@noodleseed/one 0.140.0 → 0.141.1

package/node_modules/@noodle-borg/protocol/dist/execution-error-mapping.js

@@ -12,6 +12,16 @@ const TOOL_EXECUTION_ERRORS = new Set([
 ]);
 /** Execution-error codes surfaced as JSON-RPC `-32602` (a malformed/unknown request). */
 const INVALID_PARAMS_ERRORS = new Set(['unknown_tool']);
+/**
+ * The allowlisted `connector_error` reasons that reach the wire as structured diagnostics. These
+ * are stable classifications (oversized response; execution or queue-wait time-budget expiry) —
+ * anything else stays a bare `connector_error` so backend detail never leaks.
+ */
+const CONNECTOR_ERROR_STRUCTURED_REASONS = new Set([
+    'response_too_large',
+    'timeout',
+    'queue_timeout',
+]);
 /**
  * Map an execution error to its MCP channel. Call-time, model-correctable failures become an
  * `isError: true` tool result; an unknown tool is an invalid-params protocol error; everything else
@@ -54,7 +64,9 @@ export function mapExecutionError(error) {
             result: {
                 content: [{ type: 'text', text }],
                 ...(error.code === 'credential_unavailable' ||
-                    (error.code === 'connector_error' && error.reason === 'response_too_large')
+                    (error.code === 'connector_error' &&
+                        error.reason !== undefined &&
+                        CONNECTOR_ERROR_STRUCTURED_REASONS.has(error.reason))
                     ? { structuredContent: { error: structuredError } }
                     : {}),
                 isError: true,

package/node_modules/@noodle-borg/protocol/dist/observation.d.ts

@@ -21,7 +21,8 @@ export interface ProtocolObservation {
 }
 /**
  * The analytics `errorKind` for an execution error: the stable code, refined with the allowlisted
- * `reason` when one exists (`connector_error.timeout`). Analytics-only — wire mapping is unchanged.
+ * `reason` when one exists (`connector_error.timeout`). Analytics-only — the wire's structured
+ * reasons are gated separately (and more narrowly) in `execution-error-mapping.ts`.
  */
 export declare function executionErrorKind(error: {
     readonly code: string;

package/node_modules/@noodle-borg/protocol/dist/observation.js

@@ -1,6 +1,7 @@
 /**
  * The analytics `errorKind` for an execution error: the stable code, refined with the allowlisted
- * `reason` when one exists (`connector_error.timeout`). Analytics-only — wire mapping is unchanged.
+ * `reason` when one exists (`connector_error.timeout`). Analytics-only — the wire's structured
+ * reasons are gated separately (and more narrowly) in `execution-error-mapping.ts`.
  */
 export function executionErrorKind(error) {
     return error.reason === undefined ? error.code : `${error.code}.${error.reason}`;

package/node_modules/@noodle-borg/runtime/dist/connector/failure-details.d.ts

@@ -1,5 +1,5 @@
 import type { ConnectorTraceEvent } from './types.js';
-type ConnectorFailureDetails = Pick<ConnectorTraceEvent, 'status' | 'category' | 'attempts' | 'retryable' | 'retryAfterMs' | 'responseExcerpt'>;
+type ConnectorFailureDetails = Pick<ConnectorTraceEvent, 'status' | 'category' | 'attempts' | 'retryable' | 'retryAfterMs' | 'responseExcerpt' | 'queueWaitMs' | 'executionMs'>;
 /** Reconstruct connector failure metadata from runtime-validated own data properties only. */
 export declare function sanitizeConnectorFailureDetails(error: unknown, options?: {
     readonly includeResponseExcerpt?: boolean;

package/node_modules/@noodle-borg/runtime/dist/connector/failure-details.js

@@ -1,5 +1,6 @@
 const FAILURE_CATEGORIES = new Set([
     'timeout',
+    'queue_timeout',
     'network_error',
     'rate_limited',
     'upstream_5xx',
@@ -20,6 +21,8 @@ export function sanitizeConnectorFailureDetails(error, options = {}) {
     const responseExcerpt = options.includeResponseExcerpt
         ? ownData(error, 'responseExcerpt')
         : undefined;
+    const queueWaitMs = ownData(error, 'queueWaitMs');
+    const executionMs = ownData(error, 'executionMs');
     return Object.freeze({
         ...(isIntegerInRange(status, 100, 599) ? { status } : {}),
         ...(typeof category === 'string' && FAILURE_CATEGORIES.has(category)
@@ -31,6 +34,8 @@ export function sanitizeConnectorFailureDetails(error, options = {}) {
         ...(typeof responseExcerpt === 'string' && responseExcerpt.length <= MAX_RESPONSE_EXCERPT_LENGTH
             ? { responseExcerpt }
             : {}),
+        ...(isIntegerInRange(queueWaitMs, 0, MAX_RETRY_AFTER_MS) ? { queueWaitMs } : {}),
+        ...(isIntegerInRange(executionMs, 0, MAX_RETRY_AFTER_MS) ? { executionMs } : {}),
     });
 }
 function ownData(error, key) {

package/node_modules/@noodle-borg/runtime/dist/connector/types.d.ts

@@ -34,11 +34,15 @@ export interface ConnectorTraceEvent {
     readonly retryable?: boolean;
     readonly retryAfterMs?: number;
     readonly responseExcerpt?: string;
+    /** Time the call waited for an execution slot, timed independently of execution. */
+    readonly queueWaitMs?: number;
+    /** Time the call actually executed, excluding queue wait. */
+    readonly executionMs?: number;
 }
 export interface ExecutionTraceSink {
     record(event: ConnectorTraceEvent): void;
 }
-export type ConnectorFailureCategory = 'timeout' | 'network_error' | 'rate_limited' | 'upstream_5xx' | 'upstream_4xx' | 'invalid_response' | 'response_too_large';
+export type ConnectorFailureCategory = 'timeout' | 'queue_timeout' | 'network_error' | 'rate_limited' | 'upstream_5xx' | 'upstream_4xx' | 'invalid_response' | 'response_too_large';
 export declare class ConnectorInvocationError extends Error {
     readonly status?: number;
     readonly category?: ConnectorFailureCategory;
@@ -46,6 +50,8 @@ export declare class ConnectorInvocationError extends Error {
     readonly retryable?: boolean;
     readonly retryAfterMs?: number;
     readonly responseExcerpt?: string;
+    readonly queueWaitMs?: number;
+    readonly executionMs?: number;
     constructor(message: string, details?: {
         readonly status?: number;
         readonly category?: ConnectorFailureCategory;
@@ -53,6 +59,8 @@ export declare class ConnectorInvocationError extends Error {
         readonly retryable?: boolean;
         readonly retryAfterMs?: number;
         readonly responseExcerpt?: string;
+        readonly queueWaitMs?: number;
+        readonly executionMs?: number;
     });
 }
 /** Trap-free nominal classification for connector rejection values. Proxy wrappers are untrusted. */
@@ -89,6 +97,12 @@ export interface ConnectorCall {
     readonly route?: CustomerConnectorRoute;
     /** Optional host capability for sandboxed connectors; ignored by ordinary connectors. */
     readonly host?: ConnectorCallHost;
+    /**
+     * Optional execution trace sink for connector-side observability (e.g. sandbox queue-wait vs
+     * execution durations). Connectors record only flat scalar fields; the runtime still owns the
+     * failure-event path.
+     */
+    readonly trace?: ExecutionTraceSink;
 }
 /**
  * A connector: a versioned integration exposing typed operations. Phase 1 ships only an in-memory

package/node_modules/@noodle-borg/runtime/dist/connector/types.js

@@ -7,6 +7,8 @@ export class ConnectorInvocationError extends Error {
     retryable;
     retryAfterMs;
     responseExcerpt;
+    queueWaitMs;
+    executionMs;
     constructor(message, details = {}) {
         super(message);
         connectorInvocationErrors.add(this);
@@ -24,6 +26,10 @@ export class ConnectorInvocationError extends Error {
             this.retryAfterMs = details.retryAfterMs;
         if (details.responseExcerpt !== undefined)
             this.responseExcerpt = details.responseExcerpt;
+        if (details.queueWaitMs !== undefined)
+            this.queueWaitMs = details.queueWaitMs;
+        if (details.executionMs !== undefined)
+            this.executionMs = details.executionMs;
     }
 }
 /** Trap-free nominal classification for connector rejection values. Proxy wrappers are untrusted. */

package/node_modules/@noodle-borg/runtime/dist/index.d.ts

@@ -18,6 +18,6 @@ export { AllowAllPolicy } from './policy/allow-all.js';
 export type { PolicyContext, PolicyDecision, PolicyGate } from './policy/types.js';
 export { type ConfirmationActionReview, type ConfirmationPreparationResult, type ConfirmationReview, type ConnectorFailureAttribution, type ElicitationRequest, type ElicitationResponse, type ExecutionError, type ExecutionErrorCode, type ExecutionResult, type InteractiveExecutionResult, isConfirmationRequired, isInputRequired, isInputRequiredForConfirmation, type PreparedOperationAction, type PreparedToolContinuation, type ToolContinuation, type ToolPreparationContinuation, } from './result.js';
 export { splitResultMeta } from './result-meta.js';
-export { assertNoSecretValue, assertSchemaValue, COMPLETE_STATE_OPERATION, createStateConnector, InMemoryStateHandleStore, PATCH_STATE_OPERATION, READ_STATE_OPERATION, STATE_CONNECTOR_ID, STATE_CONNECTOR_VERSION, STATE_OPERATION_SIGNATURES, StateConnector, type StateHandleRecord, type StateHandleStore, type StateInput, type StateMutationInput, type StatePatchInput, } from './state-handles.js';
+export { assertExpectedStateRevision, assertNoSecretValue, assertSchemaValue, assertStateHandleNotCompleted, COMPLETE_STATE_OPERATION, createMutableStateHandleRecord, createStateConnector, InMemoryStateHandleStore, type MutableStateHandleRecord, PATCH_STATE_OPERATION, READ_STATE_OPERATION, STATE_CONNECTOR_ID, STATE_CONNECTOR_VERSION, STATE_OPERATION_SIGNATURES, StateConnector, type StateHandleRecord, type StateHandleStore, type StateInput, type StateMutationInput, type StatePatchInput, stateHandleRecordForMutation, toPublicStateHandleRecord, } from './state-handles.js';
 export type { ToolDispatchContext, ToolDispatchDecision, ToolDispatchHook, } from './tool-dispatch.js';
 //# sourceMappingURL=index.d.ts.map

package/node_modules/@noodle-borg/runtime/dist/index.js

@@ -15,5 +15,5 @@ export { resolveManagedOrigins, } from './managed-origins.js';
 export { AllowAllPolicy } from './policy/allow-all.js';
 export { isConfirmationRequired, isInputRequired, isInputRequiredForConfirmation, } from './result.js';
 export { splitResultMeta } from './result-meta.js';
-export { assertNoSecretValue, assertSchemaValue, COMPLETE_STATE_OPERATION, createStateConnector, InMemoryStateHandleStore, PATCH_STATE_OPERATION, READ_STATE_OPERATION, STATE_CONNECTOR_ID, STATE_CONNECTOR_VERSION, STATE_OPERATION_SIGNATURES, StateConnector, } from './state-handles.js';
+export { assertExpectedStateRevision, assertNoSecretValue, assertSchemaValue, assertStateHandleNotCompleted, COMPLETE_STATE_OPERATION, createMutableStateHandleRecord, createStateConnector, InMemoryStateHandleStore, PATCH_STATE_OPERATION, READ_STATE_OPERATION, STATE_CONNECTOR_ID, STATE_CONNECTOR_VERSION, STATE_OPERATION_SIGNATURES, StateConnector, stateHandleRecordForMutation, toPublicStateHandleRecord, } from './state-handles.js';
 //# sourceMappingURL=index.js.map

package/node_modules/@noodle-borg/runtime/dist/operation-execution.js

@@ -171,6 +171,7 @@ async function invokeOperation(ref, args, sig, toolName, deps, policy, host, env
                 ...(deps.caller !== undefined ? { caller: deps.caller } : {}),
                 ...(customerRoute === undefined ? {} : { route: customerRoute }),
                 host,
+                ...(deps.trace === undefined ? {} : { trace: deps.trace }),
             });
         }
         catch (error) {

package/node_modules/@noodle-borg/runtime/dist/state-handles.d.ts

@@ -14,6 +14,16 @@ export interface StateHandleRecord {
     readonly status: 'active' | 'completed' | 'expired';
     readonly expiresAt?: string;
 }
+export interface MutableStateHandleRecord {
+    handle: string;
+    key: string;
+    value: Record<string, unknown>;
+    revision: number;
+    status: 'active' | 'completed';
+    createdAt: number;
+    updatedAt: number;
+    expiresAt?: number;
+}
 export interface StateHandleStore {
     read(input: StateInput): Promise<StateHandleRecord> | StateHandleRecord;
     patch(input: StatePatchInput): Promise<StateHandleRecord> | StateHandleRecord;
@@ -46,6 +56,11 @@ export declare class StateConnector implements Connector {
     invoke(call: ConnectorCall): Promise<unknown>;
 }
 export declare function createStateConnector(state: ArtifactState | undefined): StateConnector | undefined;
+export declare function createMutableStateHandleRecord(handle: string, key: string, ttlSeconds: number | undefined, now: number): MutableStateHandleRecord;
+export declare function stateHandleRecordForMutation(record: MutableStateHandleRecord | undefined, handle: string, key: string, ttlSeconds: number | undefined, now: number): MutableStateHandleRecord;
+export declare function assertStateHandleNotCompleted(record: MutableStateHandleRecord): void;
+export declare function assertExpectedStateRevision(record: MutableStateHandleRecord, expectedRevision: number): void;
+export declare function toPublicStateHandleRecord(record: MutableStateHandleRecord, now: number): StateHandleRecord;
 export declare function assertNoSecretValue(value: unknown, path?: string): void;
 export declare function assertSchemaValue(schema: Record<string, unknown>, value: Record<string, unknown>): void;
 //# sourceMappingURL=state-handles.d.ts.map

package/node_modules/@noodle-borg/runtime/dist/state-handles.js

@@ -55,18 +55,20 @@ export class InMemoryStateHandleStore {
     read(input) {
         const def = this.#definition(input.handle);
         const key = this.#recordKey(def, input);
-        return this.#publicRecord(this.#records.get(key) ?? this.#emptyRecord(input.handle, input.key ?? 'default', def));
+        const now = this.#now().getTime();
+        return toPublicStateHandleRecord(this.#records.get(key) ??
+            createMutableStateHandleRecord(input.handle, input.key ?? 'default', def.ttlSeconds, now), now);
     }
     patch(input) {
         const def = this.#definition(input.handle);
         const key = this.#recordKey(def, input);
-        const current = this.#records.get(key) ?? this.#emptyRecord(input.handle, input.key ?? 'default', def);
-        assertActive(current, this.#now().getTime());
-        assertExpectedRevision(current, input.expectedRevision);
+        const now = this.#now().getTime();
+        const current = stateHandleRecordForMutation(this.#records.get(key), input.handle, input.key ?? 'default', def.ttlSeconds, now);
+        assertStateHandleNotCompleted(current);
+        assertExpectedStateRevision(current, input.expectedRevision);
         assertNoSecretValue(input.value);
         const value = { ...current.value, ...input.value };
         assertSchemaValue(def.schema, value);
-        const now = this.#now().getTime();
         const next = {
             ...current,
             value,
@@ -74,22 +76,23 @@ export class InMemoryStateHandleStore {
             updatedAt: now,
         };
         this.#records.set(key, next);
-        return this.#publicRecord(next);
+        return toPublicStateHandleRecord(next, now);
     }
     complete(input) {
         const def = this.#definition(input.handle);
         const key = this.#recordKey(def, input);
-        const current = this.#records.get(key) ?? this.#emptyRecord(input.handle, input.key ?? 'default', def);
-        assertActive(current, this.#now().getTime());
-        assertExpectedRevision(current, input.expectedRevision);
+        const now = this.#now().getTime();
+        const current = stateHandleRecordForMutation(this.#records.get(key), input.handle, input.key ?? 'default', def.ttlSeconds, now);
+        assertStateHandleNotCompleted(current);
+        assertExpectedStateRevision(current, input.expectedRevision);
         const next = {
             ...current,
             status: 'completed',
             revision: current.revision + 1,
-            updatedAt: this.#now().getTime(),
+            updatedAt: now,
         };
         this.#records.set(key, next);
-        return this.#publicRecord(next);
+        return toPublicStateHandleRecord(next, now);
     }
     #definition(handle) {
         const def = this.#state.handles[handle];
@@ -102,34 +105,6 @@ export class InMemoryStateHandleStore {
         const owner = def.scope === 'caller' ? (input.callerSubject ?? 'anonymous') : 'deployment';
         return `${input.handle}\u0000${owner}\u0000${userKey}`;
     }
-    #emptyRecord(handle, key, def) {
-        const now = this.#now().getTime();
-        return {
-            handle,
-            key,
-            value: {},
-            revision: 0,
-            status: 'active',
-            createdAt: now,
-            updatedAt: now,
-            ...(def.ttlSeconds !== undefined ? { expiresAt: now + def.ttlSeconds * 1000 } : {}),
-        };
-    }
-    #publicRecord(record) {
-        const status = record.expiresAt !== undefined && record.expiresAt <= this.#now().getTime()
-            ? 'expired'
-            : record.status;
-        return {
-            handle: record.handle,
-            key: record.key,
-            value: record.value,
-            revision: record.revision,
-            status,
-            ...(record.expiresAt !== undefined
-                ? { expiresAt: new Date(record.expiresAt).toISOString() }
-                : {}),
-        };
-    }
 }
 export class StateConnector {
     id = STATE_CONNECTOR_ID;
@@ -212,18 +187,53 @@ function objectArg(value, name) {
         throw new Error(`${name} must be an object`);
     return value;
 }
-function assertActive(record, now) {
+export function createMutableStateHandleRecord(handle, key, ttlSeconds, now) {
+    return {
+        handle,
+        key,
+        value: {},
+        revision: 0,
+        status: 'active',
+        createdAt: now,
+        updatedAt: now,
+        ...(ttlSeconds !== undefined ? { expiresAt: now + ttlSeconds * 1000 } : {}),
+    };
+}
+export function stateHandleRecordForMutation(record, handle, key, ttlSeconds, now) {
+    if (record === undefined)
+        return createMutableStateHandleRecord(handle, key, ttlSeconds, now);
+    if (!isExpired(record, now))
+        return record;
+    return {
+        ...createMutableStateHandleRecord(handle, key, ttlSeconds, now),
+        revision: record.revision + 1,
+    };
+}
+export function assertStateHandleNotCompleted(record) {
     if (record.status === 'completed')
         throw new Error('completed state handles are read-only');
-    if (record.expiresAt !== undefined && record.expiresAt <= now) {
-        throw new Error('expired state handles are read-only');
-    }
 }
-function assertExpectedRevision(record, expectedRevision) {
+function isExpired(record, now) {
+    return record.expiresAt !== undefined && record.expiresAt <= now;
+}
+export function assertExpectedStateRevision(record, expectedRevision) {
     if (record.revision !== expectedRevision) {
         throw new Error(`state revision conflict: expected ${expectedRevision}, got ${record.revision}`);
     }
 }
+export function toPublicStateHandleRecord(record, now) {
+    const expired = isExpired(record, now);
+    return {
+        handle: record.handle,
+        key: record.key,
+        value: record.value,
+        revision: record.revision + (expired ? 1 : 0),
+        status: expired ? 'expired' : record.status,
+        ...(record.expiresAt !== undefined
+            ? { expiresAt: new Date(record.expiresAt).toISOString() }
+            : {}),
+    };
+}
 const SECRET_LIKE_FIELD = /(secret|token|api[_-]?key|password|credential|authorization|cookie)/i;
 export function assertNoSecretValue(value, path = 'value') {
     if (Array.isArray(value)) {

package/node_modules/@noodle-borg/service/dist/auth/developer-grant-guard.js

@@ -8,7 +8,8 @@ export async function authorizeDeveloperGrant(identity, context) {
     });
     if (grant === undefined)
         return false;
-    if (developerResourcePath(grant.resource) !== context.resourcePath)
+    const grantPath = developerResourcePath(grant.resource);
+    if (grantPath === undefined || !context.resourcePaths.has(grantPath))
         return false;
     if (!grant.capabilities.includes(context.capability))
         return false;

package/node_modules/@noodle-borg/service/dist/modules/route-dispatch.js

@@ -42,7 +42,7 @@ export function createModuleRouteContext(hostRequest, deps) {
                             controlPlane: deps.controlPlane,
                             org: input.org,
                             capability: input.permission,
-                            resourcePath: DEVELOPER_CLI_PATH,
+                            resourcePaths: new Set([DEVELOPER_CLI_PATH]),
                         }));
                     if (!allowed) {
                         return forbidden('developer grant does not authorize this operation');

package/node_modules/@noodle-borg/service/dist/registry-types.d.ts

@@ -1,11 +1,11 @@
 import type { CapabilityName } from '@noodle-borg/capabilities';
 import type { CatalogConnector, HostedPackagedAsset } from '@noodle-borg/compiler';
+import type { ControlPlaneIdentity } from '@noodle-borg/control-plane/portable';
 import type { OrgMembershipSource, PolicyGate } from '@noodle-borg/module';
 import type { Connector } from '@noodle-borg/runtime';
 import type { AccessMode, OwnerTokenVerifier } from '@noodle-borg/transport-http';
 import type { DeploymentSource } from '@noodle-borg/wire-contracts';
 import type { AppPackageRenderer } from './app-package-snapshot.js';
-import type { ControlPlaneIdentity } from './auth/deploy-gate.js';
 import type { DelegatedExchangeOptions } from './delegated-token-exchange.js';
 import type { ExternalCredentialExchangeRuntimeOptions } from './external-credential-exchange.js';
 import type { GoogleWorkloadIdentityRuntimeOptions } from './google-workload-identity.js';

package/node_modules/@noodle-borg/service/dist/routes/assistant-agent.js

@@ -1,6 +1,6 @@
 import { ADMISSION_DEFAULTS } from '@noodle-borg/admission-limits/portable';
 import { requestModelCompletion, } from '@noodle-borg/assistant-gateway/model-runtime';
-import { assistantModelToolOncePerSession, assistantModelToolRequiredWhenVisible, dispatchAssistantTool, projectAssistantGuide, publicSurfaceOf, selectAssistantModelTools, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
+import { assistantModelToolOncePerSession, assistantModelToolRequiredWhenVisible, authenticatedSurfaceOf, dispatchAssistantTool, projectAssistantGuide, publicSurfaceOf, selectAssistantModelTools, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
 import { validateJsonSchemaWithDefaults } from '@noodle-borg/compiler';
 import { guardedFetch } from '@noodle-borg/connector-http';
 import { evaluateToolAuthorization } from '@noodle-borg/protocol';
@@ -383,10 +383,22 @@ function selectTurnModelTools(target, caller, latestMessage, usedToolNames) {
         ...(usedToolNames === undefined ? {} : { usedToolNames }),
     });
 }
-/** Surface behavior is injected only when the session is pinned to the public projection that minted it. */
+/**
+ * Surface behavior is injected only for the exact surface the session is bound to (ADR 0215): the
+ * public-audience surface for embed-minted sessions, the authenticated surface for backend-exchanged
+ * ones. A session with no binding — a record from before binding existed, or a pre-surfaces artifact —
+ * fails closed to no surface block, never to a union or first-surface fallback.
+ */
 function surfaceInstructionsContext(assistant, session) {
-    if (session.publicEmbedId === undefined)
+    const bound = session.boundSurface ?? (session.publicEmbedId !== undefined ? 'public' : undefined);
+    if (bound === undefined)
         return '';
+    if (bound === 'authenticated') {
+        const surface = authenticatedSurfaceOf(assistant);
+        if (!surface?.instructions)
+            return '';
+        return `\n\nSurface instructions (authenticated website surface; same trust level as tenant instructions):\n${surface.instructions}`;
+    }
     const surface = publicSurfaceOf(assistant);
     if (!surface?.instructions)
         return '';

package/node_modules/@noodle-borg/service/dist/routes/assistant-clients.js

@@ -0,0 +1,116 @@
+import { readJsonBody, sendForbidden, sendJson } from '../http-util.js';
+import { now } from './assistant-route-http.js';
+import { authorizeControlPlane } from './control-plane.js';
+export async function handleAssistantClients(req, res, tenant, id, action, deps) {
+    const identity = await authorizeControlPlane(req, res, deps.gate, { requireIdentity: false });
+    if (identity === false)
+        return;
+    if (identity && !identity.superAdmin) {
+        const member = await deps.controlPlane.isOrgMember({
+            org: tenant.org,
+            subject: identity.subject,
+        });
+        if (!member)
+            return sendForbidden(res, 'forbidden');
+    }
+    if (action === 'collection' && req.method === 'GET') {
+        const clients = await deps.store.listClients(tenant);
+        return sendJson(res, 200, {
+            ok: true,
+            clients: clients.map(publicClient),
+        });
+    }
+    if (action === 'collection' && req.method === 'POST') {
+        const body = await readJsonBody(req, deps.maxBody);
+        if (!body.ok)
+            return sendJson(res, body.status, { error: body.error });
+        const name = body.value.name;
+        if (typeof name !== 'string' || name.trim().length < 1 || name.length > 80) {
+            return sendJson(res, 400, { error: '"name" must be a non-empty string' });
+        }
+        const target = await deps.registry.getActiveByTenant(tenant);
+        const assistant = target?.served.artifact.server.assistant;
+        if (!target?.deploymentId || !assistant)
+            return sendJson(res, 409, { error: 'deployment has no embedded assistant' });
+        const created = await deps.store.createClient({
+            name: name.trim(),
+            tenant,
+            deploymentId: target.deploymentId,
+            allowedOrigins: assistant.allowedOrigins,
+            now: now(deps),
+        });
+        await deps.audit.emit({
+            eventType: 'assistant.client.created',
+            org: tenant.org,
+            app: tenant.app,
+            env: tenant.env,
+            deploymentId: target.deploymentId,
+            decision: 'allow',
+            status: 201,
+            ...(identity ? { actorSubject: identity.subject } : {}),
+            ...(identity?.email ? { actorEmail: identity.email } : {}),
+            details: { clientId: created.client.id, name: created.client.name },
+        });
+        return sendJson(res, 201, {
+            ok: true,
+            ...publicClient(created.client),
+            clientSecret: created.secret,
+        });
+    }
+    if (!id)
+        return sendJson(res, 404, { error: 'not found' });
+    const owned = (await deps.store.listClients(tenant)).some((client) => client.id === id);
+    if (!owned)
+        return sendJson(res, 404, { error: 'not found' });
+    if (action === 'rotate' && req.method === 'POST') {
+        const rotated = await deps.store.rotateClient(id, now(deps));
+        if (!rotated)
+            return sendJson(res, 404, { error: 'not found' });
+        await deps.audit.emit({
+            eventType: 'assistant.client.rotated',
+            org: tenant.org,
+            app: tenant.app,
+            env: tenant.env,
+            deploymentId: rotated.client.deploymentId,
+            decision: 'allow',
+            status: 200,
+            ...(identity ? { actorSubject: identity.subject } : {}),
+            ...(identity?.email ? { actorEmail: identity.email } : {}),
+            details: { clientId: rotated.client.id },
+        });
+        return sendJson(res, 200, {
+            ok: true,
+            ...publicClient(rotated.client),
+            clientSecret: rotated.secret,
+        });
+    }
+    if (action === 'item' && req.method === 'DELETE') {
+        await deps.store.revokeClient(id, now(deps));
+        await deps.audit.emit({
+            eventType: 'assistant.client.revoked',
+            org: tenant.org,
+            app: tenant.app,
+            env: tenant.env,
+            decision: 'allow',
+            status: 204,
+            ...(identity ? { actorSubject: identity.subject } : {}),
+            ...(identity?.email ? { actorEmail: identity.email } : {}),
+            details: { clientId: id },
+        });
+        res.statusCode = 204;
+        res.end();
+        return;
+    }
+    sendJson(res, 405, { error: 'method not allowed' });
+}
+function publicClient(client) {
+    return {
+        id: client.id,
+        name: client.name,
+        createdAt: client.createdAt,
+        // Audit data only: sessions follow the tenant's active deployment, not this snapshot.
+        createdAgainstDeploymentId: client.deploymentId,
+        ...(client.revokedAt ? { revokedAt: client.revokedAt } : {}),
+    };
+}
+//# sourceMappingURL=assistant-clients.js.map

package/node_modules/@noodle-borg/service/dist/routes/assistant-dispatch.js

@@ -1,10 +1,13 @@
-import { handleAssistantAppRequest, handleAssistantClients, handleAssistantPreflight, handleAssistantSession, handleAssistantTurn, handleConsoleApprovalNonce, } from './assistant.js';
+import { isAssistantSandboxHost, } from '@noodle-borg/assistant-gateway/portable';
+import { handleAssistantAppRequest, handleAssistantPreflight, handleAssistantSession, handleAssistantTurn, handleConsoleApprovalNonce, } from './assistant.js';
+import { handleAssistantClients } from './assistant-clients.js';
 import { handleAssistantDoctor } from './assistant-doctor.js';
 import { handleAssistantEmbedScript } from './assistant-embed-script.js';
 import { handleAssistantEmbeds } from './assistant-embeds.js';
 import { handleAssistantConfirmation, handleAssistantInteraction, } from './assistant-interactions.js';
 import { handlePublicAssistantSession } from './assistant-public-session.js';
 import { handleAssistantSandbox } from './assistant-sandbox.js';
+import { handleAssistantTranscript } from './assistant-transcript.js';
 export function dispatchAssistantRoutes(req, res, url, deps) {
     if (url.pathname === '/v1/console/approval-nonces/consume' && req.method === 'POST') {
         return run(req, res, deps, () => handleConsoleApprovalNonce(req, res, deps));
@@ -13,7 +16,8 @@ export function dispatchAssistantRoutes(req, res, url, deps) {
         url.pathname === '/v1/assistant/turns' ||
         url.pathname === '/v1/assistant/tool-confirmations' ||
         url.pathname === '/v1/assistant/interactions' ||
-        url.pathname === '/v1/assistant/apps') &&
+        url.pathname === '/v1/assistant/apps' ||
+        url.pathname === '/v1/assistant/transcript') &&
         req.method === 'OPTIONS') {
         deps.applySecurityHeaders(res, deps.tls);
         handleAssistantPreflight(req, res);
@@ -32,7 +36,9 @@ export function dispatchAssistantRoutes(req, res, url, deps) {
         deps.applySecurityHeaders(res, deps.tls);
         if (deps.enforceHttps(req, res, deps.tls))
             return true;
-        handleAssistantSandbox(req, res);
+        const sandboxBase = deps.sandboxBase?.(req);
+        const isolatedOrigin = isAssistantSandboxHost(req.headers.host, sandboxBase);
+        handleAssistantSandbox(req, res, { isolatedOrigin });
         return true;
     }
     if (url.pathname === '/v1/assistant/public-sessions' && req.method === 'POST') {
@@ -47,6 +53,9 @@ export function dispatchAssistantRoutes(req, res, url, deps) {
     if (url.pathname === '/v1/assistant/apps' && req.method === 'POST') {
         return run(req, res, deps, () => handleAssistantAppRequest(req, res, deps));
     }
+    if (url.pathname === '/v1/assistant/transcript' && req.method === 'POST') {
+        return run(req, res, deps, () => handleAssistantTranscript(req, res, deps));
+    }
     const doctorMatch = /^\/v1\/orgs\/([^/]+)\/apps\/([^/]+)\/envs\/([^/]+)\/assistant\/doctor$/.exec(url.pathname);
     if (doctorMatch) {
         const tenant = decodeTenant(doctorMatch);

package/node_modules/@noodle-borg/service/dist/routes/assistant-elevation.js

@@ -93,6 +93,7 @@ export async function elevateAssistantSession(res, deps, input) {
         clientId: input.client.id,
         origin: input.origin,
         ...(input.customerRouting ? { customerRouting: input.customerRouting } : {}),
+        ...(input.boundSurface ? { boundSurface: input.boundSurface } : {}),
         resume: input.resume,
     }, {
         elevations: deps.elevations,

package/node_modules/@noodle-borg/service/dist/routes/assistant-interaction-stream.js

@@ -5,7 +5,10 @@ export async function narrateResolvedInteraction(res, deps, target, session, too
     try {
         const narration = await narrateInteractionResolution(target, session, tool, action, result, context, deps, (delta) => res.write(`event: content\ndata: ${JSON.stringify({ delta })}\n\n`));
         if (narration) {
-            await deps.store.appendHistory(session.id, [{ role: 'assistant', content: narration }]);
+            // Streamed to the panel as content deltas above, so it is genuine visible prose.
+            await deps.store.appendHistory(session.id, [
+                { role: 'assistant', content: narration, kind: 'visible' },
+            ]);
         }
     }
     catch {

package/node_modules/@noodle-borg/service/dist/routes/assistant-interactions.js

@@ -341,7 +341,12 @@ async function finishExecution(res, deps, session, interaction, context, result,
         status: 'succeeded',
     });
     await deps.store.appendHistory(session.id, [
-        { role: 'assistant', content: `Completed ${toolName}: ${JSON.stringify(safeOutput)}` },
+        // Model-facing scaffolding: the panel saw the tool_completed card, never this row's tool JSON.
+        {
+            role: 'assistant',
+            content: `Completed ${toolName}: ${JSON.stringify(safeOutput)}`,
+            kind: 'narration',
+        },
     ]);
     writeInteractionSseHeaders(res, session.origin);
     writeInteractionResolved(res, interaction.id, 'accept');
@@ -412,9 +417,11 @@ async function resolveStop(res, deps, session, interaction, action) {
     });
     const toolName = assistantInteractionTool(completion.interaction) ?? 'tool request';
     await deps.store.appendHistory(session.id, [
+        // Model-facing scaffolding: the panel saw the interaction resolve, never this summary row.
         {
             role: 'assistant',
             content: `${action === 'decline' ? 'Declined' : 'Cancelled'} ${toolName}; it was not executed.`,
+            kind: 'narration',
         },
     ]);
     writeInteractionSseHeaders(res, session.origin);