npm - @noodleseed/one - Versions diffs - 0.140.0 → 0.141.0 - Mend

@noodleseed/one 0.140.0 → 0.141.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (71) hide show

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-app-sandbox.d.ts ADDED Viewed

@@ -0,0 +1,13 @@
+/** Relay body pinned to `contract/v1/assistant-sandbox-document.html` and the browser client. */
+export declare const ASSISTANT_SANDBOX_DOCUMENT = "<!doctype html><meta charset=\"utf-8\"><style>html,body,iframe{border:0;margin:0;width:100%;height:100%;overflow:hidden}body{background:transparent}</style><body><script>\nlet inner,loaded=false;\nif(self===top)throw new Error('The assistant sandbox relay must be embedded');\nconst standardSandbox='allow-scripts allow-same-origin allow-forms';\nconst rawParentOrigin=new URLSearchParams(location.hash.slice(1)).get('parentOrigin');\nlet expectedParentOrigin;\ntry{const parsed=new URL(rawParentOrigin||'');if(parsed.origin===rawParentOrigin&&/^https?:$/.test(parsed.protocol))expectedParentOrigin=parsed.origin}catch{}\nconst parentTarget=expectedParentOrigin||'*';\nconst ownOrigin=self.origin;\nconst ready={jsonrpc:'2.0',method:'ui/notifications/sandbox-proxy-ready',params:{}};\n// Re-announce until the host acknowledges with the resource: when this document is hosted\n// cross-origin, the first announcement can arrive before the host's load handler is listening.\nconst announce=setInterval(()=>parent.postMessage(ready,parentTarget),120);\nsetTimeout(()=>clearInterval(announce),15000);\naddEventListener('message',(event)=>{\n  if(event.source===parent){\n    if(expectedParentOrigin&&event.origin!==expectedParentOrigin)return;\n    const message=event.data;\n    if(message?.method==='ui/notifications/sandbox-resource-ready'){\n      clearInterval(announce);\n      if(loaded)return;\n      loaded=true;\n      const requestedSandbox=message.params?.sandbox;\n      inner=document.createElement('iframe');\n      inner.setAttribute('sandbox',requestedSandbox===standardSandbox?standardSandbox:'allow-scripts');\n      inner.setAttribute('referrerpolicy','no-referrer');\n      const permissions=message.params?.permissions;\n      const allow=[];\n      if(permissions?.camera)allow.push('camera');\n      if(permissions?.microphone)allow.push('microphone');\n      if(permissions?.geolocation)allow.push('geolocation');\n      if(permissions?.clipboardWrite)allow.push('clipboard-write');\n      if(allow.length)inner.setAttribute('allow',allow.join('; '));\n      document.body.append(inner);\n      let html=String(message.params?.html||'');\n      const csp=message.params?.csp;\n      if(csp&&typeof csp==='object'){\n        const list=(value,fallback)=>Array.isArray(value)&&value.length?value.join(' '):fallback;\n        const resources=Array.isArray(csp.resourceDomains)?csp.resourceDomains:[];\n        const suffix=resources.length?' '+resources.join(' '):'';\n        const policy=[\"default-src 'none'\",\"script-src 'unsafe-inline'\"+suffix,\"style-src 'unsafe-inline'\"+suffix,'img-src data: blob:'+suffix,'font-src data: blob:'+suffix,'media-src data: blob:'+suffix,'worker-src blob:'+suffix,'connect-src '+list(csp.connectDomains,\"'none'\"),'frame-src '+list(csp.frameDomains,\"'none'\"),\"object-src 'none'\",\"form-action 'none'\",'base-uri '+list(csp.baseUriDomains,\"'none'\")].join('; ');\n        const meta='<meta http-equiv=\"Content-Security-Policy\" content=\"'+policy.replace(/&/g,'&amp;').replace(/\"/g,'&quot;')+'\">';\n        const doctype=html.match(/^\\s*<!doctype[^>]*>/i);\n        html=doctype?html.slice(0,doctype[0].length)+meta+html.slice(doctype[0].length):meta+html;\n      }\n      try{\n        const doc=inner.contentDocument||inner.contentWindow?.document;\n        if(!doc)throw new Error('document unavailable');\n        doc.open();doc.write(html);doc.close();\n      }catch{inner.srcdoc=html}\n      return;\n    }\n    inner?.contentWindow?.postMessage(message,'*');\n  } else if(inner && event.source===inner.contentWindow) {\n    if(event.origin!==ownOrigin)return;\n    parent.postMessage(event.data,parentTarget);\n  }\n});\nparent.postMessage(ready,parentTarget);\n</script></body>";
+export interface AssistantSandboxResponsePolicy {
+    readonly ok: boolean;
+    readonly contentSecurityPolicy: string;
+}
+/** Match a request authority to the configured sandbox origin, normalizing default ports. */
+export declare function isAssistantSandboxHost(requestHost: string | undefined, sandboxBaseUrl: string | undefined): boolean;
+/** Validate an untrusted query and return the CSP response header to apply before navigation. */
+export declare function resolveAssistantSandboxResponsePolicy(requestUrl: string, isolatedOrigin?: boolean): AssistantSandboxResponsePolicy;
+/** Normalize the operator-provided dedicated sandbox origin and keep it off the service origin. */
+export declare function validateAssistantSandboxBaseUrl(value: string, serviceBase: string | undefined): string;
+//# sourceMappingURL=assistant-app-sandbox.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-app-sandbox.js ADDED Viewed

@@ -0,0 +1,204 @@
+/** Relay body pinned to `contract/v1/assistant-sandbox-document.html` and the browser client. */
+export const ASSISTANT_SANDBOX_DOCUMENT = `<!doctype html><meta charset="utf-8"><style>html,body,iframe{border:0;margin:0;width:100%;height:100%;overflow:hidden}body{background:transparent}</style><body><script>
+let inner,loaded=false;
+if(self===top)throw new Error('The assistant sandbox relay must be embedded');
+const standardSandbox='allow-scripts allow-same-origin allow-forms';
+const rawParentOrigin=new URLSearchParams(location.hash.slice(1)).get('parentOrigin');
+let expectedParentOrigin;
+try{const parsed=new URL(rawParentOrigin||'');if(parsed.origin===rawParentOrigin&&/^https?:$/.test(parsed.protocol))expectedParentOrigin=parsed.origin}catch{}
+const parentTarget=expectedParentOrigin||'*';
+const ownOrigin=self.origin;
+const ready={jsonrpc:'2.0',method:'ui/notifications/sandbox-proxy-ready',params:{}};
+// Re-announce until the host acknowledges with the resource: when this document is hosted
+// cross-origin, the first announcement can arrive before the host's load handler is listening.
+const announce=setInterval(()=>parent.postMessage(ready,parentTarget),120);
+setTimeout(()=>clearInterval(announce),15000);
+addEventListener('message',(event)=>{
+  if(event.source===parent){
+    if(expectedParentOrigin&&event.origin!==expectedParentOrigin)return;
+    const message=event.data;
+    if(message?.method==='ui/notifications/sandbox-resource-ready'){
+      clearInterval(announce);
+      if(loaded)return;
+      loaded=true;
+      const requestedSandbox=message.params?.sandbox;
+      inner=document.createElement('iframe');
+      inner.setAttribute('sandbox',requestedSandbox===standardSandbox?standardSandbox:'allow-scripts');
+      inner.setAttribute('referrerpolicy','no-referrer');
+      const permissions=message.params?.permissions;
+      const allow=[];
+      if(permissions?.camera)allow.push('camera');
+      if(permissions?.microphone)allow.push('microphone');
+      if(permissions?.geolocation)allow.push('geolocation');
+      if(permissions?.clipboardWrite)allow.push('clipboard-write');
+      if(allow.length)inner.setAttribute('allow',allow.join('; '));
+      document.body.append(inner);
+      let html=String(message.params?.html||'');
+      const csp=message.params?.csp;
+      if(csp&&typeof csp==='object'){
+        const list=(value,fallback)=>Array.isArray(value)&&value.length?value.join(' '):fallback;
+        const resources=Array.isArray(csp.resourceDomains)?csp.resourceDomains:[];
+        const suffix=resources.length?' '+resources.join(' '):'';
+        const policy=["default-src 'none'","script-src 'unsafe-inline'"+suffix,"style-src 'unsafe-inline'"+suffix,'img-src data: blob:'+suffix,'font-src data: blob:'+suffix,'media-src data: blob:'+suffix,'worker-src blob:'+suffix,'connect-src '+list(csp.connectDomains,"'none'"),'frame-src '+list(csp.frameDomains,"'none'"),"object-src 'none'","form-action 'none'",'base-uri '+list(csp.baseUriDomains,"'none'")].join('; ');
+        const meta='<meta http-equiv="Content-Security-Policy" content="'+policy.replace(/&/g,'&amp;').replace(/"/g,'&quot;')+'">';
+        const doctype=html.match(/^\\s*<!doctype[^>]*>/i);
+        html=doctype?html.slice(0,doctype[0].length)+meta+html.slice(doctype[0].length):meta+html;
+      }
+      try{
+        const doc=inner.contentDocument||inner.contentWindow?.document;
+        if(!doc)throw new Error('document unavailable');
+        doc.open();doc.write(html);doc.close();
+      }catch{inner.srcdoc=html}
+      return;
+    }
+    inner?.contentWindow?.postMessage(message,'*');
+  } else if(inner && event.source===inner.contentWindow) {
+    if(event.origin!==ownOrigin)return;
+    parent.postMessage(event.data,parentTarget);
+  }
+});
+parent.postMessage(ready,parentTarget);
+</script></body>`;
+const COMPATIBILITY_CSP = "sandbox allow-scripts; default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; img-src https: data: blob:; font-src https: data:; frame-src about:; form-action 'none'; base-uri 'none'; frame-ancestors *";
+const MAX_CSP_QUERY_LENGTH = 8_192;
+const MAX_DOMAINS_PER_DIRECTIVE = 32;
+const CSP_KEYS = ['connectDomains', 'resourceDomains', 'frameDomains', 'baseUriDomains'];
+const CSP_KEY_SET = new Set(CSP_KEYS);
+/** Match a request authority to the configured sandbox origin, normalizing default ports. */
+export function isAssistantSandboxHost(requestHost, sandboxBaseUrl) {
+    if (requestHost === undefined || sandboxBaseUrl === undefined)
+        return false;
+    try {
+        const sandboxUrl = new URL(sandboxBaseUrl);
+        const requestUrl = new URL(`${sandboxUrl.protocol}//${requestHost}`);
+        return requestUrl.href === `${sandboxUrl.origin}/`;
+    }
+    catch {
+        return false;
+    }
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function isLoopback(hostname) {
+    return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]';
+}
+function normalizeCspDomain(value, connect) {
+    if (value.length > 512 || /[;\r\n'"\s]/u.test(value))
+        return undefined;
+    try {
+        const parsed = new URL(value);
+        const secure = parsed.protocol === 'https:' || (connect && parsed.protocol === 'wss:');
+        const local = isLoopback(parsed.hostname) &&
+            (parsed.protocol === 'http:' || (connect && parsed.protocol === 'ws:'));
+        if (!secure && !local)
+            return undefined;
+        if (parsed.username ||
+            parsed.password ||
+            parsed.pathname !== '/' ||
+            parsed.search ||
+            parsed.hash) {
+            return undefined;
+        }
+        return parsed.origin;
+    }
+    catch {
+        return undefined;
+    }
+}
+function parseSandboxCsp(requestUrl) {
+    const url = new URL(requestUrl, 'http://sandbox.invalid');
+    const values = url.searchParams.getAll('csp');
+    if (values.length === 0)
+        return { ok: true };
+    const serialized = values[0];
+    if (values.length !== 1 || serialized === undefined || serialized.length > MAX_CSP_QUERY_LENGTH) {
+        return { ok: false };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(serialized);
+    }
+    catch {
+        return { ok: false };
+    }
+    if (!isRecord(parsed) || Object.keys(parsed).some((key) => !CSP_KEY_SET.has(key))) {
+        return { ok: false };
+    }
+    const csp = {};
+    for (const key of CSP_KEYS) {
+        const raw = parsed[key];
+        if (raw === undefined)
+            continue;
+        if (!Array.isArray(raw) || raw.length > MAX_DOMAINS_PER_DIRECTIVE)
+            return { ok: false };
+        const normalized = [];
+        for (const entry of raw) {
+            if (typeof entry !== 'string')
+                return { ok: false };
+            const domain = normalizeCspDomain(entry, key === 'connectDomains');
+            if (!domain)
+                return { ok: false };
+            normalized.push(domain);
+        }
+        csp[key] = [...new Set(normalized)];
+    }
+    return { ok: true, value: csp };
+}
+function sources(values, fallback) {
+    return values && values.length > 0 ? values.join(' ') : fallback;
+}
+function sandboxCsp(csp, isolatedOrigin) {
+    const resources = csp.resourceDomains ?? [];
+    const resourceSuffix = resources.length > 0 ? ` ${resources.join(' ')}` : '';
+    return [
+        isolatedOrigin
+            ? 'sandbox allow-scripts allow-same-origin allow-forms'
+            : 'sandbox allow-scripts',
+        "default-src 'none'",
+        `script-src 'self' 'unsafe-inline'${resourceSuffix}`,
+        `style-src 'self' 'unsafe-inline'${resourceSuffix}`,
+        `img-src 'self' data: blob:${resourceSuffix}`,
+        `font-src 'self' data: blob:${resourceSuffix}`,
+        `media-src 'self' data: blob:${resourceSuffix}`,
+        `worker-src 'self' blob:${resourceSuffix}`,
+        `connect-src 'self'${csp.connectDomains && csp.connectDomains.length > 0 ? ` ${csp.connectDomains.join(' ')}` : ''}`,
+        `frame-src ${sources(csp.frameDomains, "'none'")}`,
+        "object-src 'none'",
+        "form-action 'none'",
+        `base-uri ${sources(csp.baseUriDomains, "'none'")}`,
+        'frame-ancestors *',
+    ].join('; ');
+}
+/** Validate an untrusted query and return the CSP response header to apply before navigation. */
+export function resolveAssistantSandboxResponsePolicy(requestUrl, isolatedOrigin = false) {
+    const parsed = parseSandboxCsp(requestUrl);
+    if (!parsed.ok)
+        return { ok: false, contentSecurityPolicy: COMPATIBILITY_CSP };
+    return {
+        ok: true,
+        contentSecurityPolicy: parsed.value !== undefined || isolatedOrigin
+            ? sandboxCsp(parsed.value ?? {}, isolatedOrigin)
+            : COMPATIBILITY_CSP,
+    };
+}
+/** Normalize the operator-provided dedicated sandbox origin and keep it off the service origin. */
+export function validateAssistantSandboxBaseUrl(value, serviceBase) {
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        throw new Error('assistantSandboxBaseUrl must be an exact HTTPS or HTTP loopback origin');
+    }
+    const loopback = isLoopback(parsed.hostname);
+    if (parsed.origin !== value ||
+        (parsed.protocol !== 'https:' && !(parsed.protocol === 'http:' && loopback))) {
+        throw new Error('assistantSandboxBaseUrl must be an exact HTTPS or HTTP loopback origin');
+    }
+    if (serviceBase !== undefined && new URL(serviceBase).origin === parsed.origin) {
+        throw new Error('assistantSandboxBaseUrl must use an origin separate from publicBaseUrl');
+    }
+    return parsed.origin;
+}
+//# sourceMappingURL=assistant-app-sandbox.js.map

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-store.d.ts CHANGED Viewed

@@ -50,6 +50,14 @@ export interface AssistantSessionRecord {
      * turns still belong to the surface that admitted them.
      */
     readonly publicEmbedId?: string;
+    /**
+     * The exact authored surface this session is bound to: 'public' is the deployment's one
+     * public-audience surface (public or mixed mode), 'authenticated' its authenticated surface. Written
+     * at mint from the origin that admitted the session; absent only on records minted before binding
+     * existed and on pre-surfaces artifacts, where the projection derives the surface from the pinned
+     * deployment and the session's origin instead. Never a deployment-wide union.
+     */
+    readonly boundSurface?: 'public' | 'authenticated';
     /**
      * The intercepted tool a successful elevation may re-attempt as the session's first elevated
      * turn. Armed only in the same statement that elevates; consumed (or mooted by the visitor's
@@ -81,6 +89,13 @@ export interface AssistantTurnConsumption {
 export interface AssistantHistoryMessage {
     readonly role: 'user' | 'assistant';
     readonly content: string;
+    /**
+     * Whether this row ever appeared in the visible panel (`visible`) or is model-facing scaffolding —
+     * resolution summaries carrying tool output, `[platform]` resume prompts (`narration`). Only rows
+     * explicitly tagged `visible` may be replayed to a browser (ADR 0141/0201 amendments 2026-08-26);
+     * an untagged legacy row is treated as narration, fail closed.
+     */
+    readonly kind?: 'visible' | 'narration';
 }
 /** Latest prompt messages retained for model continuity; turn admission is tracked separately. */
 export declare const ASSISTANT_HISTORY_MAX_MESSAGES = 40;
@@ -147,6 +162,12 @@ export interface AssistantStore {
         readonly origin: string;
         /** Backend-verified customer routes; absent means unchanged, never cleared. */
         readonly customerRouting?: AssistantSessionRecord['customerRouting'];
+        /**
+         * The surface that owns the elevation origin: the session lands on that surface's projection —
+         * capabilities, instructions, budgets, attribution — in the same statement that elevates
+         * (ADR 0201 amendment 2026-08-26). Absent means unchanged, the pre-surfaces artifact case.
+         */
+        readonly boundSurface?: AssistantSessionRecord['boundSurface'];
         /** Arms the one-shot resume of the intercepted tool, in the same statement that elevates. */
         readonly pendingResume?: AssistantPendingResume;
         readonly now: Date;
@@ -209,6 +230,7 @@ export declare class InMemoryAssistantStore implements AssistantStore {
         readonly clientId: string;
         readonly origin: string;
         readonly customerRouting?: AssistantSessionRecord['customerRouting'];
+        readonly boundSurface?: AssistantSessionRecord['boundSurface'];
         readonly pendingResume?: AssistantPendingResume;
         readonly now: Date;
     }): Promise<AssistantSessionElevation>;

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-store.js CHANGED Viewed

@@ -102,13 +102,15 @@ export class InMemoryAssistantStore {
             return { ok: false, reason: 'already_elevated' };
         }
         const token = mintSecret('nss_');
-        // History and publicEmbedId ride along untouched: same conversation, same admitting surface.
-        // clientId and origin do NOT: a public session's clientId is the embed id and its origin is the
-        // anonymous mint's page — but the issuer of every post-elevation delegated exchange derives from
-        // clientId (ADR 0152), and CORS on every session route follows origin, which after a login
-        // redirect is wherever the elevating client says the conversation continues. Customer routing
-        // arrives here too: elevation is the first authenticated moment, so it is the only chance a
-        // routed connector's session ever gets its backend-verified routes.
+        // History and publicEmbedId ride along untouched: same conversation, same admitting surface for
+        // admission. clientId and origin do NOT: a public session's clientId is the embed id and its
+        // origin is the anonymous mint's page — but the issuer of every post-elevation delegated exchange
+        // derives from clientId (ADR 0152), and CORS on every session route follows origin, which after a
+        // login redirect is wherever the elevating client says the conversation continues. Customer
+        // routing arrives here too: elevation is the first authenticated moment, so it is the only chance
+        // a routed connector's session ever gets its backend-verified routes. The surface binding follows
+        // the landing origin: signing in on the app surface lands the conversation on the app surface's
+        // projection (ADR 0201 amendment 2026-08-26); absent means unchanged.
         const elevated = {
             ...session,
             tokenHash: digest(token),
@@ -118,6 +120,7 @@ export class InMemoryAssistantStore {
             ...(input.customerRouting
                 ? { customerRouting: Object.freeze({ ...input.customerRouting }) }
                 : {}),
+            ...(input.boundSurface ? { boundSurface: input.boundSurface } : {}),
             ...(input.pendingResume ? { pendingResume: { ...input.pendingResume } } : {}),
         };
         this.#sessions.set(session.id, elevated);

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-transcript.d.ts ADDED Viewed

@@ -0,0 +1,18 @@
+import type { AssistantHistoryMessage } from './assistant-store.js';
+/**
+ * The bounded visible-transcript projection (ADR 0141/0201 amendments 2026-08-26): what a widget may
+ * repaint after a full-page navigation — the sign-in redirect above all — from the session's own
+ * short-lived history. Transport-free like every gateway decision; `packages/service` adapts.
+ *
+ * Only rows explicitly tagged `visible` project. Everything else fails closed out of the transcript:
+ * `narration` rows are model-facing scaffolding (resolution summaries carrying tool output,
+ * `[platform]` resume prompts the visitor never saw), and an untagged legacy row cannot prove which
+ * it was. This is a read-only projection over state that already exists and already expires with the
+ * session — it is not a durable transcript, and nothing here may extend a retention window.
+ */
+export interface AssistantTranscriptEntry {
+    readonly role: 'user' | 'assistant';
+    readonly text: string;
+}
+export declare function visibleTranscript(history: readonly AssistantHistoryMessage[]): readonly AssistantTranscriptEntry[];
+//# sourceMappingURL=assistant-transcript.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-transcript.js ADDED Viewed

@@ -0,0 +1,6 @@
+export function visibleTranscript(history) {
+    return history
+        .filter((entry) => entry.kind === 'visible')
+        .map((entry) => ({ role: entry.role, text: entry.content }));
+}
+//# sourceMappingURL=assistant-transcript.js.map

package/node_modules/@noodle-borg/assistant-gateway/dist/elevation.d.ts CHANGED Viewed

@@ -20,6 +20,7 @@ export interface ElevationPorts {
         readonly clientId: string;
         readonly origin: string;
         readonly customerRouting?: AssistantSessionRecord['customerRouting'];
+        readonly boundSurface?: AssistantSessionRecord['boundSurface'];
         readonly pendingResume?: AssistantPendingResume;
         readonly now: Date;
     }) => Promise<{
@@ -47,6 +48,12 @@ export interface ElevationRequest {
     readonly origin: string;
     /** Backend-verified customer routes, validated by the route; absent means unchanged. */
     readonly customerRouting?: AssistantSessionRecord['customerRouting'];
+    /**
+     * The surface that owns the (already validated) elevation origin: the conversation lands on that
+     * surface's projection (ADR 0201 amendment 2026-08-26). Absent means unchanged — the pre-surfaces
+     * artifact shape, which has no surfaces to land on.
+     */
+    readonly boundSurface?: AssistantSessionRecord['boundSurface'];
     /**
      * Arm the one-shot resume of the intercepted tool on success. Only an explicit `true` arms —
      * the route owns the default policy, and probes (the doctor's synthetic elevation) pass nothing.

package/node_modules/@noodle-borg/assistant-gateway/dist/elevation.js CHANGED Viewed

@@ -23,6 +23,7 @@ export async function completeElevation(request, ports) {
         clientId: request.clientId,
         origin: request.origin,
         ...(request.customerRouting ? { customerRouting: request.customerRouting } : {}),
+        ...(request.boundSurface ? { boundSurface: request.boundSurface } : {}),
         // Armed in the same statement that elevates: the claim happened above, so the intercepted
         // tool is in hand exactly when the session mutation runs.
         ...(request.resume === true

package/node_modules/@noodle-borg/assistant-gateway/dist/portable.d.ts CHANGED Viewed

@@ -1,5 +1,6 @@
 /** Assistant gateway contracts and in-memory adapters safe for the published CLI runtime. */
 export * from './artifact-projection.js';
+export * from './assistant-app-sandbox.js';
 export * from './assistant-context.js';
 export * from './assistant-customer-issuer.js';
 export * from './assistant-customer-routing.js';
@@ -9,6 +10,7 @@ export * from './assistant-interactive.js';
 export * from './assistant-presentation.js';
 export * from './assistant-sensitive-values.js';
 export * from './assistant-store.js';
+export * from './assistant-transcript.js';
 export * from './elevation.js';
 export * from './elevation-store.js';
 export * from './embed-script.js';

package/node_modules/@noodle-borg/assistant-gateway/dist/portable.js CHANGED Viewed

@@ -1,5 +1,6 @@
 /** Assistant gateway contracts and in-memory adapters safe for the published CLI runtime. */
 export * from './artifact-projection.js';
+export * from './assistant-app-sandbox.js';
 export * from './assistant-context.js';
 export * from './assistant-customer-issuer.js';
 export * from './assistant-customer-routing.js';
@@ -9,6 +10,7 @@ export * from './assistant-interactive.js';
 export * from './assistant-presentation.js';
 export * from './assistant-sensitive-values.js';
 export * from './assistant-store.js';
+export * from './assistant-transcript.js';
 export * from './elevation.js';
 export * from './elevation-store.js';
 export * from './embed-script.js';

package/node_modules/@noodle-borg/assistant-gateway/dist/public-surface.d.ts CHANGED Viewed

@@ -17,5 +17,26 @@ export interface PublicSurface {
     readonly capabilities: readonly SurfaceCapabilityRef[];
     readonly instructions?: string;
 }
+export interface AuthenticatedSurface {
+    readonly origins: readonly string[];
+    /** Absent means the authored intent is the whole server; a declared list narrows it. */
+    readonly capabilities?: readonly SurfaceCapabilityRef[];
+    readonly instructions?: string;
+}
+/** The deployment's one authenticated surface, read with the same shape discipline as the public one. */
+export declare function authenticatedSurfaceOf(assistant: unknown): AuthenticatedSurface | undefined;
+/**
+ * Which authored surface owns this origin (ADR 0201: every session binds one exact surface).
+ * `pre-surfaces` is the released artifact shape from before surfaces existed — the deployment-wide
+ * origin union remains its only contract. `unowned` means surfaces exist and none lists the origin:
+ * the caller must refuse, never fall back to the union.
+ */
+export declare function surfaceBindingForOrigin(assistant: unknown, origin: string): {
+    readonly kind: 'public' | 'authenticated';
+} | {
+    readonly kind: 'unowned';
+} | {
+    readonly kind: 'pre-surfaces';
+};
 export declare function publicSurfaceOf(assistant: unknown): PublicSurface | undefined;
 //# sourceMappingURL=public-surface.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/public-surface.js CHANGED Viewed

@@ -1,3 +1,42 @@
+/** The deployment's one authenticated surface, read with the same shape discipline as the public one. */
+export function authenticatedSurfaceOf(assistant) {
+    const surfaces = assistant?.surfaces;
+    if (!Array.isArray(surfaces))
+        return undefined;
+    for (const entry of surfaces) {
+        const { mode, origins, capabilities, instructions } = entry;
+        if (mode !== 'authenticated')
+            continue;
+        return {
+            origins: Array.isArray(origins) ? origins : [],
+            // Unlike a public surface, an omitted list is the authored whole-server intent, not a hole:
+            // the compiler requires the allowlist only on public-audience surfaces.
+            ...(Array.isArray(capabilities)
+                ? { capabilities: capabilities }
+                : {}),
+            ...(typeof instructions === 'string' ? { instructions } : {}),
+        };
+    }
+    return undefined;
+}
+/**
+ * Which authored surface owns this origin (ADR 0201: every session binds one exact surface).
+ * `pre-surfaces` is the released artifact shape from before surfaces existed — the deployment-wide
+ * origin union remains its only contract. `unowned` means surfaces exist and none lists the origin:
+ * the caller must refuse, never fall back to the union.
+ */
+export function surfaceBindingForOrigin(assistant, origin) {
+    const surfaces = assistant?.surfaces;
+    if (!Array.isArray(surfaces))
+        return { kind: 'pre-surfaces' };
+    const publicSurface = publicSurfaceOf(assistant);
+    if (publicSurface?.origins.includes(origin))
+        return { kind: 'public' };
+    if (authenticatedSurfaceOf(assistant)?.origins.includes(origin)) {
+        return { kind: 'authenticated' };
+    }
+    return { kind: 'unowned' };
+}
 export function publicSurfaceOf(assistant) {
     const surfaces = assistant?.surfaces;
     if (!Array.isArray(surfaces))

package/node_modules/@noodle-borg/assistant-gateway/dist/session-resume.d.ts CHANGED Viewed

@@ -19,4 +19,11 @@ export declare function shouldAutoResume(override: boolean | undefined): boolean
  * replayed: the model re-derives them from history under the new principal.
  */
 export declare function resumeTurnMessage(tool: string): string;
+/**
+ * The honest fail-closed variant: the elevation landed the conversation on a surface whose
+ * projection does not offer the intercepted tool (ADR 0201 amendment 2026-08-26). Silence would
+ * read as a hang and a hallucinated attempt would be worse, so the model is told plainly to say
+ * the action is not available here and to offer what this surface can do.
+ */
+export declare function resumeUnavailableMessage(tool: string): string;
 //# sourceMappingURL=session-resume.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/session-resume.js CHANGED Viewed

@@ -25,4 +25,16 @@ export function resumeTurnMessage(tool) {
         `which returned sign_in_required. Call "${tool}" now to complete that request yourself — do ` +
         'not ask them to repeat or re-confirm it — then reply naturally with the outcome.');
 }
+/**
+ * The honest fail-closed variant: the elevation landed the conversation on a surface whose
+ * projection does not offer the intercepted tool (ADR 0201 amendment 2026-08-26). Silence would
+ * read as a hang and a hallucinated attempt would be worse, so the model is told plainly to say
+ * the action is not available here and to offer what this surface can do.
+ */
+export function resumeUnavailableMessage(tool) {
+    return (`[platform] The visitor has just signed in. Their pre-sign-in request needed the "${tool}" ` +
+        'tool, but the surface this signed-in conversation continues on does not offer it. Tell them ' +
+        'plainly that this action is not available here, and offer what the current tools can do ' +
+        'instead. Do not pretend to run it.');
+}
 //# sourceMappingURL=session-resume.js.map

package/node_modules/@noodle-borg/auth/dist/control-plane-token-exchange.d.ts ADDED Viewed

@@ -0,0 +1,110 @@
+import { type JWTVerifyGetKey } from 'jose';
+/**
+ * The inbound half of the delegated token exchange (RFC 8693), serving exactly one first-party
+ * caller: the hosted assistant's control-plane connector. We implement the same target-endpoint
+ * contract we ask every customer token endpoint to implement (docs/spec/connectors.md, ADR 0152) —
+ * verify the platform-signed assertion, identify the user by `(customer_identity.issuer, sub)`,
+ * honour the 120s lifetime and single-use `jti`, and return a standard token response.
+ *
+ * The same issuer and signing key mint control-plane access tokens and exchange assertions, so
+ * **audience separation is the entire security boundary**: this exchange accepts only the dedicated
+ * exchange URN below and structurally refuses every resource audience (all of which are URLs) —
+ * including our own access tokens presented as subject tokens. The minted token is capability-scoped
+ * through the developer-grant machinery, so rollback/config-write can never be stored on it and
+ * every control-plane route re-checks live org membership per request.
+ *
+ * This module is the Express-free decision core; the hosted service wraps it in a thin HTTP adapter
+ * and supplies every policy port below (ADR 0218).
+ */
+export declare const CONTROL_PLANE_EXCHANGE_AUDIENCE = "urn:noodleseed:control-plane:delegated-exchange";
+export declare const CONTROL_PLANE_EXCHANGE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange";
+/** Durable single-use claims for inbound exchange assertion `jti`s; false = replayed. */
+export interface TokenExchangeJtiStore {
+    consume(jti: string, expiresAtMs: number, nowMs: number): Promise<boolean>;
+}
+/** Local/test-only; production deployments need durable shared atomic replay storage. */
+export declare class InMemoryTokenExchangeJtiStore implements TokenExchangeJtiStore {
+    #private;
+    consume(jti: string, expiresAtMs: number, nowMs: number): Promise<boolean>;
+}
+export interface ControlPlaneExchangeConfig {
+    /** The dedicated confidential client; deliberately not registered in the OAuth store. */
+    readonly clientId: string;
+    readonly clientSecret: string;
+    /** Exact `org/app/env` tenants whose assertions this exchange serves (the first-party assistant). */
+    readonly allowedTenants: readonly string[];
+}
+export interface ControlPlaneExchangeTenantRef {
+    readonly org: string;
+    readonly app: string;
+    readonly env: string;
+}
+/** Structural audit port; the hosted service passes its tenant-scoped audit sink. */
+export interface ControlPlaneExchangeAuditEvent {
+    readonly eventType: string;
+    readonly org: string;
+    readonly app: string;
+    readonly env: string;
+    readonly decision: 'allow' | 'deny';
+    readonly status: number;
+    readonly reasonCode?: string;
+    readonly actorSubject?: string;
+    readonly details?: Readonly<Record<string, string>>;
+}
+export interface ControlPlaneExchangeDeps {
+    readonly issuer: string;
+    readonly config: ControlPlaneExchangeConfig;
+    readonly verifierKey: () => Promise<JWTVerifyGetKey>;
+    /** Capability-scoped developer-grant creation/reuse (method-typed so narrower stores satisfy it). */
+    readonly grants: {
+        getOrCreateActive(input: {
+            readonly clientId: string;
+            readonly subject: string;
+            readonly resource: string;
+            readonly capabilities: readonly string[];
+        }): Promise<{
+            readonly id: string;
+        }>;
+    };
+    /** Durable single-use claim; false = replayed. */
+    readonly consumeJti: (jti: string, expiresAtMs: number) => Promise<boolean>;
+    /** Resolve an EXISTING platform principal; never creates one. Undefined = refuse. */
+    readonly resolveSubject: (subject: string) => Promise<{
+        readonly ok: true;
+    } | undefined>;
+    /** Live (non-revoked) assistant client ids of one tenant; the elevation issuer must name one. */
+    readonly listAssistantClientIds: (tenant: ControlPlaneExchangeTenantRef) => Promise<readonly string[]>;
+    /** Public-signup-mode workspace provisioning at mint; wired only when signup mode is public. */
+    readonly ensureWorkspace?: (identity: {
+        readonly subject: string;
+        readonly email: string;
+    }) => Promise<void>;
+    /** The scope ceiling and the developer resource the grant/token bind to. */
+    readonly resourcePath: string;
+    readonly capabilityCeiling: readonly string[];
+    readonly issueAccessToken: (input: {
+        readonly subject: string;
+        readonly email: string;
+        readonly resource: string;
+        readonly scope: string;
+        readonly developerGrantId: string;
+        readonly oauthClientId: string;
+        readonly ttlSeconds: number;
+    }) => Promise<string>;
+    readonly audit?: {
+        emit(event: ControlPlaneExchangeAuditEvent): Promise<unknown> | unknown;
+    };
+}
+export interface ControlPlaneExchangeRequest {
+    /** The parsed `application/x-www-form-urlencoded` body. */
+    readonly form: Readonly<Record<string, unknown>>;
+    readonly authorizationHeader?: string;
+}
+export interface ControlPlaneExchangeDecision {
+    readonly status: number;
+    readonly body: Readonly<Record<string, unknown>>;
+    /** Present exactly when the adapter must set `WWW-Authenticate`. */
+    readonly wwwAuthenticate?: string;
+}
+export declare function decideControlPlaneTokenExchange(request: ControlPlaneExchangeRequest, deps: ControlPlaneExchangeDeps): Promise<ControlPlaneExchangeDecision>;
+//# sourceMappingURL=control-plane-token-exchange.d.ts.map