[AnthonyRonning]

Uncensored DeepSeek currently depends on feature-flag discovery, and model authorization only distinguishes Free from Paid. Add a richer model-access policy and an inclusive V2 catalog so Research can offer Max/Team upgrades without changing the catalog contract used by existing clients.

Resulting behavior

Chat Completions and Responses use the same authenticated access snapshot throughout model resolution, routing, and execution:

Subscription	Flag off, missing, or unavailable	Explicit flag on
Free / Pro	Upgrade required	Model access granted
Max / Teams	Model access granted	Model access granted

The flag is an access override, not a prerequisite for eligible subscribers. Authentication, guest restrictions, usage admission, feature limits, and context limits remain independent. Other models and Auto alias tiers keep their existing policy.

GET /v2/models/catalog lists uncensored DeepSeek for everyone with an access object containing allowed, eligible_plans, and reason. Research uses that decision to show the required plans and the appropriate popup, including structured inference rejections for stale selections. Catalog requests are scoped to the current account, refreshed on plan changes and selector opening, and discarded after disposal; cached model metadata cannot restore an affirmative grant.

Rollout order

1. Deploy billing #138 first. Its V2 admin usage response adds the effective subscription tier while preserving existing quota fields and decisions.
2. Deploy OpenSecret from this PR next, using the existing backend release/deployment workflow. Verify both inference surfaces enforce the shared policy before rolling out the upsell UI. Merging this monorepo PR or passing CI does not deploy the backend; coordinate any client builds triggered by the merge accordingly.
3. Distribute updated Research clients last. They opt into the new catalog and upgrade metadata. Other frontends can remain on V1 and migrate independently. No feature-flag rollout percentages, account allocations, or production configuration are changed here.

Research intentionally switches to file:../../../sdk in this draft so its build consumes the new TypeScript API. Both SDKs add opt-in V2 catalog methods while retaining the old methods. No SDK publication, SDK version bump, or app release bump is included. If distributing Research with a registry SDK pin, publish a version containing this API and update that pin before distribution.

Backwards compatibility

• /v1/models and /v1/models/catalog retain their existing schemas and visibility. Uncensored DeepSeek stays hidden unless the account's flag is on, and its V1 access label remains pro. Older clients are not silently opted into a new access enum or upsell contract.
• Versioning discovery does not weaken inference authorization: both Chat and Responses apply the same policy regardless of the catalog used by the caller. Existing flagged beta access needs no separate grandfathering list.
• Premium denials retain HTTP 403, the flat error fields, and model_not_available_on_plan, with additive nested model and eligible_plans metadata. Quota errors remain distinct.
• Updated Research falls back to V1 only when a catalog endpoint is absent (404/405), not on authorization errors, malformed policies, or outages.
• With an older billing endpoint, existing Free/Paid behavior is retained. Missing or unknown tier identity cannot grant unflagged Max/Teams access, and API credits never imply a plan. Billing V1 fallback is limited to explicit V2 endpoint absence.
• Catalog API versioning is independent of Transport V1/V2. Existing transport, trust, and signing contracts are unchanged.

Validation

Component	Local result
OpenSecret	Formatting, strict Clippy, 895 tests passed; 34 ignored
Research	Full frontend gates, 1,380 tests passed; 13 existing lint warnings
TypeScript SDK	Formatting/build, 296 tests passed; 3 hosted checks skipped
Rust SDK	Formatting, strict Clippy, docs, 124 tests passed; 1 ignored
Packaging / dependency selection	PR web build and in-tree Rust dependency-wiring check passed

Linked Local OpenSecret, billing, and flags checks also passed:

• Encrypted V1/V2 catalog calls through both SDKs, plus a Max API-key catalog call.
• Unflagged Pro requests rejected by both Chat and Responses with matching 403 upgrade metadata.
• Browser verification of all four cases: Free/Pro upsell with flag off, Max selection with flag off, and Free selection with an explicit flag grant.

Local fixtures were restored and task services stopped. Native app runtimes, live model inference, and production deployment were not exercised. Hosted PR checks are separate from these local results.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[github-actions]

Maple development preview: https://536eedf2.maple-ca8.pages.dev

Commit: 8ad50744509b42cda051d2628ef9b6b955bcdec7

Uses development API, billing, flags and PCR configuration. Cloudflare Access applies.