@noodleseed/assistant 1.12.0 → 1.14.0

package/README.md

@@ -195,6 +195,13 @@ export async function POST(request: Request) {
 }
 ```
 
+For a connector that uses `customerEndpoint("customer_api", ...)`, the authenticated backend may also pass
+`routing: { endpoints: { customer_api: account.clusterApiBaseUrl } }`. Resolve the URL from server-owned
+user/account membership after authentication; never accept it from the browser, page context, session
+claims, or tool input. The endpoint key must match the authored name. Noodle validates and stores the route
+only in private short-lived session state, and an omitted route leaves only dependent tools unavailable.
+Mint a new session when the user's selected account or cluster changes.
+
 Then add the framework-neutral element:
 
 ```ts
@@ -298,6 +305,11 @@ Do not also key an ancestor by the whole view object or a callback. Pass the emb
 resolved `"light"` or `"dark"` theme; later changes are published through MCP Apps host context without
 replacing the iframe.
 
+The App document owns its action intent: it calls standard `tools/call` after connecting and never relies on
+native form navigation. If that call needs input or confirmation, the same `client` publishes the normal
+pending interaction part for either managed or customer-owned rendering. The original App call stays pending
+and receives its MCP result after `client.respond(...)`; applications must not retry or translate the click.
+
 Outside React, subscribe to the DOM-free AI SDK `UIMessage` state without registering a custom element or
 touching browser storage:
 

package/dist/{chunk-ZPELSHUP.js → chunk-7WXGZJCA.js}

@@ -2,7 +2,7 @@ import {
   AssistantClientError,
   copyAssistantModelContext,
   createAssistantClient
-} from "./chunk-KRB2SXFD.js";
+} from "./chunk-RITHSCTD.js";
 import {
   _enum,
   _null,
@@ -3142,7 +3142,7 @@ function mountAssistantApp(detail, actions, options = {}) {
         const current = options.getDetail?.() ?? detail;
         void bridge.sendSandboxResourceReady({
           html: current.html,
-          sandbox: "allow-scripts allow-forms",
+          sandbox: "allow-scripts",
           ...current.resourceMeta ?? {}
         });
       };
@@ -6706,7 +6706,6 @@ var AssistantElementEventController = class {
       return;
     }
     if (name === "tool_proposed" || name === "interaction_proposed") {
-      if (!this.#streamKind) return;
       this.#appendToolProposal(
         String(data.id ?? ""),
         String(data.tool ?? "action"),
@@ -6718,7 +6717,6 @@ var AssistantElementEventController = class {
       return;
     }
     if (name === "input_requested" && isRecord(data.requestedSchema)) {
-      if (!this.#streamKind) return;
       this.#appendInputRequest(
         String(data.id ?? ""),
         String(data.message ?? "More information is required"),
@@ -8223,4 +8221,4 @@ export {
 dompurify/dist/purify.es.mjs:
   (*! @license DOMPurify 3.4.11 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.11/LICENSE *)
 */
-//# sourceMappingURL=chunk-ZPELSHUP.js.map
+//# sourceMappingURL=chunk-7WXGZJCA.js.map