@xfey/tutti 0.1.119 → 0.1.121

package/dist/server-shell/managed-access/state.js

@@ -0,0 +1,292 @@
+import { createHash, randomBytes } from "node:crypto";
+import { existsSync, realpathSync } from "node:fs";
+import { join } from "node:path";
+import { Value } from "@sinclair/typebox/value";
+import { createIdempotencyKey, createPrefixedId, createProjectId, ID_PREFIXES, isPrefixedId, } from "@tutti/shared/ids";
+import { HostDelegationProjectionSchema, PROJECT_TRIAL_POLICY, } from "@tutti/shared/schemas/internal";
+import { ensureManagedPrivateRoot, isWithin, ManagedLocalStateError, ManagedPrivateStore, } from "./private-store.js";
+import { parseInstallation, parseJournal, NativeProjectPointerSchema, } from "./records.js";
+const DRAFT_TTL_MS = 10 * 60_000;
+const secret = () => randomBytes(32).toString("base64url");
+const hash = (value) => `sha256:${createHash("sha256").update(value).digest("hex")}`;
+export function managedRelayOrigin(input) {
+    try {
+        const url = new URL(input);
+        if (url.username ||
+            url.password ||
+            url.search ||
+            url.hash ||
+            url.pathname !== "/" ||
+            !(url.protocol === "https:" ||
+                (url.protocol === "http:" && ["127.0.0.1", "[::1]"].includes(url.hostname))))
+            throw new Error();
+        return url.origin;
+    }
+    catch {
+        throw new ManagedLocalStateError("managed_relay_origin_invalid");
+    }
+}
+function originDirectory(tuttiHome, relayUrl) {
+    return join(tuttiHome, "credentials", "managed", createHash("sha256").update(managedRelayOrigin(relayUrl)).digest("hex"));
+}
+// BYOK reads do not create a managed installation, journal or mutex.
+export function findNativeManagedProject(options) {
+    if (!isPrefixedId(options.projectId, ID_PREFIXES.project))
+        throw new ManagedLocalStateError("managed_project_id_invalid");
+    let origin;
+    try {
+        origin = new URL(options.relayUrl).origin;
+    }
+    catch {
+        return null;
+    }
+    if (!existsSync(join(originDirectory(options.tuttiHome, origin), `project-${options.projectId}.json`)))
+        return null;
+    const state = new NativeManagedState(options);
+    return { state, journal: state.project(options.projectId) };
+}
+export class NativeManagedState {
+    origin;
+    files;
+    constructor(options) {
+        this.origin = managedRelayOrigin(options.relayUrl);
+        this.files = new ManagedPrivateStore(ensureManagedPrivateRoot(options.tuttiHome, createHash("sha256").update(this.origin).digest("hex")));
+    }
+    installation(now = new Date()) {
+        return this.files.transaction(() => {
+            const saved = this.files.read("installation.json");
+            if (saved !== null)
+                return parseInstallation(saved, this.origin);
+            const value = {
+                version: 1,
+                relay_origin: this.origin,
+                installation_ref: createPrefixedId(ID_PREFIXES.hostInstallation),
+                secret: secret(),
+                created_at: now.toISOString(),
+            };
+            this.files.write("installation.json", value, true);
+            return parseInstallation(this.files.read("installation.json"), this.origin);
+        });
+    }
+    createDraft(options) {
+        const now = options.now ?? new Date();
+        let workspace;
+        try {
+            workspace = realpathSync(options.workspaceRoot);
+        }
+        catch {
+            throw new ManagedLocalStateError("managed_workspace_unavailable");
+        }
+        if (isWithin(workspace, this.files.root) || isWithin(this.files.root, workspace))
+            throw new ManagedLocalStateError("managed_state_in_workspace");
+        const installation = this.installation(now);
+        const requestRef = options.requestRef ?? createIdempotencyKey();
+        const name = this.journalName(requestRef);
+        return this.files.transaction(() => {
+            const saved = this.files.read(name);
+            if (saved !== null) {
+                const record = this.readJournal(requestRef);
+                if (record.workspace_root !== workspace ||
+                    record.display_name !== options.displayName ||
+                    record.description !== options.description ||
+                    record.surface !== options.surface ||
+                    (options.projectId !== undefined && record.project_id !== options.projectId) ||
+                    record.existing_relay_project_ref !== options.existing?.relayProjectRef ||
+                    record.previous_request_ref !== options.existing?.previousRequestRef ||
+                    (options.existing !== undefined &&
+                        record.host_registration_secret !== options.existing.hostSecret) ||
+                    record.installation_ref !== installation.installation_ref)
+                    throw new ManagedLocalStateError("managed_creation_mismatch");
+                return record;
+            }
+            const record = parseJournal({
+                version: 2,
+                request_ref: requestRef,
+                project_id: options.projectId ?? createProjectId(),
+                relay_origin: this.origin,
+                installation_ref: installation.installation_ref,
+                workspace_root: workspace,
+                display_name: options.displayName,
+                ...(options.description === undefined ? {} : { description: options.description }),
+                surface: options.surface,
+                ...(options.existing === undefined
+                    ? {}
+                    : {
+                        existing_relay_project_ref: options.existing.relayProjectRef,
+                        ...(options.existing.previousRequestRef === undefined
+                            ? {}
+                            : { previous_request_ref: options.existing.previousRequestRef }),
+                    }),
+                handoff_token: secret(),
+                host_registration_secret: options.existing?.hostSecret ?? secret(),
+                created_at: now.toISOString(),
+                expires_at: new Date(now.getTime() + DRAFT_TTL_MS).toISOString(),
+                state: "awaiting_authorization",
+            }, this.origin, requestRef);
+            this.files.write(name, record, true);
+            return record;
+        });
+    }
+    read(requestRef) {
+        return this.files.transaction(() => this.readJournal(requestRef));
+    }
+    // Called only inside the private-store mutex. Upgrade metadata atomically;
+    // never rotate proofs, extend consent or restore revoked runtime credentials.
+    readJournal(requestRef) {
+        const name = this.journalName(requestRef);
+        const saved = this.files.read(name);
+        const row = parseJournal(saved, this.origin, requestRef);
+        if (saved && typeof saved === "object" && "version" in saved && saved.version === 1)
+            this.files.write(name, row);
+        return row;
+    }
+    attachProject(requestRef, now = new Date()) {
+        this.bootstrap(requestRef, now);
+        return this.files.transaction(() => {
+            const row = this.readJournal(requestRef);
+            const name = `project-${row.project_id}.json`;
+            const old = this.files.read(name);
+            if (old !== null &&
+                (!Value.Check(NativeProjectPointerSchema, old) ||
+                    old.project_id !== row.project_id ||
+                    (old.request_ref !== requestRef && old.request_ref !== row.previous_request_ref)))
+                throw new ManagedLocalStateError("managed_project_binding_conflict");
+            if (old === null ||
+                (Value.Check(NativeProjectPointerSchema, old) && old.request_ref !== requestRef))
+                this.files.write(name, { version: 1, project_id: row.project_id, request_ref: requestRef }, old === null);
+            return row;
+        });
+    }
+    project(projectId) {
+        if (!isPrefixedId(projectId, ID_PREFIXES.project))
+            throw new ManagedLocalStateError("managed_project_id_invalid");
+        return this.files.transaction(() => {
+            const pointer = this.files.read(`project-${projectId}.json`);
+            if (!Value.Check(NativeProjectPointerSchema, pointer) || pointer.project_id !== projectId)
+                throw new ManagedLocalStateError("managed_project_binding_invalid");
+            const row = this.readJournal(pointer.request_ref);
+            if (row.project_id !== projectId || (row.state !== "validated" && row.state !== "registered"))
+                throw new ManagedLocalStateError("managed_project_binding_invalid");
+            return row;
+        });
+    }
+    preparationBody(requestRef) {
+        const row = this.read(requestRef), installation = this.installation();
+        if (row.installation_ref !== installation.installation_ref)
+            throw new ManagedLocalStateError("managed_installation_changed");
+        return {
+            request_ref: row.request_ref,
+            project_id: row.project_id,
+            surface: row.surface,
+            ...(row.existing_relay_project_ref === undefined
+                ? {}
+                : { existing_relay_project_ref: row.existing_relay_project_ref }),
+            installation_ref: row.installation_ref,
+            installation_secret_hash: hash(installation.secret),
+            handoff_token_hash: hash(row.handoff_token),
+            host_registration_secret_hash: hash(row.host_registration_secret),
+            trial_consent: PROJECT_TRIAL_POLICY,
+            expires_before: row.expires_at,
+        };
+    }
+    proof(requestRef) {
+        const row = this.read(requestRef), installation = this.installation();
+        if (row.installation_ref !== installation.installation_ref)
+            throw new ManagedLocalStateError("managed_installation_changed");
+        return {
+            request_ref: row.request_ref,
+            project_id: row.project_id,
+            installation_ref: row.installation_ref,
+            installation_secret: installation.secret,
+            handoff_token: row.handoff_token,
+            host_registration_secret: row.host_registration_secret,
+        };
+    }
+    // Only native, Relay-verified responses may call these transitions. Browser input is not evidence.
+    prepared(requestRef, receipt, now = new Date()) {
+        return this.update(requestRef, (row) => {
+            if (row.project_id !== receipt.project_id ||
+                row.installation_ref !== receipt.installation_ref ||
+                row.surface !== receipt.surface ||
+                !Number.isFinite(Date.parse(receipt.expires_at)) ||
+                Date.parse(receipt.expires_at) > Date.parse(row.expires_at))
+                throw new ManagedLocalStateError("managed_preparation_mismatch");
+            if (row.state !== "awaiting_authorization") {
+                if (row.creation_ref !== receipt.creation_ref)
+                    throw new ManagedLocalStateError("managed_preparation_mismatch");
+                return row;
+            }
+            if (receipt.expires_at <= now.toISOString())
+                throw new ManagedLocalStateError("managed_preparation_expired");
+            return {
+                ...row,
+                state: "prepared",
+                creation_ref: receipt.creation_ref,
+                expires_at: receipt.expires_at,
+            };
+        });
+    }
+    validation(requestRef, outcome) {
+        return this.update(requestRef, (row) => {
+            if (row.state === "registered" || row.state === "validated")
+                return row;
+            if (row.state === "validation_failed") {
+                if (outcome !== row.state)
+                    throw new ManagedLocalStateError("managed_validation_conflict");
+                return row;
+            }
+            if (row.state !== "prepared" && row.state !== "validation_unknown")
+                throw new ManagedLocalStateError("managed_creation_not_prepared");
+            return { ...row, state: outcome };
+        });
+    }
+    bootstrap(requestRef, now = new Date()) {
+        const row = this.read(requestRef), installation = this.installation();
+        if ((row.state !== "validated" && row.state !== "registered") ||
+            (row.state !== "registered" && row.expires_at <= now.toISOString()))
+            throw new ManagedLocalStateError("managed_creation_not_validated");
+        if (row.installation_ref !== installation.installation_ref)
+            throw new ManagedLocalStateError("managed_installation_changed");
+        return {
+            kind: "managed_project_authority_v2",
+            creation_ref: row.creation_ref,
+            installation_ref: installation.installation_ref,
+            installation_secret: installation.secret,
+            handoff_token: row.handoff_token,
+        };
+    }
+    registered(requestRef, authority) {
+        return this.update(requestRef, (row) => {
+            if (!Value.Check(HostDelegationProjectionSchema, authority) ||
+                authority.installation_ref !== row.installation_ref ||
+                (row.existing_relay_project_ref !== undefined &&
+                    authority.relay_project_ref !== row.existing_relay_project_ref))
+                throw new ManagedLocalStateError("managed_registration_mismatch");
+            if (row.state === "registered") {
+                if (row.authority.delegation_ref !== authority.delegation_ref ||
+                    row.authority.grant_ref !== authority.grant_ref ||
+                    row.authority.relay_project_ref !== authority.relay_project_ref)
+                    throw new ManagedLocalStateError("managed_registration_mismatch");
+                return row;
+            }
+            if (row.state !== "validated")
+                throw new ManagedLocalStateError("managed_creation_not_validated");
+            return { ...row, state: "registered", authority };
+        });
+    }
+    update(requestRef, change) {
+        return this.files.transaction(() => {
+            const name = this.journalName(requestRef);
+            const row = parseJournal(this.files.read(name), this.origin, requestRef);
+            const updated = parseJournal(change(row), this.origin, requestRef);
+            this.files.write(name, updated);
+            return updated;
+        });
+    }
+    journalName(requestRef) {
+        if (!isPrefixedId(requestRef, ID_PREFIXES.idempotency))
+            throw new ManagedLocalStateError("managed_request_ref_invalid");
+        return `${requestRef}.json`;
+    }
+}
+//# sourceMappingURL=state.js.map

package/dist/server-shell/managed-access/transport.d.ts

@@ -0,0 +1,45 @@
+import type { NativeManagedState } from "./state.js";
+export declare function reconcileNativePreparation(options: {
+    state: NativeManagedState;
+    requestRef: string;
+    fetchImpl?: typeof fetch;
+    now?: Date;
+    signal?: AbortSignal;
+}): Promise<{
+    authority?: {
+        state: "active";
+        delegation_ref: string;
+        grant_ref: string;
+        installation_ref: string;
+        relay_project_ref: string;
+        expires_at: null;
+        funding_kind: "trial";
+        model_access: "runtime_authority_required" | "not_enabled";
+    };
+    account_ref: string;
+    request_ref: string;
+    creation: {
+        relay_project_ref?: string;
+        state: "revoked" | "expired" | "prepared" | "activated";
+        installation_ref: string;
+        surface: "standalone" | "feishu";
+        expires_at: string;
+        project_id: string;
+        creation_ref: string;
+    };
+}>;
+export declare function validateNativePreparation(options: {
+    state: NativeManagedState;
+    requestRef: string;
+    fetchImpl?: typeof fetch;
+    signal?: AbortSignal;
+}): Promise<{
+    state: "failed" | "unknown" | "started" | "succeeded";
+    installation_ref: string;
+    reason_code: "validation_started" | "validation_succeeded" | "validation_route_unavailable" | "validation_http_rejected" | "validation_response_invalid" | "validation_transport_unknown" | "validation_interrupted";
+    project_id: string;
+    creation_ref: string;
+    route_ref: string;
+    http_status: number | null;
+}>;
+//# sourceMappingURL=transport.d.ts.map

package/dist/server-shell/managed-access/transport.js

@@ -0,0 +1,39 @@
+import { readNativeCreationAuthority, validateNativeCreationAuthority } from "@tutti/relay-client";
+import { ManagedLocalStateError } from "./private-store.js";
+// The browser never supplies a trusted receipt or account identity to the native journal.
+export async function reconcileNativePreparation(options) {
+    const result = await readNativeCreationAuthority({
+        relayUrl: options.state.origin,
+        body: options.state.proof(options.requestRef),
+        ...(options.fetchImpl === undefined ? {} : { fetchImpl: options.fetchImpl }),
+        ...(options.signal === undefined ? {} : { signal: options.signal }),
+    });
+    if (result.creation.state === "expired" || result.creation.state === "revoked")
+        throw new ManagedLocalStateError(`managed_preparation_${result.creation.state}`);
+    options.state.prepared(options.requestRef, result.creation, options.now ?? new Date());
+    if (result.authority !== undefined)
+        options.state.registered(options.requestRef, result.authority);
+    return result;
+}
+export async function validateNativePreparation(options) {
+    const result = await validateNativeCreationAuthority({
+        relayUrl: options.state.origin,
+        body: options.state.proof(options.requestRef),
+        ...(options.fetchImpl === undefined ? {} : { fetchImpl: options.fetchImpl }),
+        ...(options.signal === undefined ? {} : { signal: options.signal }),
+    });
+    const row = options.state.read(options.requestRef);
+    if (!("creation_ref" in row) ||
+        row.creation_ref !== result.creation_ref ||
+        row.project_id !== result.project_id ||
+        row.installation_ref !== result.installation_ref)
+        throw new ManagedLocalStateError("managed_validation_mismatch");
+    if (result.state === "succeeded")
+        options.state.validation(options.requestRef, "validated");
+    else if (result.state === "unknown" || result.state === "started")
+        options.state.validation(options.requestRef, "validation_unknown");
+    else
+        options.state.validation(options.requestRef, "validation_failed");
+    return result;
+}
+//# sourceMappingURL=transport.js.map

package/dist/server-shell/managed-access/workspace.d.ts

@@ -0,0 +1,10 @@
+import type { NativeManagedState } from "./state.js";
+export declare function acquireManagedWorkspaceLease(tuttiHome: string, workspaceRoot: string): () => void;
+export declare function materializeManagedWorkspace(options: {
+    state: NativeManagedState;
+    requestRef: string;
+    tuttiHome: string;
+    environment: NodeJS.ProcessEnv;
+    now?: () => Date;
+}): Promise<import("../cli/launch.js").LaunchPreparationResult>;
+//# sourceMappingURL=workspace.d.ts.map

package/dist/server-shell/managed-access/workspace.js

@@ -0,0 +1,69 @@
+import { createHash } from "node:crypto";
+import { realpathSync } from "node:fs";
+import { prepareLaunchProject, resolveLaunchLocalContext } from "../cli/launch.js";
+import { readExistingManagedTarget } from "./existing-project.js";
+import { ensureManagedPrivateRoot, ManagedLocalStateError, ManagedPrivateStore, } from "./private-store.js";
+// A workspace can be selected by different drafts and Relay origins. Serialize by
+// canonical folder in a machine-wide namespace, not by project or creation ID.
+export function acquireManagedWorkspaceLease(tuttiHome, workspaceRoot) {
+    const files = new ManagedPrivateStore(ensureManagedPrivateRoot(tuttiHome, createHash("sha256").update("tutti-managed-workspace-locks-v1").digest("hex")));
+    return files.acquireExecutionLease(`workspace-${createHash("sha256").update(realpathSync(workspaceRoot)).digest("hex")}`);
+}
+// Native-only materialization after verified validation. Does not start a Host or
+// write a placeholder BYOK credential. Resuming the same draft reuses its identity.
+export async function materializeManagedWorkspace(options) {
+    const now = options.now ?? (() => new Date());
+    options.state.bootstrap(options.requestRef, now());
+    const row = options.state.read(options.requestRef);
+    const unlock = acquireManagedWorkspaceLease(options.tuttiHome, row.workspace_root);
+    try {
+        let workspacePath = row.workspace_root;
+        if (row.existing_relay_project_ref !== undefined) {
+            const target = readExistingManagedTarget({
+                tuttiHome: options.tuttiHome,
+                relayOrigin: options.state.origin,
+                projectId: row.project_id,
+                workspaceRoot: row.workspace_root,
+                surface: row.surface,
+                requireStopped: row.state !== "registered",
+            });
+            if (target.relayProjectRef !== row.existing_relay_project_ref ||
+                target.hostSecret !== row.host_registration_secret)
+                throw new ManagedLocalStateError("managed_existing_project_mismatch");
+            workspacePath = target.workspacePath;
+        }
+        const environment = {
+            ...options.environment,
+            TUTTI_HOME: options.tuttiHome,
+            TUTTI_RELAY_URL: options.state.origin,
+        };
+        const local = resolveLaunchLocalContext({
+            workspacePath,
+            env: environment,
+        });
+        if (realpathSync(local.workspace_root) !== row.workspace_root ||
+            (local.existing_identity.kind === "present" &&
+                local.existing_identity.project_id !== row.project_id))
+            throw new ManagedLocalStateError("managed_workspace_identity_changed");
+        // Persist the recovery pointer before Git/binding mutation. A crash never leaves
+        // an apparently-BYOK project where the managed creation reservation was lost.
+        options.state.attachProject(options.requestRef, now());
+        return await prepareLaunchProject({
+            workspacePath,
+            env: environment,
+            yes: true,
+            projectDisplayName: row.display_name,
+            ...(row.description === undefined ? {} : { projectDescription: row.description }),
+            projectSurface: row.surface,
+            reservedIdentity: {
+                projectId: row.project_id,
+                hostRegistrationSecret: row.host_registration_secret,
+            },
+            now,
+        });
+    }
+    finally {
+        unlock();
+    }
+}
+//# sourceMappingURL=workspace.js.map

package/dist/server-shell/smoke/e2e-client.d.ts

@@ -1,5 +1,10 @@
-import { type HostProjectApiClient, type LoginPayload, type LoginResponse, type OpenProjectResponse, type RelayApiClient, type TuttiApiFetch, type AcceptJoinResponse, type JoinEntryProjection, type TuttiApiResponse } from "@tutti/api-client";
+import { type HostProjectApiClient, type EmailLoginChallengeProjection, type LoginResponse, type OpenProjectResponse, type RelayApiClient, type TuttiApiFetch, type AcceptJoinResponse, type JoinEntryProjection, type TuttiApiResponse } from "@tutti/api-client";
 import type { RelayProjectRef } from "@tutti/shared/ids";
+export type SmokeEmailLoginInput = {
+    email: string;
+    display_name?: string;
+    readCode: (challenge: EmailLoginChallengeProjection) => Promise<string>;
+};
 export type E2ESmokeLogSink = (line: string) => void;
 export type E2ESmokeClientOptions = {
     relayBaseUrl: string;
@@ -20,7 +25,7 @@ export type E2ESmokeSession = {
 };
 export type LoginJoinAndOpenWorkspaceInput = {
     joinToken: string;
-    login?: Partial<LoginPayload>;
+    login: SmokeEmailLoginInput;
 };
 export type LoginJoinAndOpenWorkspaceResult = {
     joinEntry: JoinEntryProjection;
@@ -53,7 +58,7 @@ export declare class E2ESmokeCookieJar {
     private storeSetCookieHeader;
 }
 export declare function createE2ESmokeSession(options: E2ESmokeClientOptions): E2ESmokeSession;
-export declare function loginRelaySmokeAccount(session: E2ESmokeSession, input?: Partial<LoginPayload>): Promise<LoginResponse>;
+export declare function loginRelaySmokeAccount(session: E2ESmokeSession, input: SmokeEmailLoginInput): Promise<LoginResponse>;
 export declare function loginJoinAndOpenWorkspace(session: E2ESmokeSession, input: LoginJoinAndOpenWorkspaceInput): Promise<LoginJoinAndOpenWorkspaceResult>;
 export declare function pollE2ESmoke<TValue>(options: E2ESmokePollOptions<TValue>): Promise<TValue>;
 //# sourceMappingURL=e2e-client.d.ts.map

package/dist/server-shell/smoke/e2e-client.js

@@ -1,10 +1,6 @@
 import { setTimeout as sleep } from "node:timers/promises";
 import { createHostProjectApiClientFromRelay, createRelayApiClientFromRelay, } from "@tutti/api-client";
 import { serializeRuntimeLogLine } from "@tutti/shared/utils";
-const DEFAULT_SMOKE_LOGIN_PAYLOAD = {
-    email: "tutti-smoke@example.invalid",
-    display_name: "Tutti Smoke",
-};
 const DEFAULT_POLL_TIMEOUT_MS = 30_000;
 const DEFAULT_POLL_INTERVAL_MS = 500;
 export class E2ESmokeFlowError extends Error {
@@ -160,12 +156,6 @@ function emitSmokeLog(session, stage, fields = {}) {
         now: session.now,
     }));
 }
-function loginPayload(input) {
-    return {
-        ...DEFAULT_SMOKE_LOGIN_PAYLOAD,
-        ...(input ?? {}),
-    };
-}
 function readRelayProjectRefFromJoin(joinEntry) {
     if (joinEntry.relay_project !== undefined) {
         return joinEntry.relay_project.relay_project_ref;
@@ -216,7 +206,17 @@ export function createE2ESmokeSession(options) {
     };
 }
 export async function loginRelaySmokeAccount(session, input) {
-    const response = await session.relay.login(loginPayload(input), { now: session.now });
+    const start = await session.relay.startEmailLogin({ email: input.email }, { now: session.now });
+    if (start.result === undefined)
+        throw new Error("Email login challenge was not returned");
+    const code = await input.readCode(start.result.challenge);
+    const response = await session.relay.verifyEmailLogin({
+        challenge_ref: start.result.challenge.challenge_ref,
+        code,
+    }, { now: session.now });
+    if (response.result?.account.profile_complete === false && input.display_name !== undefined) {
+        await session.relay.completeAccountProfile({ display_name: input.display_name }, { now: session.now });
+    }
     emitSmokeLog(session, "relay_login", {
         disposition: response.disposition.kind,
         account_ref: response.result?.account.account_ref,

package/node_modules/@tutti/relay-client/dist/host-control.d.ts

@@ -1,7 +1,7 @@
 import { type HostConnectionRef, type IdempotencyKey, type ProjectId, type RelayProjectRef, type RelayUploadRef } from "@tutti/shared/ids";
 import type { ProjectSurfaceProfile } from "@tutti/shared/domain";
 import type { RelayUploadPurpose, Sha256Digest } from "@tutti/shared/schemas/api";
-import { type FeishuSetupProjection, type PlatformOutboundHandoffResponse, type PlatformOutboundIntent } from "@tutti/shared/schemas/internal";
+import { type HostDelegationProjection, type ManagedProjectBootstrap, type FeishuSetupProjection, type PlatformOutboundHandoffResponse, type PlatformOutboundIntent } from "@tutti/shared/schemas/internal";
 export type RelayHostControlFetch = (input: string | URL, init?: RequestInit) => Promise<Response>;
 export type RelayProjectProjection = {
     relay_project_ref: RelayProjectRef;
@@ -25,6 +25,7 @@ export type JoinTokenProjection = {
     visibility: "visible_once" | "not_recoverable";
 };
 export type RegisterRelayHostConnectionPayload = {
+    managed_bootstrap?: ManagedProjectBootstrap;
     project_identity: {
         source: "git_config";
         project_id: ProjectId;
@@ -64,6 +65,7 @@ export type RegisterRelayHostConnectionPayload = {
     };
 };
 export type RegisterRelayHostConnectionResult = {
+    managed_authority?: HostDelegationProjection;
     relay_project: RelayProjectProjection;
     host_connection: HostConnectionProjection;
     join_token?: JoinTokenProjection;
@@ -152,6 +154,7 @@ export type DeliverRelayPlatformOutboundOptions = {
     signal?: AbortSignal;
 };
 export type RegisterRelayHostConnectionOptions = {
+    managedBootstrap?: ManagedProjectBootstrap;
     relayUrl: string;
     projectId: ProjectId;
     hostRegistrationSecret: string;

package/node_modules/@tutti/relay-client/dist/host-control.js

@@ -1,5 +1,5 @@
 import { createIdempotencyKey, } from "@tutti/shared/ids";
-import { isPlatformOutboundHandoffResponse, } from "@tutti/shared/schemas/internal";
+import { isPlatformOutboundHandoffResponse, isHostDelegationProjection, isManagedProjectBootstrap, } from "@tutti/shared/schemas/internal";
 export class RelayHostControlClientError extends Error {
     code;
     retryable;
@@ -91,6 +91,12 @@ function createRegisterPayload(options) {
             account_handoff_token: options.accountHandoffToken,
         };
     }
+    if (options.managedBootstrap !== undefined) {
+        if (options.accountHandoffToken !== undefined ||
+            !isManagedProjectBootstrap(options.managedBootstrap))
+            throw new RelayHostControlClientError("relay_registration_failed", "Managed Host authority input is invalid", false);
+        payload.managed_bootstrap = options.managedBootstrap;
+    }
     return payload;
 }
 function createRefreshJoinTokenPayload(options) {
@@ -199,6 +205,10 @@ function assertRegistrationResponse(value) {
         throw new RelayHostControlClientError("relay_registration_failed", "Relay host registration response is invalid", false);
     }
     const dispositionKind = stringField(value.disposition, "kind");
+    if (isRecord(value.result) &&
+        value.result.managed_authority !== undefined &&
+        !isHostDelegationProjection(value.result.managed_authority))
+        throw new RelayHostControlClientError("relay_registration_failed", "Managed Host authority response is invalid", false);
     if (dispositionKind !== "registered" && dispositionKind !== "interrupted") {
         throw new RelayHostControlClientError("relay_registration_failed", "Relay host registration disposition is invalid", false);
     }
@@ -249,6 +259,7 @@ export async function registerRelayHostConnection(options) {
     const fetchImpl = options.fetch ?? fetch;
     const commandId = options.commandId ?? createIdempotencyKey();
     const issuedAt = options.issuedAt ?? new Date();
+    const payload = createRegisterPayload(options);
     const response = await (async () => {
         try {
             return await fetchWithTimeout(fetchImpl, registrationUrl(options.relayUrl), {
@@ -260,7 +271,7 @@ export async function registerRelayHostConnection(options) {
                 body: JSON.stringify({
                     command_id: commandId,
                     issued_at: issuedAt.toISOString(),
-                    payload: createRegisterPayload(options),
+                    payload,
                 }),
             }, options.timeoutMs ?? DEFAULT_TIMEOUT_MS, options.signal);
         }
@@ -278,7 +289,19 @@ export async function registerRelayHostConnection(options) {
         }
         throw new RelayHostControlClientError(response.status >= 500 ? "relay_unavailable" : "relay_registration_failed", `Relay host registration failed with HTTP ${response.status}`, response.status >= 500, response.status, relayErrorCode);
     }
-    return assertRegistrationResponse(await response.json());
+    const result = assertRegistrationResponse(await response.json());
+    if (options.managedBootstrap !== undefined &&
+        result.result !== undefined &&
+        result.result.managed_authority === undefined)
+        throw new RelayHostControlClientError("relay_registration_failed", "Relay does not support managed Host authority", false);
+    if (options.managedBootstrap !== undefined &&
+        result.result?.managed_authority !== undefined &&
+        (result.result.managed_authority.installation_ref !==
+            options.managedBootstrap.installation_ref ||
+            result.result.managed_authority.relay_project_ref !==
+                result.result.relay_project?.relay_project_ref))
+        throw new RelayHostControlClientError("relay_registration_failed", "Managed Host authority response does not match registration", false);
+    return result;
 }
 export async function refreshRelayJoinToken(options) {
     const fetchImpl = options.fetch ?? fetch;

package/node_modules/@tutti/relay-client/dist/index.d.ts

@@ -1,4 +1,5 @@
 export * from "./host-control.js";
 export * from "./tunnel.js";
 export * from "./external-references.js";
+export * from "./project-authority.js";
 //# sourceMappingURL=index.d.ts.map

package/node_modules/@tutti/relay-client/dist/index.js

@@ -1,4 +1,5 @@
 export * from "./host-control.js";
 export * from "./tunnel.js";
 export * from "./external-references.js";
+export * from "./project-authority.js";
 //# sourceMappingURL=index.js.map