@noodleseed/one 0.148.0 → 0.149.0

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-guide.js

@@ -31,6 +31,21 @@ export function selectAssistantModelTools(artifact, caller, options = {}) {
         hasValidSessionVisibility(tool, options.usedToolNames) &&
         matchesLatestMessageConstraint(tool, options.latestMessage));
 }
+/**
+ * What to tell a model that called a tool this turn does not offer.
+ *
+ * The alternative — ending the turn on `invalid_model_tool_call` — is a security-correct rejection
+ * with a dishonest failure mode: the widget renders it as "temporarily unavailable" beside a
+ * Reconnect button that mints a whole new session, so a visitor who asked for something reasonable
+ * gets silence and the surface pays a session for it. A `role:'tool'` result costs one model step
+ * and gets the visitor a real answer instead. It names the tool because the model supplied that
+ * name in the first place, and says nothing about why the tool is absent, which is the part a
+ * visitor is not entitled to.
+ */
+export function assistantOmittedToolResult(name) {
+    return (`The tool "${name}" is not available in this conversation. Do not call it again. ` +
+        'Answer the person directly in your own words, and say plainly if you cannot help with this.');
+}
 /** Whether an already-selected tool requires the first model step to call it. */
 export function assistantModelToolRequiredWhenVisible(tool) {
     return tool.annotations?.[REQUIRED_WHEN_VISIBLE] === true;

package/node_modules/@noodle-borg/assistant-gateway/dist/embed-operator-view.d.ts

@@ -0,0 +1,71 @@
+import type { AdmissionEnvelope } from '@noodle-borg/admission-limits/portable';
+import type { PublicEmbedRecord } from './embed-store.js';
+import type { PublicSurface } from './public-surface.js';
+/**
+ * The operator's view of one public surface: what it is, and what it may spend.
+ *
+ * Origins, capabilities, and surfaceMode come from the *active* deployment rather than the embed
+ * row, so what an operator reads here is what a browser will actually be held to at mint time. The
+ * row keeps its provisioning-time mode by design — `ensure` never overwrites a live row.
+ */
+export interface AssistantEmbedOperatorView {
+    readonly embedId: string;
+    readonly surfaceMode: string;
+    readonly origins: readonly string[];
+    readonly capabilities: readonly string[];
+    readonly turnsPerDay: number;
+    readonly mintsPerDay: number;
+    /** True when the caps are the deployment defaults rather than something an operator chose. */
+    readonly budgetIsDefault: boolean;
+    readonly turnsToday: number;
+    readonly mintsToday: number;
+    readonly createdAt: string;
+    /**
+     * Present only when Noodle is funding this surface's model. It exists so an operator can tell
+     * platform-imposed degradation from a bug in their own app, which is the one thing they cannot
+     * work out from the caps above — those look normal right up to the moment the ladder closes them.
+     */
+    readonly managedSpend?: AssistantManagedSpendView;
+}
+export interface AssistantManagedSpendView {
+    /** `normal`, `approaching`, `near`, `limited`, or `closed`. */
+    readonly state: string;
+    /**
+     * Turns left today at the current rung, not a percentage. The spend consume is all-or-nothing, so
+     * a costly turn is refused while a cheap one still passes at the tail of the day — a percentage
+     * would look like it stopped early.
+     */
+    readonly turnsRemaining: number;
+    /** One plain sentence about what a visitor experiences right now. */
+    readonly visitors: string;
+}
+/**
+ * Project a tenant's spend into what an operator needs to read.
+ *
+ * Takes the raw peek rather than a rung so the caller owns only the read: which rung that is, and
+ * what a turn costs there, are the ladder's business and stay in one place.
+ */
+export declare function assistantManagedSpendView(input: {
+    readonly spend: {
+        readonly allowance: number;
+    };
+    readonly unitsUsed: number;
+}): AssistantManagedSpendView;
+/**
+ * Project one embed row into that view. Pure on purpose: the caller owns the reads (active
+ * deployment, counter peeks) and this owns the shape, so the projection stays testable without a
+ * registry or a counter store.
+ */
+export declare function assistantEmbedOperatorView(input: {
+    readonly record: PublicEmbedRecord;
+    readonly surface: PublicSurface | undefined;
+    readonly envelope: AdmissionEnvelope;
+    /** Usage without consuming. The keys are this package's own convention, so it forms them here. */
+    readonly peek: (key: string) => Promise<number>;
+    /** Present only when Noodle funds this surface's model. */
+    readonly spend?: {
+        readonly key: string;
+        readonly allowance: number;
+    };
+}): Promise<AssistantEmbedOperatorView>;
+//# sourceMappingURL=embed-operator-view.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/embed-operator-view.js

@@ -0,0 +1,59 @@
+import { managedSpendRung, managedSpendUnitWeight } from './managed-spend.js';
+const SPEND_STATES = [
+    { state: 'normal', visitors: 'Full answers, full tools.' },
+    { state: 'approaching', visitors: 'Shorter answers. Nothing else changes.' },
+    {
+        state: 'near',
+        visitors: 'Shorter answers, and conversations restart after 8 turns.',
+    },
+    { state: 'limited', visitors: 'Short answers from knowledge only; tools are paused.' },
+    {
+        state: 'closed',
+        visitors: 'Paused until 00:00 UTC. Connect your own model key to keep serving.',
+    },
+];
+/**
+ * Project a tenant's spend into what an operator needs to read.
+ *
+ * Takes the raw peek rather than a rung so the caller owns only the read: which rung that is, and
+ * what a turn costs there, are the ladder's business and stay in one place.
+ */
+export function assistantManagedSpendView(input) {
+    const rungAt = managedSpendRung(input.unitsUsed, input.spend.allowance);
+    const perTurn = managedSpendUnitWeight(rungAt);
+    const remaining = Math.max(0, input.spend.allowance - input.unitsUsed);
+    const rung = Math.min(rungAt, SPEND_STATES.length - 1);
+    return {
+        ...SPEND_STATES[rung],
+        turnsRemaining: perTurn > 0 ? Math.floor(remaining / perTurn) : 0,
+    };
+}
+/**
+ * Project one embed row into that view. Pure on purpose: the caller owns the reads (active
+ * deployment, counter peeks) and this owns the shape, so the projection stays testable without a
+ * registry or a counter store.
+ */
+export async function assistantEmbedOperatorView(input) {
+    const { record, surface, envelope, spend } = input;
+    return {
+        embedId: record.embedId,
+        surfaceMode: surface?.mode ?? record.surfaceMode,
+        origins: surface?.origins ?? [],
+        capabilities: surface?.capabilities.map((entry) => entry.name) ?? [],
+        turnsPerDay: envelope.turnsPerDay,
+        mintsPerDay: envelope.mintsPerDay,
+        budgetIsDefault: record.turnsPerDay === undefined && record.mintsPerDay === undefined,
+        turnsToday: await input.peek(`turns:${record.embedId}`),
+        mintsToday: await input.peek(`mints:${record.embedId}`),
+        createdAt: record.createdAt.toISOString(),
+        ...(spend === undefined
+            ? {}
+            : {
+                managedSpend: assistantManagedSpendView({
+                    spend,
+                    unitsUsed: await input.peek(spend.key),
+                }),
+            }),
+    };
+}
+//# sourceMappingURL=embed-operator-view.js.map

package/node_modules/@noodle-borg/assistant-gateway/dist/embed-store.d.ts

@@ -31,6 +31,13 @@ export interface PublicEmbedRecord {
      */
     readonly turnsPerDay?: number;
     readonly mintsPerDay?: number;
+    /**
+     * Operator overrides for the per-address abuse bounds. Rarely needed — tier 4 handles fairness and
+     * these only have to stop a single machine — but an operator who knows their own traffic shape
+     * (an internal tool behind one proxy, say) can lower them, and lowering is all anyone may do.
+     */
+    readonly mintsPerAddressHour?: number;
+    readonly turnsPerAddressHour?: number;
 }
 /** Project the non-secret embed coordinate onto the shared assistant tenant shape. */
 export declare function publicEmbedTenant(embed: PublicEmbedRecord): TenantRef;
@@ -38,6 +45,8 @@ export declare function publicEmbedTenant(embed: PublicEmbedRecord): TenantRef;
 export interface PublicEmbedBudget {
     readonly turnsPerDay?: number;
     readonly mintsPerDay?: number;
+    readonly mintsPerAddressHour?: number;
+    readonly turnsPerAddressHour?: number;
 }
 export interface PublicEmbedStore {
     /**
@@ -73,4 +82,22 @@ export interface PublicEmbedStore {
 export declare const PUBLIC_EMBED_ID_PREFIX = "pub_";
 export declare function isPublicEmbedId(value: string): boolean;
 import type { TenantRef } from './tenant-ref.js';
+/**
+ * Validate an operator's requested caps.
+ *
+ * Lives with the budget type rather than with the route that receives it: the rules are about what a
+ * cap may be, not about HTTP, and a second caller must not be able to reach the store with a shape
+ * this would have rejected.
+ */
+export type BudgetField = 'turnsPerDay' | 'mintsPerDay' | 'mintsPerAddressHour' | 'turnsPerAddressHour';
+type BudgetValue = Partial<Record<BudgetField, number>>;
+type ParsedBudget = {
+    readonly ok: true;
+    readonly value: BudgetValue;
+} | {
+    readonly ok: false;
+    readonly error: string;
+};
+export declare function parsePublicEmbedBudget(body: unknown): ParsedBudget;
+export {};
 //# sourceMappingURL=embed-store.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/embed-store.js

@@ -23,4 +23,39 @@ export const PUBLIC_EMBED_ID_PREFIX = 'pub_';
 export function isPublicEmbedId(value) {
     return new RegExp(`^${PUBLIC_EMBED_ID_PREFIX}[0-9a-z]{20,32}$`).test(value);
 }
+const BUDGET_FIELDS = [
+    'turnsPerDay',
+    'mintsPerDay',
+    'mintsPerAddressHour',
+    'turnsPerAddressHour',
+];
+export function parsePublicEmbedBudget(body) {
+    // A JSON body of `null` is an object to `typeof` and reads as a crash to a property access, so it
+    // is checked by name: an operator sending nonsense deserves the 400 this returns, not the 500 an
+    // uncaught `TypeError` would become.
+    if (typeof body !== 'object' || body === null || Array.isArray(body)) {
+        return { ok: false, error: 'body must be a JSON object' };
+    }
+    const supplied = body;
+    const value = {};
+    for (const [name, raw] of BUDGET_FIELDS.map((field) => [field, supplied[field]])) {
+        if (raw === undefined)
+            continue;
+        // Zero is valid and is the point; anything negative or fractional is a mistake worth saying out
+        // loud rather than silently flooring, because an operator setting a cap is being deliberate.
+        // `isSafeInteger` rather than `isInteger`: past 2^53 a JSON number has already lost the value
+        // the operator typed, and it reaches a `::bigint` column that would store the rounded one.
+        if (typeof raw !== 'number' || !Number.isSafeInteger(raw) || raw < 0) {
+            return { ok: false, error: `"${name}" must be a non-negative integer` };
+        }
+        value[name] = raw;
+    }
+    if (Object.keys(value).length === 0) {
+        return {
+            ok: false,
+            error: `set at least one of ${BUDGET_FIELDS.map((f) => `"${f}"`).join(', ')}`,
+        };
+    }
+    return { ok: true, value };
+}
 //# sourceMappingURL=embed-store.js.map

package/node_modules/@noodle-borg/assistant-gateway/dist/in-memory-embed-store.js

@@ -39,6 +39,12 @@ export class InMemoryPublicEmbedStore {
             ...record,
             ...(budget.turnsPerDay !== undefined ? { turnsPerDay: budget.turnsPerDay } : {}),
             ...(budget.mintsPerDay !== undefined ? { mintsPerDay: budget.mintsPerDay } : {}),
+            ...(budget.mintsPerAddressHour !== undefined
+                ? { mintsPerAddressHour: budget.mintsPerAddressHour }
+                : {}),
+            ...(budget.turnsPerAddressHour !== undefined
+                ? { turnsPerAddressHour: budget.turnsPerAddressHour }
+                : {}),
         };
         this.#byId.set(embedId, updated);
         return updated;

package/node_modules/@noodle-borg/assistant-gateway/dist/managed-spend.d.ts

@@ -0,0 +1,80 @@
+import type { AdmissionEnvelope } from '@noodle-borg/admission-limits/portable';
+import type { AssistantModelRequestPolicy } from './model-request.js';
+import type { SurfaceBudgetBounds } from './surface-budget.js';
+/**
+ * Cost breakers for the sponsored managed-assistant beta (ADR 0213 amendment §3).
+ *
+ * Noodle pays for `noodle-managed` inference and charges nothing for it, so aggregate spend is a
+ * platform expense with no customer-side limit standing behind it. Per-surface daily caps bound one
+ * surface; they do not bound how many surfaces enrol. This is the missing ceiling, expressed as a
+ * ladder rather than a switch: a tenant approaching its allowance gets shorter answers before it gets
+ * a closed door, and the door itself is the kill switch that already exists.
+ *
+ * Two things make it small. Every rung is expressed through `SurfaceBudgetBounds` and
+ * `AssistantModelRequestPolicy`, which the resolver already returns and admission already reads live
+ * per turn — so degradation applies immediately and reverses on its own when the UTC day rolls, with
+ * no unwind path to write. And the unit is one delivered bounded turn, which is the billable unit ADR
+ * 0213 §12 already defines.
+ */
+/**
+ * Billable tokens per charged unit. Prompt and completion are counted together and completion is
+ * weighted, because output costs several times input on every provider we have measured.
+ */
+export declare const MANAGED_SPEND_UNIT_TOKENS = 4000;
+export interface ManagedSpendPolicy {
+    readonly requestPolicy: AssistantModelRequestPolicy;
+    readonly admission: SurfaceBudgetBounds;
+}
+/**
+ * Which rung a tenant is on.
+ *
+ * An absent or nonsensical allowance means "unbudgeted", never "exhausted". Failing closed on a typo
+ * would take a customer's surface dark for a configuration mistake, and the per-surface daily cap
+ * still bounds what that costs.
+ */
+export declare function managedSpendRung(unitsUsed: number, allowance: number): number;
+export declare function managedSpendPolicy(rung: number): ManagedSpendPolicy;
+/**
+ * Units one turn costs at this rung: its worst case under the rung's own policy, in whole units.
+ *
+ * Prompt-inclusive on purpose. `maxCompletionTokens` says nothing about how large a prompt the agent
+ * loop may resend on each step, and the prompt is where an unbounded turn actually spends.
+ */
+export declare function managedSpendUnitWeight(rung: number): number;
+/**
+ * The unit ledger for a day's worth of ordinary turns.
+ *
+ * Units are worst-case, so a turn is charged what its rung's policy *permits* rather than what it
+ * happened to use. That is deliberate — the alternative under-charges exactly the adversary the cap
+ * exists for — but it means the number is only meaningful denominated in turns. An allowance is
+ * therefore configured as "this many sponsored turns a day" and converted here, which is also the
+ * form the operator surface reports.
+ *
+ * The conservatism is uniform within a rung, so it does not distort when the ladder trips; across
+ * rungs it is the intended effect, since a degraded turn genuinely costs less and the same allowance
+ * stretches further.
+ */
+export declare function managedSpendAllowanceForTurns(turnsPerDay: number): number;
+/**
+ * Is the ledger telling the truth?
+ *
+ * A unit weight is a claim about what a turn's own rung permits. If the rung's `requestPolicy` does
+ * not actually bound what it says, the claim is fiction and the whole cap is decorative — and the
+ * failure is silent, because a cheap-looking ledger is exactly what an unbounded turn produces.
+ *
+ * So telemetry checks the counter rather than replacing it. Observed billable tokens per delivered
+ * turn must stay under what rung 0 permits, since rung 0 is the most permissive rung any turn could
+ * have run at. Exceeding it is not a budgeting question; it means an enforcer is not enforcing.
+ */
+export declare function managedSpendDrift(observed: {
+    readonly deliveredTurns: number;
+    readonly promptTokens: number;
+    readonly completionTokens: number;
+}): {
+    readonly observedPerTurn: number;
+    readonly permittedPerTurn: number;
+    readonly exceeded: boolean;
+};
+/** Convenience for readers that only care whether a tenant is being held back at all. */
+export declare function isManagedSpendDegraded(envelope: Pick<AdmissionEnvelope, 'turnsPerDay'>): boolean;
+//# sourceMappingURL=managed-spend.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/managed-spend.js

@@ -0,0 +1,186 @@
+/**
+ * Cost breakers for the sponsored managed-assistant beta (ADR 0213 amendment §3).
+ *
+ * Noodle pays for `noodle-managed` inference and charges nothing for it, so aggregate spend is a
+ * platform expense with no customer-side limit standing behind it. Per-surface daily caps bound one
+ * surface; they do not bound how many surfaces enrol. This is the missing ceiling, expressed as a
+ * ladder rather than a switch: a tenant approaching its allowance gets shorter answers before it gets
+ * a closed door, and the door itself is the kill switch that already exists.
+ *
+ * Two things make it small. Every rung is expressed through `SurfaceBudgetBounds` and
+ * `AssistantModelRequestPolicy`, which the resolver already returns and admission already reads live
+ * per turn — so degradation applies immediately and reverses on its own when the UTC day rolls, with
+ * no unwind path to write. And the unit is one delivered bounded turn, which is the billable unit ADR
+ * 0213 §12 already defines.
+ */
+/**
+ * Billable tokens per charged unit. Prompt and completion are counted together and completion is
+ * weighted, because output costs several times input on every provider we have measured.
+ */
+export const MANAGED_SPEND_UNIT_TOKENS = 4_000;
+const OUTPUT_WEIGHT = 8;
+const BYTES_PER_TOKEN = 4;
+/**
+ * The rungs, tightest-claim-first.
+ *
+ * Rung 0 is not "today's policy": a weight is only honest if the rung's own policy enforces it, and
+ * an unbounded prompt makes the worst case forty times the typical turn. Bounding the request keeps
+ * the ledger true. These numbers are the starting point and are expected to move once measured P99
+ * prompt sizes are read off the live surface — that measurement is a gate on raising the ceilings,
+ * not on shipping the breaker.
+ */
+const RUNGS = [
+    {
+        requestPolicy: {
+            maxRequestBytes: 32 * 1_024,
+            maxCompletionTokens: 1_500,
+            maxTokensPerTurn: 3_000,
+            maxModelStepsPerTurn: 6,
+            maxToolCallsPerTurn: 8,
+        },
+        admission: {
+            defaults: { turnsPerSession: 40, turnsPerDay: 20_000, mintsPerDay: 5_000 },
+            ceiling: { turnsPerDay: 20_000, mintsPerDay: 5_000 },
+        },
+    },
+    {
+        // Shorter answers. Nothing is announced: telling a stranger on a customer's marketing site that
+        // it is on a reduced tier harms the customer and helps no one, and a shorter answer explains
+        // itself.
+        requestPolicy: {
+            maxRequestBytes: 24 * 1_024,
+            maxCompletionTokens: 900,
+            maxTokensPerTurn: 1_800,
+            maxModelStepsPerTurn: 4,
+            maxToolCallsPerTurn: 6,
+        },
+        admission: {
+            defaults: { turnsPerSession: 40, turnsPerDay: 20_000, mintsPerDay: 5_000 },
+            ceiling: { turnsPerDay: 20_000, mintsPerDay: 5_000 },
+        },
+    },
+    {
+        // Shorter conversations. This does not lower a turn's worst case — `maxRequestBytes` already caps
+        // that — it lowers the typical prompt by cutting history growth, which stretches the remaining
+        // allowance without shortening any individual answer. The visitor meets
+        // `session_turn_budget_exhausted`, which the widget already renders as its existing "new
+        // conversation" affordance.
+        requestPolicy: {
+            maxRequestBytes: 16 * 1_024,
+            maxCompletionTokens: 700,
+            maxTokensPerTurn: 1_400,
+            maxModelStepsPerTurn: 3,
+            maxToolCallsPerTurn: 4,
+        },
+        admission: {
+            defaults: { turnsPerSession: 8, turnsPerDay: 20_000, mintsPerDay: 5_000 },
+            ceiling: { turnsPerDay: 20_000, mintsPerDay: 5_000 },
+        },
+    },
+    {
+        // No tools. `projectAssistantGuide` projects the per-turn tool set, so the guide never promises a
+        // tool that is not offered; the assistant simply answers from knowledge and its own words.
+        requestPolicy: {
+            maxRequestBytes: 12 * 1_024,
+            maxCompletionTokens: 400,
+            maxTokensPerTurn: 800,
+            maxModelStepsPerTurn: 1,
+            maxToolCallsPerTurn: 0,
+        },
+        admission: {
+            defaults: { turnsPerSession: 8, turnsPerDay: 20_000, mintsPerDay: 5_000 },
+            ceiling: { turnsPerDay: 20_000, mintsPerDay: 5_000 },
+        },
+    },
+    {
+        // At cap. Deliberately the *existing* kill switch and not a new failure mode: zero ceilings refuse
+        // at admission with `daily_turn_budget_exhausted`, a code every published widget already treats as
+        // final. A new code would be read as retryable by every widget predating it, and they would hammer
+        // the endpoint this cap exists to protect.
+        requestPolicy: {
+            maxRequestBytes: 12 * 1_024,
+            maxCompletionTokens: 400,
+            maxTokensPerTurn: 800,
+            maxModelStepsPerTurn: 1,
+            maxToolCallsPerTurn: 0,
+        },
+        admission: {
+            defaults: { turnsPerSession: 8, turnsPerDay: 0, mintsPerDay: 0 },
+            ceiling: { turnsPerDay: 0, mintsPerDay: 0 },
+        },
+    },
+];
+/** Fractions of the allowance at which each rung begins. */
+const THRESHOLDS = [0.6, 0.8, 0.95, 1];
+/**
+ * Which rung a tenant is on.
+ *
+ * An absent or nonsensical allowance means "unbudgeted", never "exhausted". Failing closed on a typo
+ * would take a customer's surface dark for a configuration mistake, and the per-surface daily cap
+ * still bounds what that costs.
+ */
+export function managedSpendRung(unitsUsed, allowance) {
+    if (!Number.isFinite(allowance) || allowance <= 0)
+        return 0;
+    const share = Math.max(0, unitsUsed) / allowance;
+    return THRESHOLDS.filter((threshold) => share >= threshold).length;
+}
+export function managedSpendPolicy(rung) {
+    return RUNGS[Math.min(Math.max(Math.trunc(rung), 0), RUNGS.length - 1)];
+}
+/**
+ * Units one turn costs at this rung: its worst case under the rung's own policy, in whole units.
+ *
+ * Prompt-inclusive on purpose. `maxCompletionTokens` says nothing about how large a prompt the agent
+ * loop may resend on each step, and the prompt is where an unbounded turn actually spends.
+ */
+export function managedSpendUnitWeight(rung) {
+    const { requestPolicy } = managedSpendPolicy(rung);
+    const prompt = ((requestPolicy.maxModelStepsPerTurn ?? 1) * (requestPolicy.maxRequestBytes ?? 0)) /
+        BYTES_PER_TOKEN;
+    const output = OUTPUT_WEIGHT * (requestPolicy.maxTokensPerTurn ?? 0);
+    return Math.max(1, Math.ceil((prompt + output) / MANAGED_SPEND_UNIT_TOKENS));
+}
+/**
+ * The unit ledger for a day's worth of ordinary turns.
+ *
+ * Units are worst-case, so a turn is charged what its rung's policy *permits* rather than what it
+ * happened to use. That is deliberate — the alternative under-charges exactly the adversary the cap
+ * exists for — but it means the number is only meaningful denominated in turns. An allowance is
+ * therefore configured as "this many sponsored turns a day" and converted here, which is also the
+ * form the operator surface reports.
+ *
+ * The conservatism is uniform within a rung, so it does not distort when the ladder trips; across
+ * rungs it is the intended effect, since a degraded turn genuinely costs less and the same allowance
+ * stretches further.
+ */
+export function managedSpendAllowanceForTurns(turnsPerDay) {
+    if (!Number.isFinite(turnsPerDay) || turnsPerDay <= 0)
+        return 0;
+    return Math.ceil(turnsPerDay) * managedSpendUnitWeight(0);
+}
+/**
+ * Is the ledger telling the truth?
+ *
+ * A unit weight is a claim about what a turn's own rung permits. If the rung's `requestPolicy` does
+ * not actually bound what it says, the claim is fiction and the whole cap is decorative — and the
+ * failure is silent, because a cheap-looking ledger is exactly what an unbounded turn produces.
+ *
+ * So telemetry checks the counter rather than replacing it. Observed billable tokens per delivered
+ * turn must stay under what rung 0 permits, since rung 0 is the most permissive rung any turn could
+ * have run at. Exceeding it is not a budgeting question; it means an enforcer is not enforcing.
+ */
+export function managedSpendDrift(observed) {
+    const permittedPerTurn = managedSpendUnitWeight(0) * MANAGED_SPEND_UNIT_TOKENS;
+    if (observed.deliveredTurns <= 0) {
+        return { observedPerTurn: 0, permittedPerTurn, exceeded: false };
+    }
+    const billable = observed.promptTokens + OUTPUT_WEIGHT * observed.completionTokens;
+    const observedPerTurn = Math.round(billable / observed.deliveredTurns);
+    return { observedPerTurn, permittedPerTurn, exceeded: observedPerTurn > permittedPerTurn };
+}
+/** Convenience for readers that only care whether a tenant is being held back at all. */
+export function isManagedSpendDegraded(envelope) {
+    return envelope.turnsPerDay === 0;
+}
+//# sourceMappingURL=managed-spend.js.map

package/node_modules/@noodle-borg/assistant-gateway/dist/model-request.d.ts

@@ -5,6 +5,12 @@ export interface AssistantModelRequestPolicy {
     readonly maxCompletionTokens?: number;
     readonly maxTokensPerTurn?: number;
     readonly maxRequestBytes?: number;
+    /**
+     * Per-tenant agent-loop bounds. The deployment-wide admission envelope still wins whenever it is
+     * lower — these narrow a turn for one tenant, they never widen it for anyone.
+     */
+    readonly maxModelStepsPerTurn?: number;
+    readonly maxToolCallsPerTurn?: number;
     readonly timeoutMs?: number;
     readonly maxTurnMs?: number;
     /** Trusted operator-selected OpenAI-compatible request extensions. */
@@ -26,6 +32,16 @@ interface ResolvedAssistantModelBase {
             readonly turnsPerDay: number;
             readonly mintsPerDay: number;
         };
+        /**
+         * Platform spend accounting, present only when someone other than the customer is paying. Passed
+         * through to `SurfaceBudgetBounds` unchanged, which is why the shape is declared identically
+         * here rather than imported — the two contracts stay independent by design.
+         */
+        readonly spend?: {
+            readonly key: string;
+            readonly units: number;
+            readonly allowance: number;
+        };
     };
 }
 export type ResolvedAssistantModel = ResolvedAssistantModelBase & ({

package/node_modules/@noodle-borg/assistant-gateway/dist/portable.d.ts

@@ -17,11 +17,13 @@ export * from './assistant-transcript.js';
 export * from './assistant-view-availability.js';
 export * from './elevation.js';
 export * from './elevation-store.js';
+export * from './embed-operator-view.js';
 export * from './embed-script.js';
 export * from './embed-store.js';
 export * from './in-memory-assistant-appearance-store.js';
 export * from './in-memory-elevation-store.js';
 export * from './in-memory-embed-store.js';
+export * from './managed-spend.js';
 export * from './public-configuration.js';
 export * from './public-session.js';
 export * from './public-surface.js';

package/node_modules/@noodle-borg/assistant-gateway/dist/portable.js

@@ -17,11 +17,13 @@ export * from './assistant-transcript.js';
 export * from './assistant-view-availability.js';
 export * from './elevation.js';
 export * from './elevation-store.js';
+export * from './embed-operator-view.js';
 export * from './embed-script.js';
 export * from './embed-store.js';
 export * from './in-memory-assistant-appearance-store.js';
 export * from './in-memory-elevation-store.js';
 export * from './in-memory-embed-store.js';
+export * from './managed-spend.js';
 export * from './public-configuration.js';
 export * from './public-session.js';
 export * from './public-surface.js';

package/node_modules/@noodle-borg/assistant-gateway/dist/public-session.d.ts

@@ -1,4 +1,4 @@
-import type { AdmissionEnvelope, DailyCounterStore } from '@noodle-borg/admission-limits/portable';
+import { type AdmissionEnvelope, type DailyCounterStore } from '@noodle-borg/admission-limits/portable';
 import { type PublicEmbedRecord, type PublicEmbedStore } from './embed-store.js';
 import type { PublicSurface } from './public-surface.js';
 import { type SurfaceBudgetBounds } from './surface-budget.js';
@@ -43,6 +43,13 @@ export interface PublicSessionRequest {
      * be parsed, in which case the surface tier alone applies: fairness degrades, solvency does not.
      */
     readonly addressBucket?: string | undefined;
+    /**
+     * The browser's own visitor identifier (admission tier 4), unvalidated exactly like `embedId`:
+     * it arrives from the request body, so the decision owns its parse rather than the transport.
+     * Client-supplied and therefore rotatable, so it bounds fairness and never abuse — the address
+     * tier underneath is the one that cannot be rotated.
+     */
+    readonly visitorId?: unknown;
 }
 export type PublicSessionResult = {
     readonly ok: true;
@@ -54,6 +61,12 @@ export type PublicSessionResult = {
     readonly status: number;
     readonly code: string;
     readonly message: string;
+    /**
+     * The surface this refusal belongs to, once it is known. Present for every refusal an operator
+     * needs to see — out of budget, address at its ceiling, origin off the live allowlist — and
+     * absent for the ones that cannot be attributed to a tenant at all, which are prober noise.
+     */
+    readonly embed?: PublicEmbedRecord;
 };
 export declare function mintPublicSession(request: PublicSessionRequest, envelope: AdmissionEnvelope, ports: PublicSessionPorts): Promise<PublicSessionResult>;
 //# sourceMappingURL=public-session.d.ts.map