@xfey/tutti 0.1.119 → 0.1.120

package/dist/server-shell/http/routes/project-api/schemas.d.ts

@@ -43,73 +43,7 @@ export declare const AccountAvatarProjectionSchema: {
         };
     }];
 };
-export declare const ProviderConfigProjectionSchema: {
-    readonly oneOf: readonly [{
-        readonly type: "object";
-        readonly required: readonly ["status"];
-        readonly additionalProperties: false;
-        readonly properties: {
-            readonly status: {
-                readonly type: "string";
-                readonly enum: readonly ["not_configured"];
-            };
-        };
-    }, {
-        readonly type: "object";
-        readonly required: readonly ["status", "provider", "auth_kind", "redacted_key", "default_model", "validated_at"];
-        readonly additionalProperties: false;
-        readonly properties: {
-            readonly status: {
-                readonly type: "string";
-                readonly enum: readonly ["configured"];
-            };
-            readonly provider: {
-                readonly type: "string";
-                readonly enum: readonly ["openai"];
-            };
-            readonly auth_kind: {
-                readonly type: "string";
-                readonly enum: readonly ["api_key"];
-            };
-            readonly redacted_key: {
-                readonly type: "string";
-            };
-            readonly default_model: {
-                readonly type: "string";
-            };
-            readonly validated_at: import("@sinclair/typebox").TString;
-        };
-    }, {
-        readonly type: "object";
-        readonly required: readonly ["status"];
-        readonly additionalProperties: false;
-        readonly properties: {
-            readonly status: {
-                readonly type: "string";
-                readonly enum: readonly ["invalid"];
-            };
-            readonly provider: {
-                readonly type: "string";
-                readonly enum: readonly ["openai"];
-            };
-            readonly auth_kind: {
-                readonly type: "string";
-                readonly enum: readonly ["api_key"];
-            };
-            readonly redacted_key: {
-                readonly type: "string";
-            };
-            readonly default_model: {
-                readonly type: "string";
-            };
-            readonly validated_at: import("@sinclair/typebox").TString;
-            readonly invalid_reason_code: {
-                readonly type: "string";
-                readonly enum: readonly ["provider_auth_invalid", "provider_quota_or_billing_required", "provider_rate_limited", "provider_model_unavailable", "provider_network_error", "unknown"];
-            };
-        };
-    }];
-};
+export { ProviderConfigProjectionSchema } from "@tutti/shared/schemas/api";
 export declare const ProviderUsageProjectionSchema: {
     readonly type: "object";
     readonly required: readonly ["total_tokens", "totals", "by_source", "by_model", "recent_windows"];
@@ -552,7 +486,7 @@ export declare const WorkspaceResponseSchema: {
             readonly properties: {
                 readonly status: {
                     readonly type: "string";
-                    readonly enum: readonly ["not_configured", "configured", "invalid"];
+                    readonly enum: readonly ["not_configured", "configured", "managed", "invalid"];
                 };
                 readonly provider: {
                     readonly type: "string";
@@ -735,7 +669,7 @@ export declare const BootstrapResponseSchema: {
                     readonly properties: {
                         readonly status: {
                             readonly type: "string";
-                            readonly enum: readonly ["not_configured", "configured", "invalid"];
+                            readonly enum: readonly ["not_configured", "configured", "managed", "invalid"];
                         };
                         readonly provider: {
                             readonly type: "string";
@@ -873,73 +807,28 @@ export declare const BootstrapResponseSchema: {
                 };
             };
         };
-        readonly provider_config: {
-            readonly oneOf: readonly [{
-                readonly type: "object";
-                readonly required: readonly ["status"];
-                readonly additionalProperties: false;
-                readonly properties: {
-                    readonly status: {
-                        readonly type: "string";
-                        readonly enum: readonly ["not_configured"];
-                    };
-                };
-            }, {
-                readonly type: "object";
-                readonly required: readonly ["status", "provider", "auth_kind", "redacted_key", "default_model", "validated_at"];
-                readonly additionalProperties: false;
-                readonly properties: {
-                    readonly status: {
-                        readonly type: "string";
-                        readonly enum: readonly ["configured"];
-                    };
-                    readonly provider: {
-                        readonly type: "string";
-                        readonly enum: readonly ["openai"];
-                    };
-                    readonly auth_kind: {
-                        readonly type: "string";
-                        readonly enum: readonly ["api_key"];
-                    };
-                    readonly redacted_key: {
-                        readonly type: "string";
-                    };
-                    readonly default_model: {
-                        readonly type: "string";
-                    };
-                    readonly validated_at: import("@sinclair/typebox").TString;
-                };
-            }, {
-                readonly type: "object";
-                readonly required: readonly ["status"];
-                readonly additionalProperties: false;
-                readonly properties: {
-                    readonly status: {
-                        readonly type: "string";
-                        readonly enum: readonly ["invalid"];
-                    };
-                    readonly provider: {
-                        readonly type: "string";
-                        readonly enum: readonly ["openai"];
-                    };
-                    readonly auth_kind: {
-                        readonly type: "string";
-                        readonly enum: readonly ["api_key"];
-                    };
-                    readonly redacted_key: {
-                        readonly type: "string";
-                    };
-                    readonly default_model: {
-                        readonly type: "string";
-                    };
-                    readonly validated_at: import("@sinclair/typebox").TString;
-                    readonly invalid_reason_code: {
-                        readonly type: "string";
-                        readonly enum: readonly ["provider_auth_invalid", "provider_quota_or_billing_required", "provider_rate_limited", "provider_model_unavailable", "provider_network_error", "unknown"];
-                    };
-                };
-            }];
-        };
+        readonly provider_config: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TObject<{
+            status: import("@sinclair/typebox").TLiteral<"not_configured">;
+        }>, import("@sinclair/typebox").TObject<{
+            status: import("@sinclair/typebox").TLiteral<"managed">;
+            funding_kind: import("@sinclair/typebox").TLiteral<"trial">;
+            tier: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"light">, import("@sinclair/typebox").TLiteral<"high">, import("@sinclair/typebox").TLiteral<"max">]>;
+        }>, import("@sinclair/typebox").TObject<{
+            status: import("@sinclair/typebox").TLiteral<"configured">;
+            provider: import("@sinclair/typebox").TLiteral<"openai">;
+            auth_kind: import("@sinclair/typebox").TLiteral<"api_key">;
+            redacted_key: import("@sinclair/typebox").TString;
+            default_model: import("@sinclair/typebox").TString;
+            validated_at: import("@sinclair/typebox").TString;
+        }>, import("@sinclair/typebox").TObject<{
+            status: import("@sinclair/typebox").TLiteral<"invalid">;
+            provider: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TLiteral<"openai">>;
+            auth_kind: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TLiteral<"api_key">>;
+            redacted_key: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+            default_model: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+            validated_at: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+            invalid_reason_code: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"provider_auth_invalid">, import("@sinclair/typebox").TLiteral<"provider_quota_or_billing_required">, import("@sinclair/typebox").TLiteral<"provider_rate_limited">, import("@sinclair/typebox").TLiteral<"provider_model_unavailable">, import("@sinclair/typebox").TLiteral<"provider_network_error">, import("@sinclair/typebox").TLiteral<"unknown">]>>;
+        }>]>;
         readonly snapshots: {
             readonly type: "object";
             readonly additionalProperties: false;

package/dist/server-shell/http/routes/project-api/schemas.js

@@ -1,5 +1,5 @@
 import { ApprovalRequestIdSchema, ClarificationRoundRefSchema, ClarificationThreadRefSchema, IdempotencyKeySchema, IsoDateTimeStringSchema, ProjectIdSchema, RelayAccountRefSchema, RelayClientSessionIdSchema, RelayPlatformSessionRefSchema, RelayProjectRefSchema, RecoverySummaryIdSchema, TaskIdSchema, } from "@tutti/shared/schemas/domain";
-import { ActiveClarificationProjectionSchema, ActiveApprovalProjectionSchema, ExecutionStatusProjectionSchema, MessageWindowSchema, ProjectTimelineResponseSchema, ReadStateSummaryProjectionSchema, ScratchpadProjectionSchema, WorklistProjectionSchema, } from "@tutti/shared/schemas/api";
+import { ActiveClarificationProjectionSchema, ActiveApprovalProjectionSchema, ExecutionStatusProjectionSchema, MessageWindowSchema, ProjectTimelineResponseSchema, ReadStateSummaryProjectionSchema, ScratchpadProjectionSchema, WorklistProjectionSchema, ProviderConfigProjectionSchema, } from "@tutti/shared/schemas/api";
 import { ACCOUNT_AVATAR_COLORS } from "@tutti/shared/domain";
 import { HOST_MAINLINE_BRANCH } from "./constants.js";
 export const AccountAvatarProjectionSchema = {
@@ -27,62 +27,8 @@ export const AccountAvatarProjectionSchema = {
         },
     ],
 };
-export const ProviderConfigProjectionSchema = {
-    oneOf: [
-        {
-            type: "object",
-            required: ["status"],
-            additionalProperties: false,
-            properties: {
-                status: { type: "string", enum: ["not_configured"] },
-            },
-        },
-        {
-            type: "object",
-            required: [
-                "status",
-                "provider",
-                "auth_kind",
-                "redacted_key",
-                "default_model",
-                "validated_at",
-            ],
-            additionalProperties: false,
-            properties: {
-                status: { type: "string", enum: ["configured"] },
-                provider: { type: "string", enum: ["openai"] },
-                auth_kind: { type: "string", enum: ["api_key"] },
-                redacted_key: { type: "string" },
-                default_model: { type: "string" },
-                validated_at: IsoDateTimeStringSchema,
-            },
-        },
-        {
-            type: "object",
-            required: ["status"],
-            additionalProperties: false,
-            properties: {
-                status: { type: "string", enum: ["invalid"] },
-                provider: { type: "string", enum: ["openai"] },
-                auth_kind: { type: "string", enum: ["api_key"] },
-                redacted_key: { type: "string" },
-                default_model: { type: "string" },
-                validated_at: IsoDateTimeStringSchema,
-                invalid_reason_code: {
-                    type: "string",
-                    enum: [
-                        "provider_auth_invalid",
-                        "provider_quota_or_billing_required",
-                        "provider_rate_limited",
-                        "provider_model_unavailable",
-                        "provider_network_error",
-                        "unknown",
-                    ],
-                },
-            },
-        },
-    ],
-};
+// Keep Fastify serialization and OpenAPI on the shared provider contract.
+export { ProviderConfigProjectionSchema } from "@tutti/shared/schemas/api";
 const ProviderUsageBreakdownProjectionSchema = {
     type: "object",
     required: [
@@ -305,7 +251,7 @@ export const WorkspaceResponseSchema = {
             required: ["status"],
             additionalProperties: false,
             properties: {
-                status: { type: "string", enum: ["not_configured", "configured", "invalid"] },
+                status: { type: "string", enum: ["not_configured", "configured", "managed", "invalid"] },
                 provider: { type: "string", enum: ["openai"] },
             },
         },

package/dist/server-shell/http/routes/project-api/types.d.ts

@@ -23,6 +23,10 @@ export type ResolvedStagedUpload = {
     complete: (status: "completed" | "aborted") => Promise<void>;
 };
 export type HostProviderConfigProjection = {
+    status: "managed";
+    funding_kind: "trial";
+    tier: "light" | "high" | "max";
+} | {
     status: "not_configured";
 } | {
     status: "configured";

package/dist/server-shell/local-console/managed-project-routes.d.ts

@@ -0,0 +1,9 @@
+import type { FastifyInstance, FastifyRequest } from "fastify";
+import { type LocalConsoleManagedProjectService } from "./managed-project-service.js";
+import type { ReadLocalConsoleSession } from "./session.js";
+export declare function registerLocalConsoleManagedProjectRoutes(app: FastifyInstance, options: {
+    service: LocalConsoleManagedProjectService;
+    tuttiHome: string;
+    requireSession: (request: FastifyRequest, csrf: boolean) => ReadLocalConsoleSession;
+}): void;
+//# sourceMappingURL=managed-project-routes.d.ts.map

package/dist/server-shell/local-console/managed-project-routes.js

@@ -0,0 +1,120 @@
+import { Type } from "@sinclair/typebox";
+import { Value } from "@sinclair/typebox/value";
+import { IdempotencyKeySchema } from "@tutti/shared/schemas/domain";
+import { serializeRuntimeLogLine } from "@tutti/shared/utils";
+import { NativeAuthorityTransportError } from "@tutti/relay-client";
+import { appendHostLogLine, getHostLogFilePath } from "../cli/machine-local.js";
+import { ManagedLocalStateError } from "../managed-access/private-store.js";
+import { LocalConsoleProjectError } from "./project-service.js";
+import { LocalConsoleOperationConflictError } from "./operation-coordinator.js";
+import { LaunchError } from "../cli/errors.js";
+import { ManagedDraftInputSchema, } from "./managed-project-service.js";
+const ReadSchema = Type.Object({ request_ref: IdempotencyKeySchema }, { additionalProperties: false });
+export function registerLocalConsoleManagedProjectRoutes(app, options) {
+    for (const operation of ["prepare", "read", "reconcile", "validate", "launch"]) {
+        app.post(`/local-console/v1/managed-projects/${operation}`, {
+            bodyLimit: 8192,
+            errorHandler: (error, request, reply) => {
+                if (error.code !== "FST_ERR_CTP_INVALID_JSON_BODY" &&
+                    error.code !== "FST_ERR_CTP_BODY_TOO_LARGE")
+                    throw error;
+                const status = error.code === "FST_ERR_CTP_BODY_TOO_LARGE" ? 413 : 400;
+                void reply
+                    .code(status)
+                    .header("cache-control", "no-store")
+                    .header("x-tutti-request-id", request.id)
+                    .send({
+                    error: {
+                        code: status === 413 ? "payload_too_large" : "managed_creation_input_invalid",
+                        request_id: request.id,
+                        retryable: false,
+                    },
+                });
+            },
+            onError: (request, _reply, error, done) => {
+                // Parser, loopback, cookie and CSRF rejection precede the operation handler.
+                // Never record error.message: JSON parser errors may include request content.
+                observeManagedCreation(options.tuttiHome, request.id, operation, "rejected", error.statusCode === 401
+                    ? "session_required"
+                    : error.statusCode === 403
+                        ? "request_origin_or_csrf_rejected"
+                        : error.statusCode === 413
+                            ? "payload_too_large"
+                            : "managed_http_rejected");
+                done();
+            },
+        }, async (request, reply) => {
+            const diagnostic = request.id;
+            reply.header("x-tutti-request-id", diagnostic);
+            const session = options.requireSession(request, true);
+            if (!session.accountReady) {
+                observeManagedCreation(options.tuttiHome, diagnostic, operation, "rejected", "account_required");
+                return reply.code(401).send({
+                    error: { code: "account_required", request_id: diagnostic, retryable: false },
+                });
+            }
+            const observe = (status, reason, upstreamRequestId) => {
+                observeManagedCreation(options.tuttiHome, diagnostic, operation, status, reason, upstreamRequestId);
+            };
+            try {
+                if (Object.keys(request.query).length)
+                    throw new ManagedLocalStateError("managed_creation_input_invalid");
+                let result;
+                if (operation === "prepare") {
+                    if (!Value.Check(ManagedDraftInputSchema, request.body))
+                        throw new ManagedLocalStateError("managed_creation_input_invalid");
+                    result = await options.service.prepare(request.body, session.context);
+                }
+                else {
+                    if (!Value.Check(ReadSchema, request.body))
+                        throw new ManagedLocalStateError("managed_creation_input_invalid");
+                    result = await options.service[operation](request.body.request_ref, session.context);
+                }
+                observe("succeeded");
+                return result;
+            }
+            catch (error) {
+                const code = error instanceof ManagedLocalStateError ||
+                    error instanceof LocalConsoleProjectError ||
+                    error instanceof LocalConsoleOperationConflictError ||
+                    error instanceof LaunchError ||
+                    error instanceof NativeAuthorityTransportError
+                    ? error.code
+                    : "managed_creation_unavailable";
+                const status = error instanceof NativeAuthorityTransportError
+                    ? (error.status ?? 503)
+                    : error instanceof LocalConsoleProjectError
+                        ? error.statusCode
+                        : code === "managed_creation_input_invalid"
+                            ? 400
+                            : 409;
+                observe("rejected", code, error instanceof NativeAuthorityTransportError ? error.requestId : undefined);
+                return reply
+                    .code(status)
+                    .send({ error: { code, request_id: diagnostic, retryable: false } });
+            }
+        });
+    }
+}
+function observeManagedCreation(tuttiHome, diagnostic, stage, status, reason, upstreamRequestId) {
+    try {
+        appendHostLogLine(getHostLogFilePath(tuttiHome), serializeRuntimeLogLine({
+            service: "host",
+            component: "managed-creation",
+            level: status === "succeeded" ? "info" : "warn",
+            message: "Native managed creation operation",
+            fields: {
+                request_id: diagnostic,
+                stage,
+                status,
+                ...(reason === undefined ? {} : { reason_code: reason }),
+                ...(upstreamRequestId === undefined ? {} : { relay_request_id: upstreamRequestId }),
+            },
+            now: () => new Date(),
+        }));
+    }
+    catch {
+        /* Diagnostics cannot alter authorization or disclose private failures. */
+    }
+}
+//# sourceMappingURL=managed-project-routes.js.map

package/dist/server-shell/local-console/managed-project-service.d.ts

@@ -0,0 +1,151 @@
+import { type Static } from "@sinclair/typebox";
+import { type LocalConsoleInvocationContext } from "./invocation-context.js";
+import type { LocalConsoleOperationCoordinator } from "./operation-coordinator.js";
+import type { LocalConsoleProjectService } from "./project-service.js";
+export declare const ManagedDraftInputSchema: import("@sinclair/typebox").TObject<{
+    request_ref: import("@sinclair/typebox").TString;
+    workspace_path: import("@sinclair/typebox").TString;
+    display_name: import("@sinclair/typebox").TString;
+    description: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    surface: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"standalone">, import("@sinclair/typebox").TLiteral<"feishu">]>;
+    tier: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"light">, import("@sinclair/typebox").TLiteral<"high">, import("@sinclair/typebox").TLiteral<"max">]>;
+    existing_project_id: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+}>;
+export type ManagedDraftInput = Static<typeof ManagedDraftInputSchema>;
+export declare class LocalConsoleManagedProjectService {
+    private readonly options;
+    constructor(options: {
+        tuttiHome: string;
+        operations: LocalConsoleOperationCoordinator;
+        serviceEnvironment?: NodeJS.ProcessEnv;
+        fetchImpl?: typeof fetch;
+        now?: () => Date;
+        projects?: Pick<LocalConsoleProjectService, "launchAuthorizedProject">;
+    });
+    private environment;
+    private state;
+    prepare(input: ManagedDraftInput, context: LocalConsoleInvocationContext): Promise<{
+        draft: {
+            state: "validation_failed" | "prepared" | "registered" | "validated" | "awaiting_authorization" | "validation_unknown";
+            expires_at: string;
+            existing_project_id?: `prj_${string}`;
+            surface: "standalone" | "feishu";
+            tier: "light" | "high" | "max";
+            description?: string;
+            request_ref: string;
+            project_id: `prj_${string}`;
+            display_name: string;
+            workspace_path: string;
+        };
+        relay_origin: string;
+        preparation: {
+            existing_relay_project_ref?: string;
+            expires_before?: string;
+            installation_ref: string;
+            surface: "standalone" | "feishu";
+            tier: "light" | "high" | "max";
+            request_ref: string;
+            project_id: string;
+            installation_secret_hash: string;
+            handoff_token_hash: string;
+            host_registration_secret_hash: string;
+            trial_consent: "trial-project-v1";
+        };
+    }>;
+    read(requestRef: string, context: LocalConsoleInvocationContext): {
+        draft: {
+            state: "validation_failed" | "prepared" | "registered" | "validated" | "awaiting_authorization" | "validation_unknown";
+            expires_at: string;
+            existing_project_id?: `prj_${string}`;
+            surface: "standalone" | "feishu";
+            tier: "light" | "high" | "max";
+            description?: string;
+            request_ref: string;
+            project_id: `prj_${string}`;
+            display_name: string;
+            workspace_path: string;
+        };
+        relay_origin: string;
+        preparation: {
+            existing_relay_project_ref?: string;
+            expires_before?: string;
+            installation_ref: string;
+            surface: "standalone" | "feishu";
+            tier: "light" | "high" | "max";
+            request_ref: string;
+            project_id: string;
+            installation_secret_hash: string;
+            handoff_token_hash: string;
+            host_registration_secret_hash: string;
+            trial_consent: "trial-project-v1";
+        };
+    };
+    reconcile(requestRef: string, context: LocalConsoleInvocationContext): Promise<{
+        draft: {
+            state: "validation_failed" | "prepared" | "registered" | "validated" | "awaiting_authorization" | "validation_unknown";
+            expires_at: string;
+            existing_project_id?: `prj_${string}`;
+            surface: "standalone" | "feishu";
+            tier: "light" | "high" | "max";
+            description?: string;
+            request_ref: string;
+            project_id: `prj_${string}`;
+            display_name: string;
+            workspace_path: string;
+        };
+        relay_origin: string;
+        preparation: {
+            existing_relay_project_ref?: string;
+            expires_before?: string;
+            installation_ref: string;
+            surface: "standalone" | "feishu";
+            tier: "light" | "high" | "max";
+            request_ref: string;
+            project_id: string;
+            installation_secret_hash: string;
+            handoff_token_hash: string;
+            host_registration_secret_hash: string;
+            trial_consent: "trial-project-v1";
+        };
+    }>;
+    validate(requestRef: string, context: LocalConsoleInvocationContext): Promise<{
+        validation: {
+            state: "failed" | "unknown" | "started" | "succeeded";
+            installation_ref: string;
+            tier: "light" | "high" | "max";
+            reason_code: "validation_started" | "validation_succeeded" | "validation_route_unavailable" | "validation_http_rejected" | "validation_response_invalid" | "validation_transport_unknown" | "validation_interrupted";
+            project_id: string;
+            creation_ref: string;
+            route_ref: string;
+            http_status: number | null;
+        };
+        draft: {
+            state: "validation_failed" | "prepared" | "registered" | "validated" | "awaiting_authorization" | "validation_unknown";
+            expires_at: string;
+            existing_project_id?: `prj_${string}`;
+            surface: "standalone" | "feishu";
+            tier: "light" | "high" | "max";
+            description?: string;
+            request_ref: string;
+            project_id: `prj_${string}`;
+            display_name: string;
+            workspace_path: string;
+        };
+        relay_origin: string;
+        preparation: {
+            existing_relay_project_ref?: string;
+            expires_before?: string;
+            installation_ref: string;
+            surface: "standalone" | "feishu";
+            tier: "light" | "high" | "max";
+            request_ref: string;
+            project_id: string;
+            installation_secret_hash: string;
+            handoff_token_hash: string;
+            host_registration_secret_hash: string;
+            trial_consent: "trial-project-v1";
+        };
+    }>;
+    launch(requestRef: string, context: LocalConsoleInvocationContext): Promise<import("./project-service.js").LocalConsoleLaunchResult>;
+}
+//# sourceMappingURL=managed-project-service.d.ts.map