@noodleseed/one 0.132.2 → 0.134.0

package/node_modules/@noodle-borg/agent-kit/dist/skill-authoring-refs.js

@@ -122,7 +122,7 @@ export function renderAuthoringWorkflowReference() {
         ']);',
         '```',
         '',
-        'Naming: connector operation names and tool names are lowercase-with-underscores. Map with `${args.field}` for tool/operation inputs and `${response.path}` for the response — the parsed JSON body is bound directly to `${response}`, so there is **no `.body` envelope**; use bracket syntax for array indices (`${response.data[0].id}`) — a dotted numeric index like `.0.` is invalid. Declare URL query parameters with the operation-level `query: ["arg"]` array, **not** inside `request` (which builds only the JSON body). `allowedOrigins` must be literal origin URLs (the SSRF allowlist); `baseUrl` may be a `variable(...)` that differs by env.',
+        'Naming: connector operation names and tool names are lowercase-with-underscores. Map with `${args.field}` for tool/operation inputs and `${response.path}` for the response — the parsed JSON body is bound directly to `${response}`, so there is **no `.body` envelope**; use bracket syntax for array indices (`${response.data[0].id}`) — a dotted numeric index like `.0.` is invalid. Declare URL query parameters with the operation-level `query: ["arg"]` array, **not** inside `request` (which builds only the JSON body). `allowedOrigins` is the SSRF allowlist: use literal exact origins, or the same `variable("STORE_ORIGIN")` as `baseUrl` when one reusable single-origin app is bound per business. A managed origin must resolve to one canonical bare HTTPS origin (exact loopback HTTP is the development exception); never use a wildcard, path, or tenant source edit.',
         '',
         'More: `auth.kind` is `bearer` | `apiKey` (needs `header`) | `clientCredentials` | `delegatedOAuth` | `delegatedSessionCookie` | `delegatedTokenExchange`. For client credentials use `{ kind: "clientCredentials", tokenUrl, clientId, clientSecret, scopes? }` (RFC-6749 grant); for a non-standard partner token endpoint add `profile: "custom"` with a `custom: { requestFormat, clientIdField, clientSecretField, tokenResponsePath, expirySource }` descriptor. Do not put credential headers in operation `headers`; use connector `auth`. Use `.compute(name, { input, output, run })` for a sandboxed transform; `provides:` (instead of `use:`) exposes a connector only to compute `callOperation`; and `noodle import openapi <file>` generates a connector from an OpenAPI spec.',
         '',

package/node_modules/@noodle-borg/agent-kit/dist/skill-embedded-assistant-ref.js

@@ -63,7 +63,7 @@ export function renderEmbeddedAssistantReference() {
         '}),',
         '```',
         '',
-        'Origins are exact: scheme, host, and optional port, with no path, trailing slash, or wildcard. Production origins must be HTTPS; plain HTTP is accepted only for loopback development origins (`http://localhost:<port>`, `http://127.0.0.1:<port>`). `noodle dev` serves the MCP project, not the embedding SaaS.',
+        'Origins are exact: scheme, host, and optional port, with no path, trailing slash, or wildcard. Production origins must be HTTPS; plain HTTP is accepted only for loopback development origins (`http://localhost:<port>`, `http://127.0.0.1:<port>`). `noodle dev` serves the MCP project, not the embedding SaaS. For a public surface it also prints a process-local Embed ID and script; mount that script on the separately running loopback website to test anonymous mint, chat, widgets, and confirmation. The local ID is ephemeral, while a hosted deploy provisions the stable ID behind durable admission counters.',
         '',
         '## Product workflow guidance',
         '',
@@ -82,6 +82,7 @@ export function renderEmbeddedAssistantReference() {
         '  publicWebsite({',
         '    origins: ["https://www.example.com"],',
         '    capabilities: [answerProductQuestion, requestDemo],',
+        '    instructions: "Help visitors understand the best workflow for their goal before inviting a next step.",',
         '  }),',
         '  authenticatedWebsite({',
         '    origins: ["https://app.example.com"],',
@@ -92,6 +93,8 @@ export function renderEmbeddedAssistantReference() {
         '',
         'At most one public surface (`public` or `mixed`) and at most one authenticated surface, and no origin may appear on two surfaces — otherwise "which projection is this request?" would be ambiguous. Each gets its own embed snippet, budget, and kill switch.',
         '',
+        'Keep shared, host-neutral product truth in `server.instructions`. Use a surface `instructions` value only for the voice, goals, boundaries, and next-step invitations appropriate to that front door. It is trimmed, non-empty, and at most 4,000 characters. The service injects it only after binding the exact website surface; it never enters MCP `initialize` or another assistant surface. For a public sales assistant, be consultative rather than pushy: deliver useful diagnosis or guidance before asking for contact details, and never put secrets in instructions.',
+        '',
         '`publicWebsite` is for a page with no signed-in user. The visitor is an **anonymous principal**, not an empty user: there is no `${user}`, no roles, no scopes, no customer routing, and no delegated credentials. A tool that needs identity — because it reads `${user}` or declares an `authorization` requirement — cannot be projected to a `public` surface, and the compiler says so.',
         '',
         'A public surface **must** declare `capabilities`: the exact positive allowlist it may reach. It is required by the type, and it is the whole externally reachable surface — a reviewer should read it in one screenful. Anything absent stays private, and a capability added to the server later is excluded until someone lists it. `authenticatedWebsite` may also take `capabilities` to narrow the in-app surface; omitted, it projects the whole server.',

package/node_modules/@noodle-borg/agent-kit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodle-borg/agent-kit",
-  "version": "0.79.0",
+  "version": "0.80.0",
   "license": "Apache-2.0",
   "type": "module",
   "engines": {

package/node_modules/@noodle-borg/assistant-gateway/dist/artifact-projection.d.ts

@@ -0,0 +1,21 @@
+import { type RuntimeArtifact } from '@noodle-borg/compiler';
+/**
+ * One surface's view of a deployment's artifact.
+ *
+ * The design choice worth preserving: this projects the **artifact object**, not the readers. A dozen
+ * call sites across the turn, interaction, and execution paths do `artifact.tools.find(...)`; handing
+ * each a filtered artifact means an unlisted tool is not hidden but *absent*, so none of them needs to
+ * know projection exists. Filtering the readers instead would be a dozen places to forget — and would
+ * leave the paths the compiler cannot close over (a `callServerTool` target, an elicitation branch)
+ * unguarded at runtime, which is exactly the gap this is the backstop for.
+ *
+ * It is deliberately a pure filter with no cache. "One projected view per session" means one *seam*,
+ * not memoisation; a `(deployment, surface)` memo can be added later if anything measures it.
+ */
+/** What the author selected for this surface, from the compiled manifest. */
+export interface SurfaceCapabilityRef {
+    readonly kind: 'tool' | 'resource' | 'prompt' | 'knowledge';
+    readonly name: string;
+}
+export declare function projectArtifactForSurface(artifact: RuntimeArtifact, capabilities: readonly SurfaceCapabilityRef[]): RuntimeArtifact;
+//# sourceMappingURL=artifact-projection.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-context.d.ts

@@ -0,0 +1,25 @@
+import type { InvocationContext } from '@noodle-borg/runtime';
+export interface AssistantContextPreferences {
+    readonly locale?: string | undefined;
+    readonly timeZone?: string | undefined;
+}
+interface ResolveInvocationContextInput {
+    readonly instant: Date;
+    readonly applicationPreference?: AssistantContextPreferences;
+    readonly clientHint?: AssistantContextPreferences;
+    readonly defaults?: AssistantContextPreferences;
+}
+export type AssistantContextPreferencesResult = {
+    readonly ok: true;
+    readonly value: AssistantContextPreferences;
+} | {
+    readonly ok: false;
+};
+/** Resolve presentation preferences independently from server-authoritative time. */
+export declare function resolveInvocationContext(input: ResolveInvocationContextInput): InvocationContext;
+/** Stable temporal grounding line shared by normal turns and interaction continuations. */
+export declare function invocationContextSystemMessage(context: InvocationContext): string;
+/** Validate and canonicalize a backend-supplied preference object at the session boundary. */
+export declare function parseAssistantContextPreferences(value: unknown): AssistantContextPreferencesResult;
+export {};
+//# sourceMappingURL=assistant-context.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-customer-issuer.d.ts

@@ -0,0 +1,3 @@
+/** Private delegated-credential identity namespace derived at the authenticated client boundary. */
+export declare function assistantCustomerIssuer(clientId: string): string;
+//# sourceMappingURL=assistant-customer-issuer.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-customer-routing.d.ts

@@ -0,0 +1,19 @@
+import type { CustomerEndpointPolicy, RuntimeArtifact } from '@noodle-borg/compiler';
+import { type ExecuteDeps, freezeCustomerRoutes } from '@noodle-borg/runtime';
+import type { AssistantSessionRecord } from './assistant-store.js';
+export type AssistantCustomerRouting = Readonly<Record<string, string>>;
+export type AssistantCustomerRoutingResult = {
+    readonly ok: true;
+    readonly customerRouting?: AssistantCustomerRouting;
+} | {
+    readonly ok: false;
+    readonly endpoint?: string;
+};
+/** Validate and canonicalize private customer endpoint authority supplied by an embed backend. */
+export declare function parseAssistantCustomerRouting(declarations: Readonly<Record<string, CustomerEndpointPolicy>> | undefined, input: unknown): AssistantCustomerRoutingResult;
+/** Reconstruct all private assistant execution authority from one authenticated session snapshot. */
+export declare function withAssistantSessionExecutionAuthority<T extends ExecuteDeps>(deps: T, artifact: Pick<RuntimeArtifact, 'customerEndpoints'>, session: Pick<AssistantSessionRecord, 'clientId' | 'customerRouting'>): T & {
+    readonly customerIssuer: string;
+    readonly customerRoutes?: ReturnType<typeof freezeCustomerRoutes>;
+};
+//# sourceMappingURL=assistant-customer-routing.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-guide.d.ts

@@ -0,0 +1,39 @@
+import type { ArtifactTool, RuntimeArtifact } from '@noodle-borg/compiler';
+import { type ToolAuthorizationCaller } from '@noodle-borg/protocol';
+import { type SurfaceCapabilityRef } from './artifact-projection.js';
+/** Model-context budget for the embedded assistant's compact product workflow projection. */
+export declare const ASSISTANT_GUIDE_MAX_BYTES: number;
+export type AssistantGuideUnavailableReason = 'package_unavailable' | 'no_complete_workflow' | 'context_too_large';
+export type AssistantGuideProjection = {
+    readonly status: 'ready';
+    readonly guide: {
+        readonly content: string;
+        readonly workflowIds: readonly string[];
+        readonly byteLength: number;
+    };
+} | {
+    readonly status: 'unavailable';
+    readonly reason: AssistantGuideUnavailableReason;
+};
+/**
+ * Select the exact deployment tools an embedded model may see for this turn.
+ *
+ * A mixed anonymous surface deliberately advertises only its declared tools so the existing elevation
+ * interceptor can turn an attempted gated call into a sign-in offer. The selector performs that projection
+ * itself: callers cannot opt into sign-in offers without supplying the surface capability boundary. Every
+ * other caller gets the normal authorization filter. App-only tools never enter model tools or guidance.
+ */
+export declare function selectAssistantModelTools(artifact: RuntimeArtifact, caller: (ToolAuthorizationCaller & {
+    readonly identityKind?: string;
+}) | undefined, options?: {
+    readonly anonymousSignInOfferSurface?: readonly SurfaceCapabilityRef[];
+}): readonly ArtifactTool[];
+/**
+ * Build bounded product guidance from structured App Package data, never from rendered host files.
+ * Workflows are atomic: if one step is unavailable to this model, the entire workflow is omitted.
+ */
+export declare function projectAssistantGuide(input: {
+    readonly appPackage: unknown;
+    readonly modelTools: readonly ArtifactTool[];
+}): AssistantGuideProjection;
+//# sourceMappingURL=assistant-guide.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-interaction-state.d.ts

@@ -0,0 +1,181 @@
+import type { InvocationContext } from '@noodle-borg/runtime';
+export declare const DEFAULT_MAX_PENDING_INTERACTIONS_PER_SESSION = 8;
+export declare const ASSISTANT_INTERACTION_OUTCOME_RETENTION_MS: number;
+/** Recovery grace for an in-flight action before its outcome becomes unknowable and payload is scrubbed. */
+export declare const ASSISTANT_INTERACTION_EXECUTING_GRACE_MS: number;
+export type AssistantInteractionKind = 'confirmation' | 'input';
+export type AssistantInteractionStatus = 'pending' | 'executing' | 'succeeded' | 'failed' | 'declined' | 'cancelled';
+export type AssistantInteractionPublicScalar = string | number | boolean | null;
+export interface AssistantInteractionPublicArray extends ReadonlyArray<AssistantInteractionPublicValue> {
+    readonly [index: number]: AssistantInteractionPublicValue;
+}
+export interface AssistantInteractionPublicObject {
+    readonly [key: string]: AssistantInteractionPublicValue;
+}
+export type AssistantInteractionPublicValue = AssistantInteractionPublicScalar | AssistantInteractionPublicArray | AssistantInteractionPublicObject;
+/** Compact replay-safe data only. Exact connector output and errors must never enter this shape. */
+export interface AssistantInteractionPublicOutcome {
+    readonly code: string;
+    readonly summary: string;
+    readonly details?: Readonly<Record<string, AssistantInteractionPublicScalar>>;
+    readonly result?: AssistantInteractionPublicValue;
+}
+export declare const ASSISTANT_INTERACTION_UNKNOWN_OUTCOME: AssistantInteractionPublicOutcome;
+interface AssistantInteractionCommon {
+    readonly id: string;
+    readonly sessionId: string;
+    readonly deploymentId: string;
+    /** Immutable proposal-time snapshot reused when the interaction resumes. */
+    readonly context?: InvocationContext;
+    /** Set when a terminal interaction's exact private payload has been removed. */
+    readonly payloadScrubbedAt?: string;
+    readonly createdAt: string;
+    readonly expiresAt: string;
+}
+interface AssistantConfirmationInteractionPayload {
+    readonly kind: 'confirmation';
+    readonly tool: string;
+    /** Exact validated arguments. Store-internal; renderers receive a separate review projection. */
+    readonly arguments: unknown;
+    /** Prepared post-elicitation execution state. Server-internal and absent on legacy proposals. */
+    readonly continuation?: unknown;
+    /** Complete, already-redacted review projection retained so a lost response can be replayed. */
+    readonly review?: unknown;
+}
+interface AssistantInputInteractionPayload {
+    readonly kind: 'input';
+    readonly tool: string;
+    readonly message: string;
+    readonly requestedSchema: Readonly<Record<string, unknown>>;
+    /** Exact runtime continuation. Store-internal and never part of the public interaction event. */
+    readonly continuation: unknown;
+}
+export interface AssistantPendingInteractionState {
+    readonly status: 'pending';
+}
+export interface AssistantExecutingInteractionState {
+    readonly status: 'executing';
+    readonly claimedAt: string;
+}
+export interface AssistantSucceededInteractionState {
+    readonly status: 'succeeded';
+    readonly claimedAt: string;
+    readonly completedAt: string;
+    readonly publicOutcome: AssistantInteractionPublicOutcome;
+}
+export interface AssistantFailedInteractionState {
+    readonly status: 'failed';
+    readonly claimedAt: string;
+    readonly completedAt: string;
+    readonly publicOutcome: AssistantInteractionPublicOutcome;
+}
+export interface AssistantDeclinedInteractionState {
+    readonly status: 'declined';
+    readonly completedAt: string;
+    readonly publicOutcome: AssistantInteractionPublicOutcome;
+}
+export interface AssistantCancelledInteractionState {
+    readonly status: 'cancelled';
+    readonly completedAt: string;
+    readonly publicOutcome: AssistantInteractionPublicOutcome;
+}
+export type AssistantInteractionState = AssistantPendingInteractionState | AssistantExecutingInteractionState | AssistantSucceededInteractionState | AssistantFailedInteractionState | AssistantDeclinedInteractionState | AssistantCancelledInteractionState;
+export type AssistantTerminalInteractionState = AssistantSucceededInteractionState | AssistantFailedInteractionState | AssistantDeclinedInteractionState | AssistantCancelledInteractionState;
+export type AssistantConfirmationInteractionRecord = AssistantInteractionCommon & AssistantConfirmationInteractionPayload & AssistantInteractionState;
+export type AssistantInputInteractionRecord = AssistantInteractionCommon & AssistantInputInteractionPayload & AssistantInteractionState;
+export type AssistantInteractionRecord = AssistantConfirmationInteractionRecord | AssistantInputInteractionRecord;
+export type AssistantPendingConfirmationInteractionRecord = AssistantInteractionCommon & AssistantConfirmationInteractionPayload & AssistantPendingInteractionState;
+export type AssistantPendingInputInteractionRecord = AssistantInteractionCommon & AssistantInputInteractionPayload & AssistantPendingInteractionState;
+export type AssistantPendingInteractionRecord = AssistantPendingConfirmationInteractionRecord | AssistantPendingInputInteractionRecord;
+interface AssistantInteractionCreateCommon {
+    readonly sessionId: string;
+    readonly deploymentId: string;
+    readonly context?: InvocationContext;
+    /** Omit only when the persistence adapter should stamp its own proposal time. */
+    readonly createdAt?: string;
+    readonly expiresAt: string;
+}
+export type AssistantConfirmationInteractionCreateInput = AssistantInteractionCreateCommon & Omit<AssistantConfirmationInteractionPayload, never>;
+export type AssistantInputInteractionCreateInput = AssistantInteractionCreateCommon & Omit<AssistantInputInteractionPayload, never>;
+export type AssistantInteractionCreateInput = AssistantConfirmationInteractionCreateInput | AssistantInputInteractionCreateInput;
+export interface AssistantInteractionScope {
+    readonly id: string;
+    readonly sessionId: string;
+    readonly deploymentId: string;
+    readonly now: Date;
+}
+export type AssistantInteractionClaimResult = {
+    readonly disposition: 'claimed';
+    readonly interaction: AssistantInteractionRecord & AssistantExecutingInteractionState;
+} | {
+    readonly disposition: 'replay';
+    readonly interaction: AssistantInteractionRecord;
+} | {
+    readonly disposition: 'unavailable';
+};
+export type AssistantInteractionCompletion = {
+    readonly status: 'succeeded' | 'failed';
+    readonly publicOutcome: AssistantInteractionPublicOutcome;
+} | {
+    readonly status: 'declined' | 'cancelled';
+    readonly publicOutcome?: AssistantInteractionPublicOutcome;
+};
+export type AssistantInteractionCompletionResult = {
+    readonly disposition: 'completed';
+    readonly interaction: AssistantInteractionRecord;
+} | {
+    readonly disposition: 'replay';
+    readonly interaction: AssistantInteractionRecord;
+} | {
+    readonly disposition: 'conflict';
+    readonly interaction: AssistantInteractionRecord;
+} | {
+    readonly disposition: 'unavailable';
+};
+export type AssistantInteractionTransitionNext = Omit<AssistantConfirmationInteractionCreateInput, 'sessionId' | 'deploymentId' | 'createdAt'> | Omit<AssistantInputInteractionCreateInput, 'sessionId' | 'deploymentId' | 'createdAt'>;
+/**
+ * Atomically records that an executing interaction handed control to one new pending interaction.
+ * The store owns the child identity and persists it in the parent's replay-safe public outcome.
+ */
+export interface AssistantInteractionTransitionInput extends AssistantInteractionScope {
+    readonly publicOutcome: AssistantInteractionPublicOutcome;
+    readonly next: AssistantInteractionTransitionNext;
+}
+export type AssistantInteractionTransitionResult = {
+    readonly disposition: 'transitioned';
+    readonly interaction: AssistantInteractionRecord & AssistantSucceededInteractionState;
+    readonly next: AssistantPendingInteractionRecord;
+} | {
+    readonly disposition: 'replay';
+    readonly interaction: AssistantInteractionRecord;
+} | {
+    readonly disposition: 'conflict';
+    readonly interaction: AssistantInteractionRecord;
+} | {
+    readonly disposition: 'unavailable';
+};
+export declare class AssistantInteractionCapacityError extends Error {
+    readonly code: "pending_interaction_limit";
+    constructor();
+}
+export declare function createPendingInteraction(id: string, input: AssistantConfirmationInteractionCreateInput): AssistantPendingConfirmationInteractionRecord;
+export declare function createPendingInteraction(id: string, input: AssistantInputInteractionCreateInput): AssistantPendingInputInteractionRecord;
+export declare function executingInteraction(interaction: AssistantInteractionRecord, claimedAt: Date): AssistantInteractionRecord & AssistantExecutingInteractionState;
+export declare function completedInteraction(interaction: AssistantInteractionRecord, completion: AssistantInteractionCompletion, completedAt: Date): AssistantInteractionRecord & AssistantTerminalInteractionState;
+export declare function transitionedInteractions(interaction: AssistantInteractionRecord, input: AssistantInteractionTransitionInput, nextId: string): {
+    readonly interaction: AssistantInteractionRecord & AssistantSucceededInteractionState;
+    readonly next: AssistantPendingInteractionRecord;
+};
+export declare function isTerminalInteraction(interaction: AssistantInteractionRecord): interaction is AssistantInteractionRecord & AssistantTerminalInteractionState;
+/**
+ * Pending proposals expire at their decision deadline. Executing/unknown work keeps a tombstone, and a
+ * terminal public outcome remains replayable for a bounded reconciliation window after completion.
+ */
+export declare function isPrunableInteraction(interaction: AssistantInteractionRecord, now: Date): boolean;
+export declare function shouldExpireStrandedExecutingInteraction(interaction: AssistantInteractionRecord, now: Date): interaction is AssistantInteractionRecord & AssistantExecutingInteractionState;
+/** Preserve a non-retryable unknown outcome without retaining its exact private payload. */
+export declare function expireStrandedExecutingInteraction(interaction: AssistantInteractionRecord & AssistantExecutingInteractionState, scrubbedAt: Date): AssistantInteractionRecord & AssistantFailedInteractionState;
+export declare function cloneInteraction<T extends AssistantInteractionRecord>(interaction: T): T;
+export declare function normalizePublicOutcome(input: AssistantInteractionPublicOutcome): AssistantInteractionPublicOutcome;
+export {};
+//# sourceMappingURL=assistant-interaction-state.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-interactive.d.ts

@@ -0,0 +1,99 @@
+import { type RuntimeArtifact } from '@noodle-borg/compiler';
+import type { AuditSink } from '@noodle-borg/module';
+import type { CallerIdentity, ConfirmationPreparationResult, ExecuteDeps, InteractiveExecutionResult, InvocationContext, PreparedToolContinuation, ToolContinuation, ToolPreparationContinuation } from '@noodle-borg/runtime';
+import { type AssistantInteractionRecord, type AssistantInteractionTransitionNext, type AssistantPendingConfirmationInteractionRecord, type AssistantPendingInputInteractionRecord } from './assistant-interaction-state.js';
+import type { AssistantSessionRecord, AssistantStore } from './assistant-store.js';
+/**
+ * Single-use confirmation lifetime, owned by the admission envelope rather than restated here. The
+ * value is unchanged; what changes is that lowering `confirmationTtlMs` now does something, where
+ * before the envelope documented a bound this constant silently outranked.
+ */
+export declare const ASSISTANT_INTERACTION_TTL_MS: number;
+type InputRequired = Extract<InteractiveExecutionResult, {
+    readonly status: 'input_required';
+}> | Extract<ConfirmationPreparationResult, {
+    readonly status: 'input_required';
+}>;
+export type AssistantToolDispatch = {
+    readonly kind: 'event';
+    readonly event: 'tool_proposed' | 'input_requested' | 'error';
+    readonly data: Readonly<Record<string, unknown>>;
+} | {
+    readonly kind: 'tool_result';
+    readonly output: unknown;
+};
+/** Apply the same confirmation and suspend/resume policy to one model-proposed tool call. */
+export declare function dispatchAssistantTool(input: {
+    readonly artifact: RuntimeArtifact;
+    readonly tool: RuntimeArtifact['tools'][number];
+    readonly arguments: unknown;
+    readonly executeDeps: ExecuteDeps;
+    readonly caller: CallerIdentity;
+    readonly context: InvocationContext;
+    readonly session: AssistantSessionRecord;
+    readonly store: AssistantStore;
+    readonly audit: AuditSink;
+    readonly now: () => Date;
+    readonly onToolStarted?: () => void;
+}): Promise<AssistantToolDispatch>;
+/** Persist a complete, reviewable proposal and its server-only prepared execution state. */
+export declare function createAssistantConfirmationInteraction(input: {
+    readonly store: AssistantStore;
+    readonly audit: AuditSink;
+    readonly session: AssistantSessionRecord;
+    readonly context: InvocationContext;
+    readonly tool: string;
+    readonly arguments: unknown;
+    readonly review: unknown;
+    readonly continuation: PreparedToolContinuation;
+    readonly now: Date;
+}): Promise<AssistantPendingConfirmationInteractionRecord>;
+export declare function assistantConfirmationTransition(input: {
+    readonly context: InvocationContext;
+    readonly tool: string;
+    readonly arguments: unknown;
+    readonly review: unknown;
+    readonly continuation: PreparedToolContinuation;
+    readonly now: Date;
+}): Extract<AssistantInteractionTransitionNext, {
+    readonly kind: 'confirmation';
+}>;
+export declare function assistantConfirmationProposalData(interaction: AssistantPendingConfirmationInteractionRecord): Readonly<Record<string, unknown>>;
+/** Persist an opaque input interaction and audit only scalar metadata about the suspension. */
+export declare function createAssistantInputInteraction(input: {
+    readonly store: AssistantStore;
+    readonly audit: AuditSink;
+    readonly session: AssistantSessionRecord;
+    readonly context: InvocationContext;
+    readonly required: InputRequired;
+    readonly now: Date;
+}): Promise<AssistantPendingInputInteractionRecord>;
+export declare function assistantInputTransition(input: {
+    readonly context: InvocationContext;
+    readonly required: InputRequired;
+    readonly now: Date;
+}): Extract<AssistantInteractionTransitionNext, {
+    readonly kind: 'input';
+}>;
+/** Emit one tenant-scoped, scalar-only interaction audit record. */
+export declare function auditAssistantInteraction(input: {
+    readonly audit: AuditSink;
+    readonly session: AssistantSessionRecord;
+    readonly interaction: AssistantInteractionRecord;
+    readonly eventType: 'assistant.interaction.proposed' | 'assistant.interaction.resolved' | 'assistant.interaction.execution';
+    readonly decision: 'allow' | 'deny';
+    readonly httpStatus: number;
+    readonly status: string;
+    readonly action?: 'accept' | 'decline' | 'cancel';
+    readonly reasonCode?: string;
+}): Promise<void>;
+export declare function assistantInteractionTool(interaction: AssistantInteractionRecord): string | undefined;
+/** The store is the only trust boundary allowed to deserialize this runtime continuation. */
+export declare function assistantToolContinuation(interaction: Extract<AssistantInteractionRecord, {
+    readonly kind: 'input';
+}>): ToolContinuation | ToolPreparationContinuation;
+export declare function assistantPreparedToolContinuation(interaction: Extract<AssistantInteractionRecord, {
+    readonly kind: 'confirmation';
+}>): PreparedToolContinuation | undefined;
+export {};
+//# sourceMappingURL=assistant-interactive.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-interactive.js

@@ -1,4 +1,4 @@
-import { ADMISSION_DEFAULTS } from '@noodle-borg/admission-limits';
+import { ADMISSION_DEFAULTS } from '@noodle-borg/admission-limits/portable';
 import { requiresToolConfirmation } from '@noodle-borg/compiler';
 import { evaluateToolAuthorization } from '@noodle-borg/protocol';
 import { executeToolInteractive, prepareToolForConfirmation } from '@noodle-borg/runtime';

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-presentation.d.ts

@@ -0,0 +1,35 @@
+import { type ConfirmationReview } from '@noodle-borg/runtime';
+type JsonSchema = Readonly<Record<string, unknown>>;
+type AssistantPresentationScalar = string | number | boolean | null;
+interface AssistantPresentationArray extends ReadonlyArray<AssistantPresentationValue> {
+}
+interface AssistantPresentationObject {
+    readonly [key: string]: AssistantPresentationValue;
+}
+export type AssistantPresentationValue = AssistantPresentationScalar | AssistantPresentationArray | AssistantPresentationObject;
+type ArgumentReview = {
+    readonly ok: true;
+    readonly value: unknown;
+    readonly reviewSchema: JsonSchema;
+} | {
+    readonly ok: false;
+    readonly code: 'arguments_not_presentable';
+};
+/** Derive a client-visible review while retaining the exact validated arguments only in the store. */
+export declare function assistantArgumentReview(schema: JsonSchema, value: unknown): ArgumentReview;
+/** Present the original tool input plus every elicited value that will affect prepared execution. */
+export declare function assistantPreparedArgumentReview(schema: JsonSchema, review: ConfirmationReview): ArgumentReview;
+/** Attach portable display metadata to the already-persisted review JSON without changing execution input. */
+export declare function assistantConfirmationReview(input: {
+    readonly title?: string;
+    readonly description: string;
+    readonly review: Extract<ArgumentReview, {
+        readonly ok: true;
+    }>;
+}): Readonly<Record<string, unknown>>;
+/** Decode enriched and legacy persisted reviews into the additive public proposal shape. */
+export declare function assistantConfirmationProposal(review: unknown): Readonly<Record<string, unknown>>;
+/** Redact and bound execution output before SSE, history, audit, or model narration. */
+export declare function assistantSafeOutput(schema: JsonSchema | undefined, value: unknown): AssistantPresentationValue;
+export {};
+//# sourceMappingURL=assistant-presentation.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-sensitive-values.d.ts

@@ -0,0 +1,3 @@
+/** Catch common credential shapes even when a connector returns them under an innocuous key. */
+export declare function isCredentialShapedAssistantText(value: string): boolean;
+//# sourceMappingURL=assistant-sensitive-values.d.ts.map