@sealant/sdk-next 0.40.0-next.765 → 0.40.0-next.767

package/dist/effect/api-client.d.ts

@@ -1032,6 +1032,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly connectedAccountLoginClass: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                 readonly kubernetesPersonLayout: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                 readonly credentialPlacements: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+                readonly connectedAccountApiKeys: import("effect/Schema").optional<import("effect/Schema").Boolean>;
             }>>;
         }>>, never, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly getSetupState: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"getSetupState", "GET", "/v1/system/setup-state", never, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
@@ -1629,9 +1630,13 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                     readonly placementId: import("effect/Schema").String;
                     readonly accountId: import("effect/Schema").String;
                     readonly revision: import("effect/Schema").Int;
-                    readonly login: import("effect/Schema").Struct<{
+                    readonly login: import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
                         readonly kind: import("effect/Schema").Literal<"subscription">;
-                    }>;
+                    }>, import("effect/Schema").Struct<{
+                        readonly kind: import("effect/Schema").Literal<"api-key">;
+                        readonly suffix: import("effect/Schema").String;
+                        readonly keyPath: import("effect/Schema").optional<import("effect/Schema").String>;
+                    }>]>;
                     readonly pinned: import("effect/Schema").Boolean;
                     readonly provider: import("effect/Schema").Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
                 }>>>;
@@ -1750,9 +1755,13 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                     readonly placementId: import("effect/Schema").String;
                     readonly accountId: import("effect/Schema").String;
                     readonly revision: import("effect/Schema").Int;
-                    readonly login: import("effect/Schema").Struct<{
+                    readonly login: import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
                         readonly kind: import("effect/Schema").Literal<"subscription">;
-                    }>;
+                    }>, import("effect/Schema").Struct<{
+                        readonly kind: import("effect/Schema").Literal<"api-key">;
+                        readonly suffix: import("effect/Schema").String;
+                        readonly keyPath: import("effect/Schema").optional<import("effect/Schema").String>;
+                    }>]>;
                     readonly pinned: import("effect/Schema").Boolean;
                     readonly provider: import("effect/Schema").Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
                 }>>>;
@@ -1805,9 +1814,13 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                     readonly placementId: import("effect/Schema").String;
                     readonly accountId: import("effect/Schema").String;
                     readonly revision: import("effect/Schema").Int;
-                    readonly login: import("effect/Schema").Struct<{
+                    readonly login: import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
                         readonly kind: import("effect/Schema").Literal<"subscription">;
-                    }>;
+                    }>, import("effect/Schema").Struct<{
+                        readonly kind: import("effect/Schema").Literal<"api-key">;
+                        readonly suffix: import("effect/Schema").String;
+                        readonly keyPath: import("effect/Schema").optional<import("effect/Schema").String>;
+                    }>]>;
                     readonly pinned: import("effect/Schema").Boolean;
                     readonly provider: import("effect/Schema").Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
                 }>>>;
@@ -2964,6 +2977,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly connectedAccountLoginClass: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                 readonly kubernetesPersonLayout: import("effect/Schema").optional<import("effect/Schema").Boolean>;
                 readonly credentialPlacements: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+                readonly connectedAccountApiKeys: import("effect/Schema").optional<import("effect/Schema").Boolean>;
             }>>;
         }>>, never, import("@sealant/api-contracts").RequestRefusal, never>, never, never>;
         readonly getSetupState: HttpApiClient.Client.Method<import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"getSetupState", "GET", "/v1/system/setup-state", never, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
@@ -3561,9 +3575,13 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                     readonly placementId: import("effect/Schema").String;
                     readonly accountId: import("effect/Schema").String;
                     readonly revision: import("effect/Schema").Int;
-                    readonly login: import("effect/Schema").Struct<{
+                    readonly login: import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
                         readonly kind: import("effect/Schema").Literal<"subscription">;
-                    }>;
+                    }>, import("effect/Schema").Struct<{
+                        readonly kind: import("effect/Schema").Literal<"api-key">;
+                        readonly suffix: import("effect/Schema").String;
+                        readonly keyPath: import("effect/Schema").optional<import("effect/Schema").String>;
+                    }>]>;
                     readonly pinned: import("effect/Schema").Boolean;
                     readonly provider: import("effect/Schema").Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
                 }>>>;
@@ -3682,9 +3700,13 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                     readonly placementId: import("effect/Schema").String;
                     readonly accountId: import("effect/Schema").String;
                     readonly revision: import("effect/Schema").Int;
-                    readonly login: import("effect/Schema").Struct<{
+                    readonly login: import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
                         readonly kind: import("effect/Schema").Literal<"subscription">;
-                    }>;
+                    }>, import("effect/Schema").Struct<{
+                        readonly kind: import("effect/Schema").Literal<"api-key">;
+                        readonly suffix: import("effect/Schema").String;
+                        readonly keyPath: import("effect/Schema").optional<import("effect/Schema").String>;
+                    }>]>;
                     readonly pinned: import("effect/Schema").Boolean;
                     readonly provider: import("effect/Schema").Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
                 }>>>;
@@ -3737,9 +3759,13 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                     readonly placementId: import("effect/Schema").String;
                     readonly accountId: import("effect/Schema").String;
                     readonly revision: import("effect/Schema").Int;
-                    readonly login: import("effect/Schema").Struct<{
+                    readonly login: import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
                         readonly kind: import("effect/Schema").Literal<"subscription">;
-                    }>;
+                    }>, import("effect/Schema").Struct<{
+                        readonly kind: import("effect/Schema").Literal<"api-key">;
+                        readonly suffix: import("effect/Schema").String;
+                        readonly keyPath: import("effect/Schema").optional<import("effect/Schema").String>;
+                    }>]>;
                     readonly pinned: import("effect/Schema").Boolean;
                     readonly provider: import("effect/Schema").Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
                 }>>>;

package/dist/effect/operations.d.ts

@@ -575,6 +575,10 @@ export declare const putWorkspaceCredentialsOp: (workspaceId: string, payload: {
             readonly revision: number;
             readonly login: {
                 readonly kind: "subscription";
+            } | {
+                readonly kind: "api-key";
+                readonly suffix: string;
+                readonly keyPath?: string | undefined;
             };
             readonly pinned: boolean;
             readonly provider: "claude" | "codex" | "github" | "opencode" | "pi";
@@ -625,6 +629,10 @@ export declare const pruneWorkspaceCredentialsOp: (workspaceId: string, payload:
             readonly revision: number;
             readonly login: {
                 readonly kind: "subscription";
+            } | {
+                readonly kind: "api-key";
+                readonly suffix: string;
+                readonly keyPath?: string | undefined;
             };
             readonly pinned: boolean;
             readonly provider: "claude" | "codex" | "github" | "opencode" | "pi";
@@ -676,6 +684,10 @@ export declare const listWorkspaceCredentialsOp: (workspaceId: string, query: {
             readonly revision: number;
             readonly login: {
                 readonly kind: "subscription";
+            } | {
+                readonly kind: "api-key";
+                readonly suffix: string;
+                readonly keyPath?: string | undefined;
             };
             readonly pinned: boolean;
             readonly provider: "claude" | "codex" | "github" | "opencode" | "pi";
@@ -1381,6 +1393,7 @@ export declare const getIndexOp: () => Effect.Effect<{
         readonly connectedAccountLoginClass?: boolean | undefined;
         readonly kubernetesPersonLayout?: boolean | undefined;
         readonly credentialPlacements?: boolean | undefined;
+        readonly connectedAccountApiKeys?: boolean | undefined;
     } | undefined;
 }, import("effect/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | import("effect/Schema").SchemaError, SealantApiClient>;
 export declare const getSetupStateOp: () => Effect.Effect<{

package/dist/facade/workspace.js

@@ -200,9 +200,23 @@ export const toWorkspaceImage = (image) => ({
             },
         }),
 });
+const toPlacementLogin = (login) => login.kind === "subscription"
+    ? login
+    : {
+        kind: "api-key",
+        suffix: login.suffix,
+        ...(login.keyPath === undefined ? {} : { keyPath: login.keyPath }),
+    };
 /** Wire → public credential home. */
 const toCredentialHome = (home) => ({
-    ...(home.placements === undefined ? {} : { placements: home.placements }),
+    ...(home.placements === undefined
+        ? {}
+        : {
+            placements: home.placements.map((receipt) => ({
+                ...receipt,
+                login: toPlacementLogin(receipt.login),
+            })),
+        }),
     home: home.home,
     onBehalfOf: home.onBehalfOfUserId,
     accounts: {

package/dist/internal/features.d.ts

@@ -20,6 +20,7 @@ export declare const toFeatures: (index: {
         readonly connectedAccountLoginClass?: boolean | undefined;
         readonly kubernetesPersonLayout?: boolean | undefined;
         readonly credentialPlacements?: boolean | undefined;
+        readonly connectedAccountApiKeys?: boolean | undefined;
     } | undefined;
 }) => SealantFeatures;
 /**

package/dist/internal/features.js

@@ -24,6 +24,7 @@ export const toFeatures = (index) => {
         connectedAccountDefaults: features?.connectedAccountDefaults === true,
         connectedAccountLoginClass: features?.connectedAccountLoginClass === true,
         kubernetesPersonLayout: features?.kubernetesPersonLayout === true,
+        connectedAccountApiKeys: features?.connectedAccountApiKeys === true,
     };
 };
 /**

package/dist/types.d.ts

@@ -1343,11 +1343,20 @@ export interface CredentialPlacementReceipt {
     readonly placementId: string;
     readonly accountId: string;
     readonly revision: number;
-    readonly login: {
-        readonly kind: "subscription";
-    };
+    readonly login: CredentialPlacementLogin;
     readonly pinned: boolean;
 }
+/**
+ * What a placed login spends. A key carries its last four characters; a Claude key also the
+ * absolute path of its file in the home, for an `apiKeyHelper` such as `cat <keyPath>`.
+ */
+export type CredentialPlacementLogin = {
+    readonly kind: "subscription";
+} | {
+    readonly kind: "api-key";
+    readonly suffix: string;
+    readonly keyPath?: string;
+};
 /** A receipt associated with the provider slot it occupies in this home. */
 export interface WorkspaceCredentialPlacementReceipt extends CredentialPlacementReceipt {
     readonly provider: "claude" | "codex" | "github" | "pi" | "opencode";
@@ -1365,7 +1374,12 @@ export interface WorkspaceCredentialHome {
     readonly home: string;
     /** The one person whose logins the home holds. */
     readonly onBehalfOf: string;
+    /**
+     * By provider, the account whose login holds the provider's one file. Claude keys are not here:
+     * the receipts in `placements` say which logins a home holds.
+     */
     readonly accounts: {
+        /** The account of Claude's subscription file, never a Claude key's. */
         readonly claude?: WorkspaceCredentialHomeAccount;
         readonly codex?: WorkspaceCredentialHomeAccount;
         readonly github?: WorkspaceCredentialHomeAccount;
@@ -1453,6 +1467,11 @@ export interface SealantFeatures {
     readonly kubernetesPersonLayout: boolean;
     /** Credential homes answer placement receipts; a put takes `live`; `prune` exists. */
     readonly credentialPlacements: boolean;
+    /**
+     * Claude and Codex API keys are placed into homes: a Claude key's receipt carries `keyPath`, the
+     * file an `apiKeyHelper` reads. A launch at `$HOME` still refuses a Claude key.
+     */
+    readonly connectedAccountApiKeys: boolean;
 }
 /** A published workspace image. */
 export interface WorkspaceImage {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealant/sdk-next",
-  "version": "0.40.0-next.765",
+  "version": "0.40.0-next.767",
   "description": "The fluent public SDK for Sealant — create a workspace, run a harness, replay the record.",
   "license": "Apache-2.0",
   "repository": {
@@ -26,12 +26,12 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@sealant/api-contracts": "npm:@sealant/api-contracts-next@0.40.0-next.765"
+    "@sealant/api-contracts": "npm:@sealant/api-contracts-next@0.40.0-next.767"
   },
   "peerDependencies": {
     "effect": "^4.0.5"
   },
-  "gitHead": "9802ef32e54645b875272fecf15d036bf7f095e1",
+  "gitHead": "97076a88aa9305d64290508d681af72dfa89868f",
   "publishConfig": {
     "access": "public"
   }