@noodleseed/one 0.132.2 → 0.134.0

package/node_modules/@noodle-borg/assistant-gateway/dist/public-turn.d.ts

@@ -0,0 +1,44 @@
+import type { AdmissionEnvelope, DailyCounterStore } from '@noodle-borg/admission-limits/portable';
+import type { AssistantTurnConsumption } from './assistant-store.js';
+import type { PublicEmbedStore } from './embed-store.js';
+/**
+ * Whether an anonymous visitor's next turn runs.
+ *
+ * Transport-free for the same reason {@link ./public-session.ts} is: the decision about who gets to spend
+ * a customer's model budget should be provable without standing up a server. The service adapts it.
+ *
+ * The envelope arrives per call rather than being snapshotted onto the session at mint time, and that is
+ * load-bearing: `noodle assistant budget set --turns-per-day 0` must stop conversations already under
+ * way, which is precisely the case an operator reaches for the kill switch to stop. Re-reading it each
+ * turn makes the switch fall out of the ordinary path instead of needing a second mechanism.
+ */
+export interface PublicTurnPorts {
+    readonly counters: DailyCounterStore;
+    /** Re-read per turn: it carries the operator's live budget, and whether the surface still exists. */
+    readonly embeds: Pick<PublicEmbedStore, 'lookup'>;
+    /** Spend one of this session's turns, atomically (admission tier 1). */
+    consumeTurn(id: string, limit: number): Promise<AssistantTurnConsumption>;
+    now(): Date;
+}
+export interface PublicTurnRequest {
+    readonly sessionId: string;
+    /** The surface the session was admitted through; daily spend is charged against it. */
+    readonly publicEmbedId: string;
+    readonly message: string;
+    /**
+     * The visitor's hashed address bucket (admission tier 3), or absent when ingress could not be parsed.
+     * A raw address must never reach this decision, a counter key, or an audit payload.
+     */
+    readonly addressBucket?: string | undefined;
+}
+export type PublicTurnResult = {
+    readonly ok: true;
+    readonly turnCount: number;
+} | {
+    readonly ok: false;
+    readonly status: number;
+    readonly code: string;
+    readonly message: string;
+};
+export declare function admitPublicTurn(request: PublicTurnRequest, defaults: AdmissionEnvelope, ports: PublicTurnPorts): Promise<PublicTurnResult>;
+//# sourceMappingURL=public-turn.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/session-resume.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The post-sign-in resume decision and its platform message (issue #1177). When a spent ticket
+ * elevates a session, the service may run one assistant turn so the model re-attempts the
+ * intercepted intent under the new principal — the visitor signed in to get an answer, and the
+ * panel's first content should be that answer, not silence. Transport-free like the elevation
+ * decision; `packages/service` adapts.
+ */
+/**
+ * Whether a successful elevation arms the one-shot resume. ON by default — the demo-magic case is
+ * the default experience — with the exchange-side `resume: false` as the single disable knob (it
+ * lives in the integrator's own session endpoint, the code that spends the ticket).
+ */
+export declare function shouldAutoResume(override: boolean | undefined): boolean;
+/**
+ * The `[platform]` message that drives the resume turn, persisted to history as a user-role
+ * message like the interaction-resolution narration. It must countermand the interception's own
+ * guidance ("ask them to sign in, then offer to try again") — the sign-in already happened, and
+ * asking the visitor to repeat themselves is the silence this feature removes. Arguments are not
+ * replayed: the model re-derives them from history under the new principal.
+ */
+export declare function resumeTurnMessage(tool: string): string;
+//# sourceMappingURL=session-resume.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/surface-budget.d.ts

@@ -0,0 +1,16 @@
+import { type AdmissionEnvelope } from '@noodle-borg/admission-limits/portable';
+import type { PublicEmbedRecord } from './embed-store.js';
+/**
+ * One surface's daily budget, resolved from the operator's override and the deployment's defaults.
+ *
+ * Per surface rather than per service, because the question a customer actually asks is "does capping
+ * my marketing bot throttle my in-app assistant" — and the answer has to be an obvious no. The override
+ * lives on the embed row, which `ensure` never overwrites, so a redeploy cannot silently reset a kill
+ * switch someone reached for.
+ *
+ * Routed through `clamp` rather than used directly: the structural maximum is not negotiable by an
+ * operator any more than by app code, so an over-eager `--turns-per-day 999999999` degrades to the
+ * ceiling instead of becoming the ceiling. Zero survives clamping and is the kill switch.
+ */
+export declare function surfaceEnvelope(base: AdmissionEnvelope, embed: Pick<PublicEmbedRecord, 'turnsPerDay' | 'mintsPerDay'>): AdmissionEnvelope;
+//# sourceMappingURL=surface-budget.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/surface-budget.js

@@ -1,4 +1,4 @@
-import { clamp } from '@noodle-borg/admission-limits';
+import { clamp } from '@noodle-borg/admission-limits/portable';
 /**
  * One surface's daily budget, resolved from the operator's override and the deployment's defaults.
  *

package/node_modules/@noodle-borg/assistant-gateway/dist/tenant-ref.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The tenant coordinate an assistant session is bound to.
+ *
+ * Structurally re-declared rather than imported: `packages/service`'s `store.ts` remains the canonical
+ * definition, but the gateway must not depend on the hosted service (the dependency runs the other way).
+ * The two shapes are identical by contract — widen them together.
+ */
+export interface TenantRef {
+    readonly org: string;
+    readonly app: string;
+    readonly env: string;
+}
+//# sourceMappingURL=tenant-ref.d.ts.map

package/node_modules/@noodle-borg/authoring/dist/assistant.d.ts

@@ -143,6 +143,7 @@ export type AssistantSurfaceMode = 'authenticated' | 'public' | 'mixed';
 export interface AuthenticatedWebsiteAccess {
     readonly mode: 'authenticated';
     readonly origins: readonly string[];
+    readonly instructions?: string;
     /** Allowlist of verified session claims; undeclared claims are dropped at session exchange. */
     readonly sessionClaims?: Readonly<Record<string, SessionClaimDeclaration>>;
     readonly capabilities?: readonly CapabilityRef[];
@@ -151,16 +152,21 @@ export interface PublicWebsiteAccess {
     readonly mode: 'public' | 'mixed';
     readonly origins: readonly string[];
     readonly capabilities: readonly CapabilityRef[];
+    readonly instructions?: string;
 }
 export type AssistantAccess = AuthenticatedWebsiteAccess | PublicWebsiteAccess;
 export interface AuthenticatedWebsiteInput {
-    readonly origins: readonly string[];
+    readonly origins: readonly (string | ConfigRef)[];
+    /** Assistant-only behavior for this exact signed-in website audience. */
+    readonly instructions?: string;
     readonly sessionClaims?: Readonly<Record<string, SessionClaimDeclaration>>;
     /** Optional narrowing; omitted means the signed-in surface projects the whole server. */
     readonly capabilities?: readonly CapabilityRef[];
 }
 export interface PublicWebsiteInput {
-    readonly origins: readonly string[];
+    readonly origins: readonly (string | ConfigRef)[];
+    /** Assistant-only behavior for anonymous visitors on this website surface. */
+    readonly instructions?: string;
     /**
      * Required: on a public page this list *is* the externally reachable surface, so it must be an
      * explicit positive choice rather than whatever the server happens to declare.
@@ -186,6 +192,7 @@ export interface EmbeddedAssistantOptions extends AssistantUiOptions {
 export interface AssistantSurfaceConfig {
     readonly mode: AssistantSurfaceMode;
     readonly origins: readonly string[];
+    readonly instructions?: string;
     readonly capabilities?: readonly AssistantCapability[];
     readonly sessionClaims?: Readonly<Record<string, SessionClaimDeclaration>>;
 }

package/node_modules/@noodle-borg/authoring/dist/assistant.js

@@ -2,7 +2,8 @@ import { serializeSecretRef, serializeVariableRef } from './config.js';
 export function authenticatedWebsite(input) {
     return {
         mode: 'authenticated',
-        origins: [...input.origins],
+        origins: serializeOrigins(input.origins, 'assistant.access.origins'),
+        ...(input.instructions === undefined ? {} : { instructions: input.instructions }),
         ...(input.sessionClaims ? { sessionClaims: structuredClone(input.sessionClaims) } : {}),
         ...(input.capabilities ? { capabilities: [...input.capabilities] } : {}),
     };
@@ -10,10 +11,14 @@ export function authenticatedWebsite(input) {
 export function publicWebsite(input) {
     return {
         mode: input.signIn === true ? 'mixed' : 'public',
-        origins: [...input.origins],
+        origins: serializeOrigins(input.origins, 'assistant.access.origins'),
         capabilities: [...input.capabilities],
+        ...(input.instructions === undefined ? {} : { instructions: input.instructions }),
     };
 }
+function serializeOrigins(origins, path) {
+    return origins.map((origin, index) => typeof origin === 'string' ? origin : serializeVariableRef(origin, `${path}.${index}`));
+}
 export function openAICompatible(input) {
     const baseUrl = typeof input.baseUrl === 'string'
         ? input.baseUrl
@@ -39,6 +44,7 @@ export function embeddedAssistant(input) {
         surfaces: surfaces.map((surface) => ({
             mode: surface.mode,
             origins: [...surface.origins],
+            ...(surface.instructions === undefined ? {} : { instructions: surface.instructions }),
             ...(surface.capabilities
                 ? { capabilities: normalizeCapabilities(surface.capabilities) }
                 : {}),

package/node_modules/@noodle-borg/authoring/dist/connectors.d.ts

@@ -77,8 +77,10 @@ type HttpOperationOptionsWithRefs = Omit<HttpConnectorDef['operations'][string],
     readonly input?: OperationIoOptions;
     readonly output?: OperationIoOptions;
 };
-export type HttpConnectorOptions = Omit<HttpConnectorDef['http'], 'baseUrl' | 'auth'> & {
+export type HttpConnectorOptions = Omit<HttpConnectorDef['http'], 'baseUrl' | 'allowedOrigins' | 'auth'> & {
     readonly baseUrl: string | ConfigRef | CustomerEndpointRef;
+    /** Exact literal or operator-managed origins that may receive connector requests. */
+    readonly allowedOrigins?: readonly (string | ConfigRef)[];
     readonly auth?: HttpAuthOptions;
 } & {
     readonly credentialProfiles?: HttpConnectorDef['credentialProfiles'];

package/node_modules/@noodle-borg/authoring/dist/connectors.js

@@ -158,7 +158,11 @@ function normalizeHttpOptions(id, options) {
     const normalized = {
         ...httpOptions,
         baseUrl: normalizeBaseUrl(options.baseUrl, `connectors.${id}.http.baseUrl`),
-        ...(options.allowedOrigins !== undefined ? { allowedOrigins: options.allowedOrigins } : {}),
+        ...(options.allowedOrigins !== undefined
+            ? {
+                allowedOrigins: options.allowedOrigins.map((origin, index) => normalizeVariableOrString(origin, `connectors.${id}.http.allowedOrigins.${index}`)),
+            }
+            : {}),
         ...(options.auth !== undefined
             ? { auth: normalizeAuth(options.auth, `connectors.${id}.http.auth`) }
             : {}),

package/node_modules/@noodle-borg/authoring/dist/server.d.ts

@@ -4,6 +4,7 @@ import { type AgentGuideSource } from './agent-guide.js';
 import type { EmbeddedAssistantConfig } from './assistant.js';
 import { type DistributionMetadataSource, type DistributionMetadataV1 } from './distribution.js';
 export { annotations } from './annotations.js';
+import { type ConfigRef } from './config.js';
 import { type ConnectorCatalogDoc, type ConnectorRef } from './connectors.js';
 import { type ServerContextOptions } from './context.js';
 import { type CustomerAuth } from './customer-auth.js';
@@ -77,7 +78,7 @@ export interface ServerOptions {
         readonly colorScheme?: 'auto' | 'light' | 'dark';
     };
     readonly handoff?: {
-        readonly allowedDomains: readonly string[];
+        readonly allowedDomains: readonly (string | ConfigRef)[];
     };
     readonly state?: {
         readonly handles: Readonly<Record<string, StateHandleOptions>>;

package/node_modules/@noodle-borg/authoring/dist/server.js

@@ -3,6 +3,7 @@ import { z } from 'zod';
 import { manifestAgentGuide } from './agent-guide.js';
 import { projectDistributionMetadata, } from './distribution.js';
 export { annotations } from './annotations.js';
+import { isConfigRef, serializeVariableRef } from './config.js';
 import { toManifestConnectorRef } from './connections.js';
 import { validateCatalog } from './connectors.js';
 import { manifestContext } from './context.js';
@@ -210,7 +211,9 @@ class ServerBuilder {
             ...(this.options.handoff
                 ? {
                     handoff: {
-                        allowedDomains: [...this.options.handoff.allowedDomains],
+                        allowedDomains: this.options.handoff.allowedDomains.map((domain, index) => isConfigRef(domain)
+                            ? serializeVariableRef(domain, `server.handoff.allowedDomains.${index}`)
+                            : domain),
                     },
                 }
                 : {}),

package/node_modules/@noodle-borg/compiler/dist/artifact/assemble.js

@@ -9,7 +9,7 @@ export function assembleRuntimeArtifact({ manifest, options, runtimeBranding, ru
         ...(artifactPrompts.length > 0 ? { prompts: artifactPrompts.map((p) => p.name) } : {}),
     };
     const connectorBindings = Object.fromEntries(Object.entries(declared).flatMap(([alias, connector]) => connector.binding === undefined ? [] : [[alias, connector.binding]]));
-    const config = artifactConfig(artifactTools, allResources, artifactPrompts, connectorBindings, artifactAmbientContext?.fulfilment);
+    const config = artifactConfig(manifest, artifactTools, allResources, artifactPrompts, connectorBindings, artifactAmbientContext?.fulfilment);
     const artifact = {
         artifactSchemaVersion: ARTIFACT_SCHEMA_VERSION,
         resolution: options.catalog ? 'resolved' : 'shape-only',

package/node_modules/@noodle-borg/compiler/dist/artifact/config.js

@@ -1,19 +1,31 @@
-export function artifactConfig(tools, resources, prompts, connectorBindings, ambientFulfilment) {
+export function artifactConfig(manifest, tools, resources, prompts, connectorBindings, ambientFulfilment) {
     const variables = new Set();
+    collectVariablesFromManagedOrigins(manifest, variables);
     for (const tool of tools)
         collectVariablesFromFulfilment(tool.fulfilment, variables);
     for (const resource of resources)
         collectVariablesFromFulfilment(resource.fulfilment, variables);
     for (const prompt of prompts)
         collectVariablesFromFulfilment(prompt.fulfilment, variables);
-    if (ambientFulfilment !== undefined) {
+    if (ambientFulfilment !== undefined)
         collectVariablesFromFulfilment(ambientFulfilment, variables);
-    }
-    for (const binding of Object.values(connectorBindings)) {
+    for (const binding of Object.values(connectorBindings))
         collectVariablesFromConnectionSource(binding.connection.source, variables);
-    }
     return variables.size > 0 ? { variables: [...variables].sort() } : undefined;
 }
+function collectVariablesFromManagedOrigins(manifest, out) {
+    const assistant = manifest.server.assistant;
+    const values = [
+        ...(assistant?.allowedOrigins ?? []),
+        ...(assistant?.surfaces?.flatMap((surface) => surface.origins) ?? []),
+        ...(manifest.handoff?.allowedDomains ?? []),
+    ];
+    for (const value of values) {
+        const match = /^\$\{env\.([A-Za-z0-9_]+)\}$/.exec(value);
+        if (match?.[1] !== undefined)
+            out.add(match[1]);
+    }
+}
 function collectVariablesFromConnectionSource(source, out) {
     const values = source.kind === 'clientCredentials'
         ? [source.tokenUrl, source.clientId]
@@ -51,36 +63,29 @@ function collectVariablesFromExprMap(map, out) {
 }
 function collectVariablesFromExpr(node, out) {
     if (node.kind === 'path') {
-        if (node.root === 'env') {
-            const first = node.segments[0];
-            if (first?.kind === 'prop')
-                out.add(first.name);
-        }
-        return;
+        const first = node.segments[0];
+        if (node.root === 'env' && first?.kind === 'prop')
+            out.add(first.name);
     }
-    if (node.kind === 'template') {
+    else if (node.kind === 'template') {
         for (const part of node.parts) {
             if (part.kind !== 'text')
                 collectVariablesFromExpr(part, out);
         }
-        return;
     }
-    if (node.kind === 'array') {
+    else if (node.kind === 'array') {
         for (const item of node.items)
             collectVariablesFromExpr(item, out);
-        return;
     }
-    if (node.kind === 'object') {
+    else if (node.kind === 'object') {
         for (const entry of node.entries)
             collectVariablesFromExpr(entry.value, out);
-        return;
     }
-    if (node.kind === 'coalesce') {
+    else if (node.kind === 'coalesce') {
         collectVariablesFromExpr(node.left, out);
         collectVariablesFromExpr(node.right, out);
-        return;
     }
-    if (node.kind === 'function') {
+    else if (node.kind === 'function') {
         for (const arg of node.args)
             collectVariablesFromExpr(arg, out);
     }

package/node_modules/@noodle-borg/compiler/dist/manifest/schema.d.ts

@@ -6,7 +6,7 @@ type ToolAuthorizationManifest = {
 };
 export declare const manifestV1Schema: z.ZodObject<{
     handoff: z.ZodOptional<z.ZodObject<{
-        allowedDomains: z.ZodArray<z.ZodURL>;
+        allowedDomains: z.ZodArray<z.ZodUnion<readonly [z.ZodURL, z.ZodString]>>;
     }, z.core.$strict>>;
     state: z.ZodOptional<z.ZodObject<{
         handles: z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -331,14 +331,15 @@ export declare const manifestV1Schema: z.ZodObject<{
                 model: z.ZodString;
                 apiKey: z.ZodString;
             }, z.core.$strict>;
-            allowedOrigins: z.ZodArray<z.ZodURL>;
+            allowedOrigins: z.ZodArray<z.ZodString>;
             surfaces: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 mode: z.ZodEnum<{
                     authenticated: "authenticated";
                     public: "public";
                     mixed: "mixed";
                 }>;
-                origins: z.ZodArray<z.ZodURL>;
+                origins: z.ZodArray<z.ZodString>;
+                instructions: z.ZodOptional<z.ZodString>;
                 capabilities: z.ZodOptional<z.ZodArray<z.ZodObject<{
                     kind: z.ZodEnum<{
                         tool: "tool";
@@ -498,7 +499,7 @@ export declare const manifestV1Schema: z.ZodObject<{
 }, z.core.$strip>;
 export declare const manifestV2Schema: z.ZodObject<{
     handoff: z.ZodOptional<z.ZodObject<{
-        allowedDomains: z.ZodArray<z.ZodURL>;
+        allowedDomains: z.ZodArray<z.ZodUnion<readonly [z.ZodURL, z.ZodString]>>;
     }, z.core.$strict>>;
     state: z.ZodOptional<z.ZodObject<{
         handles: z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -781,14 +782,15 @@ export declare const manifestV2Schema: z.ZodObject<{
                 model: z.ZodString;
                 apiKey: z.ZodString;
             }, z.core.$strict>;
-            allowedOrigins: z.ZodArray<z.ZodURL>;
+            allowedOrigins: z.ZodArray<z.ZodString>;
             surfaces: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 mode: z.ZodEnum<{
                     authenticated: "authenticated";
                     public: "public";
                     mixed: "mixed";
                 }>;
-                origins: z.ZodArray<z.ZodURL>;
+                origins: z.ZodArray<z.ZodString>;
+                instructions: z.ZodOptional<z.ZodString>;
                 capabilities: z.ZodOptional<z.ZodArray<z.ZodObject<{
                     kind: z.ZodEnum<{
                         tool: "tool";
@@ -1116,7 +1118,7 @@ export declare const manifestV2Schema: z.ZodObject<{
 }, z.core.$strip>;
 export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     handoff: z.ZodOptional<z.ZodObject<{
-        allowedDomains: z.ZodArray<z.ZodURL>;
+        allowedDomains: z.ZodArray<z.ZodUnion<readonly [z.ZodURL, z.ZodString]>>;
     }, z.core.$strict>>;
     state: z.ZodOptional<z.ZodObject<{
         handles: z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -1441,14 +1443,15 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                 model: z.ZodString;
                 apiKey: z.ZodString;
             }, z.core.$strict>;
-            allowedOrigins: z.ZodArray<z.ZodURL>;
+            allowedOrigins: z.ZodArray<z.ZodString>;
             surfaces: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 mode: z.ZodEnum<{
                     authenticated: "authenticated";
                     public: "public";
                     mixed: "mixed";
                 }>;
-                origins: z.ZodArray<z.ZodURL>;
+                origins: z.ZodArray<z.ZodString>;
+                instructions: z.ZodOptional<z.ZodString>;
                 capabilities: z.ZodOptional<z.ZodArray<z.ZodObject<{
                     kind: z.ZodEnum<{
                         tool: "tool";
@@ -1607,7 +1610,7 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     }, z.core.$strip>>>;
 }, z.core.$strip>, z.ZodObject<{
     handoff: z.ZodOptional<z.ZodObject<{
-        allowedDomains: z.ZodArray<z.ZodURL>;
+        allowedDomains: z.ZodArray<z.ZodUnion<readonly [z.ZodURL, z.ZodString]>>;
     }, z.core.$strict>>;
     state: z.ZodOptional<z.ZodObject<{
         handles: z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -1890,14 +1893,15 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                 model: z.ZodString;
                 apiKey: z.ZodString;
             }, z.core.$strict>;
-            allowedOrigins: z.ZodArray<z.ZodURL>;
+            allowedOrigins: z.ZodArray<z.ZodString>;
             surfaces: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 mode: z.ZodEnum<{
                     authenticated: "authenticated";
                     public: "public";
                     mixed: "mixed";
                 }>;
-                origins: z.ZodArray<z.ZodURL>;
+                origins: z.ZodArray<z.ZodString>;
+                instructions: z.ZodOptional<z.ZodString>;
                 capabilities: z.ZodOptional<z.ZodArray<z.ZodObject<{
                     kind: z.ZodEnum<{
                         tool: "tool";

package/node_modules/@noodle-borg/compiler/dist/manifest/schema.js

@@ -135,9 +135,13 @@ const promptSchema = z.object({
 });
 const hexColorSchema = z.string().regex(/^#[0-9A-Fa-f]{6}$/, 'must be a 6-digit hex color');
 const httpsUrlSchema = z.url().regex(/^https:\/\//, 'must use https');
+const managedVariableExpressionPattern = /^\$\{env\.[A-Za-z0-9_]+\}$/;
+const managedVariableExpressionSchema = z
+    .string()
+    .regex(managedVariableExpressionPattern, 'must be an exact managed variable expression');
 // HTTP is allowed only for loopback development origins (mirrors the host-pattern loopback
 // exception used for connector/CSP origins); production embedding origins stay https-only.
-const canonicalAssistantOriginPattern = /^(?:https:\/\/[^/?#@\\]+|http:\/\/(?:localhost|127\.0\.0\.1|\[::1\])(?::\d+)?)$/;
+const assistantOriginOrVariablePattern = /^(?:\$\{env\.[A-Za-z0-9_]+\}|https:\/\/[^/?#@\\]+|http:\/\/(?:localhost|127\.0\.0\.1|\[::1\])(?::\d+)?)$/;
 function isCanonicalAssistantOrigin(value) {
     try {
         return new URL(value).origin === value;
@@ -146,10 +150,10 @@ function isCanonicalAssistantOrigin(value) {
         return false;
     }
 }
-const assistantOriginSchema = z
-    .url()
-    .regex(canonicalAssistantOriginPattern, 'must be a canonical bare origin using https (http is allowed only for localhost/127.0.0.1/[::1] loopback development origins)')
-    .refine(isCanonicalAssistantOrigin, 'must be a canonical bare origin');
+const assistantOriginOrVariableSchema = z
+    .string()
+    .regex(assistantOriginOrVariablePattern, 'must be a canonical bare origin using https (http is allowed only for localhost/127.0.0.1/[::1] loopback development origins)')
+    .refine((value) => managedVariableExpressionPattern.test(value) || isCanonicalAssistantOrigin(value), 'must be a canonical bare origin');
 const packagedAssetSchema = z
     .object({
     kind: z.literal('asset'),
@@ -330,6 +334,11 @@ const assistantCapabilitySchema = z
     name: z.string().trim().min(1),
 })
     .strict();
+/**
+ * Upper bound on server- and surface-level instructions. These are concise behavior primers, not
+ * documentation; the shared cap keeps prompt ownership predictable across both layers.
+ */
+const MAX_SERVER_INSTRUCTIONS = 4000;
 /** Verified session claims an embedding backend may pass at exchange; undeclared keys are dropped. */
 const sessionClaimsSchema = z.record(z.string().regex(/^[A-Za-z][A-Za-z0-9_]{0,63}$/, 'claim keys are identifier-style'), z.object({ exposeToModel: z.boolean().optional() }).strict());
 const embeddedAssistantSchema = z
@@ -342,7 +351,7 @@ const embeddedAssistantSchema = z
         apiKey: z.string().regex(/^[A-Za-z0-9_]+$/),
     })
         .strict(),
-    allowedOrigins: z.array(assistantOriginSchema).min(1),
+    allowedOrigins: z.array(assistantOriginOrVariableSchema).min(1),
     // The front doors this assistant serves (ADR 0201, amended 2026-08-12). Absent means the pre-0201
     // authenticated shape, so released artifacts keep their meaning; `allowedOrigins` stays the union
     // and `sessionClaims` stays mirrored, so the service reads both unchanged. `capabilities` is the
@@ -351,7 +360,8 @@ const embeddedAssistantSchema = z
         .array(z
         .object({
         mode: z.enum(['authenticated', 'public', 'mixed']),
-        origins: z.array(assistantOriginSchema).min(1),
+        origins: z.array(assistantOriginOrVariableSchema).min(1),
+        instructions: z.string().trim().min(1).max(MAX_SERVER_INSTRUCTIONS).optional(),
         capabilities: z.array(assistantCapabilitySchema).optional(),
         sessionClaims: sessionClaimsSchema.optional(),
     })
@@ -423,11 +433,6 @@ const serverShellSchema = z
     persistentActions: z.array(serverShellActionSchema).optional(),
 })
     .strict();
-/**
- * Upper bound on `server.instructions`. Hosts inject instructions into every session's context, so the
- * field is for a concise usage primer (a few hundred words), not documentation.
- */
-const MAX_SERVER_INSTRUCTIONS = 4000;
 const serverContextSchema = z
     .object({
     defaults: z
@@ -472,7 +477,7 @@ const serverV2Schema = serverSchema.extend({
 });
 const handoffSchema = z
     .object({
-    allowedDomains: z.array(httpsUrlSchema).min(1),
+    allowedDomains: z.array(z.union([httpsUrlSchema, managedVariableExpressionSchema])).min(1),
 })
     .strict();
 const stateHandleSchema = z

package/node_modules/@noodle-borg/connector-defs/dist/compile-http.js

@@ -22,6 +22,8 @@ export function compileHttpConnector(def, mode, errors, catalog, connectors, sec
         (stringBase === undefined || isVariableExpression(stringBase) ? [] : [stringBase]);
     if (stringBase !== undefined)
         collectVariableExpression(stringBase, variableBindings);
+    for (const origin of allowedOrigins)
+        collectVariableExpression(origin, variableBindings);
     if (def.http.auth !== undefined)
         collectVariablesFromHttpAuth(def.http.auth, variableBindings);
     if (routedBase) {

package/node_modules/@noodle-borg/connector-defs/dist/schema.d.ts

@@ -269,7 +269,7 @@ declare const httpConnectorDefSchema: z.ZodObject<{
                 readonly allowedHttpsHostSuffixes: readonly string[];
             }, unknown>>;
         }, z.core.$strict>]>;
-        allowedOrigins: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        allowedOrigins: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodString]>>>;
         auth: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
             kind: z.ZodLiteral<"bearer">;
             secret: z.ZodString;
@@ -551,7 +551,7 @@ declare const connectorDefSchema: z.ZodUnion<readonly [z.ZodObject<{
                 readonly allowedHttpsHostSuffixes: readonly string[];
             }, unknown>>;
         }, z.core.$strict>]>;
-        allowedOrigins: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        allowedOrigins: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodString]>>>;
         auth: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
             kind: z.ZodLiteral<"bearer">;
             secret: z.ZodString;
@@ -828,7 +828,7 @@ export declare const connectorFileSchema: z.ZodObject<{
                     readonly allowedHttpsHostSuffixes: readonly string[];
                 }, unknown>>;
             }, z.core.$strict>]>;
-            allowedOrigins: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            allowedOrigins: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodString]>>>;
             auth: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
                 kind: z.ZodLiteral<"bearer">;
                 secret: z.ZodString;

package/node_modules/@noodle-borg/connector-defs/dist/schema.js

@@ -366,6 +366,9 @@ const computeOperationSchema = z
     credentials: operationCredentialsSchema.optional(),
 })
     .strict();
+const managedVariableExpressionSchema = z
+    .string()
+    .regex(/^\$\{env\.[A-Za-z0-9_]+\}$/, 'must be an exact managed variable expression');
 const connectorIdentity = {
     id: z.string().min(1),
     version: z.string().min(1),
@@ -381,7 +384,9 @@ const httpConnectorDefSchema = z
     http: z
         .object({
         baseUrl: baseUrlSchema,
-        allowedOrigins: z.array(z.string().url()).optional(),
+        allowedOrigins: z
+            .array(z.union([z.string().url(), managedVariableExpressionSchema]))
+            .optional(),
         /** Connector-default auth scheme; an operation's own `auth` overrides it. */
         auth: httpAuthSchema.optional(),
     })