@xfey/tenso 0.1.130

package/node_modules/@tutti/shared/dist/schemas/internal/feishu-connections.js

@@ -0,0 +1,23 @@
+import { Type } from "@sinclair/typebox";
+import { FeishuConnectionEntryRefSchema, FeishuConnectionProjectionSchema, } from "../api/feishu-connections.js";
+export const FEISHU_CONNECTION_CONTROL_PATH = "/internal/v1/feishu-connections";
+export const FeishuConnectionControlRequestSchema = Type.Union([
+    Type.Object({
+        action: Type.Literal("resolve"),
+        entry_ref: FeishuConnectionEntryRefSchema,
+        diagnostic_id: Type.Optional(Type.String({ pattern: "^fdiag_[a-f0-9]{32}$" })),
+    }, { additionalProperties: false }),
+    Type.Object({
+        action: Type.Literal("connect"),
+        entry_ref: FeishuConnectionEntryRefSchema,
+        external_subject_ref: Type.String({ pattern: "^open_id:[A-Za-z0-9_-]{1,128}$" }),
+        input: Type.String({ minLength: 1, maxLength: 256 }),
+        diagnostic_id: Type.Optional(Type.String({ pattern: "^fdiag_[a-f0-9]{32}$" })),
+    }, { additionalProperties: false }),
+]);
+export const FeishuConnectionControlResponseSchema = Type.Object({
+    installation_ref: Type.String({ minLength: 1, maxLength: 256 }),
+    conversation_ref: Type.String({ pattern: "^oc_[A-Za-z0-9_-]{1,128}$" }),
+    projection: FeishuConnectionProjectionSchema,
+}, { additionalProperties: false });
+//# sourceMappingURL=feishu-connections.js.map

package/node_modules/@tutti/shared/dist/schemas/internal/feishu-documents.d.ts

@@ -0,0 +1,49 @@
+import { type Static } from "@sinclair/typebox";
+export declare const FEISHU_DOCUMENT_CONTROL_PATH = "/internal/v1/feishu-documents";
+export declare const FeishuDocumentControlRequestSchema: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TObject<{
+    action: import("@sinclair/typebox").TLiteral<"list">;
+    authority: import("@sinclair/typebox").TObject<{
+        project_ref: import("@sinclair/typebox").TString;
+        installation_ref: import("@sinclair/typebox").TString;
+        binding_ref: import("@sinclair/typebox").TString;
+        external_subject_ref: import("@sinclair/typebox").TString;
+        role: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"owner">, import("@sinclair/typebox").TLiteral<"member">]>;
+    }>;
+    diagnostic_id: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+}>, import("@sinclair/typebox").TObject<{
+    action: import("@sinclair/typebox").TLiteral<"connect">;
+    document_id: import("@sinclair/typebox").TString;
+    authority: import("@sinclair/typebox").TObject<{
+        project_ref: import("@sinclair/typebox").TString;
+        installation_ref: import("@sinclair/typebox").TString;
+        binding_ref: import("@sinclair/typebox").TString;
+        external_subject_ref: import("@sinclair/typebox").TString;
+        role: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"owner">, import("@sinclair/typebox").TLiteral<"member">]>;
+    }>;
+    diagnostic_id: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+}>, import("@sinclair/typebox").TObject<{
+    action: import("@sinclair/typebox").TLiteral<"connect_wiki">;
+    node_token: import("@sinclair/typebox").TString;
+    authority: import("@sinclair/typebox").TObject<{
+        project_ref: import("@sinclair/typebox").TString;
+        installation_ref: import("@sinclair/typebox").TString;
+        binding_ref: import("@sinclair/typebox").TString;
+        external_subject_ref: import("@sinclair/typebox").TString;
+        role: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"owner">, import("@sinclair/typebox").TLiteral<"member">]>;
+    }>;
+    diagnostic_id: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+}>, import("@sinclair/typebox").TObject<{
+    expected_updated_at: import("@sinclair/typebox").TString;
+    action: import("@sinclair/typebox").TLiteral<"refresh">;
+    source_ref: import("@sinclair/typebox").TString;
+    authority: import("@sinclair/typebox").TObject<{
+        project_ref: import("@sinclair/typebox").TString;
+        installation_ref: import("@sinclair/typebox").TString;
+        binding_ref: import("@sinclair/typebox").TString;
+        external_subject_ref: import("@sinclair/typebox").TString;
+        role: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"owner">, import("@sinclair/typebox").TLiteral<"member">]>;
+    }>;
+    diagnostic_id: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+}>]>;
+export type FeishuDocumentControlRequest = Static<typeof FeishuDocumentControlRequestSchema>;
+//# sourceMappingURL=feishu-documents.d.ts.map

package/node_modules/@tutti/shared/dist/schemas/internal/feishu-documents.js

@@ -0,0 +1,36 @@
+import { Type } from "@sinclair/typebox";
+import { FeishuDocumentSourceRefSchema, RefreshFeishuDocumentBodySchema, } from "../api/feishu-documents.js";
+import { RelayProjectRefSchema } from "../domain/index.js";
+export const FEISHU_DOCUMENT_CONTROL_PATH = "/internal/v1/feishu-documents";
+const authority = Type.Object({
+    project_ref: RelayProjectRefSchema,
+    installation_ref: Type.String({ minLength: 1, maxLength: 512 }),
+    binding_ref: Type.String({ minLength: 1, maxLength: 512 }),
+    external_subject_ref: Type.String({ pattern: "^open_id:[A-Za-z0-9_-]{1,500}$" }),
+    role: Type.Union([Type.Literal("owner"), Type.Literal("member")]),
+}, { additionalProperties: false });
+const common = {
+    authority,
+    diagnostic_id: Type.Optional(Type.String({ pattern: "^fdiag_[a-f0-9]{32}$" })),
+};
+// The private document locator travels only in this authenticated Relay -> Integration body.
+export const FeishuDocumentControlRequestSchema = Type.Union([
+    Type.Object({ ...common, action: Type.Literal("list") }, { additionalProperties: false }),
+    Type.Object({
+        ...common,
+        action: Type.Literal("connect"),
+        document_id: Type.String({ pattern: "^[A-Za-z0-9]{27}$" }),
+    }, { additionalProperties: false }),
+    Type.Object({
+        ...common,
+        action: Type.Literal("connect_wiki"),
+        node_token: Type.String({ pattern: "^[A-Za-z0-9]{1,999}$" }),
+    }, { additionalProperties: false }),
+    Type.Object({
+        ...common,
+        action: Type.Literal("refresh"),
+        source_ref: FeishuDocumentSourceRefSchema,
+        ...RefreshFeishuDocumentBodySchema.properties,
+    }, { additionalProperties: false }),
+]);
+//# sourceMappingURL=feishu-documents.js.map

package/node_modules/@tutti/shared/dist/schemas/internal/feishu-user-credentials.d.ts

@@ -0,0 +1,22 @@
+import type { Static } from "@sinclair/typebox";
+export declare const FEISHU_USER_CREDENTIAL_HANDOFF_PATH = "/internal/v1/feishu-user-credentials";
+export declare const FeishuUserCredentialRefSchema: import("@sinclair/typebox").TString;
+export declare const FeishuUserCredentialHandoffSchema: import("@sinclair/typebox").TObject<{
+    version: import("@sinclair/typebox").TLiteral<1>;
+    installation_ref: import("@sinclair/typebox").TString;
+    external_subject_ref: import("@sinclair/typebox").TString;
+    access_token: import("@sinclair/typebox").TString;
+    refresh_token: import("@sinclair/typebox").TString;
+    access_expires_at: import("@sinclair/typebox").TString;
+    refresh_expires_at: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    scopes: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+    authorized_at: import("@sinclair/typebox").TString;
+}>;
+export declare const FeishuUserCredentialHandoffResponseSchema: import("@sinclair/typebox").TObject<{
+    credential_ref: import("@sinclair/typebox").TString;
+    updated_at: import("@sinclair/typebox").TString;
+}>;
+export type FeishuUserCredentialRef = Static<typeof FeishuUserCredentialRefSchema>;
+export type FeishuUserCredentialHandoff = Static<typeof FeishuUserCredentialHandoffSchema>;
+export type FeishuUserCredentialHandoffResponse = Static<typeof FeishuUserCredentialHandoffResponseSchema>;
+//# sourceMappingURL=feishu-user-credentials.d.ts.map

package/node_modules/@tutti/shared/dist/schemas/internal/feishu-user-credentials.js

@@ -0,0 +1,37 @@
+import { Type } from "@sinclair/typebox";
+import { IsoDateTimeStringSchema } from "../domain/index.js";
+export const FEISHU_USER_CREDENTIAL_HANDOFF_PATH = "/internal/v1/feishu-user-credentials";
+const SecretValueSchema = Type.String({
+    minLength: 1,
+    maxLength: 4_096,
+    pattern: "^[^\\u0000-\\u001f\\u007f]+$",
+});
+export const FeishuUserCredentialRefSchema = Type.String({
+    minLength: 36,
+    maxLength: 36,
+    pattern: "^feishu_user_[a-f0-9]{24}$",
+});
+export const FeishuUserCredentialHandoffSchema = Type.Object({
+    version: Type.Literal(1),
+    installation_ref: Type.String({ minLength: 1, maxLength: 512 }),
+    external_subject_ref: Type.String({
+        minLength: 9,
+        maxLength: 508,
+        pattern: "^open_id:[A-Za-z0-9_-]{1,500}$",
+    }),
+    access_token: SecretValueSchema,
+    refresh_token: SecretValueSchema,
+    access_expires_at: IsoDateTimeStringSchema,
+    refresh_expires_at: Type.Optional(IsoDateTimeStringSchema),
+    scopes: Type.Array(Type.String({ minLength: 1, maxLength: 256 }), {
+        minItems: 1,
+        maxItems: 32,
+        uniqueItems: true,
+    }),
+    authorized_at: IsoDateTimeStringSchema,
+}, { additionalProperties: false });
+export const FeishuUserCredentialHandoffResponseSchema = Type.Object({
+    credential_ref: FeishuUserCredentialRefSchema,
+    updated_at: IsoDateTimeStringSchema,
+}, { additionalProperties: false });
+//# sourceMappingURL=feishu-user-credentials.js.map

package/node_modules/@tutti/shared/dist/schemas/internal/index.d.ts

@@ -0,0 +1,86 @@
+import type { Static } from "@sinclair/typebox";
+export declare const CommandIdempotencyStatusSchema: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"in_progress">, import("@sinclair/typebox").TLiteral<"completed">, import("@sinclair/typebox").TLiteral<"failed">]>;
+export declare const InterruptedCommandDispositionSchema: import("@sinclair/typebox").TObject<{
+    kind: import("@sinclair/typebox").TLiteral<"interrupted">;
+    retry_with_new_command_id: import("@sinclair/typebox").TBoolean;
+}>;
+export declare const AccountAvatarColorSchema: import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"green" | "blue" | "yellow" | "neutral">[]>;
+export declare const AccountAvatarProjectionSchema: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TObject<{
+    kind: import("@sinclair/typebox").TLiteral<"initials">;
+    initials: import("@sinclair/typebox").TString;
+    color: import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"green" | "blue" | "yellow" | "neutral">[]>;
+}>, import("@sinclair/typebox").TObject<{
+    kind: import("@sinclair/typebox").TLiteral<"image">;
+    image_url: import("@sinclair/typebox").TString;
+    initials: import("@sinclair/typebox").TString;
+    color: import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"green" | "blue" | "yellow" | "neutral">[]>;
+}>]>;
+export declare const RelaySessionContextSchema: import("@sinclair/typebox").TObject<{
+    account_ref: import("@sinclair/typebox").TString;
+    display_name: import("@sinclair/typebox").TString;
+    avatar: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TObject<{
+        kind: import("@sinclair/typebox").TLiteral<"initials">;
+        initials: import("@sinclair/typebox").TString;
+        color: import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"green" | "blue" | "yellow" | "neutral">[]>;
+    }>, import("@sinclair/typebox").TObject<{
+        kind: import("@sinclair/typebox").TLiteral<"image">;
+        image_url: import("@sinclair/typebox").TString;
+        initials: import("@sinclair/typebox").TString;
+        color: import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"green" | "blue" | "yellow" | "neutral">[]>;
+    }>]>;
+    membership: import("@sinclair/typebox").TObject<{
+        label: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"owner">, import("@sinclair/typebox").TLiteral<"member">]>;
+        relay_project_ref: import("@sinclair/typebox").TString;
+        joined_at: import("@sinclair/typebox").TString;
+    }>;
+    client_session_id: import("@sinclair/typebox").TString;
+    client_session_created_at: import("@sinclair/typebox").TString;
+}>;
+export declare const FeishuPlatformSessionContextSchema: import("@sinclair/typebox").TObject<{
+    platform_session_ref: import("@sinclair/typebox").TString;
+    account_ref: import("@sinclair/typebox").TString;
+    display_name: import("@sinclair/typebox").TString;
+    avatar: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TObject<{
+        kind: import("@sinclair/typebox").TLiteral<"initials">;
+        initials: import("@sinclair/typebox").TString;
+        color: import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"green" | "blue" | "yellow" | "neutral">[]>;
+    }>, import("@sinclair/typebox").TObject<{
+        kind: import("@sinclair/typebox").TLiteral<"image">;
+        image_url: import("@sinclair/typebox").TString;
+        initials: import("@sinclair/typebox").TString;
+        color: import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"green" | "blue" | "yellow" | "neutral">[]>;
+    }>]>;
+    membership: import("@sinclair/typebox").TObject<{
+        label: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"owner">, import("@sinclair/typebox").TLiteral<"member">]>;
+        relay_project_ref: import("@sinclair/typebox").TString;
+        joined_at: import("@sinclair/typebox").TString;
+    }>;
+    binding_ref: import("@sinclair/typebox").TString;
+    installation_ref: import("@sinclair/typebox").TString;
+    external_subject_ref: import("@sinclair/typebox").TString;
+    platform_session_created_at: import("@sinclair/typebox").TString;
+    platform_session_expires_at: import("@sinclair/typebox").TString;
+}>;
+export type CommandIdempotencyStatus = Static<typeof CommandIdempotencyStatusSchema>;
+export type InterruptedCommandDisposition = Static<typeof InterruptedCommandDispositionSchema>;
+export type AccountAvatarColor = Static<typeof AccountAvatarColorSchema>;
+export type AccountAvatarProjection = Static<typeof AccountAvatarProjectionSchema>;
+export type RelaySessionContext = Static<typeof RelaySessionContextSchema>;
+export type FeishuPlatformSessionContext = Static<typeof FeishuPlatformSessionContextSchema>;
+export declare function isRelaySessionContext(value: unknown): value is RelaySessionContext;
+export declare function parseRelaySessionContext(value: unknown): RelaySessionContext | null;
+export declare function isFeishuPlatformSessionContext(value: unknown): value is FeishuPlatformSessionContext;
+export declare function parseFeishuPlatformSessionContext(value: unknown): FeishuPlatformSessionContext | null;
+export * from "./platform-integration.js";
+export * from "./feishu-user-credentials.js";
+export * from "./feishu-documents.js";
+export * from "./external-references.js";
+export * from "./platform-clarification-content.js";
+export * from "./platform-clarification.js";
+export * from "./feishu-connections.js";
+export * from "./managed-models.js";
+export * from "./project-authority.js";
+export * from "./creation-validation.js";
+export * from "./managed-runtime.js";
+export * from "./managed-account.js";
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@tutti/shared/dist/schemas/internal/index.js

@@ -0,0 +1,80 @@
+import { Type } from "@sinclair/typebox";
+import { Value } from "@sinclair/typebox/value";
+import { ACCOUNT_AVATAR_COLORS } from "../../domain/index.js";
+import { IsoDateTimeStringSchema, RelayAccountRefSchema, RelayClientSessionIdSchema, RelayPlatformSessionRefSchema, RelayProjectRefSchema, } from "../domain/index.js";
+export const CommandIdempotencyStatusSchema = Type.Union([
+    Type.Literal("in_progress"),
+    Type.Literal("completed"),
+    Type.Literal("failed"),
+]);
+export const InterruptedCommandDispositionSchema = Type.Object({
+    kind: Type.Literal("interrupted"),
+    retry_with_new_command_id: Type.Boolean(),
+}, { additionalProperties: false });
+export const AccountAvatarColorSchema = Type.Union(ACCOUNT_AVATAR_COLORS.map((color) => Type.Literal(color)));
+export const AccountAvatarProjectionSchema = Type.Union([
+    Type.Object({
+        kind: Type.Literal("initials"),
+        initials: Type.String({ minLength: 1 }),
+        color: AccountAvatarColorSchema,
+    }, { additionalProperties: false }),
+    Type.Object({
+        kind: Type.Literal("image"),
+        image_url: Type.String({ minLength: 1 }),
+        initials: Type.String({ minLength: 1 }),
+        color: AccountAvatarColorSchema,
+    }, { additionalProperties: false }),
+]);
+export const RelaySessionContextSchema = Type.Object({
+    account_ref: RelayAccountRefSchema,
+    display_name: Type.String({ minLength: 1 }),
+    avatar: AccountAvatarProjectionSchema,
+    membership: Type.Object({
+        label: Type.Union([Type.Literal("owner"), Type.Literal("member")]),
+        relay_project_ref: RelayProjectRefSchema,
+        joined_at: IsoDateTimeStringSchema,
+    }, { additionalProperties: false }),
+    client_session_id: RelayClientSessionIdSchema,
+    client_session_created_at: IsoDateTimeStringSchema,
+}, { additionalProperties: false });
+export const FeishuPlatformSessionContextSchema = Type.Object({
+    platform_session_ref: RelayPlatformSessionRefSchema,
+    account_ref: RelayAccountRefSchema,
+    display_name: Type.String({ minLength: 1 }),
+    avatar: AccountAvatarProjectionSchema,
+    membership: Type.Object({
+        label: Type.Union([Type.Literal("owner"), Type.Literal("member")]),
+        relay_project_ref: RelayProjectRefSchema,
+        joined_at: IsoDateTimeStringSchema,
+    }, { additionalProperties: false }),
+    binding_ref: Type.String({ minLength: 1, maxLength: 512 }),
+    installation_ref: Type.String({ minLength: 1, maxLength: 512 }),
+    external_subject_ref: Type.String({ minLength: 1, maxLength: 512 }),
+    platform_session_created_at: IsoDateTimeStringSchema,
+    platform_session_expires_at: IsoDateTimeStringSchema,
+}, { additionalProperties: false });
+export function isRelaySessionContext(value) {
+    return Value.Check(RelaySessionContextSchema, value);
+}
+export function parseRelaySessionContext(value) {
+    return isRelaySessionContext(value) ? value : null;
+}
+export function isFeishuPlatformSessionContext(value) {
+    return Value.Check(FeishuPlatformSessionContextSchema, value);
+}
+export function parseFeishuPlatformSessionContext(value) {
+    return isFeishuPlatformSessionContext(value) ? value : null;
+}
+export * from "./platform-integration.js";
+export * from "./feishu-user-credentials.js";
+export * from "./feishu-documents.js";
+export * from "./external-references.js";
+export * from "./platform-clarification-content.js";
+export * from "./platform-clarification.js";
+export * from "./feishu-connections.js";
+export * from "./managed-models.js";
+export * from "./project-authority.js";
+export * from "./creation-validation.js";
+export * from "./managed-runtime.js";
+export * from "./managed-account.js";
+//# sourceMappingURL=index.js.map

package/node_modules/@tutti/shared/dist/schemas/internal/managed-account.d.ts

@@ -0,0 +1,12 @@
+import { type Static } from "@sinclair/typebox";
+export declare const ManagedAccountReadAuthoritySchema: import("@sinclair/typebox").TObject<{
+    version: import("@sinclair/typebox").TLiteral<1>;
+    audience: import("@sinclair/typebox").TLiteral<"tutti-managed-account-read">;
+    issuer: import("@sinclair/typebox").TString;
+    account_ref: import("@sinclair/typebox").TString;
+    nonce: import("@sinclair/typebox").TString;
+    issued_at: import("@sinclair/typebox").TInteger;
+    expires_at: import("@sinclair/typebox").TInteger;
+}>;
+export type ManagedAccountReadAuthority = Static<typeof ManagedAccountReadAuthoritySchema>;
+//# sourceMappingURL=managed-account.d.ts.map

package/node_modules/@tutti/shared/dist/schemas/internal/managed-account.js

@@ -0,0 +1,13 @@
+import { Type } from "@sinclair/typebox";
+import { RelayAccountRefSchema, IdempotencyKeySchema } from "../domain/index.js";
+// Read-only account ledger snapshot. Cannot create users, pin routes or issue keys.
+export const ManagedAccountReadAuthoritySchema = Type.Object({
+    version: Type.Literal(1),
+    audience: Type.Literal("tutti-managed-account-read"),
+    issuer: Type.String({ minLength: 1, maxLength: 200 }),
+    account_ref: RelayAccountRefSchema,
+    nonce: IdempotencyKeySchema,
+    issued_at: Type.Integer({ minimum: 0 }),
+    expires_at: Type.Integer({ minimum: 0 }),
+}, { additionalProperties: false });
+//# sourceMappingURL=managed-account.js.map

package/node_modules/@tutti/shared/dist/schemas/internal/managed-models.d.ts

@@ -0,0 +1,17 @@
+import { type Static } from "@sinclair/typebox";
+export declare const ManagedModelAuthoritySchema: import("@sinclair/typebox").TObject<{
+    version: import("@sinclair/typebox").TLiteral<1>;
+    audience: import("@sinclair/typebox").TLiteral<"tutti-managed-models">;
+    issuer: import("@sinclair/typebox").TString;
+    account_ref: import("@sinclair/typebox").TString;
+    relay_project_ref: import("@sinclair/typebox").TString;
+    nonce: import("@sinclair/typebox").TString;
+    issued_at: import("@sinclair/typebox").TInteger;
+    expires_at: import("@sinclair/typebox").TInteger;
+}>;
+export declare const ManagedModelAuthorizationBodySchema: import("@sinclair/typebox").TObject<{
+    relay_project_ref: import("@sinclair/typebox").TString;
+}>;
+export type ManagedModelAuthority = Static<typeof ManagedModelAuthoritySchema>;
+export type ManagedModelAuthorizationBody = Static<typeof ManagedModelAuthorizationBodySchema>;
+//# sourceMappingURL=managed-models.d.ts.map

package/node_modules/@tutti/shared/dist/schemas/internal/managed-models.js

@@ -0,0 +1,17 @@
+import { Type } from "@sinclair/typebox";
+import { RelayAccountRefSchema, RelayProjectRefSchema, IdempotencyKeySchema, } from "../domain/index.js";
+// Private capability contract. Never exported through browser OpenAPI.
+export const ManagedModelAuthoritySchema = Type.Object({
+    version: Type.Literal(1),
+    audience: Type.Literal("tutti-managed-models"),
+    issuer: Type.String({ minLength: 1, maxLength: 200 }),
+    account_ref: RelayAccountRefSchema,
+    relay_project_ref: RelayProjectRefSchema,
+    nonce: IdempotencyKeySchema,
+    issued_at: Type.Integer({ minimum: 0 }),
+    expires_at: Type.Integer({ minimum: 0 }),
+}, { additionalProperties: false });
+export const ManagedModelAuthorizationBodySchema = Type.Object({
+    relay_project_ref: RelayProjectRefSchema,
+}, { additionalProperties: false });
+//# sourceMappingURL=managed-models.js.map

package/node_modules/@tutti/shared/dist/schemas/internal/managed-runtime.d.ts

@@ -0,0 +1,113 @@
+import { type Static } from "@sinclair/typebox";
+export declare const ManagedDelegationScopeFields: {
+    account_ref: import("@sinclair/typebox").TString;
+    relay_project_ref: import("@sinclair/typebox").TString;
+    delegation_ref: import("@sinclair/typebox").TString;
+    grant_ref: import("@sinclair/typebox").TString;
+    installation_ref: import("@sinclair/typebox").TString;
+};
+export declare const ManagedRuntimeAuthoritySchema: import("@sinclair/typebox").TObject<{
+    funding_kind: import("@sinclair/typebox").TLiteral<"trial">;
+    account_ref: import("@sinclair/typebox").TString;
+    relay_project_ref: import("@sinclair/typebox").TString;
+    delegation_ref: import("@sinclair/typebox").TString;
+    grant_ref: import("@sinclair/typebox").TString;
+    installation_ref: import("@sinclair/typebox").TString;
+    issuer: import("@sinclair/typebox").TString;
+    nonce: import("@sinclair/typebox").TString;
+    issued_at: import("@sinclair/typebox").TInteger;
+    expires_at: import("@sinclair/typebox").TInteger;
+    version: import("@sinclair/typebox").TLiteral<3>;
+    audience: import("@sinclair/typebox").TLiteral<"tutti-managed-runtime">;
+}>;
+export type ManagedRuntimeAuthority = Static<typeof ManagedRuntimeAuthoritySchema>;
+export declare const ManagedRevocationAuthoritySchema: import("@sinclair/typebox").TObject<{
+    account_ref: import("@sinclair/typebox").TString;
+    relay_project_ref: import("@sinclair/typebox").TString;
+    delegation_ref: import("@sinclair/typebox").TString;
+    grant_ref: import("@sinclair/typebox").TString;
+    installation_ref: import("@sinclair/typebox").TString;
+    issuer: import("@sinclair/typebox").TString;
+    nonce: import("@sinclair/typebox").TString;
+    issued_at: import("@sinclair/typebox").TInteger;
+    expires_at: import("@sinclair/typebox").TInteger;
+    version: import("@sinclair/typebox").TLiteral<1>;
+    audience: import("@sinclair/typebox").TLiteral<"tutti-managed-revocation">;
+}>;
+export type ManagedRevocationAuthority = Static<typeof ManagedRevocationAuthoritySchema>;
+export declare const NativeRuntimeAuthorizationSchema: import("@sinclair/typebox").TObject<{
+    authorization: import("@sinclair/typebox").TString;
+    expires_at: import("@sinclair/typebox").TInteger;
+    control_origin: import("@sinclair/typebox").TString;
+    delegation_ref: import("@sinclair/typebox").TString;
+}>;
+export declare const ManagedRuntimeSessionRefSchema: import("@sinclair/typebox").TString;
+export declare const ManagedRuntimeCredentialRefSchema: import("@sinclair/typebox").TString;
+export declare const ManagedRouteRefSchema: import("@sinclair/typebox").TString;
+export declare const ManagedProviderIdentitySchema: import("@sinclair/typebox").TObject<{
+    base_url: import("@sinclair/typebox").TString;
+    model: import("@sinclair/typebox").TString;
+}>;
+export declare const ManagedSessionResultSchema: import("@sinclair/typebox").TObject<{
+    session_ref: import("@sinclair/typebox").TString;
+    route_ref: import("@sinclair/typebox").TString;
+    disposition: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"created">, import("@sinclair/typebox").TLiteral<"existing">]>;
+    provider: import("@sinclair/typebox").TObject<{
+        base_url: import("@sinclair/typebox").TString;
+        model: import("@sinclair/typebox").TString;
+    }>;
+}>;
+export declare const ManagedCredentialProjectionSchema: import("@sinclair/typebox").TObject<{
+    credential_ref: import("@sinclair/typebox").TString;
+    session_ref: import("@sinclair/typebox").TString;
+    device_ref: import("@sinclair/typebox").TString;
+    state: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"creating">, import("@sinclair/typebox").TLiteral<"active">, import("@sinclair/typebox").TLiteral<"expired">, import("@sinclair/typebox").TLiteral<"revoking">, import("@sinclair/typebox").TLiteral<"revoked">]>;
+    expires_at: import("@sinclair/typebox").TInteger;
+    quota_cap: import("@sinclair/typebox").TInteger;
+}>;
+export declare const ManagedProviderCredentialSchema: import("@sinclair/typebox").TObject<{
+    base_url: import("@sinclair/typebox").TString;
+    model: import("@sinclair/typebox").TString;
+    api_key: import("@sinclair/typebox").TString;
+}>;
+export declare const ManagedCredentialIssueResultSchema: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TObject<{
+    disposition: import("@sinclair/typebox").TLiteral<"issued">;
+    credential: import("@sinclair/typebox").TObject<{
+        credential_ref: import("@sinclair/typebox").TString;
+        session_ref: import("@sinclair/typebox").TString;
+        device_ref: import("@sinclair/typebox").TString;
+        state: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"creating">, import("@sinclair/typebox").TLiteral<"active">, import("@sinclair/typebox").TLiteral<"expired">, import("@sinclair/typebox").TLiteral<"revoking">, import("@sinclair/typebox").TLiteral<"revoked">]>;
+        expires_at: import("@sinclair/typebox").TInteger;
+        quota_cap: import("@sinclair/typebox").TInteger;
+    }>;
+    route_ref: import("@sinclair/typebox").TString;
+    provider: import("@sinclair/typebox").TObject<{
+        base_url: import("@sinclair/typebox").TString;
+        model: import("@sinclair/typebox").TString;
+        api_key: import("@sinclair/typebox").TString;
+    }>;
+}>, import("@sinclair/typebox").TObject<{
+    disposition: import("@sinclair/typebox").TLiteral<"already_issued">;
+    credential: import("@sinclair/typebox").TObject<{
+        credential_ref: import("@sinclair/typebox").TString;
+        session_ref: import("@sinclair/typebox").TString;
+        device_ref: import("@sinclair/typebox").TString;
+        state: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"creating">, import("@sinclair/typebox").TLiteral<"active">, import("@sinclair/typebox").TLiteral<"expired">, import("@sinclair/typebox").TLiteral<"revoking">, import("@sinclair/typebox").TLiteral<"revoked">]>;
+        expires_at: import("@sinclair/typebox").TInteger;
+        quota_cap: import("@sinclair/typebox").TInteger;
+    }>;
+}>]>;
+export declare const ManagedCredentialRevokeResultSchema: import("@sinclair/typebox").TObject<{
+    disposition: import("@sinclair/typebox").TLiteral<"revoked">;
+    credential: import("@sinclair/typebox").TObject<{
+        credential_ref: import("@sinclair/typebox").TString;
+        session_ref: import("@sinclair/typebox").TString;
+        device_ref: import("@sinclair/typebox").TString;
+        state: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"creating">, import("@sinclair/typebox").TLiteral<"active">, import("@sinclair/typebox").TLiteral<"expired">, import("@sinclair/typebox").TLiteral<"revoking">, import("@sinclair/typebox").TLiteral<"revoked">]>;
+        expires_at: import("@sinclair/typebox").TInteger;
+        quota_cap: import("@sinclair/typebox").TInteger;
+    }>;
+}>;
+export type ManagedProviderCredential = Static<typeof ManagedProviderCredentialSchema>;
+export type ManagedCredentialProjection = Static<typeof ManagedCredentialProjectionSchema>;
+//# sourceMappingURL=managed-runtime.d.ts.map

package/node_modules/@tutti/shared/dist/schemas/internal/managed-runtime.js

@@ -0,0 +1,84 @@
+import { Type } from "@sinclair/typebox";
+import { ID_PREFIXES, ULID_BODY_PATTERN } from "../../ids/index.js";
+import { RelayAccountRefSchema, RelayProjectRefSchema, IdempotencyKeySchema, } from "../domain/index.js";
+import { HostDelegationRefSchema, HostInstallationRefSchema, ProjectModelGrantRefSchema, } from "./project-authority.js";
+export const ManagedDelegationScopeFields = {
+    account_ref: RelayAccountRefSchema,
+    relay_project_ref: RelayProjectRefSchema,
+    delegation_ref: HostDelegationRefSchema,
+    grant_ref: ProjectModelGrantRefSchema,
+    installation_ref: HostInstallationRefSchema,
+};
+const CapabilityFields = {
+    issuer: Type.String({ minLength: 1, maxLength: 200 }),
+    nonce: IdempotencyKeySchema,
+    issued_at: Type.Integer({ minimum: 0 }),
+    expires_at: Type.Integer({ minimum: 0 }),
+};
+export const ManagedRuntimeAuthoritySchema = Type.Object({
+    version: Type.Literal(3),
+    audience: Type.Literal("tutti-managed-runtime"),
+    ...CapabilityFields,
+    ...ManagedDelegationScopeFields,
+    funding_kind: Type.Literal("trial"),
+}, { additionalProperties: false });
+// Operator/service control only; never issued to native or browser callers.
+export const ManagedRevocationAuthoritySchema = Type.Object({
+    version: Type.Literal(1),
+    audience: Type.Literal("tutti-managed-revocation"),
+    ...CapabilityFields,
+    ...ManagedDelegationScopeFields,
+}, { additionalProperties: false });
+export const NativeRuntimeAuthorizationSchema = Type.Object({
+    authorization: Type.String({
+        pattern: "^tma3\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]{86}$",
+        maxLength: 3500,
+    }),
+    expires_at: Type.Integer({ minimum: 0 }),
+    control_origin: Type.String({ minLength: 1, maxLength: 500 }),
+    delegation_ref: HostDelegationRefSchema,
+}, { additionalProperties: false });
+const managedId = (prefix) => Type.String({ pattern: `^${prefix}${ULID_BODY_PATTERN}$` });
+export const ManagedRuntimeSessionRefSchema = managedId(ID_PREFIXES.managedSession);
+export const ManagedRuntimeCredentialRefSchema = managedId(ID_PREFIXES.managedCredential);
+export const ManagedRouteRefSchema = Type.String({ pattern: "^[a-z0-9][a-z0-9-]{1,60}$" });
+export const ManagedProviderIdentitySchema = Type.Object({
+    base_url: Type.String({ minLength: 1, maxLength: 500 }),
+    model: Type.String({ pattern: "^tutti-[a-z0-9-]{1,80}$" }),
+}, { additionalProperties: false });
+export const ManagedSessionResultSchema = Type.Object({
+    session_ref: ManagedRuntimeSessionRefSchema,
+    route_ref: ManagedRouteRefSchema,
+    disposition: Type.Union([Type.Literal("created"), Type.Literal("existing")]),
+    provider: ManagedProviderIdentitySchema,
+}, { additionalProperties: false });
+export const ManagedCredentialProjectionSchema = Type.Object({
+    credential_ref: ManagedRuntimeCredentialRefSchema,
+    session_ref: ManagedRuntimeSessionRefSchema,
+    device_ref: managedId(ID_PREFIXES.managedDevice),
+    state: Type.Union([
+        Type.Literal("creating"),
+        Type.Literal("active"),
+        Type.Literal("expired"),
+        Type.Literal("revoking"),
+        Type.Literal("revoked"),
+    ]),
+    expires_at: Type.Integer({ minimum: 0 }),
+    quota_cap: Type.Integer({ minimum: 1 }),
+}, { additionalProperties: false });
+export const ManagedProviderCredentialSchema = Type.Object({
+    base_url: Type.String({ minLength: 1, maxLength: 500 }),
+    model: Type.String({ pattern: "^tutti-[a-z0-9-]{1,80}$" }),
+    api_key: Type.String({ minLength: 16, maxLength: 1024, pattern: "^[^\\s]+$" }),
+}, { additionalProperties: false });
+export const ManagedCredentialIssueResultSchema = Type.Union([
+    Type.Object({
+        disposition: Type.Literal("issued"),
+        credential: ManagedCredentialProjectionSchema,
+        route_ref: ManagedRouteRefSchema,
+        provider: ManagedProviderCredentialSchema,
+    }, { additionalProperties: false }),
+    Type.Object({ disposition: Type.Literal("already_issued"), credential: ManagedCredentialProjectionSchema }, { additionalProperties: false }),
+]);
+export const ManagedCredentialRevokeResultSchema = Type.Object({ disposition: Type.Literal("revoked"), credential: ManagedCredentialProjectionSchema }, { additionalProperties: false });
+//# sourceMappingURL=managed-runtime.js.map

package/node_modules/@tutti/shared/dist/schemas/internal/platform-clarification-content.d.ts

@@ -0,0 +1,15 @@
+import type { Static } from "@sinclair/typebox";
+/** Immutable request plus a monotonic Host projection, never Integration-owned round truth. */
+export declare const PlatformClarificationContentSchema: import("@sinclair/typebox").TObject<{
+    kind: import("@sinclair/typebox").TLiteral<"clarification">;
+    round_id: import("@sinclair/typebox").TString;
+    version: import("@sinclair/typebox").TInteger;
+    answer_revision: import("@sinclair/typebox").TInteger;
+    closed_reason: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"resolved">, import("@sinclair/typebox").TLiteral<"contract_changed">, import("@sinclair/typebox").TLiteral<"cancelled">]>>;
+    state: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"writable">, import("@sinclair/typebox").TLiteral<"submitted">, import("@sinclair/typebox").TLiteral<"continued">, import("@sinclair/typebox").TLiteral<"closed">]>;
+    title: import("@sinclair/typebox").TString;
+    request: import("@sinclair/typebox").TString;
+    opened_at: import("@sinclair/typebox").TString;
+}>;
+export type PlatformClarificationContent = Static<typeof PlatformClarificationContentSchema>;
+//# sourceMappingURL=platform-clarification-content.d.ts.map