@noodleseed/one 0.147.1 → 0.149.0

package/node_modules/@noodle-borg/assistant-gateway/dist/model-stream.d.ts

@@ -0,0 +1,35 @@
+export interface ModelToolCall {
+    readonly id: string;
+    readonly type: 'function';
+    readonly function: {
+        readonly name: string;
+        readonly arguments: string;
+    };
+    /**
+     * Opaque provider round-trip state, echoed back unread on the follow-up request.
+     *
+     * Gemini 3.x returns a `thought_signature` here and **rejects the next request** without it, so a
+     * client that drops this can call a tool once and never finish the turn. The OpenAI wire format
+     * reserves `extra_content` for exactly this, so it is passed through rather than special-cased —
+     * nothing here reads it, and no provider is named in the code that carries it.
+     */
+    readonly extra_content?: unknown;
+}
+export interface ModelCompletion {
+    readonly choices: readonly {
+        readonly message: {
+            readonly role: 'assistant';
+            readonly content?: string | null;
+            readonly tool_calls?: readonly ModelToolCall[];
+        };
+    }[];
+    readonly usage?: ModelUsage;
+}
+export interface ModelUsage {
+    readonly promptTokens: number;
+    readonly completionTokens: number;
+    readonly totalTokens: number;
+    readonly reasoningTokens?: number;
+}
+export declare function readModelCompletion(response: Response, onContent: (delta: string) => void, maxBytes?: number): Promise<ModelCompletion>;
+//# sourceMappingURL=model-stream.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/portable.d.ts

@@ -17,16 +17,19 @@ export * from './assistant-transcript.js';
 export * from './assistant-view-availability.js';
 export * from './elevation.js';
 export * from './elevation-store.js';
+export * from './embed-operator-view.js';
 export * from './embed-script.js';
 export * from './embed-store.js';
 export * from './in-memory-assistant-appearance-store.js';
 export * from './in-memory-elevation-store.js';
 export * from './in-memory-embed-store.js';
+export * from './managed-spend.js';
 export * from './public-configuration.js';
 export * from './public-session.js';
 export * from './public-surface.js';
 export * from './public-turn.js';
 export * from './session-resume.js';
+export * from './session-target.js';
 export * from './surface-budget.js';
 export * from './tenant-ref.js';
 //# sourceMappingURL=portable.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/portable.js

@@ -17,16 +17,19 @@ export * from './assistant-transcript.js';
 export * from './assistant-view-availability.js';
 export * from './elevation.js';
 export * from './elevation-store.js';
+export * from './embed-operator-view.js';
 export * from './embed-script.js';
 export * from './embed-store.js';
 export * from './in-memory-assistant-appearance-store.js';
 export * from './in-memory-elevation-store.js';
 export * from './in-memory-embed-store.js';
+export * from './managed-spend.js';
 export * from './public-configuration.js';
 export * from './public-session.js';
 export * from './public-surface.js';
 export * from './public-turn.js';
 export * from './session-resume.js';
+export * from './session-target.js';
 export * from './surface-budget.js';
 export * from './tenant-ref.js';
 //# sourceMappingURL=portable.js.map

package/node_modules/@noodle-borg/assistant-gateway/dist/public-session.d.ts

@@ -1,4 +1,4 @@
-import type { AdmissionEnvelope, DailyCounterStore } from '@noodle-borg/admission-limits/portable';
+import { type AdmissionEnvelope, type DailyCounterStore } from '@noodle-borg/admission-limits/portable';
 import { type PublicEmbedRecord, type PublicEmbedStore } from './embed-store.js';
 import type { PublicSurface } from './public-surface.js';
 import { type SurfaceBudgetBounds } from './surface-budget.js';
@@ -43,6 +43,13 @@ export interface PublicSessionRequest {
      * be parsed, in which case the surface tier alone applies: fairness degrades, solvency does not.
      */
     readonly addressBucket?: string | undefined;
+    /**
+     * The browser's own visitor identifier (admission tier 4), unvalidated exactly like `embedId`:
+     * it arrives from the request body, so the decision owns its parse rather than the transport.
+     * Client-supplied and therefore rotatable, so it bounds fairness and never abuse — the address
+     * tier underneath is the one that cannot be rotated.
+     */
+    readonly visitorId?: unknown;
 }
 export type PublicSessionResult = {
     readonly ok: true;
@@ -54,6 +61,12 @@ export type PublicSessionResult = {
     readonly status: number;
     readonly code: string;
     readonly message: string;
+    /**
+     * The surface this refusal belongs to, once it is known. Present for every refusal an operator
+     * needs to see — out of budget, address at its ceiling, origin off the live allowlist — and
+     * absent for the ones that cannot be attributed to a tenant at all, which are prober noise.
+     */
+    readonly embed?: PublicEmbedRecord;
 };
 export declare function mintPublicSession(request: PublicSessionRequest, envelope: AdmissionEnvelope, ports: PublicSessionPorts): Promise<PublicSessionResult>;
 //# sourceMappingURL=public-session.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/public-session.js

@@ -1,7 +1,8 @@
+import { visitorBucket, } from '@noodle-borg/admission-limits/portable';
 import { isPublicEmbedId } from './embed-store.js';
 import { surfaceEnvelope } from './surface-budget.js';
-function refuse(status, code, message) {
-    return { ok: false, status, code, message };
+function refuse(status, code, message, embed) {
+    return { ok: false, status, code, message, ...(embed === undefined ? {} : { embed }) };
 }
 export async function mintPublicSession(request, envelope, ports) {
     if (typeof request.embedId !== 'string' || !isPublicEmbedId(request.embedId)) {
@@ -22,17 +23,33 @@ export async function mintPublicSession(request, envelope, ports) {
         return refuse(403, 'embed_not_found', 'embed is not available');
     const surface = await ports.resolveActiveSurface(embed);
     if (surface === undefined) {
-        return refuse(409, 'surface_unavailable', 'assistant deployment is unavailable');
+        return refuse(409, 'surface_unavailable', 'assistant deployment is unavailable', embed);
     }
     // Origins come from the live artifact, so `noodle deploy` alone updates a pasted snippet.
     if (!surface.origins.includes(request.origin)) {
-        return refuse(403, 'origin_not_allowed', 'origin is not allowed');
+        return refuse(403, 'origin_not_allowed', 'origin is not allowed', embed);
     }
     // The surface's own budget, which an operator may have lowered — or set to zero, which is the kill
     // switch. Resolved after the embed is known and before anything is spent.
     const budgetBounds = await ports.resolveBudgetBounds?.(embed);
     const surfaceLimits = surfaceEnvelope(envelope, embed, budgetBounds);
     const now = ports.now();
+    // Tier 4 before tier 3, which is before solvency. A visitor at their own hourly ceiling is refused
+    // without spending any of the shared address allowance, so one person behind a corporate NAT cannot
+    // consume the allowance the other three hundred are also using. An abuser who rotates the
+    // identifier simply never meets this tier and lands on the address bound below, which is the point:
+    // this is fairness, that is abuse control, and they are deliberately not the same limit.
+    const visitor = visitorBucket(request.visitorId);
+    if (visitor !== undefined) {
+        const perVisitor = await ports.counters.consume({
+            key: `mints:vis:${embed.embedId}:${visitor}`,
+            limit: surfaceLimits.mintsPerVisitorHour,
+            window: 'hour',
+        }, now);
+        if (!perVisitor.allowed) {
+            return refuse(429, 'visitor_session_budget_exhausted', 'assistant is unavailable right now', embed);
+        }
+    }
     // Fairness before solvency: an address at its hourly ceiling is refused without spending any of the
     // surface's day, so one visitor cannot burn the customer's budget on refusals.
     if (typeof request.addressBucket === 'string') {
@@ -42,14 +59,14 @@ export async function mintPublicSession(request, envelope, ports) {
             window: 'hour',
         }, now);
         if (!perAddress.allowed) {
-            return refuse(429, 'address_session_budget_exhausted', 'assistant is unavailable right now');
+            return refuse(429, 'address_session_budget_exhausted', 'assistant is unavailable right now', embed);
         }
     }
     const mints = await ports.counters.consume({ key: `mints:${embed.embedId}`, limit: surfaceLimits.mintsPerDay }, now);
     if (!mints.allowed) {
         // Distinct from a hard error: the widget renders this calmly, and an operator sees a surface that
         // is switched off (limit 0) or spent, not a broken embed.
-        return refuse(429, 'daily_session_budget_exhausted', 'assistant is unavailable right now');
+        return refuse(429, 'daily_session_budget_exhausted', 'assistant is unavailable right now', embed);
     }
     const session = await ports.createSession({
         embed,

package/node_modules/@noodle-borg/assistant-gateway/dist/public-turn.d.ts

@@ -1,6 +1,7 @@
-import type { AdmissionEnvelope, DailyCounterStore } from '@noodle-borg/admission-limits/portable';
-import type { AssistantTurnConsumption } from './assistant-store.js';
+import { type AdmissionEnvelope, type DailyCounterStore } from '@noodle-borg/admission-limits/portable';
+import type { AssistantSessionRecord, AssistantStore, AssistantTurnConsumption } from './assistant-store.js';
 import type { PublicEmbedRecord, PublicEmbedStore } from './embed-store.js';
+import type { ManagedAssistantModelResolver } from './model-request.js';
 import { type SurfaceBudgetBounds } from './surface-budget.js';
 /**
  * Whether an anonymous visitor's next turn runs.
@@ -43,5 +44,55 @@ export type PublicTurnResult = {
     readonly code: string;
     readonly message: string;
 };
+export interface AssistantPublicTurnDeps {
+    readonly publicEmbeds?: PublicEmbedStore;
+    readonly admissionCounters?: DailyCounterStore;
+    readonly admissionEnvelope?: AdmissionEnvelope;
+    readonly managedModelResolver?: ManagedAssistantModelResolver;
+    readonly store: Pick<AssistantStore, 'consumeTurn'>;
+    readonly clock?: () => Date;
+}
+export interface PublicTurnRefusal {
+    readonly status: number;
+    readonly code: string;
+    readonly message: string;
+}
+/** Adapt a session plus serving ports to the transport-free public-turn decision below. */
+export declare function refusePublicTurn(deps: AssistantPublicTurnDeps, session: AssistantSessionRecord, message: string, addressBucket: string | undefined): Promise<PublicTurnRefusal | undefined>;
+/**
+ * The same gate in front of a WebMCP bridge tool call (ADR 0220). A browser agent can call governed
+ * tools without ever running a model turn, so the turn budget above would never refuse it.
+ */
+export declare function refuseBridgeToolCall(deps: AssistantPublicTurnDeps, session: AssistantSessionRecord): Promise<PublicTurnRefusal | undefined>;
 export declare function admitPublicTurn(request: PublicTurnRequest, defaults: AdmissionEnvelope, ports: PublicTurnPorts): Promise<PublicTurnResult>;
+/**
+ * Whether a browser agent's next bridge tool call runs (ADR 0220).
+ *
+ * Separate from {@link admitPublicTurn} because a WebMCP call is not a turn: it spends no model budget,
+ * so the turn caps would never refuse it however long an agent kept going. It still reaches connectors
+ * and customer backends, so it gets its own pair of bounds — and, like every other admission decision
+ * here, the envelope is read per call so an operator lowering a cap stops traffic already under way.
+ *
+ * Authority is not decided here and never could be: this runs *after* the route has authenticated the
+ * session, and the call it admits still goes through tool authorization and confirmation downstream.
+ */
+export interface BridgeToolCallPorts {
+    readonly counters: DailyCounterStore;
+    readonly embeds: Pick<PublicEmbedStore, 'lookup'>;
+    readonly resolveBudgetBounds?: (embed: PublicEmbedRecord) => Promise<SurfaceBudgetBounds | undefined>;
+    now(): Date;
+}
+export interface BridgeToolCallRequest {
+    readonly sessionId: string;
+    readonly publicEmbedId: string;
+}
+export type BridgeToolCallResult = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly status: number;
+    readonly code: string;
+    readonly message: string;
+};
+export declare function admitBridgeToolCall(request: BridgeToolCallRequest, defaults: AdmissionEnvelope, ports: BridgeToolCallPorts): Promise<BridgeToolCallResult>;
 //# sourceMappingURL=public-turn.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/public-turn.js

@@ -1,4 +1,65 @@
+import { ADMISSION_DEFAULTS, isDisabled, } from '@noodle-borg/admission-limits/portable';
 import { surfaceEnvelope } from './surface-budget.js';
+/** Adapt a session plus serving ports to the transport-free public-turn decision below. */
+export async function refusePublicTurn(deps, session, message, addressBucket) {
+    const publicEmbedId = session.publicEmbedId;
+    if (publicEmbedId === undefined)
+        return undefined;
+    if (!deps.publicEmbeds || !deps.admissionCounters) {
+        return {
+            status: 503,
+            code: 'admission_unavailable',
+            message: 'assistant is unavailable right now',
+        };
+    }
+    const result = await admitPublicTurn({ sessionId: session.id, publicEmbedId, message, ...(addressBucket ? { addressBucket } : {}) }, deps.admissionEnvelope ?? ADMISSION_DEFAULTS, {
+        counters: deps.admissionCounters,
+        embeds: deps.publicEmbeds,
+        resolveBudgetBounds: async () => session.modelSource !== 'noodle-managed'
+            ? undefined
+            : (await deps.managedModelResolver?.resolve({
+                tenant: session.tenant,
+                deploymentId: session.deploymentId,
+            }))?.publicAdmission,
+        consumeTurn: (id, limit) => deps.store.consumeTurn(id, limit),
+        now: () => deps.clock?.() ?? new Date(),
+    });
+    return result.ok
+        ? undefined
+        : { status: result.status, code: result.code, message: result.message };
+}
+/**
+ * The same gate in front of a WebMCP bridge tool call (ADR 0220). A browser agent can call governed
+ * tools without ever running a model turn, so the turn budget above would never refuse it.
+ */
+export async function refuseBridgeToolCall(deps, session) {
+    const publicEmbedId = session.publicEmbedId;
+    if (publicEmbedId === undefined)
+        return undefined;
+    if (!deps.publicEmbeds || !deps.admissionCounters) {
+        return {
+            status: 503,
+            code: 'admission_unavailable',
+            message: 'assistant is unavailable right now',
+        };
+    }
+    const result = await admitBridgeToolCall({ sessionId: session.id, publicEmbedId }, deps.admissionEnvelope ?? ADMISSION_DEFAULTS, {
+        counters: deps.admissionCounters,
+        embeds: deps.publicEmbeds,
+        // Resolved live rather than snapshotted, so removing a surface from a sponsored cohort lowers
+        // its envelope immediately instead of at the next mint.
+        resolveBudgetBounds: async () => session.modelSource !== 'noodle-managed'
+            ? undefined
+            : (await deps.managedModelResolver?.resolve({
+                tenant: session.tenant,
+                deploymentId: session.deploymentId,
+            }))?.publicAdmission,
+        now: () => deps.clock?.() ?? new Date(),
+    });
+    return result.ok
+        ? undefined
+        : { status: result.status, code: result.code, message: result.message };
+}
 export async function admitPublicTurn(request, defaults, ports) {
     // Cheapest first, so an oversized body costs neither a session slot nor surface budget. The public
     // bound is narrower than the shared request schema's, which stays as it is for authenticated callers.
@@ -64,6 +125,77 @@ export async function admitPublicTurn(request, defaults, ports) {
             message: 'assistant is unavailable right now',
         };
     }
+    // Platform spend last, when someone other than the customer is paying. Every counter here is
+    // all-or-nothing with no refund, so whichever runs first is charged for turns the ones after it
+    // refuse — and a session ending at its length limit is ordinary traffic, many times a day, while
+    // spend exhaustion is rare and for one day only. Charging the sponsor for every visitor's last
+    // turn is the worse of the two leaks, so this is the counter that goes last.
+    //
+    // It reports the surface's own exhaustion code on purpose: every published widget already treats
+    // `daily_turn_budget_exhausted` as final, and a new code would be read as retryable by all of them
+    // — precisely the load this ceiling exists to refuse. At the ladder's closing rung the surface
+    // ceiling is already zero, so that refusal arrives above; this is the backstop between rungs.
+    if (budgetBounds?.spend !== undefined) {
+        const { key, units, allowance } = budgetBounds.spend;
+        const spend = await ports.counters.consume({ key, limit: allowance, amount: units }, ports.now());
+        if (!spend.allowed) {
+            return {
+                ok: false,
+                status: 429,
+                code: 'daily_turn_budget_exhausted',
+                message: 'assistant is unavailable right now',
+            };
+        }
+    }
     return { ok: true, turnCount: session.turnCount };
 }
+export async function admitBridgeToolCall(request, defaults, ports) {
+    try {
+        const embed = await ports.embeds.lookup(request.publicEmbedId);
+        if (embed === undefined) {
+            return {
+                ok: false,
+                status: 403,
+                code: 'embed_not_found',
+                message: 'assistant is unavailable right now',
+            };
+        }
+        const budgetBounds = await ports.resolveBudgetBounds?.(embed);
+        const envelope = surfaceEnvelope(defaults, embed, budgetBounds);
+        // One kill switch, not two. An operator who zeroes a surface's day means all of it, including the
+        // tools a page agent can reach without ever running a turn.
+        if (isDisabled(envelope))
+            return bridgeBudgetExhausted('daily');
+        // The session's own allowance first, so a session with nothing left cannot spend the customer's
+        // day on a call that is refused a moment later. Mirrors the turn path's ordering.
+        const session = await ports.counters.consume({
+            key: `bridge:ses:${request.sessionId}`,
+            limit: envelope.bridgeToolCallsPerSession,
+        }, ports.now());
+        if (!session.allowed)
+            return bridgeBudgetExhausted('session');
+        const surface = await ports.counters.consume({ key: `bridge:${request.publicEmbedId}`, limit: envelope.bridgeToolCallsPerDay }, ports.now());
+        if (!surface.allowed)
+            return bridgeBudgetExhausted('daily');
+        return { ok: true };
+    }
+    catch {
+        // Fail closed. A counter store we cannot reach is a budget we cannot enforce, and an unbounded
+        // agent loop against a customer's backend is the exact outcome these caps exist to prevent.
+        return {
+            ok: false,
+            status: 503,
+            code: 'bridge_admission_unavailable',
+            message: 'assistant is unavailable right now',
+        };
+    }
+}
+function bridgeBudgetExhausted(scope) {
+    return {
+        ok: false,
+        status: 429,
+        code: `${scope}_bridge_budget_exhausted`,
+        message: 'assistant is unavailable right now',
+    };
+}
 //# sourceMappingURL=public-turn.js.map

package/node_modules/@noodle-borg/assistant-gateway/dist/session-target.d.ts

@@ -0,0 +1,27 @@
+import type { RuntimeArtifact } from '@noodle-borg/compiler';
+import type { AssistantSessionRecord } from './assistant-store.js';
+/**
+ * The deployment a session may act on, already narrowed to the surface that admitted it.
+ *
+ * This is the seam ADR 0201's projection rests on. Every session-authenticated route resolves its target
+ * through here instead of calling `registry.get` directly, so the dozen `artifact.tools.find(...)` sites
+ * downstream get a projected artifact without knowing projection exists. Delete the projection call
+ * below and the projection tests fail — one deletion, not a dozen.
+ *
+ * The surface is read from the session's pinned deployment, never from whatever is active now: projecting
+ * artifact N by a surface read from artifact N+1 is a skew bug that would widen or narrow a live session
+ * on someone else's deploy. 5.1b's `assertDistinctSurfaces` guarantees at most one public-audience
+ * surface and at most one authenticated surface per artifact, so a binding never needs disambiguation.
+ *
+ * Sessions carry their binding explicitly (`boundSurface`, written at mint). A record from before the
+ * binding existed derives it here from the pinned deployment and the session's own origin, so in-flight
+ * sessions stay correct across the deploy that introduced binding; only a pre-surfaces artifact still
+ * reaches the whole server, because the deployment-wide union is that released shape's entire contract.
+ */
+export interface AssistantSessionTarget {
+    readonly served: {
+        readonly artifact: RuntimeArtifact;
+    };
+}
+export declare function resolveAssistantSessionTarget<Target extends AssistantSessionTarget>(load: (deploymentId: string) => Promise<Target | undefined>, session: AssistantSessionRecord): Promise<Target | undefined>;
+//# sourceMappingURL=session-target.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/session-target.js

@@ -0,0 +1,50 @@
+import { projectArtifactForSurface } from './artifact-projection.js';
+import { authenticatedSurfaceOf, publicSurfaceOf, surfaceBindingForOrigin, } from './public-surface.js';
+export async function resolveAssistantSessionTarget(load, session) {
+    const target = await load(session.deploymentId);
+    if (!target)
+        return undefined;
+    const assistant = target.served.artifact.server.assistant;
+    const bound = session.boundSurface ?? deriveLegacyBinding(assistant, session);
+    if (bound === 'pre-surfaces')
+        return target;
+    // Fail closed: an origin no surface owns must never widen to the whole server.
+    if (bound === 'unowned')
+        return undefined;
+    // Fail closed on a vanished surface. A rollback to an artifact without the bound surface must end the
+    // session's reach, never hand it the unprojected server.
+    if (bound === 'authenticated') {
+        const surface = authenticatedSurfaceOf(assistant);
+        if (surface === undefined)
+            return undefined;
+        // An omitted allowlist on an authenticated surface is the authored whole-server intent, so the
+        // exact binding still holds (instructions, budgets, attribution) without narrowing capabilities.
+        if (surface.capabilities === undefined)
+            return target;
+        return projected(target, surface.capabilities);
+    }
+    const surface = publicSurfaceOf(assistant);
+    if (surface === undefined)
+        return undefined;
+    return projected(target, surface.capabilities);
+}
+function projected(target, capabilities) {
+    return {
+        ...target,
+        served: {
+            ...target.served,
+            artifact: projectArtifactForSurface(target.served.artifact, capabilities),
+        },
+    };
+}
+/**
+ * A record minted before `boundSurface` existed: the embed id marks the public surface; otherwise the
+ * session's origin selects the owning surface on the pinned deployment. `pre-surfaces` means the whole
+ * server on that released artifact shape; `unowned` fails closed above.
+ */
+function deriveLegacyBinding(assistant, session) {
+    if (session.publicEmbedId !== undefined)
+        return 'public';
+    return surfaceBindingForOrigin(assistant, session.origin).kind;
+}
+//# sourceMappingURL=session-target.js.map

package/node_modules/@noodle-borg/assistant-gateway/dist/surface-budget.d.ts

@@ -4,6 +4,20 @@ import type { PublicEmbedRecord } from './embed-store.js';
 export interface SurfaceBudgetBounds {
     readonly defaults: Pick<AdmissionEnvelope, 'turnsPerSession' | 'turnsPerDay' | 'mintsPerDay'>;
     readonly ceiling: Pick<AdmissionEnvelope, 'turnsPerDay' | 'mintsPerDay'>;
+    /**
+     * Platform spend accounting for this turn, present only when someone other than the customer is
+     * paying. Absent means customer-funded, and nothing is charged.
+     *
+     * `units` is what this turn costs at the tenant's current rung and `allowance` is its ceiling for
+     * the day; the ladder that produces both lives in `managed-spend.ts`. The ceilings above remain the
+     * primary mechanism — this counter is the exact backstop for the window in which a cached rung
+     * read still says "plenty left".
+     */
+    readonly spend?: {
+        readonly key: string;
+        readonly units: number;
+        readonly allowance: number;
+    };
 }
 /**
  * One surface's daily budget, resolved from the operator's override and the deployment's defaults.
@@ -17,5 +31,5 @@ export interface SurfaceBudgetBounds {
  * operator any more than by app code, so an over-eager `--turns-per-day 999999999` degrades to the
  * ceiling instead of becoming the ceiling. Zero survives clamping and is the kill switch.
  */
-export declare function surfaceEnvelope(base: AdmissionEnvelope, embed: Pick<PublicEmbedRecord, 'turnsPerDay' | 'mintsPerDay'>, bounds?: SurfaceBudgetBounds): AdmissionEnvelope;
+export declare function surfaceEnvelope(base: AdmissionEnvelope, embed: Pick<PublicEmbedRecord, 'turnsPerDay' | 'mintsPerDay' | 'mintsPerAddressHour' | 'turnsPerAddressHour'>, bounds?: SurfaceBudgetBounds): AdmissionEnvelope;
 //# sourceMappingURL=surface-budget.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/surface-budget.js

@@ -17,6 +17,20 @@ export function surfaceEnvelope(base, embed, bounds) {
         ...effectiveBase,
         ...(embed.turnsPerDay !== undefined ? { turnsPerDay: embed.turnsPerDay } : {}),
         ...(embed.mintsPerDay !== undefined ? { mintsPerDay: embed.mintsPerDay } : {}),
+        // The per-address bounds carry no hosted ceiling, because they govern abuse rather than spend —
+        // so the deployed default is what caps them, and an operator may only lower it. A surface that
+        // could raise its own abuse bound toward the structural maximum would be turning the bound off
+        // for everyone behind one address, which is not a budget an operator gets to spend.
+        ...(embed.mintsPerAddressHour !== undefined
+            ? {
+                mintsPerAddressHour: Math.min(embed.mintsPerAddressHour, effectiveBase.mintsPerAddressHour),
+            }
+            : {}),
+        ...(embed.turnsPerAddressHour !== undefined
+            ? {
+                turnsPerAddressHour: Math.min(embed.turnsPerAddressHour, effectiveBase.turnsPerAddressHour),
+            }
+            : {}),
     });
     if (bounds === undefined)
         return requested;

package/node_modules/@noodle-borg/assistant-gateway/package.json

@@ -41,7 +41,7 @@
     "@noodle-borg/module": "0.0.0",
     "@noodle-borg/protocol": "0.0.0",
     "@noodle-borg/runtime": "0.0.0",
-    "@noodleseed/assistant": "1.28.0",
+    "@noodleseed/assistant": "1.29.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/node_modules/@noodle-borg/authoring/dist/assistant.d.ts

@@ -102,6 +102,7 @@ export interface AssistantUiOptions {
     };
     readonly labels?: AssistantLabels;
     readonly presentation?: AssistantPresentationOptions;
+    /** Exact initial prompts only; omit to generate context-aware initial prompts, or pass [] for none. */
     readonly suggestedPrompts?: readonly string[];
     readonly privacyUrl?: string;
     readonly termsUrl?: string;
@@ -207,6 +208,17 @@ export interface EmbeddedAssistantOptions extends AssistantUiOptions {
     readonly model: AssistantModel;
     /** One surface, or every front door this assistant serves. */
     readonly access: AssistantAccess | readonly AssistantAccess[];
+    /**
+     * Let a browser agent (Gemini-in-Chrome, Claude-in-Chrome) call this assistant's tools through the
+     * page's WebMCP API. Off unless set. Calls carry exactly the embed session's authority and take the
+     * same authorization, limits, confirmation, and audit path as the assistant's own — see ADR 0220.
+     *
+     * Deployment-wide on purpose: it decides which callers may reach the server's tools, which is
+     * surface authority rather than presentation, so it is not refinable per surface.
+     */
+    readonly webmcp?: {
+        readonly enabled?: boolean;
+    };
 }
 /** One projected surface as it appears in compiled data. */
 export interface AssistantSurfaceConfig {
@@ -226,6 +238,10 @@ export interface EmbeddedAssistantConfig extends AssistantUiOptions {
     readonly allowedOrigins: readonly string[];
     /** Mirrored from the authenticated surface, for the same reason. */
     readonly sessionClaims?: Readonly<Record<string, SessionClaimDeclaration>>;
+    /** @see EmbeddedAssistantOptions.webmcp — deployment-wide, never per surface. */
+    readonly webmcp?: {
+        readonly enabled?: boolean;
+    };
 }
 export declare function openAICompatible(input: OpenAICompatibleModelInput): OpenAICompatibleModel;
 /** Use Noodle Seed Cloud's operator-selected model. Provider details never enter authored source. */

package/node_modules/@noodle-borg/cli-catalog/dist/catalog-data-assistant.js

@@ -96,7 +96,7 @@ const EMBEDS_SUBCOMMAND = subcommand({
 const BUDGET_SUBCOMMAND = subcommand({
     ...SUBCOMMAND_FIELDS,
     name: 'budget',
-    summary: 'Set what a public website surface may spend per day. Zero is the kill switch.',
+    summary: 'Set what a public website surface may spend, per day and per source address.',
     subcommands: [
         clientLeaf('set', 'Raise, lower, or switch off a public surface’s daily caps.', {
             ...LEAF_FIELDS,
@@ -115,6 +115,20 @@ const BUDGET_SUBCOMMAND = subcommand({
                     value: '<count>',
                     summary: 'Sessions this surface may open per UTC day. 0 stops it serving anyone.',
                 }),
+                flag({
+                    ...FLAG_FIELDS,
+                    name: 'mints-per-address-hour',
+                    type: 'string',
+                    value: '<count>',
+                    summary: 'Sessions one source address may open per hour. The abuse bound, not fairness.',
+                }),
+                flag({
+                    ...FLAG_FIELDS,
+                    name: 'turns-per-address-hour',
+                    type: 'string',
+                    value: '<count>',
+                    summary: 'Model turns one source address may run per hour. The abuse bound, not fairness.',
+                }),
                 flag({
                     ...FLAG_FIELDS,
                     name: 'surface',

package/node_modules/@noodle-borg/compiler/dist/manifest/schema.d.ts

@@ -381,6 +381,9 @@ export declare const manifestV1Schema: z.ZodObject<{
             sessionClaims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                 exposeToModel: z.ZodOptional<z.ZodBoolean>;
             }, z.core.$strict>>>;
+            webmcp: z.ZodOptional<z.ZodObject<{
+                enabled: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>>;
         }, z.core.$strict>>;
         branding: z.ZodOptional<z.ZodObject<{
             name: z.ZodOptional<z.ZodString>;
@@ -857,6 +860,9 @@ export declare const manifestV2Schema: z.ZodObject<{
             sessionClaims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                 exposeToModel: z.ZodOptional<z.ZodBoolean>;
             }, z.core.$strict>>>;
+            webmcp: z.ZodOptional<z.ZodObject<{
+                enabled: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>>;
         }, z.core.$strict>>;
         branding: z.ZodOptional<z.ZodObject<{
             name: z.ZodOptional<z.ZodString>;
@@ -1543,6 +1549,9 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             sessionClaims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                 exposeToModel: z.ZodOptional<z.ZodBoolean>;
             }, z.core.$strict>>>;
+            webmcp: z.ZodOptional<z.ZodObject<{
+                enabled: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>>;
         }, z.core.$strict>>;
         branding: z.ZodOptional<z.ZodObject<{
             name: z.ZodOptional<z.ZodString>;
@@ -2018,6 +2027,9 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             sessionClaims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                 exposeToModel: z.ZodOptional<z.ZodBoolean>;
             }, z.core.$strict>>>;
+            webmcp: z.ZodOptional<z.ZodObject<{
+                enabled: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>>;
         }, z.core.$strict>>;
         branding: z.ZodOptional<z.ZodObject<{
             name: z.ZodOptional<z.ZodString>;

package/node_modules/@noodle-borg/compiler/dist/manifest/schema.js

@@ -359,6 +359,11 @@ const embeddedAssistantSchema = z
     // Mirrored from the authenticated surface; the session exchange reads it here (ADR 0141,
     // 2026-07-14). Keys become `${user.claims.<key>}`; `exposeToModel` adds it to the identity line.
     sessionClaims: sessionClaimsSchema.optional(),
+    // Additive optional field: a v1.x minor under ADR 0150, so no existing manifest can observe it.
+    // Declared here rather than in `assistantUiSchema` deliberately — that shape is also spread into
+    // every surface, and which callers may reach the server's tools is surface authority, not
+    // renderer-owned presentation a surface may refine.
+    webmcp: optionalStrictObject({ enabled: z.boolean().optional() }),
     ...assistantUiSchema.shape,
 })
     .strict()