@noodleseed/one 0.149.0 → 0.150.0

package/node_modules/@noodle-borg/authoring/dist/assistant.d.ts

@@ -168,12 +168,20 @@ export interface AuthenticatedWebsiteAccess {
     /** Allowlist of verified session claims; undeclared claims are dropped at session exchange. */
     readonly sessionClaims?: Readonly<Record<string, SessionClaimDeclaration>>;
     readonly capabilities?: readonly CapabilityRef[];
+    /** @see AuthenticatedWebsiteInput.webmcp */
+    readonly webmcp?: {
+        readonly enabled?: boolean;
+    };
 }
 export interface PublicWebsiteAccess {
     readonly mode: 'public' | 'mixed';
     readonly origins: readonly string[];
     readonly capabilities: readonly CapabilityRef[];
     readonly instructions?: string;
+    /** @see AuthenticatedWebsiteInput.webmcp */
+    readonly webmcp?: {
+        readonly enabled?: boolean;
+    };
 }
 export type AssistantAccess = AuthenticatedWebsiteAccess | PublicWebsiteAccess;
 export interface AuthenticatedWebsiteInput {
@@ -183,6 +191,19 @@ export interface AuthenticatedWebsiteInput {
     readonly sessionClaims?: Readonly<Record<string, SessionClaimDeclaration>>;
     /** Optional narrowing; omitted means the signed-in surface projects the whole server. */
     readonly capabilities?: readonly CapabilityRef[];
+    /**
+     * Override this assistant's WebMCP opt-in for sessions minted on this surface, in either
+     * direction (ADR 0220, amended). Omitted inherits the assistant's value.
+     *
+     * It governs **discovery**: whether the embed registers this session's tools with
+     * `document.modelContext`, and so whether a browser agent learns they exist. It is not a second
+     * authorization boundary — every call the bridge makes already carries exactly this session's
+     * authority. A deployment serving a marketing page and a signed-in app usually has two honest
+     * answers, which one switch cannot express.
+     */
+    readonly webmcp?: {
+        readonly enabled?: boolean;
+    };
 }
 export interface PublicWebsiteInput {
     readonly origins: readonly (string | ConfigRef)[];
@@ -201,6 +222,10 @@ export interface PublicWebsiteInput {
      * never operates one — and its backend completes the exchange.
      */
     readonly signIn?: boolean;
+    /** @see AuthenticatedWebsiteInput.webmcp */
+    readonly webmcp?: {
+        readonly enabled?: boolean;
+    };
 }
 export declare function authenticatedWebsite(input: AuthenticatedWebsiteInput): AuthenticatedWebsiteAccess;
 export declare function publicWebsite(input: PublicWebsiteInput): PublicWebsiteAccess;
@@ -213,8 +238,7 @@ export interface EmbeddedAssistantOptions extends AssistantUiOptions {
      * page's WebMCP API. Off unless set. Calls carry exactly the embed session's authority and take the
      * same authorization, limits, confirmation, and audit path as the assistant's own — see ADR 0220.
      *
-     * Deployment-wide on purpose: it decides which callers may reach the server's tools, which is
-     * surface authority rather than presentation, so it is not refinable per surface.
+     * The default for every surface, which any surface may override in either direction.
      */
     readonly webmcp?: {
         readonly enabled?: boolean;
@@ -227,6 +251,10 @@ export interface AssistantSurfaceConfig {
     readonly instructions?: string;
     readonly capabilities?: readonly AssistantCapability[];
     readonly sessionClaims?: Readonly<Record<string, SessionClaimDeclaration>>;
+    /** @see AuthenticatedWebsiteInput.webmcp */
+    readonly webmcp?: {
+        readonly enabled?: boolean;
+    };
 }
 export interface EmbeddedAssistantConfig extends AssistantUiOptions {
     readonly model: AssistantModel;
@@ -238,7 +266,7 @@ export interface EmbeddedAssistantConfig extends AssistantUiOptions {
     readonly allowedOrigins: readonly string[];
     /** Mirrored from the authenticated surface, for the same reason. */
     readonly sessionClaims?: Readonly<Record<string, SessionClaimDeclaration>>;
-    /** @see EmbeddedAssistantOptions.webmcp — deployment-wide, never per surface. */
+    /** @see EmbeddedAssistantOptions.webmcp — the default each surface may override. */
     readonly webmcp?: {
         readonly enabled?: boolean;
     };

package/node_modules/@noodle-borg/authoring/dist/assistant.js

@@ -6,6 +6,7 @@ export function authenticatedWebsite(input) {
         ...(input.instructions === undefined ? {} : { instructions: input.instructions }),
         ...(input.sessionClaims ? { sessionClaims: structuredClone(input.sessionClaims) } : {}),
         ...(input.capabilities ? { capabilities: [...input.capabilities] } : {}),
+        ...(input.webmcp === undefined ? {} : { webmcp: { ...input.webmcp } }),
     };
 }
 export function publicWebsite(input) {
@@ -14,6 +15,7 @@ export function publicWebsite(input) {
         origins: serializeOrigins(input.origins, 'assistant.access.origins'),
         capabilities: [...input.capabilities],
         ...(input.instructions === undefined ? {} : { instructions: input.instructions }),
+        ...(input.webmcp === undefined ? {} : { webmcp: { ...input.webmcp } }),
     };
 }
 function serializeOrigins(origins, path) {
@@ -56,6 +58,7 @@ export function embeddedAssistant(input) {
             ...(surface.mode === 'authenticated' && surface.sessionClaims
                 ? { sessionClaims: structuredClone(surface.sessionClaims) }
                 : {}),
+            ...(surface.webmcp === undefined ? {} : { webmcp: { ...surface.webmcp } }),
         })),
         allowedOrigins: surfaces.flatMap((surface) => [...surface.origins]),
         ...structuredClone(ui),

package/node_modules/@noodle-borg/cli-catalog/dist/catalog-data-assistant.js

@@ -129,6 +129,20 @@ const BUDGET_SUBCOMMAND = subcommand({
                     value: '<count>',
                     summary: 'Model turns one source address may run per hour. The abuse bound, not fairness.',
                 }),
+                flag({
+                    ...FLAG_FIELDS,
+                    name: 'bridge-calls-per-session',
+                    type: 'string',
+                    value: '<count>',
+                    summary: 'Tool calls a browser agent may make in one session over the WebMCP bridge.',
+                }),
+                flag({
+                    ...FLAG_FIELDS,
+                    name: 'bridge-calls-per-day',
+                    type: 'string',
+                    value: '<count>',
+                    summary: 'Bridge tool calls this surface may serve per UTC day. 0 closes the bridge.',
+                }),
                 flag({
                     ...FLAG_FIELDS,
                     name: 'surface',

package/node_modules/@noodle-borg/cli-catalog/dist/catalog-data-hosted-observability.js

@@ -352,7 +352,7 @@ export const CATALOG_HOSTED_OBSERVABILITY = [
         name: 'intents',
         section: 'operate',
         helpRank: 5,
-        summary: 'Optional model-supplied user-goal insights for private-preview environments.',
+        summary: 'Optional model-supplied user-goal insights, enabled per environment.',
         arguments: [],
         subcommands: [
             subcommand({

package/node_modules/@noodle-borg/compiler/dist/manifest/schema.d.ts

@@ -377,6 +377,9 @@ export declare const manifestV1Schema: z.ZodObject<{
                 sessionClaims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                     exposeToModel: z.ZodOptional<z.ZodBoolean>;
                 }, z.core.$strict>>>;
+                webmcp: z.ZodOptional<z.ZodObject<{
+                    enabled: z.ZodOptional<z.ZodBoolean>;
+                }, z.core.$strict>>;
             }, z.core.$strict>>>;
             sessionClaims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                 exposeToModel: z.ZodOptional<z.ZodBoolean>;
@@ -856,6 +859,9 @@ export declare const manifestV2Schema: z.ZodObject<{
                 sessionClaims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                     exposeToModel: z.ZodOptional<z.ZodBoolean>;
                 }, z.core.$strict>>>;
+                webmcp: z.ZodOptional<z.ZodObject<{
+                    enabled: z.ZodOptional<z.ZodBoolean>;
+                }, z.core.$strict>>;
             }, z.core.$strict>>>;
             sessionClaims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                 exposeToModel: z.ZodOptional<z.ZodBoolean>;
@@ -1545,6 +1551,9 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                 sessionClaims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                     exposeToModel: z.ZodOptional<z.ZodBoolean>;
                 }, z.core.$strict>>>;
+                webmcp: z.ZodOptional<z.ZodObject<{
+                    enabled: z.ZodOptional<z.ZodBoolean>;
+                }, z.core.$strict>>;
             }, z.core.$strict>>>;
             sessionClaims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                 exposeToModel: z.ZodOptional<z.ZodBoolean>;
@@ -2023,6 +2032,9 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                 sessionClaims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                     exposeToModel: z.ZodOptional<z.ZodBoolean>;
                 }, z.core.$strict>>>;
+                webmcp: z.ZodOptional<z.ZodObject<{
+                    enabled: z.ZodOptional<z.ZodBoolean>;
+                }, z.core.$strict>>;
             }, z.core.$strict>>>;
             sessionClaims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                 exposeToModel: z.ZodOptional<z.ZodBoolean>;

package/node_modules/@noodle-borg/compiler/dist/manifest/schema.js

@@ -352,6 +352,11 @@ const embeddedAssistantSchema = z
         instructions: z.string().trim().min(1).max(MAX_SERVER_INSTRUCTIONS).optional(),
         capabilities: z.array(assistantCapabilitySchema).optional(),
         sessionClaims: sessionClaimsSchema.optional(),
+        // Overrides the assistant's own opt-in for sessions minted on this surface, in either
+        // direction (ADR 0220, amended). Declared explicitly rather than inherited from
+        // `assistantUiSchema.shape` — this is not renderer presentation, and a surface that
+        // acquired it by a spread would be an accident rather than a decision.
+        webmcp: optionalStrictObject({ enabled: z.boolean().optional() }),
     })
         .strict())
         .min(1)
@@ -360,9 +365,9 @@ const embeddedAssistantSchema = z
     // 2026-07-14). Keys become `${user.claims.<key>}`; `exposeToModel` adds it to the identity line.
     sessionClaims: sessionClaimsSchema.optional(),
     // Additive optional field: a v1.x minor under ADR 0150, so no existing manifest can observe it.
-    // Declared here rather than in `assistantUiSchema` deliberately — that shape is also spread into
-    // every surface, and which callers may reach the server's tools is surface authority, not
-    // renderer-owned presentation a surface may refine.
+    // The deployment's default, which any surface may override. Declared here rather than in
+    // `assistantUiSchema` because that shape is spread into every surface as renderer-owned
+    // presentation, and this is not presentation — the surface carries its own copy on purpose.
     webmcp: optionalStrictObject({ enabled: z.boolean().optional() }),
     ...assistantUiSchema.shape,
 })

package/node_modules/@noodle-borg/observability/dist/assistant-app-tool-usage.js

@@ -0,0 +1,25 @@
+import { randomUUID } from 'node:crypto';
+/** Project one apps-bridge tool call onto the shared tenant request stream. */
+export function assistantAppToolCallRequestEvent(session, input) {
+    const isPublic = session.publicEmbedId !== undefined;
+    return {
+        ...session.tenant,
+        deploymentId: session.deploymentId,
+        requestId: randomUUID(),
+        sessionId: session.id,
+        sessionSource: 'synthetic',
+        subjectKind: isPublic ? 'anonymous' : 'authenticated',
+        accessMode: isPublic ? 'public' : 'authenticated',
+        surface: input.bridged ? 'webmcp' : isPublic ? 'assistant-public' : 'assistant-authenticated',
+        method: 'tools/call',
+        kind: 'usage',
+        toolName: input.toolName,
+        outcome: input.outcome === 'ok' ? 'ok' : input.outcome === 'refused' ? 'tool_error' : 'mcp_error',
+        ...(input.errorKind === undefined ? {} : { errorKind: input.errorKind }),
+        durationMs: Number.isFinite(input.durationMs) && input.durationMs > 0 ? input.durationMs : 0,
+        // Scalar-only, like every other assistant event: tool arguments, results, page context, and
+        // credentials have no field to enter through.
+        details: { eventKind: 'appToolCall', bridged: input.bridged },
+    };
+}
+//# sourceMappingURL=assistant-app-tool-usage.js.map

package/node_modules/@noodle-borg/observability/dist/index.js

@@ -1,3 +1,4 @@
+export * from './assistant-app-tool-usage.js';
 export * from './assistant-usage.js';
 export * from './intent-capture.js';
 export * from './request-event-buffer.js';

package/node_modules/@noodle-borg/service/dist/invocation-context.js

@@ -1,56 +1,4 @@
-import { resolveInvocationContext, toolTouchesDelegatedAuth, } from '@noodle-borg/assistant-gateway/portable';
-import { executeAmbientContext, } from '@noodle-borg/runtime';
-/** Resolve one immutable snapshot, including a schema-validated read-only ambient provider. */
-export async function resolveInvocationContextSnapshot(input) {
-    const callerPreference = {
-        ...(input.caller?.locale ? { locale: input.caller.locale } : {}),
-        ...(input.caller?.timeZone ? { timeZone: input.caller.timeZone } : {}),
-        ...(input.applicationPreference ?? {}),
-    };
-    const clientHint = {
-        ...(input.clientLocationHint?.timeZone === undefined
-            ? {}
-            : { timeZone: input.clientLocationHint.timeZone }),
-        ...(input.clientHint ?? {}),
-    };
-    const temporal = resolveInvocationContext({
-        instant: input.instant,
-        ...(Object.keys(callerPreference).length > 0
-            ? { applicationPreference: callerPreference }
-            : {}),
-        ...(Object.keys(clientHint).length === 0 ? {} : { clientHint }),
-        ...(input.artifact.server.context?.defaults
-            ? { defaults: input.artifact.server.context.defaults }
-            : {}),
-    });
-    const context = {
-        ...temporal,
-        ...(input.clientLocationHint === undefined
-            ? {}
-            : { location: { ...input.clientLocationHint, source: 'client-hint' } }),
-    };
-    const ambient = input.artifact.server.context?.ambient;
-    if (!ambient)
-        return context;
-    // An anonymous principal can never satisfy a delegated-auth fulfilment: the broker exchange
-    // is guaranteed to fail, so skip the doomed round trip instead of paying it every turn.
-    if (input.caller?.identityKind === 'anonymous') {
-        const delegatedKeys = input.executeDeps.broker.assistantDelegatedAuthKeys?.();
-        if (delegatedKeys !== undefined &&
-            delegatedKeys.size > 0 &&
-            toolTouchesDelegatedAuth(ambient, delegatedKeys)) {
-            return { ...context, ambientStatus: 'unavailable' };
-        }
-    }
-    const result = await executeAmbientContext(input.artifact, {
-        ...input.executeDeps,
-        ...(input.caller ? { caller: input.caller } : {}),
-        context,
-    });
-    if (!result.ok)
-        return { ...context, ambientStatus: 'unavailable' };
-    return { ...context, ambientStatus: 'available', ambient: result.output };
-}
+import { resolveInvocationContextSnapshot } from '@noodle-borg/assistant-gateway/portable';
 /** Bind the shared snapshot resolver to stateless MCP requests without coupling it to router code. */
 export function createMcpInvocationContextResolver(clock = () => new Date()) {
     return ({ target, caller, clientHint }) => resolveInvocationContextSnapshot({

package/node_modules/@noodle-borg/service/dist/observability-runtime.js

@@ -8,17 +8,16 @@ export function createObservabilityStores(options) {
         options.intentCaptureSettingsStore ?? new InMemoryIntentCaptureSettingsStore(),
         options.intentEventStore ?? new InMemoryIntentEventStore(),
         options.requestEventStore ?? new InMemoryRequestEventStore(),
-        new Set(options.intentCapturePreviewOrgs ?? []),
     ];
 }
-export async function resolveIntentMode(target, ref, previewOrgs, settings) {
+export async function resolveIntentMode(target, ref, settings) {
     if (target === undefined)
         return undefined;
     const resolved = ref ??
         (target.org !== undefined && target.app !== undefined && target.environment !== undefined
             ? { org: target.org, app: target.app, env: target.environment }
             : undefined);
-    if (resolved === undefined || !previewOrgs.has(resolved.org))
+    if (resolved === undefined)
         return target;
     try {
         const setting = await settings.get(resolved);
@@ -28,8 +27,8 @@ export async function resolveIntentMode(target, ref, previewOrgs, settings) {
         return target;
     }
 }
-export function createIntentTargetResolver(settings, previewOrgs) {
-    return (target, ref) => resolveIntentMode(target, ref, previewOrgs, settings);
+export function createIntentTargetResolver(settings) {
+    return (target, ref) => resolveIntentMode(target, ref, settings);
 }
 export function createObservabilityDispatcher(deps) {
     return (req, res, url) => dispatchAnalyticsReads(req, res, url, {
@@ -50,7 +49,6 @@ export function createObservabilityDispatcher(deps) {
             requests: deps.requestEvents,
             audit: deps.audit,
             maxBody: deps.maxBody,
-            previewOrgs: deps.previewOrgs,
             applySecurityHeaders,
             enforceHttps,
             sendJson,

package/node_modules/@noodle-borg/service/dist/routes/assistant-interaction-resolution.js

@@ -1,5 +1,4 @@
-import { withAssistantSessionExecutionAuthority } from '@noodle-borg/assistant-gateway/portable';
-import { resolveInvocationContextSnapshot } from '../invocation-context.js';
+import { resolveInvocationContextSnapshot, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
 import { now } from './assistant.js';
 export function assistantInteractionScope(id, session, instant) {
     return {

package/node_modules/@noodle-borg/service/dist/routes/assistant-public-configuration.js

@@ -29,7 +29,7 @@ export async function handlePublicAssistantConfiguration(req, res, embedId, deps
     if (target === undefined) {
         return sendJson(res, 409, { error: 'assistant deployment is unavailable' });
     }
-    const resolved = await effectiveAssistantBrowserConfiguration(target.served.artifact.server, publicEmbedTenant(authorized.embed), deps.appearance);
+    const resolved = await effectiveAssistantBrowserConfiguration(target.served.artifact.server, publicEmbedTenant(authorized.embed), deps.appearance, 'public');
     applyBrowserCors(req, res, origin);
     res.setHeader('cache-control', 'private, no-cache');
     return sendJson(res, 200, {

package/node_modules/@noodle-borg/service/dist/routes/assistant-public-session.js

@@ -59,7 +59,7 @@ export async function handlePublicAssistantSession(req, res, deps) {
             if (!target?.deploymentId)
                 throw new Error('assistant deployment vanished mid-mint');
             const current = now(deps);
-            configuration = (await effectiveAssistantBrowserConfiguration(target.served.artifact.server, publicEmbedTenant(input.embed), deps.appearance)).effective;
+            configuration = (await effectiveAssistantBrowserConfiguration(target.served.artifact.server, publicEmbedTenant(input.embed), deps.appearance, 'public')).effective;
             const created = await deps.store.createSession({
                 // A public surface has no client credential, so the embed id stands in as the minting
                 // authority. It is not a secret and nothing downstream may begin treating it as one.

package/node_modules/@noodle-borg/service/dist/routes/assistant-suggestions.js

@@ -1,8 +1,7 @@
 import { ADMISSION_DEFAULTS } from '@noodle-borg/admission-limits/portable';
-import { parseAssistantContextPreferences, surfaceEnvelope, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
+import { parseAssistantContextPreferences, resolveInvocationContextSnapshot, surfaceEnvelope, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
 import { assistantSuggestionsRequestSchema } from '@noodle-borg/wire-contracts';
 import { readJsonBody, sendJson } from '../http-util.js';
-import { resolveInvocationContextSnapshot } from '../invocation-context.js';
 import { generateInitialAssistantSuggestions } from './assistant-agent.js';
 import { applyBrowserCors, authenticateSession, now } from './assistant-route-http.js';
 import { sessionScopedTarget } from './assistant-session-target.js';

package/node_modules/@noodle-borg/service/dist/routes/assistant.js

@@ -1,15 +1,13 @@
 import { clientAddressBucket, } from '@noodle-borg/admission-limits/portable';
 import { assistantModelFailure, assistantModelSource, assistantModelTransport, } from '@noodle-borg/assistant-gateway/model-runtime';
-import { ASSISTANT_SESSION_IDLE_MS, dispatchAssistantTool, effectiveAssistantBrowserConfiguration, isAssistantPageContext, isAssistantVerifiedClaims, parseAssistantContextPreferences, parseAssistantCustomerRouting, refuseBridgeToolCall, refusePublicTurn, resumeTurnMessage, resumeUnavailableMessage, shouldAutoResume, surfaceBindingForOrigin, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
+import { ASSISTANT_SESSION_IDLE_MS, effectiveAssistantBrowserConfiguration, executeAssistantAppToolCall, isAssistantPageContext, isAssistantVerifiedClaims, parseAssistantContextPreferences, parseAssistantCustomerRouting, refuseBridgeToolCall, refusePublicTurn, resolveInvocationContextSnapshot, resumeTurnMessage, resumeUnavailableMessage, shouldAutoResume, surfaceBindingForOrigin, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
 import { canonicalizeAuthorizationClaimValues } from '@noodle-borg/auth';
-import { validateJsonSchemaWithDefaults } from '@noodle-borg/compiler';
 import { tenantMcpUrl } from '@noodle-borg/module';
-import { assistantRefusedTurnUsageRequestEvent, assistantSessionUsageRequestEvent, assistantTurnNumber, assistantTurnUsageRequestEvent, captureAssistantUsage, } from '@noodle-borg/observability';
-import { evaluateToolAuthorization, mapExecutionError, mapResourceContents, mapResourcesList, mapToolOutput, mapToolsList, } from '@noodle-borg/protocol';
+import { assistantAppToolCallRequestEvent, assistantRefusedTurnUsageRequestEvent, assistantSessionUsageRequestEvent, assistantTurnNumber, assistantTurnUsageRequestEvent, captureAssistantUsage, } from '@noodle-borg/observability';
+import { mapExecutionError, mapResourceContents, mapResourcesList, mapToolOutput, mapToolsList, } from '@noodle-borg/protocol';
 import { executeResource } from '@noodle-borg/runtime';
 import { assistantMessageTurnRequestSchema, assistantResumeTurnRequestSchema, assistantSessionResponseSchema, } from '@noodle-borg/wire-contracts';
 import { readJsonBody, sendForbidden, sendJson, sendUnauthorized } from '../http-util.js';
-import { resolveInvocationContextSnapshot } from '../invocation-context.js';
 import { createAssistantTurnStats, runAgentTurn } from './assistant-agent.js';
 import { elevateAssistantSession } from './assistant-elevation.js';
 import { executeAssistantKnowledgeSearch, findAssistantKnowledgeComponent, resolveAssistantKnowledge, } from './assistant-knowledge.js';
@@ -99,7 +97,7 @@ export async function handleAssistantSession(req, res, deps) {
     const declaredClaims = assistant.sessionClaims ?? {};
     const claims = Object.fromEntries(Object.entries(isAssistantVerifiedClaims(parsed.claims) ? parsed.claims : {}).filter(([key]) => key in declaredClaims));
     const current = now(deps);
-    const configuration = (await effectiveAssistantBrowserConfiguration(target.served.artifact.server, client.tenant, deps.appearance)).effective;
+    const configuration = (await effectiveAssistantBrowserConfiguration(target.served.artifact.server, client.tenant, deps.appearance, surfaceBinding.kind === 'pre-surfaces' ? undefined : surfaceBinding.kind)).effective;
     const roles = canonicalizeAuthorizationClaimValues(parsed.user.roles, 'role');
     const scopes = canonicalizeAuthorizationClaimValues(parsed.user.scopes, 'scope');
     // Hoisted so an elevation and a fresh exchange bind the *same* principal. Two constructions would be
@@ -405,15 +403,18 @@ export async function handleAssistantAppRequest(req, res, deps) {
         const resource = target.served.artifact.resources?.find((candidate) => candidate.uri === params.uri);
         if (!resource)
             return sendJson(res, 404, { error: 'resource not found' });
+        // One projection for both the snapshot and the execution: they must agree, and building it
+        // twice was two chances for them not to.
+        const executeDeps = withAssistantSessionExecutionAuthority(target.served.deps, target.served.artifact, session);
         const context = await resolveInvocationContextSnapshot({
             artifact: target.served.artifact,
-            executeDeps: withAssistantSessionExecutionAuthority(target.served.deps, target.served.artifact, session),
+            executeDeps,
             caller: session.caller,
             instant: now(deps),
             ...(session.preferences ? { applicationPreference: session.preferences } : {}),
         });
         const execution = await executeResource(target.served.artifact, resource.name, {}, {
-            ...withAssistantSessionExecutionAuthority(target.served.deps, target.served.artifact, session),
+            ...executeDeps,
             caller: session.caller,
             context,
         });
@@ -424,56 +425,64 @@ export async function handleAssistantAppRequest(req, res, deps) {
     if (method === 'tools/call') {
         if (typeof params.name !== 'string')
             return sendJson(res, 400, { error: 'tool name required' });
-        const knowledgeComponent = findAssistantKnowledgeComponent(knowledge, params.name);
+        const startedAt = performance.now();
+        const toolName = params.name;
+        // Recorded on every exit below, including the refusals: a rejected browser-agent call is
+        // exactly the traffic an operator watching one needs to see (ADR 0220 decision 6).
+        const record = (outcome, errorKind) => captureAssistantUsage(deps.captureRequestEvent, assistantAppToolCallRequestEvent(session, {
+            toolName,
+            // Attribution only. The marker labels the row; the session decided authority above.
+            bridged,
+            outcome,
+            ...(errorKind === undefined ? {} : { errorKind }),
+            durationMs: performance.now() - startedAt,
+        }));
+        const knowledgeComponent = findAssistantKnowledgeComponent(knowledge, toolName);
         if (knowledge !== undefined && knowledgeComponent !== undefined) {
             const content = await executeAssistantKnowledgeSearch(knowledge, knowledgeComponent, params.arguments ?? {});
+            record('ok');
             return sendJson(res, 200, mapToolOutput(JSON.parse(content)));
         }
-        const tool = target.served.artifact.tools.find((candidate) => candidate.name === params.name);
-        if (!tool || tool._meta?.ui?.visibility?.includes('app') === false) {
+        const call = await executeAssistantAppToolCall({
+            artifact: target.served.artifact,
+            deps: target.served.deps,
+            session,
+            toolName,
+            arguments: params.arguments,
+            now: () => now(deps),
+            store: deps.store,
+            audit: deps.audit,
+        });
+        if (call.kind === 'not-found') {
+            record('refused', 'app_tool_not_found');
             return sendJson(res, 404, { error: 'app tool not found' });
         }
-        if (!evaluateToolAuthorization(tool.authorization, session.caller).allow) {
+        if (call.kind === 'forbidden') {
+            record('refused', 'tool_forbidden');
             return sendJson(res, 403, { error: 'tool forbidden' });
         }
-        const context = await resolveInvocationContextSnapshot({
-            artifact: target.served.artifact,
-            executeDeps: withAssistantSessionExecutionAuthority(target.served.deps, target.served.artifact, session),
-            caller: session.caller,
-            instant: now(deps),
-            ...(session.preferences ? { applicationPreference: session.preferences } : {}),
-        });
-        const validated = validateJsonSchemaWithDefaults(tool.inputSchema, params.arguments ?? {});
-        if (validated.issues.length > 0) {
+        if (call.kind === 'invalid-arguments') {
+            record('refused', 'invalid_tool_arguments');
             return sendJson(res, 200, {
                 content: [{ type: 'text', text: 'invalid tool arguments' }],
                 isError: true,
             });
         }
-        const dispatched = await dispatchAssistantTool({
-            artifact: target.served.artifact,
-            tool,
-            arguments: validated.value,
-            executeDeps: withAssistantSessionExecutionAuthority(target.served.deps, target.served.artifact, session),
-            caller: session.caller,
-            context,
-            session,
-            store: deps.store,
-            audit: deps.audit,
-            now: () => now(deps),
-        });
-        if (dispatched.kind === 'event') {
-            if (dispatched.event === 'tool_proposed' || dispatched.event === 'input_requested') {
-                return sendJson(res, 200, {
-                    interaction: { event: dispatched.event, data: dispatched.data },
-                });
-            }
+        if (call.kind === 'interaction') {
+            // A raised confirmation is not a failure and not yet an execution: the bridge did what it
+            // should, and the interaction is answered on its own route.
+            record('ok');
+            return sendJson(res, 200, { interaction: { event: call.event, data: call.data } });
+        }
+        if (call.kind === 'error') {
+            record('failed', call.code);
             return sendJson(res, 200, {
-                content: [{ type: 'text', text: String(dispatched.data.code ?? dispatched.event) }],
+                content: [{ type: 'text', text: call.code }],
                 isError: true,
             });
         }
-        return sendJson(res, 200, mapToolOutput(dispatched.output));
+        record('ok');
+        return sendJson(res, 200, mapToolOutput(call.output));
     }
     return sendJson(res, 400, { error: 'unsupported MCP App method' });
 }

package/node_modules/@noodle-borg/service/dist/routes/intent-capture.js

@@ -14,9 +14,6 @@ export async function handleIntentCaptureSettings(req, res, ref, deps) {
         const identity = await authorizeTenantControl(req, res, deps.gate, deps.controlPlane, ref.org);
         if (identity === false)
             return;
-        if (!deps.previewOrgs.has(ref.org)) {
-            return sendJson(res, 403, { ok: false, error: 'intent capture preview is unavailable' });
-        }
         const setting = await deps.settings.get(ref);
         return sendJson(res, 200, {
             ok: true,
@@ -32,9 +29,6 @@ export async function handleIntentCaptureSettings(req, res, ref, deps) {
         const identity = await authorizeOwner(req, res, ref, deps);
         if (identity === undefined)
             return;
-        if (!deps.previewOrgs.has(ref.org)) {
-            return sendJson(res, 403, { ok: false, error: 'intent capture preview is unavailable' });
-        }
         const body = await readJsonBody(req, deps.maxBody);
         if (!body.ok)
             return sendJson(res, body.status, { error: body.error });
@@ -74,9 +68,6 @@ export async function handleIntentCaptureSettings(req, res, ref, deps) {
         const identity = await authorizeOwner(req, res, ref, deps);
         if (identity === undefined)
             return;
-        if (!deps.previewOrgs.has(ref.org)) {
-            return sendJson(res, 403, { ok: false, error: 'intent capture preview is unavailable' });
-        }
         await deps.settings.delete(ref);
         const purged = await deps.intents.purge(ref);
         await deps.audit.emit({
@@ -98,9 +89,6 @@ export async function handleIntentInsights(req, res, ref, url, deps) {
     const identity = await authorizeTenantControl(req, res, deps.gate, deps.controlPlane, ref.org);
     if (identity === false)
         return;
-    if (!deps.previewOrgs.has(ref.org)) {
-        return sendJson(res, 403, { ok: false, error: 'intent capture preview is unavailable' });
-    }
     const windowName = url.searchParams.get('window') ?? '7d';
     const windowMs = WINDOWS_MS.get(windowName);
     if (windowMs === undefined) {

package/node_modules/@noodle-borg/service/dist/service.js

@@ -57,7 +57,7 @@ export function createServiceHandler(registry, options = {}) {
     let activeAudit;
     const configStore = options.configStore ?? registry.configStore;
     const alertRuleStore = options.alertRuleStore ?? new InMemoryAlertRuleStore();
-    const [intentSettings, intentEvents, requestEvents, intentPreviewOrgs] = createObservabilityStores(options);
+    const [intentSettings, intentEvents, requestEvents] = createObservabilityStores(options);
     const assistantStore = options.assistantStore ?? new InMemoryAssistantStore();
     const assistantAppearance = options.assistantAppearance ?? new InMemoryAssistantAppearanceSettingsStore();
     const anonymousLimiter = new AnonymousConsumerLimiter();
@@ -76,7 +76,7 @@ export function createServiceHandler(registry, options = {}) {
     activeAudit = audit;
     const { publicTenantRouting } = mcp.mcpRoutingOptions(options, controlPlane);
     const resolveEndpointOptions = (org) => mcp.endpointUrlOptionsForOrg(options, controlPlane, org);
-    const withIntentMode = createIntentTargetResolver(intentSettings, intentPreviewOrgs);
+    const withIntentMode = createIntentTargetResolver(intentSettings);
     const router = createMcpRouter(async (id) => withIntentMode(await registry.getServing(id)), {
         logger,
         tls,
@@ -122,7 +122,6 @@ export function createServiceHandler(registry, options = {}) {
         requestEvents,
         intentEvents,
         intentSettings,
-        previewOrgs: intentPreviewOrgs,
         audit,
         maxBody,
         tls,

package/node_modules/@noodle-borg/service/package.json

@@ -39,7 +39,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.88.0",
+    "@noodle-borg/agent-kit": "0.89.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",
     "@noodle-borg/auth": "0.0.0",

package/node_modules/@noodleseed/assistant/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/assistant",
-  "version": "1.29.0",
+  "version": "1.30.0",
   "description": "Embed the Noodle Seed customer-branded assistant in your web app with managed or framework-owned UI, a framework-neutral MCP App host, a DOM-free client, and a backend session helper. Authoring and deploying the server is @noodleseed/one.",
   "license": "Apache-2.0",
   "repository": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/one",
-  "version": "0.149.0",
+  "version": "0.150.0",
   "private": false,
   "description": "Noodle CLI by Noodle Seed — author, run, and deploy declarative MCP servers. Embedding the assistant in your own web app is @noodleseed/assistant.",
   "license": "Apache-2.0",
@@ -236,7 +236,7 @@
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.88.0",
+    "@noodle-borg/agent-kit": "0.89.0",
     "@noodle-borg/app-audit": "0.0.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",