaceCredentials: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"pruneWorkspaceCredentials", "POST", "/v1/workspaces/:workspaceId/credentials/prune", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+            readonly workspaceId: import("effect/Schema").String;
+        }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly ownerUserId: import("effect/Schema").String;
+            readonly home: import("effect/Schema").String;
+            readonly live: import("effect/Schema").$Array<import("effect/Schema").String>;
+        }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+            readonly workspaceId: import("effect/Schema").String;
+            readonly runId: import("effect/Schema").String;
+            readonly home: import("effect/Schema").optional<import("effect/Schema").Struct<{
+                readonly home: import("effect/Schema").String;
+                readonly onBehalfOfUserId: import("effect/Schema").String;
+                readonly placements: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").Struct<{
+                    readonly placementId: import("effect/Schema").String;
+                    readonly accountId: import("effect/Schema").String;
+                    readonly revision: import("effect/Schema").Int;
+                    readonly login: import("effect/Schema").Struct<{
+                        readonly kind: import("effect/Schema").Literal<"subscription">;
+                    }>;
+                    readonly pinned: import("effect/Schema").Boolean;
+                    readonly provider: import("effect/Schema").Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
+                }>>>;
+                readonly accounts: import("effect/Schema").Struct<{
+                    readonly claude: import("effect/Schema").optional<import("effect/Schema").Struct<{
+                        readonly connectedAccountId: import("effect/Schema").String;
+                        readonly name: import("effect/Schema").String;
+                    }>>;
+                    readonly codex: import("effect/Schema").optional<import("effect/Schema").Struct<{
+                        readonly connectedAccountId: import("effect/Schema").String;
+                        readonly name: import("effect/Schema").String;
+                    }>>;
+                    readonly github: import("effect/Schema").optional<import("effect/Schema").Struct<{
+                        readonly connectedAccountId: import("effect/Schema").String;
+                        readonly name: import("effect/Schema").String;
+                    }>>;
+                    readonly pi: import("effect/Schema").optional<import("effect/Schema").Struct<{
+                        readonly connectedAccountId: import("effect/Schema").String;
+                        readonly name: import("effect/Schema").String;
+                    }>>;
+                    readonly opencode: import("effect/Schema").optional<import("effect/Schema").Struct<{
+                        readonly connectedAccountId: import("effect/Schema").String;
+                        readonly name: import("effect/Schema").String;
+                    }>>;
+                }>;
+            }>>;
+        }>>, import("effect/Schema").toCodecJson<typeof import("@sealant/api-contracts").WorkspaceBadRequestError | typeof import("@sealant/api-contracts").WorkspaceForbiddenError | typeof import("@sealant/api-contracts").WorkspaceNotFoundError | typeof import("@sealant/api-contracts").WorkspaceConflictError | typeof import("@sealant/api-contracts").WorkspaceBadGatewayError | typeof import("@sealant/api-contracts").WorkspaceServiceUnavailableError | typeof import("@sealant/api-contracts").WorkspaceInternalServerError>, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly putWorkspaceCredentials: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"putWorkspaceCredentials", "POST", "/v1/workspaces/:workspaceId/credentials", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
             readonly workspaceId: import("effect/Schema").String;
         }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
@@ -3601,12 +3726,23 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly pi: import("effect/Schema").optional<import("effect/Schema").NullOr<import("effect/Schema").String>>;
             readonly opencode: import("effect/Schema").optional<import("effect/Schema").NullOr<import("effect/Schema").String>>;
             readonly partial: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+            readonly live: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
         }>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
             readonly workspaceId: import("effect/Schema").String;
             readonly runId: import("effect/Schema").String;
             readonly home: import("effect/Schema").Struct<{
                 readonly home: import("effect/Schema").String;
                 readonly onBehalfOfUserId: import("effect/Schema").String;
+                readonly placements: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").Struct<{
+                    readonly placementId: import("effect/Schema").String;
+                    readonly accountId: import("effect/Schema").String;
+                    readonly revision: import("effect/Schema").Int;
+                    readonly login: import("effect/Schema").Struct<{
+                        readonly kind: import("effect/Schema").Literal<"subscription">;
+                    }>;
+                    readonly pinned: import("effect/Schema").Boolean;
+                    readonly provider: import("effect/Schema").Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
+                }>>>;
                 readonly accounts: import("effect/Schema").Struct<{
                     readonly claude: import("effect/Schema").optional<import("effect/Schema").Struct<{
                         readonly connectedAccountId: import("effect/Schema").String;

package/dist/effect/operations.d.ts

@@ -562,12 +562,23 @@ export declare const putWorkspaceCredentialsOp: (workspaceId: string, payload: {
     readonly pi?: string | null | undefined;
     readonly opencode?: string | null | undefined;
     readonly partial?: boolean | undefined;
+    readonly live?: readonly string[] | undefined;
 }) => Effect.Effect<{
     readonly workspaceId: string;
     readonly runId: string;
     readonly home: {
         readonly home: string;
         readonly onBehalfOfUserId: string;
+        readonly placements?: readonly {
+            readonly placementId: string;
+            readonly accountId: string;
+            readonly revision: number;
+            readonly login: {
+                readonly kind: "subscription";
+            };
+            readonly pinned: boolean;
+            readonly provider: "claude" | "codex" | "github" | "opencode" | "pi";
+        }[] | undefined;
         readonly accounts: {
             readonly claude?: {
                 readonly connectedAccountId: string;
@@ -597,6 +608,51 @@ export declare const putWorkspaceCredentialsOp: (workspaceId: string, payload: {
         readonly message: string;
     }[] | undefined;
 }, import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError, SealantApiClient>;
+/** Remove unused credential placements in one home. */
+export declare const pruneWorkspaceCredentialsOp: (workspaceId: string, payload: {
+    readonly ownerUserId: string;
+    readonly home: string;
+    readonly live: readonly string[];
+}) => Effect.Effect<{
+    readonly workspaceId: string;
+    readonly runId: string;
+    readonly home?: {
+        readonly home: string;
+        readonly onBehalfOfUserId: string;
+        readonly placements?: readonly {
+            readonly placementId: string;
+            readonly accountId: string;
+            readonly revision: number;
+            readonly login: {
+                readonly kind: "subscription";
+            };
+            readonly pinned: boolean;
+            readonly provider: "claude" | "codex" | "github" | "opencode" | "pi";
+        }[] | undefined;
+        readonly accounts: {
+            readonly claude?: {
+                readonly connectedAccountId: string;
+                readonly name: string;
+            } | undefined;
+            readonly codex?: {
+                readonly connectedAccountId: string;
+                readonly name: string;
+            } | undefined;
+            readonly github?: {
+                readonly connectedAccountId: string;
+                readonly name: string;
+            } | undefined;
+            readonly pi?: {
+                readonly connectedAccountId: string;
+                readonly name: string;
+            } | undefined;
+            readonly opencode?: {
+                readonly connectedAccountId: string;
+                readonly name: string;
+            } | undefined;
+        };
+    } | undefined;
+}, import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError, SealantApiClient>;
 export declare const releaseWorkspaceCredentialsOp: (workspaceId: string, query: {
     readonly ownerUserId: string;
     readonly home: string;
@@ -614,6 +670,16 @@ export declare const listWorkspaceCredentialsOp: (workspaceId: string, query: {
     readonly homes: readonly {
         readonly home: string;
         readonly onBehalfOfUserId: string;
+        readonly placements?: readonly {
+            readonly placementId: string;
+            readonly accountId: string;
+            readonly revision: number;
+            readonly login: {
+                readonly kind: "subscription";
+            };
+            readonly pinned: boolean;
+            readonly provider: "claude" | "codex" | "github" | "opencode" | "pi";
+        }[] | undefined;
         readonly accounts: {
             readonly claude?: {
                 readonly connectedAccountId: string;
@@ -1314,6 +1380,7 @@ export declare const getIndexOp: () => Effect.Effect<{
         readonly connectedAccountDefaults?: boolean | undefined;
         readonly connectedAccountLoginClass?: boolean | undefined;
         readonly kubernetesPersonLayout?: boolean | undefined;
+        readonly credentialPlacements?: boolean | undefined;
     } | undefined;
 }, import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("effect/Schema").SchemaError, SealantApiClient>;
 export declare const getSetupStateOp: () => Effect.Effect<{

package/dist/effect/operations.js

@@ -28,6 +28,8 @@ export const recoverWorkspaceOp = (workspaceId, payload) => Effect.flatMap(Seala
 export const restartWorkspaceOp = (workspaceId, payload) => Effect.flatMap(SealantApiClient, (client) => client.workspaces.restartWorkspace({ params: { workspaceId }, payload }));
 export const inspectWorkspaceImageOp = (payload) => Effect.flatMap(SealantApiClient, (client) => client.workspaces.inspectWorkspaceImage({ payload }));
 export const putWorkspaceCredentialsOp = (workspaceId, payload) => Effect.flatMap(SealantApiClient, (client) => client.workspaces.putWorkspaceCredentials({ params: { workspaceId }, payload }));
+/** Remove unused credential placements in one home. */
+export const pruneWorkspaceCredentialsOp = (workspaceId, payload) => Effect.flatMap(SealantApiClient, (client) => client.workspaces.pruneWorkspaceCredentials({ params: { workspaceId }, payload }));
 export const releaseWorkspaceCredentialsOp = (workspaceId, query) => Effect.flatMap(SealantApiClient, (client) => client.workspaces.releaseWorkspaceCredentials({ params: { workspaceId }, query }));
 export const listWorkspaceCredentialsOp = (workspaceId, query) => Effect.flatMap(SealantApiClient, (client) => client.workspaces.listWorkspaceCredentials({ params: { workspaceId }, query }));
 export const expireWorkspaceOp = (workspaceId, payload) => Effect.flatMap(SealantApiClient, (client) => client.workspaces.expireWorkspace({ params: { workspaceId }, payload }));

package/dist/facade/workspace.js

@@ -1,11 +1,12 @@
 import { sessionArgvIssue } from "@sealant/api-contracts";
 import { applyDotfiles } from "../effect/apply-dotfiles.js";
 import { execWorkspace } from "../effect/exec-workspace.js";
-import { bindWorkspaceOp, flushWorkspaceCaptureOp, getWorkspaceCaptureStatusOp, createSessionAsUserOp, createSessionOp, expireWorkspaceOp, clearWorkspaceSshUserOp, getSessionOp, getWorkspaceOp, listSessionsOp, replanWorkspaceCaptureOp, recoverWorkspaceOp, restartWorkspaceOp, listWorkspaceCredentialsOp, putWorkspaceCredentialsOp, releaseWorkspaceCredentialsOp, stopWorkspaceOp, } from "../effect/operations.js";
+import { bindWorkspaceOp, flushWorkspaceCaptureOp, getWorkspaceCaptureStatusOp, createSessionAsUserOp, createSessionOp, expireWorkspaceOp, clearWorkspaceSshUserOp, getSessionOp, getWorkspaceOp, listSessionsOp, replanWorkspaceCaptureOp, recoverWorkspaceOp, restartWorkspaceOp, listWorkspaceCredentialsOp, putWorkspaceCredentialsOp, pruneWorkspaceCredentialsOp, releaseWorkspaceCredentialsOp, stopWorkspaceOp, } from "../effect/operations.js";
 import { SealantApiError, SealantError, SealantNotImplementedError } from "../errors.js";
 import { elapsed } from "../internal/clock.js";
 import { mapAccountRef } from "../internal/credentials.js";
 import { parseTtlSeconds } from "../internal/duration.js";
+import { requireCredentialPlacements } from "../internal/features.js";
 import { requireProcessUser } from "../internal/process-user.js";
 import { openForward, openForwardV2 } from "./forward.js";
 import { makeInteractiveSession } from "./session.js";
@@ -201,6 +202,7 @@ export const toWorkspaceImage = (image) => ({
 });
 /** Wire → public credential home. */
 const toCredentialHome = (home) => ({
+    ...(home.placements === undefined ? {} : { placements: home.placements }),
     home: home.home,
     onBehalfOf: home.onBehalfOfUserId,
     accounts: {
@@ -759,6 +761,8 @@ export const makeWorkspace = (ctx, init) => {
         // People's logins, one person per home; the workspace stays the client owner's.
         credentials: {
             put: async (options) => {
+                if (options.live !== undefined)
+                    await requireCredentialPlacements(ctx);
                 const choices = {
                     claude: accountChoice(options.claude),
                     codex: accountChoice(options.codex),
@@ -778,6 +782,7 @@ export const makeWorkspace = (ctx, init) => {
                     ...(choices.pi === undefined ? {} : { pi: choices.pi }),
                     ...(choices.opencode === undefined ? {} : { opencode: choices.opencode }),
                     ...(options.partial === true ? { partial: true } : {}),
+                    ...(options.live === undefined ? {} : { live: options.live }),
                 }));
                 return {
                     ...toCredentialHome(answered.home),
@@ -788,6 +793,15 @@ export const makeWorkspace = (ctx, init) => {
                     })),
                 };
             },
+            prune: async (home, live) => {
+                await requireCredentialPlacements(ctx);
+                const answered = await ctx.runtime.run(pruneWorkspaceCredentialsOp(init.id, {
+                    ownerUserId: ctx.config.hostLocal.ownerUserId,
+                    home,
+                    live,
+                }));
+                return answered.home === undefined ? undefined : toCredentialHome(answered.home);
+            },
             release: async (home) => {
                 const answered = await ctx.runtime.run(releaseWorkspaceCredentialsOp(init.id, {
                     ownerUserId: ctx.config.hostLocal.ownerUserId,

package/dist/internal/features.d.ts

@@ -19,6 +19,7 @@ export declare const toFeatures: (index: {
         readonly connectedAccountDefaults?: boolean | undefined;
         readonly connectedAccountLoginClass?: boolean | undefined;
         readonly kubernetesPersonLayout?: boolean | undefined;
+        readonly credentialPlacements?: boolean | undefined;
     } | undefined;
 }) => SealantFeatures;
 /**
@@ -28,3 +29,4 @@ export declare const toFeatures: (index: {
 export declare const readFeatures: (ctx: SdkContext) => Promise<SealantFeatures>;
 export declare const requireConnectedAccountDefaults: (ctx: SdkContext) => Promise<void>;
 export declare const requireConnectedAccountLoginClass: (ctx: SdkContext) => Promise<void>;
+export declare const requireCredentialPlacements: (ctx: SdkContext) => Promise<void>;

package/dist/internal/features.js

@@ -20,6 +20,7 @@ export const toFeatures = (index) => {
         workspaceSshUser: features?.workspaceSshUser === true,
         personBinding: features?.personBinding === true,
         sshKeyRemovalEndsConnections: features?.sshKeyRemovalEndsConnections === true,
+        credentialPlacements: features?.credentialPlacements === true,
         connectedAccountDefaults: features?.connectedAccountDefaults === true,
         connectedAccountLoginClass: features?.connectedAccountLoginClass === true,
         kubernetesPersonLayout: features?.kubernetesPersonLayout === true,
@@ -57,3 +58,8 @@ export const requireConnectedAccountLoginClass = async (ctx) => {
         throw new SealantError("This control plane cannot check a connect's login class (it does not report the feature, or could not be asked), and would store the secret whatever it is; nothing was sent.", { code: "connected-account-login-class-unsupported" });
     }
 };
+export const requireCredentialPlacements = async (ctx) => {
+    const supported = await readFeatures(ctx).then((features) => features.credentialPlacements, () => false);
+    if (!supported)
+        throw new SealantError("This control plane cannot protect live credential placements or prune them; nothing was sent.", { code: "credential-placements-unsupported" });
+};

package/dist/types.d.ts

@@ -1203,6 +1203,11 @@ export interface WorkspaceCredentials {
     }>;
     /** The homes of the running executor and the logins Core keeps in each, oldest first. */
     list(): Promise<readonly WorkspaceCredentialHome[]>;
+    /**
+     * Remove every login of `home` that is neither in `live` (the placements running processes hold)
+     * nor the person's default. Answers the home as it is left, or `undefined` when it holds nothing.
+     */
+    prune(home: string, live: readonly string[]): Promise<WorkspaceCredentialHome | undefined>;
 }
 /**
  * A person's dotfiles in a running workspace (see {@link Workspace.dotfiles}): the same sources as a
@@ -1313,6 +1318,11 @@ export interface WorkspaceCredentialsPutOptions {
      * which and why, instead of the whole put rejecting. Any other refusal still rejects.
      */
     readonly partial?: boolean;
+    /**
+     * The placements running processes hold in this home: a provider whose file one of them holds is
+     * not written over with another login. Requires `features().credentialPlacements`.
+     */
+    readonly live?: readonly string[];
 }
 /** A provider a partial {@link WorkspaceCredentials.put} left out, and why. */
 export interface WorkspaceCredentialSkip {
@@ -1328,6 +1338,20 @@ export interface WorkspaceCredentialsPutResult extends WorkspaceCredentialHome {
     /** A partial put's left-out providers, in the order named; always empty for a whole put. */
     readonly skipped: readonly WorkspaceCredentialSkip[];
 }
+/** One login written into one home: its id stays the same while a refresh moves its revision. */
+export interface CredentialPlacementReceipt {
+    readonly placementId: string;
+    readonly accountId: string;
+    readonly revision: number;
+    readonly login: {
+        readonly kind: "subscription";
+    };
+    readonly pinned: boolean;
+}
+/** A receipt associated with the provider slot it occupies in this home. */
+export interface WorkspaceCredentialPlacementReceipt extends CredentialPlacementReceipt {
+    readonly provider: "claude" | "codex" | "github" | "pi" | "opencode";
+}
 /** One account whose copy a home holds. */
 export interface WorkspaceCredentialHomeAccount {
     readonly connectedAccountId: string;
@@ -1336,6 +1360,8 @@ export interface WorkspaceCredentialHomeAccount {
 }
 /** One home of a running workspace and the logins Core keeps in it. */
 export interface WorkspaceCredentialHome {
+    /** One receipt per login written there. Absent from a control plane without placements. */
+    readonly placements?: readonly WorkspaceCredentialPlacementReceipt[];
     readonly home: string;
     /** The one person whose logins the home holds. */
     readonly onBehalfOf: string;
@@ -1425,6 +1451,8 @@ export interface SealantFeatures {
      * create with `ownerMap` on Kubernetes is refused.
      */
     readonly kubernetesPersonLayout: boolean;
+    /** Credential homes answer placement receipts; a put takes `live`; `prune` exists. */
+    readonly credentialPlacements: boolean;
 }
 /** A published workspace image. */
 export interface WorkspaceImage {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealant/sdk-next",
-  "version": "0.40.0-next.764",
+  "version": "0.40.0-next.766",
   "description": "The fluent public SDK for Sealant — create a workspace, run a harness, replay the record.",
   "license": "Apache-2.0",
   "repository": {
@@ -26,12 +26,12 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@sealant/api-contracts": "npm:@sealant/api-contracts-next@0.40.0-next.764"
+    "@sealant/api-contracts": "npm:@sealant/api-contracts-next@0.40.0-next.766"
   },
   "peerDependencies": {
     "effect": "^4.0.5"
   },
-  "gitHead": "4d306e5cd66c40f162f7346370edd82930c1bc02",
+  "gitHead": "a8da605cc7a422a896dd2203183561cf62bde351",
   "publishConfig": {
     "access": "public"
   }