@noodleseed/one 0.148.0 → 0.150.0

package/node_modules/@noodle-borg/assistant-gateway/dist/managed-spend.d.ts

@@ -0,0 +1,80 @@
+import type { AdmissionEnvelope } from '@noodle-borg/admission-limits/portable';
+import type { AssistantModelRequestPolicy } from './model-request.js';
+import type { SurfaceBudgetBounds } from './surface-budget.js';
+/**
+ * Cost breakers for the sponsored managed-assistant beta (ADR 0213 amendment §3).
+ *
+ * Noodle pays for `noodle-managed` inference and charges nothing for it, so aggregate spend is a
+ * platform expense with no customer-side limit standing behind it. Per-surface daily caps bound one
+ * surface; they do not bound how many surfaces enrol. This is the missing ceiling, expressed as a
+ * ladder rather than a switch: a tenant approaching its allowance gets shorter answers before it gets
+ * a closed door, and the door itself is the kill switch that already exists.
+ *
+ * Two things make it small. Every rung is expressed through `SurfaceBudgetBounds` and
+ * `AssistantModelRequestPolicy`, which the resolver already returns and admission already reads live
+ * per turn — so degradation applies immediately and reverses on its own when the UTC day rolls, with
+ * no unwind path to write. And the unit is one delivered bounded turn, which is the billable unit ADR
+ * 0213 §12 already defines.
+ */
+/**
+ * Billable tokens per charged unit. Prompt and completion are counted together and completion is
+ * weighted, because output costs several times input on every provider we have measured.
+ */
+export declare const MANAGED_SPEND_UNIT_TOKENS = 4000;
+export interface ManagedSpendPolicy {
+    readonly requestPolicy: AssistantModelRequestPolicy;
+    readonly admission: SurfaceBudgetBounds;
+}
+/**
+ * Which rung a tenant is on.
+ *
+ * An absent or nonsensical allowance means "unbudgeted", never "exhausted". Failing closed on a typo
+ * would take a customer's surface dark for a configuration mistake, and the per-surface daily cap
+ * still bounds what that costs.
+ */
+export declare function managedSpendRung(unitsUsed: number, allowance: number): number;
+export declare function managedSpendPolicy(rung: number): ManagedSpendPolicy;
+/**
+ * Units one turn costs at this rung: its worst case under the rung's own policy, in whole units.
+ *
+ * Prompt-inclusive on purpose. `maxCompletionTokens` says nothing about how large a prompt the agent
+ * loop may resend on each step, and the prompt is where an unbounded turn actually spends.
+ */
+export declare function managedSpendUnitWeight(rung: number): number;
+/**
+ * The unit ledger for a day's worth of ordinary turns.
+ *
+ * Units are worst-case, so a turn is charged what its rung's policy *permits* rather than what it
+ * happened to use. That is deliberate — the alternative under-charges exactly the adversary the cap
+ * exists for — but it means the number is only meaningful denominated in turns. An allowance is
+ * therefore configured as "this many sponsored turns a day" and converted here, which is also the
+ * form the operator surface reports.
+ *
+ * The conservatism is uniform within a rung, so it does not distort when the ladder trips; across
+ * rungs it is the intended effect, since a degraded turn genuinely costs less and the same allowance
+ * stretches further.
+ */
+export declare function managedSpendAllowanceForTurns(turnsPerDay: number): number;
+/**
+ * Is the ledger telling the truth?
+ *
+ * A unit weight is a claim about what a turn's own rung permits. If the rung's `requestPolicy` does
+ * not actually bound what it says, the claim is fiction and the whole cap is decorative — and the
+ * failure is silent, because a cheap-looking ledger is exactly what an unbounded turn produces.
+ *
+ * So telemetry checks the counter rather than replacing it. Observed billable tokens per delivered
+ * turn must stay under what rung 0 permits, since rung 0 is the most permissive rung any turn could
+ * have run at. Exceeding it is not a budgeting question; it means an enforcer is not enforcing.
+ */
+export declare function managedSpendDrift(observed: {
+    readonly deliveredTurns: number;
+    readonly promptTokens: number;
+    readonly completionTokens: number;
+}): {
+    readonly observedPerTurn: number;
+    readonly permittedPerTurn: number;
+    readonly exceeded: boolean;
+};
+/** Convenience for readers that only care whether a tenant is being held back at all. */
+export declare function isManagedSpendDegraded(envelope: Pick<AdmissionEnvelope, 'turnsPerDay'>): boolean;
+//# sourceMappingURL=managed-spend.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/managed-spend.js

@@ -0,0 +1,186 @@
+/**
+ * Cost breakers for the sponsored managed-assistant beta (ADR 0213 amendment §3).
+ *
+ * Noodle pays for `noodle-managed` inference and charges nothing for it, so aggregate spend is a
+ * platform expense with no customer-side limit standing behind it. Per-surface daily caps bound one
+ * surface; they do not bound how many surfaces enrol. This is the missing ceiling, expressed as a
+ * ladder rather than a switch: a tenant approaching its allowance gets shorter answers before it gets
+ * a closed door, and the door itself is the kill switch that already exists.
+ *
+ * Two things make it small. Every rung is expressed through `SurfaceBudgetBounds` and
+ * `AssistantModelRequestPolicy`, which the resolver already returns and admission already reads live
+ * per turn — so degradation applies immediately and reverses on its own when the UTC day rolls, with
+ * no unwind path to write. And the unit is one delivered bounded turn, which is the billable unit ADR
+ * 0213 §12 already defines.
+ */
+/**
+ * Billable tokens per charged unit. Prompt and completion are counted together and completion is
+ * weighted, because output costs several times input on every provider we have measured.
+ */
+export const MANAGED_SPEND_UNIT_TOKENS = 4_000;
+const OUTPUT_WEIGHT = 8;
+const BYTES_PER_TOKEN = 4;
+/**
+ * The rungs, tightest-claim-first.
+ *
+ * Rung 0 is not "today's policy": a weight is only honest if the rung's own policy enforces it, and
+ * an unbounded prompt makes the worst case forty times the typical turn. Bounding the request keeps
+ * the ledger true. These numbers are the starting point and are expected to move once measured P99
+ * prompt sizes are read off the live surface — that measurement is a gate on raising the ceilings,
+ * not on shipping the breaker.
+ */
+const RUNGS = [
+    {
+        requestPolicy: {
+            maxRequestBytes: 32 * 1_024,
+            maxCompletionTokens: 1_500,
+            maxTokensPerTurn: 3_000,
+            maxModelStepsPerTurn: 6,
+            maxToolCallsPerTurn: 8,
+        },
+        admission: {
+            defaults: { turnsPerSession: 40, turnsPerDay: 20_000, mintsPerDay: 5_000 },
+            ceiling: { turnsPerDay: 20_000, mintsPerDay: 5_000 },
+        },
+    },
+    {
+        // Shorter answers. Nothing is announced: telling a stranger on a customer's marketing site that
+        // it is on a reduced tier harms the customer and helps no one, and a shorter answer explains
+        // itself.
+        requestPolicy: {
+            maxRequestBytes: 24 * 1_024,
+            maxCompletionTokens: 900,
+            maxTokensPerTurn: 1_800,
+            maxModelStepsPerTurn: 4,
+            maxToolCallsPerTurn: 6,
+        },
+        admission: {
+            defaults: { turnsPerSession: 40, turnsPerDay: 20_000, mintsPerDay: 5_000 },
+            ceiling: { turnsPerDay: 20_000, mintsPerDay: 5_000 },
+        },
+    },
+    {
+        // Shorter conversations. This does not lower a turn's worst case — `maxRequestBytes` already caps
+        // that — it lowers the typical prompt by cutting history growth, which stretches the remaining
+        // allowance without shortening any individual answer. The visitor meets
+        // `session_turn_budget_exhausted`, which the widget already renders as its existing "new
+        // conversation" affordance.
+        requestPolicy: {
+            maxRequestBytes: 16 * 1_024,
+            maxCompletionTokens: 700,
+            maxTokensPerTurn: 1_400,
+            maxModelStepsPerTurn: 3,
+            maxToolCallsPerTurn: 4,
+        },
+        admission: {
+            defaults: { turnsPerSession: 8, turnsPerDay: 20_000, mintsPerDay: 5_000 },
+            ceiling: { turnsPerDay: 20_000, mintsPerDay: 5_000 },
+        },
+    },
+    {
+        // No tools. `projectAssistantGuide` projects the per-turn tool set, so the guide never promises a
+        // tool that is not offered; the assistant simply answers from knowledge and its own words.
+        requestPolicy: {
+            maxRequestBytes: 12 * 1_024,
+            maxCompletionTokens: 400,
+            maxTokensPerTurn: 800,
+            maxModelStepsPerTurn: 1,
+            maxToolCallsPerTurn: 0,
+        },
+        admission: {
+            defaults: { turnsPerSession: 8, turnsPerDay: 20_000, mintsPerDay: 5_000 },
+            ceiling: { turnsPerDay: 20_000, mintsPerDay: 5_000 },
+        },
+    },
+    {
+        // At cap. Deliberately the *existing* kill switch and not a new failure mode: zero ceilings refuse
+        // at admission with `daily_turn_budget_exhausted`, a code every published widget already treats as
+        // final. A new code would be read as retryable by every widget predating it, and they would hammer
+        // the endpoint this cap exists to protect.
+        requestPolicy: {
+            maxRequestBytes: 12 * 1_024,
+            maxCompletionTokens: 400,
+            maxTokensPerTurn: 800,
+            maxModelStepsPerTurn: 1,
+            maxToolCallsPerTurn: 0,
+        },
+        admission: {
+            defaults: { turnsPerSession: 8, turnsPerDay: 0, mintsPerDay: 0 },
+            ceiling: { turnsPerDay: 0, mintsPerDay: 0 },
+        },
+    },
+];
+/** Fractions of the allowance at which each rung begins. */
+const THRESHOLDS = [0.6, 0.8, 0.95, 1];
+/**
+ * Which rung a tenant is on.
+ *
+ * An absent or nonsensical allowance means "unbudgeted", never "exhausted". Failing closed on a typo
+ * would take a customer's surface dark for a configuration mistake, and the per-surface daily cap
+ * still bounds what that costs.
+ */
+export function managedSpendRung(unitsUsed, allowance) {
+    if (!Number.isFinite(allowance) || allowance <= 0)
+        return 0;
+    const share = Math.max(0, unitsUsed) / allowance;
+    return THRESHOLDS.filter((threshold) => share >= threshold).length;
+}
+export function managedSpendPolicy(rung) {
+    return RUNGS[Math.min(Math.max(Math.trunc(rung), 0), RUNGS.length - 1)];
+}
+/**
+ * Units one turn costs at this rung: its worst case under the rung's own policy, in whole units.
+ *
+ * Prompt-inclusive on purpose. `maxCompletionTokens` says nothing about how large a prompt the agent
+ * loop may resend on each step, and the prompt is where an unbounded turn actually spends.
+ */
+export function managedSpendUnitWeight(rung) {
+    const { requestPolicy } = managedSpendPolicy(rung);
+    const prompt = ((requestPolicy.maxModelStepsPerTurn ?? 1) * (requestPolicy.maxRequestBytes ?? 0)) /
+        BYTES_PER_TOKEN;
+    const output = OUTPUT_WEIGHT * (requestPolicy.maxTokensPerTurn ?? 0);
+    return Math.max(1, Math.ceil((prompt + output) / MANAGED_SPEND_UNIT_TOKENS));
+}
+/**
+ * The unit ledger for a day's worth of ordinary turns.
+ *
+ * Units are worst-case, so a turn is charged what its rung's policy *permits* rather than what it
+ * happened to use. That is deliberate — the alternative under-charges exactly the adversary the cap
+ * exists for — but it means the number is only meaningful denominated in turns. An allowance is
+ * therefore configured as "this many sponsored turns a day" and converted here, which is also the
+ * form the operator surface reports.
+ *
+ * The conservatism is uniform within a rung, so it does not distort when the ladder trips; across
+ * rungs it is the intended effect, since a degraded turn genuinely costs less and the same allowance
+ * stretches further.
+ */
+export function managedSpendAllowanceForTurns(turnsPerDay) {
+    if (!Number.isFinite(turnsPerDay) || turnsPerDay <= 0)
+        return 0;
+    return Math.ceil(turnsPerDay) * managedSpendUnitWeight(0);
+}
+/**
+ * Is the ledger telling the truth?
+ *
+ * A unit weight is a claim about what a turn's own rung permits. If the rung's `requestPolicy` does
+ * not actually bound what it says, the claim is fiction and the whole cap is decorative — and the
+ * failure is silent, because a cheap-looking ledger is exactly what an unbounded turn produces.
+ *
+ * So telemetry checks the counter rather than replacing it. Observed billable tokens per delivered
+ * turn must stay under what rung 0 permits, since rung 0 is the most permissive rung any turn could
+ * have run at. Exceeding it is not a budgeting question; it means an enforcer is not enforcing.
+ */
+export function managedSpendDrift(observed) {
+    const permittedPerTurn = managedSpendUnitWeight(0) * MANAGED_SPEND_UNIT_TOKENS;
+    if (observed.deliveredTurns <= 0) {
+        return { observedPerTurn: 0, permittedPerTurn, exceeded: false };
+    }
+    const billable = observed.promptTokens + OUTPUT_WEIGHT * observed.completionTokens;
+    const observedPerTurn = Math.round(billable / observed.deliveredTurns);
+    return { observedPerTurn, permittedPerTurn, exceeded: observedPerTurn > permittedPerTurn };
+}
+/** Convenience for readers that only care whether a tenant is being held back at all. */
+export function isManagedSpendDegraded(envelope) {
+    return envelope.turnsPerDay === 0;
+}
+//# sourceMappingURL=managed-spend.js.map

package/node_modules/@noodle-borg/assistant-gateway/dist/model-request.d.ts

@@ -5,6 +5,12 @@ export interface AssistantModelRequestPolicy {
     readonly maxCompletionTokens?: number;
     readonly maxTokensPerTurn?: number;
     readonly maxRequestBytes?: number;
+    /**
+     * Per-tenant agent-loop bounds. The deployment-wide admission envelope still wins whenever it is
+     * lower — these narrow a turn for one tenant, they never widen it for anyone.
+     */
+    readonly maxModelStepsPerTurn?: number;
+    readonly maxToolCallsPerTurn?: number;
     readonly timeoutMs?: number;
     readonly maxTurnMs?: number;
     /** Trusted operator-selected OpenAI-compatible request extensions. */
@@ -26,6 +32,16 @@ interface ResolvedAssistantModelBase {
             readonly turnsPerDay: number;
             readonly mintsPerDay: number;
         };
+        /**
+         * Platform spend accounting, present only when someone other than the customer is paying. Passed
+         * through to `SurfaceBudgetBounds` unchanged, which is why the shape is declared identically
+         * here rather than imported — the two contracts stay independent by design.
+         */
+        readonly spend?: {
+            readonly key: string;
+            readonly units: number;
+            readonly allowance: number;
+        };
     };
 }
 export type ResolvedAssistantModel = ResolvedAssistantModelBase & ({

package/node_modules/@noodle-borg/assistant-gateway/dist/portable.d.ts

@@ -1,4 +1,5 @@
 /** Assistant gateway contracts and in-memory adapters safe for the published CLI runtime. */
+export * from './app-tool-call.js';
 export * from './artifact-projection.js';
 export * from './assistant-appearance.js';
 export * from './assistant-appearance-store.js';
@@ -17,11 +18,13 @@ export * from './assistant-transcript.js';
 export * from './assistant-view-availability.js';
 export * from './elevation.js';
 export * from './elevation-store.js';
+export * from './embed-operator-view.js';
 export * from './embed-script.js';
 export * from './embed-store.js';
 export * from './in-memory-assistant-appearance-store.js';
 export * from './in-memory-elevation-store.js';
 export * from './in-memory-embed-store.js';
+export * from './managed-spend.js';
 export * from './public-configuration.js';
 export * from './public-session.js';
 export * from './public-surface.js';

package/node_modules/@noodle-borg/assistant-gateway/dist/portable.js

@@ -1,4 +1,5 @@
 /** Assistant gateway contracts and in-memory adapters safe for the published CLI runtime. */
+export * from './app-tool-call.js';
 export * from './artifact-projection.js';
 export * from './assistant-appearance.js';
 export * from './assistant-appearance-store.js';
@@ -17,11 +18,13 @@ export * from './assistant-transcript.js';
 export * from './assistant-view-availability.js';
 export * from './elevation.js';
 export * from './elevation-store.js';
+export * from './embed-operator-view.js';
 export * from './embed-script.js';
 export * from './embed-store.js';
 export * from './in-memory-assistant-appearance-store.js';
 export * from './in-memory-elevation-store.js';
 export * from './in-memory-embed-store.js';
+export * from './managed-spend.js';
 export * from './public-configuration.js';
 export * from './public-session.js';
 export * from './public-surface.js';

package/node_modules/@noodle-borg/assistant-gateway/dist/public-session.d.ts

@@ -1,4 +1,4 @@
-import type { AdmissionEnvelope, DailyCounterStore } from '@noodle-borg/admission-limits/portable';
+import { type AdmissionEnvelope, type DailyCounterStore } from '@noodle-borg/admission-limits/portable';
 import { type PublicEmbedRecord, type PublicEmbedStore } from './embed-store.js';
 import type { PublicSurface } from './public-surface.js';
 import { type SurfaceBudgetBounds } from './surface-budget.js';
@@ -43,6 +43,13 @@ export interface PublicSessionRequest {
      * be parsed, in which case the surface tier alone applies: fairness degrades, solvency does not.
      */
     readonly addressBucket?: string | undefined;
+    /**
+     * The browser's own visitor identifier (admission tier 4), unvalidated exactly like `embedId`:
+     * it arrives from the request body, so the decision owns its parse rather than the transport.
+     * Client-supplied and therefore rotatable, so it bounds fairness and never abuse — the address
+     * tier underneath is the one that cannot be rotated.
+     */
+    readonly visitorId?: unknown;
 }
 export type PublicSessionResult = {
     readonly ok: true;
@@ -54,6 +61,12 @@ export type PublicSessionResult = {
     readonly status: number;
     readonly code: string;
     readonly message: string;
+    /**
+     * The surface this refusal belongs to, once it is known. Present for every refusal an operator
+     * needs to see — out of budget, address at its ceiling, origin off the live allowlist — and
+     * absent for the ones that cannot be attributed to a tenant at all, which are prober noise.
+     */
+    readonly embed?: PublicEmbedRecord;
 };
 export declare function mintPublicSession(request: PublicSessionRequest, envelope: AdmissionEnvelope, ports: PublicSessionPorts): Promise<PublicSessionResult>;
 //# sourceMappingURL=public-session.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/public-session.js

@@ -1,7 +1,8 @@
+import { visitorBucket, } from '@noodle-borg/admission-limits/portable';
 import { isPublicEmbedId } from './embed-store.js';
 import { surfaceEnvelope } from './surface-budget.js';
-function refuse(status, code, message) {
-    return { ok: false, status, code, message };
+function refuse(status, code, message, embed) {
+    return { ok: false, status, code, message, ...(embed === undefined ? {} : { embed }) };
 }
 export async function mintPublicSession(request, envelope, ports) {
     if (typeof request.embedId !== 'string' || !isPublicEmbedId(request.embedId)) {
@@ -22,17 +23,33 @@ export async function mintPublicSession(request, envelope, ports) {
         return refuse(403, 'embed_not_found', 'embed is not available');
     const surface = await ports.resolveActiveSurface(embed);
     if (surface === undefined) {
-        return refuse(409, 'surface_unavailable', 'assistant deployment is unavailable');
+        return refuse(409, 'surface_unavailable', 'assistant deployment is unavailable', embed);
     }
     // Origins come from the live artifact, so `noodle deploy` alone updates a pasted snippet.
     if (!surface.origins.includes(request.origin)) {
-        return refuse(403, 'origin_not_allowed', 'origin is not allowed');
+        return refuse(403, 'origin_not_allowed', 'origin is not allowed', embed);
     }
     // The surface's own budget, which an operator may have lowered — or set to zero, which is the kill
     // switch. Resolved after the embed is known and before anything is spent.
     const budgetBounds = await ports.resolveBudgetBounds?.(embed);
     const surfaceLimits = surfaceEnvelope(envelope, embed, budgetBounds);
     const now = ports.now();
+    // Tier 4 before tier 3, which is before solvency. A visitor at their own hourly ceiling is refused
+    // without spending any of the shared address allowance, so one person behind a corporate NAT cannot
+    // consume the allowance the other three hundred are also using. An abuser who rotates the
+    // identifier simply never meets this tier and lands on the address bound below, which is the point:
+    // this is fairness, that is abuse control, and they are deliberately not the same limit.
+    const visitor = visitorBucket(request.visitorId);
+    if (visitor !== undefined) {
+        const perVisitor = await ports.counters.consume({
+            key: `mints:vis:${embed.embedId}:${visitor}`,
+            limit: surfaceLimits.mintsPerVisitorHour,
+            window: 'hour',
+        }, now);
+        if (!perVisitor.allowed) {
+            return refuse(429, 'visitor_session_budget_exhausted', 'assistant is unavailable right now', embed);
+        }
+    }
     // Fairness before solvency: an address at its hourly ceiling is refused without spending any of the
     // surface's day, so one visitor cannot burn the customer's budget on refusals.
     if (typeof request.addressBucket === 'string') {
@@ -42,14 +59,14 @@ export async function mintPublicSession(request, envelope, ports) {
             window: 'hour',
         }, now);
         if (!perAddress.allowed) {
-            return refuse(429, 'address_session_budget_exhausted', 'assistant is unavailable right now');
+            return refuse(429, 'address_session_budget_exhausted', 'assistant is unavailable right now', embed);
         }
     }
     const mints = await ports.counters.consume({ key: `mints:${embed.embedId}`, limit: surfaceLimits.mintsPerDay }, now);
     if (!mints.allowed) {
         // Distinct from a hard error: the widget renders this calmly, and an operator sees a surface that
         // is switched off (limit 0) or spent, not a broken embed.
-        return refuse(429, 'daily_session_budget_exhausted', 'assistant is unavailable right now');
+        return refuse(429, 'daily_session_budget_exhausted', 'assistant is unavailable right now', embed);
     }
     const session = await ports.createSession({
         embed,

package/node_modules/@noodle-borg/assistant-gateway/dist/public-turn.js

@@ -125,6 +125,28 @@ export async function admitPublicTurn(request, defaults, ports) {
             message: 'assistant is unavailable right now',
         };
     }
+    // Platform spend last, when someone other than the customer is paying. Every counter here is
+    // all-or-nothing with no refund, so whichever runs first is charged for turns the ones after it
+    // refuse — and a session ending at its length limit is ordinary traffic, many times a day, while
+    // spend exhaustion is rare and for one day only. Charging the sponsor for every visitor's last
+    // turn is the worse of the two leaks, so this is the counter that goes last.
+    //
+    // It reports the surface's own exhaustion code on purpose: every published widget already treats
+    // `daily_turn_budget_exhausted` as final, and a new code would be read as retryable by all of them
+    // — precisely the load this ceiling exists to refuse. At the ladder's closing rung the surface
+    // ceiling is already zero, so that refusal arrives above; this is the backstop between rungs.
+    if (budgetBounds?.spend !== undefined) {
+        const { key, units, allowance } = budgetBounds.spend;
+        const spend = await ports.counters.consume({ key, limit: allowance, amount: units }, ports.now());
+        if (!spend.allowed) {
+            return {
+                ok: false,
+                status: 429,
+                code: 'daily_turn_budget_exhausted',
+                message: 'assistant is unavailable right now',
+            };
+        }
+    }
     return { ok: true, turnCount: session.turnCount };
 }
 export async function admitBridgeToolCall(request, defaults, ports) {

package/node_modules/@noodle-borg/assistant-gateway/dist/surface-budget.d.ts

@@ -4,6 +4,20 @@ import type { PublicEmbedRecord } from './embed-store.js';
 export interface SurfaceBudgetBounds {
     readonly defaults: Pick<AdmissionEnvelope, 'turnsPerSession' | 'turnsPerDay' | 'mintsPerDay'>;
     readonly ceiling: Pick<AdmissionEnvelope, 'turnsPerDay' | 'mintsPerDay'>;
+    /**
+     * Platform spend accounting for this turn, present only when someone other than the customer is
+     * paying. Absent means customer-funded, and nothing is charged.
+     *
+     * `units` is what this turn costs at the tenant's current rung and `allowance` is its ceiling for
+     * the day; the ladder that produces both lives in `managed-spend.ts`. The ceilings above remain the
+     * primary mechanism — this counter is the exact backstop for the window in which a cached rung
+     * read still says "plenty left".
+     */
+    readonly spend?: {
+        readonly key: string;
+        readonly units: number;
+        readonly allowance: number;
+    };
 }
 /**
  * One surface's daily budget, resolved from the operator's override and the deployment's defaults.
@@ -17,5 +31,5 @@ export interface SurfaceBudgetBounds {
  * operator any more than by app code, so an over-eager `--turns-per-day 999999999` degrades to the
  * ceiling instead of becoming the ceiling. Zero survives clamping and is the kill switch.
  */
-export declare function surfaceEnvelope(base: AdmissionEnvelope, embed: Pick<PublicEmbedRecord, 'turnsPerDay' | 'mintsPerDay'>, bounds?: SurfaceBudgetBounds): AdmissionEnvelope;
+export declare function surfaceEnvelope(base: AdmissionEnvelope, embed: Pick<PublicEmbedRecord, 'turnsPerDay' | 'mintsPerDay' | 'mintsPerAddressHour' | 'turnsPerAddressHour' | 'bridgeToolCallsPerSession' | 'bridgeToolCallsPerDay'>, bounds?: SurfaceBudgetBounds): AdmissionEnvelope;
 //# sourceMappingURL=surface-budget.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/surface-budget.js

@@ -17,6 +17,30 @@ export function surfaceEnvelope(base, embed, bounds) {
         ...effectiveBase,
         ...(embed.turnsPerDay !== undefined ? { turnsPerDay: embed.turnsPerDay } : {}),
         ...(embed.mintsPerDay !== undefined ? { mintsPerDay: embed.mintsPerDay } : {}),
+        // The per-address bounds carry no hosted ceiling, because they govern abuse rather than spend —
+        // so the deployed default is what caps them, and an operator may only lower it. A surface that
+        // could raise its own abuse bound toward the structural maximum would be turning the bound off
+        // for everyone behind one address, which is not a budget an operator gets to spend.
+        ...(embed.mintsPerAddressHour !== undefined
+            ? {
+                mintsPerAddressHour: Math.min(embed.mintsPerAddressHour, effectiveBase.mintsPerAddressHour),
+            }
+            : {}),
+        ...(embed.turnsPerAddressHour !== undefined
+            ? {
+                turnsPerAddressHour: Math.min(embed.turnsPerAddressHour, effectiveBase.turnsPerAddressHour),
+            }
+            : {}),
+        // The bridge bounds are the operator's to spend in either direction, like the daily caps and
+        // unlike the per-address ones: they govern this surface's own agent traffic against its own
+        // connectors, not a bound shared with everyone behind one address. `clamp` still holds them
+        // under the structural maximum.
+        ...(embed.bridgeToolCallsPerSession !== undefined
+            ? { bridgeToolCallsPerSession: embed.bridgeToolCallsPerSession }
+            : {}),
+        ...(embed.bridgeToolCallsPerDay !== undefined
+            ? { bridgeToolCallsPerDay: embed.bridgeToolCallsPerDay }
+            : {}),
     });
     if (bounds === undefined)
         return requested;

package/node_modules/@noodle-borg/assistant-gateway/package.json

@@ -41,7 +41,7 @@
     "@noodle-borg/module": "0.0.0",
     "@noodle-borg/protocol": "0.0.0",
     "@noodle-borg/runtime": "0.0.0",
-    "@noodleseed/assistant": "1.28.0",
+    "@noodleseed/assistant": "1.30.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/node_modules/@noodle-borg/authoring/dist/assistant.d.ts

@@ -168,12 +168,20 @@ export interface AuthenticatedWebsiteAccess {
     /** Allowlist of verified session claims; undeclared claims are dropped at session exchange. */
     readonly sessionClaims?: Readonly<Record<string, SessionClaimDeclaration>>;
     readonly capabilities?: readonly CapabilityRef[];
+    /** @see AuthenticatedWebsiteInput.webmcp */
+    readonly webmcp?: {
+        readonly enabled?: boolean;
+    };
 }
 export interface PublicWebsiteAccess {
     readonly mode: 'public' | 'mixed';
     readonly origins: readonly string[];
     readonly capabilities: readonly CapabilityRef[];
     readonly instructions?: string;
+    /** @see AuthenticatedWebsiteInput.webmcp */
+    readonly webmcp?: {
+        readonly enabled?: boolean;
+    };
 }
 export type AssistantAccess = AuthenticatedWebsiteAccess | PublicWebsiteAccess;
 export interface AuthenticatedWebsiteInput {
@@ -183,6 +191,19 @@ export interface AuthenticatedWebsiteInput {
     readonly sessionClaims?: Readonly<Record<string, SessionClaimDeclaration>>;
     /** Optional narrowing; omitted means the signed-in surface projects the whole server. */
     readonly capabilities?: readonly CapabilityRef[];
+    /**
+     * Override this assistant's WebMCP opt-in for sessions minted on this surface, in either
+     * direction (ADR 0220, amended). Omitted inherits the assistant's value.
+     *
+     * It governs **discovery**: whether the embed registers this session's tools with
+     * `document.modelContext`, and so whether a browser agent learns they exist. It is not a second
+     * authorization boundary — every call the bridge makes already carries exactly this session's
+     * authority. A deployment serving a marketing page and a signed-in app usually has two honest
+     * answers, which one switch cannot express.
+     */
+    readonly webmcp?: {
+        readonly enabled?: boolean;
+    };
 }
 export interface PublicWebsiteInput {
     readonly origins: readonly (string | ConfigRef)[];
@@ -201,6 +222,10 @@ export interface PublicWebsiteInput {
      * never operates one — and its backend completes the exchange.
      */
     readonly signIn?: boolean;
+    /** @see AuthenticatedWebsiteInput.webmcp */
+    readonly webmcp?: {
+        readonly enabled?: boolean;
+    };
 }
 export declare function authenticatedWebsite(input: AuthenticatedWebsiteInput): AuthenticatedWebsiteAccess;
 export declare function publicWebsite(input: PublicWebsiteInput): PublicWebsiteAccess;
@@ -213,8 +238,7 @@ export interface EmbeddedAssistantOptions extends AssistantUiOptions {
      * page's WebMCP API. Off unless set. Calls carry exactly the embed session's authority and take the
      * same authorization, limits, confirmation, and audit path as the assistant's own — see ADR 0220.
      *
-     * Deployment-wide on purpose: it decides which callers may reach the server's tools, which is
-     * surface authority rather than presentation, so it is not refinable per surface.
+     * The default for every surface, which any surface may override in either direction.
      */
     readonly webmcp?: {
         readonly enabled?: boolean;
@@ -227,6 +251,10 @@ export interface AssistantSurfaceConfig {
     readonly instructions?: string;
     readonly capabilities?: readonly AssistantCapability[];
     readonly sessionClaims?: Readonly<Record<string, SessionClaimDeclaration>>;
+    /** @see AuthenticatedWebsiteInput.webmcp */
+    readonly webmcp?: {
+        readonly enabled?: boolean;
+    };
 }
 export interface EmbeddedAssistantConfig extends AssistantUiOptions {
     readonly model: AssistantModel;
@@ -238,7 +266,7 @@ export interface EmbeddedAssistantConfig extends AssistantUiOptions {
     readonly allowedOrigins: readonly string[];
     /** Mirrored from the authenticated surface, for the same reason. */
     readonly sessionClaims?: Readonly<Record<string, SessionClaimDeclaration>>;
-    /** @see EmbeddedAssistantOptions.webmcp — deployment-wide, never per surface. */
+    /** @see EmbeddedAssistantOptions.webmcp — the default each surface may override. */
     readonly webmcp?: {
         readonly enabled?: boolean;
     };

package/node_modules/@noodle-borg/authoring/dist/assistant.js

@@ -6,6 +6,7 @@ export function authenticatedWebsite(input) {
         ...(input.instructions === undefined ? {} : { instructions: input.instructions }),
         ...(input.sessionClaims ? { sessionClaims: structuredClone(input.sessionClaims) } : {}),
         ...(input.capabilities ? { capabilities: [...input.capabilities] } : {}),
+        ...(input.webmcp === undefined ? {} : { webmcp: { ...input.webmcp } }),
     };
 }
 export function publicWebsite(input) {
@@ -14,6 +15,7 @@ export function publicWebsite(input) {
         origins: serializeOrigins(input.origins, 'assistant.access.origins'),
         capabilities: [...input.capabilities],
         ...(input.instructions === undefined ? {} : { instructions: input.instructions }),
+        ...(input.webmcp === undefined ? {} : { webmcp: { ...input.webmcp } }),
     };
 }
 function serializeOrigins(origins, path) {
@@ -56,6 +58,7 @@ export function embeddedAssistant(input) {
             ...(surface.mode === 'authenticated' && surface.sessionClaims
                 ? { sessionClaims: structuredClone(surface.sessionClaims) }
                 : {}),
+            ...(surface.webmcp === undefined ? {} : { webmcp: { ...surface.webmcp } }),
         })),
         allowedOrigins: surfaces.flatMap((surface) => [...surface.origins]),
         ...structuredClone(ui),