@xfey/tutti 0.1.120 → 0.1.122

package/dist/server-shell/managed-access/runtime.js

@@ -34,7 +34,7 @@ export class NativeManagedRuntime {
                     },
                     ...(options.fetchImpl === undefined ? {} : { fetchImpl: options.fetchImpl }),
                 });
-                if (authority.tier !== journal.tier ||
+                if (authority.delegation_ref !== journal.authority.delegation_ref ||
                     authority.expires_at <= Math.floor(this.now().getTime() / 1000))
                     throw new ManagedLocalStateError("managed_runtime_authority_mismatch");
                 return authority;
@@ -65,8 +65,7 @@ export class NativeManagedRuntime {
                 if (row.project_id !== this.options.projectId ||
                     row.owner.kind !== owner.kind ||
                     row.owner.ref !== owner.ref ||
-                    row.installation_ref !== authority.installation_ref ||
-                    row.tier !== authority.tier)
+                    row.installation_ref !== authority.installation_ref)
                     throw new ManagedLocalStateError("managed_model_session_scope_changed");
                 if (row.delegation_ref !== authority.delegation_ref ||
                     row.grant_ref !== authority.grant_ref) {
@@ -85,15 +84,16 @@ export class NativeManagedRuntime {
                     this.files.write(`${name}.json`, renewed);
                     return renewed;
                 }
+                if (typeof saved === "object" && "version" in saved && saved.version === 1)
+                    this.files.write(`${name}.json`, row);
                 return row;
             }
             const row = {
-                version: 1,
+                version: 2,
                 project_id: this.options.projectId,
                 delegation_ref: authority.delegation_ref,
                 grant_ref: authority.grant_ref,
                 installation_ref: authority.installation_ref,
-                tier: authority.tier,
                 owner,
                 session_ref: createPrefixedId(ID_PREFIXES.managedSession),
                 state: "ready",
@@ -111,7 +111,6 @@ export class NativeManagedRuntime {
     async pin(name, row) {
         const pin = await this.client.pin(row.session_ref, row.route_ref);
         if (pin.session_ref !== row.session_ref ||
-            pin.tier !== row.tier ||
             (row.route_ref !== undefined && pin.route_ref !== row.route_ref) ||
             (row.provider_identity !== undefined &&
                 (row.provider_identity.model !== pin.provider.model ||

package/dist/server-shell/managed-access/state.d.ts

@@ -22,7 +22,6 @@ export declare class NativeManagedState {
         displayName: string;
         description?: string;
         surface: "standalone" | "feishu";
-        tier: "light" | "high" | "max";
         requestRef?: string;
         projectId?: string;
         existing?: {
@@ -33,6 +32,7 @@ export declare class NativeManagedState {
         now?: Date;
     }): CreationJournal;
     read(requestRef: string): CreationJournal;
+    private readJournal;
     attachProject(requestRef: string, now?: Date): CreationJournal;
     project(projectId: string): CreationJournal;
     preparationBody(requestRef: string): PrepareProjectAuthority;
@@ -42,7 +42,6 @@ export declare class NativeManagedState {
         project_id: string;
         installation_ref: string;
         surface: string;
-        tier: string;
         expires_at: string;
     }, now?: Date): CreationJournal;
     validation(requestRef: string, outcome: "validated" | "validation_unknown" | "validation_failed"): CreationJournal;

package/dist/server-shell/managed-access/state.js

@@ -85,12 +85,11 @@ export class NativeManagedState {
         return this.files.transaction(() => {
             const saved = this.files.read(name);
             if (saved !== null) {
-                const record = parseJournal(saved, this.origin, requestRef);
+                const record = this.readJournal(requestRef);
                 if (record.workspace_root !== workspace ||
                     record.display_name !== options.displayName ||
                     record.description !== options.description ||
                     record.surface !== options.surface ||
-                    record.tier !== options.tier ||
                     (options.projectId !== undefined && record.project_id !== options.projectId) ||
                     record.existing_relay_project_ref !== options.existing?.relayProjectRef ||
                     record.previous_request_ref !== options.existing?.previousRequestRef ||
@@ -101,7 +100,7 @@ export class NativeManagedState {
                 return record;
             }
             const record = parseJournal({
-                version: 1,
+                version: 2,
                 request_ref: requestRef,
                 project_id: options.projectId ?? createProjectId(),
                 relay_origin: this.origin,
@@ -110,7 +109,6 @@ export class NativeManagedState {
                 display_name: options.displayName,
                 ...(options.description === undefined ? {} : { description: options.description }),
                 surface: options.surface,
-                tier: options.tier,
                 ...(options.existing === undefined
                     ? {}
                     : {
@@ -130,12 +128,22 @@ export class NativeManagedState {
         });
     }
     read(requestRef) {
-        return this.files.transaction(() => parseJournal(this.files.read(this.journalName(requestRef)), this.origin, requestRef));
+        return this.files.transaction(() => this.readJournal(requestRef));
+    }
+    // Called only inside the private-store mutex. Upgrade metadata atomically;
+    // never rotate proofs, extend consent or restore revoked runtime credentials.
+    readJournal(requestRef) {
+        const name = this.journalName(requestRef);
+        const saved = this.files.read(name);
+        const row = parseJournal(saved, this.origin, requestRef);
+        if (saved && typeof saved === "object" && "version" in saved && saved.version === 1)
+            this.files.write(name, row);
+        return row;
     }
     attachProject(requestRef, now = new Date()) {
         this.bootstrap(requestRef, now);
         return this.files.transaction(() => {
-            const row = parseJournal(this.files.read(this.journalName(requestRef)), this.origin, requestRef);
+            const row = this.readJournal(requestRef);
             const name = `project-${row.project_id}.json`;
             const old = this.files.read(name);
             if (old !== null &&
@@ -156,7 +164,7 @@ export class NativeManagedState {
             const pointer = this.files.read(`project-${projectId}.json`);
             if (!Value.Check(NativeProjectPointerSchema, pointer) || pointer.project_id !== projectId)
                 throw new ManagedLocalStateError("managed_project_binding_invalid");
-            const row = parseJournal(this.files.read(this.journalName(pointer.request_ref)), this.origin, pointer.request_ref);
+            const row = this.readJournal(pointer.request_ref);
             if (row.project_id !== projectId || (row.state !== "validated" && row.state !== "registered"))
                 throw new ManagedLocalStateError("managed_project_binding_invalid");
             return row;
@@ -170,7 +178,6 @@ export class NativeManagedState {
             request_ref: row.request_ref,
             project_id: row.project_id,
             surface: row.surface,
-            tier: row.tier,
             ...(row.existing_relay_project_ref === undefined
                 ? {}
                 : { existing_relay_project_ref: row.existing_relay_project_ref }),
@@ -201,7 +208,6 @@ export class NativeManagedState {
             if (row.project_id !== receipt.project_id ||
                 row.installation_ref !== receipt.installation_ref ||
                 row.surface !== receipt.surface ||
-                row.tier !== receipt.tier ||
                 !Number.isFinite(Date.parse(receipt.expires_at)) ||
                 Date.parse(receipt.expires_at) > Date.parse(row.expires_at))
                 throw new ManagedLocalStateError("managed_preparation_mismatch");
@@ -253,7 +259,6 @@ export class NativeManagedState {
         return this.update(requestRef, (row) => {
             if (!Value.Check(HostDelegationProjectionSchema, authority) ||
                 authority.installation_ref !== row.installation_ref ||
-                authority.tier !== row.tier ||
                 (row.existing_relay_project_ref !== undefined &&
                     authority.relay_project_ref !== row.existing_relay_project_ref))
                 throw new ManagedLocalStateError("managed_registration_mismatch");

package/dist/server-shell/managed-access/transport.d.ts

@@ -12,7 +12,6 @@ export declare function reconcileNativePreparation(options: {
         grant_ref: string;
         installation_ref: string;
         relay_project_ref: string;
-        tier: "light" | "high" | "max";
         expires_at: null;
         funding_kind: "trial";
         model_access: "runtime_authority_required" | "not_enabled";
@@ -24,7 +23,6 @@ export declare function reconcileNativePreparation(options: {
         state: "revoked" | "expired" | "prepared" | "activated";
         installation_ref: string;
         surface: "standalone" | "feishu";
-        tier: "light" | "high" | "max";
         expires_at: string;
         project_id: string;
         creation_ref: string;
@@ -38,7 +36,6 @@ export declare function validateNativePreparation(options: {
 }): Promise<{
     state: "failed" | "unknown" | "started" | "succeeded";
     installation_ref: string;
-    tier: "light" | "high" | "max";
     reason_code: "validation_started" | "validation_succeeded" | "validation_route_unavailable" | "validation_http_rejected" | "validation_response_invalid" | "validation_transport_unknown" | "validation_interrupted";
     project_id: string;
     creation_ref: string;

package/dist/server-shell/managed-access/transport.js

@@ -25,7 +25,8 @@ export async function validateNativePreparation(options) {
     const row = options.state.read(options.requestRef);
     if (!("creation_ref" in row) ||
         row.creation_ref !== result.creation_ref ||
-        row.tier !== result.tier)
+        row.project_id !== result.project_id ||
+        row.installation_ref !== result.installation_ref)
         throw new ManagedLocalStateError("managed_validation_mismatch");
     if (result.state === "succeeded")
         options.state.validation(options.requestRef, "validated");

package/node_modules/@tutti/relay-client/dist/project-authority.d.ts

@@ -1,4 +1,4 @@
-import { type HostDelegationStatusBody, type NativeCreationProof } from "@tutti/shared/schemas/internal";
+import { type ConsoleProjectAuthority, type HostDelegationStatusBody, type NativeCreationProof } from "@tutti/shared/schemas/internal";
 export declare class NativeAuthorityTransportError extends Error {
     readonly code: string;
     readonly status?: number | undefined;
@@ -10,6 +10,17 @@ type Transport = {
     fetchImpl?: typeof fetch;
     signal?: AbortSignal;
 };
+export declare function prepareNativeConsoleAuthority(options: Transport & {
+    body: ConsoleProjectAuthority;
+}): Promise<{
+    relay_project_ref?: string;
+    expires_at: string;
+    state: "expired" | "prepared" | "activated" | "revoked";
+    installation_ref: string;
+    project_id: string;
+    surface: "standalone" | "feishu";
+    creation_ref: string;
+}>;
 export declare function validateNativeCreationAuthority(options: Transport & {
     body: NativeCreationProof;
 }): Promise<{
@@ -17,7 +28,6 @@ export declare function validateNativeCreationAuthority(options: Transport & {
     state: "failed" | "started" | "succeeded" | "unknown";
     installation_ref: string;
     project_id: string;
-    tier: "light" | "high" | "max";
     creation_ref: string;
     route_ref: string;
     http_status: number | null;
@@ -31,7 +41,6 @@ export declare function readNativeCreationAuthority(options: Transport & {
         relay_project_ref: string;
         installation_ref: string;
         funding_kind: "trial";
-        tier: "light" | "high" | "max";
         delegation_ref: string;
         grant_ref: string;
         model_access: "runtime_authority_required" | "not_enabled";
@@ -44,7 +53,6 @@ export declare function readNativeCreationAuthority(options: Transport & {
         state: "expired" | "prepared" | "activated" | "revoked";
         installation_ref: string;
         project_id: string;
-        tier: "light" | "high" | "max";
         surface: "standalone" | "feishu";
         creation_ref: string;
     };
@@ -57,7 +65,6 @@ export declare function readNativeHostAuthority(options: Transport & {
     relay_project_ref: string;
     installation_ref: string;
     funding_kind: "trial";
-    tier: "light" | "high" | "max";
     delegation_ref: string;
     grant_ref: string;
     model_access: "runtime_authority_required" | "not_enabled";
@@ -67,7 +74,6 @@ export declare function authorizeNativeModelRuntime(options: Transport & {
 }): Promise<{
     expires_at: number;
     authorization: string;
-    tier: "light" | "high" | "max";
     delegation_ref: string;
     control_origin: string;
 }>;

package/node_modules/@tutti/relay-client/dist/project-authority.js

@@ -1,5 +1,5 @@
 import { Value } from "@sinclair/typebox/value";
-import { HostDelegationProjectionSchema, HostDelegationStatusBodySchema, NativeCreationProofSchema, NativeCreationStatusSchema, CreationValidationResultSchema, NativeRuntimeAuthorizationSchema, } from "@tutti/shared/schemas/internal";
+import { HostDelegationProjectionSchema, HostDelegationStatusBodySchema, NativeCreationProofSchema, NativeCreationStatusSchema, CreationValidationResultSchema, NativeRuntimeAuthorizationSchema, ConsoleProjectAuthoritySchema, ManagedCreationProjectionSchema, } from "@tutti/shared/schemas/internal";
 export class NativeAuthorityTransportError extends Error {
     code;
     status;
@@ -13,6 +13,15 @@ export class NativeAuthorityTransportError extends Error {
     }
 }
 const safeReasons = new Set([
+    "console_setup_access_invalid",
+    "project_already_registered",
+    "project_authority_conflict",
+    "command_replay_mismatch",
+    "creation_limit_reached",
+    "project_creation_pending",
+    "installation_identity_conflict",
+    "host_delegation_already_active",
+    "host_delegation_revocation_pending",
     "account_session_required",
     "account_authority_inactive",
     "project_owner_required",
@@ -95,6 +104,16 @@ async function request(options, path, body, schema, timeoutMs = 15_000) {
             : new NativeAuthorityTransportError("managed_authority_unavailable");
     }
 }
+export async function prepareNativeConsoleAuthority(options) {
+    if (!Value.Check(ConsoleProjectAuthoritySchema, options.body))
+        throw new NativeAuthorityTransportError("managed_authority_invalid_request");
+    const result = await request(options, "/host-control/v1/managed-authority/prepare", options.body, ManagedCreationProjectionSchema);
+    if (result.project_id !== options.body.preparation.project_id ||
+        result.surface !== options.body.preparation.surface ||
+        result.installation_ref !== options.body.preparation.installation_ref)
+        throw new NativeAuthorityTransportError("managed_authority_invalid_response");
+    return result;
+}
 export async function validateNativeCreationAuthority(options) {
     if (!Value.Check(NativeCreationProofSchema, options.body))
         throw new NativeAuthorityTransportError("managed_authority_invalid_request");
@@ -113,8 +132,7 @@ export async function readNativeCreationAuthority(options) {
         result.creation.installation_ref !== options.body.installation_ref ||
         (result.creation.state === "activated") !== (result.authority !== undefined) ||
         (result.authority !== undefined &&
-            (result.authority.tier !== result.creation.tier ||
-                result.authority.installation_ref !== options.body.installation_ref ||
+            (result.authority.installation_ref !== options.body.installation_ref ||
                 result.authority.relay_project_ref !== result.creation.relay_project_ref)))
         throw new NativeAuthorityTransportError("managed_authority_invalid_response");
     return result;

package/node_modules/@tutti/shared/dist/schemas/api/local-console-account-handoffs.d.ts

@@ -2,6 +2,7 @@ import type { Static } from "@sinclair/typebox";
 export declare const LOCAL_CONSOLE_ACCOUNT_HANDOFF_TOKEN_MIN_LENGTH = 32;
 export declare const LOCAL_CONSOLE_ACCOUNT_HANDOFF_TOKEN_MAX_LENGTH = 128;
 export declare const RegisterLocalConsoleAccountHandoffBodySchema: import("@sinclair/typebox").TObject<{
+    setup_access: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TLiteral<true>>;
     handoff_token: import("@sinclair/typebox").TString;
 }>;
 export declare const RegisterLocalConsoleAccountHandoffResponseSchema: import("@sinclair/typebox").TObject<{

package/node_modules/@tutti/shared/dist/schemas/api/local-console-account-handoffs.js

@@ -3,6 +3,7 @@ import { IsoDateTimeStringSchema } from "../domain/index.js";
 export const LOCAL_CONSOLE_ACCOUNT_HANDOFF_TOKEN_MIN_LENGTH = 32;
 export const LOCAL_CONSOLE_ACCOUNT_HANDOFF_TOKEN_MAX_LENGTH = 128;
 export const RegisterLocalConsoleAccountHandoffBodySchema = Type.Object({
+    setup_access: Type.Optional(Type.Literal(true)),
     handoff_token: Type.String({
         minLength: LOCAL_CONSOLE_ACCOUNT_HANDOFF_TOKEN_MIN_LENGTH,
         maxLength: LOCAL_CONSOLE_ACCOUNT_HANDOFF_TOKEN_MAX_LENGTH,

package/node_modules/@tutti/shared/dist/schemas/api/managed-account.d.ts

@@ -18,7 +18,6 @@ export declare const ManagedAccountOverviewSchema: import("@sinclair/typebox").T
         relay_project_ref: import("@sinclair/typebox").TString;
         project_name: import("@sinclair/typebox").TString;
         surface: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"standalone">, import("@sinclair/typebox").TLiteral<"feishu">]>;
-        tier: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"light">, import("@sinclair/typebox").TLiteral<"high">, import("@sinclair/typebox").TLiteral<"max">]>;
         created_at: import("@sinclair/typebox").TString;
         state: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"active">, import("@sinclair/typebox").TLiteral<"revoked">]>;
         downstream_keys: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"not_requested">, import("@sinclair/typebox").TLiteral<"pending">, import("@sinclair/typebox").TLiteral<"confirmed">]>;

package/node_modules/@tutti/shared/dist/schemas/api/managed-account.js

@@ -21,7 +21,6 @@ export const ManagedAccountOverviewSchema = Type.Object({
         relay_project_ref: RelayProjectRefSchema,
         project_name: Type.String(),
         surface: Type.Union([Type.Literal("standalone"), Type.Literal("feishu")]),
-        tier: Type.Union([Type.Literal("light"), Type.Literal("high"), Type.Literal("max")]),
         created_at: timestamp,
         state: Type.Union([Type.Literal("active"), Type.Literal("revoked")]),
         downstream_keys: Type.Union([

package/node_modules/@tutti/shared/dist/schemas/api/provider-config.d.ts

@@ -41,7 +41,6 @@ export declare const ProviderConfigProjectionSchema: import("@sinclair/typebox")
 }>, import("@sinclair/typebox").TObject<{
     status: import("@sinclair/typebox").TLiteral<"managed">;
     funding_kind: import("@sinclair/typebox").TLiteral<"trial">;
-    tier: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"light">, import("@sinclair/typebox").TLiteral<"high">, import("@sinclair/typebox").TLiteral<"max">]>;
 }>, import("@sinclair/typebox").TObject<{
     status: import("@sinclair/typebox").TLiteral<"configured">;
     provider: import("@sinclair/typebox").TLiteral<"openai">;

package/node_modules/@tutti/shared/dist/schemas/api/provider-config.js

@@ -73,7 +73,6 @@ export const ProviderConfigProjectionSchema = Type.Union([
     Type.Object({
         status: Type.Literal("managed"),
         funding_kind: Type.Literal("trial"),
-        tier: Type.Union([Type.Literal("light"), Type.Literal("high"), Type.Literal("max")]),
     }, { additionalProperties: false }),
     Type.Object({
         status: Type.Literal("configured"),

package/node_modules/@tutti/shared/dist/schemas/api/runtime-events.d.ts

@@ -540,7 +540,6 @@ export declare const ProviderConfigChangedEventPayloadSchema: import("@sinclair/
     }>, import("@sinclair/typebox").TObject<{
         status: import("@sinclair/typebox").TLiteral<"managed">;
         funding_kind: import("@sinclair/typebox").TLiteral<"trial">;
-        tier: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"light">, import("@sinclair/typebox").TLiteral<"high">, import("@sinclair/typebox").TLiteral<"max">]>;
     }>, import("@sinclair/typebox").TObject<{
         status: import("@sinclair/typebox").TLiteral<"configured">;
         provider: import("@sinclair/typebox").TLiteral<"openai">;

package/node_modules/@tutti/shared/dist/schemas/internal/creation-validation.d.ts

@@ -1,13 +1,12 @@
 import { type Static } from "@sinclair/typebox";
 export declare const CreationValidationAuthoritySchema: import("@sinclair/typebox").TObject<{
-    version: import("@sinclair/typebox").TLiteral<1>;
+    version: import("@sinclair/typebox").TLiteral<2>;
     audience: import("@sinclair/typebox").TLiteral<"tutti-creation-validation">;
     issuer: import("@sinclair/typebox").TString;
     account_ref: import("@sinclair/typebox").TString;
     creation_ref: import("@sinclair/typebox").TString;
     project_id: import("@sinclair/typebox").TString;
     installation_ref: import("@sinclair/typebox").TString;
-    tier: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"light">, import("@sinclair/typebox").TLiteral<"high">, import("@sinclair/typebox").TLiteral<"max">]>;
     creation_expires_at: import("@sinclair/typebox").TInteger;
     nonce: import("@sinclair/typebox").TString;
     issued_at: import("@sinclair/typebox").TInteger;
@@ -18,7 +17,6 @@ export declare const CreationValidationResultSchema: import("@sinclair/typebox")
     creation_ref: import("@sinclair/typebox").TString;
     project_id: import("@sinclair/typebox").TString;
     installation_ref: import("@sinclair/typebox").TString;
-    tier: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"light">, import("@sinclair/typebox").TLiteral<"high">, import("@sinclair/typebox").TLiteral<"max">]>;
     route_ref: import("@sinclair/typebox").TString;
     state: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"started">, import("@sinclair/typebox").TLiteral<"succeeded">, import("@sinclair/typebox").TLiteral<"failed">, import("@sinclair/typebox").TLiteral<"unknown">]>;
     reason_code: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"validation_started">, import("@sinclair/typebox").TLiteral<"validation_succeeded">, import("@sinclair/typebox").TLiteral<"validation_route_unavailable">, import("@sinclair/typebox").TLiteral<"validation_http_rejected">, import("@sinclair/typebox").TLiteral<"validation_response_invalid">, import("@sinclair/typebox").TLiteral<"validation_transport_unknown">, import("@sinclair/typebox").TLiteral<"validation_interrupted">]>;

package/node_modules/@tutti/shared/dist/schemas/internal/creation-validation.js

@@ -1,16 +1,15 @@
 import { Type } from "@sinclair/typebox";
 import { IdempotencyKeySchema, ProjectIdSchema, RelayAccountRefSchema } from "../domain/index.js";
-import { HostInstallationRefSchema, ManagedCreationRefSchema, ManagedTierSchema, } from "./project-authority.js";
+import { HostInstallationRefSchema, ManagedCreationRefSchema } from "./project-authority.js";
 // A fixed platform-funded connectivity probe, never a general model/key capability.
 export const CreationValidationAuthoritySchema = Type.Object({
-    version: Type.Literal(1),
+    version: Type.Literal(2),
     audience: Type.Literal("tutti-creation-validation"),
     issuer: Type.String({ minLength: 1, maxLength: 200 }),
     account_ref: RelayAccountRefSchema,
     creation_ref: ManagedCreationRefSchema,
     project_id: ProjectIdSchema,
     installation_ref: HostInstallationRefSchema,
-    tier: ManagedTierSchema,
     creation_expires_at: Type.Integer({ minimum: 0 }),
     nonce: IdempotencyKeySchema,
     issued_at: Type.Integer({ minimum: 0 }),
@@ -20,7 +19,6 @@ export const CreationValidationResultSchema = Type.Object({
     creation_ref: ManagedCreationRefSchema,
     project_id: ProjectIdSchema,
     installation_ref: HostInstallationRefSchema,
-    tier: ManagedTierSchema,
     route_ref: Type.String({ pattern: "^[a-z0-9][a-z0-9-]{1,60}$" }),
     state: Type.Union([
         Type.Literal("started"),

package/node_modules/@tutti/shared/dist/schemas/internal/managed-runtime.d.ts

@@ -8,7 +8,6 @@ export declare const ManagedDelegationScopeFields: {
 };
 export declare const ManagedRuntimeAuthoritySchema: import("@sinclair/typebox").TObject<{
     funding_kind: import("@sinclair/typebox").TLiteral<"trial">;
-    tier: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"light">, import("@sinclair/typebox").TLiteral<"high">, import("@sinclair/typebox").TLiteral<"max">]>;
     account_ref: import("@sinclair/typebox").TString;
     relay_project_ref: import("@sinclair/typebox").TString;
     delegation_ref: import("@sinclair/typebox").TString;
@@ -18,7 +17,7 @@ export declare const ManagedRuntimeAuthoritySchema: import("@sinclair/typebox").
     nonce: import("@sinclair/typebox").TString;
     issued_at: import("@sinclair/typebox").TInteger;
     expires_at: import("@sinclair/typebox").TInteger;
-    version: import("@sinclair/typebox").TLiteral<2>;
+    version: import("@sinclair/typebox").TLiteral<3>;
     audience: import("@sinclair/typebox").TLiteral<"tutti-managed-runtime">;
 }>;
 export type ManagedRuntimeAuthority = Static<typeof ManagedRuntimeAuthoritySchema>;
@@ -41,7 +40,6 @@ export declare const NativeRuntimeAuthorizationSchema: import("@sinclair/typebox
     expires_at: import("@sinclair/typebox").TInteger;
     control_origin: import("@sinclair/typebox").TString;
     delegation_ref: import("@sinclair/typebox").TString;
-    tier: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"light">, import("@sinclair/typebox").TLiteral<"high">, import("@sinclair/typebox").TLiteral<"max">]>;
 }>;
 export declare const ManagedRuntimeSessionRefSchema: import("@sinclair/typebox").TString;
 export declare const ManagedRuntimeCredentialRefSchema: import("@sinclair/typebox").TString;
@@ -53,7 +51,6 @@ export declare const ManagedProviderIdentitySchema: import("@sinclair/typebox").
 export declare const ManagedSessionResultSchema: import("@sinclair/typebox").TObject<{
     session_ref: import("@sinclair/typebox").TString;
     route_ref: import("@sinclair/typebox").TString;
-    tier: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"light">, import("@sinclair/typebox").TLiteral<"high">, import("@sinclair/typebox").TLiteral<"max">]>;
     disposition: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"created">, import("@sinclair/typebox").TLiteral<"existing">]>;
     provider: import("@sinclair/typebox").TObject<{
         base_url: import("@sinclair/typebox").TString;

package/node_modules/@tutti/shared/dist/schemas/internal/managed-runtime.js

@@ -1,7 +1,7 @@
 import { Type } from "@sinclair/typebox";
 import { ID_PREFIXES, ULID_BODY_PATTERN } from "../../ids/index.js";
 import { RelayAccountRefSchema, RelayProjectRefSchema, IdempotencyKeySchema, } from "../domain/index.js";
-import { HostDelegationRefSchema, HostInstallationRefSchema, ProjectModelGrantRefSchema, ManagedTierSchema, } from "./project-authority.js";
+import { HostDelegationRefSchema, HostInstallationRefSchema, ProjectModelGrantRefSchema, } from "./project-authority.js";
 export const ManagedDelegationScopeFields = {
     account_ref: RelayAccountRefSchema,
     relay_project_ref: RelayProjectRefSchema,
@@ -16,12 +16,11 @@ const CapabilityFields = {
     expires_at: Type.Integer({ minimum: 0 }),
 };
 export const ManagedRuntimeAuthoritySchema = Type.Object({
-    version: Type.Literal(2),
+    version: Type.Literal(3),
     audience: Type.Literal("tutti-managed-runtime"),
     ...CapabilityFields,
     ...ManagedDelegationScopeFields,
     funding_kind: Type.Literal("trial"),
-    tier: ManagedTierSchema,
 }, { additionalProperties: false });
 // Operator/service control only; never issued to native or browser callers.
 export const ManagedRevocationAuthoritySchema = Type.Object({
@@ -32,13 +31,12 @@ export const ManagedRevocationAuthoritySchema = Type.Object({
 }, { additionalProperties: false });
 export const NativeRuntimeAuthorizationSchema = Type.Object({
     authorization: Type.String({
-        pattern: "^tma2\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]{86}$",
+        pattern: "^tma3\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]{86}$",
         maxLength: 3500,
     }),
     expires_at: Type.Integer({ minimum: 0 }),
     control_origin: Type.String({ minLength: 1, maxLength: 500 }),
     delegation_ref: HostDelegationRefSchema,
-    tier: ManagedTierSchema,
 }, { additionalProperties: false });
 const managedId = (prefix) => Type.String({ pattern: `^${prefix}${ULID_BODY_PATTERN}$` });
 export const ManagedRuntimeSessionRefSchema = managedId(ID_PREFIXES.managedSession);
@@ -51,7 +49,6 @@ export const ManagedProviderIdentitySchema = Type.Object({
 export const ManagedSessionResultSchema = Type.Object({
     session_ref: ManagedRuntimeSessionRefSchema,
     route_ref: ManagedRouteRefSchema,
-    tier: ManagedTierSchema,
     disposition: Type.Union([Type.Literal("created"), Type.Literal("existing")]),
     provider: ManagedProviderIdentitySchema,
 }, { additionalProperties: false });

package/node_modules/@tutti/shared/dist/schemas/internal/project-authority.d.ts

@@ -7,7 +7,6 @@ export declare const AuthoritySecretSchema: import("@sinclair/typebox").TString;
 export declare const AuthoritySecretHashSchema: import("@sinclair/typebox").TString;
 export declare const AuthorityTimestampSchema: import("@sinclair/typebox").TString;
 export declare function isAuthorityTimestamp(value: string): boolean;
-export declare const ManagedTierSchema: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"light">, import("@sinclair/typebox").TLiteral<"high">, import("@sinclair/typebox").TLiteral<"max">]>;
 export declare const PROJECT_TRIAL_POLICY = "trial-project-v1";
 export declare const PrepareProjectAuthoritySchema: import("@sinclair/typebox").TObject<{
     request_ref: import("@sinclair/typebox").TString;
@@ -18,11 +17,26 @@ export declare const PrepareProjectAuthoritySchema: import("@sinclair/typebox").
     installation_secret_hash: import("@sinclair/typebox").TString;
     handoff_token_hash: import("@sinclair/typebox").TString;
     host_registration_secret_hash: import("@sinclair/typebox").TString;
-    tier: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"light">, import("@sinclair/typebox").TLiteral<"high">, import("@sinclair/typebox").TLiteral<"max">]>;
     trial_consent: import("@sinclair/typebox").TLiteral<"trial-project-v1">;
     expires_before: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
 }>;
 export type PrepareProjectAuthority = Static<typeof PrepareProjectAuthoritySchema>;
+export declare const ConsoleProjectAuthoritySchema: import("@sinclair/typebox").TObject<{
+    console_token: import("@sinclair/typebox").TString;
+    preparation: import("@sinclair/typebox").TObject<{
+        request_ref: import("@sinclair/typebox").TString;
+        project_id: import("@sinclair/typebox").TString;
+        surface: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"standalone">, import("@sinclair/typebox").TLiteral<"feishu">]>;
+        existing_relay_project_ref: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        installation_ref: import("@sinclair/typebox").TString;
+        installation_secret_hash: import("@sinclair/typebox").TString;
+        handoff_token_hash: import("@sinclair/typebox").TString;
+        host_registration_secret_hash: import("@sinclair/typebox").TString;
+        trial_consent: import("@sinclair/typebox").TLiteral<"trial-project-v1">;
+        expires_before: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    }>;
+}>;
+export type ConsoleProjectAuthority = Static<typeof ConsoleProjectAuthoritySchema>;
 export declare const ManagedProjectBootstrapSchema: import("@sinclair/typebox").TObject<{
     kind: import("@sinclair/typebox").TLiteral<"managed_project_authority_v2">;
     creation_ref: import("@sinclair/typebox").TString;
@@ -45,7 +59,6 @@ export declare const HostDelegationProjectionSchema: import("@sinclair/typebox")
     grant_ref: import("@sinclair/typebox").TString;
     relay_project_ref: import("@sinclair/typebox").TString;
     installation_ref: import("@sinclair/typebox").TString;
-    tier: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"light">, import("@sinclair/typebox").TLiteral<"high">, import("@sinclair/typebox").TLiteral<"max">]>;
     funding_kind: import("@sinclair/typebox").TLiteral<"trial">;
     expires_at: import("@sinclair/typebox").TNull;
     state: import("@sinclair/typebox").TLiteral<"active">;
@@ -57,7 +70,6 @@ export declare const ManagedCreationProjectionSchema: import("@sinclair/typebox"
     project_id: import("@sinclair/typebox").TString;
     surface: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"standalone">, import("@sinclair/typebox").TLiteral<"feishu">]>;
     installation_ref: import("@sinclair/typebox").TString;
-    tier: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"light">, import("@sinclair/typebox").TLiteral<"high">, import("@sinclair/typebox").TLiteral<"max">]>;
     expires_at: import("@sinclair/typebox").TString;
     state: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"prepared">, import("@sinclair/typebox").TLiteral<"activated">, import("@sinclair/typebox").TLiteral<"expired">, import("@sinclair/typebox").TLiteral<"revoked">]>;
     relay_project_ref: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
@@ -80,7 +92,6 @@ export declare const NativeCreationStatusSchema: import("@sinclair/typebox").TOb
         project_id: import("@sinclair/typebox").TString;
         surface: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"standalone">, import("@sinclair/typebox").TLiteral<"feishu">]>;
         installation_ref: import("@sinclair/typebox").TString;
-        tier: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"light">, import("@sinclair/typebox").TLiteral<"high">, import("@sinclair/typebox").TLiteral<"max">]>;
         expires_at: import("@sinclair/typebox").TString;
         state: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"prepared">, import("@sinclair/typebox").TLiteral<"activated">, import("@sinclair/typebox").TLiteral<"expired">, import("@sinclair/typebox").TLiteral<"revoked">]>;
         relay_project_ref: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
@@ -90,7 +101,6 @@ export declare const NativeCreationStatusSchema: import("@sinclair/typebox").TOb
         grant_ref: import("@sinclair/typebox").TString;
         relay_project_ref: import("@sinclair/typebox").TString;
         installation_ref: import("@sinclair/typebox").TString;
-        tier: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"light">, import("@sinclair/typebox").TLiteral<"high">, import("@sinclair/typebox").TLiteral<"max">]>;
         funding_kind: import("@sinclair/typebox").TLiteral<"trial">;
         expires_at: import("@sinclair/typebox").TNull;
         state: import("@sinclair/typebox").TLiteral<"active">;

package/node_modules/@tutti/shared/dist/schemas/internal/project-authority.js

@@ -16,11 +16,6 @@ export function isAuthorityTimestamp(value) {
     const time = Date.parse(value);
     return Number.isFinite(time) && new Date(time).toISOString() === value;
 }
-export const ManagedTierSchema = Type.Union([
-    Type.Literal("light"),
-    Type.Literal("high"),
-    Type.Literal("max"),
-]);
 export const PROJECT_TRIAL_POLICY = "trial-project-v1";
 // Preparation creates no model credential or project truth. Native secrets never go to Web.
 export const PrepareProjectAuthoritySchema = Type.Object({
@@ -32,10 +27,13 @@ export const PrepareProjectAuthoritySchema = Type.Object({
     installation_secret_hash: AuthoritySecretHashSchema,
     handoff_token_hash: AuthoritySecretHashSchema,
     host_registration_secret_hash: AuthoritySecretHashSchema,
-    tier: ManagedTierSchema,
     trial_consent: Type.Literal(PROJECT_TRIAL_POLICY),
     expires_before: Type.Optional(AuthorityTimestampSchema),
 }, { additionalProperties: false });
+export const ConsoleProjectAuthoritySchema = Type.Object({
+    console_token: AuthoritySecretSchema,
+    preparation: PrepareProjectAuthoritySchema,
+}, { additionalProperties: false });
 export const ManagedProjectBootstrapSchema = Type.Object({
     kind: Type.Literal("managed_project_authority_v2"),
     creation_ref: ManagedCreationRefSchema,
@@ -56,7 +54,6 @@ export const HostDelegationProjectionSchema = Type.Object({
     grant_ref: ProjectModelGrantRefSchema,
     relay_project_ref: RelayProjectRefSchema,
     installation_ref: HostInstallationRefSchema,
-    tier: ManagedTierSchema,
     funding_kind: Type.Literal("trial"),
     expires_at: Type.Null(),
     state: Type.Literal("active"),
@@ -72,7 +69,6 @@ export const ManagedCreationProjectionSchema = Type.Object({
     project_id: ProjectIdSchema,
     surface: Type.Union([Type.Literal("standalone"), Type.Literal("feishu")]),
     installation_ref: HostInstallationRefSchema,
-    tier: ManagedTierSchema,
     expires_at: AuthorityTimestampSchema,
     state: Type.Union([
         Type.Literal("prepared"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xfey/tutti",
-  "version": "0.1.120",
+  "version": "0.1.122",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",