@noodleseed/one 0.127.2 → 0.129.0

package/node_modules/@noodleseed/assistant/dist/react.d.cts

@@ -1,7 +1,7 @@
 import { ReactElement, RefAttributes } from 'react';
 import { a as AssistantThemeMode } from './appearance-Cc-eqSbp.cjs';
 import { AssistantAppearance, AssistantAppearanceWarning, NoodleAssistantElement } from './index.cjs';
-import { c as AssistantClient, d as AssistantViewAvailableDetail, A as AssistantPageContext, a as AssistantContext, e as AssistantModelContextUpdate, f as AssistantClientEvent, g as AssistantErrorDetail } from './client-BQ30Fq-c.cjs';
+import { c as AssistantClient, d as AssistantViewAvailableDetail, A as AssistantPageContext, a as AssistantContext, e as AssistantModelContextUpdate, f as AssistantClientEvent, g as AssistantErrorDetail } from './client-7o7n2nqw.cjs';
 import 'ai';
 
 interface NoodleAppViewProps {

package/node_modules/@noodleseed/assistant/dist/react.d.ts

@@ -1,7 +1,7 @@
 import { ReactElement, RefAttributes } from 'react';
 import { a as AssistantThemeMode } from './appearance-Cc-eqSbp.js';
 import { AssistantAppearance, AssistantAppearanceWarning, NoodleAssistantElement } from './index.js';
-import { c as AssistantClient, d as AssistantViewAvailableDetail, A as AssistantPageContext, a as AssistantContext, e as AssistantModelContextUpdate, f as AssistantClientEvent, g as AssistantErrorDetail } from './client-B6pnBmF8.js';
+import { c as AssistantClient, d as AssistantViewAvailableDetail, A as AssistantPageContext, a as AssistantContext, e as AssistantModelContextUpdate, f as AssistantClientEvent, g as AssistantErrorDetail } from './client-CysBQBdd.js';
 import 'ai';
 
 interface NoodleAppViewProps {

package/node_modules/@noodleseed/assistant/dist/react.js

@@ -3,8 +3,8 @@ import {
   registerNoodleAssistant,
   unmountAssistantApp,
   updateAssistantAppTheme
-} from "./chunk-RFETV5KQ.js";
-import "./chunk-S373FCAI.js";
+} from "./chunk-DLUINP4W.js";
+import "./chunk-52XT7BLR.js";
 import "./chunk-3YYTUJPJ.js";
 import "./chunk-5FUTL2UF.js";
 

package/node_modules/@noodleseed/assistant/dist/server.cjs

@@ -20,10 +20,53 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/server.ts
 var server_exports = {};
 __export(server_exports, {
+  ASSISTANT_ELEVATION_REFUSAL_CODES: () => ASSISTANT_ELEVATION_REFUSAL_CODES,
+  AssistantSessionExchangeError: () => AssistantSessionExchangeError,
   createAssistantSession: () => createAssistantSession
 });
 module.exports = __toCommonJS(server_exports);
+var ASSISTANT_ELEVATION_REFUSAL_CODES = [
+  "elevation_ticket_invalid",
+  "elevation_ticket_expired",
+  "elevation_tenant_mismatch",
+  "elevation_session_unavailable",
+  "elevation_already_signed_in"
+];
+var AssistantSessionExchangeError = class extends Error {
+  detail;
+  constructor(detail, message) {
+    super(message);
+    this.name = "AssistantSessionExchangeError";
+    this.detail = detail;
+  }
+  /**
+   * The narrowed sign-in refusal, when this failure is one. `elevation_ticket_expired` means the
+   * visitor took too long — re-prompt; `elevation_tenant_mismatch` means a client reached for a
+   * conversation it does not own — alert someone, never retry.
+   */
+  get elevationRefusal() {
+    const code = this.detail.serviceCode;
+    return code !== void 0 && ASSISTANT_ELEVATION_REFUSAL_CODES.includes(code) ? code : void 0;
+  }
+};
+async function exchangeError(response) {
+  const body = await response.json().catch(() => void 0);
+  const serviceCode = typeof body?.code === "string" ? body.code : void 0;
+  return new AssistantSessionExchangeError(
+    {
+      code: "session_exchange_failed",
+      status: response.status,
+      // `elevation_unavailable` is a 503 an operator has to fix; retrying cannot help.
+      retryable: response.status >= 500 && serviceCode !== "elevation_unavailable",
+      ...serviceCode === void 0 ? {} : { serviceCode }
+    },
+    `Assistant session exchange failed (${response.status})`
+  );
+}
 async function createAssistantSession(input, dependencies = {}) {
+  if (input.signInTicket !== void 0 && input.context !== void 0) {
+    throw new Error("context does not apply when spending a sign-in ticket");
+  }
   const request = dependencies.fetch ?? fetch;
   const serviceUrl = input.serviceUrl.replace(/\/$/, "");
   const credentials = Buffer.from(`${input.clientId}:${input.clientSecret}`, "utf8").toString(
@@ -39,17 +82,20 @@ async function createAssistantSession(input, dependencies = {}) {
     body: JSON.stringify({
       origin: input.origin,
       user: input.user,
+      ...input.signInTicket === void 0 ? {} : { signInTicket: input.signInTicket },
       ...input.claims ? { claims: input.claims } : {},
       ...input.context ? { context: input.context } : {},
       ...input.preferences ? { preferences: input.preferences } : {},
       ...input.routing ? { routing: input.routing } : {}
     })
   });
-  if (!response.ok) throw new Error(`Assistant session exchange failed (${response.status})`);
+  if (!response.ok) throw await exchangeError(response);
   return await response.json();
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  ASSISTANT_ELEVATION_REFUSAL_CODES,
+  AssistantSessionExchangeError,
   createAssistantSession
 });
 //# sourceMappingURL=server.cjs.map

package/node_modules/@noodleseed/assistant/dist/server.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/server.ts"],"sourcesContent":["import type { AssistantConfiguration } from './appearance.js';\n\nexport interface CreateAssistantSessionInput {\n  readonly serviceUrl: string;\n  readonly clientId: string;\n  readonly clientSecret: string;\n  /** Browser origin to bind into the short-lived assistant session. */\n  readonly origin: string;\n  readonly user: {\n    readonly id: string;\n    readonly email?: string;\n    readonly name?: string;\n    readonly tenant?: string;\n    readonly roles?: readonly string[];\n    readonly scopes?: readonly string[];\n  };\n  readonly context?: Readonly<Record<string, string | number | boolean | null>>;\n  /** Backend-verified user preferences; these outrank untrusted browser presentation hints. */\n  readonly preferences?: {\n    readonly locale?: string;\n    readonly timeZone?: string;\n  };\n  /** Backend-verified connector routes keyed by authored `customerEndpoint` name. */\n  readonly routing?: {\n    readonly endpoints: Readonly<Record<string, string>>;\n  };\n  /**\n   * Verified session claims from your authenticated backend. Only claims the server declares in\n   * `embeddedAssistant({ sessionClaims })` reach tools (`\\${user.claims.<key>}`) and, when marked\n   * `exposeToModel`, the assistant's identity context. Flat scalars only.\n   */\n  readonly claims?: Readonly<Record<string, string | number | boolean | null>>;\n}\n\nexport interface AssistantSession {\n  readonly token: string;\n  readonly expiresAt: string;\n  readonly endpoints: {\n    readonly turns: string;\n    readonly toolConfirmations: string;\n    readonly interactions?: string;\n    readonly apps?: string;\n    /** Additive hosted sandbox document for widget frames; absent on older services. */\n    readonly sandbox?: string;\n  };\n  readonly configuration?: AssistantConfiguration;\n}\n\nexport async function createAssistantSession(\n  input: CreateAssistantSessionInput,\n  dependencies: { readonly fetch?: typeof fetch } = {},\n): Promise<AssistantSession> {\n  const request = dependencies.fetch ?? fetch;\n  const serviceUrl = input.serviceUrl.replace(/\\/$/, '');\n  const credentials = Buffer.from(`${input.clientId}:${input.clientSecret}`, 'utf8').toString(\n    'base64',\n  );\n  const response = await request(`${serviceUrl}/v1/assistant/sessions`, {\n    method: 'POST',\n    headers: {\n      Authorization: `Basic ${credentials}`,\n      Accept: 'application/json',\n      'Content-Type': 'application/json',\n    },\n    body: JSON.stringify({\n      origin: input.origin,\n      user: input.user,\n      ...(input.claims ? { claims: input.claims } : {}),\n      ...(input.context ? { context: input.context } : {}),\n      ...(input.preferences ? { preferences: input.preferences } : {}),\n      ...(input.routing ? { routing: input.routing } : {}),\n    }),\n  });\n  if (!response.ok) throw new Error(`Assistant session exchange failed (${response.status})`);\n  return (await response.json()) as AssistantSession;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAgDA,eAAsB,uBACpB,OACA,eAAkD,CAAC,GACxB;AAC3B,QAAM,UAAU,aAAa,SAAS;AACtC,QAAM,aAAa,MAAM,WAAW,QAAQ,OAAO,EAAE;AACrD,QAAM,cAAc,OAAO,KAAK,GAAG,MAAM,QAAQ,IAAI,MAAM,YAAY,IAAI,MAAM,EAAE;AAAA,IACjF;AAAA,EACF;AACA,QAAM,WAAW,MAAM,QAAQ,GAAG,UAAU,0BAA0B;AAAA,IACpE,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,eAAe,SAAS,WAAW;AAAA,MACnC,QAAQ;AAAA,MACR,gBAAgB;AAAA,IAClB;AAAA,IACA,MAAM,KAAK,UAAU;AAAA,MACnB,QAAQ,MAAM;AAAA,MACd,MAAM,MAAM;AAAA,MACZ,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,MAC/C,GAAI,MAAM,UAAU,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,MAClD,GAAI,MAAM,cAAc,EAAE,aAAa,MAAM,YAAY,IAAI,CAAC;AAAA,MAC9D,GAAI,MAAM,UAAU,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,IACpD,CAAC;AAAA,EACH,CAAC;AACD,MAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM,sCAAsC,SAAS,MAAM,GAAG;AAC1F,SAAQ,MAAM,SAAS,KAAK;AAC9B;","names":[]}
+{"version":3,"sources":["../src/server.ts"],"sourcesContent":["import type { AssistantConfiguration } from './appearance.js';\n\ninterface AssistantSessionExchangeBase {\n  readonly serviceUrl: string;\n  readonly clientId: string;\n  readonly clientSecret: string;\n  /** Browser origin to bind into the short-lived assistant session. */\n  readonly origin: string;\n  /** The signed-in person your backend vouches for — on both arms: an elevation IS this vouching. */\n  readonly user: {\n    readonly id: string;\n    readonly email?: string;\n    readonly name?: string;\n    readonly tenant?: string;\n    readonly roles?: readonly string[];\n    readonly scopes?: readonly string[];\n  };\n  /** Backend-verified user preferences; these outrank untrusted browser presentation hints. */\n  readonly preferences?: {\n    readonly locale?: string;\n    readonly timeZone?: string;\n  };\n  /**\n   * Verified session claims from your authenticated backend. Only claims the server declares in\n   * `embeddedAssistant({ sessionClaims })` reach tools (`\\${user.claims.<key>}`) and, when marked\n   * `exposeToModel`, the assistant's identity context. Flat scalars only.\n   */\n  readonly claims?: Readonly<Record<string, string | number | boolean | null>>;\n}\n\n/**\n * Fresh mint XOR mid-conversation sign-in, exclusive rather than merged for the same reason the\n * client's `sessionEndpoint`/`embedId` pair is: the two are different operations, and the wrong\n * combination should fail to typecheck instead of silently picking a meaning.\n *\n * `context` applies only when a session is being created; an elevation keeps the existing\n * conversation, so it is excluded rather than silently ignored. `routing` is allowed on both arms —\n * elevation is the first authenticated moment, so it is the only chance a routed connector's\n * session ever gets its backend-verified customer routes.\n */\nexport type CreateAssistantSessionInput =\n  | (AssistantSessionExchangeBase & {\n      readonly signInTicket?: undefined;\n      readonly context?: Readonly<Record<string, string | number | boolean | null>>;\n      /** Backend-verified connector routes keyed by authored `customerEndpoint` name. */\n      readonly routing?: {\n        readonly endpoints: Readonly<Record<string, string>>;\n      };\n    })\n  | (AssistantSessionExchangeBase & {\n      /**\n       * Single-use sign-in ticket from the widget's `assistant-sign-in-requested` event\n       * (ADR 0201, 5.6b). Spending it binds this signed-in user to the visitor's existing\n       * anonymous conversation instead of minting a new one. Unrelated to the server-held\n       * interaction continuation, which never reaches browser code.\n       */\n      readonly signInTicket: string;\n      readonly context?: undefined;\n      /** Backend-verified connector routes keyed by authored `customerEndpoint` name. */\n      readonly routing?: {\n        readonly endpoints: Readonly<Record<string, string>>;\n      };\n    });\n\nexport interface AssistantSession {\n  readonly token: string;\n  readonly expiresAt: string;\n  readonly endpoints: {\n    readonly turns: string;\n    readonly toolConfirmations: string;\n    readonly interactions?: string;\n    readonly apps?: string;\n    /** Additive hosted sandbox document for widget frames; absent on older services. */\n    readonly sandbox?: string;\n  };\n  readonly configuration?: AssistantConfiguration;\n}\n\n/** The service's refusal codes for a sign-in ticket the exchange would not honour. */\nexport const ASSISTANT_ELEVATION_REFUSAL_CODES = [\n  'elevation_ticket_invalid',\n  'elevation_ticket_expired',\n  'elevation_tenant_mismatch',\n  'elevation_session_unavailable',\n  'elevation_already_signed_in',\n] as const;\nexport type AssistantElevationRefusalCode = (typeof ASSISTANT_ELEVATION_REFUSAL_CODES)[number];\n\n/**\n * Structurally mirrors the browser client's `AssistantErrorDetail` (declared locally: the backend\n * entry must not pull the browser transport module into its graph). `code` is a closed union owned\n * by this package; `serviceCode` passes the service's machine code through additively.\n */\nexport interface AssistantSessionExchangeErrorDetail {\n  readonly code: 'session_exchange_failed';\n  readonly status: number;\n  /** 5xx infrastructure failures may be retried; a refused exchange must not be — tickets are single-use. */\n  readonly retryable: boolean;\n  /** The service's machine code when the body carried one, e.g. `elevation_ticket_expired`. */\n  readonly serviceCode?: string;\n}\n\nexport class AssistantSessionExchangeError extends Error {\n  readonly detail: AssistantSessionExchangeErrorDetail;\n\n  constructor(detail: AssistantSessionExchangeErrorDetail, message: string) {\n    super(message);\n    this.name = 'AssistantSessionExchangeError';\n    this.detail = detail;\n  }\n\n  /**\n   * The narrowed sign-in refusal, when this failure is one. `elevation_ticket_expired` means the\n   * visitor took too long — re-prompt; `elevation_tenant_mismatch` means a client reached for a\n   * conversation it does not own — alert someone, never retry.\n   */\n  get elevationRefusal(): AssistantElevationRefusalCode | undefined {\n    const code = this.detail.serviceCode;\n    return code !== undefined &&\n      (ASSISTANT_ELEVATION_REFUSAL_CODES as readonly string[]).includes(code)\n      ? (code as AssistantElevationRefusalCode)\n      : undefined;\n  }\n}\n\n/** Never throws while reading the body — a proxy can answer with HTML instead of JSON. */\nasync function exchangeError(response: Response): Promise<AssistantSessionExchangeError> {\n  const body = (await response.json().catch(() => undefined)) as\n    | { readonly error?: unknown; readonly code?: unknown }\n    | undefined;\n  const serviceCode = typeof body?.code === 'string' ? body.code : undefined;\n  return new AssistantSessionExchangeError(\n    {\n      code: 'session_exchange_failed',\n      status: response.status,\n      // `elevation_unavailable` is a 503 an operator has to fix; retrying cannot help.\n      retryable: response.status >= 500 && serviceCode !== 'elevation_unavailable',\n      ...(serviceCode === undefined ? {} : { serviceCode }),\n    },\n    `Assistant session exchange failed (${response.status})`,\n  );\n}\n\nexport async function createAssistantSession(\n  input: CreateAssistantSessionInput,\n  dependencies: { readonly fetch?: typeof fetch } = {},\n): Promise<AssistantSession> {\n  if (input.signInTicket !== undefined && (input as { context?: unknown }).context !== undefined) {\n    // Mirrors resolveSessionSource: silently dropping what the service ignores would pick a\n    // meaning the developer did not intend.\n    throw new Error('context does not apply when spending a sign-in ticket');\n  }\n  const request = dependencies.fetch ?? fetch;\n  const serviceUrl = input.serviceUrl.replace(/\\/$/, '');\n  const credentials = Buffer.from(`${input.clientId}:${input.clientSecret}`, 'utf8').toString(\n    'base64',\n  );\n  const response = await request(`${serviceUrl}/v1/assistant/sessions`, {\n    method: 'POST',\n    headers: {\n      Authorization: `Basic ${credentials}`,\n      Accept: 'application/json',\n      'Content-Type': 'application/json',\n    },\n    body: JSON.stringify({\n      origin: input.origin,\n      user: input.user,\n      ...(input.signInTicket === undefined ? {} : { signInTicket: input.signInTicket }),\n      ...(input.claims ? { claims: input.claims } : {}),\n      ...(input.context ? { context: input.context } : {}),\n      ...(input.preferences ? { preferences: input.preferences } : {}),\n      ...(input.routing ? { routing: input.routing } : {}),\n    }),\n  });\n  // A fresh mint answers 201, an elevation 200; both are the same wire shape (ADR 0151).\n  if (!response.ok) throw await exchangeError(response);\n  return (await response.json()) as AssistantSession;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA+EO,IAAM,oCAAoC;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAiBO,IAAM,gCAAN,cAA4C,MAAM;AAAA,EAC9C;AAAA,EAET,YAAY,QAA6C,SAAiB;AACxE,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,mBAA8D;AAChE,UAAM,OAAO,KAAK,OAAO;AACzB,WAAO,SAAS,UACb,kCAAwD,SAAS,IAAI,IACnE,OACD;AAAA,EACN;AACF;AAGA,eAAe,cAAc,UAA4D;AACvF,QAAM,OAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,MAAS;AAGzD,QAAM,cAAc,OAAO,MAAM,SAAS,WAAW,KAAK,OAAO;AACjE,SAAO,IAAI;AAAA,IACT;AAAA,MACE,MAAM;AAAA,MACN,QAAQ,SAAS;AAAA;AAAA,MAEjB,WAAW,SAAS,UAAU,OAAO,gBAAgB;AAAA,MACrD,GAAI,gBAAgB,SAAY,CAAC,IAAI,EAAE,YAAY;AAAA,IACrD;AAAA,IACA,sCAAsC,SAAS,MAAM;AAAA,EACvD;AACF;AAEA,eAAsB,uBACpB,OACA,eAAkD,CAAC,GACxB;AAC3B,MAAI,MAAM,iBAAiB,UAAc,MAAgC,YAAY,QAAW;AAG9F,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AACA,QAAM,UAAU,aAAa,SAAS;AACtC,QAAM,aAAa,MAAM,WAAW,QAAQ,OAAO,EAAE;AACrD,QAAM,cAAc,OAAO,KAAK,GAAG,MAAM,QAAQ,IAAI,MAAM,YAAY,IAAI,MAAM,EAAE;AAAA,IACjF;AAAA,EACF;AACA,QAAM,WAAW,MAAM,QAAQ,GAAG,UAAU,0BAA0B;AAAA,IACpE,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,eAAe,SAAS,WAAW;AAAA,MACnC,QAAQ;AAAA,MACR,gBAAgB;AAAA,IAClB;AAAA,IACA,MAAM,KAAK,UAAU;AAAA,MACnB,QAAQ,MAAM;AAAA,MACd,MAAM,MAAM;AAAA,MACZ,GAAI,MAAM,iBAAiB,SAAY,CAAC,IAAI,EAAE,cAAc,MAAM,aAAa;AAAA,MAC/E,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,MAC/C,GAAI,MAAM,UAAU,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,MAClD,GAAI,MAAM,cAAc,EAAE,aAAa,MAAM,YAAY,IAAI,CAAC;AAAA,MAC9D,GAAI,MAAM,UAAU,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,IACpD,CAAC;AAAA,EACH,CAAC;AAED,MAAI,CAAC,SAAS,GAAI,OAAM,MAAM,cAAc,QAAQ;AACpD,SAAQ,MAAM,SAAS,KAAK;AAC9B;","names":[]}

package/node_modules/@noodleseed/assistant/dist/server.d.cts

@@ -1,11 +1,12 @@
 import { A as AssistantConfiguration } from './appearance-Cc-eqSbp.cjs';
 
-interface CreateAssistantSessionInput {
+interface AssistantSessionExchangeBase {
     readonly serviceUrl: string;
     readonly clientId: string;
     readonly clientSecret: string;
     /** Browser origin to bind into the short-lived assistant session. */
     readonly origin: string;
+    /** The signed-in person your backend vouches for — on both arms: an elevation IS this vouching. */
     readonly user: {
         readonly id: string;
         readonly email?: string;
@@ -14,16 +15,11 @@ interface CreateAssistantSessionInput {
         readonly roles?: readonly string[];
         readonly scopes?: readonly string[];
     };
-    readonly context?: Readonly<Record<string, string | number | boolean | null>>;
     /** Backend-verified user preferences; these outrank untrusted browser presentation hints. */
     readonly preferences?: {
         readonly locale?: string;
         readonly timeZone?: string;
     };
-    /** Backend-verified connector routes keyed by authored `customerEndpoint` name. */
-    readonly routing?: {
-        readonly endpoints: Readonly<Record<string, string>>;
-    };
     /**
      * Verified session claims from your authenticated backend. Only claims the server declares in
      * `embeddedAssistant({ sessionClaims })` reach tools (`\${user.claims.<key>}`) and, when marked
@@ -31,6 +27,37 @@ interface CreateAssistantSessionInput {
      */
     readonly claims?: Readonly<Record<string, string | number | boolean | null>>;
 }
+/**
+ * Fresh mint XOR mid-conversation sign-in, exclusive rather than merged for the same reason the
+ * client's `sessionEndpoint`/`embedId` pair is: the two are different operations, and the wrong
+ * combination should fail to typecheck instead of silently picking a meaning.
+ *
+ * `context` applies only when a session is being created; an elevation keeps the existing
+ * conversation, so it is excluded rather than silently ignored. `routing` is allowed on both arms —
+ * elevation is the first authenticated moment, so it is the only chance a routed connector's
+ * session ever gets its backend-verified customer routes.
+ */
+type CreateAssistantSessionInput = (AssistantSessionExchangeBase & {
+    readonly signInTicket?: undefined;
+    readonly context?: Readonly<Record<string, string | number | boolean | null>>;
+    /** Backend-verified connector routes keyed by authored `customerEndpoint` name. */
+    readonly routing?: {
+        readonly endpoints: Readonly<Record<string, string>>;
+    };
+}) | (AssistantSessionExchangeBase & {
+    /**
+     * Single-use sign-in ticket from the widget's `assistant-sign-in-requested` event
+     * (ADR 0201, 5.6b). Spending it binds this signed-in user to the visitor's existing
+     * anonymous conversation instead of minting a new one. Unrelated to the server-held
+     * interaction continuation, which never reaches browser code.
+     */
+    readonly signInTicket: string;
+    readonly context?: undefined;
+    /** Backend-verified connector routes keyed by authored `customerEndpoint` name. */
+    readonly routing?: {
+        readonly endpoints: Readonly<Record<string, string>>;
+    };
+});
 interface AssistantSession {
     readonly token: string;
     readonly expiresAt: string;
@@ -44,8 +71,34 @@ interface AssistantSession {
     };
     readonly configuration?: AssistantConfiguration;
 }
+/** The service's refusal codes for a sign-in ticket the exchange would not honour. */
+declare const ASSISTANT_ELEVATION_REFUSAL_CODES: readonly ["elevation_ticket_invalid", "elevation_ticket_expired", "elevation_tenant_mismatch", "elevation_session_unavailable", "elevation_already_signed_in"];
+type AssistantElevationRefusalCode = (typeof ASSISTANT_ELEVATION_REFUSAL_CODES)[number];
+/**
+ * Structurally mirrors the browser client's `AssistantErrorDetail` (declared locally: the backend
+ * entry must not pull the browser transport module into its graph). `code` is a closed union owned
+ * by this package; `serviceCode` passes the service's machine code through additively.
+ */
+interface AssistantSessionExchangeErrorDetail {
+    readonly code: 'session_exchange_failed';
+    readonly status: number;
+    /** 5xx infrastructure failures may be retried; a refused exchange must not be — tickets are single-use. */
+    readonly retryable: boolean;
+    /** The service's machine code when the body carried one, e.g. `elevation_ticket_expired`. */
+    readonly serviceCode?: string;
+}
+declare class AssistantSessionExchangeError extends Error {
+    readonly detail: AssistantSessionExchangeErrorDetail;
+    constructor(detail: AssistantSessionExchangeErrorDetail, message: string);
+    /**
+     * The narrowed sign-in refusal, when this failure is one. `elevation_ticket_expired` means the
+     * visitor took too long — re-prompt; `elevation_tenant_mismatch` means a client reached for a
+     * conversation it does not own — alert someone, never retry.
+     */
+    get elevationRefusal(): AssistantElevationRefusalCode | undefined;
+}
 declare function createAssistantSession(input: CreateAssistantSessionInput, dependencies?: {
     readonly fetch?: typeof fetch;
 }): Promise<AssistantSession>;
 
-export { type AssistantSession, type CreateAssistantSessionInput, createAssistantSession };
+export { ASSISTANT_ELEVATION_REFUSAL_CODES, type AssistantElevationRefusalCode, type AssistantSession, AssistantSessionExchangeError, type AssistantSessionExchangeErrorDetail, type CreateAssistantSessionInput, createAssistantSession };

package/node_modules/@noodleseed/assistant/dist/server.d.ts

@@ -1,11 +1,12 @@
 import { A as AssistantConfiguration } from './appearance-Cc-eqSbp.js';
 
-interface CreateAssistantSessionInput {
+interface AssistantSessionExchangeBase {
     readonly serviceUrl: string;
     readonly clientId: string;
     readonly clientSecret: string;
     /** Browser origin to bind into the short-lived assistant session. */
     readonly origin: string;
+    /** The signed-in person your backend vouches for — on both arms: an elevation IS this vouching. */
     readonly user: {
         readonly id: string;
         readonly email?: string;
@@ -14,16 +15,11 @@ interface CreateAssistantSessionInput {
         readonly roles?: readonly string[];
         readonly scopes?: readonly string[];
     };
-    readonly context?: Readonly<Record<string, string | number | boolean | null>>;
     /** Backend-verified user preferences; these outrank untrusted browser presentation hints. */
     readonly preferences?: {
         readonly locale?: string;
         readonly timeZone?: string;
     };
-    /** Backend-verified connector routes keyed by authored `customerEndpoint` name. */
-    readonly routing?: {
-        readonly endpoints: Readonly<Record<string, string>>;
-    };
     /**
      * Verified session claims from your authenticated backend. Only claims the server declares in
      * `embeddedAssistant({ sessionClaims })` reach tools (`\${user.claims.<key>}`) and, when marked
@@ -31,6 +27,37 @@ interface CreateAssistantSessionInput {
      */
     readonly claims?: Readonly<Record<string, string | number | boolean | null>>;
 }
+/**
+ * Fresh mint XOR mid-conversation sign-in, exclusive rather than merged for the same reason the
+ * client's `sessionEndpoint`/`embedId` pair is: the two are different operations, and the wrong
+ * combination should fail to typecheck instead of silently picking a meaning.
+ *
+ * `context` applies only when a session is being created; an elevation keeps the existing
+ * conversation, so it is excluded rather than silently ignored. `routing` is allowed on both arms —
+ * elevation is the first authenticated moment, so it is the only chance a routed connector's
+ * session ever gets its backend-verified customer routes.
+ */
+type CreateAssistantSessionInput = (AssistantSessionExchangeBase & {
+    readonly signInTicket?: undefined;
+    readonly context?: Readonly<Record<string, string | number | boolean | null>>;
+    /** Backend-verified connector routes keyed by authored `customerEndpoint` name. */
+    readonly routing?: {
+        readonly endpoints: Readonly<Record<string, string>>;
+    };
+}) | (AssistantSessionExchangeBase & {
+    /**
+     * Single-use sign-in ticket from the widget's `assistant-sign-in-requested` event
+     * (ADR 0201, 5.6b). Spending it binds this signed-in user to the visitor's existing
+     * anonymous conversation instead of minting a new one. Unrelated to the server-held
+     * interaction continuation, which never reaches browser code.
+     */
+    readonly signInTicket: string;
+    readonly context?: undefined;
+    /** Backend-verified connector routes keyed by authored `customerEndpoint` name. */
+    readonly routing?: {
+        readonly endpoints: Readonly<Record<string, string>>;
+    };
+});
 interface AssistantSession {
     readonly token: string;
     readonly expiresAt: string;
@@ -44,8 +71,34 @@ interface AssistantSession {
     };
     readonly configuration?: AssistantConfiguration;
 }
+/** The service's refusal codes for a sign-in ticket the exchange would not honour. */
+declare const ASSISTANT_ELEVATION_REFUSAL_CODES: readonly ["elevation_ticket_invalid", "elevation_ticket_expired", "elevation_tenant_mismatch", "elevation_session_unavailable", "elevation_already_signed_in"];
+type AssistantElevationRefusalCode = (typeof ASSISTANT_ELEVATION_REFUSAL_CODES)[number];
+/**
+ * Structurally mirrors the browser client's `AssistantErrorDetail` (declared locally: the backend
+ * entry must not pull the browser transport module into its graph). `code` is a closed union owned
+ * by this package; `serviceCode` passes the service's machine code through additively.
+ */
+interface AssistantSessionExchangeErrorDetail {
+    readonly code: 'session_exchange_failed';
+    readonly status: number;
+    /** 5xx infrastructure failures may be retried; a refused exchange must not be — tickets are single-use. */
+    readonly retryable: boolean;
+    /** The service's machine code when the body carried one, e.g. `elevation_ticket_expired`. */
+    readonly serviceCode?: string;
+}
+declare class AssistantSessionExchangeError extends Error {
+    readonly detail: AssistantSessionExchangeErrorDetail;
+    constructor(detail: AssistantSessionExchangeErrorDetail, message: string);
+    /**
+     * The narrowed sign-in refusal, when this failure is one. `elevation_ticket_expired` means the
+     * visitor took too long — re-prompt; `elevation_tenant_mismatch` means a client reached for a
+     * conversation it does not own — alert someone, never retry.
+     */
+    get elevationRefusal(): AssistantElevationRefusalCode | undefined;
+}
 declare function createAssistantSession(input: CreateAssistantSessionInput, dependencies?: {
     readonly fetch?: typeof fetch;
 }): Promise<AssistantSession>;
 
-export { type AssistantSession, type CreateAssistantSessionInput, createAssistantSession };
+export { ASSISTANT_ELEVATION_REFUSAL_CODES, type AssistantElevationRefusalCode, type AssistantSession, AssistantSessionExchangeError, type AssistantSessionExchangeErrorDetail, type CreateAssistantSessionInput, createAssistantSession };

package/node_modules/@noodleseed/assistant/dist/server.js

@@ -1,7 +1,48 @@
 import "./chunk-5FUTL2UF.js";
 
 // src/server.ts
+var ASSISTANT_ELEVATION_REFUSAL_CODES = [
+  "elevation_ticket_invalid",
+  "elevation_ticket_expired",
+  "elevation_tenant_mismatch",
+  "elevation_session_unavailable",
+  "elevation_already_signed_in"
+];
+var AssistantSessionExchangeError = class extends Error {
+  detail;
+  constructor(detail, message) {
+    super(message);
+    this.name = "AssistantSessionExchangeError";
+    this.detail = detail;
+  }
+  /**
+   * The narrowed sign-in refusal, when this failure is one. `elevation_ticket_expired` means the
+   * visitor took too long — re-prompt; `elevation_tenant_mismatch` means a client reached for a
+   * conversation it does not own — alert someone, never retry.
+   */
+  get elevationRefusal() {
+    const code = this.detail.serviceCode;
+    return code !== void 0 && ASSISTANT_ELEVATION_REFUSAL_CODES.includes(code) ? code : void 0;
+  }
+};
+async function exchangeError(response) {
+  const body = await response.json().catch(() => void 0);
+  const serviceCode = typeof body?.code === "string" ? body.code : void 0;
+  return new AssistantSessionExchangeError(
+    {
+      code: "session_exchange_failed",
+      status: response.status,
+      // `elevation_unavailable` is a 503 an operator has to fix; retrying cannot help.
+      retryable: response.status >= 500 && serviceCode !== "elevation_unavailable",
+      ...serviceCode === void 0 ? {} : { serviceCode }
+    },
+    `Assistant session exchange failed (${response.status})`
+  );
+}
 async function createAssistantSession(input, dependencies = {}) {
+  if (input.signInTicket !== void 0 && input.context !== void 0) {
+    throw new Error("context does not apply when spending a sign-in ticket");
+  }
   const request = dependencies.fetch ?? fetch;
   const serviceUrl = input.serviceUrl.replace(/\/$/, "");
   const credentials = Buffer.from(`${input.clientId}:${input.clientSecret}`, "utf8").toString(
@@ -17,16 +58,19 @@ async function createAssistantSession(input, dependencies = {}) {
     body: JSON.stringify({
       origin: input.origin,
       user: input.user,
+      ...input.signInTicket === void 0 ? {} : { signInTicket: input.signInTicket },
       ...input.claims ? { claims: input.claims } : {},
       ...input.context ? { context: input.context } : {},
       ...input.preferences ? { preferences: input.preferences } : {},
       ...input.routing ? { routing: input.routing } : {}
     })
   });
-  if (!response.ok) throw new Error(`Assistant session exchange failed (${response.status})`);
+  if (!response.ok) throw await exchangeError(response);
   return await response.json();
 }
 export {
+  ASSISTANT_ELEVATION_REFUSAL_CODES,
+  AssistantSessionExchangeError,
   createAssistantSession
 };
 //# sourceMappingURL=server.js.map

package/node_modules/@noodleseed/assistant/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/server.ts"],"sourcesContent":["import type { AssistantConfiguration } from './appearance.js';\n\nexport interface CreateAssistantSessionInput {\n  readonly serviceUrl: string;\n  readonly clientId: string;\n  readonly clientSecret: string;\n  /** Browser origin to bind into the short-lived assistant session. */\n  readonly origin: string;\n  readonly user: {\n    readonly id: string;\n    readonly email?: string;\n    readonly name?: string;\n    readonly tenant?: string;\n    readonly roles?: readonly string[];\n    readonly scopes?: readonly string[];\n  };\n  readonly context?: Readonly<Record<string, string | number | boolean | null>>;\n  /** Backend-verified user preferences; these outrank untrusted browser presentation hints. */\n  readonly preferences?: {\n    readonly locale?: string;\n    readonly timeZone?: string;\n  };\n  /** Backend-verified connector routes keyed by authored `customerEndpoint` name. */\n  readonly routing?: {\n    readonly endpoints: Readonly<Record<string, string>>;\n  };\n  /**\n   * Verified session claims from your authenticated backend. Only claims the server declares in\n   * `embeddedAssistant({ sessionClaims })` reach tools (`\\${user.claims.<key>}`) and, when marked\n   * `exposeToModel`, the assistant's identity context. Flat scalars only.\n   */\n  readonly claims?: Readonly<Record<string, string | number | boolean | null>>;\n}\n\nexport interface AssistantSession {\n  readonly token: string;\n  readonly expiresAt: string;\n  readonly endpoints: {\n    readonly turns: string;\n    readonly toolConfirmations: string;\n    readonly interactions?: string;\n    readonly apps?: string;\n    /** Additive hosted sandbox document for widget frames; absent on older services. */\n    readonly sandbox?: string;\n  };\n  readonly configuration?: AssistantConfiguration;\n}\n\nexport async function createAssistantSession(\n  input: CreateAssistantSessionInput,\n  dependencies: { readonly fetch?: typeof fetch } = {},\n): Promise<AssistantSession> {\n  const request = dependencies.fetch ?? fetch;\n  const serviceUrl = input.serviceUrl.replace(/\\/$/, '');\n  const credentials = Buffer.from(`${input.clientId}:${input.clientSecret}`, 'utf8').toString(\n    'base64',\n  );\n  const response = await request(`${serviceUrl}/v1/assistant/sessions`, {\n    method: 'POST',\n    headers: {\n      Authorization: `Basic ${credentials}`,\n      Accept: 'application/json',\n      'Content-Type': 'application/json',\n    },\n    body: JSON.stringify({\n      origin: input.origin,\n      user: input.user,\n      ...(input.claims ? { claims: input.claims } : {}),\n      ...(input.context ? { context: input.context } : {}),\n      ...(input.preferences ? { preferences: input.preferences } : {}),\n      ...(input.routing ? { routing: input.routing } : {}),\n    }),\n  });\n  if (!response.ok) throw new Error(`Assistant session exchange failed (${response.status})`);\n  return (await response.json()) as AssistantSession;\n}\n"],"mappings":";;;AAgDA,eAAsB,uBACpB,OACA,eAAkD,CAAC,GACxB;AAC3B,QAAM,UAAU,aAAa,SAAS;AACtC,QAAM,aAAa,MAAM,WAAW,QAAQ,OAAO,EAAE;AACrD,QAAM,cAAc,OAAO,KAAK,GAAG,MAAM,QAAQ,IAAI,MAAM,YAAY,IAAI,MAAM,EAAE;AAAA,IACjF;AAAA,EACF;AACA,QAAM,WAAW,MAAM,QAAQ,GAAG,UAAU,0BAA0B;AAAA,IACpE,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,eAAe,SAAS,WAAW;AAAA,MACnC,QAAQ;AAAA,MACR,gBAAgB;AAAA,IAClB;AAAA,IACA,MAAM,KAAK,UAAU;AAAA,MACnB,QAAQ,MAAM;AAAA,MACd,MAAM,MAAM;AAAA,MACZ,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,MAC/C,GAAI,MAAM,UAAU,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,MAClD,GAAI,MAAM,cAAc,EAAE,aAAa,MAAM,YAAY,IAAI,CAAC;AAAA,MAC9D,GAAI,MAAM,UAAU,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,IACpD,CAAC;AAAA,EACH,CAAC;AACD,MAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM,sCAAsC,SAAS,MAAM,GAAG;AAC1F,SAAQ,MAAM,SAAS,KAAK;AAC9B;","names":[]}
+{"version":3,"sources":["../src/server.ts"],"sourcesContent":["import type { AssistantConfiguration } from './appearance.js';\n\ninterface AssistantSessionExchangeBase {\n  readonly serviceUrl: string;\n  readonly clientId: string;\n  readonly clientSecret: string;\n  /** Browser origin to bind into the short-lived assistant session. */\n  readonly origin: string;\n  /** The signed-in person your backend vouches for — on both arms: an elevation IS this vouching. */\n  readonly user: {\n    readonly id: string;\n    readonly email?: string;\n    readonly name?: string;\n    readonly tenant?: string;\n    readonly roles?: readonly string[];\n    readonly scopes?: readonly string[];\n  };\n  /** Backend-verified user preferences; these outrank untrusted browser presentation hints. */\n  readonly preferences?: {\n    readonly locale?: string;\n    readonly timeZone?: string;\n  };\n  /**\n   * Verified session claims from your authenticated backend. Only claims the server declares in\n   * `embeddedAssistant({ sessionClaims })` reach tools (`\\${user.claims.<key>}`) and, when marked\n   * `exposeToModel`, the assistant's identity context. Flat scalars only.\n   */\n  readonly claims?: Readonly<Record<string, string | number | boolean | null>>;\n}\n\n/**\n * Fresh mint XOR mid-conversation sign-in, exclusive rather than merged for the same reason the\n * client's `sessionEndpoint`/`embedId` pair is: the two are different operations, and the wrong\n * combination should fail to typecheck instead of silently picking a meaning.\n *\n * `context` applies only when a session is being created; an elevation keeps the existing\n * conversation, so it is excluded rather than silently ignored. `routing` is allowed on both arms —\n * elevation is the first authenticated moment, so it is the only chance a routed connector's\n * session ever gets its backend-verified customer routes.\n */\nexport type CreateAssistantSessionInput =\n  | (AssistantSessionExchangeBase & {\n      readonly signInTicket?: undefined;\n      readonly context?: Readonly<Record<string, string | number | boolean | null>>;\n      /** Backend-verified connector routes keyed by authored `customerEndpoint` name. */\n      readonly routing?: {\n        readonly endpoints: Readonly<Record<string, string>>;\n      };\n    })\n  | (AssistantSessionExchangeBase & {\n      /**\n       * Single-use sign-in ticket from the widget's `assistant-sign-in-requested` event\n       * (ADR 0201, 5.6b). Spending it binds this signed-in user to the visitor's existing\n       * anonymous conversation instead of minting a new one. Unrelated to the server-held\n       * interaction continuation, which never reaches browser code.\n       */\n      readonly signInTicket: string;\n      readonly context?: undefined;\n      /** Backend-verified connector routes keyed by authored `customerEndpoint` name. */\n      readonly routing?: {\n        readonly endpoints: Readonly<Record<string, string>>;\n      };\n    });\n\nexport interface AssistantSession {\n  readonly token: string;\n  readonly expiresAt: string;\n  readonly endpoints: {\n    readonly turns: string;\n    readonly toolConfirmations: string;\n    readonly interactions?: string;\n    readonly apps?: string;\n    /** Additive hosted sandbox document for widget frames; absent on older services. */\n    readonly sandbox?: string;\n  };\n  readonly configuration?: AssistantConfiguration;\n}\n\n/** The service's refusal codes for a sign-in ticket the exchange would not honour. */\nexport const ASSISTANT_ELEVATION_REFUSAL_CODES = [\n  'elevation_ticket_invalid',\n  'elevation_ticket_expired',\n  'elevation_tenant_mismatch',\n  'elevation_session_unavailable',\n  'elevation_already_signed_in',\n] as const;\nexport type AssistantElevationRefusalCode = (typeof ASSISTANT_ELEVATION_REFUSAL_CODES)[number];\n\n/**\n * Structurally mirrors the browser client's `AssistantErrorDetail` (declared locally: the backend\n * entry must not pull the browser transport module into its graph). `code` is a closed union owned\n * by this package; `serviceCode` passes the service's machine code through additively.\n */\nexport interface AssistantSessionExchangeErrorDetail {\n  readonly code: 'session_exchange_failed';\n  readonly status: number;\n  /** 5xx infrastructure failures may be retried; a refused exchange must not be — tickets are single-use. */\n  readonly retryable: boolean;\n  /** The service's machine code when the body carried one, e.g. `elevation_ticket_expired`. */\n  readonly serviceCode?: string;\n}\n\nexport class AssistantSessionExchangeError extends Error {\n  readonly detail: AssistantSessionExchangeErrorDetail;\n\n  constructor(detail: AssistantSessionExchangeErrorDetail, message: string) {\n    super(message);\n    this.name = 'AssistantSessionExchangeError';\n    this.detail = detail;\n  }\n\n  /**\n   * The narrowed sign-in refusal, when this failure is one. `elevation_ticket_expired` means the\n   * visitor took too long — re-prompt; `elevation_tenant_mismatch` means a client reached for a\n   * conversation it does not own — alert someone, never retry.\n   */\n  get elevationRefusal(): AssistantElevationRefusalCode | undefined {\n    const code = this.detail.serviceCode;\n    return code !== undefined &&\n      (ASSISTANT_ELEVATION_REFUSAL_CODES as readonly string[]).includes(code)\n      ? (code as AssistantElevationRefusalCode)\n      : undefined;\n  }\n}\n\n/** Never throws while reading the body — a proxy can answer with HTML instead of JSON. */\nasync function exchangeError(response: Response): Promise<AssistantSessionExchangeError> {\n  const body = (await response.json().catch(() => undefined)) as\n    | { readonly error?: unknown; readonly code?: unknown }\n    | undefined;\n  const serviceCode = typeof body?.code === 'string' ? body.code : undefined;\n  return new AssistantSessionExchangeError(\n    {\n      code: 'session_exchange_failed',\n      status: response.status,\n      // `elevation_unavailable` is a 503 an operator has to fix; retrying cannot help.\n      retryable: response.status >= 500 && serviceCode !== 'elevation_unavailable',\n      ...(serviceCode === undefined ? {} : { serviceCode }),\n    },\n    `Assistant session exchange failed (${response.status})`,\n  );\n}\n\nexport async function createAssistantSession(\n  input: CreateAssistantSessionInput,\n  dependencies: { readonly fetch?: typeof fetch } = {},\n): Promise<AssistantSession> {\n  if (input.signInTicket !== undefined && (input as { context?: unknown }).context !== undefined) {\n    // Mirrors resolveSessionSource: silently dropping what the service ignores would pick a\n    // meaning the developer did not intend.\n    throw new Error('context does not apply when spending a sign-in ticket');\n  }\n  const request = dependencies.fetch ?? fetch;\n  const serviceUrl = input.serviceUrl.replace(/\\/$/, '');\n  const credentials = Buffer.from(`${input.clientId}:${input.clientSecret}`, 'utf8').toString(\n    'base64',\n  );\n  const response = await request(`${serviceUrl}/v1/assistant/sessions`, {\n    method: 'POST',\n    headers: {\n      Authorization: `Basic ${credentials}`,\n      Accept: 'application/json',\n      'Content-Type': 'application/json',\n    },\n    body: JSON.stringify({\n      origin: input.origin,\n      user: input.user,\n      ...(input.signInTicket === undefined ? {} : { signInTicket: input.signInTicket }),\n      ...(input.claims ? { claims: input.claims } : {}),\n      ...(input.context ? { context: input.context } : {}),\n      ...(input.preferences ? { preferences: input.preferences } : {}),\n      ...(input.routing ? { routing: input.routing } : {}),\n    }),\n  });\n  // A fresh mint answers 201, an elevation 200; both are the same wire shape (ADR 0151).\n  if (!response.ok) throw await exchangeError(response);\n  return (await response.json()) as AssistantSession;\n}\n"],"mappings":";;;AA+EO,IAAM,oCAAoC;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAiBO,IAAM,gCAAN,cAA4C,MAAM;AAAA,EAC9C;AAAA,EAET,YAAY,QAA6C,SAAiB;AACxE,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,mBAA8D;AAChE,UAAM,OAAO,KAAK,OAAO;AACzB,WAAO,SAAS,UACb,kCAAwD,SAAS,IAAI,IACnE,OACD;AAAA,EACN;AACF;AAGA,eAAe,cAAc,UAA4D;AACvF,QAAM,OAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,MAAS;AAGzD,QAAM,cAAc,OAAO,MAAM,SAAS,WAAW,KAAK,OAAO;AACjE,SAAO,IAAI;AAAA,IACT;AAAA,MACE,MAAM;AAAA,MACN,QAAQ,SAAS;AAAA;AAAA,MAEjB,WAAW,SAAS,UAAU,OAAO,gBAAgB;AAAA,MACrD,GAAI,gBAAgB,SAAY,CAAC,IAAI,EAAE,YAAY;AAAA,IACrD;AAAA,IACA,sCAAsC,SAAS,MAAM;AAAA,EACvD;AACF;AAEA,eAAsB,uBACpB,OACA,eAAkD,CAAC,GACxB;AAC3B,MAAI,MAAM,iBAAiB,UAAc,MAAgC,YAAY,QAAW;AAG9F,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AACA,QAAM,UAAU,aAAa,SAAS;AACtC,QAAM,aAAa,MAAM,WAAW,QAAQ,OAAO,EAAE;AACrD,QAAM,cAAc,OAAO,KAAK,GAAG,MAAM,QAAQ,IAAI,MAAM,YAAY,IAAI,MAAM,EAAE;AAAA,IACjF;AAAA,EACF;AACA,QAAM,WAAW,MAAM,QAAQ,GAAG,UAAU,0BAA0B;AAAA,IACpE,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,eAAe,SAAS,WAAW;AAAA,MACnC,QAAQ;AAAA,MACR,gBAAgB;AAAA,IAClB;AAAA,IACA,MAAM,KAAK,UAAU;AAAA,MACnB,QAAQ,MAAM;AAAA,MACd,MAAM,MAAM;AAAA,MACZ,GAAI,MAAM,iBAAiB,SAAY,CAAC,IAAI,EAAE,cAAc,MAAM,aAAa;AAAA,MAC/E,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,MAC/C,GAAI,MAAM,UAAU,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,MAClD,GAAI,MAAM,cAAc,EAAE,aAAa,MAAM,YAAY,IAAI,CAAC;AAAA,MAC9D,GAAI,MAAM,UAAU,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,IACpD,CAAC;AAAA,EACH,CAAC;AAED,MAAI,CAAC,SAAS,GAAI,OAAM,MAAM,cAAc,QAAQ;AACpD,SAAQ,MAAM,SAAS,KAAK;AAC9B;","names":[]}

package/node_modules/@noodleseed/assistant/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/assistant",
-  "version": "1.19.0",
+  "version": "1.20.0",
   "description": "Embed the Noodle Seed customer-branded assistant in your web app with a Web Component, managed or custom React UI, DOM-free client, and backend session helper. Authoring and deploying the server is @noodleseed/one.",
   "license": "Apache-2.0",
   "repository": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/one",
-  "version": "0.127.2",
+  "version": "0.129.0",
   "private": false,
   "description": "Noodle CLI by Noodle Seed — author, run, and deploy declarative MCP servers. Embedding the assistant in your own web app is @noodleseed/assistant.",
   "license": "Apache-2.0",
@@ -103,6 +103,7 @@
     "@noodle-borg/knowledge-operations",
     "@noodle-borg/module",
     "@noodle-borg/module-audit",
+    "@noodle-borg/oauth-client-registry",
     "@noodle-borg/openapi-import",
     "@noodle-borg/plugin-distribution",
     "@noodle-borg/protocol",
@@ -235,7 +236,7 @@
     "@jitl/quickjs-wasmfile-release-sync": "0.32.0",
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
-    "@noodle-borg/agent-kit": "0.75.0",
+    "@noodle-borg/agent-kit": "0.76.0",
     "@noodle-borg/app-audit": "0.0.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/auth": "0.0.0",