@noodleseed/one 0.137.0 → 0.139.0

package/node_modules/@noodle-borg/agent-kit/dist/generated/surface.js

@@ -88,6 +88,7 @@ export const SDK_EXPORTS = [
     'knowledge',
     'managedSecret',
     'meilisearch',
+    'noodleManaged',
     'openAICompatible',
     'prompt',
     'publicWebsite',

package/node_modules/@noodle-borg/agent-kit/dist/skill-authoring-refs.js

@@ -40,7 +40,8 @@ export function renderAuthoringWorkflowReference() {
         '',
         '1. **Website scrape** — if the user gives a URL, scrape it for surface hints (products, services, hours, contact, pricing). Stop there: the URL does not reveal CRM, booking systems, custom APIs, auth model, eligibility rules, quoting logic, or approval flows. Those live in the business systems and the owner’s head — ask.',
         '2. **OpenAPI import** — `noodle import openapi <file>` emits a starter `server.ts` from a spec. Use it when the user provides an OpenAPI document.',
-        '3. **User interview** — Noodle does not interview; you do. Cover custom APIs/integrations, eligibility rules, quoting/approval logic, and private schemas (SQL DDL or JSON samples for custom `connector` declarations). Ask for concrete examples and sample payloads; do not guess a schema from a URL or invent endpoints.',
+        '3. **Upstream MCP import** — `noodle import mcp <url> --name <slug> --output <dir>` discovers `tools/list` once, validates and freezes tool schemas into TypeScript, and writes a secret-free drift snapshot. Upstream annotations are untrusted, so generated tools remain destructive confirmed actions until an author verifies and narrows them. Use `--header-env <header>=<ENV_NAME>` for import-only auth and `--check` for classified, non-mutating drift detection. Runtime never performs discovery.',
+        '4. **User interview** — Noodle does not interview; you do. Cover custom APIs/integrations, eligibility rules, quoting/approval logic, and private schemas (SQL DDL or JSON samples for custom `connector` declarations). Ask for concrete examples and sample payloads; do not guess a schema from a URL or invent endpoints.',
         '',
         '## Fit check',
         '',
@@ -59,10 +60,18 @@ export function renderAuthoringWorkflowReference() {
         'Declare connectors as data, not imperative code:',
         '',
         '- **HTTP**: `connector("id").version("1.0.0").http({ baseUrl, allowedOrigins, auth, operations })` with per-operation `request`/`response` mapping using `${args...}` / `${response...}` expressions.',
+        '- **MCP**: `connector("id").version("1.0.0").mcp({ endpoint, allowedOrigins, auth?, operations })` where each operation freezes the separate upstream `tool` wire name plus input/output schema. Import with `noodle import mcp`; do not hand-copy a live surface or call `tools/list` at runtime.',
         '- **Compute**: `connector("id").version("1.0.0").compute(name, { input, output, calls?, run })` — a self-contained, sandboxed function (no imports/closure capture) that may call allowlisted operations via `callOperation`.',
         '',
         'Tools record connector calls into a flow; recording is not execution. Do not branch on runtime outputs with native `if` — use declarative `when(...)` conditions.',
         '',
+        'MCP connectors are curated backing operations, never transparent proxies. Publish ordinary Noodle tools',
+        'with stable intent-shaped names, descriptions, annotations, authored schemas, confirmation, visibility,',
+        'and optional React `view`. Normalize a text-only upstream result through compute before rendering when the',
+        'view needs a richer stable output. Upstream resources, prompts, `_meta`, annotations, widgets, and CSP are',
+        'not imported or forwarded. The runtime opens one guarded session for one operation, uses only a broker-minted',
+        'credential, and closes it; it does not act as an agent for upstream sampling, roots, or elicitation.',
+        '',
         'HTTP connector auth variants: `bearer` (`{ kind: "bearer", secret: secret("API_TOKEN") }`), `apiKey` (`{ kind: "apiKey", header: "X-API-Key", secret: secret("API_KEY") }`), `clientCredentials`, `delegatedOAuth`, `delegatedSessionCookie`, and `delegatedTokenExchange` (per-user calls to your own API — see "Delegated downstream auth" below). Use managed `secret(...)` / `variable(...)` refs for all values that differ by org/app/env.',
         '',
         'When one connector needs independently selectable accounts, declare catalog `credentialProfiles` plus each operation’s accepted `credentials.profiles`, then bind each `server.use` alias with `bind(connector, { profile, connection: connection("logical_id", managedSecret(secret("NAME"), { scopes, audience })) })`. The alias is the stable account boundary; never put provider account ids, labels, or credential values in it. `gmailConnector()` is the curated Gmail catalog helper; reuse it under independent aliases and accept canonical `accounts` arrays in tools (one account for writes, or an explicitly ordered supported combination for reads). See the bundled `gmail-multi-account` flagship. Bound managed secrets are supported by hosted execution. For deployed-server access to Google APIs, use `googleWorkloadIdentity({ provider: variable("GOOGLE_WIF_PROVIDER"), access: { kind: "direct" } })`, or add `serviceAccountImpersonation` with a managed service-account email. This is keyless Google Workload Identity Federation: exact Google scopes/audience come from the catalog operation, while `noodle auth google prepare|status|doctor|revoke` owns operator lifecycle. See the bundled `google-bigquery` flagship. `externalExchange()` is runnable only when the deployment operator injects an exact HTTPS provider endpoint/origin/audience and durable shared subject-pin store through service ports; Noodle sends a short-lived platform-signed deployment workload assertion and accepts only a bounded bearer response. Provider implementations must consume assertion replay ids through durable shared atomic storage across instances and restarts. There is intentionally no hosted enrollment or provider CRUD surface yet. The provider wire contract is public, but its conformance kit is workspace/source-only and is not an installable npm package. Bound `clientCredentials(...)` remains fail-closed until its provider slice lands.',
@@ -271,7 +280,7 @@ export function renderWidgetsAndAppsReference() {
         '',
         '## Tools and views',
         '',
-        'Use `tool(name, { description, input, output, fulfil, view })` for a model-visible tool that renders a widget, and the same `tool(name, { ..., visibility: ["app"] })` for an app-only helper hidden from the model. A `view` is `{ component: "name", entry: "./views/name.tsx" }` — a React component the compiler bundles at validate/deploy time.',
+        'Use `tool(name, { description, input, output, fulfil, view })` for a model-visible tool that renders a widget, and the same `tool(name, { ..., visibility: ["app"] })` for an app-only helper hidden from the model. When a view is valid only for narrow explicit intent, add `modelVisibility: { latestMessageIncludesAny: ["open the form", ...] }`; Noodle normalizes and matches those literal phrases against the latest user message before model discovery and fails closed on malformed data. This is relevance filtering, never authorization. A `view` is `{ component: "name", entry: "./views/name.tsx" }` — a React component the compiler bundles at validate/deploy time.',
         '',
         '## Noodle Design default',
         '',

package/node_modules/@noodle-borg/agent-kit/dist/skill-connect-refs.js

@@ -16,6 +16,7 @@ export function renderConnectAnApiReference() {
         '- Secure the key first',
         '- Probe the live API',
         '- Model the connector from the observed shape',
+        '- Import and curate an upstream MCP server',
         '- Return a list',
         '- Create, update, delete',
         '- Design intent tools',
@@ -27,7 +28,7 @@ export function renderConnectAnApiReference() {
         '',
         '## Use when',
         '',
-        '- The user provides credentials, a reachable API, or an OpenAPI document and wants real MCP behavior backed by it.',
+        '- The user provides credentials, a reachable API, an OpenAPI document, or an upstream MCP endpoint and wants real MCP behavior backed by it.',
         '- Existing connector behavior compiles but still needs proof against the actual service and data shape.',
         '',
         '## Do not use when',
@@ -85,6 +86,35 @@ export function renderConnectAnApiReference() {
         'The full connector shape, every `auth.kind`, and compute connectors are in',
         '`references/authoring-workflow.md`.',
         '',
+        '### Import and curate an upstream MCP server',
+        '',
+        'Use an explicit import to discover the upstream tool surface once and generate TypeScript:',
+        '',
+        '```sh',
+        'noodle import mcp https://store.example/api/mcp --name store --output store-app',
+        '# When import discovery needs a credential, read it only from the environment:',
+        'noodle import mcp https://store.example/api/mcp --name store \\',
+        '  --header-env Authorization=STORE_MCP_TOKEN',
+        '```',
+        '',
+        'The importer freezes upstream tool names and normalized schemas into `.mcp({ operations })`; it never',
+        'persists the import credential. Runtime calls only those declared operations and never runs `tools/list`.',
+        'MCP annotations are untrusted hints, so every generated tool starts as a destructive confirmed action.',
+        'Verify real behavior and deliberately narrow proven reads before accepting the generated source. Use',
+        '`noodle import mcp <url> --output <dir> --check` in CI to detect upstream additions, removals, or schema',
+        'changes without mutating source; its review labels drift additive, breaking, or metadata-only.',
+        '',
+        'Treat the imported connector operation as a backing-system contract, not the public tool design. Publish',
+        'ordinary intent-shaped `tool(...)` capabilities with stable names and narrower schemas, normalize text or',
+        'large upstream output through compute, and attach a normal Noodle React `view` when UI helps. Upstream',
+        '`_meta`, resources, prompts, annotations, widgets, and CSP are never forwarded. A Noodle-owned widget may',
+        'therefore enrich a headless upstream tool without trusting upstream executable UI.',
+        '',
+        'Managed endpoints require an exact managed origin allowlist. Configure each deployment with',
+        '`variable(...)` and `secret(...)`; inbound MCP/OAuth bearer tokens are never reusable upstream credentials.',
+        'The first release supports no auth, bearer, API key, and client credentials through the broker. Do not',
+        'invent a delegated-user OAuth shortcut for an upstream MCP server.',
+        '',
         '### Return a list',
         '',
         'Most real tools return a variable-length list (search results, a user’s tasks). Bind the **whole array** — a single `${response.path}` returns the referenced value verbatim, arrays included:',

package/node_modules/@noodle-borg/agent-kit/dist/skill-content.js

@@ -129,7 +129,7 @@ const SDK_RECIPES = [
     '',
     '### Non-trivial tool: ctx connectors, annotations, visibility, async',
     '',
-    "`ctx` is `{ input, user, connectors }`. Bind connectors with `use` on the server, then call one inside `fulfil` to record a step. `annotations.readOnly()` declares a closed-world safe read. TypeScript action helpers enforce confirmation only with `{ confirm: true }`; omitted or `false` executes directly, and action/destructive/open-world hints alone never enable the gate. For stateless hosts that cannot present Noodle confirmation, set `interactions: { confirmationFallback: 'host' }` in the `server` options to explicitly trust native host write approval; omission remains fail-closed and the fallback never supplies missing `ctx.elicit` input. `visibility` defaults to `['model', 'app']` — set `['app']` to hide a helper from the model. `fulfil` may be `async` (the compiler awaits it while recording).",
+    "`ctx` is `{ input, user, connectors }`. Bind connectors with `use` on the server, then call one inside `fulfil` to record a step. `annotations.readOnly()` declares a closed-world safe read. TypeScript action helpers enforce confirmation only with `{ confirm: true }`; omitted or `false` executes directly, and action/destructive/open-world hints alone never enable the gate. For stateless hosts that cannot present Noodle confirmation, set `interactions: { confirmationFallback: 'host' }` in the `server` options to explicitly trust native host write approval; omission remains fail-closed and the fallback never supplies missing `ctx.elicit` input. `visibility` defaults to `['model', 'app']` — set `['app']` to hide a helper from the model. For a narrow explicit-intent tool, `modelVisibility: { latestMessageIncludesAny: [...] }` deterministically limits model discovery to a latest user message containing one of the normalized literal phrases; it is not authorization. `fulfil` may be `async` (the compiler awaits it while recording).",
     '',
     '```ts',
     "import { annotations, connector, server, tool, z } from '@noodleseed/one';",
@@ -160,6 +160,7 @@ const SDK_RECIPES = [
     '    output: z.object({ subject: z.string(), status: z.string() }),',
     '    annotations: annotations.readOnly(), // read-only hint for hosts',
     "    visibility: ['model', 'app'], // default; use ['app'] to hide the tool from the model",
+    "    modelVisibility: { latestMessageIncludesAny: ['show ticket', 'open ticket'] },",
     '    // ctx is { input, user, connectors }. A connector call records one flow step (a Ref) —',
     '    // recording is not execution, so never branch on the result with native if (use when).',
     '    fulfil: ({ input, connectors }) => {',
@@ -243,7 +244,7 @@ const SDK_AUTHORING_SIGNATURES = [
     '## Authoring signatures',
     '',
     '- `server(name, options, definitions)` — `options` commonly includes `title`, `version`, `instructions`, `agentGuide`, `distribution`, `branding`, `auth`, `use`, `provides`, `state`, and `handoff`; `definitions` is the array of tools/resources/prompts.',
-    '- `tool(name, { description, input, output, annotations?, visibility?, view?, fulfil })` — `input`/`output` are Zod schemas; `fulfil({ input, connectors, user })` returns data matching `output`. Add `view: { component, entry }` for a React widget; use `visibility: ["app"]` for an app-only helper.',
+    '- `tool(name, { description, input, output, annotations?, visibility?, modelVisibility?, view?, fulfil })` — `input`/`output` are Zod schemas; `fulfil({ input, connectors, user })` returns data matching `output`. Add `view: { component, entry }` for a React widget; use `visibility: ["app"]` for an app-only helper. Use `modelVisibility.latestMessageIncludesAny` only for normalized literal explicit-intent discovery; it does not authorize execution.',
     '- Keep tool input names application-owned and meaningful; `__noodleIntent` is reserved for an optional serve-time operator analytics adapter and never reaches `fulfil`.',
     '- `resource(name, { uri, description?, mimeType?, fulfil })` and `prompt(name, { description?, arguments?, fulfil })` expose MCP resources/prompts.',
     '- View metadata (`viewTitle`, `viewDescription`, `csp`, `domain`, `permissions`) belongs on the tool that renders it; `asset("./path")` packages local files.',

package/node_modules/@noodle-borg/agent-kit/dist/skill-embedded-assistant-ref.js

@@ -32,7 +32,8 @@ export function renderEmbeddedAssistantReference() {
         '| Owner | Values | Destination |',
         '| --- | --- | --- |',
         '| Noodle operator | Login, selected org/app/env | Plugin-managed CLI profile and explicit target; never the SaaS runtime |',
-        '| Noodle deployment | `ASSISTANT_MODEL_BASE_URL`, `ASSISTANT_MODEL`, `ASSISTANT_MODEL_API_KEY` | `noodle variables set` / `noodle secrets set`; never the SaaS environment |',
+        '| Noodle-managed model | No authored provider, model id, URL, or key | Hosted operator state; available only when Noodle has enrolled the exact org/app/env |',
+        '| Operator-provided model | `ASSISTANT_MODEL_BASE_URL`, `ASSISTANT_MODEL`, `ASSISTANT_MODEL_API_KEY` | `noodle variables set` / `noodle secrets set`; never the SaaS environment |',
         '| Connector/delegated exchange | Connector credentials and any customer-owned token-exchange client | Noodle managed configuration plus the matching customer backend secret manager |',
         '| SaaS backend | `NOODLE_SERVICE_URL`, `NOODLE_ASSISTANT_CLIENT_ID`, `NOODLE_ASSISTANT_CLIENT_SECRET`, `PUBLIC_APP_ORIGIN` | Backend-only environment or secret manager; never browser code or public-prefixed variables |',
         '| Browser | Short-lived assistant session only | In memory; never a client secret, model key, connector credential, or raw application session |',
@@ -51,11 +52,7 @@ export function renderEmbeddedAssistantReference() {
         'branding: { name: "Acme", accent: "#3157D5" },',
         'context: { defaults: { locale: "en-GB", timeZone: "Europe/London" } },',
         'assistant: embeddedAssistant({',
-        '  model: openAICompatible({',
-        '    baseUrl: variable("ASSISTANT_MODEL_BASE_URL"),',
-        '    model: variable("ASSISTANT_MODEL"),',
-        '    apiKey: secret("ASSISTANT_MODEL_API_KEY"),',
-        '  }),',
+        '  model: noodleManaged(),',
         '  access: authenticatedWebsite({',
         '    origins: ["http://localhost:3000", "https://app.example.com"],',
         '  }),',
@@ -63,6 +60,8 @@ export function renderEmbeddedAssistantReference() {
         '}),',
         '```',
         '',
+        '`noodleManaged()` is the zero-configuration Cloud path: the public artifact contains only `{ kind: "noodle-managed" }`. It never exposes a provider or model identifier, and it fails closed unless Noodle has enrolled that exact deployment target. For a customer- or self-hosted model, replace it with `openAICompatible({ baseUrl: variable("ASSISTANT_MODEL_BASE_URL"), model: variable("ASSISTANT_MODEL"), apiKey: secret("ASSISTANT_MODEL_API_KEY") })`; that remains the portable BYO path.',
+        '',
         'Origins are exact: scheme, host, and optional port, with no path, trailing slash, or wildcard. Production origins must be HTTPS; plain HTTP is accepted only for loopback development origins (`http://localhost:<port>`, `http://127.0.0.1:<port>`). `noodle dev` serves the MCP project, not the embedding SaaS. For a public surface it also prints a process-local Embed ID and script; mount that script on the separately running loopback website to test anonymous mint, chat, widgets, and confirmation. The local ID is ephemeral, while a hosted deploy provisions the stable ID behind durable admission counters.',
         '',
         '## Product workflow guidance',
@@ -169,7 +168,7 @@ export function renderEmbeddedAssistantReference() {
         'noodle deploy --org <org> --app <app> --env <env>',
         '```',
         '',
-        'Deploy preflights the complete target before upload. In an interactive terminal it collects all missing model variables and secrets, then continues. In a non-interactive run it reports every missing name and safe `noodle variables set ... --from-env` / `noodle secrets set ... --from-env` action; perform every action and repeat the same deploy command. Values never appear in the preflight report or resume state. Do not put these model values in the embedding SaaS environment. A production deployment may omit a local origin; include a loopback origin only when local browser integration is required.',
+        'Deploy preflights the complete target before upload. `noodleManaged()` has no customer model variables or secrets; enrollment is hosted operator state and an unenrolled target fails closed at serving time. `openAICompatible()` preflight collects or reports every missing model variable and secret with safe `noodle variables set ... --from-env` / `noodle secrets set ... --from-env` actions. Values never appear in the preflight report or resume state. Do not put BYO model values in the embedding SaaS environment. A production deployment may omit a local origin; include a loopback origin only when local browser integration is required.',
         '',
         '## Access modes and customer auth',
         '',

package/node_modules/@noodle-borg/agent-kit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodle-borg/agent-kit",
-  "version": "0.81.0",
+  "version": "0.83.0",
   "license": "Apache-2.0",
   "type": "module",
   "engines": {

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-guide.d.ts

@@ -27,6 +27,7 @@ export declare function selectAssistantModelTools(artifact: RuntimeArtifact, cal
     readonly identityKind?: string;
 }) | undefined, options?: {
     readonly anonymousSignInOfferSurface?: readonly SurfaceCapabilityRef[];
+    readonly latestMessage?: string;
 }): readonly ArtifactTool[];
 /**
  * Build bounded product guidance from structured App Package data, never from rendered host files.

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-guide.js

@@ -3,6 +3,9 @@ import { filterAuthorizedTools } from '@noodle-borg/protocol';
 import { projectArtifactForSurface } from './artifact-projection.js';
 /** Model-context budget for the embedded assistant's compact product workflow projection. */
 export const ASSISTANT_GUIDE_MAX_BYTES = 16 * 1024;
+const LATEST_MESSAGE_INCLUDES_ANY = 'x-noodleseed-model-latest-message-includes-any';
+const MAX_VISIBILITY_PHRASES = 32;
+const MAX_VISIBILITY_PHRASE_CHARS = 128;
 /**
  * Select the exact deployment tools an embedded model may see for this turn.
  *
@@ -16,7 +19,38 @@ export function selectAssistantModelTools(artifact, caller, options = {}) {
         ? projectArtifactForSurface(artifact, options.anonymousSignInOfferSurface)
         : undefined;
     const authorized = signInOfferArtifact?.tools ?? filterAuthorizedTools(artifact.tools, caller);
-    return authorized.filter((tool) => tool._meta?.ui?.visibility?.includes('model') !== false);
+    return authorized.filter((tool) => tool._meta?.ui?.visibility?.includes('model') !== false &&
+        matchesLatestMessageConstraint(tool, options.latestMessage));
+}
+function matchesLatestMessageConstraint(tool, latestMessage) {
+    if (!Object.hasOwn(tool.annotations ?? {}, LATEST_MESSAGE_INCLUDES_ANY)) {
+        return true;
+    }
+    const phrases = tool.annotations?.[LATEST_MESSAGE_INCLUDES_ANY];
+    if (!Array.isArray(phrases) ||
+        phrases.length < 1 ||
+        phrases.length > MAX_VISIBILITY_PHRASES ||
+        phrases.some((phrase) => typeof phrase !== 'string' ||
+            phrase.length > MAX_VISIBILITY_PHRASE_CHARS ||
+            normalizeVisibilityText(phrase).length === 0)) {
+        return false;
+    }
+    const normalizedMessage = normalizeVisibilityText(latestMessage ?? '');
+    if (normalizedMessage.length === 0)
+        return false;
+    const paddedMessage = ` ${normalizedMessage} `;
+    return phrases.some((phrase) => {
+        const normalizedPhrase = normalizeVisibilityText(phrase);
+        return paddedMessage.includes(` ${normalizedPhrase} `);
+    });
+}
+function normalizeVisibilityText(value) {
+    return value
+        .normalize('NFKC')
+        .toLocaleLowerCase('en-US')
+        .replace(/[^\p{L}\p{N}]+/gu, ' ')
+        .trim()
+        .replace(/\s+/gu, ' ');
 }
 /**
  * Build bounded product guidance from structured App Package data, never from rendered host files.

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-store.d.ts

@@ -31,6 +31,8 @@ export interface AssistantSessionRecord {
     readonly clientId: string;
     readonly tenant: TenantRef;
     readonly deploymentId: string;
+    /** Model funding boundary pinned with the deployment that minted this session. */
+    readonly modelSource?: 'operator' | 'noodle-managed';
     readonly origin: string;
     readonly caller: CallerIdentity;
     /** Canonical customer endpoint routes; private session authority, never caller or response data. */
@@ -59,8 +61,8 @@ export interface AssistantSessionRecord {
     readonly absoluteExpiresAt: string;
     readonly history: AssistantHistoryMessage[];
     /**
-     * Model turns already spent. Durable and separate from `history`, which truncates to the last twelve
-     * messages: history is a prompt-window trim, never a bound.
+     * Model turns already spent. Durable and separate from `history`, which keeps a bounded recent
+     * prompt window and is never the admission bound.
      */
     readonly turnCount: number;
 }
@@ -78,6 +80,8 @@ export interface AssistantHistoryMessage {
     readonly role: 'user' | 'assistant';
     readonly content: string;
 }
+/** Latest prompt messages retained for model continuity; turn admission is tracked separately. */
+export declare const ASSISTANT_HISTORY_MAX_MESSAGES = 40;
 export type AssistantSessionElevation = {
     readonly ok: true;
     readonly session: AssistantSessionRecord;

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-store.js

@@ -22,6 +22,8 @@ export const ASSISTANT_BROWSER_UI_FIELDS = [
     'locale',
     'direction',
 ];
+/** Latest prompt messages retained for model continuity; turn admission is tracked separately. */
+export const ASSISTANT_HISTORY_MAX_MESSAGES = 40;
 export class InMemoryAssistantStore {
     #clients = new Map();
     #sessions = new Map();
@@ -163,8 +165,9 @@ export class InMemoryAssistantStore {
         if (!session)
             return;
         session.history.push(...messages);
-        if (session.history.length > 12)
-            session.history.splice(0, session.history.length - 12);
+        if (session.history.length > ASSISTANT_HISTORY_MAX_MESSAGES) {
+            session.history.splice(0, session.history.length - ASSISTANT_HISTORY_MAX_MESSAGES);
+        }
     }
     async createInteraction(input) {
         const proposalTime = new Date(input.createdAt ?? new Date());

package/node_modules/@noodle-borg/assistant-gateway/dist/model-request.js

@@ -0,0 +1,37 @@
+import { readModelCompletion } from './model-stream.js';
+export async function requestModelCompletion(input) {
+    const { binding } = input;
+    const url = new URL(`${binding.baseUrl.replace(/\/$/, '')}/chat/completions`);
+    if (url.protocol !== 'https:' || url.username || url.password) {
+        throw new Error('unsafe model endpoint');
+    }
+    const completionLimit = input.maxCompletionTokens ?? binding.requestPolicy?.maxCompletionTokens;
+    const body = JSON.stringify({
+        ...binding.requestPolicy?.extraBody,
+        model: binding.model,
+        stream: true,
+        messages: input.messages,
+        tools: input.tools,
+        ...(completionLimit === undefined ? {} : { max_completion_tokens: completionLimit }),
+    });
+    const requestBytes = new TextEncoder().encode(body).byteLength;
+    const maxRequestBytes = binding.requestPolicy?.maxRequestBytes;
+    if (maxRequestBytes !== undefined && requestBytes > maxRequestBytes) {
+        throw new Error('model request too large');
+    }
+    const bearerToken = binding.apiKey ?? (await binding.bearerToken());
+    if (!/^[^\s]{1,8192}$/.test(bearerToken))
+        throw new Error('invalid model bearer token');
+    const timeoutSignal = AbortSignal.timeout(binding.requestPolicy?.timeoutMs ?? 30_000);
+    const response = await input.fetcher(url.href, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${bearerToken}`, 'content-type': 'application/json' },
+        body,
+        redirect: 'manual',
+        signal: input.signal === undefined ? timeoutSignal : AbortSignal.any([input.signal, timeoutSignal]),
+    });
+    if (!response.ok)
+        throw new Error(`model request failed (${response.status})`);
+    return readModelCompletion(response, input.onContent ?? (() => undefined), input.maxResponseBytes);
+}
+//# sourceMappingURL=model-request.js.map

package/node_modules/@noodle-borg/assistant-gateway/dist/model-runtime.js

@@ -0,0 +1,4 @@
+/** Provider-neutral embedded-assistant model transport. */
+export * from './model-request.js';
+export * from './model-stream.js';
+//# sourceMappingURL=model-runtime.js.map

package/node_modules/@noodle-borg/{service/dist/assistant-model-stream.js → assistant-gateway/dist/model-stream.js}

@@ -2,7 +2,11 @@ export async function readModelCompletion(response, onContent, maxBytes = 1 << 2
     const contentType = response.headers.get('content-type') ?? '';
     if (!contentType.includes('text/event-stream')) {
         const text = await readBoundedText(response, maxBytes);
-        const completion = JSON.parse(text);
+        const parsed = JSON.parse(text);
+        const completion = {
+            choices: parsed.choices,
+            ...normalizeUsage(parsed.usage),
+        };
         const message = completion.choices[0]?.message;
         if (!message?.tool_calls?.length && message?.content)
             onContent(message.content);
@@ -15,6 +19,7 @@ export async function readModelCompletion(response, onContent, maxBytes = 1 << 2
     const toolCalls = new Map();
     let pending = '';
     let content = '';
+    let usage;
     let bytes = 0;
     while (true) {
         const { done, value } = await reader.read();
@@ -36,6 +41,7 @@ export async function readModelCompletion(response, onContent, maxBytes = 1 << 2
             const parsed = JSON.parse(data);
             if (parsed.error !== undefined)
                 throw new Error('model stream returned an error');
+            usage = normalizeUsageValue(parsed.usage) ?? usage;
             const delta = parsed.choices?.[0]?.delta;
             if (delta?.content) {
                 content += delta.content;
@@ -80,8 +86,34 @@ export async function readModelCompletion(response, onContent, maxBytes = 1 << 2
                 },
             },
         ],
+        ...(usage === undefined ? {} : { usage }),
     };
 }
+function normalizeUsage(usage) {
+    const normalized = normalizeUsageValue(usage);
+    return normalized === undefined ? {} : { usage: normalized };
+}
+function normalizeUsageValue(usage) {
+    if (usage === undefined)
+        return undefined;
+    const promptTokens = nonNegativeInteger(usage.prompt_tokens);
+    const completionTokens = nonNegativeInteger(usage.completion_tokens);
+    const reportedTotalTokens = nonNegativeInteger(usage.total_tokens);
+    if (promptTokens === undefined || completionTokens === undefined) {
+        return undefined;
+    }
+    const totalTokens = reportedTotalTokens ?? promptTokens + completionTokens;
+    const reasoningTokens = nonNegativeInteger(usage.completion_tokens_details?.reasoning_tokens);
+    return {
+        promptTokens,
+        completionTokens,
+        totalTokens,
+        ...(reasoningTokens === undefined ? {} : { reasoningTokens }),
+    };
+}
+function nonNegativeInteger(value) {
+    return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 ? value : undefined;
+}
 async function readBoundedText(response, maxBytes) {
     const text = await response.text();
     if (new TextEncoder().encode(text).byteLength > maxBytes) {
@@ -89,4 +121,4 @@ async function readBoundedText(response, maxBytes) {
     }
     return text;
 }
-//# sourceMappingURL=assistant-model-stream.js.map
+//# sourceMappingURL=model-stream.js.map

package/node_modules/@noodle-borg/assistant-gateway/dist/public-session.d.ts

@@ -1,6 +1,7 @@
 import type { AdmissionEnvelope, DailyCounterStore } from '@noodle-borg/admission-limits/portable';
 import { type PublicEmbedRecord, type PublicEmbedStore } from './embed-store.js';
 import type { PublicSurface } from './public-surface.js';
+import { type SurfaceBudgetBounds } from './surface-budget.js';
 /**
  * Minting an anonymous session for a public page.
  *
@@ -17,6 +18,8 @@ export interface PublicSessionPorts {
     readonly counters: DailyCounterStore;
     /** The live surface for this tenant, read from the *active* deployment at mint time. */
     resolveActiveSurface(embed: PublicEmbedRecord): Promise<PublicSurface | undefined>;
+    /** Optional hosted entitlement; absent preserves the ordinary customer-funded envelope. */
+    readonly resolveBudgetBounds?: (embed: PublicEmbedRecord) => Promise<SurfaceBudgetBounds | undefined>;
     /** Persist the anonymous session and return its bearer token and expiry. */
     createSession(input: {
         readonly embed: PublicEmbedRecord;

package/node_modules/@noodle-borg/assistant-gateway/dist/public-session.js

@@ -30,7 +30,8 @@ export async function mintPublicSession(request, envelope, ports) {
     }
     // The surface's own budget, which an operator may have lowered — or set to zero, which is the kill
     // switch. Resolved after the embed is known and before anything is spent.
-    const surfaceLimits = surfaceEnvelope(envelope, embed);
+    const budgetBounds = await ports.resolveBudgetBounds?.(embed);
+    const surfaceLimits = surfaceEnvelope(envelope, embed, budgetBounds);
     const now = ports.now();
     // Fairness before solvency: an address at its hourly ceiling is refused without spending any of the
     // surface's day, so one visitor cannot burn the customer's budget on refusals.

package/node_modules/@noodle-borg/assistant-gateway/dist/public-turn.d.ts

@@ -1,6 +1,7 @@
 import type { AdmissionEnvelope, DailyCounterStore } from '@noodle-borg/admission-limits/portable';
 import type { AssistantTurnConsumption } from './assistant-store.js';
-import type { PublicEmbedStore } from './embed-store.js';
+import type { PublicEmbedRecord, PublicEmbedStore } from './embed-store.js';
+import { type SurfaceBudgetBounds } from './surface-budget.js';
 /**
  * Whether an anonymous visitor's next turn runs.
  *
@@ -16,6 +17,8 @@ export interface PublicTurnPorts {
     readonly counters: DailyCounterStore;
     /** Re-read per turn: it carries the operator's live budget, and whether the surface still exists. */
     readonly embeds: Pick<PublicEmbedStore, 'lookup'>;
+    /** Optional hosted entitlement; resolved live so cohort removal lowers the envelope immediately. */
+    readonly resolveBudgetBounds?: (embed: PublicEmbedRecord) => Promise<SurfaceBudgetBounds | undefined>;
     /** Spend one of this session's turns, atomically (admission tier 1). */
     consumeTurn(id: string, limit: number): Promise<AssistantTurnConsumption>;
     now(): Date;

package/node_modules/@noodle-borg/assistant-gateway/dist/public-turn.js

@@ -22,7 +22,8 @@ export async function admitPublicTurn(request, defaults, ports) {
             message: 'assistant is unavailable right now',
         };
     }
-    const envelope = surfaceEnvelope(defaults, embed);
+    const budgetBounds = await ports.resolveBudgetBounds?.(embed);
+    const envelope = surfaceEnvelope(defaults, embed, budgetBounds);
     // Fairness before either of the budgets below: an address at its hourly ceiling is turned away
     // without spending the session's allowance or the customer's day, so one visitor cannot burn either
     // on turns that were never served. Mirrors the ordering the mint uses.

package/node_modules/@noodle-borg/assistant-gateway/dist/surface-budget.d.ts

@@ -1,5 +1,10 @@
 import { type AdmissionEnvelope } from '@noodle-borg/admission-limits/portable';
 import type { PublicEmbedRecord } from './embed-store.js';
+/** Hosted/operator entitlement layered between structural maxima and per-surface overrides. */
+export interface SurfaceBudgetBounds {
+    readonly defaults: Pick<AdmissionEnvelope, 'turnsPerSession' | 'turnsPerDay' | 'mintsPerDay'>;
+    readonly ceiling: Pick<AdmissionEnvelope, 'turnsPerDay' | 'mintsPerDay'>;
+}
 /**
  * One surface's daily budget, resolved from the operator's override and the deployment's defaults.
  *
@@ -12,5 +17,5 @@ import type { PublicEmbedRecord } from './embed-store.js';
  * operator any more than by app code, so an over-eager `--turns-per-day 999999999` degrades to the
  * ceiling instead of becoming the ceiling. Zero survives clamping and is the kill switch.
  */
-export declare function surfaceEnvelope(base: AdmissionEnvelope, embed: Pick<PublicEmbedRecord, 'turnsPerDay' | 'mintsPerDay'>): AdmissionEnvelope;
+export declare function surfaceEnvelope(base: AdmissionEnvelope, embed: Pick<PublicEmbedRecord, 'turnsPerDay' | 'mintsPerDay'>, bounds?: SurfaceBudgetBounds): AdmissionEnvelope;
 //# sourceMappingURL=surface-budget.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/surface-budget.js

@@ -11,13 +11,19 @@ import { clamp } from '@noodle-borg/admission-limits/portable';
  * operator any more than by app code, so an over-eager `--turns-per-day 999999999` degrades to the
  * ceiling instead of becoming the ceiling. Zero survives clamping and is the kill switch.
  */
-export function surfaceEnvelope(base, embed) {
-    if (embed.turnsPerDay === undefined && embed.mintsPerDay === undefined)
-        return base;
-    return clamp({
-        ...base,
+export function surfaceEnvelope(base, embed, bounds) {
+    const effectiveBase = bounds === undefined ? base : clamp({ ...base, ...bounds.defaults });
+    const requested = clamp({
+        ...effectiveBase,
         ...(embed.turnsPerDay !== undefined ? { turnsPerDay: embed.turnsPerDay } : {}),
         ...(embed.mintsPerDay !== undefined ? { mintsPerDay: embed.mintsPerDay } : {}),
     });
+    if (bounds === undefined)
+        return requested;
+    return {
+        ...requested,
+        turnsPerDay: Math.min(requested.turnsPerDay, bounds.ceiling.turnsPerDay),
+        mintsPerDay: Math.min(requested.mintsPerDay, bounds.ceiling.mintsPerDay),
+    };
 }
 //# sourceMappingURL=surface-budget.js.map

package/node_modules/@noodle-borg/assistant-gateway/package.json

@@ -17,6 +17,10 @@
       "types": "./dist/portable.d.ts",
       "import": "./dist/portable.js"
     },
+    "./model-runtime": {
+      "types": "./dist/model-runtime.d.ts",
+      "import": "./dist/model-runtime.js"
+    },
     "./postgres": {
       "types": "./dist/postgres.d.ts",
       "import": "./dist/postgres.js"
@@ -36,7 +40,7 @@
     "@noodle-borg/module": "0.0.0",
     "@noodle-borg/protocol": "0.0.0",
     "@noodle-borg/runtime": "0.0.0",
-    "@noodleseed/assistant": "1.22.0"
+    "@noodleseed/assistant": "1.24.0"
   },
   "devDependencies": {
     "@types/node": "^24.13.1",

package/node_modules/@noodle-borg/authoring/dist/assistant.d.ts

@@ -59,6 +59,7 @@ export interface AssistantLabels {
     readonly copy?: string;
     readonly newMessages?: string;
     readonly reconnect?: string;
+    readonly newConversation?: string;
     readonly retry?: string;
     readonly unavailable?: string;
     readonly sessionExpired?: string;
@@ -108,6 +109,11 @@ export interface OpenAICompatibleModel {
     /** Managed secret name, never the secret value. */
     readonly apiKey: string;
 }
+/** Provider-neutral request for the model selected and operated by Noodle Seed Cloud. */
+export interface NoodleManagedModel {
+    readonly kind: 'noodle-managed';
+}
+export type AssistantModel = OpenAICompatibleModel | NoodleManagedModel;
 /**
  * A verified session claim the embedding backend may pass at session exchange. Keys become
  * `${user.claims.<key>}` in tool fulfilment; `exposeToModel: true` additionally places the value
@@ -184,7 +190,7 @@ export interface PublicWebsiteInput {
 export declare function authenticatedWebsite(input: AuthenticatedWebsiteInput): AuthenticatedWebsiteAccess;
 export declare function publicWebsite(input: PublicWebsiteInput): PublicWebsiteAccess;
 export interface EmbeddedAssistantOptions extends AssistantUiOptions {
-    readonly model: OpenAICompatibleModel;
+    readonly model: AssistantModel;
     /** One surface, or every front door this assistant serves. */
     readonly access: AssistantAccess | readonly AssistantAccess[];
 }
@@ -197,7 +203,7 @@ export interface AssistantSurfaceConfig {
     readonly sessionClaims?: Readonly<Record<string, SessionClaimDeclaration>>;
 }
 export interface EmbeddedAssistantConfig extends AssistantUiOptions {
-    readonly model: OpenAICompatibleModel;
+    readonly model: AssistantModel;
     readonly surfaces: readonly AssistantSurfaceConfig[];
     /**
      * Union of every surface's origins. Kept at the top level so the service's origin check and the
@@ -208,5 +214,7 @@ export interface EmbeddedAssistantConfig extends AssistantUiOptions {
     readonly sessionClaims?: Readonly<Record<string, SessionClaimDeclaration>>;
 }
 export declare function openAICompatible(input: OpenAICompatibleModelInput): OpenAICompatibleModel;
+/** Use Noodle Seed Cloud's operator-selected model. Provider details never enter authored source. */
+export declare function noodleManaged(): NoodleManagedModel;
 export declare function embeddedAssistant(input: EmbeddedAssistantOptions): EmbeddedAssistantConfig;
 //# sourceMappingURL=assistant.d.ts.map

package/node_modules/@noodle-borg/authoring/dist/assistant.js

@@ -33,6 +33,10 @@ export function openAICompatible(input) {
         apiKey: serializeSecretRef(input.apiKey, 'assistant.model.apiKey'),
     };
 }
+/** Use Noodle Seed Cloud's operator-selected model. Provider details never enter authored source. */
+export function noodleManaged() {
+    return { kind: 'noodle-managed' };
+}
 export function embeddedAssistant(input) {
     const { model, access, suggestedPrompts, ...ui } = input;
     assertAccessDeclared(input, access);

package/node_modules/@noodle-borg/authoring/dist/connections.js

@@ -20,6 +20,7 @@ export function bind(connector, options) {
             : {}),
         ...(connector.definitions !== undefined ? { definitions: connector.definitions } : {}),
         ...(connector.httpDef !== undefined ? { httpDef: connector.httpDef } : {}),
+        ...(connector.mcpDef !== undefined ? { mcpDef: connector.mcpDef } : {}),
         binding: { profile: options.profile, connection: options.connection },
     };
 }