@noodleseed/one 0.132.2 → 0.134.0

package/node_modules/@noodle-borg/admission-limits/dist/counter-store.d.ts

@@ -0,0 +1,71 @@
+/**
+ * The durable daily-counter port.
+ *
+ * Types are declared here rather than imported from the service's policy layer on purpose: this package
+ * must not reach into a commercial carve-out cluster, and the shape is small enough that an independent
+ * declaration is cheaper than the coupling (the same precedent `@noodle-borg/module` and
+ * `@noodle-borg/transport-http` set for `AccessMode`).
+ */
+export interface CounterRequest {
+    /** Stable identity of the thing being bounded — a surface's embed id, never a raw address. */
+    readonly key: string;
+    /** Ceiling for this key on this UTC day. Zero means the surface is switched off. */
+    readonly limit: number;
+    /** Units to consume; a mint and a turn are both 1 today. */
+    readonly amount?: number;
+    /**
+     * Which window the ceiling belongs to. Solvency bounds are daily (the default); the per-address
+     * fairness tier is hourly, so a visitor's accidental burst forgives itself within the same visit.
+     */
+    readonly window?: 'day' | 'hour';
+}
+export interface CounterOutcome {
+    readonly allowed: boolean;
+    /** Units used after this call (unchanged when the call was denied). */
+    readonly used: number;
+    readonly limit: number;
+    /** Start of the window after the one this counter belongs to. */
+    readonly resetAt: Date;
+}
+export interface DailyCounterStore {
+    /**
+     * Atomically consume against a key's daily budget. Must be safe under concurrency: N simultaneous
+     * callers on one key may never push `used` past `limit`, because that is the whole point of the
+     * counter.
+     */
+    consume(request: CounterRequest, now: Date): Promise<CounterOutcome>;
+    /** Usage without consuming, for operator reads. */
+    peek(key: string, now: Date): Promise<number>;
+    /**
+     * Whether this store survives a process restart and is shared across service instances. The public
+     * mint route refuses to serve when this is false: a per-process counter silently resets a customer's
+     * spend ceiling on every deploy, restart, and scale-out, which is indistinguishable from having no
+     * ceiling at all.
+     */
+    readonly durable: boolean;
+}
+/** Counters roll at UTC midnight — a fixed boundary no tenant timezone can shift. */
+export declare function dayKey(now: Date): string;
+/**
+ * Tier 3 rolls hourly rather than daily. A fairness bound wants a window short enough that an
+ * accidental burst forgives itself within the same visit, where a solvency bound wants the whole day.
+ */
+export declare function hourKey(now: Date): string;
+/**
+ * The row identity for a request, and the reason the hour is folded into the **key** rather than the day.
+ *
+ * The counter table's `day` column is a real `date`, so an hour-resolution value cannot go there: it
+ * fails at the database with `invalid input syntax for type date`, which is exactly how the per-address
+ * tier took production down after passing every test — the shared suite only exercised the daily window
+ * and the route tests used a mocked counter, so no test ever put an hourly request through real SQL.
+ *
+ * Partitioning by date and distinguishing the hour inside the key keeps both windows in one table with
+ * no migration and no ambiguity: a daily row and an hourly row can never collide, because the hourly key
+ * carries a suffix the daily key cannot produce.
+ */
+export declare function counterRow(request: Pick<CounterRequest, 'key' | 'window'>, now: Date): {
+    readonly key: string;
+    readonly day: string;
+};
+export declare function nextReset(now: Date, window?: 'day' | 'hour'): Date;
+//# sourceMappingURL=counter-store.d.ts.map

package/node_modules/@noodle-borg/admission-limits/dist/envelope.d.ts

@@ -0,0 +1,67 @@
+/**
+ * The public-surface safety envelope (ADR 0201 §7, amended 2026-08-12).
+ *
+ * Two ideas are deliberately separate here:
+ *
+ * - **Structural maximums** are the ceiling neither app code nor managed config may raise. They exist
+ *   because a public surface faces the open internet, and "the author configured it" is not a reason to
+ *   trust a larger bound.
+ * - **Operator defaults** are what a surface gets when nobody says otherwise. Operators may lower any of
+ *   them, and lowering the daily caps to zero is the kill switch — one mechanism, not two.
+ *
+ * `clamp()` is the only way to build an envelope, so raising a bound is unrepresentable rather than
+ * merely discouraged.
+ */
+export interface AdmissionEnvelope {
+    /** Longest visitor message accepted, in characters. */
+    readonly messageCharacters: number;
+    /** Model turns one session may run before it must be replaced. */
+    readonly turnsPerSession: number;
+    /** Model steps inside a single turn (the agent loop bound). */
+    readonly modelStepsPerTurn: number;
+    /** Tool calls inside a single turn, across all steps. */
+    readonly toolCallsPerTurn: number;
+    /** Inputs or confirmations that may be outstanding on one session at a time. */
+    readonly pendingInteractions: number;
+    /** Lifetime of a single-use confirmation, in milliseconds. */
+    readonly confirmationTtlMs: number;
+    /** Idle timeout before a session is unusable, in milliseconds. */
+    readonly sessionIdleMs: number;
+    /** Absolute session lifetime regardless of activity, in milliseconds. */
+    readonly sessionAbsoluteMs: number;
+    /**
+     * Model turns this surface may run per UTC day. This is the solvency bound: it caps what a bot can
+     * spend of the customer's model budget without depending on client-IP attribution.
+     */
+    readonly turnsPerDay: number;
+    /**
+     * Sessions this surface may mint per UTC day. Turns alone are not enough — a bot that only mints
+     * writes durable session rows forever while spending nothing.
+     */
+    readonly mintsPerDay: number;
+    /**
+     * Sessions one source address may mint per hour, and turns it may run (admission tier 3).
+     *
+     * A different question from the daily caps, which is why it is a separate tier rather than a tighter
+     * number: the per-surface cap governs **solvency** — the customer's model spend is bounded whatever
+     * happens — while this governs **fairness**, so one visitor cannot consume the surface's whole day
+     * before anybody else arrives. Losing this tier loses fairness and never solvency, which is why the
+     * pilot shipped without it.
+     */
+    readonly mintsPerAddressHour: number;
+    readonly turnsPerAddressHour: number;
+}
+/** Ceilings. Nothing may exceed these, whatever the manifest or managed config asks for. */
+export declare const ADMISSION_MAXIMUM: AdmissionEnvelope;
+/** What a surface gets when nobody configures it. Conservative by intent for a first pilot. */
+export declare const ADMISSION_DEFAULTS: AdmissionEnvelope;
+/**
+ * Build an envelope from an operator request. Every field is clamped to {@link ADMISSION_MAXIMUM};
+ * a request below the ceiling is honoured exactly, and a request above it is silently reduced rather
+ * than rejected, so a stale or over-eager configuration degrades to safe instead of failing a surface
+ * closed at request time. Zero is meaningful for the daily caps and is preserved.
+ */
+export declare function clamp(requested?: Partial<AdmissionEnvelope>): AdmissionEnvelope;
+/** A surface whose daily budget is exhausted or switched off serves nobody until it is raised. */
+export declare function isDisabled(envelope: AdmissionEnvelope): boolean;
+//# sourceMappingURL=envelope.d.ts.map

package/node_modules/@noodle-borg/admission-limits/dist/in-memory-counter-store.d.ts

@@ -0,0 +1,15 @@
+import { type CounterOutcome, type CounterRequest, type DailyCounterStore } from './counter-store.js';
+/**
+ * Process-local counters for local development and tests.
+ *
+ * `durable` is false, and that is load-bearing rather than informational: the public mint route refuses
+ * to serve a surface backed by this store, because a ceiling that resets on every restart and is not
+ * shared across instances would look like protection while providing none.
+ */
+export declare class InMemoryDailyCounterStore implements DailyCounterStore {
+    #private;
+    readonly durable = false;
+    consume(request: CounterRequest, now: Date): Promise<CounterOutcome>;
+    peek(key: string, now: Date): Promise<number>;
+}
+//# sourceMappingURL=in-memory-counter-store.d.ts.map

package/node_modules/@noodle-borg/admission-limits/dist/portable.d.ts

@@ -0,0 +1,6 @@
+/** Admission contracts and in-memory adapters safe for the published CLI runtime. */
+export * from './client-address.js';
+export * from './counter-store.js';
+export * from './envelope.js';
+export * from './in-memory-counter-store.js';
+//# sourceMappingURL=portable.d.ts.map

package/node_modules/@noodle-borg/admission-limits/dist/portable.js

@@ -0,0 +1,6 @@
+/** Admission contracts and in-memory adapters safe for the published CLI runtime. */
+export * from './client-address.js';
+export * from './counter-store.js';
+export * from './envelope.js';
+export * from './in-memory-counter-store.js';
+//# sourceMappingURL=portable.js.map

package/node_modules/@noodle-borg/admission-limits/package.json

@@ -12,6 +12,14 @@
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
+    },
+    "./portable": {
+      "types": "./dist/portable.d.ts",
+      "import": "./dist/portable.js"
+    },
+    "./postgres": {
+      "types": "./dist/postgres.d.ts",
+      "import": "./dist/postgres.js"
     }
   },
   "files": [