@noodleseed/one 0.148.0 → 0.150.0

package/node_modules/@noodle-borg/service/dist/routes/assistant-agent.js

@@ -1,6 +1,6 @@
 import { ADMISSION_DEFAULTS } from '@noodle-borg/admission-limits/portable';
 import { assistantCoreModelMessages, assistantTurnModelContextMessages, requestAssistantSuggestedPrompts, requestModelCompletion, resolveAssistantContextProviderModelResult, } from '@noodle-borg/assistant-gateway/model-runtime';
-import { assistantGuideModelContext, assistantModelToolOncePerSession, assistantModelToolRequiredWhenVisible, assistantViewAvailableData, dispatchAssistantTool, projectAssistantGuide, publicSurfaceOf, selectAssistantModelTools, toolTouchesDelegatedAuth, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
+import { assistantGuideModelContext, assistantModelToolOncePerSession, assistantModelToolRequiredWhenVisible, assistantOmittedToolResult, assistantViewAvailableData, dispatchAssistantTool, projectAssistantGuide, publicSurfaceOf, selectAssistantModelTools, toolTouchesDelegatedAuth, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
 import { validateJsonSchemaWithDefaults } from '@noodle-borg/compiler';
 import { guardedFetch } from '@noodle-borg/connector-http';
 import { evaluateToolAuthorization } from '@noodle-borg/protocol';
@@ -8,6 +8,19 @@ import { interceptForElevation, offersSignIn } from './assistant-elevation.js';
 import { assistantKnowledgeModelTools, executeAssistantKnowledgeSearch, findAssistantKnowledgeComponent, KNOWLEDGE_CITATION_GUIDANCE, resolveAssistantKnowledge, } from './assistant-knowledge.js';
 import { resolveAssistantModelBinding } from './assistant-model-binding.js';
 const MAX_MODEL_RESPONSE = 1 << 20;
+/**
+ * The agent-loop bounds come from the admission envelope so an operator lowering them changes
+ * behaviour. They used to be a constant here that happened to equal the envelope's default, which
+ * meant the envelope documented a limit it did not control.
+ */
+function agentBounds(deps, policy) {
+    const { modelStepsPerTurn, toolCallsPerTurn } = deps.admissionEnvelope ?? ADMISSION_DEFAULTS;
+    // A per-tenant policy narrows a turn; it can never widen one, so the envelope wins when lower.
+    return {
+        steps: Math.min(modelStepsPerTurn, policy?.maxModelStepsPerTurn ?? modelStepsPerTurn),
+        toolCalls: Math.min(toolCallsPerTurn, policy?.maxToolCallsPerTurn ?? toolCallsPerTurn),
+    };
+}
 export function createAssistantTurnStats() {
     return {
         modelRequests: 0,
@@ -21,9 +34,12 @@ export function createAssistantTurnStats() {
 }
 /** Run one model/tool loop against the immutable invocation-context snapshot for this turn. */
 export async function runAgentTurn(target, session, message, context, deps, emit, modelContext, pageContext, stats = createAssistantTurnStats(), suggestions = false) {
+    // Every terminal failure in this loop is one shape: a code, and the turn ends. Naming it keeps the
+    // dozen sites readable and stops a new one inventing a different envelope.
+    const fail = (code) => emit({ event: 'error', data: { code } });
     const assistant = target.served.artifact.server.assistant;
     if (!assistant)
-        return emit({ event: 'error', data: { code: 'assistant_unavailable' } });
+        return fail('assistant_unavailable');
     const binding = await resolveAssistantModelBinding(target, session.tenant, session.deploymentId, deps);
     if (!binding) {
         return emit({
@@ -35,12 +51,18 @@ export async function runAgentTurn(target, session, message, context, deps, emit
             },
         });
     }
-    const knowledge = await resolveAssistantKnowledge(target.served);
-    let modelTools = selectTurnModelTools(target, session.caller, message, session.modelToolUses);
+    // Zero means offer none, from every source — not "call one and meet `tool_call_budget_exhausted`".
+    // A required tool and a knowledge tool each reach the model by their own path, so silencing only
+    // the ordinary ones would still advertise a tool the turn can never run.
+    const bounds = agentBounds(deps, binding.requestPolicy);
+    const toolless = bounds.toolCalls === 0;
+    const knowledge = toolless ? undefined : await resolveAssistantKnowledge(target.served);
+    let modelTools = toolless
+        ? []
+        : selectTurnModelTools(target, session.caller, message, session.modelToolUses);
     const requiredTools = modelTools.filter(assistantModelToolRequiredWhenVisible);
-    if (requiredTools.length > 1) {
-        return emit({ event: 'error', data: { code: 'multiple_required_model_tools' } });
-    }
+    if (requiredTools.length > 1)
+        return fail('multiple_required_model_tools');
     let requiredTool = requiredTools[0];
     const guideProjection = projectAssistantGuide({
         appPackage: target.served.appPackageSnapshot?.artifact,
@@ -73,19 +95,17 @@ export async function runAgentTurn(target, session, message, context, deps, emit
         ...session.history,
         { role: 'user', content: message },
     ];
-    const envelope = deps.admissionEnvelope ?? ADMISSION_DEFAULTS;
-    const bounds = { steps: envelope.modelStepsPerTurn, toolCalls: envelope.toolCallsPerTurn };
     // Across every step of this turn, not per step: eight tool calls is eight, however the model splits
     // them, or a model that loops one call per step would spend the budget a step at a time.
     let toolCallsThisTurn = 0;
+    let omittedToolRecoveries = 0;
     let remainingTokens = binding.requestPolicy?.maxTokensPerTurn;
     const turnSignal = binding.requestPolicy?.maxTurnMs === undefined
         ? undefined
         : AbortSignal.timeout(binding.requestPolicy.maxTurnMs);
     for (let step = 0; step < bounds.steps; step += 1) {
-        if (remainingTokens !== undefined && remainingTokens <= 0) {
-            return emit({ event: 'error', data: { code: 'model_token_budget_exhausted' } });
-        }
+        if (remainingTokens !== undefined && remainingTokens <= 0)
+            return fail('model_token_budget_exhausted');
         const requestTokenLimit = Math.min(binding.requestPolicy?.maxCompletionTokens ?? Number.MAX_SAFE_INTEGER, remainingTokens ?? Number.MAX_SAFE_INTEGER);
         const requiredToolForStep = requiredTool;
         const stepModelTools = requiredToolForStep === undefined ? modelTools : [requiredToolForStep];
@@ -106,12 +126,11 @@ export async function runAgentTurn(target, session, message, context, deps, emit
         }
         const response = completion.choices[0]?.message;
         if (!response)
-            return emit({ event: 'error', data: { code: 'invalid_model_response' } });
+            return fail('invalid_model_response');
         if (requiredToolForStep !== undefined &&
             (response.tool_calls?.length !== 1 ||
-                response.tool_calls[0]?.function.name !== requiredToolForStep.name)) {
-            return emit({ event: 'error', data: { code: 'required_model_tool_missing' } });
-        }
+                response.tool_calls[0]?.function.name !== requiredToolForStep.name))
+            return fail('required_model_tool_missing');
         if (!response.tool_calls?.length) {
             const assistantContent = response.content || streamedContent;
             if (assistantContent)
@@ -141,9 +160,8 @@ export async function runAgentTurn(target, session, message, context, deps, emit
         for (const call of response.tool_calls) {
             toolCallsThisTurn += 1;
             stats.toolCalls += 1;
-            if (toolCallsThisTurn > bounds.toolCalls) {
-                return emit({ event: 'error', data: { code: 'tool_call_budget_exhausted' } });
-            }
+            if (toolCallsThisTurn > bounds.toolCalls)
+                return fail('tool_call_budget_exhausted');
             const knowledgeComponent = findAssistantKnowledgeComponent(knowledge, call.function.name);
             if (knowledge !== undefined && knowledgeComponent !== undefined) {
                 let knowledgeArgs;
@@ -151,7 +169,7 @@ export async function runAgentTurn(target, session, message, context, deps, emit
                     knowledgeArgs = JSON.parse(call.function.arguments);
                 }
                 catch {
-                    return emit({ event: 'error', data: { code: 'invalid_tool_arguments' } });
+                    return fail('invalid_tool_arguments');
                 }
                 emit({ event: 'tool_started', data: { id: call.id, tool: call.function.name } });
                 messages.push({
@@ -163,7 +181,19 @@ export async function runAgentTurn(target, session, message, context, deps, emit
             }
             const tool = stepModelTools.find((candidate) => candidate.name === call.function.name);
             if (!tool) {
-                return emit({ event: 'error', data: { code: 'invalid_model_tool_call' } });
+                // Tell the model rather than ending the turn on a bare error; `assistantOmittedToolResult`
+                // carries the reasoning. Once per turn: a model that insists after being told is the
+                // protocol violation the error code exists for, and it stops paying for extra steps.
+                if (omittedToolRecoveries > 0)
+                    return fail('invalid_model_tool_call');
+                omittedToolRecoveries += 1;
+                modelTools = [];
+                messages.push({
+                    role: 'tool',
+                    tool_call_id: call.id,
+                    content: assistantOmittedToolResult(call.function.name),
+                });
+                continue;
             }
             // A mixed surface turns "denied" into "sign in first". The intercept runs BEFORE the
             // authorization denial — an ADR 0185-gated tool is exactly what an anonymous visitor signs
@@ -195,22 +225,20 @@ export async function runAgentTurn(target, session, message, context, deps, emit
                 });
                 continue;
             }
-            if (!evaluateToolAuthorization(tool.authorization, session.caller).allow) {
-                return emit({ event: 'error', data: { code: 'invalid_model_tool_call' } });
-            }
+            if (!evaluateToolAuthorization(tool.authorization, session.caller).allow)
+                return fail('invalid_model_tool_call');
             let args;
             try {
                 args = JSON.parse(call.function.arguments);
             }
             catch {
-                return emit({ event: 'error', data: { code: 'invalid_tool_arguments' } });
+                return fail('invalid_tool_arguments');
             }
             // Validate AND apply schema defaults; the pending record and the execution below both use
             // the coerced copy, so the confirmed call equals the executed call (roadmap S5).
             const coerced = validateJsonSchemaWithDefaults(tool.inputSchema, args);
-            if (coerced.issues.length > 0) {
-                return emit({ event: 'error', data: { code: 'invalid_tool_arguments' } });
-            }
+            if (coerced.issues.length > 0)
+                return fail('invalid_tool_arguments');
             args = coerced.value;
             const dispatch = await dispatchAssistantTool({
                 artifact: target.served.artifact,
@@ -250,7 +278,7 @@ export async function runAgentTurn(target, session, message, context, deps, emit
             });
         }
     }
-    emit({ event: 'error', data: { code: 'step_limit' } });
+    fail('step_limit');
 }
 /** Generate an initial prompt set from the same exact surface/context assembly as an ordinary turn. */
 export async function generateInitialAssistantSuggestions(target, session, context, deps, modelContext, pageContext) {

package/node_modules/@noodle-borg/service/dist/routes/assistant-embeds.js

@@ -1,8 +1,19 @@
 import { ADMISSION_DEFAULTS, clamp } from '@noodle-borg/admission-limits/portable';
-import { publicSurfaceOf, surfaceEnvelope } from '@noodle-borg/assistant-gateway/portable';
+import { assistantEmbedOperatorView, parsePublicEmbedBudget, publicSurfaceOf, surfaceEnvelope, } from '@noodle-borg/assistant-gateway/portable';
 import { readJsonBody, sendForbidden, sendJson } from '../http-util.js';
 import { now } from './assistant-route-http.js';
 import { authorizeControlPlane } from './control-plane.js';
+/**
+ * The operator's view of a tenant's public surfaces, and the one control over them.
+ *
+ * `PATCH` sets the daily caps; `--turns-per-day 0` is the kill switch, and it is deliberately the only
+ * documented one. Revoking an embed would also stop a surface, but it destroys the paste-once id and
+ * every page carrying it, so it stays an exceptional action rather than the routine off-switch.
+ *
+ * Origins, capabilities, and surfaceMode are read from the *active* deployment rather than the embed
+ * row, so what an operator sees here is what a browser will actually be held to at mint time (the row
+ * keeps its provisioning-time mode by design — `ensure` never overwrites a live row).
+ */
 export async function handleAssistantEmbeds(req, res, tenant, embedId, deps) {
     const identity = await authorizeControlPlane(req, res, deps.gate, { requireIdentity: false });
     if (identity === false)
@@ -30,7 +41,7 @@ export async function handleAssistantEmbeds(req, res, tenant, embedId, deps) {
         const body = await readJsonBody(req, deps.maxBody);
         if (!body.ok)
             return sendJson(res, body.status, { error: body.error });
-        const budget = parseBudget(body.value);
+        const budget = parsePublicEmbedBudget(body.value);
         if (!budget.ok)
             return sendJson(res, 400, { error: budget.error });
         const updated = await embeds.setBudget(embedId, budget.value, now(deps));
@@ -46,44 +57,21 @@ export async function handleAssistantEmbeds(req, res, tenant, embedId, deps) {
     res.setHeader('Allow', embedId === undefined ? 'GET' : 'PATCH');
     return sendJson(res, 405, { error: 'method not allowed' });
 }
-function parseBudget(body) {
-    const { turnsPerDay, mintsPerDay } = body;
-    const value = {};
-    for (const [name, raw] of [
-        ['turnsPerDay', turnsPerDay],
-        ['mintsPerDay', mintsPerDay],
-    ]) {
-        if (raw === undefined)
-            continue;
-        // Zero is valid and is the point; anything negative or fractional is a mistake worth saying out
-        // loud rather than silently flooring, because an operator setting a cap is being deliberate.
-        if (typeof raw !== 'number' || !Number.isInteger(raw) || raw < 0) {
-            return { ok: false, error: `"${name}" must be a non-negative integer` };
-        }
-        value[name] = raw;
-    }
-    if (Object.keys(value).length === 0) {
-        return { ok: false, error: 'set at least one of "turnsPerDay" or "mintsPerDay"' };
-    }
-    return { ok: true, value };
-}
 async function view(record, tenant, defaults, deps, counters) {
     const target = await deps.registry.getActiveByTenant(tenant);
-    const surface = publicSurfaceOf(target?.served.artifact.server.assistant);
-    // Clamped even for the pure-default case, so what an operator reads is what admission will enforce.
-    const envelope = surfaceEnvelope(clamp(defaults), record);
     const at = now(deps);
-    return {
-        embedId: record.embedId,
-        surfaceMode: surface?.mode ?? record.surfaceMode,
-        origins: surface?.origins ?? [],
-        capabilities: surface?.capabilities.map((entry) => entry.name) ?? [],
-        turnsPerDay: envelope.turnsPerDay,
-        mintsPerDay: envelope.mintsPerDay,
-        budgetIsDefault: record.turnsPerDay === undefined && record.mintsPerDay === undefined,
-        turnsToday: await counters.peek(`turns:${record.embedId}`, at),
-        mintsToday: await counters.peek(`mints:${record.embedId}`, at),
-        createdAt: record.createdAt.toISOString(),
-    };
+    // The same bounds admission resolves, not the bare defaults: a sponsored surface enforces the
+    // hosted envelope, and reporting the unsponsored one told an operator a number nothing honours.
+    const deploymentId = target?.deploymentId ?? '';
+    const bounds = (await deps.managedModelResolver?.resolve({ tenant, deploymentId }))
+        ?.publicAdmission;
+    return assistantEmbedOperatorView({
+        record,
+        surface: publicSurfaceOf(target?.served.artifact.server.assistant),
+        // Clamped even for the pure-default case, so what an operator reads is what admission enforces.
+        envelope: surfaceEnvelope(clamp(defaults), record, bounds),
+        peek: (key) => counters.peek(key, at),
+        ...(bounds?.spend === undefined ? {} : { spend: bounds.spend }),
+    });
 }
 //# sourceMappingURL=assistant-embeds.js.map

package/node_modules/@noodle-borg/service/dist/routes/assistant-interaction-resolution.js

@@ -1,5 +1,4 @@
-import { withAssistantSessionExecutionAuthority } from '@noodle-borg/assistant-gateway/portable';
-import { resolveInvocationContextSnapshot } from '../invocation-context.js';
+import { resolveInvocationContextSnapshot, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
 import { now } from './assistant.js';
 export function assistantInteractionScope(id, session, instant) {
     return {

package/node_modules/@noodle-borg/service/dist/routes/assistant-model-binding.js

@@ -5,10 +5,7 @@ export async function resolveAssistantModelBinding(target, tenant, deploymentId,
     if (declaration === undefined)
         return undefined;
     if (declaration.kind === 'noodle-managed') {
-        return deps.managedModelResolver?.resolve({
-            tenant,
-            deploymentId,
-        });
+        return deps.managedModelResolver?.resolve({ tenant, deploymentId });
     }
     const scope = resolveConfigScope(tenant);
     const [variables, secrets] = await Promise.all([

package/node_modules/@noodle-borg/service/dist/routes/assistant-public-configuration.js

@@ -29,7 +29,7 @@ export async function handlePublicAssistantConfiguration(req, res, embedId, deps
     if (target === undefined) {
         return sendJson(res, 409, { error: 'assistant deployment is unavailable' });
     }
-    const resolved = await effectiveAssistantBrowserConfiguration(target.served.artifact.server, publicEmbedTenant(authorized.embed), deps.appearance);
+    const resolved = await effectiveAssistantBrowserConfiguration(target.served.artifact.server, publicEmbedTenant(authorized.embed), deps.appearance, 'public');
     applyBrowserCors(req, res, origin);
     res.setHeader('cache-control', 'private, no-cache');
     return sendJson(res, 200, {

package/node_modules/@noodle-borg/service/dist/routes/assistant-public-session.js

@@ -1,7 +1,7 @@
 import { randomBytes } from 'node:crypto';
 import { ADMISSION_DEFAULTS, clientAddressBucket } from '@noodle-borg/admission-limits/portable';
 import { effectiveAssistantBrowserConfiguration, mintPublicSession, publicEmbedTenant, publicSurfaceOf, } from '@noodle-borg/assistant-gateway/portable';
-import { assistantSessionUsageRequestEvent, captureAssistantUsage, } from '@noodle-borg/observability';
+import { assistantSessionUsageRequestEvent, captureAssistantUsage, captureRefusedAssistantSession, } from '@noodle-borg/observability';
 import { assistantSessionResponseSchema } from '@noodle-borg/wire-contracts';
 import { readJsonBody, sendJson } from '../http-util.js';
 import { applyBrowserCors, assistantSessionEndpoints, now } from './assistant-route-http.js';
@@ -25,7 +25,7 @@ export async function handlePublicAssistantSession(req, res, deps) {
     const body = await readJsonBody(req, deps.maxBody);
     if (!body.ok)
         return sendJson(res, body.status, { error: body.error });
-    const { embedId } = body.value;
+    const { embedId, visitorId } = body.value;
     // The browser's Origin header is the claim under test. The body never asserts its own origin.
     const origin = typeof req.headers.origin === 'string' ? req.headers.origin : undefined;
     // Admission tier 3. Hashed here so no raw address crosses into the decision, a counter key, or an
@@ -36,7 +36,7 @@ export async function handlePublicAssistantSession(req, res, deps) {
     let configuration;
     let sponsoredBudget;
     let usageSession;
-    const result = await mintPublicSession({ embedId, origin, ...(addressBucket ? { addressBucket } : {}) }, deps.admissionEnvelope ?? ADMISSION_DEFAULTS, {
+    const result = await mintPublicSession({ embedId, visitorId, origin, ...(addressBucket ? { addressBucket } : {}) }, deps.admissionEnvelope ?? ADMISSION_DEFAULTS, {
         embeds,
         counters,
         resolveActiveSurface: async (embed) => {
@@ -59,7 +59,7 @@ export async function handlePublicAssistantSession(req, res, deps) {
             if (!target?.deploymentId)
                 throw new Error('assistant deployment vanished mid-mint');
             const current = now(deps);
-            configuration = (await effectiveAssistantBrowserConfiguration(target.served.artifact.server, publicEmbedTenant(input.embed), deps.appearance)).effective;
+            configuration = (await effectiveAssistantBrowserConfiguration(target.served.artifact.server, publicEmbedTenant(input.embed), deps.appearance, 'public')).effective;
             const created = await deps.store.createSession({
                 // A public surface has no client credential, so the embed id stands in as the minting
                 // authority. It is not a secret and nothing downstream may begin treating it as one.
@@ -86,6 +86,10 @@ export async function handlePublicAssistantSession(req, res, deps) {
         now: () => now(deps),
     });
     if (!result.ok) {
+        // A refusal the surface owns is usage. Without it an operator whose visitors are being turned
+        // away sees a healthy-looking page; which refusals count is the helper's decision, not this one's.
+        const refusedIn = performance.now() - usageStartedAt;
+        captureRefusedAssistantSession(deps.captureRequestEvent, result, refusedIn);
         return sendJson(res, result.status, { error: result.message, code: result.code });
     }
     // Only here, with the origin proven against the live surface, may the page read the response.

package/node_modules/@noodle-borg/service/dist/routes/assistant-suggestions.js

@@ -1,8 +1,7 @@
 import { ADMISSION_DEFAULTS } from '@noodle-borg/admission-limits/portable';
-import { parseAssistantContextPreferences, surfaceEnvelope, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
+import { parseAssistantContextPreferences, resolveInvocationContextSnapshot, surfaceEnvelope, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
 import { assistantSuggestionsRequestSchema } from '@noodle-borg/wire-contracts';
 import { readJsonBody, sendJson } from '../http-util.js';
-import { resolveInvocationContextSnapshot } from '../invocation-context.js';
 import { generateInitialAssistantSuggestions } from './assistant-agent.js';
 import { applyBrowserCors, authenticateSession, now } from './assistant-route-http.js';
 import { sessionScopedTarget } from './assistant-session-target.js';

package/node_modules/@noodle-borg/service/dist/routes/assistant.js

@@ -1,15 +1,13 @@
 import { clientAddressBucket, } from '@noodle-borg/admission-limits/portable';
 import { assistantModelFailure, assistantModelSource, assistantModelTransport, } from '@noodle-borg/assistant-gateway/model-runtime';
-import { ASSISTANT_SESSION_IDLE_MS, dispatchAssistantTool, effectiveAssistantBrowserConfiguration, isAssistantPageContext, isAssistantVerifiedClaims, parseAssistantContextPreferences, parseAssistantCustomerRouting, refuseBridgeToolCall, refusePublicTurn, resumeTurnMessage, resumeUnavailableMessage, shouldAutoResume, surfaceBindingForOrigin, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
+import { ASSISTANT_SESSION_IDLE_MS, effectiveAssistantBrowserConfiguration, executeAssistantAppToolCall, isAssistantPageContext, isAssistantVerifiedClaims, parseAssistantContextPreferences, parseAssistantCustomerRouting, refuseBridgeToolCall, refusePublicTurn, resolveInvocationContextSnapshot, resumeTurnMessage, resumeUnavailableMessage, shouldAutoResume, surfaceBindingForOrigin, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
 import { canonicalizeAuthorizationClaimValues } from '@noodle-borg/auth';
-import { validateJsonSchemaWithDefaults } from '@noodle-borg/compiler';
 import { tenantMcpUrl } from '@noodle-borg/module';
-import { assistantRefusedTurnUsageRequestEvent, assistantSessionUsageRequestEvent, assistantTurnNumber, assistantTurnUsageRequestEvent, captureAssistantUsage, } from '@noodle-borg/observability';
-import { evaluateToolAuthorization, mapExecutionError, mapResourceContents, mapResourcesList, mapToolOutput, mapToolsList, } from '@noodle-borg/protocol';
+import { assistantAppToolCallRequestEvent, assistantRefusedTurnUsageRequestEvent, assistantSessionUsageRequestEvent, assistantTurnNumber, assistantTurnUsageRequestEvent, captureAssistantUsage, } from '@noodle-borg/observability';
+import { mapExecutionError, mapResourceContents, mapResourcesList, mapToolOutput, mapToolsList, } from '@noodle-borg/protocol';
 import { executeResource } from '@noodle-borg/runtime';
 import { assistantMessageTurnRequestSchema, assistantResumeTurnRequestSchema, assistantSessionResponseSchema, } from '@noodle-borg/wire-contracts';
 import { readJsonBody, sendForbidden, sendJson, sendUnauthorized } from '../http-util.js';
-import { resolveInvocationContextSnapshot } from '../invocation-context.js';
 import { createAssistantTurnStats, runAgentTurn } from './assistant-agent.js';
 import { elevateAssistantSession } from './assistant-elevation.js';
 import { executeAssistantKnowledgeSearch, findAssistantKnowledgeComponent, resolveAssistantKnowledge, } from './assistant-knowledge.js';
@@ -99,7 +97,7 @@ export async function handleAssistantSession(req, res, deps) {
     const declaredClaims = assistant.sessionClaims ?? {};
     const claims = Object.fromEntries(Object.entries(isAssistantVerifiedClaims(parsed.claims) ? parsed.claims : {}).filter(([key]) => key in declaredClaims));
     const current = now(deps);
-    const configuration = (await effectiveAssistantBrowserConfiguration(target.served.artifact.server, client.tenant, deps.appearance)).effective;
+    const configuration = (await effectiveAssistantBrowserConfiguration(target.served.artifact.server, client.tenant, deps.appearance, surfaceBinding.kind === 'pre-surfaces' ? undefined : surfaceBinding.kind)).effective;
     const roles = canonicalizeAuthorizationClaimValues(parsed.user.roles, 'role');
     const scopes = canonicalizeAuthorizationClaimValues(parsed.user.scopes, 'scope');
     // Hoisted so an elevation and a fresh exchange bind the *same* principal. Two constructions would be
@@ -174,6 +172,16 @@ export async function handleAssistantSession(req, res, deps) {
     captureAssistantUsage(deps.captureRequestEvent, assistantSessionUsageRequestEvent(session.session, performance.now() - usageStartedAt));
     return sendJson(res, 201, sessionBody);
 }
+/**
+ * Both turn entries — a resume and a typed message — refuse identically: the refusal is spent
+ * budget, so it is recorded against the surface before the caller is told no. Kept in one place so
+ * the two entries cannot drift into recording it differently.
+ */
+function refuseTurn(deps, res, session, refusal, usageStartedAt) {
+    const durationMs = performance.now() - usageStartedAt;
+    captureAssistantUsage(deps.captureRequestEvent, assistantRefusedTurnUsageRequestEvent(session, refusal.code, durationMs));
+    sendJson(res, refusal.status, { error: refusal.message, code: refusal.code });
+}
 export async function handleAssistantTurn(req, res, deps) {
     const usageStartedAt = performance.now();
     const session = await authenticateSession(req, res, deps);
@@ -201,10 +209,8 @@ export async function handleAssistantTurn(req, res, deps) {
         }
         suggestionsRequested = resumeResult.data.suggestions === true;
         const refusal = await refusePublicTurn(deps, session, 'resume', addressBucket);
-        if (refusal) {
-            captureAssistantUsage(deps.captureRequestEvent, assistantRefusedTurnUsageRequestEvent(session, refusal.code, performance.now() - usageStartedAt));
-            return sendJson(res, refusal.status, { error: refusal.message, code: refusal.code });
-        }
+        if (refusal)
+            return refuseTurn(deps, res, session, refusal, usageStartedAt);
         const pending = await deps.store.consumePendingResume(session.id);
         if (!pending) {
             return sendJson(res, 409, {
@@ -252,10 +258,8 @@ export async function handleAssistantTurn(req, res, deps) {
         // Admission before any metered work (ADR 0201 §8): ahead of the deployment read and well ahead
         // of the model, so a refused turn costs the customer nothing.
         const refusal = await refusePublicTurn(deps, session, message, addressBucket);
-        if (refusal) {
-            captureAssistantUsage(deps.captureRequestEvent, assistantRefusedTurnUsageRequestEvent(session, refusal.code, performance.now() - usageStartedAt));
-            return sendJson(res, refusal.status, { error: refusal.message, code: refusal.code });
-        }
+        if (refusal)
+            return refuseTurn(deps, res, session, refusal, usageStartedAt);
         // The visitor typed first: any pending post-sign-in resume is moot, and must not fire later.
         if (session.pendingResume)
             await deps.store.consumePendingResume(session.id);
@@ -399,15 +403,18 @@ export async function handleAssistantAppRequest(req, res, deps) {
         const resource = target.served.artifact.resources?.find((candidate) => candidate.uri === params.uri);
         if (!resource)
             return sendJson(res, 404, { error: 'resource not found' });
+        // One projection for both the snapshot and the execution: they must agree, and building it
+        // twice was two chances for them not to.
+        const executeDeps = withAssistantSessionExecutionAuthority(target.served.deps, target.served.artifact, session);
         const context = await resolveInvocationContextSnapshot({
             artifact: target.served.artifact,
-            executeDeps: withAssistantSessionExecutionAuthority(target.served.deps, target.served.artifact, session),
+            executeDeps,
             caller: session.caller,
             instant: now(deps),
             ...(session.preferences ? { applicationPreference: session.preferences } : {}),
         });
         const execution = await executeResource(target.served.artifact, resource.name, {}, {
-            ...withAssistantSessionExecutionAuthority(target.served.deps, target.served.artifact, session),
+            ...executeDeps,
             caller: session.caller,
             context,
         });
@@ -418,56 +425,64 @@ export async function handleAssistantAppRequest(req, res, deps) {
     if (method === 'tools/call') {
         if (typeof params.name !== 'string')
             return sendJson(res, 400, { error: 'tool name required' });
-        const knowledgeComponent = findAssistantKnowledgeComponent(knowledge, params.name);
+        const startedAt = performance.now();
+        const toolName = params.name;
+        // Recorded on every exit below, including the refusals: a rejected browser-agent call is
+        // exactly the traffic an operator watching one needs to see (ADR 0220 decision 6).
+        const record = (outcome, errorKind) => captureAssistantUsage(deps.captureRequestEvent, assistantAppToolCallRequestEvent(session, {
+            toolName,
+            // Attribution only. The marker labels the row; the session decided authority above.
+            bridged,
+            outcome,
+            ...(errorKind === undefined ? {} : { errorKind }),
+            durationMs: performance.now() - startedAt,
+        }));
+        const knowledgeComponent = findAssistantKnowledgeComponent(knowledge, toolName);
         if (knowledge !== undefined && knowledgeComponent !== undefined) {
             const content = await executeAssistantKnowledgeSearch(knowledge, knowledgeComponent, params.arguments ?? {});
+            record('ok');
             return sendJson(res, 200, mapToolOutput(JSON.parse(content)));
         }
-        const tool = target.served.artifact.tools.find((candidate) => candidate.name === params.name);
-        if (!tool || tool._meta?.ui?.visibility?.includes('app') === false) {
+        const call = await executeAssistantAppToolCall({
+            artifact: target.served.artifact,
+            deps: target.served.deps,
+            session,
+            toolName,
+            arguments: params.arguments,
+            now: () => now(deps),
+            store: deps.store,
+            audit: deps.audit,
+        });
+        if (call.kind === 'not-found') {
+            record('refused', 'app_tool_not_found');
             return sendJson(res, 404, { error: 'app tool not found' });
         }
-        if (!evaluateToolAuthorization(tool.authorization, session.caller).allow) {
+        if (call.kind === 'forbidden') {
+            record('refused', 'tool_forbidden');
             return sendJson(res, 403, { error: 'tool forbidden' });
         }
-        const context = await resolveInvocationContextSnapshot({
-            artifact: target.served.artifact,
-            executeDeps: withAssistantSessionExecutionAuthority(target.served.deps, target.served.artifact, session),
-            caller: session.caller,
-            instant: now(deps),
-            ...(session.preferences ? { applicationPreference: session.preferences } : {}),
-        });
-        const validated = validateJsonSchemaWithDefaults(tool.inputSchema, params.arguments ?? {});
-        if (validated.issues.length > 0) {
+        if (call.kind === 'invalid-arguments') {
+            record('refused', 'invalid_tool_arguments');
             return sendJson(res, 200, {
                 content: [{ type: 'text', text: 'invalid tool arguments' }],
                 isError: true,
             });
         }
-        const dispatched = await dispatchAssistantTool({
-            artifact: target.served.artifact,
-            tool,
-            arguments: validated.value,
-            executeDeps: withAssistantSessionExecutionAuthority(target.served.deps, target.served.artifact, session),
-            caller: session.caller,
-            context,
-            session,
-            store: deps.store,
-            audit: deps.audit,
-            now: () => now(deps),
-        });
-        if (dispatched.kind === 'event') {
-            if (dispatched.event === 'tool_proposed' || dispatched.event === 'input_requested') {
-                return sendJson(res, 200, {
-                    interaction: { event: dispatched.event, data: dispatched.data },
-                });
-            }
+        if (call.kind === 'interaction') {
+            // A raised confirmation is not a failure and not yet an execution: the bridge did what it
+            // should, and the interaction is answered on its own route.
+            record('ok');
+            return sendJson(res, 200, { interaction: { event: call.event, data: call.data } });
+        }
+        if (call.kind === 'error') {
+            record('failed', call.code);
             return sendJson(res, 200, {
-                content: [{ type: 'text', text: String(dispatched.data.code ?? dispatched.event) }],
+                content: [{ type: 'text', text: call.code }],
                 isError: true,
             });
         }
-        return sendJson(res, 200, mapToolOutput(dispatched.output));
+        record('ok');
+        return sendJson(res, 200, mapToolOutput(call.output));
     }
     return sendJson(res, 400, { error: 'unsupported MCP App method' });
 }

package/node_modules/@noodle-borg/service/dist/routes/intent-capture.js

@@ -14,9 +14,6 @@ export async function handleIntentCaptureSettings(req, res, ref, deps) {
         const identity = await authorizeTenantControl(req, res, deps.gate, deps.controlPlane, ref.org);
         if (identity === false)
             return;
-        if (!deps.previewOrgs.has(ref.org)) {
-            return sendJson(res, 403, { ok: false, error: 'intent capture preview is unavailable' });
-        }
         const setting = await deps.settings.get(ref);
         return sendJson(res, 200, {
             ok: true,
@@ -32,9 +29,6 @@ export async function handleIntentCaptureSettings(req, res, ref, deps) {
         const identity = await authorizeOwner(req, res, ref, deps);
         if (identity === undefined)
             return;
-        if (!deps.previewOrgs.has(ref.org)) {
-            return sendJson(res, 403, { ok: false, error: 'intent capture preview is unavailable' });
-        }
         const body = await readJsonBody(req, deps.maxBody);
         if (!body.ok)
             return sendJson(res, body.status, { error: body.error });
@@ -74,9 +68,6 @@ export async function handleIntentCaptureSettings(req, res, ref, deps) {
         const identity = await authorizeOwner(req, res, ref, deps);
         if (identity === undefined)
             return;
-        if (!deps.previewOrgs.has(ref.org)) {
-            return sendJson(res, 403, { ok: false, error: 'intent capture preview is unavailable' });
-        }
         await deps.settings.delete(ref);
         const purged = await deps.intents.purge(ref);
         await deps.audit.emit({
@@ -98,9 +89,6 @@ export async function handleIntentInsights(req, res, ref, url, deps) {
     const identity = await authorizeTenantControl(req, res, deps.gate, deps.controlPlane, ref.org);
     if (identity === false)
         return;
-    if (!deps.previewOrgs.has(ref.org)) {
-        return sendJson(res, 403, { ok: false, error: 'intent capture preview is unavailable' });
-    }
     const windowName = url.searchParams.get('window') ?? '7d';
     const windowMs = WINDOWS_MS.get(windowName);
     if (windowMs === undefined) {

package/node_modules/@noodle-borg/service/dist/service.js

@@ -57,7 +57,7 @@ export function createServiceHandler(registry, options = {}) {
     let activeAudit;
     const configStore = options.configStore ?? registry.configStore;
     const alertRuleStore = options.alertRuleStore ?? new InMemoryAlertRuleStore();
-    const [intentSettings, intentEvents, requestEvents, intentPreviewOrgs] = createObservabilityStores(options);
+    const [intentSettings, intentEvents, requestEvents] = createObservabilityStores(options);
     const assistantStore = options.assistantStore ?? new InMemoryAssistantStore();
     const assistantAppearance = options.assistantAppearance ?? new InMemoryAssistantAppearanceSettingsStore();
     const anonymousLimiter = new AnonymousConsumerLimiter();
@@ -76,7 +76,7 @@ export function createServiceHandler(registry, options = {}) {
     activeAudit = audit;
     const { publicTenantRouting } = mcp.mcpRoutingOptions(options, controlPlane);
     const resolveEndpointOptions = (org) => mcp.endpointUrlOptionsForOrg(options, controlPlane, org);
-    const withIntentMode = createIntentTargetResolver(intentSettings, intentPreviewOrgs);
+    const withIntentMode = createIntentTargetResolver(intentSettings);
     const router = createMcpRouter(async (id) => withIntentMode(await registry.getServing(id)), {
         logger,
         tls,
@@ -122,7 +122,6 @@ export function createServiceHandler(registry, options = {}) {
         requestEvents,
         intentEvents,
         intentSettings,
-        previewOrgs: intentPreviewOrgs,
         audit,
         maxBody,
         tls,

package/node_modules/@noodle-borg/service/package.json

@@ -39,7 +39,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.87.1",
+    "@noodle-borg/agent-kit": "0.89.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",
     "@noodle-borg/auth": "0.0.0",