@noodleseed/one 0.140.0 → 0.141.0

package/node_modules/@noodle-borg/protocol/dist/observation.js

@@ -1,6 +1,7 @@
 /**
  * The analytics `errorKind` for an execution error: the stable code, refined with the allowlisted
- * `reason` when one exists (`connector_error.timeout`). Analytics-only — wire mapping is unchanged.
+ * `reason` when one exists (`connector_error.timeout`). Analytics-only — the wire's structured
+ * reasons are gated separately (and more narrowly) in `execution-error-mapping.ts`.
  */
 export function executionErrorKind(error) {
     return error.reason === undefined ? error.code : `${error.code}.${error.reason}`;

package/node_modules/@noodle-borg/runtime/dist/connector/failure-details.d.ts

@@ -1,5 +1,5 @@
 import type { ConnectorTraceEvent } from './types.js';
-type ConnectorFailureDetails = Pick<ConnectorTraceEvent, 'status' | 'category' | 'attempts' | 'retryable' | 'retryAfterMs' | 'responseExcerpt'>;
+type ConnectorFailureDetails = Pick<ConnectorTraceEvent, 'status' | 'category' | 'attempts' | 'retryable' | 'retryAfterMs' | 'responseExcerpt' | 'queueWaitMs' | 'executionMs'>;
 /** Reconstruct connector failure metadata from runtime-validated own data properties only. */
 export declare function sanitizeConnectorFailureDetails(error: unknown, options?: {
     readonly includeResponseExcerpt?: boolean;

package/node_modules/@noodle-borg/runtime/dist/connector/failure-details.js

@@ -1,5 +1,6 @@
 const FAILURE_CATEGORIES = new Set([
     'timeout',
+    'queue_timeout',
     'network_error',
     'rate_limited',
     'upstream_5xx',
@@ -20,6 +21,8 @@ export function sanitizeConnectorFailureDetails(error, options = {}) {
     const responseExcerpt = options.includeResponseExcerpt
         ? ownData(error, 'responseExcerpt')
         : undefined;
+    const queueWaitMs = ownData(error, 'queueWaitMs');
+    const executionMs = ownData(error, 'executionMs');
     return Object.freeze({
         ...(isIntegerInRange(status, 100, 599) ? { status } : {}),
         ...(typeof category === 'string' && FAILURE_CATEGORIES.has(category)
@@ -31,6 +34,8 @@ export function sanitizeConnectorFailureDetails(error, options = {}) {
         ...(typeof responseExcerpt === 'string' && responseExcerpt.length <= MAX_RESPONSE_EXCERPT_LENGTH
             ? { responseExcerpt }
             : {}),
+        ...(isIntegerInRange(queueWaitMs, 0, MAX_RETRY_AFTER_MS) ? { queueWaitMs } : {}),
+        ...(isIntegerInRange(executionMs, 0, MAX_RETRY_AFTER_MS) ? { executionMs } : {}),
     });
 }
 function ownData(error, key) {

package/node_modules/@noodle-borg/runtime/dist/connector/types.d.ts

@@ -34,11 +34,15 @@ export interface ConnectorTraceEvent {
     readonly retryable?: boolean;
     readonly retryAfterMs?: number;
     readonly responseExcerpt?: string;
+    /** Time the call waited for an execution slot, timed independently of execution. */
+    readonly queueWaitMs?: number;
+    /** Time the call actually executed, excluding queue wait. */
+    readonly executionMs?: number;
 }
 export interface ExecutionTraceSink {
     record(event: ConnectorTraceEvent): void;
 }
-export type ConnectorFailureCategory = 'timeout' | 'network_error' | 'rate_limited' | 'upstream_5xx' | 'upstream_4xx' | 'invalid_response' | 'response_too_large';
+export type ConnectorFailureCategory = 'timeout' | 'queue_timeout' | 'network_error' | 'rate_limited' | 'upstream_5xx' | 'upstream_4xx' | 'invalid_response' | 'response_too_large';
 export declare class ConnectorInvocationError extends Error {
     readonly status?: number;
     readonly category?: ConnectorFailureCategory;
@@ -46,6 +50,8 @@ export declare class ConnectorInvocationError extends Error {
     readonly retryable?: boolean;
     readonly retryAfterMs?: number;
     readonly responseExcerpt?: string;
+    readonly queueWaitMs?: number;
+    readonly executionMs?: number;
     constructor(message: string, details?: {
         readonly status?: number;
         readonly category?: ConnectorFailureCategory;
@@ -53,6 +59,8 @@ export declare class ConnectorInvocationError extends Error {
         readonly retryable?: boolean;
         readonly retryAfterMs?: number;
         readonly responseExcerpt?: string;
+        readonly queueWaitMs?: number;
+        readonly executionMs?: number;
     });
 }
 /** Trap-free nominal classification for connector rejection values. Proxy wrappers are untrusted. */
@@ -89,6 +97,12 @@ export interface ConnectorCall {
     readonly route?: CustomerConnectorRoute;
     /** Optional host capability for sandboxed connectors; ignored by ordinary connectors. */
     readonly host?: ConnectorCallHost;
+    /**
+     * Optional execution trace sink for connector-side observability (e.g. sandbox queue-wait vs
+     * execution durations). Connectors record only flat scalar fields; the runtime still owns the
+     * failure-event path.
+     */
+    readonly trace?: ExecutionTraceSink;
 }
 /**
  * A connector: a versioned integration exposing typed operations. Phase 1 ships only an in-memory

package/node_modules/@noodle-borg/runtime/dist/connector/types.js

@@ -7,6 +7,8 @@ export class ConnectorInvocationError extends Error {
     retryable;
     retryAfterMs;
     responseExcerpt;
+    queueWaitMs;
+    executionMs;
     constructor(message, details = {}) {
         super(message);
         connectorInvocationErrors.add(this);
@@ -24,6 +26,10 @@ export class ConnectorInvocationError extends Error {
             this.retryAfterMs = details.retryAfterMs;
         if (details.responseExcerpt !== undefined)
             this.responseExcerpt = details.responseExcerpt;
+        if (details.queueWaitMs !== undefined)
+            this.queueWaitMs = details.queueWaitMs;
+        if (details.executionMs !== undefined)
+            this.executionMs = details.executionMs;
     }
 }
 /** Trap-free nominal classification for connector rejection values. Proxy wrappers are untrusted. */

package/node_modules/@noodle-borg/runtime/dist/operation-execution.js

@@ -171,6 +171,7 @@ async function invokeOperation(ref, args, sig, toolName, deps, policy, host, env
                 ...(deps.caller !== undefined ? { caller: deps.caller } : {}),
                 ...(customerRoute === undefined ? {} : { route: customerRoute }),
                 host,
+                ...(deps.trace === undefined ? {} : { trace: deps.trace }),
             });
         }
         catch (error) {

package/node_modules/@noodle-borg/service/dist/auth/developer-grant-guard.js

@@ -8,7 +8,8 @@ export async function authorizeDeveloperGrant(identity, context) {
     });
     if (grant === undefined)
         return false;
-    if (developerResourcePath(grant.resource) !== context.resourcePath)
+    const grantPath = developerResourcePath(grant.resource);
+    if (grantPath === undefined || !context.resourcePaths.has(grantPath))
         return false;
     if (!grant.capabilities.includes(context.capability))
         return false;

package/node_modules/@noodle-borg/service/dist/modules/route-dispatch.js

@@ -42,7 +42,7 @@ export function createModuleRouteContext(hostRequest, deps) {
                             controlPlane: deps.controlPlane,
                             org: input.org,
                             capability: input.permission,
-                            resourcePath: DEVELOPER_CLI_PATH,
+                            resourcePaths: new Set([DEVELOPER_CLI_PATH]),
                         }));
                     if (!allowed) {
                         return forbidden('developer grant does not authorize this operation');

package/node_modules/@noodle-borg/service/dist/registry-types.d.ts

@@ -1,11 +1,11 @@
 import type { CapabilityName } from '@noodle-borg/capabilities';
 import type { CatalogConnector, HostedPackagedAsset } from '@noodle-borg/compiler';
+import type { ControlPlaneIdentity } from '@noodle-borg/control-plane/portable';
 import type { OrgMembershipSource, PolicyGate } from '@noodle-borg/module';
 import type { Connector } from '@noodle-borg/runtime';
 import type { AccessMode, OwnerTokenVerifier } from '@noodle-borg/transport-http';
 import type { DeploymentSource } from '@noodle-borg/wire-contracts';
 import type { AppPackageRenderer } from './app-package-snapshot.js';
-import type { ControlPlaneIdentity } from './auth/deploy-gate.js';
 import type { DelegatedExchangeOptions } from './delegated-token-exchange.js';
 import type { ExternalCredentialExchangeRuntimeOptions } from './external-credential-exchange.js';
 import type { GoogleWorkloadIdentityRuntimeOptions } from './google-workload-identity.js';

package/node_modules/@noodle-borg/service/dist/routes/assistant-agent.js

@@ -1,6 +1,6 @@
 import { ADMISSION_DEFAULTS } from '@noodle-borg/admission-limits/portable';
 import { requestModelCompletion, } from '@noodle-borg/assistant-gateway/model-runtime';
-import { assistantModelToolOncePerSession, assistantModelToolRequiredWhenVisible, dispatchAssistantTool, projectAssistantGuide, publicSurfaceOf, selectAssistantModelTools, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
+import { assistantModelToolOncePerSession, assistantModelToolRequiredWhenVisible, authenticatedSurfaceOf, dispatchAssistantTool, projectAssistantGuide, publicSurfaceOf, selectAssistantModelTools, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
 import { validateJsonSchemaWithDefaults } from '@noodle-borg/compiler';
 import { guardedFetch } from '@noodle-borg/connector-http';
 import { evaluateToolAuthorization } from '@noodle-borg/protocol';
@@ -383,10 +383,22 @@ function selectTurnModelTools(target, caller, latestMessage, usedToolNames) {
         ...(usedToolNames === undefined ? {} : { usedToolNames }),
     });
 }
-/** Surface behavior is injected only when the session is pinned to the public projection that minted it. */
+/**
+ * Surface behavior is injected only for the exact surface the session is bound to (ADR 0215): the
+ * public-audience surface for embed-minted sessions, the authenticated surface for backend-exchanged
+ * ones. A session with no binding — a record from before binding existed, or a pre-surfaces artifact —
+ * fails closed to no surface block, never to a union or first-surface fallback.
+ */
 function surfaceInstructionsContext(assistant, session) {
-    if (session.publicEmbedId === undefined)
+    const bound = session.boundSurface ?? (session.publicEmbedId !== undefined ? 'public' : undefined);
+    if (bound === undefined)
         return '';
+    if (bound === 'authenticated') {
+        const surface = authenticatedSurfaceOf(assistant);
+        if (!surface?.instructions)
+            return '';
+        return `\n\nSurface instructions (authenticated website surface; same trust level as tenant instructions):\n${surface.instructions}`;
+    }
     const surface = publicSurfaceOf(assistant);
     if (!surface?.instructions)
         return '';

package/node_modules/@noodle-borg/service/dist/routes/assistant-clients.js

@@ -0,0 +1,116 @@
+import { readJsonBody, sendForbidden, sendJson } from '../http-util.js';
+import { now } from './assistant-route-http.js';
+import { authorizeControlPlane } from './control-plane.js';
+export async function handleAssistantClients(req, res, tenant, id, action, deps) {
+    const identity = await authorizeControlPlane(req, res, deps.gate, { requireIdentity: false });
+    if (identity === false)
+        return;
+    if (identity && !identity.superAdmin) {
+        const member = await deps.controlPlane.isOrgMember({
+            org: tenant.org,
+            subject: identity.subject,
+        });
+        if (!member)
+            return sendForbidden(res, 'forbidden');
+    }
+    if (action === 'collection' && req.method === 'GET') {
+        const clients = await deps.store.listClients(tenant);
+        return sendJson(res, 200, {
+            ok: true,
+            clients: clients.map(publicClient),
+        });
+    }
+    if (action === 'collection' && req.method === 'POST') {
+        const body = await readJsonBody(req, deps.maxBody);
+        if (!body.ok)
+            return sendJson(res, body.status, { error: body.error });
+        const name = body.value.name;
+        if (typeof name !== 'string' || name.trim().length < 1 || name.length > 80) {
+            return sendJson(res, 400, { error: '"name" must be a non-empty string' });
+        }
+        const target = await deps.registry.getActiveByTenant(tenant);
+        const assistant = target?.served.artifact.server.assistant;
+        if (!target?.deploymentId || !assistant)
+            return sendJson(res, 409, { error: 'deployment has no embedded assistant' });
+        const created = await deps.store.createClient({
+            name: name.trim(),
+            tenant,
+            deploymentId: target.deploymentId,
+            allowedOrigins: assistant.allowedOrigins,
+            now: now(deps),
+        });
+        await deps.audit.emit({
+            eventType: 'assistant.client.created',
+            org: tenant.org,
+            app: tenant.app,
+            env: tenant.env,
+            deploymentId: target.deploymentId,
+            decision: 'allow',
+            status: 201,
+            ...(identity ? { actorSubject: identity.subject } : {}),
+            ...(identity?.email ? { actorEmail: identity.email } : {}),
+            details: { clientId: created.client.id, name: created.client.name },
+        });
+        return sendJson(res, 201, {
+            ok: true,
+            ...publicClient(created.client),
+            clientSecret: created.secret,
+        });
+    }
+    if (!id)
+        return sendJson(res, 404, { error: 'not found' });
+    const owned = (await deps.store.listClients(tenant)).some((client) => client.id === id);
+    if (!owned)
+        return sendJson(res, 404, { error: 'not found' });
+    if (action === 'rotate' && req.method === 'POST') {
+        const rotated = await deps.store.rotateClient(id, now(deps));
+        if (!rotated)
+            return sendJson(res, 404, { error: 'not found' });
+        await deps.audit.emit({
+            eventType: 'assistant.client.rotated',
+            org: tenant.org,
+            app: tenant.app,
+            env: tenant.env,
+            deploymentId: rotated.client.deploymentId,
+            decision: 'allow',
+            status: 200,
+            ...(identity ? { actorSubject: identity.subject } : {}),
+            ...(identity?.email ? { actorEmail: identity.email } : {}),
+            details: { clientId: rotated.client.id },
+        });
+        return sendJson(res, 200, {
+            ok: true,
+            ...publicClient(rotated.client),
+            clientSecret: rotated.secret,
+        });
+    }
+    if (action === 'item' && req.method === 'DELETE') {
+        await deps.store.revokeClient(id, now(deps));
+        await deps.audit.emit({
+            eventType: 'assistant.client.revoked',
+            org: tenant.org,
+            app: tenant.app,
+            env: tenant.env,
+            decision: 'allow',
+            status: 204,
+            ...(identity ? { actorSubject: identity.subject } : {}),
+            ...(identity?.email ? { actorEmail: identity.email } : {}),
+            details: { clientId: id },
+        });
+        res.statusCode = 204;
+        res.end();
+        return;
+    }
+    sendJson(res, 405, { error: 'method not allowed' });
+}
+function publicClient(client) {
+    return {
+        id: client.id,
+        name: client.name,
+        createdAt: client.createdAt,
+        // Audit data only: sessions follow the tenant's active deployment, not this snapshot.
+        createdAgainstDeploymentId: client.deploymentId,
+        ...(client.revokedAt ? { revokedAt: client.revokedAt } : {}),
+    };
+}
+//# sourceMappingURL=assistant-clients.js.map

package/node_modules/@noodle-borg/service/dist/routes/assistant-dispatch.js

@@ -1,10 +1,13 @@
-import { handleAssistantAppRequest, handleAssistantClients, handleAssistantPreflight, handleAssistantSession, handleAssistantTurn, handleConsoleApprovalNonce, } from './assistant.js';
+import { isAssistantSandboxHost, } from '@noodle-borg/assistant-gateway/portable';
+import { handleAssistantAppRequest, handleAssistantPreflight, handleAssistantSession, handleAssistantTurn, handleConsoleApprovalNonce, } from './assistant.js';
+import { handleAssistantClients } from './assistant-clients.js';
 import { handleAssistantDoctor } from './assistant-doctor.js';
 import { handleAssistantEmbedScript } from './assistant-embed-script.js';
 import { handleAssistantEmbeds } from './assistant-embeds.js';
 import { handleAssistantConfirmation, handleAssistantInteraction, } from './assistant-interactions.js';
 import { handlePublicAssistantSession } from './assistant-public-session.js';
 import { handleAssistantSandbox } from './assistant-sandbox.js';
+import { handleAssistantTranscript } from './assistant-transcript.js';
 export function dispatchAssistantRoutes(req, res, url, deps) {
     if (url.pathname === '/v1/console/approval-nonces/consume' && req.method === 'POST') {
         return run(req, res, deps, () => handleConsoleApprovalNonce(req, res, deps));
@@ -13,7 +16,8 @@ export function dispatchAssistantRoutes(req, res, url, deps) {
         url.pathname === '/v1/assistant/turns' ||
         url.pathname === '/v1/assistant/tool-confirmations' ||
         url.pathname === '/v1/assistant/interactions' ||
-        url.pathname === '/v1/assistant/apps') &&
+        url.pathname === '/v1/assistant/apps' ||
+        url.pathname === '/v1/assistant/transcript') &&
         req.method === 'OPTIONS') {
         deps.applySecurityHeaders(res, deps.tls);
         handleAssistantPreflight(req, res);
@@ -32,7 +36,9 @@ export function dispatchAssistantRoutes(req, res, url, deps) {
         deps.applySecurityHeaders(res, deps.tls);
         if (deps.enforceHttps(req, res, deps.tls))
             return true;
-        handleAssistantSandbox(req, res);
+        const sandboxBase = deps.sandboxBase?.(req);
+        const isolatedOrigin = isAssistantSandboxHost(req.headers.host, sandboxBase);
+        handleAssistantSandbox(req, res, { isolatedOrigin });
         return true;
     }
     if (url.pathname === '/v1/assistant/public-sessions' && req.method === 'POST') {
@@ -47,6 +53,9 @@ export function dispatchAssistantRoutes(req, res, url, deps) {
     if (url.pathname === '/v1/assistant/apps' && req.method === 'POST') {
         return run(req, res, deps, () => handleAssistantAppRequest(req, res, deps));
     }
+    if (url.pathname === '/v1/assistant/transcript' && req.method === 'POST') {
+        return run(req, res, deps, () => handleAssistantTranscript(req, res, deps));
+    }
     const doctorMatch = /^\/v1\/orgs\/([^/]+)\/apps\/([^/]+)\/envs\/([^/]+)\/assistant\/doctor$/.exec(url.pathname);
     if (doctorMatch) {
         const tenant = decodeTenant(doctorMatch);

package/node_modules/@noodle-borg/service/dist/routes/assistant-elevation.js

@@ -93,6 +93,7 @@ export async function elevateAssistantSession(res, deps, input) {
         clientId: input.client.id,
         origin: input.origin,
         ...(input.customerRouting ? { customerRouting: input.customerRouting } : {}),
+        ...(input.boundSurface ? { boundSurface: input.boundSurface } : {}),
         resume: input.resume,
     }, {
         elevations: deps.elevations,

package/node_modules/@noodle-borg/service/dist/routes/assistant-interaction-stream.js

@@ -5,7 +5,10 @@ export async function narrateResolvedInteraction(res, deps, target, session, too
     try {
         const narration = await narrateInteractionResolution(target, session, tool, action, result, context, deps, (delta) => res.write(`event: content\ndata: ${JSON.stringify({ delta })}\n\n`));
         if (narration) {
-            await deps.store.appendHistory(session.id, [{ role: 'assistant', content: narration }]);
+            // Streamed to the panel as content deltas above, so it is genuine visible prose.
+            await deps.store.appendHistory(session.id, [
+                { role: 'assistant', content: narration, kind: 'visible' },
+            ]);
         }
     }
     catch {

package/node_modules/@noodle-borg/service/dist/routes/assistant-interactions.js

@@ -341,7 +341,12 @@ async function finishExecution(res, deps, session, interaction, context, result,
         status: 'succeeded',
     });
     await deps.store.appendHistory(session.id, [
-        { role: 'assistant', content: `Completed ${toolName}: ${JSON.stringify(safeOutput)}` },
+        // Model-facing scaffolding: the panel saw the tool_completed card, never this row's tool JSON.
+        {
+            role: 'assistant',
+            content: `Completed ${toolName}: ${JSON.stringify(safeOutput)}`,
+            kind: 'narration',
+        },
     ]);
     writeInteractionSseHeaders(res, session.origin);
     writeInteractionResolved(res, interaction.id, 'accept');
@@ -412,9 +417,11 @@ async function resolveStop(res, deps, session, interaction, action) {
     });
     const toolName = assistantInteractionTool(completion.interaction) ?? 'tool request';
     await deps.store.appendHistory(session.id, [
+        // Model-facing scaffolding: the panel saw the interaction resolve, never this summary row.
         {
             role: 'assistant',
             content: `${action === 'decline' ? 'Declined' : 'Cancelled'} ${toolName}; it was not executed.`,
+            kind: 'narration',
         },
     ]);
     writeInteractionSseHeaders(res, session.origin);

package/node_modules/@noodle-borg/service/dist/routes/assistant-public-session.js

@@ -5,7 +5,7 @@ import { assistantSessionUsageRequestEvent, captureAssistantUsage, } from '@nood
 import { assistantSessionResponseSchema } from '@noodle-borg/wire-contracts';
 import { readJsonBody, sendJson } from '../http-util.js';
 import { assistantBrowserConfiguration } from './assistant-configuration.js';
-import { applyBrowserCors, now } from './assistant-route-http.js';
+import { applyBrowserCors, assistantSessionEndpoints, now } from './assistant-route-http.js';
 /**
  * The transport half of anonymous session minting. Every decision — which refusal, in which order, and
  * whether the surface may serve at all — lives in `@noodle-borg/assistant-gateway`; this file parses a
@@ -76,6 +76,7 @@ export async function handlePublicAssistantSession(req, res, deps) {
                     : 'operator',
                 origin: input.origin,
                 publicEmbedId: input.embed.embedId,
+                boundSurface: 'public',
                 caller: { subject: input.subject, identityKind: 'anonymous' },
                 ...(configuration ? { configuration } : {}),
                 createdAt: current.toISOString(),
@@ -94,17 +95,10 @@ export async function handlePublicAssistantSession(req, res, deps) {
     }
     // Only here, with the origin proven against the live surface, may the page read the response.
     applyBrowserCors(req, res, origin);
-    const base = deps.serviceBase(req);
     const sessionBody = {
         token: result.token,
         expiresAt: result.expiresAt,
-        endpoints: {
-            turns: `${base}/v1/assistant/turns`,
-            toolConfirmations: `${base}/v1/assistant/tool-confirmations`,
-            interactions: `${base}/v1/assistant/interactions`,
-            apps: `${base}/v1/assistant/apps`,
-            sandbox: `${base}/v1/assistant/sandbox`,
-        },
+        endpoints: assistantSessionEndpoints(deps.serviceBase(req), deps.sandboxBase?.(req)),
         ...(configuration ? { configuration } : {}),
     };
     // Parse rather than trust: every published @noodleseed/assistant widget consumes this shape, and the

package/node_modules/@noodle-borg/service/dist/routes/assistant-route-http.js

@@ -47,4 +47,15 @@ export function applyBrowserCors(req, res, expectedOrigin) {
 export function now(deps) {
     return deps.clock?.() ?? new Date();
 }
+/** The one endpoint map every session mint returns; three mints, one source of truth. */
+export function assistantSessionEndpoints(base, sandboxBase = base) {
+    return {
+        turns: `${base}/v1/assistant/turns`,
+        toolConfirmations: `${base}/v1/assistant/tool-confirmations`,
+        interactions: `${base}/v1/assistant/interactions`,
+        apps: `${base}/v1/assistant/apps`,
+        sandbox: `${sandboxBase}/v1/assistant/sandbox`,
+        transcript: `${base}/v1/assistant/transcript`,
+    };
+}
 //# sourceMappingURL=assistant-route-http.js.map

package/node_modules/@noodle-borg/service/dist/routes/assistant-sandbox.js

@@ -1,58 +1,23 @@
-/**
- * Hosted widget sandbox document (ADR 0151 addendum). The embedded assistant renders MCP App
- * widgets in a double iframe; when the outer frame is an `about:srcdoc` document it inherits the
- * customer page's CSP, so a strict `script-src` silently blanks every widget. Serving this relay
- * document from the service origin gives it — and the inner `srcdoc` widget document that inherits
- * from it — a CSP the platform controls. The body is pinned byte-for-byte to
- * `contract/v1/assistant-sandbox-document.html` and to the published client's srcdoc fallback; any
- * relay-protocol change is a coordinated contract event, never a local edit.
- */
-export const ASSISTANT_SANDBOX_DOCUMENT = `<!doctype html><meta charset="utf-8"><style>html,body,iframe{border:0;margin:0;width:100%;height:100%;overflow:hidden}body{background:transparent}</style><script>
-let inner;
-const ready={jsonrpc:'2.0',method:'ui/notifications/sandbox-proxy-ready',params:{}};
-// Re-announce until the host acknowledges with the resource: when this document is hosted
-// cross-origin, the first announcement can arrive before the host's load handler is listening.
-const announce=setInterval(()=>parent.postMessage(ready,'*'),120);
-setTimeout(()=>clearInterval(announce),15000);
-addEventListener('message',(event)=>{
-  if(event.source===parent){
-    const message=event.data;
-    if(message?.method==='ui/notifications/sandbox-resource-ready'){
-      clearInterval(announce);
-      if(inner)return;
-      inner=document.createElement('iframe');
-      inner.setAttribute('sandbox',message.params?.sandbox||'allow-scripts');
-      inner.setAttribute('referrerpolicy','no-referrer');
-      inner.srcdoc=String(message.params?.html||'');
-      document.body.replaceChildren(inner);
-      return;
-    }
-    inner?.contentWindow?.postMessage(message,'*');
-  } else if(inner && event.source===inner.contentWindow) {
-    parent.postMessage(event.data,'*');
-  }
-});
-parent.postMessage(ready,'*');
-</script>`;
-/**
- * The sandbox document's own CSP. `sandbox allow-scripts` forces an opaque origin server-side even
- * if a future embedder frames the URL without a sandbox attribute (the document can never read
- * service cookies or storage); inline script/style must be allowed because the relay script and the
- * inner widget document's injected bridge are inline by design; everything else stays closed —
- * widget data flows only over the postMessage bridge, never direct fetch.
- */
-const SANDBOX_CSP = "sandbox allow-scripts; default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; img-src https: data: blob:; font-src https: data:; frame-src about:; form-action 'none'; base-uri 'none'; frame-ancestors *";
-/** Serve the static, secret-free sandbox document. GET-only; cacheable despite the no-store baseline. */
-export function handleAssistantSandbox(req, res) {
+import { ASSISTANT_SANDBOX_DOCUMENT, resolveAssistantSandboxResponsePolicy, } from '@noodle-borg/assistant-gateway/portable';
+/** Serve the static, secret-free sandbox relay and apply its validated CSP before writing the body. */
+export function handleAssistantSandbox(req, res, options = {}) {
     if (req.method !== 'GET') {
         res.statusCode = 405;
         res.setHeader('Allow', 'GET');
         res.end();
         return;
     }
+    const policy = resolveAssistantSandboxResponsePolicy(req.url ?? '/', options.isolatedOrigin === true);
+    res.setHeader('Content-Security-Policy', policy.contentSecurityPolicy);
+    if (!policy.ok) {
+        res.statusCode = 400;
+        res.setHeader('Content-Type', 'text/plain; charset=utf-8');
+        res.setHeader('Cache-Control', 'no-store');
+        res.end('Invalid sandbox policy');
+        return;
+    }
     res.statusCode = 200;
     res.setHeader('Content-Type', 'text/html; charset=utf-8');
-    res.setHeader('Content-Security-Policy', SANDBOX_CSP);
     res.setHeader('Cache-Control', 'public, max-age=300');
     res.end(ASSISTANT_SANDBOX_DOCUMENT);
 }

package/node_modules/@noodle-borg/service/dist/routes/assistant-session-target.js

@@ -1,23 +1,49 @@
-import { projectArtifactForSurface, publicSurfaceOf, } from '@noodle-borg/assistant-gateway/portable';
+import { authenticatedSurfaceOf, projectArtifactForSurface, publicSurfaceOf, surfaceBindingForOrigin, } from '@noodle-borg/assistant-gateway/portable';
 export async function sessionScopedTarget(registry, session) {
     const target = await registry.get(session.deploymentId);
     if (!target)
         return undefined;
-    // Keyed on the embed id, not `identityKind`: after elevation a signed-in visitor on a mixed surface
-    // keeps the surface that admitted them, and should keep its projection with it.
-    if (session.publicEmbedId === undefined)
+    const assistant = target.served.artifact.server.assistant;
+    const bound = session.boundSurface ?? deriveLegacyBinding(assistant, session);
+    if (bound === 'pre-surfaces')
         return target;
-    const surface = publicSurfaceOf(target.served.artifact.server.assistant);
-    // Fail closed. A rollback to an artifact with no public surface must end the session's reach, never
-    // hand it the unprojected server.
+    // Fail closed: an origin no surface owns must never widen to the whole server.
+    if (bound === 'unowned')
+        return undefined;
+    // Fail closed on a vanished surface. A rollback to an artifact without the bound surface must end the
+    // session's reach, never hand it the unprojected server.
+    if (bound === 'authenticated') {
+        const surface = authenticatedSurfaceOf(assistant);
+        if (surface === undefined)
+            return undefined;
+        // An omitted allowlist on an authenticated surface is the authored whole-server intent, so the
+        // exact binding still holds (instructions, budgets, attribution) without narrowing capabilities.
+        if (surface.capabilities === undefined)
+            return target;
+        return projected(target, surface.capabilities);
+    }
+    const surface = publicSurfaceOf(assistant);
     if (surface === undefined)
         return undefined;
+    return projected(target, surface.capabilities);
+}
+function projected(target, capabilities) {
     return {
         ...target,
         served: {
             ...target.served,
-            artifact: projectArtifactForSurface(target.served.artifact, surface.capabilities),
+            artifact: projectArtifactForSurface(target.served.artifact, capabilities),
         },
     };
 }
+/**
+ * A record minted before `boundSurface` existed: the embed id marks the public surface; otherwise the
+ * session's origin selects the owning surface on the pinned deployment. `pre-surfaces` means the whole
+ * server on that released artifact shape; `unowned` fails closed above.
+ */
+function deriveLegacyBinding(assistant, session) {
+    if (session.publicEmbedId !== undefined)
+        return 'public';
+    return surfaceBindingForOrigin(assistant, session.origin).kind;
+}
 //# sourceMappingURL=assistant-session-target.js.map

package/node_modules/@noodle-borg/service/dist/routes/assistant-transcript.js

@@ -0,0 +1,27 @@
+import { visibleTranscript } from '@noodle-borg/assistant-gateway/portable';
+import { assistantTranscriptResponseSchema } from '@noodle-borg/wire-contracts';
+import { sendJson } from '../http-util.js';
+import { applyBrowserCors, authenticateSession } from './assistant-route-http.js';
+/**
+ * The bounded visible-transcript read (ADR 0141/0201 amendments 2026-08-26), in its own module for
+ * the same reason `assistant-elevation.ts` is: `assistant.ts` is at its size limit, and this is a
+ * different responsibility from running a turn.
+ *
+ * POST, deliberately: every other session route is a POST, so the existing preflight's
+ * `POST, OPTIONS` shape covers it without widening allow-methods. Auth is exactly the shared
+ * session gate — current token, pinned origin — so a stale pre-elevation token cannot read, by
+ * construction. A read spends no turn budget: admission binds metered work (ADR 0201 decision 8),
+ * and this is a projection over state that already exists and already expires with the session.
+ */
+export async function handleAssistantTranscript(req, res, deps) {
+    const session = await authenticateSession(req, res, deps);
+    if (!session)
+        return;
+    applyBrowserCors(req, res, session.origin);
+    const body = { entries: visibleTranscript(session.history) };
+    // Parse before sending, like the session exchange: a contract break fails loudly here rather than
+    // stranding deployed widgets (ADR 0151).
+    assistantTranscriptResponseSchema.parse(body);
+    return sendJson(res, 200, body);
+}
+//# sourceMappingURL=assistant-transcript.js.map