@noodleseed/one 0.132.2 → 0.134.0

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-store.d.ts

@@ -0,0 +1,226 @@
+import type { ArtifactServer } from '@noodle-borg/compiler';
+import type { CallerIdentity } from '@noodle-borg/runtime';
+import type { AssistantContextPreferences } from './assistant-context.js';
+import type { AssistantCustomerRouting } from './assistant-customer-routing.js';
+import { type AssistantInteractionClaimResult, type AssistantInteractionCompletionResult, type AssistantInteractionCreateInput, type AssistantInteractionRecord, type AssistantInteractionScope, type AssistantInteractionTransitionInput, type AssistantInteractionTransitionResult, type AssistantPendingConfirmationInteractionRecord, type AssistantPendingInputInteractionRecord } from './assistant-interaction-state.js';
+import type { TenantRef } from './tenant-ref.js';
+export { ASSISTANT_INTERACTION_EXECUTING_GRACE_MS, ASSISTANT_INTERACTION_OUTCOME_RETENTION_MS, type AssistantConfirmationInteractionRecord, AssistantInteractionCapacityError, type AssistantInteractionClaimResult, type AssistantInteractionCompletion, type AssistantInteractionCompletionResult, type AssistantInteractionCreateInput, type AssistantInteractionKind, type AssistantInteractionPublicArray, type AssistantInteractionPublicObject, type AssistantInteractionPublicOutcome, type AssistantInteractionPublicValue, type AssistantInteractionRecord, type AssistantInteractionScope, type AssistantInteractionStatus, type AssistantInteractionTransitionInput, type AssistantInteractionTransitionNext, type AssistantInteractionTransitionResult, type AssistantPendingConfirmationInteractionRecord, type AssistantPendingInputInteractionRecord, DEFAULT_MAX_PENDING_INTERACTIONS_PER_SESSION, } from './assistant-interaction-state.js';
+export declare const ASSISTANT_SESSION_IDLE_MS: number;
+/**
+ * The only `server.assistant` fields that may reach a browser.
+ *
+ * It lives here, beside the record it types, so the allowlist and the shape it produces cannot drift
+ * apart: the projection in `packages/service` iterates this same list. A denylist here would be a type
+ * that lies — it once admitted `sessionClaims` key names, and would now admit the public surface's
+ * capability allowlist — so growth in the manifest must not be able to grow the browser payload.
+ */
+export declare const ASSISTANT_BROWSER_UI_FIELDS: readonly ["layout", "behavior", "labels", "presentation", "suggestedPrompts", "privacyUrl", "termsUrl", "locale", "direction"];
+export interface AssistantClientRecord {
+    readonly id: string;
+    readonly name: string;
+    readonly tenant: TenantRef;
+    readonly deploymentId: string;
+    readonly allowedOrigins: readonly string[];
+    readonly secretHash: string;
+    readonly createdAt: string;
+    readonly revokedAt?: string;
+}
+export interface AssistantSessionRecord {
+    readonly id: string;
+    readonly tokenHash: string;
+    readonly clientId: string;
+    readonly tenant: TenantRef;
+    readonly deploymentId: string;
+    readonly origin: string;
+    readonly caller: CallerIdentity;
+    /** Canonical customer endpoint routes; private session authority, never caller or response data. */
+    readonly customerRouting?: AssistantCustomerRouting;
+    readonly context?: Readonly<Record<string, string | number | boolean | null>>;
+    readonly preferences?: AssistantContextPreferences;
+    readonly configuration?: {
+        readonly branding?: ArtifactServer['branding'];
+        readonly assistant?: Pick<NonNullable<ArtifactServer['assistant']>, (typeof ASSISTANT_BROWSER_UI_FIELDS)[number]>;
+    };
+    /**
+     * The public surface this session was minted from, when it was minted anonymously from a page rather
+     * than exchanged through a customer backend. It is the key admission spends against, so it stays on
+     * the record for the session's whole life — including after a mixed surface elevates the caller, whose
+     * turns still belong to the surface that admitted them.
+     */
+    readonly publicEmbedId?: string;
+    /**
+     * The intercepted tool a successful elevation may re-attempt as the session's first elevated
+     * turn. Armed only in the same statement that elevates; consumed (or mooted by the visitor's
+     * first typed turn) exactly once via {@link AssistantStore.consumePendingResume}.
+     */
+    readonly pendingResume?: AssistantPendingResume;
+    readonly createdAt: string;
+    readonly expiresAt: string;
+    readonly absoluteExpiresAt: string;
+    readonly history: AssistantHistoryMessage[];
+    /**
+     * Model turns already spent. Durable and separate from `history`, which truncates to the last twelve
+     * messages: history is a prompt-window trim, never a bound.
+     */
+    readonly turnCount: number;
+}
+/** The intercepted call a spent sign-in ticket left pending, resumable at most once. */
+export interface AssistantPendingResume {
+    readonly tool: string;
+    readonly requestedAt: string;
+}
+/** One consumed turn slot, or the refusal that the session has spent its allowance. */
+export interface AssistantTurnConsumption {
+    readonly allowed: boolean;
+    readonly turnCount: number;
+}
+export interface AssistantHistoryMessage {
+    readonly role: 'user' | 'assistant';
+    readonly content: string;
+}
+export type AssistantSessionElevation = {
+    readonly ok: true;
+    readonly session: AssistantSessionRecord;
+    /** The replacement token. The value it replaces is dead the moment this returns. */
+    readonly token: string;
+} | {
+    readonly ok: false;
+    readonly reason: 'unknown_session' | 'already_elevated';
+};
+export interface AssistantStore {
+    createClient(input: {
+        readonly name: string;
+        readonly tenant: TenantRef;
+        readonly deploymentId: string;
+        readonly allowedOrigins: readonly string[];
+        readonly now: Date;
+    }): Promise<{
+        readonly client: AssistantClientRecord;
+        readonly secret: string;
+    }>;
+    listClients(tenant: TenantRef): Promise<readonly AssistantClientRecord[]>;
+    rotateClient(id: string, now: Date): Promise<{
+        readonly client: AssistantClientRecord;
+        readonly secret: string;
+    } | undefined>;
+    revokeClient(id: string, now: Date): Promise<boolean>;
+    authenticateClient(id: string, secret: string): Promise<AssistantClientRecord | undefined>;
+    createSession(input: Omit<AssistantSessionRecord, 'id' | 'tokenHash' | 'history' | 'turnCount'>): Promise<{
+        readonly session: AssistantSessionRecord;
+        readonly token: string;
+    }>;
+    /**
+     * Spend one turn if the session has one left, atomically. This is one seam rather than a
+     * read-then-write in the route because two turns arriving together at the last slot is precisely the
+     * race a read-then-write loses. A refused turn does not advance the count.
+     */
+    consumeTurn(id: string, limit: number): Promise<AssistantTurnConsumption>;
+    /**
+     * Bind an already-open conversation to a signed-in caller (ADR 0201, 5.6b).
+     *
+     * One seam, and one row: the session is **mutated in place** rather than replaced, so the visitor
+     * keeps the conversation they were having. The old token dies with the same statement that installs
+     * the new one, which is why this is not a read-then-write — an elevation that left the anonymous
+     * token briefly alive would be a window in which both identities could act.
+     *
+     * `publicEmbedId` is deliberately retained: admission keeps charging the surface that admitted the
+     * visitor, exactly as 5.4 designed when it chose to key sessions on the embed rather than on being
+     * anonymous. Refuses when the session is already non-anonymous, which is what makes a second
+     * elevation impossible without a separate check to forget.
+     */
+    elevateSession(input: {
+        readonly sessionId: string;
+        readonly caller: AssistantSessionRecord['caller'];
+        /** The elevating client: becomes the session's delegated-credential issuer basis (ADR 0152). */
+        readonly clientId: string;
+        /** Allowlist-validated by the route: becomes the session's CORS pin, where the conversation continues. */
+        readonly origin: string;
+        /** Backend-verified customer routes; absent means unchanged, never cleared. */
+        readonly customerRouting?: AssistantSessionRecord['customerRouting'];
+        /** Arms the one-shot resume of the intercepted tool, in the same statement that elevates. */
+        readonly pendingResume?: AssistantPendingResume;
+        readonly now: Date;
+    }): Promise<AssistantSessionElevation>;
+    /**
+     * Clear and return the pending resume exactly once, atomically — the turn route calls this both
+     * to run the resume and to moot it when the visitor types first, and two requests racing the
+     * same arm must not both see it.
+     */
+    consumePendingResume(sessionId: string): Promise<AssistantPendingResume | undefined>;
+    getSession(token: string, now: Date): Promise<AssistantSessionRecord | undefined>;
+    appendHistory(id: string, messages: readonly AssistantHistoryMessage[]): Promise<void>;
+    createInteraction(input: Extract<AssistantInteractionCreateInput, {
+        readonly kind: 'confirmation';
+    }>): Promise<AssistantPendingConfirmationInteractionRecord>;
+    createInteraction(input: Extract<AssistantInteractionCreateInput, {
+        readonly kind: 'input';
+    }>): Promise<AssistantPendingInputInteractionRecord>;
+    claimInteraction(input: AssistantInteractionScope): Promise<AssistantInteractionClaimResult>;
+    completeInteraction(input: AssistantInteractionScope & {
+        readonly completion: import('./assistant-interaction-state.js').AssistantInteractionCompletion;
+    }): Promise<AssistantInteractionCompletionResult>;
+    transitionInteraction(input: AssistantInteractionTransitionInput): Promise<AssistantInteractionTransitionResult>;
+    getInteraction(input: AssistantInteractionScope): Promise<AssistantInteractionRecord | undefined>;
+    /** @deprecated Temporary compatibility for the accept-only route while it moves to claim/complete. */
+    consumeInteraction(id: string, sessionId: string, deploymentId: string, now: Date): Promise<(import('./assistant-interaction-state.js').AssistantConfirmationInteractionRecord & {
+        readonly status: 'executing';
+    }) | undefined>;
+    consumeConsoleApprovalNonce(nonce: string, subject: string, expiresAt: Date, now: Date): Promise<boolean>;
+}
+export declare class InMemoryAssistantStore implements AssistantStore {
+    #private;
+    constructor(options?: {
+        readonly maxPendingInteractionsPerSession?: number;
+    });
+    createClient(input: {
+        readonly name: string;
+        readonly tenant: TenantRef;
+        readonly deploymentId: string;
+        readonly allowedOrigins: readonly string[];
+        readonly now: Date;
+    }): Promise<{
+        readonly client: AssistantClientRecord;
+        readonly secret: string;
+    }>;
+    listClients(tenant: TenantRef): Promise<readonly AssistantClientRecord[]>;
+    rotateClient(id: string, now: Date): Promise<{
+        readonly client: AssistantClientRecord;
+        readonly secret: string;
+    } | undefined>;
+    revokeClient(id: string, now: Date): Promise<boolean>;
+    authenticateClient(id: string, secret: string): Promise<AssistantClientRecord | undefined>;
+    createSession(input: Omit<AssistantSessionRecord, 'id' | 'tokenHash' | 'history' | 'turnCount'>): Promise<{
+        readonly session: AssistantSessionRecord;
+        readonly token: string;
+    }>;
+    elevateSession(input: {
+        readonly sessionId: string;
+        readonly caller: AssistantSessionRecord['caller'];
+        readonly clientId: string;
+        readonly origin: string;
+        readonly customerRouting?: AssistantSessionRecord['customerRouting'];
+        readonly pendingResume?: AssistantPendingResume;
+        readonly now: Date;
+    }): Promise<AssistantSessionElevation>;
+    consumePendingResume(sessionId: string): Promise<AssistantPendingResume | undefined>;
+    consumeTurn(id: string, limit: number): Promise<AssistantTurnConsumption>;
+    getSession(token: string, now: Date): Promise<AssistantSessionRecord | undefined>;
+    appendHistory(id: string, messages: readonly AssistantHistoryMessage[]): Promise<void>;
+    createInteraction(input: Extract<AssistantInteractionCreateInput, {
+        readonly kind: 'confirmation';
+    }>): Promise<AssistantPendingConfirmationInteractionRecord>;
+    createInteraction(input: Extract<AssistantInteractionCreateInput, {
+        readonly kind: 'input';
+    }>): Promise<AssistantPendingInputInteractionRecord>;
+    claimInteraction(input: AssistantInteractionScope): Promise<AssistantInteractionClaimResult>;
+    completeInteraction(input: AssistantInteractionScope & {
+        readonly completion: import('./assistant-interaction-state.js').AssistantInteractionCompletion;
+    }): Promise<AssistantInteractionCompletionResult>;
+    transitionInteraction(input: AssistantInteractionTransitionInput): Promise<AssistantInteractionTransitionResult>;
+    getInteraction(input: AssistantInteractionScope): Promise<AssistantInteractionRecord | undefined>;
+    consumeInteraction(id: string, sessionId: string, deploymentId: string, now: Date): Promise<(import('./assistant-interaction-state.js').AssistantConfirmationInteractionRecord & {
+        readonly status: 'executing';
+    }) | undefined>;
+    consumeConsoleApprovalNonce(nonce: string, subject: string, expiresAt: Date, now: Date): Promise<boolean>;
+}
+//# sourceMappingURL=assistant-store.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-store.js

@@ -1,5 +1,5 @@
 import { createHash, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
-import { ADMISSION_DEFAULTS } from '@noodle-borg/admission-limits';
+import { ADMISSION_DEFAULTS } from '@noodle-borg/admission-limits/portable';
 import { AssistantInteractionCapacityError, cloneInteraction, completedInteraction, createPendingInteraction, DEFAULT_MAX_PENDING_INTERACTIONS_PER_SESSION, executingInteraction, expireStrandedExecutingInteraction, isPrunableInteraction, isTerminalInteraction, shouldExpireStrandedExecutingInteraction, transitionedInteractions, } from './assistant-interaction-state.js';
 export { ASSISTANT_INTERACTION_EXECUTING_GRACE_MS, ASSISTANT_INTERACTION_OUTCOME_RETENTION_MS, AssistantInteractionCapacityError, DEFAULT_MAX_PENDING_INTERACTIONS_PER_SESSION, } from './assistant-interaction-state.js';
 export const ASSISTANT_SESSION_IDLE_MS = 30 * 60 * 1000;

package/node_modules/@noodle-borg/assistant-gateway/dist/elevation-store.d.ts

@@ -0,0 +1,70 @@
+import type { TenantRef } from './tenant-ref.js';
+/**
+ * Mid-conversation sign-in on a `mixed` surface (ADR 0201, 5.6b).
+ *
+ * **Not an interaction record, deliberately.** The plan proposed a new `auth_requested` kind on the
+ * existing interaction machinery, but that machinery is *visitor-resolvable*: accept/decline/cancel are
+ * driven from the widget. An elevation resolved by a visitor click would be an elevation with no
+ * credentials, so reusing it would have meant bolting a "this kind is not visitor-resolvable" exception
+ * onto every resolution path and hoping none was missed. A separate record has no such path to forget.
+ *
+ * **The continuation is a capability that travels through the browser**, so possession alone must be
+ * worthless: spending one also requires the customer's client credentials, and the claim checks that the
+ * client's tenant owns the session. It is stored hashed for the same reason session tokens are — the
+ * store never holds a value that could be replayed if it leaked.
+ */
+export interface AssistantElevationRecord {
+    readonly id: string;
+    readonly sessionId: string;
+    readonly tenant: TenantRef;
+    /** The capability the visitor was refused, carried so the audit says what they signed in for. */
+    readonly tool: string;
+    readonly continuationHash: string;
+    readonly createdAt: string;
+    readonly expiresAt: string;
+    readonly claimedAt?: string;
+}
+export type AssistantElevationClaim = {
+    readonly ok: true;
+    readonly elevation: AssistantElevationRecord;
+} | {
+    readonly ok: false;
+    /**
+     * One code per refusal, because they are operationally different: `unknown` is a bad or already
+     * spent continuation, `expired` is a visitor who took too long, and `tenant_mismatch` is a client
+     * spending a continuation for a conversation it does not own — the last is the one worth alerting
+     * on, so it must not collapse into the first.
+     */
+    readonly reason: 'unknown' | 'expired' | 'tenant_mismatch';
+};
+/** Ten minutes: long enough for a real login round trip, short enough that a leaked value is stale. */
+export declare const ASSISTANT_ELEVATION_TTL_MS: number;
+export interface AssistantElevationStore {
+    /**
+     * Open one elevation for a session. At most one may be live at a time — a second request supersedes
+     * the first rather than accumulating, so a model that asks twice cannot mint unbounded capabilities.
+     */
+    request(input: {
+        readonly sessionId: string;
+        readonly tenant: TenantRef;
+        readonly tool: string;
+        readonly now: Date;
+    }): Promise<{
+        readonly elevation: AssistantElevationRecord;
+        readonly continuation: string;
+    }>;
+    /**
+     * Spend a continuation exactly once. Atomic: two backends racing the same value must not both win,
+     * which is why this is one store seam rather than a read-then-write in the route.
+     */
+    claim(input: {
+        readonly continuation: string;
+        readonly tenant: TenantRef;
+        readonly now: Date;
+    }): Promise<AssistantElevationClaim>;
+}
+export declare function elevationContinuation(): string;
+export declare function elevationDigest(value: string): string;
+export declare function elevationHashesEqual(left: string, right: string): boolean;
+export declare function sameTenant(left: TenantRef, right: TenantRef): boolean;
+//# sourceMappingURL=elevation-store.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/elevation.d.ts

@@ -0,0 +1,68 @@
+import type { AssistantPendingResume, AssistantSessionRecord } from './assistant-store.js';
+import type { AssistantElevationStore } from './elevation-store.js';
+import type { TenantRef } from './tenant-ref.js';
+/**
+ * The elevation decision, with no HTTP in it.
+ *
+ * Kept transport-free for the same reason `mintPublicSession` is: the interesting part is an ordering of
+ * refusals, and an ordering is only testable without standing up a server. `packages/service` adapts.
+ *
+ * **The order is the contract.** The continuation is claimed *before* the session is touched, and the
+ * claim is tenant-checked, so a client reaching for a conversation it does not own never reaches the
+ * mutation at all. Claiming first also means a refused elevation cannot leave a spent continuation
+ * behind — and a spent one cannot be replayed, which is the same statement read from the other side.
+ */
+export interface ElevationPorts {
+    readonly elevations: Pick<AssistantElevationStore, 'claim'>;
+    readonly elevateSession: (input: {
+        readonly sessionId: string;
+        readonly caller: AssistantSessionRecord['caller'];
+        readonly clientId: string;
+        readonly origin: string;
+        readonly customerRouting?: AssistantSessionRecord['customerRouting'];
+        readonly pendingResume?: AssistantPendingResume;
+        readonly now: Date;
+    }) => Promise<{
+        readonly ok: true;
+        readonly session: AssistantSessionRecord;
+        readonly token: string;
+    } | {
+        readonly ok: false;
+        readonly reason: 'unknown_session' | 'already_elevated';
+    }>;
+    readonly now: () => Date;
+}
+export interface ElevationRequest {
+    /** Presented by the customer's backend. Possession alone is not enough; see the route. */
+    readonly continuation: string;
+    /** The tenant of the *authenticated client*, never a value the caller supplied loose. */
+    readonly tenant: TenantRef;
+    readonly caller: AssistantSessionRecord['caller'];
+    /** The authenticated client's id: rebinds the session's issuer basis on success (ADR 0152). */
+    readonly clientId: string;
+    /**
+     * Where the conversation continues: allowlist-validated by the route BEFORE the ticket is
+     * claimed, then re-pinned onto the session so its CORS follows the visitor's post-login page.
+     */
+    readonly origin: string;
+    /** Backend-verified customer routes, validated by the route; absent means unchanged. */
+    readonly customerRouting?: AssistantSessionRecord['customerRouting'];
+    /**
+     * Arm the one-shot resume of the intercepted tool on success. Only an explicit `true` arms —
+     * the route owns the default policy, and probes (the doctor's synthetic elevation) pass nothing.
+     */
+    readonly resume?: boolean;
+}
+export type ElevationResult = {
+    readonly ok: true;
+    readonly session: AssistantSessionRecord;
+    readonly token: string;
+    /** What the visitor was refused before signing in, for the audit trail. */
+    readonly tool: string;
+} | {
+    readonly ok: false;
+    readonly status: 403 | 409;
+    readonly code: 'elevation_ticket_invalid' | 'elevation_ticket_expired' | 'elevation_tenant_mismatch' | 'elevation_session_unavailable' | 'elevation_already_signed_in';
+};
+export declare function completeElevation(request: ElevationRequest, ports: ElevationPorts): Promise<ElevationResult>;
+//# sourceMappingURL=elevation.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/embed-script.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The browser embed script, read from the published `@noodleseed/assistant` build.
+ *
+ * Served from the service origin rather than a CDN (ADR 0201): there is no new release lane to run, the
+ * script is always the one that matches the deployed service, and a CDN can front the URL later without
+ * changing a single byte a customer pasted.
+ *
+ * Read once and cached. The file is immutable for the life of the process — it ships inside the image —
+ * so re-reading it per request would buy nothing but syscalls.
+ */
+export interface EmbedScript {
+    readonly bytes: Buffer;
+    /** Content-derived, so a redeployed service with an unchanged bundle keeps browsers' caches warm. */
+    readonly etag: string;
+}
+export type EmbedScriptResult = {
+    readonly ok: true;
+    readonly script: EmbedScript;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
+export declare function loadEmbedScript(): EmbedScriptResult;
+//# sourceMappingURL=embed-script.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/embed-store.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Public embed identifiers.
+ *
+ * These live in their own table rather than as a flag on the authenticated `assistant_clients` row, and
+ * the reason is structural rather than tidiness: a public embed id is printed in page source, so it must
+ * never be a credential. A record with no secret column cannot accidentally acquire one — there is
+ * nothing for a future code path to populate, hash, or compare. Reusing the client table would have
+ * inherited its tooling for free while keeping a `secret_hash` one bug away from a public identifier.
+ *
+ * The id is stable across deploys. A customer pastes the snippet once; redeploys and rollbacks swap the
+ * projection underneath a page that never changes. Origins, capabilities, and UI therefore come from the
+ * *active* deployment at mint time, never from the embed record.
+ */
+export interface PublicEmbedRecord {
+    /** Printed in page source. Non-secret by construction. */
+    readonly embedId: string;
+    readonly org: string;
+    readonly app: string;
+    readonly env: string;
+    /**
+     * Which surface of the assistant this id addresses, so budgets and kill switches key per surface.
+     * Provisioning-time record only: `ensure` never updates a live row, so this goes stale when a
+     * redeploy changes the mode — readers report the active deployment's mode instead.
+     */
+    readonly surfaceMode: 'public' | 'mixed';
+    readonly createdAt: Date;
+    readonly revokedAt?: Date;
+    /**
+     * Operator overrides for this surface's daily caps. Undefined means "use the deployment defaults";
+     * `0` is a real value and is the kill switch, so the two must stay distinguishable everywhere.
+     */
+    readonly turnsPerDay?: number;
+    readonly mintsPerDay?: number;
+}
+/** What an operator may change about a surface. An omitted field leaves that cap as it was. */
+export interface PublicEmbedBudget {
+    readonly turnsPerDay?: number;
+    readonly mintsPerDay?: number;
+}
+export interface PublicEmbedStore {
+    /**
+     * Return the existing id for this tenant surface, or create one. Deploy calls this, so it must be
+     * idempotent: a redeploy that minted a fresh id would silently break every page already carrying the
+     * old one.
+     */
+    ensure(input: {
+        readonly org: string;
+        readonly app: string;
+        readonly env: string;
+        readonly surfaceMode: 'public' | 'mixed';
+        readonly now: Date;
+    }): Promise<PublicEmbedRecord>;
+    /** Resolve an id presented by a browser. Revoked ids resolve to undefined. */
+    lookup(embedId: string): Promise<PublicEmbedRecord | undefined>;
+    /**
+     * Raise, lower, or switch off a surface's daily caps. Separate from `ensure` on purpose: `ensure` runs
+     * on every deploy and never overwrites a live row, so a redeploy cannot reset an operator's decision.
+     */
+    setBudget(embedId: string, budget: PublicEmbedBudget, now: Date): Promise<PublicEmbedRecord | undefined>;
+    list(tenant: {
+        readonly org: string;
+        readonly app: string;
+        readonly env: string;
+    }): Promise<readonly PublicEmbedRecord[]>;
+    revoke(embedId: string, now: Date): Promise<boolean>;
+}
+/**
+ * `pub_` prefixed so it is self-describing in page source, logs, and support threads — someone reading a
+ * customer's HTML can tell at a glance that it is not a secret that leaked.
+ */
+export declare const PUBLIC_EMBED_ID_PREFIX = "pub_";
+export declare function isPublicEmbedId(value: string): boolean;
+//# sourceMappingURL=embed-store.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/in-memory-elevation-store.d.ts

@@ -0,0 +1,21 @@
+import { type AssistantElevationClaim, type AssistantElevationRecord, type AssistantElevationStore } from './elevation-store.js';
+import type { TenantRef } from './tenant-ref.js';
+/** The in-memory half of the pair. Both run the shared parity suite; neither is the only proof. */
+export declare class InMemoryAssistantElevationStore implements AssistantElevationStore {
+    #private;
+    request(input: {
+        readonly sessionId: string;
+        readonly tenant: TenantRef;
+        readonly tool: string;
+        readonly now: Date;
+    }): Promise<{
+        readonly elevation: AssistantElevationRecord;
+        readonly continuation: string;
+    }>;
+    claim(input: {
+        readonly continuation: string;
+        readonly tenant: TenantRef;
+        readonly now: Date;
+    }): Promise<AssistantElevationClaim>;
+}
+//# sourceMappingURL=in-memory-elevation-store.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/in-memory-embed-store.d.ts

@@ -0,0 +1,28 @@
+import { type PublicEmbedBudget, type PublicEmbedRecord, type PublicEmbedStore } from './embed-store.js';
+/** 120 bits of randomness, base36: unguessable enough that an id is never a discovery oracle. */
+export declare function newPublicEmbedId(): string;
+export declare function tenantKey(tenant: {
+    readonly org: string;
+    readonly app: string;
+    readonly env: string;
+}): string;
+/** Process-local embeds for local development and tests. */
+export declare class InMemoryPublicEmbedStore implements PublicEmbedStore {
+    #private;
+    ensure(input: {
+        readonly org: string;
+        readonly app: string;
+        readonly env: string;
+        readonly surfaceMode: 'public' | 'mixed';
+        readonly now: Date;
+    }): Promise<PublicEmbedRecord>;
+    setBudget(embedId: string, budget: PublicEmbedBudget, _now: Date): Promise<PublicEmbedRecord | undefined>;
+    lookup(embedId: string): Promise<PublicEmbedRecord | undefined>;
+    list(tenant: {
+        readonly org: string;
+        readonly app: string;
+        readonly env: string;
+    }): Promise<readonly PublicEmbedRecord[]>;
+    revoke(embedId: string, now: Date): Promise<boolean>;
+}
+//# sourceMappingURL=in-memory-embed-store.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/portable.d.ts

@@ -0,0 +1,24 @@
+/** Assistant gateway contracts and in-memory adapters safe for the published CLI runtime. */
+export * from './artifact-projection.js';
+export * from './assistant-context.js';
+export * from './assistant-customer-issuer.js';
+export * from './assistant-customer-routing.js';
+export * from './assistant-guide.js';
+export * from './assistant-interaction-state.js';
+export * from './assistant-interactive.js';
+export * from './assistant-presentation.js';
+export * from './assistant-sensitive-values.js';
+export * from './assistant-store.js';
+export * from './elevation.js';
+export * from './elevation-store.js';
+export * from './embed-script.js';
+export * from './embed-store.js';
+export * from './in-memory-elevation-store.js';
+export * from './in-memory-embed-store.js';
+export * from './public-session.js';
+export * from './public-surface.js';
+export * from './public-turn.js';
+export * from './session-resume.js';
+export * from './surface-budget.js';
+export * from './tenant-ref.js';
+//# sourceMappingURL=portable.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/public-session.d.ts

@@ -0,0 +1,56 @@
+import type { AdmissionEnvelope, DailyCounterStore } from '@noodle-borg/admission-limits/portable';
+import { type PublicEmbedRecord, type PublicEmbedStore } from './embed-store.js';
+import type { PublicSurface } from './public-surface.js';
+/**
+ * Minting an anonymous session for a public page.
+ *
+ * Transport-free on purpose: the hosting service owns the HTTP adapter (parse body, map result), and
+ * everything that decides *whether* a stranger gets a session lives here, behind narrow ports. That is
+ * what keeps the decision testable without a server and the service-side residue to a few lines.
+ *
+ * The refusal order is part of the contract, not an implementation detail. ADR 0201 §8 requires
+ * admission to complete before any metered work, so the store-durability and budget checks come before
+ * anything that would read deployment state or reach a model.
+ */
+export interface PublicSessionPorts {
+    readonly embeds: Pick<PublicEmbedStore, 'lookup'>;
+    readonly counters: DailyCounterStore;
+    /** The live surface for this tenant, read from the *active* deployment at mint time. */
+    resolveActiveSurface(embed: PublicEmbedRecord): Promise<PublicSurface | undefined>;
+    /** Persist the anonymous session and return its bearer token and expiry. */
+    createSession(input: {
+        readonly embed: PublicEmbedRecord;
+        readonly origin: string;
+        readonly subject: string;
+        readonly envelope: AdmissionEnvelope;
+    }): Promise<{
+        readonly token: string;
+        readonly expiresAt: string;
+    }>;
+    /** Opaque, deployment-scoped, unlinkable to any person. */
+    newAnonymousSubject(): string;
+    now(): Date;
+}
+export interface PublicSessionRequest {
+    readonly embedId: unknown;
+    readonly origin: unknown;
+    /**
+     * The visitor's address bucket (admission tier 3), already hashed by the transport — a raw address
+     * must never reach this decision, a counter key, or an audit payload. Absent when ingress could not
+     * be parsed, in which case the surface tier alone applies: fairness degrades, solvency does not.
+     */
+    readonly addressBucket?: string | undefined;
+}
+export type PublicSessionResult = {
+    readonly ok: true;
+    readonly token: string;
+    readonly expiresAt: string;
+    readonly embed: PublicEmbedRecord;
+} | {
+    readonly ok: false;
+    readonly status: number;
+    readonly code: string;
+    readonly message: string;
+};
+export declare function mintPublicSession(request: PublicSessionRequest, envelope: AdmissionEnvelope, ports: PublicSessionPorts): Promise<PublicSessionResult>;
+//# sourceMappingURL=public-session.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/public-surface.d.ts

@@ -0,0 +1,21 @@
+import type { SurfaceCapabilityRef } from './artifact-projection.js';
+/**
+ * The one reader of "does this deployment face the public, and on what terms".
+ *
+ * Three callers ask that question and must never disagree: deploy decides whether to provision an embed
+ * id, minting checks the browser's origin against the surface, and the session's projection narrows the
+ * artifact to the surface's capabilities. When each answered locally, a surface shape one of them
+ * accepted and another rejected would silently mint sessions that could reach nothing, or provision an id
+ * for a surface that refuses to serve it.
+ *
+ * The argument is `unknown` because the assistant block arrives as compiled artifact data rather than a
+ * typed authoring value; the shape is validated here, once, rather than asserted at three call sites.
+ */
+export interface PublicSurface {
+    readonly mode: 'public' | 'mixed';
+    readonly origins: readonly string[];
+    readonly capabilities: readonly SurfaceCapabilityRef[];
+    readonly instructions?: string;
+}
+export declare function publicSurfaceOf(assistant: unknown): PublicSurface | undefined;
+//# sourceMappingURL=public-surface.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/public-surface.js

@@ -3,7 +3,7 @@ export function publicSurfaceOf(assistant) {
     if (!Array.isArray(surfaces))
         return undefined;
     for (const entry of surfaces) {
-        const { mode, origins, capabilities } = entry;
+        const { mode, origins, capabilities, instructions } = entry;
         // A mixed surface admits strangers exactly as a public one does — sign-in only widens what a visitor
         // reaches after elevation, so both provision an embed id and both project.
         if (mode !== 'public' && mode !== 'mixed')
@@ -17,6 +17,7 @@ export function publicSurfaceOf(assistant) {
             capabilities: Array.isArray(capabilities)
                 ? capabilities
                 : [],
+            ...(typeof instructions === 'string' ? { instructions } : {}),
         };
     }
     return undefined;