@noodleseed/assistant 1.25.1 → 1.26.0

package/README.md

@@ -6,10 +6,10 @@ The package exports the canonical `<noodle-assistant>` managed Web Component, th
 `<noodle-app-view>` MCP App host from `@noodleseed/assistant/app-view`, a managed React wrapper and
 `NoodleAppView` adapter from `@noodleseed/assistant/react`, a renderer-free React hook from
 `@noodleseed/assistant/react/client`, a DOM-free client from `@noodleseed/assistant/client`, and the
-backend-only `createAssistantSession` helper from `@noodleseed/assistant/server`. Light, dark, and automatic
-themes work without configuration; the component inherits the deployed MCP server's brand kit while slots,
-methods, events, and semantic CSS variables let a SaaS developer integrate it without depending on internal
-DOM selectors.
+backend-only `createAssistantSession` helper from `@noodleseed/assistant/server`. The component inherits the
+deployed MCP server's brand kit while slots, methods, events, and semantic CSS variables let a SaaS developer
+integrate it without depending on internal DOM selectors. Light, dark, automatic host-page matching, and
+host-page inversion work without replacing conversation or App DOM.
 
 Never pass an embed client secret, model key, MCP token, or raw application session into the browser
 component. Exchange the already-authenticated user from the customer backend and return only the short-lived
@@ -22,7 +22,7 @@ The model configuration and SaaS integration credentials have different owners:
 | Noodle deployment | `ASSISTANT_MODEL_BASE_URL`, `ASSISTANT_MODEL`, `ASSISTANT_MODEL_API_KEY`             | Managed with `noodle variables set` / `noodle secrets set` |
 | Customer backend  | `NOODLE_SERVICE_URL`, `NOODLE_ASSISTANT_CLIENT_ID`, `NOODLE_ASSISTANT_CLIENT_SECRET` | Backend environment or secret manager only                 |
 
-`allowedOrigins` accepts exact origins. Production origins must be HTTPS; plain HTTP is accepted only for
+`access.origins` accepts exact origins. Production origins must be HTTPS; plain HTTP is accepted only for
 loopback development origins such as `http://localhost:3000`. Local MCP authoring remains available without
 login, but an external browser embed needs an active deployment before its deployment-bound client can be
 created.
@@ -55,6 +55,7 @@ structure and treatment in `embeddedAssistant({ presentation })`:
 
 ```ts
 import {
+  authenticatedWebsite,
   embeddedAssistant,
   openAICompatible,
   secret,
@@ -83,19 +84,23 @@ export default server(
         model: variable("ASSISTANT_MODEL"),
         apiKey: secret("ASSISTANT_MODEL_API_KEY"),
       }),
-      allowedOrigins: ["http://localhost:3000", "https://app.acme.example"],
+      access: authenticatedWebsite({
+        origins: ["http://localhost:3000", "https://app.acme.example"],
+      }),
       layout: {
         mode: "floating",
-        position: "bottom-right",
-        panelWidth: 520,
+        position: "bottom-center",
+        panelWidth: 970,
         panelMinHeight: 540,
-        panelMaxHeight: 740,
-        edgeOffset: 24,
+        panelMaxHeight: 1025,
+        edgeOffset: 20,
       },
-      behavior: { showTimestamps: true },
+      theme: "invert",
+      behavior: { showTimestamps: true, showPoweredBy: false },
       labels: {
         welcomeHeading: "How can Acme help?",
         welcomeMessage: "Fast answers from the tools your team already uses.",
+        launcherPlaceholder: "Ask Acme anything",
         composerPlaceholder: "Message Acme Support…",
         sessionReady: "Acme support is online",
       },
@@ -107,6 +112,7 @@ export default server(
           radius: 20,
         },
         launcher: {
+          style: "bubble",
           icon: "chat",
           size: "lg",
           status: "session",
@@ -144,10 +150,15 @@ markup-looking text stays text. `presentation.panel.radius` is a bounded panel-s
 not a second color or identity source. An HTTPS or packaged SVG referenced by `branding.logo`, `branding.mark`, or
 `branding.avatar` is a bounded asset, not inline renderer markup.
 
-If `presentation` is omitted, the rounded Halo-inspired baseline remains: a frosted glass panel with a 24px
-radius, soft elevation, subtle border/motion, medium brand-mark launcher without status or effect,
-undecorated header, pill composer and action controls, and rounded user bubbles with plain assistant messages
-at comfortable width. Partial objects merge with those defaults.
+With UI overrides omitted, the complete managed baseline remains: a bottom-center frosted launcher pill that
+morphs into a prompt input before opening; a 970px outer desktop shell with 20px side padding, 85vh height,
+1025px maximum height, and a 24px panel using the built-in `#F8F8F8` light and `#0C0A09` dark surfaces;
+bottom prompt chips and pill composer; plain assistant messages and 85%-wide user bubbles; a Noodle Seed
+attribution row; and safe-area-aware mobile fullscreen.
+The generic prompt chips ship as defaults, while an authored list—including `[]`—replaces them. Set
+`presentation.launcher.style` to `bubble` for a direct-open 44px launcher. The baseline does not include the
+“Available on ChatGPT” promotion. Partial configuration objects merge with the remaining defaults;
+`presentation.panel.surface: "glass"` remains available when a translucent panel is intentional.
 
 ### Configure and deploy
 
@@ -294,6 +305,22 @@ import "@noodleseed/assistant";
 ></noodle-assistant>
 ```
 
+That single element is the complete managed assistant in React, Vue, Angular, or plain DOM. The
+default pill expands into a prompt first; set `presentation.launcher.style: "bubble"` in `server.ts` when the
+launcher should open the panel directly. Frameworks must treat `noodle-assistant` as a custom element.
+
+When the host needs an authenticated fetch wrapper, assign complex values as properties before connecting
+the element so the first session exchange already carries the application's credentials:
+
+```ts
+import type { NoodleAssistantElement } from "@noodleseed/assistant";
+
+const assistant = document.createElement("noodle-assistant") as NoodleAssistantElement;
+assistant.fetch = authenticatedFetch;
+assistant.sessionEndpoint = "/api/assistant/session";
+document.body.append(assistant);
+```
+
 Or use React:
 
 ```tsx
@@ -641,24 +668,31 @@ noodle-assistant {
 ```
 
 For each matching region or token, precedence is the typed host appearance object, then host-provided slot
-content or a public CSS custom property, then compiled server `presentation`/`branding`, then built-in
-defaults. The public slots are `launcher-icon`,
+content or a public CSS custom property, then the saved environment operator override, compiled server
+`presentation`/`branding`, and built-in defaults. The public slots are `launcher-icon`,
 `header-leading`, `header-actions`, `empty-state`, `composer-leading`, `composer-trailing`, and
 `conversation-footer`; slotted host DOM replaces the renderer fallback for that region. Slots are a trusted
 embedding-page integration API, not a way to put HTML or callbacks in deployment configuration. Internal
 shadow-DOM selectors and classes are not public API.
 
-`theme="auto"` follows the browser's operating-system color preference. When the embedding application has
+The Console **Assistant** tab and `noodle assistant appearance show|apply|reset` manage that environment
+override. Existing embed code does not change: public elements load its non-secret configuration before
+first paint without spending a session mint, while authenticated elements receive it from session exchange.
+Each new session pins one resolved revision; an open conversation remains visually stable.
+
+`theme="auto"` follows an explicit `light`/`dark` host-page class or data attribute, then the browser's
+operating-system preference; `theme="invert"` selects the opposite host mode. When the embedding application has
 its own theme toggle, pass its resolved `"light"` or `"dark"` value to `NoodleAssistant` and every
 `<noodle-app-view>`/`NoodleAppView`. Updates change the assistant in place and notify mounted MCP Apps through standard host
 context.
 
 Server branding controls customer name, themed logo/mark/avatar assets, semantic light/dark colors, density,
-radius, typography, and automatic theme. `embeddedAssistant(...)` controls floating/inline/drawer layout,
-position and dimensions, mobile and launcher/header/avatar/timestamp behavior, visible labels, suggested
+radius, typography, and automatic theme. `embeddedAssistant(...)` controls theme selection,
+floating/inline/drawer layout, position and dimensions, mobile and launcher/header/avatar/timestamp/attribution behavior, visible labels, suggested
 prompts, privacy/terms links, locale, and text direction.
 Named slots cover launcher/header/composer/footer extensions. Public methods include `open`, `close`,
 `toggle`, `focusComposer`, `sendMessage`, `stop`, `reconnect`, `updateContext`, `updateModelContext`, `respond`, `confirmTool`, and `resetSession`;
+lifecycle properties include `sessionEndpoint`, `embedId`, `serviceUrl`, `fetch`, and `appearance`;
 lifecycle, message, tool-proposal, interaction-resolution, view-availability, context, and error events
 support application integration. `confirmTool(id)` remains the compatibility shorthand for
 `respond(id, { action: 'accept' })`.

package/dist/{app-view-element-BNkQab1B.d.ts → app-view-element-C_ATXseu.d.ts}

@@ -1,4 +1,4 @@
-import { A as AssistantClient, a as AssistantViewAvailableDetail, e as AssistantErrorDetail } from './client-BkogON2A.js';
+import { A as AssistantClient, a as AssistantViewAvailableDetail, e as AssistantErrorDetail } from './client-BheCOERq.js';
 
 declare const APP_VIEW_TAG_NAME = "noodle-app-view";
 interface AssistantAppViewErrorDetail {

package/dist/{app-view-element-DhuiNW_x.d.cts → app-view-element-CiFVNIke.d.cts}

@@ -1,4 +1,4 @@
-import { A as AssistantClient, a as AssistantViewAvailableDetail, e as AssistantErrorDetail } from './client-C07ppTU_.cjs';
+import { A as AssistantClient, a as AssistantViewAvailableDetail, e as AssistantErrorDetail } from './client-BiMRVxjs.cjs';
 
 declare const APP_VIEW_TAG_NAME = "noodle-app-view";
 interface AssistantAppViewErrorDetail {

package/dist/app-view.cjs

@@ -15197,7 +15197,7 @@ __export(app_view_exports, {
 });
 module.exports = __toCommonJS(app_view_exports);
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_supports-color@7.2.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
 init_v4();
 var RELATED_TASK_META_KEY = "io.modelcontextprotocol/related-task";
 var JSONRPC_VERSION = "2.0";
@@ -16718,7 +16718,7 @@ var UrlElicitationRequiredError = class extends McpError {
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/mini/parse.js
 init_core2();
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_supports-color@7.2.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
 function isZ4Schema(s2) {
   const schema = s2;
   return !!schema._zod;
@@ -16781,7 +16781,7 @@ function getLiteralValue(schema) {
   return void 0;
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_supports-color@7.2.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/interfaces.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/interfaces.js
 function isTerminal(status) {
   return status === "completed" || status === "failed" || status === "cancelled";
 }
@@ -16789,7 +16789,7 @@ function isTerminal(status) {
 // ../../node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@4.4.3/node_modules/zod-to-json-schema/dist/esm/parsers/string.js
 var ALPHA_NUMERIC = new Set("ABCDEFGHIJKLMNOPQRSTUVXYZabcdefghijklmnopqrstuvxyz0123456789");
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_supports-color@7.2.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js
 function getMethodLiteral(schema) {
   const shape = getObjectShape(schema);
   const methodSchema = shape?.method;
@@ -16810,7 +16810,7 @@ function parseWithCompat(schema, data) {
   return result.data;
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_supports-color@7.2.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
 var DEFAULT_REQUEST_TIMEOUT_MSEC = 6e4;
 var Protocol = class {
   constructor(_options) {