@noodleseed/one 0.136.0 → 0.138.0

package/node_modules/@noodle-borg/service/dist/routes/access.js

@@ -1,6 +1,7 @@
 import { normalizeServerVersion } from '@noodle-borg/module';
 import { accessUpdateRequestSchema } from '@noodle-borg/wire-contracts';
 import { readJsonBody, sendJson } from '../http-util.js';
+import { deploymentOwnerSubject } from '../registry-helpers.js';
 import { authorizeControlPlane } from './control-plane.js';
 import { canManageMembers } from './org-admin.js';
 export async function handleAccessUpdate(req, res, registry, gate, controlPlane, audit, maxBody, tenant) {
@@ -30,7 +31,11 @@ export async function handleAccessUpdate(req, res, registry, gate, controlPlane,
     catch (error) {
         return sendJson(res, 400, { error: error.message });
     }
-    const result = await registry.updateAccess(tenant, parsed.data.accessMode, serverVersion);
+    const result = await registry.updateAccess(tenant, {
+        accessMode: parsed.data.accessMode,
+        ...(parsed.data.ownerSubject !== undefined ? { ownerSubject: parsed.data.ownerSubject } : {}),
+        ...(serverVersion !== undefined ? { serverVersion } : {}),
+    });
     if (!result.ok) {
         return sendJson(res, result.status, {
             error: result.message,
@@ -38,6 +43,7 @@ export async function handleAccessUpdate(req, res, registry, gate, controlPlane,
         });
     }
     const accessMode = result.record.accessMode ?? 'owner-only';
+    const ownerSubject = deploymentOwnerSubject(result.record);
     await audit.emit({
         eventType: 'deployment.access.updated',
         org: tenant.org,
@@ -51,6 +57,12 @@ export async function handleAccessUpdate(req, res, registry, gate, controlPlane,
         details: {
             previousAccessMode: result.previousAccessMode,
             accessMode,
+            ...(result.previousOwnerSubject !== undefined
+                ? { previousOwnerSubject: result.previousOwnerSubject }
+                : {}),
+            ...(ownerSubject !== undefined ? { ownerSubject } : {}),
+            accessChanged: result.accessChanged,
+            ownerChanged: result.ownerChanged,
             changed: result.changed,
         },
     });
@@ -63,8 +75,14 @@ export async function handleAccessUpdate(req, res, registry, gate, controlPlane,
                 ? { serverVersion: result.record.serverVersion }
                 : {}),
             accessMode,
+            ...(ownerSubject !== undefined ? { ownerSubject } : {}),
         },
         previousAccessMode: result.previousAccessMode,
+        ...(result.previousOwnerSubject !== undefined
+            ? { previousOwnerSubject: result.previousOwnerSubject }
+            : {}),
+        accessChanged: result.accessChanged,
+        ownerChanged: result.ownerChanged,
         changed: result.changed,
     });
 }

package/node_modules/@noodle-borg/service/dist/routes/analytics-dispatch.js

@@ -1,8 +1,24 @@
 import { handleTenantEvents, handleTenantMetrics, handleTenantSession } from './analytics.js';
-import { parseTenantEventsPath, parseTenantMetricsPath, parseTenantSessionPath } from './paths.js';
+import { handleTenantAssistantUsage } from './assistant-usage.js';
+import { parseTenantAssistantUsagePath, parseTenantEventsPath, parseTenantMetricsPath, parseTenantSessionPath, } from './paths.js';
 /** Try the analytics read routes; returns true when the request was handled (or a guard ended it). */
 export function dispatchAnalyticsReads(req, res, url, deps) {
     const { gate, controlPlane, requestEventStore, applySecurityHeaders, enforceHttps, sendJson, tls, developerGrantStore, } = deps;
+    const assistantUsageRef = parseTenantAssistantUsagePath(url.pathname);
+    if (assistantUsageRef !== undefined && req.method === 'GET') {
+        applySecurityHeaders(res, tls);
+        if (enforceHttps(req, res, tls))
+            return true;
+        if (requestEventStore === undefined) {
+            sendJson(res, 409, { ok: false, error: 'assistant usage requires a configured event store' });
+            return true;
+        }
+        handleTenantAssistantUsage(req, res, gate, controlPlane, requestEventStore, assistantUsageRef, url, developerGrantStore).catch(() => {
+            if (!res.headersSent)
+                sendJson(res, 500, { error: 'internal error' });
+        });
+        return true;
+    }
     const metricsRef = parseTenantMetricsPath(url.pathname);
     if (metricsRef !== undefined && req.method === 'GET') {
         applySecurityHeaders(res, tls);

package/node_modules/@noodle-borg/service/dist/routes/analytics.js

@@ -1,5 +1,5 @@
+import { aggregateRequestEvents } from '@noodle-borg/observability';
 import { normalizedTimestamps, sendJson } from '../http-util.js';
-import { aggregateRequestEvents } from '../request-event-metrics.js';
 import { authorizeTenantControl, developerGrantRouteAccess } from './control-plane.js';
 /**
  * Tenant analytics read routes (ADR 0121 Stage B): `metrics` (aggregated), `events` (the stream), and

package/node_modules/@noodle-borg/service/dist/routes/assistant-agent.js

@@ -1,17 +1,16 @@
 import { ADMISSION_DEFAULTS } from '@noodle-borg/admission-limits/portable';
+import { requestModelCompletion, } from '@noodle-borg/assistant-gateway/model-runtime';
 import { dispatchAssistantTool, projectAssistantGuide, publicSurfaceOf, selectAssistantModelTools, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
 import { validateJsonSchemaWithDefaults } from '@noodle-borg/compiler';
 import { guardedFetch } from '@noodle-borg/connector-http';
 import { evaluateToolAuthorization } from '@noodle-borg/protocol';
 import { executeTool } from '@noodle-borg/runtime';
 import { toolTouchesDelegatedAuth } from '../assistant-delegated-projection.js';
-import { readModelCompletion, } from '../assistant-model-stream.js';
 import { assistantViewAvailableData } from '../assistant-view-availability.js';
 import { invocationContextSystemMessages } from '../invocation-context.js';
-import { resolveManagedVariablesInString } from '../managed-config-expressions.js';
-import { resolveConfigScope } from '../store.js';
 import { interceptForElevation, offersSignIn } from './assistant-elevation.js';
 import { assistantKnowledgeModelTools, executeAssistantKnowledgeSearch, findAssistantKnowledgeComponent, KNOWLEDGE_CITATION_GUIDANCE, resolveAssistantKnowledge, } from './assistant-knowledge.js';
+import { resolveAssistantModelBinding } from './assistant-model-binding.js';
 const MAX_MODEL_RESPONSE = 1 << 20;
 /**
  * The agent-loop bounds come from the admission envelope so an operator lowering them changes
@@ -22,21 +21,33 @@ function agentBounds(deps) {
     const envelope = deps.admissionEnvelope ?? ADMISSION_DEFAULTS;
     return { steps: envelope.modelStepsPerTurn, toolCalls: envelope.toolCallsPerTurn };
 }
+export function createAssistantTurnStats() {
+    return {
+        modelRequests: 0,
+        toolCalls: 0,
+        interactionCount: 0,
+        promptTokens: 0,
+        completionTokens: 0,
+        reasoningTokens: 0,
+        totalTokens: 0,
+    };
+}
 /** Run one model/tool loop against the immutable invocation-context snapshot for this turn. */
-export async function runAgentTurn(target, session, message, context, deps, emit, modelContext, pageContext) {
+export async function runAgentTurn(target, session, message, context, deps, emit, modelContext, pageContext, stats = createAssistantTurnStats()) {
     const assistant = target.served.artifact.server.assistant;
     if (!assistant)
         return emit({ event: 'error', data: { code: 'assistant_unavailable' } });
-    const scope = resolveConfigScope(session.tenant);
-    const [variables, secrets] = await Promise.all([
-        deps.registry.configStore.resolveConfigValues('variable', scope),
-        deps.registry.configStore.resolveConfigValues('secret', scope),
-    ]);
-    const baseUrl = resolveManagedVariablesInString(assistant.model.baseUrl, variables).replace(/\/$/, '');
-    const model = resolveManagedVariablesInString(assistant.model.model, variables);
-    const apiKey = secrets[assistant.model.apiKey];
-    if (!apiKey)
-        return emit({ event: 'error', data: { code: 'model_not_configured' } });
+    const binding = await resolveAssistantModelBinding(target, session.tenant, session.deploymentId, deps);
+    if (!binding) {
+        return emit({
+            event: 'error',
+            data: {
+                code: assistant.model.kind === 'noodle-managed'
+                    ? 'managed_model_unavailable'
+                    : 'model_not_configured',
+            },
+        });
+    }
     const identityLine = signedInIdentityLine(session.caller, assistant.sessionClaims);
     const knowledge = await resolveAssistantKnowledge(target.served);
     const modelTools = selectTurnModelTools(target, session.caller);
@@ -125,8 +136,24 @@ export async function runAgentTurn(target, session, message, context, deps, emit
     // Across every step of this turn, not per step: eight tool calls is eight, however the model splits
     // them, or a model that loops one call per step would spend the budget a step at a time.
     let toolCallsThisTurn = 0;
+    let remainingTokens = binding.requestPolicy?.maxTokensPerTurn;
+    const turnSignal = binding.requestPolicy?.maxTurnMs === undefined
+        ? undefined
+        : AbortSignal.timeout(binding.requestPolicy.maxTurnMs);
     for (let step = 0; step < bounds.steps; step += 1) {
-        const completion = await requestCompletion(baseUrl, model, apiKey, messages, target, session.caller, deps.modelFetch, (delta) => emit({ event: 'content', data: { delta } }), assistantKnowledgeModelTools(knowledge), modelTools);
+        if (remainingTokens !== undefined && remainingTokens <= 0) {
+            return emit({ event: 'error', data: { code: 'model_token_budget_exhausted' } });
+        }
+        const requestTokenLimit = Math.min(binding.requestPolicy?.maxCompletionTokens ?? Number.MAX_SAFE_INTEGER, remainingTokens ?? Number.MAX_SAFE_INTEGER);
+        const completion = await requestCompletion(binding, messages, target, session.caller, deps.modelFetch, (delta) => emit({ event: 'content', data: { delta } }), assistantKnowledgeModelTools(knowledge), modelTools, requestTokenLimit === Number.MAX_SAFE_INTEGER ? undefined : requestTokenLimit, turnSignal);
+        stats.modelRequests += 1;
+        stats.promptTokens += completion.usage?.promptTokens ?? 0;
+        stats.completionTokens += completion.usage?.completionTokens ?? 0;
+        stats.reasoningTokens += completion.usage?.reasoningTokens ?? 0;
+        stats.totalTokens += completion.usage?.totalTokens ?? 0;
+        if (remainingTokens !== undefined) {
+            remainingTokens = Math.max(0, remainingTokens - (completion.usage?.completionTokens ?? requestTokenLimit));
+        }
         const response = completion.choices[0]?.message;
         if (!response)
             return emit({ event: 'error', data: { code: 'invalid_model_response' } });
@@ -139,6 +166,7 @@ export async function runAgentTurn(target, session, message, context, deps, emit
         });
         for (const call of response.tool_calls) {
             toolCallsThisTurn += 1;
+            stats.toolCalls += 1;
             if (toolCallsThisTurn > bounds.toolCalls) {
                 return emit({ event: 'error', data: { code: 'tool_call_budget_exhausted' } });
             }
@@ -184,6 +212,7 @@ export async function runAgentTurn(target, session, message, context, deps, emit
                 now: assistantNow(deps),
             });
             if (elevation) {
+                stats.interactionCount += 1;
                 emit(elevation.event);
                 messages.push({
                     role: 'tool',
@@ -223,6 +252,7 @@ export async function runAgentTurn(target, session, message, context, deps, emit
                 onToolStarted: () => emit({ event: 'tool_started', data: { id: call.id, tool: tool.name } }),
             });
             if (dispatch.kind === 'event') {
+                stats.interactionCount += 1;
                 return emit({ event: dispatch.event, data: dispatch.data });
             }
             const view = assistantViewAvailableData(target.served.artifact, {
@@ -252,15 +282,8 @@ export async function narrateInteractionResolution(target, session, tool, action
     const assistant = target.served.artifact.server.assistant;
     if (!assistant)
         return '';
-    const scope = resolveConfigScope(session.tenant);
-    const [variables, secrets] = await Promise.all([
-        deps.registry.configStore.resolveConfigValues('variable', scope),
-        deps.registry.configStore.resolveConfigValues('secret', scope),
-    ]);
-    const baseUrl = resolveManagedVariablesInString(assistant.model.baseUrl, variables).replace(/\/$/, '');
-    const model = resolveManagedVariablesInString(assistant.model.model, variables);
-    const apiKey = secrets[assistant.model.apiKey];
-    if (!apiKey)
+    const binding = await resolveAssistantModelBinding(target, session.tenant, session.deploymentId, deps);
+    if (!binding)
         return '';
     const identityLine = signedInIdentityLine(session.caller, assistant.sessionClaims);
     const knowledge = await resolveAssistantKnowledge(target.served);
@@ -285,7 +308,7 @@ export async function narrateInteractionResolution(target, session, tool, action
         },
     ];
     let narrated = '';
-    const completion = await requestCompletion(baseUrl, model, apiKey, messages, target, session.caller, deps.modelFetch, (delta) => {
+    const completion = await requestCompletion(binding, messages, target, session.caller, deps.modelFetch, (delta) => {
         narrated += delta;
         onDelta(delta);
     });
@@ -296,40 +319,31 @@ export async function narrateInteractionResolution(target, session, tool, action
     }
     return narrated;
 }
-async function requestCompletion(baseUrl, model, apiKey, messages, target, caller, injected, onContent = () => undefined, extraTools = [], selectedModelTools) {
-    const url = new URL(`${baseUrl}/chat/completions`);
-    if (url.protocol !== 'https:' || url.username || url.password)
-        throw new Error('unsafe model endpoint');
-    const init = {
-        method: 'POST',
-        headers: { Authorization: `Bearer ${apiKey}`, 'content-type': 'application/json' },
-        body: JSON.stringify({
-            model,
-            stream: true,
-            messages,
-            tools: [
-                // On a mixed surface an anonymous caller sees gated tools too: projecting one to the
-                // surface is the author's opt-in to advertise it, and dispatch converts the call into a
-                // sign-in offer instead of executing (ADR 0201 decision 4). The same selector feeds the
-                // compact product guide, keeping instructions and callable tools in lockstep.
-                ...(selectedModelTools ?? selectTurnModelTools(target, caller)).map((tool) => ({
-                    type: 'function',
-                    function: {
-                        name: tool.name,
-                        description: tool.description,
-                        parameters: tool.inputSchema,
-                    },
-                })),
-                ...extraTools,
-            ],
-        }),
-        redirect: 'manual',
-        signal: AbortSignal.timeout(30_000),
-    };
-    const response = injected ? await injected(url.href, init) : await guardedFetch(url, init);
-    if (!response.ok)
-        throw new Error(`model request failed (${response.status})`);
-    return readModelCompletion(response, onContent, MAX_MODEL_RESPONSE);
+async function requestCompletion(binding, messages, target, caller, injected, onContent = () => undefined, extraTools = [], selectedModelTools, maxCompletionTokens, signal) {
+    return requestModelCompletion({
+        binding,
+        messages,
+        tools: [
+            // On a mixed surface an anonymous caller sees gated tools too: projecting one to the
+            // surface is the author's opt-in to advertise it, and dispatch converts the call into a
+            // sign-in offer instead of executing (ADR 0201 decision 4). The same selector feeds the
+            // compact product guide, keeping instructions and callable tools in lockstep.
+            ...(selectedModelTools ?? selectTurnModelTools(target, caller)).map((tool) => ({
+                type: 'function',
+                function: {
+                    name: tool.name,
+                    description: tool.description,
+                    parameters: tool.inputSchema,
+                },
+            })),
+            ...extraTools.map((tool) => ({ ...tool, type: 'function' })),
+        ],
+        fetcher: injected ?? ((url, init) => guardedFetch(new URL(url), init)),
+        onContent,
+        maxResponseBytes: MAX_MODEL_RESPONSE,
+        ...(maxCompletionTokens === undefined ? {} : { maxCompletionTokens }),
+        ...(signal === undefined ? {} : { signal }),
+    });
 }
 function selectTurnModelTools(target, caller) {
     const assistant = target.served.artifact.server.assistant;

package/node_modules/@noodle-borg/service/dist/routes/assistant-doctor.js

@@ -1,7 +1,7 @@
 import { randomUUID } from 'node:crypto';
 import { assistantCustomerIssuer, completeElevation, publicSurfaceOf, } from '@noodle-borg/assistant-gateway/portable';
+import { tenantMcpUrl } from '@noodle-borg/module';
 import { readJsonBody, sendForbidden, sendJson } from '../http-util.js';
-import { tenantMcpUrl } from '../registry-helpers.js';
 import { now } from './assistant-route-http.js';
 import { authorizeControlPlane } from './control-plane.js';
 /**

package/node_modules/@noodle-borg/service/dist/routes/assistant-model-binding.js

@@ -0,0 +1,28 @@
+import { resolveManagedVariablesInString } from '../managed-config-expressions.js';
+import { resolveConfigScope } from '../store.js';
+export async function resolveAssistantModelBinding(target, tenant, deploymentId, deps) {
+    const declaration = target.served.artifact.server.assistant?.model;
+    if (declaration === undefined)
+        return undefined;
+    if (declaration.kind === 'noodle-managed') {
+        return deps.managedModelResolver?.resolve({
+            tenant,
+            deploymentId,
+        });
+    }
+    const scope = resolveConfigScope(tenant);
+    const [variables, secrets] = await Promise.all([
+        deps.registry.configStore.resolveConfigValues('variable', scope),
+        deps.registry.configStore.resolveConfigValues('secret', scope),
+    ]);
+    const apiKey = secrets[declaration.apiKey];
+    if (!apiKey)
+        return undefined;
+    return {
+        source: 'operator',
+        baseUrl: resolveManagedVariablesInString(declaration.baseUrl, variables).replace(/\/$/, ''),
+        model: resolveManagedVariablesInString(declaration.model, variables),
+        apiKey,
+    };
+}
+//# sourceMappingURL=assistant-model-binding.js.map

package/node_modules/@noodle-borg/service/dist/routes/assistant-public-session.js

@@ -1,6 +1,7 @@
 import { randomBytes } from 'node:crypto';
 import { ADMISSION_DEFAULTS, clientAddressBucket } from '@noodle-borg/admission-limits/portable';
 import { mintPublicSession, publicSurfaceOf, } from '@noodle-borg/assistant-gateway/portable';
+import { assistantSessionUsageRequestEvent, captureAssistantUsage, } from '@noodle-borg/observability';
 import { assistantSessionResponseSchema } from '@noodle-borg/wire-contracts';
 import { readJsonBody, sendJson } from '../http-util.js';
 import { assistantBrowserConfiguration } from './assistant-configuration.js';
@@ -20,6 +21,7 @@ function tenantOf(embed) {
     return { org: embed.org, app: embed.app, env: embed.env };
 }
 export async function handlePublicAssistantSession(req, res, deps) {
+    const usageStartedAt = performance.now();
     const embeds = deps.publicEmbeds;
     const counters = deps.admissionCounters;
     if (!embeds || !counters) {
@@ -37,6 +39,8 @@ export async function handlePublicAssistantSession(req, res, deps) {
     // applies — losing fairness, never solvency.
     const addressBucket = clientAddressBucket(typeof req.headers['x-forwarded-for'] === 'string' ? req.headers['x-forwarded-for'] : undefined);
     let configuration;
+    let sponsoredBudget;
+    let usageSession;
     const result = await mintPublicSession({ embedId, origin, ...(addressBucket ? { addressBucket } : {}) }, deps.admissionEnvelope ?? ADMISSION_DEFAULTS, {
         embeds,
         counters,
@@ -44,10 +48,17 @@ export async function handlePublicAssistantSession(req, res, deps) {
             const target = await deps.registry.getActiveByTenant(tenantOf(embed));
             if (!target?.deploymentId)
                 return undefined;
+            if (target.served.artifact.server.assistant?.model.kind === 'noodle-managed') {
+                sponsoredBudget = (await deps.managedModelResolver?.resolve({
+                    tenant: tenantOf(embed),
+                    deploymentId: target.deploymentId,
+                }))?.publicAdmission;
+            }
             // Read from the ACTIVE deployment rather than cached on the embed record — which is what lets
             // `noodle deploy` alone update a snippet a customer pasted months ago.
             return publicSurfaceOf(target.served.artifact.server.assistant);
         },
+        resolveBudgetBounds: async () => sponsoredBudget,
         createSession: async (input) => {
             const target = await deps.registry.getActiveByTenant(tenantOf(input.embed));
             if (!target?.deploymentId)
@@ -60,6 +71,9 @@ export async function handlePublicAssistantSession(req, res, deps) {
                 clientId: input.embed.embedId,
                 tenant: tenantOf(input.embed),
                 deploymentId: target.deploymentId,
+                modelSource: target.served.artifact.server.assistant?.model.kind === 'noodle-managed'
+                    ? 'noodle-managed'
+                    : 'operator',
                 origin: input.origin,
                 publicEmbedId: input.embed.embedId,
                 caller: { subject: input.subject, identityKind: 'anonymous' },
@@ -68,6 +82,7 @@ export async function handlePublicAssistantSession(req, res, deps) {
                 expiresAt: new Date(current.getTime() + input.envelope.sessionIdleMs).toISOString(),
                 absoluteExpiresAt: new Date(current.getTime() + input.envelope.sessionAbsoluteMs).toISOString(),
             });
+            usageSession = created.session;
             return { token: created.token, expiresAt: created.session.expiresAt };
         },
         // Opaque, server-minted, unlinkable to any person: nothing from the request becomes a subject.
@@ -95,6 +110,9 @@ export async function handlePublicAssistantSession(req, res, deps) {
     // Parse rather than trust: every published @noodleseed/assistant widget consumes this shape, and the
     // public mint must not be the path that quietly diverges from it (ADR 0151).
     assistantSessionResponseSchema.parse(sessionBody);
+    if (usageSession !== undefined) {
+        captureAssistantUsage(deps.captureRequestEvent, assistantSessionUsageRequestEvent(usageSession, performance.now() - usageStartedAt));
+    }
     return sendJson(res, 201, sessionBody);
 }
 //# sourceMappingURL=assistant-public-session.js.map

package/node_modules/@noodle-borg/service/dist/routes/assistant-public-turn.js

@@ -21,6 +21,12 @@ addressBucket) {
     const result = await admitPublicTurn({ sessionId: session.id, publicEmbedId, message, ...(addressBucket ? { addressBucket } : {}) }, deps.admissionEnvelope ?? ADMISSION_DEFAULTS, {
         counters,
         embeds,
+        resolveBudgetBounds: async () => session.modelSource !== 'noodle-managed'
+            ? undefined
+            : (await deps.managedModelResolver?.resolve({
+                tenant: session.tenant,
+                deploymentId: session.deploymentId,
+            }))?.publicAdmission,
         consumeTurn: (id, limit) => deps.store.consumeTurn(id, limit),
         now: () => now(deps),
     });

package/node_modules/@noodle-borg/service/dist/routes/assistant-usage.js

@@ -0,0 +1,42 @@
+import { ASSISTANT_USAGE_METHOD, aggregateAssistantUsage } from '@noodle-borg/observability';
+import { normalizedTimestamps, sendJson } from '../http-util.js';
+import { authorizeTenantControl, developerGrantRouteAccess } from './control-plane.js';
+const WINDOWS_MS = new Map([
+    ['24h', 24 * 60 * 60 * 1000],
+    ['7d', 7 * 24 * 60 * 60 * 1000],
+    ['30d', 30 * 24 * 60 * 60 * 1000],
+]);
+/** Bounded raw-event scan; a filled scan is explicitly marked partial in the response. */
+const ASSISTANT_USAGE_SCAN_LIMIT = 50_000;
+export async function handleTenantAssistantUsage(req, res, gate, controlPlane, events, ref, url, developerGrants) {
+    const identity = await authorizeTenantControl(req, res, gate, controlPlane, ref.org, developerGrantRouteAccess(developerGrants, 'cloud:read'));
+    if (identity === false)
+        return;
+    const windowParam = url.searchParams.get('window') ?? '7d';
+    const windowMs = WINDOWS_MS.get(windowParam);
+    if (windowMs === undefined) {
+        return sendJson(res, 400, { error: '"window" must be one of 24h, 7d, 30d' });
+    }
+    const timestamps = normalizedTimestamps(res, {
+        until: url.searchParams.get('until') ?? undefined,
+    });
+    if (timestamps === undefined)
+        return;
+    const since = new Date(Date.now() - windowMs).toISOString();
+    const window = await events.list({
+        org: ref.org,
+        app: ref.app,
+        env: ref.env,
+        method: ASSISTANT_USAGE_METHOD,
+        since,
+        ...(timestamps.until === undefined ? {} : { until: timestamps.until }),
+        limit: ASSISTANT_USAGE_SCAN_LIMIT,
+    });
+    return sendJson(res, 200, {
+        ok: true,
+        window: { since, ...(timestamps.until === undefined ? {} : { until: timestamps.until }) },
+        ...(window.length >= ASSISTANT_USAGE_SCAN_LIMIT ? { truncated: true } : {}),
+        metrics: aggregateAssistantUsage(window),
+    });
+}
+//# sourceMappingURL=assistant-usage.js.map

package/node_modules/@noodle-borg/service/dist/routes/assistant.js

@@ -2,13 +2,14 @@ import { clientAddressBucket, } from '@noodle-borg/admission-limits/portable';
 import { ASSISTANT_SESSION_IDLE_MS, dispatchAssistantTool, parseAssistantContextPreferences, parseAssistantCustomerRouting, resumeTurnMessage, shouldAutoResume, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
 import { canonicalizeAuthorizationClaimValues } from '@noodle-borg/auth';
 import { validateJsonSchemaWithDefaults } from '@noodle-borg/compiler';
+import { tenantMcpUrl } from '@noodle-borg/module';
+import { assistantRefusedTurnUsageRequestEvent, assistantSessionUsageRequestEvent, assistantTurnNumber, assistantTurnUsageRequestEvent, captureAssistantUsage, } from '@noodle-borg/observability';
 import { evaluateToolAuthorization, mapExecutionError, mapResourceContents, mapResourcesList, mapToolOutput, mapToolsList, } from '@noodle-borg/protocol';
 import { executeResource } from '@noodle-borg/runtime';
 import { assistantMessageTurnRequestSchema, assistantResumeTurnRequestSchema, assistantSessionResponseSchema, } from '@noodle-borg/wire-contracts';
 import { readJsonBody, sendForbidden, sendJson, sendUnauthorized } from '../http-util.js';
 import { resolveInvocationContextSnapshot } from '../invocation-context.js';
-import { tenantMcpUrl } from '../registry-helpers.js';
-import { runAgentTurn } from './assistant-agent.js';
+import { createAssistantTurnStats, runAgentTurn } from './assistant-agent.js';
 import { assistantBrowserConfiguration } from './assistant-configuration.js';
 import { elevateAssistantSession } from './assistant-elevation.js';
 import { executeAssistantKnowledgeSearch, findAssistantKnowledgeComponent, resolveAssistantKnowledge, } from './assistant-knowledge.js';
@@ -144,6 +145,7 @@ export async function handleAssistantClients(req, res, tenant, id, action, deps)
     sendJson(res, 405, { error: 'method not allowed' });
 }
 export async function handleAssistantSession(req, res, deps) {
+    const usageStartedAt = performance.now();
     const credentials = basicCredentials(req);
     if (!credentials)
         return sendUnauthorized(res, 'invalid assistant client');
@@ -245,6 +247,7 @@ export async function handleAssistantSession(req, res, deps) {
         clientId: client.id,
         tenant: client.tenant,
         deploymentId: target.deploymentId,
+        modelSource: assistant.model.kind === 'noodle-managed' ? 'noodle-managed' : 'operator',
         origin: parsed.origin,
         ...(customerRouting.customerRouting
             ? { customerRouting: customerRouting.customerRouting }
@@ -272,12 +275,15 @@ export async function handleAssistantSession(req, res, deps) {
     // Every published @noodleseed/assistant widget consumes this shape; parse (don't just test)
     // so a contract break fails loudly at mint time instead of stranding deployed widgets (ADR 0151).
     assistantSessionResponseSchema.parse(sessionBody);
+    captureAssistantUsage(deps.captureRequestEvent, assistantSessionUsageRequestEvent(session.session, performance.now() - usageStartedAt));
     return sendJson(res, 201, sessionBody);
 }
 export async function handleAssistantTurn(req, res, deps) {
+    const usageStartedAt = performance.now();
     const session = await authenticateSession(req, res, deps);
     if (!session)
         return;
+    const usageTurnNumber = assistantTurnNumber(session);
     applyBrowserCors(req, res, session.origin);
     const body = await readJsonBody(req, deps.maxBody);
     if (!body.ok)
@@ -296,6 +302,7 @@ export async function handleAssistantTurn(req, res, deps) {
         }
         const refusal = await refusePublicTurn(deps, session, 'resume', addressBucket);
         if (refusal) {
+            captureAssistantUsage(deps.captureRequestEvent, assistantRefusedTurnUsageRequestEvent(session, refusal.code, performance.now() - usageStartedAt));
             return sendJson(res, refusal.status, { error: refusal.message, code: refusal.code });
         }
         const pending = await deps.store.consumePendingResume(session.id);
@@ -344,6 +351,7 @@ export async function handleAssistantTurn(req, res, deps) {
         // of the model, so a refused turn costs the customer nothing.
         const refusal = await refusePublicTurn(deps, session, message, addressBucket);
         if (refusal) {
+            captureAssistantUsage(deps.captureRequestEvent, assistantRefusedTurnUsageRequestEvent(session, refusal.code, performance.now() - usageStartedAt));
             return sendJson(res, refusal.status, { error: refusal.message, code: refusal.code });
         }
         // The visitor typed first: any pending post-sign-in resume is moot, and must not fire later.
@@ -376,12 +384,13 @@ export async function handleAssistantTurn(req, res, deps) {
     });
     res.flushHeaders?.();
     const events = [];
+    const stats = createAssistantTurnStats();
     const emit = (event) => {
         events.push(event);
         res.write(`event: ${event.event}\ndata: ${JSON.stringify(event.data)}\n\n`);
     };
     try {
-        await runAgentTurn(target, session, message.trim(), invocationContext, deps, emit, turn?.modelContext, turn?.pageContext);
+        await runAgentTurn(target, session, message.trim(), invocationContext, deps, emit, turn?.modelContext, turn?.pageContext, stats);
         const assistantContent = events
             .filter((event) => event.event === 'content')
             .map((event) => String(event.data.delta ?? ''))
@@ -395,6 +404,14 @@ export async function handleAssistantTurn(req, res, deps) {
         emit({ event: 'error', data: { code: 'model_transport_failed', retryable: true } });
     }
     res.end('event: done\ndata: {}\n\n');
+    const error = events.find((event) => event.event === 'error');
+    captureAssistantUsage(deps.captureRequestEvent, assistantTurnUsageRequestEvent(session, {
+        outcome: error === undefined ? 'delivered' : 'failed',
+        counters: stats,
+        turnNumber: usageTurnNumber,
+        durationMs: performance.now() - usageStartedAt,
+        ...(typeof error?.data.code === 'string' ? { errorKind: error.data.code } : {}),
+    }));
 }
 /** Standard MCP operations exposed to an initialized app inside the embedded assistant host. */
 export async function handleAssistantAppRequest(req, res, deps) {

package/node_modules/@noodle-borg/service/dist/routes/auth-doctor-live.js

@@ -1,8 +1,7 @@
 import { bearerToken } from '@noodle-borg/control-plane/portable';
-import { normalizeServerVersion } from '@noodle-borg/module';
+import { normalizeServerVersion, tenantMcpUrl } from '@noodle-borg/module';
 import { freezeCustomerRoutes, resolveCustomerRouteBinding, } from '@noodle-borg/runtime';
 import { sendJson } from '../http-util.js';
-import { tenantMcpUrl } from '../registry-helpers.js';
 /** Verify one real customer identity and probe delegated bindings without calling business APIs. */
 export async function handleLiveAuthDoctor(req, res, registry, tenant, options) {
     let serverVersion;