@noodleseed/one 0.148.0 → 0.150.0

package/node_modules/@noodle-borg/admission-limits/dist/visitor-bucket.js

@@ -0,0 +1,30 @@
+import { createHash } from 'node:crypto';
+/** Longest identifier accepted. A stranger supplies this string; the hash input has to be bounded. */
+const MAX_VISITOR_ID_CHARS = 128;
+/**
+ * Turn a browser-supplied visitor identifier into a counter bucket.
+ *
+ * **This is a fairness key, never an abuse bound.** Anyone can clear their storage or forge a fresh
+ * value, so nothing may be authorized by it and no limit may depend on it holding still. The
+ * per-address tier stays underneath for exactly that reason. What it buys is the case the address
+ * tier gets wrong: a hundred people behind one corporate NAT or a mobile carrier's CGNAT share a
+ * single address, and without this they race each other for one visitor's allowance — the eleventh
+ * person sees "assistant is unavailable right now" and cannot tell it from a broken product.
+ *
+ * Hashed on the way out for the same reason an address is: the raw value is the browser's, and the
+ * package rule is that nothing a client supplies reaches a counter key, a log line, or an audit
+ * payload. Bucketing needs only "is this the same visitor as before", which a digest answers exactly
+ * as well.
+ *
+ * Returns `undefined` for anything it cannot treat as an identifier, so the caller falls back to
+ * address-only fairness rather than inventing a bucket that every unparseable request would share.
+ */
+export function visitorBucket(id) {
+    if (typeof id !== 'string')
+        return undefined;
+    const trimmed = id.trim();
+    if (trimmed.length === 0 || trimmed.length > MAX_VISITOR_ID_CHARS)
+        return undefined;
+    return `vis_${createHash('sha256').update(trimmed).digest('hex').slice(0, 32)}`;
+}
+//# sourceMappingURL=visitor-bucket.js.map

package/node_modules/@noodle-borg/agent-kit/dist/skill-embedded-assistant-ref.js

@@ -168,7 +168,7 @@ export function renderEmbeddedAssistantReference() {
         '',
         'Omitted UI fields retain the complete managed baseline: a bottom-center frosted prompt pill, 970px outer desktop shell with 20px side padding, 85vh/1025px height bounds, 24px panel with built-in `#F8F8F8` light and `#0C0A09` dark surfaces, bottom prompt chips and pill composer, plain assistant messages, 85%-wide user bubbles, Noodle Seed attribution, and mobile fullscreen. The pill morphs into an input before opening; `launcher.style: "bubble"` opens directly, while `panel.surface: "glass"` remains an explicit translucent alternative. `theme: "auto"` follows the host page and `"invert"` selects its opposite. `suggestedPrompts` is the exact initial set only: pass `[]` for no initial chips, or omit it so the active model generates context-aware initial prompts. After the first message, follow-up prompts are always regenerated from the complete authorized conversation context and are never copied into transcript history. The only attribution is the Noodle Seed row, removed by `behavior.showPoweredBy: false`; the baseline carries no third-party promotion. For exact application-owned color roles, pass the typed React `appearance={{ light: { panel: { surface, text, border }, composer: {...}, confirmation: {...}, primaryButton: {...} }, dark: {...} }}` prop or assign the same object to `element.appearance`. CSS custom properties inherit through the assistant host, so those values may reuse existing application tokens such as `surface: "var(--app-surface)"` without copying literals. The appearance surface covers canvas, panel, header, messages, composer, suggestions, confirmation, buttons, launcher, code, and the MCP App frame; the package README publishes the complete role-to-`--ns-assistant-*` map. Exact parseable literal colors are preserved and low contrast emits `assistant-appearance-warning`; contrast for unresolved CSS references remains host-owned. Precedence is host appearance object, host slots/public variables, saved environment operator override, deployed semantic presentation, then defaults. Prefer reusable `server.ts` defaults; use the Console Assistant tab or `noodle assistant appearance show|apply|reset` for environment-owned changes that should reach existing embeds without a redeploy.',
         '',
-        "Set `webmcp: { enabled: true }` on the assistant, not on an access surface, because it grants deployment-wide browser-agent access. Off unless set, and inert in browsers without `document.modelContext`. The embed registers exactly the tools this session already projects, narrowed to those that are both app-callable and model-visible, and executes each over the same apps-bridge path the assistant's own calls take — so a browser agent gets the session's authority and nothing more, and a `confirm: true` tool still stops for a human in the panel rather than being accepted on the agent's behalf. Bridge calls spend their own per-session and per-day budgets instead of model turns, and the surface's daily kill switch stops them too. Prefer this over hand-registering page-local tools that borrow the visitor's session: those carry no scoped authority, policy, or audit trail.",
+        "Set `webmcp: { enabled: true }` on the assistant to let a browser agent reach this session's tools through the page's WebMCP API, and set it on an individual access surface to override that default in either direction — a marketing surface can opt in while a signed-in one opts out, or the reverse. Off unless set, and inert in browsers without `document.modelContext`. It governs discovery: whether the embed registers the tools this session already projects, narrowed to those that are both app-callable and model-visible. Every call executes over the same apps-bridge path the assistant's own calls take, so a browser agent gets the session's authority and nothing more, and a `confirm: true` tool still stops for a human in the panel rather than being accepted on the agent's behalf. It is not a second authorization boundary — the session is the only one. Bridge calls spend their own per-session and per-day budgets instead of model turns, and the surface's daily kill switch stops them too. Prefer this over hand-registering page-local tools that borrow the visitor's session: those carry no scoped authority, policy, or audit trail.",
         '',
         'Give every business action a portable `tool(..., { title: "Complete task", description: "This will mark the task complete for everyone.", input: z.object({ task: z.string().meta({ title: "Task" }) }) })` title. The standard confirmation uses the tool title/description plus schema field `title`, `description`, and `format`; it shows Confirm and Don\'t proceed and keeps technical action details secondary. `behavior.showConfirmationDetails` defaults to `true`; set it to `false` to remove only the built-in card\'s Additional details disclosure and connector mechanics. The business review and decisions remain, `confirm: true` still suspends until acceptance, and headless/BYO `data-confirmation` stays unchanged. Do not put JSON or implementation names in business-facing copy.',
         '',

package/node_modules/@noodle-borg/agent-kit/dist/skill-tool-design-ref.js

@@ -93,6 +93,10 @@ export function renderToolDesignReference() {
         '',
         "`noodle check` warns above 20 model-visible tools. That is a documented heuristic, not a host limit: no host publishes a hard number, and the real threshold depends on how distinct your descriptions are. Collapse variants that differ only by a filter into one intent-shaped tool with a typed enum, and mark widget-only helpers `visibility: ['app']` so they stay callable from the app surface without entering the model's list.",
         '',
+        '**Two tools over one data source must differ by name, not only by description.** Repeated live testing has shown a model picking the broader-sounding neighbour for a question the narrower tool owns, even when every description, server instruction and workflow prompt named the right one — the public name is read before the finer guidance is weighed. When adjacent tools form a fallback chain, give them mutually exclusive model-visible names *and* mutually exclusive entry conditions, project one capability rather than two overlapping ones, and keep the lower-level primitive available to direct MCP clients instead of to the model. Prove it with repeated fresh-session live cases: one successful route does not show a stochastic choice is stable, and unit tests cannot show it at all.',
+        '',
+        '**Repetition and eligibility belong to the runtime, not the prompt.** A rolling model will render a "once per conversation" card three times under mild pressure and will reach for a conversion action on a question that merely sounds adjacent. When a tool must fire at most once, or only on an explicit ask, express that as a runtime policy the deployment enforces rather than as a sentence the model is asked to honour.',
+        '',
         '## Provision context deliberately',
         '',
         "Most “the model guessed wrong” bugs are missing context, not a missing tool. Every invocation already carries a server-authoritative instant plus locale and time zone, so never ask the model for today's date. Set `server(..., { context: { defaults: { locale, timeZone } } })` for ambient defaults, and mark one zero-input tool `contextProvider: true` when the model needs portable application context such as workspace, plan, or permissions. `references/authoring-workflow.md` owns the full invocation-context contract.",

package/node_modules/@noodle-borg/agent-kit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodle-borg/agent-kit",
-  "version": "0.87.1",
+  "version": "0.89.0",
   "license": "Apache-2.0",
   "type": "module",
   "engines": {

package/node_modules/@noodle-borg/assistant-gateway/dist/app-tool-call.d.ts

@@ -0,0 +1,42 @@
+import type { RuntimeArtifact } from '@noodle-borg/compiler';
+import type { ExecuteDeps } from '@noodle-borg/runtime';
+import { dispatchAssistantTool } from './assistant-interactive.js';
+import type { AssistantSessionRecord } from './assistant-store.js';
+/**
+ * What one apps-bridge tool call decided, before anything turns it into an HTTP answer.
+ *
+ * Projection, authorization, argument validation, and dispatch are all this package's already —
+ * `dispatchAssistantTool` lives beside this — so the decision belongs here and only the status code
+ * belongs to the route. Keeping them apart is also what lets every outcome be recorded in one
+ * place: the call used to leave no trace at all, which made `webmcp` a surface label with nothing
+ * to put it on.
+ */
+export type AssistantAppToolCallResult = {
+    readonly kind: 'not-found';
+} | {
+    readonly kind: 'forbidden';
+} | {
+    readonly kind: 'invalid-arguments';
+} | {
+    readonly kind: 'interaction';
+    readonly event: string;
+    readonly data: Readonly<Record<string, unknown>>;
+} | {
+    readonly kind: 'error';
+    readonly code: string;
+} | {
+    readonly kind: 'output';
+    readonly output: unknown;
+};
+export interface AssistantAppToolCallInput {
+    readonly artifact: RuntimeArtifact;
+    readonly deps: ExecuteDeps;
+    readonly session: AssistantSessionRecord;
+    readonly toolName: string;
+    readonly arguments?: unknown;
+    readonly now: () => Date;
+    readonly store: Parameters<typeof dispatchAssistantTool>[0]['store'];
+    readonly audit: Parameters<typeof dispatchAssistantTool>[0]['audit'];
+}
+export declare function executeAssistantAppToolCall(input: AssistantAppToolCallInput): Promise<AssistantAppToolCallResult>;
+//# sourceMappingURL=app-tool-call.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/app-tool-call.js

@@ -0,0 +1,45 @@
+import { validateJsonSchemaWithDefaults } from '@noodle-borg/compiler';
+import { evaluateToolAuthorization } from '@noodle-borg/protocol';
+import { resolveInvocationContextSnapshot } from './assistant-context.js';
+import { withAssistantSessionExecutionAuthority } from './assistant-customer-routing.js';
+import { dispatchAssistantTool } from './assistant-interactive.js';
+export async function executeAssistantAppToolCall(input) {
+    const { artifact, session } = input;
+    const tool = artifact.tools.find((candidate) => candidate.name === input.toolName);
+    // The same gate `tools/list` projected with: a tool an app may not see is a tool it may not call.
+    if (!tool || tool._meta?.ui?.visibility?.includes('app') === false)
+        return { kind: 'not-found' };
+    if (!evaluateToolAuthorization(tool.authorization, session.caller).allow) {
+        return { kind: 'forbidden' };
+    }
+    const executeDeps = withAssistantSessionExecutionAuthority(input.deps, artifact, session);
+    const context = await resolveInvocationContextSnapshot({
+        artifact,
+        executeDeps,
+        caller: session.caller,
+        instant: input.now(),
+        ...(session.preferences ? { applicationPreference: session.preferences } : {}),
+    });
+    const validated = validateJsonSchemaWithDefaults(tool.inputSchema, input.arguments ?? {});
+    if (validated.issues.length > 0)
+        return { kind: 'invalid-arguments' };
+    const dispatched = await dispatchAssistantTool({
+        artifact,
+        tool,
+        arguments: validated.value,
+        executeDeps,
+        caller: session.caller,
+        context,
+        session,
+        store: input.store,
+        audit: input.audit,
+        now: input.now,
+    });
+    if (dispatched.kind !== 'event')
+        return { kind: 'output', output: dispatched.output };
+    if (dispatched.event === 'tool_proposed' || dispatched.event === 'input_requested') {
+        return { kind: 'interaction', event: dispatched.event, data: dispatched.data };
+    }
+    return { kind: 'error', code: String(dispatched.data.code ?? dispatched.event) };
+}
+//# sourceMappingURL=app-tool-call.js.map

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-configuration.d.ts

@@ -16,9 +16,9 @@ import type { TenantRef } from './tenant-ref.js';
  * manifest cannot silently grow the browser payload. That list is owned by the gateway, beside the
  * record type it produces, so this projection and the type it satisfies cannot disagree.
  */
-export declare function assistantBrowserConfiguration(server: ArtifactServer): AssistantAppearanceOverride | undefined;
+export declare function assistantBrowserConfiguration(server: ArtifactServer, boundSurface?: 'public' | 'authenticated'): AssistantAppearanceOverride | undefined;
 /** Resolve environment operator state above the immutable deployment projection. */
-export declare function effectiveAssistantBrowserConfiguration(server: ArtifactServer, tenant: TenantRef, store: AssistantAppearanceSettingsStore | undefined): Promise<{
+export declare function effectiveAssistantBrowserConfiguration(server: ArtifactServer, tenant: TenantRef, store: AssistantAppearanceSettingsStore | undefined, boundSurface?: 'public' | 'authenticated'): Promise<{
     effective: AssistantAppearanceOverride | undefined;
     fallback: "halo";
     provenance: import("./assistant-appearance.js").AssistantAppearanceProvenance;

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-configuration.js

@@ -13,7 +13,7 @@ import { ASSISTANT_BROWSER_UI_FIELDS } from './assistant-store.js';
  * manifest cannot silently grow the browser payload. That list is owned by the gateway, beside the
  * record type it produces, so this projection and the type it satisfies cannot disagree.
  */
-export function assistantBrowserConfiguration(server) {
+export function assistantBrowserConfiguration(server, boundSurface) {
     const assistant = server.assistant;
     const ui = {};
     for (const field of ASSISTANT_BROWSER_UI_FIELDS) {
@@ -21,6 +21,15 @@ export function assistantBrowserConfiguration(server) {
         if (value !== undefined)
             ui[field] = value;
     }
+    // `webmcp` is the one field the session's own surface may answer differently (ADR 0220, amended):
+    // it decides whether this embed registers its tools with `document.modelContext`, and a deployment
+    // serving a marketing page and a signed-in app has two honest answers to that. Read from the bound
+    // surface only — a caller that cannot name one, including a pre-surfaces deployment, gets the
+    // assistant's own value rather than an arbitrary surface's. Nothing else is read here, so
+    // consulting the surface cannot widen what crosses to the browser.
+    const surfaceWebmcp = surfaceOfMode(assistant, boundSurface)?.webmcp;
+    if (surfaceWebmcp !== undefined)
+        ui.webmcp = surfaceWebmcp;
     const configuration = {
         ...(server.branding ? { branding: server.branding } : {}),
         ...(Object.keys(ui).length > 0 ? { assistant: ui } : {}),
@@ -29,9 +38,14 @@ export function assistantBrowserConfiguration(server) {
         ? configuration
         : undefined;
 }
+function surfaceOfMode(assistant, mode) {
+    if (mode === undefined || !Array.isArray(assistant?.surfaces))
+        return undefined;
+    return assistant.surfaces.find((surface) => surface.mode === mode);
+}
 /** Resolve environment operator state above the immutable deployment projection. */
-export async function effectiveAssistantBrowserConfiguration(server, tenant, store) {
-    const developer = assistantBrowserConfiguration(server);
+export async function effectiveAssistantBrowserConfiguration(server, tenant, store, boundSurface) {
+    const developer = assistantBrowserConfiguration(server, boundSurface);
     const record = await store?.get(tenant);
     return {
         developer,

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-context.d.ts

@@ -1,4 +1,5 @@
-import type { InvocationContext } from '@noodle-borg/runtime';
+import type { RuntimeArtifact } from '@noodle-borg/compiler';
+import { type CallerIdentity, type ExecuteDeps, type InvocationContext, type InvocationLocationContext } from '@noodle-borg/runtime';
 export interface AssistantContextPreferences {
     readonly locale?: string | undefined;
     readonly timeZone?: string | undefined;
@@ -23,5 +24,16 @@ export declare function invocationContextSystemMessage(context: InvocationContex
 export declare function parseAssistantContextPreferences(value: unknown): AssistantContextPreferencesResult;
 export declare function isAssistantVerifiedClaims(value: unknown): value is Readonly<Record<string, string | number | boolean | null>>;
 export declare function isAssistantPageContext(value: unknown): value is Readonly<Record<string, string | number | boolean | null>>;
+interface ResolveAssistantInvocationContextInput {
+    readonly artifact: RuntimeArtifact;
+    readonly executeDeps: ExecuteDeps;
+    readonly caller?: CallerIdentity;
+    readonly instant: Date;
+    readonly applicationPreference?: AssistantContextPreferences;
+    readonly clientHint?: AssistantContextPreferences;
+    readonly clientLocationHint?: Omit<InvocationLocationContext, 'source'>;
+}
+/** Resolve one immutable snapshot, including a schema-validated read-only ambient provider. */
+export declare function resolveInvocationContextSnapshot(input: ResolveAssistantInvocationContextInput): Promise<InvocationContext>;
 export {};
 //# sourceMappingURL=assistant-context.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-context.js

@@ -1,3 +1,5 @@
+import { executeAmbientContext, } from '@noodle-borg/runtime';
+import { toolTouchesDelegatedAuth } from './assistant-delegated-projection.js';
 const PLATFORM_DEFAULTS = { locale: 'en-US', timeZone: 'UTC' };
 /** Resolve presentation preferences independently from server-authoritative time. */
 export function resolveInvocationContext(input) {
@@ -144,4 +146,55 @@ function offsetFromPart(value) {
         throw new RangeError(`unsupported timezone offset ${value ?? 'unknown'}`);
     return match[1];
 }
+/** Resolve one immutable snapshot, including a schema-validated read-only ambient provider. */
+export async function resolveInvocationContextSnapshot(input) {
+    const callerPreference = {
+        ...(input.caller?.locale ? { locale: input.caller.locale } : {}),
+        ...(input.caller?.timeZone ? { timeZone: input.caller.timeZone } : {}),
+        ...(input.applicationPreference ?? {}),
+    };
+    const clientHint = {
+        ...(input.clientLocationHint?.timeZone === undefined
+            ? {}
+            : { timeZone: input.clientLocationHint.timeZone }),
+        ...(input.clientHint ?? {}),
+    };
+    const temporal = resolveInvocationContext({
+        instant: input.instant,
+        ...(Object.keys(callerPreference).length > 0
+            ? { applicationPreference: callerPreference }
+            : {}),
+        ...(Object.keys(clientHint).length === 0 ? {} : { clientHint }),
+        ...(input.artifact.server.context?.defaults
+            ? { defaults: input.artifact.server.context.defaults }
+            : {}),
+    });
+    const context = {
+        ...temporal,
+        ...(input.clientLocationHint === undefined
+            ? {}
+            : { location: { ...input.clientLocationHint, source: 'client-hint' } }),
+    };
+    const ambient = input.artifact.server.context?.ambient;
+    if (!ambient)
+        return context;
+    // An anonymous principal can never satisfy a delegated-auth fulfilment: the broker exchange
+    // is guaranteed to fail, so skip the doomed round trip instead of paying it every turn.
+    if (input.caller?.identityKind === 'anonymous') {
+        const delegatedKeys = input.executeDeps.broker.assistantDelegatedAuthKeys?.();
+        if (delegatedKeys !== undefined &&
+            delegatedKeys.size > 0 &&
+            toolTouchesDelegatedAuth(ambient, delegatedKeys)) {
+            return { ...context, ambientStatus: 'unavailable' };
+        }
+    }
+    const result = await executeAmbientContext(input.artifact, {
+        ...input.executeDeps,
+        ...(input.caller ? { caller: input.caller } : {}),
+        context,
+    });
+    if (!result.ok)
+        return { ...context, ambientStatus: 'unavailable' };
+    return { ...context, ambientStatus: 'available', ambient: result.output };
+}
 //# sourceMappingURL=assistant-context.js.map

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-guide.d.ts

@@ -32,6 +32,18 @@ export declare function selectAssistantModelTools(artifact: RuntimeArtifact, cal
     readonly latestMessage?: string;
     readonly usedToolNames?: readonly string[];
 }): readonly ArtifactTool[];
+/**
+ * What to tell a model that called a tool this turn does not offer.
+ *
+ * The alternative — ending the turn on `invalid_model_tool_call` — is a security-correct rejection
+ * with a dishonest failure mode: the widget renders it as "temporarily unavailable" beside a
+ * Reconnect button that mints a whole new session, so a visitor who asked for something reasonable
+ * gets silence and the surface pays a session for it. A `role:'tool'` result costs one model step
+ * and gets the visitor a real answer instead. It names the tool because the model supplied that
+ * name in the first place, and says nothing about why the tool is absent, which is the part a
+ * visitor is not entitled to.
+ */
+export declare function assistantOmittedToolResult(name: string): string;
 /** Whether an already-selected tool requires the first model step to call it. */
 export declare function assistantModelToolRequiredWhenVisible(tool: ArtifactTool): boolean;
 /** Whether a successful model-selected call consumes this tool for the assistant session. */

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-guide.js

@@ -31,6 +31,21 @@ export function selectAssistantModelTools(artifact, caller, options = {}) {
         hasValidSessionVisibility(tool, options.usedToolNames) &&
         matchesLatestMessageConstraint(tool, options.latestMessage));
 }
+/**
+ * What to tell a model that called a tool this turn does not offer.
+ *
+ * The alternative — ending the turn on `invalid_model_tool_call` — is a security-correct rejection
+ * with a dishonest failure mode: the widget renders it as "temporarily unavailable" beside a
+ * Reconnect button that mints a whole new session, so a visitor who asked for something reasonable
+ * gets silence and the surface pays a session for it. A `role:'tool'` result costs one model step
+ * and gets the visitor a real answer instead. It names the tool because the model supplied that
+ * name in the first place, and says nothing about why the tool is absent, which is the part a
+ * visitor is not entitled to.
+ */
+export function assistantOmittedToolResult(name) {
+    return (`The tool "${name}" is not available in this conversation. Do not call it again. ` +
+        'Answer the person directly in your own words, and say plainly if you cannot help with this.');
+}
 /** Whether an already-selected tool requires the first model step to call it. */
 export function assistantModelToolRequiredWhenVisible(tool) {
     return tool.annotations?.[REQUIRED_WHEN_VISIBLE] === true;

package/node_modules/@noodle-borg/assistant-gateway/dist/embed-operator-view.d.ts

@@ -0,0 +1,79 @@
+import type { AdmissionEnvelope } from '@noodle-borg/admission-limits/portable';
+import type { PublicEmbedRecord } from './embed-store.js';
+import type { PublicSurface } from './public-surface.js';
+/**
+ * The operator's view of one public surface: what it is, and what it may spend.
+ *
+ * Origins, capabilities, and surfaceMode come from the *active* deployment rather than the embed
+ * row, so what an operator reads here is what a browser will actually be held to at mint time. The
+ * row keeps its provisioning-time mode by design — `ensure` never overwrites a live row.
+ */
+export interface AssistantEmbedOperatorView {
+    readonly embedId: string;
+    readonly surfaceMode: string;
+    readonly origins: readonly string[];
+    readonly capabilities: readonly string[];
+    readonly turnsPerDay: number;
+    readonly mintsPerDay: number;
+    /**
+     * What a browser agent may spend on this surface through the WebMCP bridge. Reported beside the
+     * turn caps because "is my budget about to run out" is the same question, and a bridge call spends
+     * neither a turn nor a mint — an operator reading only those two would see a quiet day.
+     */
+    readonly bridgeCallsPerSession: number;
+    readonly bridgeCallsPerDay: number;
+    /** True when the caps are the deployment defaults rather than something an operator chose. */
+    readonly budgetIsDefault: boolean;
+    readonly turnsToday: number;
+    readonly mintsToday: number;
+    readonly bridgeCallsToday: number;
+    readonly createdAt: string;
+    /**
+     * Present only when Noodle is funding this surface's model. It exists so an operator can tell
+     * platform-imposed degradation from a bug in their own app, which is the one thing they cannot
+     * work out from the caps above — those look normal right up to the moment the ladder closes them.
+     */
+    readonly managedSpend?: AssistantManagedSpendView;
+}
+export interface AssistantManagedSpendView {
+    /** `normal`, `approaching`, `near`, `limited`, or `closed`. */
+    readonly state: string;
+    /**
+     * Turns left today at the current rung, not a percentage. The spend consume is all-or-nothing, so
+     * a costly turn is refused while a cheap one still passes at the tail of the day — a percentage
+     * would look like it stopped early.
+     */
+    readonly turnsRemaining: number;
+    /** One plain sentence about what a visitor experiences right now. */
+    readonly visitors: string;
+}
+/**
+ * Project a tenant's spend into what an operator needs to read.
+ *
+ * Takes the raw peek rather than a rung so the caller owns only the read: which rung that is, and
+ * what a turn costs there, are the ladder's business and stay in one place.
+ */
+export declare function assistantManagedSpendView(input: {
+    readonly spend: {
+        readonly allowance: number;
+    };
+    readonly unitsUsed: number;
+}): AssistantManagedSpendView;
+/**
+ * Project one embed row into that view. Pure on purpose: the caller owns the reads (active
+ * deployment, counter peeks) and this owns the shape, so the projection stays testable without a
+ * registry or a counter store.
+ */
+export declare function assistantEmbedOperatorView(input: {
+    readonly record: PublicEmbedRecord;
+    readonly surface: PublicSurface | undefined;
+    readonly envelope: AdmissionEnvelope;
+    /** Usage without consuming. The keys are this package's own convention, so it forms them here. */
+    readonly peek: (key: string) => Promise<number>;
+    /** Present only when Noodle funds this surface's model. */
+    readonly spend?: {
+        readonly key: string;
+        readonly allowance: number;
+    };
+}): Promise<AssistantEmbedOperatorView>;
+//# sourceMappingURL=embed-operator-view.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/embed-operator-view.js

@@ -0,0 +1,67 @@
+import { managedSpendRung, managedSpendUnitWeight } from './managed-spend.js';
+const SPEND_STATES = [
+    { state: 'normal', visitors: 'Full answers, full tools.' },
+    { state: 'approaching', visitors: 'Shorter answers. Nothing else changes.' },
+    {
+        state: 'near',
+        visitors: 'Shorter answers, and conversations restart after 8 turns.',
+    },
+    { state: 'limited', visitors: 'Short answers from knowledge only; tools are paused.' },
+    {
+        state: 'closed',
+        visitors: 'Paused until 00:00 UTC. Connect your own model key to keep serving.',
+    },
+];
+/**
+ * Project a tenant's spend into what an operator needs to read.
+ *
+ * Takes the raw peek rather than a rung so the caller owns only the read: which rung that is, and
+ * what a turn costs there, are the ladder's business and stay in one place.
+ */
+export function assistantManagedSpendView(input) {
+    const rungAt = managedSpendRung(input.unitsUsed, input.spend.allowance);
+    const perTurn = managedSpendUnitWeight(rungAt);
+    const remaining = Math.max(0, input.spend.allowance - input.unitsUsed);
+    const rung = Math.min(rungAt, SPEND_STATES.length - 1);
+    return {
+        ...SPEND_STATES[rung],
+        turnsRemaining: perTurn > 0 ? Math.floor(remaining / perTurn) : 0,
+    };
+}
+/**
+ * Project one embed row into that view. Pure on purpose: the caller owns the reads (active
+ * deployment, counter peeks) and this owns the shape, so the projection stays testable without a
+ * registry or a counter store.
+ */
+export async function assistantEmbedOperatorView(input) {
+    const { record, surface, envelope, spend } = input;
+    return {
+        embedId: record.embedId,
+        surfaceMode: surface?.mode ?? record.surfaceMode,
+        origins: surface?.origins ?? [],
+        capabilities: surface?.capabilities.map((entry) => entry.name) ?? [],
+        turnsPerDay: envelope.turnsPerDay,
+        mintsPerDay: envelope.mintsPerDay,
+        bridgeCallsPerSession: envelope.bridgeToolCallsPerSession,
+        bridgeCallsPerDay: envelope.bridgeToolCallsPerDay,
+        budgetIsDefault: record.turnsPerDay === undefined &&
+            record.mintsPerDay === undefined &&
+            record.bridgeToolCallsPerSession === undefined &&
+            record.bridgeToolCallsPerDay === undefined,
+        turnsToday: await input.peek(`turns:${record.embedId}`),
+        mintsToday: await input.peek(`mints:${record.embedId}`),
+        // Keyed as `admitBridgeToolCall` writes it, so the number an operator reads is the one the
+        // gate consumed rather than a parallel count that can drift from it.
+        bridgeCallsToday: await input.peek(`bridge:${record.embedId}`),
+        createdAt: record.createdAt.toISOString(),
+        ...(spend === undefined
+            ? {}
+            : {
+                managedSpend: assistantManagedSpendView({
+                    spend,
+                    unitsUsed: await input.peek(spend.key),
+                }),
+            }),
+    };
+}
+//# sourceMappingURL=embed-operator-view.js.map

package/node_modules/@noodle-borg/assistant-gateway/dist/embed-store.d.ts

@@ -31,6 +31,21 @@ export interface PublicEmbedRecord {
      */
     readonly turnsPerDay?: number;
     readonly mintsPerDay?: number;
+    /**
+     * Operator overrides for the per-address abuse bounds. Rarely needed — tier 4 handles fairness and
+     * these only have to stop a single machine — but an operator who knows their own traffic shape
+     * (an internal tool behind one proxy, say) can lower them, and lowering is all anyone may do.
+     */
+    readonly mintsPerAddressHour?: number;
+    readonly turnsPerAddressHour?: number;
+    /**
+     * Operator overrides for this surface's WebMCP bridge budgets. The shipped defaults are
+     * proportionate rather than measured (ADR 0220), so an operator who can see their own agent
+     * traffic needs to move them without waiting for a release. `0` is the kill switch here too,
+     * though zeroing `turnsPerDay` already stops bridge calls with it.
+     */
+    readonly bridgeToolCallsPerSession?: number;
+    readonly bridgeToolCallsPerDay?: number;
 }
 /** Project the non-secret embed coordinate onto the shared assistant tenant shape. */
 export declare function publicEmbedTenant(embed: PublicEmbedRecord): TenantRef;
@@ -38,6 +53,10 @@ export declare function publicEmbedTenant(embed: PublicEmbedRecord): TenantRef;
 export interface PublicEmbedBudget {
     readonly turnsPerDay?: number;
     readonly mintsPerDay?: number;
+    readonly mintsPerAddressHour?: number;
+    readonly turnsPerAddressHour?: number;
+    readonly bridgeToolCallsPerSession?: number;
+    readonly bridgeToolCallsPerDay?: number;
 }
 export interface PublicEmbedStore {
     /**
@@ -73,4 +92,22 @@ export interface PublicEmbedStore {
 export declare const PUBLIC_EMBED_ID_PREFIX = "pub_";
 export declare function isPublicEmbedId(value: string): boolean;
 import type { TenantRef } from './tenant-ref.js';
+/**
+ * Validate an operator's requested caps.
+ *
+ * Lives with the budget type rather than with the route that receives it: the rules are about what a
+ * cap may be, not about HTTP, and a second caller must not be able to reach the store with a shape
+ * this would have rejected.
+ */
+export type BudgetField = 'turnsPerDay' | 'mintsPerDay' | 'mintsPerAddressHour' | 'turnsPerAddressHour' | 'bridgeToolCallsPerSession' | 'bridgeToolCallsPerDay';
+type BudgetValue = Partial<Record<BudgetField, number>>;
+type ParsedBudget = {
+    readonly ok: true;
+    readonly value: BudgetValue;
+} | {
+    readonly ok: false;
+    readonly error: string;
+};
+export declare function parsePublicEmbedBudget(body: unknown): ParsedBudget;
+export {};
 //# sourceMappingURL=embed-store.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/embed-store.js

@@ -23,4 +23,41 @@ export const PUBLIC_EMBED_ID_PREFIX = 'pub_';
 export function isPublicEmbedId(value) {
     return new RegExp(`^${PUBLIC_EMBED_ID_PREFIX}[0-9a-z]{20,32}$`).test(value);
 }
+const BUDGET_FIELDS = [
+    'turnsPerDay',
+    'mintsPerDay',
+    'mintsPerAddressHour',
+    'turnsPerAddressHour',
+    'bridgeToolCallsPerSession',
+    'bridgeToolCallsPerDay',
+];
+export function parsePublicEmbedBudget(body) {
+    // A JSON body of `null` is an object to `typeof` and reads as a crash to a property access, so it
+    // is checked by name: an operator sending nonsense deserves the 400 this returns, not the 500 an
+    // uncaught `TypeError` would become.
+    if (typeof body !== 'object' || body === null || Array.isArray(body)) {
+        return { ok: false, error: 'body must be a JSON object' };
+    }
+    const supplied = body;
+    const value = {};
+    for (const [name, raw] of BUDGET_FIELDS.map((field) => [field, supplied[field]])) {
+        if (raw === undefined)
+            continue;
+        // Zero is valid and is the point; anything negative or fractional is a mistake worth saying out
+        // loud rather than silently flooring, because an operator setting a cap is being deliberate.
+        // `isSafeInteger` rather than `isInteger`: past 2^53 a JSON number has already lost the value
+        // the operator typed, and it reaches a `::bigint` column that would store the rounded one.
+        if (typeof raw !== 'number' || !Number.isSafeInteger(raw) || raw < 0) {
+            return { ok: false, error: `"${name}" must be a non-negative integer` };
+        }
+        value[name] = raw;
+    }
+    if (Object.keys(value).length === 0) {
+        return {
+            ok: false,
+            error: `set at least one of ${BUDGET_FIELDS.map((f) => `"${f}"`).join(', ')}`,
+        };
+    }
+    return { ok: true, value };
+}
 //# sourceMappingURL=embed-store.js.map

package/node_modules/@noodle-borg/assistant-gateway/dist/in-memory-embed-store.js

@@ -39,6 +39,18 @@ export class InMemoryPublicEmbedStore {
             ...record,
             ...(budget.turnsPerDay !== undefined ? { turnsPerDay: budget.turnsPerDay } : {}),
             ...(budget.mintsPerDay !== undefined ? { mintsPerDay: budget.mintsPerDay } : {}),
+            ...(budget.mintsPerAddressHour !== undefined
+                ? { mintsPerAddressHour: budget.mintsPerAddressHour }
+                : {}),
+            ...(budget.turnsPerAddressHour !== undefined
+                ? { turnsPerAddressHour: budget.turnsPerAddressHour }
+                : {}),
+            ...(budget.bridgeToolCallsPerSession !== undefined
+                ? { bridgeToolCallsPerSession: budget.bridgeToolCallsPerSession }
+                : {}),
+            ...(budget.bridgeToolCallsPerDay !== undefined
+                ? { bridgeToolCallsPerDay: budget.bridgeToolCallsPerDay }
+                : {}),
         };
         this.#byId.set(embedId, updated);
         return updated;