@noodleseed/one 0.150.0 → 0.151.0

package/node_modules/@noodle-borg/module/dist/logger.js

@@ -0,0 +1,16 @@
+export function adaptModuleLogger(logger, base = {}) {
+    const fields = (extra) => ({ ...base, ...extra });
+    const log = (level, event, extra) => {
+        logger[level](event, fields(extra));
+    };
+    return {
+        level: 'debug',
+        log,
+        debug: (event, extra) => log('debug', event, extra),
+        info: (event, extra) => log('info', event, extra),
+        warn: (event, extra) => log('warn', event, extra),
+        error: (event, extra) => log('error', event, extra),
+        child: (extra) => adaptModuleLogger(logger, fields(extra)),
+    };
+}
+//# sourceMappingURL=logger.js.map

package/node_modules/@noodle-borg/observability/dist/assistant-app-tool-usage.js

@@ -1,4 +1,5 @@
 import { randomUUID } from 'node:crypto';
+import { captureAssistantUsage } from './assistant-usage.js';
 /** Project one apps-bridge tool call onto the shared tenant request stream. */
 export function assistantAppToolCallRequestEvent(session, input) {
     const isPublic = session.publicEmbedId !== undefined;
@@ -13,7 +14,7 @@ export function assistantAppToolCallRequestEvent(session, input) {
         surface: input.bridged ? 'webmcp' : isPublic ? 'assistant-public' : 'assistant-authenticated',
         method: 'tools/call',
         kind: 'usage',
-        toolName: input.toolName,
+        ...(input.toolName === undefined ? {} : { toolName: input.toolName }),
         outcome: input.outcome === 'ok' ? 'ok' : input.outcome === 'refused' ? 'tool_error' : 'mcp_error',
         ...(input.errorKind === undefined ? {} : { errorKind: input.errorKind }),
         durationMs: Number.isFinite(input.durationMs) && input.durationMs > 0 ? input.durationMs : 0,
@@ -22,4 +23,25 @@ export function assistantAppToolCallRequestEvent(session, input) {
         details: { eventKind: 'appToolCall', bridged: input.bridged },
     };
 }
+/**
+ * Bind one apps-bridge tool call's fixed facts, leaving the caller a recorder it can run at any
+ * exit. The route reaches several of them -- a budget refusal before any resolution work, an
+ * unprojected tool, bad arguments, a raised confirmation, a result -- and assembling the event at
+ * each one is how one of them ends up forgotten, which is what happened to the budget refusal.
+ */
+export function assistantAppToolCallRecorder(input) {
+    const startedAt = input.clock();
+    return (outcome, errorKind) => {
+        captureAssistantUsage(input.capture, assistantAppToolCallRequestEvent(input.session, {
+            // Absent when the caller named no tool. That row still matters: a nameless call that
+            // exhausts a budget is the shape abusive traffic takes, and it is the row an operator
+            // watching a browser agent would miss if a missing name suppressed the event.
+            ...(input.toolName === undefined ? {} : { toolName: input.toolName }),
+            bridged: input.bridged,
+            outcome,
+            ...(errorKind === undefined ? {} : { errorKind }),
+            durationMs: input.clock() - startedAt,
+        }));
+    };
+}
 //# sourceMappingURL=assistant-app-tool-usage.js.map

package/node_modules/@noodle-borg/service/dist/observability-runtime.js

@@ -8,16 +8,17 @@ export function createObservabilityStores(options) {
         options.intentCaptureSettingsStore ?? new InMemoryIntentCaptureSettingsStore(),
         options.intentEventStore ?? new InMemoryIntentEventStore(),
         options.requestEventStore ?? new InMemoryRequestEventStore(),
+        new Set(options.intentCapturePreviewOrgs ?? []),
     ];
 }
-export async function resolveIntentMode(target, ref, settings) {
+export async function resolveIntentMode(target, ref, previewOrgs, settings) {
     if (target === undefined)
         return undefined;
     const resolved = ref ??
         (target.org !== undefined && target.app !== undefined && target.environment !== undefined
             ? { org: target.org, app: target.app, env: target.environment }
             : undefined);
-    if (resolved === undefined)
+    if (resolved === undefined || !previewOrgs.has(resolved.org))
         return target;
     try {
         const setting = await settings.get(resolved);
@@ -27,8 +28,8 @@ export async function resolveIntentMode(target, ref, settings) {
         return target;
     }
 }
-export function createIntentTargetResolver(settings) {
-    return (target, ref) => resolveIntentMode(target, ref, settings);
+export function createIntentTargetResolver(settings, previewOrgs) {
+    return (target, ref) => resolveIntentMode(target, ref, previewOrgs, settings);
 }
 export function createObservabilityDispatcher(deps) {
     return (req, res, url) => dispatchAnalyticsReads(req, res, url, {
@@ -49,6 +50,7 @@ export function createObservabilityDispatcher(deps) {
             requests: deps.requestEvents,
             audit: deps.audit,
             maxBody: deps.maxBody,
+            previewOrgs: deps.previewOrgs,
             applySecurityHeaders,
             enforceHttps,
             sendJson,

package/node_modules/@noodle-borg/service/dist/routes/assistant.js

@@ -3,7 +3,7 @@ import { assistantModelFailure, assistantModelSource, assistantModelTransport, }
 import { ASSISTANT_SESSION_IDLE_MS, effectiveAssistantBrowserConfiguration, executeAssistantAppToolCall, isAssistantPageContext, isAssistantVerifiedClaims, parseAssistantContextPreferences, parseAssistantCustomerRouting, refuseBridgeToolCall, refusePublicTurn, resolveInvocationContextSnapshot, resumeTurnMessage, resumeUnavailableMessage, shouldAutoResume, surfaceBindingForOrigin, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
 import { canonicalizeAuthorizationClaimValues } from '@noodle-borg/auth';
 import { tenantMcpUrl } from '@noodle-borg/module';
-import { assistantAppToolCallRequestEvent, assistantRefusedTurnUsageRequestEvent, assistantSessionUsageRequestEvent, assistantTurnNumber, assistantTurnUsageRequestEvent, captureAssistantUsage, } from '@noodle-borg/observability';
+import { assistantAppToolCallRecorder, assistantRefusedTurnUsageRequestEvent, assistantSessionUsageRequestEvent, assistantTurnNumber, assistantTurnUsageRequestEvent, captureAssistantUsage, } from '@noodle-borg/observability';
 import { mapExecutionError, mapResourceContents, mapResourcesList, mapToolOutput, mapToolsList, } from '@noodle-borg/protocol';
 import { executeResource } from '@noodle-borg/runtime';
 import { assistantMessageTurnRequestSchema, assistantResumeTurnRequestSchema, assistantSessionResponseSchema, } from '@noodle-borg/wire-contracts';
@@ -385,9 +385,21 @@ export async function handleAssistantAppRequest(req, res, deps) {
     // Answered before any resolution work, so a refused browser agent costs nothing (ADR 0220). The
     // marker is client-declared: it selects a budget, never authority, which the session below decides.
     const bridged = method === 'tools/call' && body.value.bridge === 'webmcp';
+    // Bound before the budget gate below, because that refusal is the one an operator watching a
+    // browser agent most needs to see, and answering it before any resolution work must not mean
+    // answering it silently. `bridged` is attribution only: it labels the row, never authority.
+    const record = assistantAppToolCallRecorder({
+        capture: deps.captureRequestEvent,
+        session,
+        ...(typeof params.name === 'string' ? { toolName: params.name } : { toolName: undefined }),
+        bridged,
+        clock: () => performance.now(),
+    });
     const refusal = bridged ? await refuseBridgeToolCall(deps, session) : undefined;
-    if (refusal)
+    if (refusal) {
+        record('refused', refusal.code);
         return sendJson(res, refusal.status, { error: refusal.message, code: refusal.code });
+    }
     const knowledge = await resolveAssistantKnowledge(target.served);
     if (method === 'tools/list') {
         return sendJson(res, 200, mapToolsList(target.served.artifact, session.caller, {
@@ -423,25 +435,23 @@ export async function handleAssistantAppRequest(req, res, deps) {
         return sendJson(res, 200, mapResourceContents(resource.uri, resource.mimeType, execution.output, resource._meta));
     }
     if (method === 'tools/call') {
-        if (typeof params.name !== 'string')
+        if (typeof params.name !== 'string') {
+            record('refused', 'tool_name_required');
             return sendJson(res, 400, { error: 'tool name required' });
-        const startedAt = performance.now();
+        }
         const toolName = params.name;
-        // Recorded on every exit below, including the refusals: a rejected browser-agent call is
-        // exactly the traffic an operator watching one needs to see (ADR 0220 decision 6).
-        const record = (outcome, errorKind) => captureAssistantUsage(deps.captureRequestEvent, assistantAppToolCallRequestEvent(session, {
-            toolName,
-            // Attribution only. The marker labels the row; the session decided authority above.
-            bridged,
-            outcome,
-            ...(errorKind === undefined ? {} : { errorKind }),
-            durationMs: performance.now() - startedAt,
-        }));
         const knowledgeComponent = findAssistantKnowledgeComponent(knowledge, toolName);
         if (knowledge !== undefined && knowledgeComponent !== undefined) {
             const content = await executeAssistantKnowledgeSearch(knowledge, knowledgeComponent, params.arguments ?? {});
-            record('ok');
-            return sendJson(res, 200, mapToolOutput(JSON.parse(content)));
+            // A knowledge search reports failure in its payload rather than by throwing, so reading the
+            // envelope is the only way not to file a refused or failed search as a successful one.
+            const payload = JSON.parse(content);
+            const failure = isRecord(payload) && typeof payload.error === 'string' ? payload.error : undefined;
+            if (failure === undefined)
+                record('ok');
+            else
+                record(failure === 'invalid_arguments' ? 'refused' : 'failed', failure);
+            return sendJson(res, 200, mapToolOutput(payload));
         }
         const call = await executeAssistantAppToolCall({
             artifact: target.served.artifact,

package/node_modules/@noodle-borg/service/dist/routes/intent-capture.js

@@ -14,6 +14,9 @@ export async function handleIntentCaptureSettings(req, res, ref, deps) {
         const identity = await authorizeTenantControl(req, res, deps.gate, deps.controlPlane, ref.org);
         if (identity === false)
             return;
+        if (!deps.previewOrgs.has(ref.org)) {
+            return sendJson(res, 403, { ok: false, error: 'intent capture preview is unavailable' });
+        }
         const setting = await deps.settings.get(ref);
         return sendJson(res, 200, {
             ok: true,
@@ -29,6 +32,9 @@ export async function handleIntentCaptureSettings(req, res, ref, deps) {
         const identity = await authorizeOwner(req, res, ref, deps);
         if (identity === undefined)
             return;
+        if (!deps.previewOrgs.has(ref.org)) {
+            return sendJson(res, 403, { ok: false, error: 'intent capture preview is unavailable' });
+        }
         const body = await readJsonBody(req, deps.maxBody);
         if (!body.ok)
             return sendJson(res, body.status, { error: body.error });
@@ -68,6 +74,9 @@ export async function handleIntentCaptureSettings(req, res, ref, deps) {
         const identity = await authorizeOwner(req, res, ref, deps);
         if (identity === undefined)
             return;
+        if (!deps.previewOrgs.has(ref.org)) {
+            return sendJson(res, 403, { ok: false, error: 'intent capture preview is unavailable' });
+        }
         await deps.settings.delete(ref);
         const purged = await deps.intents.purge(ref);
         await deps.audit.emit({
@@ -89,6 +98,9 @@ export async function handleIntentInsights(req, res, ref, url, deps) {
     const identity = await authorizeTenantControl(req, res, deps.gate, deps.controlPlane, ref.org);
     if (identity === false)
         return;
+    if (!deps.previewOrgs.has(ref.org)) {
+        return sendJson(res, 403, { ok: false, error: 'intent capture preview is unavailable' });
+    }
     const windowName = url.searchParams.get('window') ?? '7d';
     const windowMs = WINDOWS_MS.get(windowName);
     if (windowMs === undefined) {

package/node_modules/@noodle-borg/service/dist/service.js

@@ -57,7 +57,7 @@ export function createServiceHandler(registry, options = {}) {
     let activeAudit;
     const configStore = options.configStore ?? registry.configStore;
     const alertRuleStore = options.alertRuleStore ?? new InMemoryAlertRuleStore();
-    const [intentSettings, intentEvents, requestEvents] = createObservabilityStores(options);
+    const [intentSettings, intentEvents, requestEvents, intentPreviewOrgs] = createObservabilityStores(options);
     const assistantStore = options.assistantStore ?? new InMemoryAssistantStore();
     const assistantAppearance = options.assistantAppearance ?? new InMemoryAssistantAppearanceSettingsStore();
     const anonymousLimiter = new AnonymousConsumerLimiter();
@@ -76,7 +76,7 @@ export function createServiceHandler(registry, options = {}) {
     activeAudit = audit;
     const { publicTenantRouting } = mcp.mcpRoutingOptions(options, controlPlane);
     const resolveEndpointOptions = (org) => mcp.endpointUrlOptionsForOrg(options, controlPlane, org);
-    const withIntentMode = createIntentTargetResolver(intentSettings);
+    const withIntentMode = createIntentTargetResolver(intentSettings, intentPreviewOrgs);
     const router = createMcpRouter(async (id) => withIntentMode(await registry.getServing(id)), {
         logger,
         tls,
@@ -122,6 +122,7 @@ export function createServiceHandler(registry, options = {}) {
         requestEvents,
         intentEvents,
         intentSettings,
+        previewOrgs: intentPreviewOrgs,
         audit,
         maxBody,
         tls,

package/node_modules/@noodle-borg/service/package.json

@@ -39,7 +39,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.89.0",
+    "@noodle-borg/agent-kit": "0.90.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",
     "@noodle-borg/auth": "0.0.0",

package/node_modules/@noodle-borg/wire-contracts/dist/index.d.ts

@@ -18,6 +18,7 @@ export * from './deployment-package.js';
 export * from './distribution.js';
 export * from './feedback.js';
 export * from './knowledge.js';
+export * from './managed-assistant-sponsorship.js';
 export * from './platform-account-reset.js';
 export * from './platform-auth.js';
 /** Informational origin of a deployment; never an authorization or policy input. */

package/node_modules/@noodle-borg/wire-contracts/dist/index.js

@@ -20,6 +20,7 @@ export * from './deployment-package.js';
 export * from './distribution.js';
 export * from './feedback.js';
 export * from './knowledge.js';
+export * from './managed-assistant-sponsorship.js';
 export * from './platform-account-reset.js';
 export * from './platform-auth.js';
 // ─── Deploy ─────────────────────────────────────────────────────────────────────

package/node_modules/@noodle-borg/wire-contracts/dist/managed-assistant-sponsorship.d.ts

@@ -0,0 +1,297 @@
+import { z } from 'zod';
+export declare const MANAGED_ASSISTANT_SPONSORSHIP_MAX_GRANT_TURNS_PER_DAY = 100000;
+export declare const ManagedAssistantSponsorshipGrantCreateRequestSchema: z.ZodObject<{
+    additionalTurnsPerDay: z.ZodNumber;
+    startsAt: z.ZodOptional<z.ZodISODateTime>;
+    expiresAt: z.ZodISODateTime;
+    reason: z.ZodString;
+    idempotencyKey: z.ZodString;
+}, z.core.$strict>;
+export type ManagedAssistantSponsorshipGrantCreateRequest = z.infer<typeof ManagedAssistantSponsorshipGrantCreateRequestSchema>;
+export declare const ManagedAssistantSponsorshipGrantRevokeRequestSchema: z.ZodObject<{
+    reason: z.ZodString;
+    idempotencyKey: z.ZodString;
+}, z.core.$strict>;
+export type ManagedAssistantSponsorshipGrantRevokeRequest = z.infer<typeof ManagedAssistantSponsorshipGrantRevokeRequestSchema>;
+export declare const ManagedAssistantSponsorshipGrantSchema: z.ZodObject<{
+    id: z.ZodString;
+    billingAccountId: z.ZodString;
+    additionalTurnsPerDay: z.ZodNumber;
+    startsAt: z.ZodISODateTime;
+    expiresAt: z.ZodISODateTime;
+    reason: z.ZodString;
+    status: z.ZodEnum<{
+        active: "active";
+        revoked: "revoked";
+        scheduled: "scheduled";
+        expired: "expired";
+    }>;
+    createdAt: z.ZodISODateTime;
+    revokedAt: z.ZodOptional<z.ZodISODateTime>;
+    revocationReason: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type ManagedAssistantSponsorshipGrant = z.infer<typeof ManagedAssistantSponsorshipGrantSchema>;
+export declare const ManagedAssistantSponsorshipResponseSchema: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    data: z.ZodObject<{
+        billingAccountId: z.ZodString;
+        mode: z.ZodLiteral<"sponsored_beta">;
+        defaultTurnsPerDay: z.ZodNumber;
+        bonusTurnsPerDay: z.ZodNumber;
+        totalTurnsPerDay: z.ZodNumber;
+        spend: z.ZodObject<{
+            state: z.ZodEnum<{
+                normal: "normal";
+                approaching: "approaching";
+                near: "near";
+                limited: "limited";
+                closed: "closed";
+            }>;
+            allowanceUnits: z.ZodNumber;
+            usedUnitsToday: z.ZodNumber;
+            turnsRemaining: z.ZodNumber;
+        }, z.core.$strict>;
+        resetAt: z.ZodISODateTime;
+        grants: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            billingAccountId: z.ZodString;
+            additionalTurnsPerDay: z.ZodNumber;
+            startsAt: z.ZodISODateTime;
+            expiresAt: z.ZodISODateTime;
+            reason: z.ZodString;
+            status: z.ZodEnum<{
+                active: "active";
+                revoked: "revoked";
+                scheduled: "scheduled";
+                expired: "expired";
+            }>;
+            createdAt: z.ZodISODateTime;
+            revokedAt: z.ZodOptional<z.ZodISODateTime>;
+            revocationReason: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        platform: z.ZodOptional<z.ZodObject<{
+            globalTurnsPerDay: z.ZodNumber;
+            spend: z.ZodObject<{
+                state: z.ZodEnum<{
+                    normal: "normal";
+                    approaching: "approaching";
+                    near: "near";
+                    limited: "limited";
+                    closed: "closed";
+                }>;
+                allowanceUnits: z.ZodNumber;
+                usedUnitsToday: z.ZodNumber;
+                turnsRemaining: z.ZodNumber;
+            }, z.core.$strict>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type ManagedAssistantSponsorshipResponse = z.infer<typeof ManagedAssistantSponsorshipResponseSchema>;
+/** Client reader strips additive fields at every layer while the service output stays strict. */
+export declare const ManagedAssistantSponsorshipClientResponseSchema: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    data: z.ZodObject<{
+        spend: z.ZodObject<{
+            state: z.ZodEnum<{
+                normal: "normal";
+                approaching: "approaching";
+                near: "near";
+                limited: "limited";
+                closed: "closed";
+            }>;
+            allowanceUnits: z.ZodNumber;
+            usedUnitsToday: z.ZodNumber;
+            turnsRemaining: z.ZodNumber;
+        }, z.core.$strip>;
+        grants: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            billingAccountId: z.ZodString;
+            additionalTurnsPerDay: z.ZodNumber;
+            startsAt: z.ZodISODateTime;
+            expiresAt: z.ZodISODateTime;
+            reason: z.ZodString;
+            status: z.ZodEnum<{
+                active: "active";
+                revoked: "revoked";
+                scheduled: "scheduled";
+                expired: "expired";
+            }>;
+            createdAt: z.ZodISODateTime;
+            revokedAt: z.ZodOptional<z.ZodISODateTime>;
+            revocationReason: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        platform: z.ZodOptional<z.ZodObject<{
+            globalTurnsPerDay: z.ZodNumber;
+            spend: z.ZodObject<{
+                state: z.ZodEnum<{
+                    normal: "normal";
+                    approaching: "approaching";
+                    near: "near";
+                    limited: "limited";
+                    closed: "closed";
+                }>;
+                allowanceUnits: z.ZodNumber;
+                usedUnitsToday: z.ZodNumber;
+                turnsRemaining: z.ZodNumber;
+            }, z.core.$strip>;
+        }, z.core.$strip>>;
+        billingAccountId: z.ZodString;
+        mode: z.ZodLiteral<"sponsored_beta">;
+        defaultTurnsPerDay: z.ZodNumber;
+        bonusTurnsPerDay: z.ZodNumber;
+        totalTurnsPerDay: z.ZodNumber;
+        resetAt: z.ZodISODateTime;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export declare const ManagedAssistantSponsorshipGrantMutationResponseSchema: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    data: z.ZodObject<{
+        replayed: z.ZodBoolean;
+        grant: z.ZodObject<{
+            id: z.ZodString;
+            billingAccountId: z.ZodString;
+            additionalTurnsPerDay: z.ZodNumber;
+            startsAt: z.ZodISODateTime;
+            expiresAt: z.ZodISODateTime;
+            reason: z.ZodString;
+            status: z.ZodEnum<{
+                active: "active";
+                revoked: "revoked";
+                scheduled: "scheduled";
+                expired: "expired";
+            }>;
+            createdAt: z.ZodISODateTime;
+            revokedAt: z.ZodOptional<z.ZodISODateTime>;
+            revocationReason: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+        sponsorship: z.ZodObject<{
+            billingAccountId: z.ZodString;
+            mode: z.ZodLiteral<"sponsored_beta">;
+            defaultTurnsPerDay: z.ZodNumber;
+            bonusTurnsPerDay: z.ZodNumber;
+            totalTurnsPerDay: z.ZodNumber;
+            spend: z.ZodObject<{
+                state: z.ZodEnum<{
+                    normal: "normal";
+                    approaching: "approaching";
+                    near: "near";
+                    limited: "limited";
+                    closed: "closed";
+                }>;
+                allowanceUnits: z.ZodNumber;
+                usedUnitsToday: z.ZodNumber;
+                turnsRemaining: z.ZodNumber;
+            }, z.core.$strict>;
+            resetAt: z.ZodISODateTime;
+            grants: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                billingAccountId: z.ZodString;
+                additionalTurnsPerDay: z.ZodNumber;
+                startsAt: z.ZodISODateTime;
+                expiresAt: z.ZodISODateTime;
+                reason: z.ZodString;
+                status: z.ZodEnum<{
+                    active: "active";
+                    revoked: "revoked";
+                    scheduled: "scheduled";
+                    expired: "expired";
+                }>;
+                createdAt: z.ZodISODateTime;
+                revokedAt: z.ZodOptional<z.ZodISODateTime>;
+                revocationReason: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
+            platform: z.ZodOptional<z.ZodObject<{
+                globalTurnsPerDay: z.ZodNumber;
+                spend: z.ZodObject<{
+                    state: z.ZodEnum<{
+                        normal: "normal";
+                        approaching: "approaching";
+                        near: "near";
+                        limited: "limited";
+                        closed: "closed";
+                    }>;
+                    allowanceUnits: z.ZodNumber;
+                    usedUnitsToday: z.ZodNumber;
+                    turnsRemaining: z.ZodNumber;
+                }, z.core.$strict>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type ManagedAssistantSponsorshipGrantMutationResponse = z.infer<typeof ManagedAssistantSponsorshipGrantMutationResponseSchema>;
+export declare const ManagedAssistantSponsorshipGrantMutationClientResponseSchema: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    data: z.ZodObject<{
+        replayed: z.ZodBoolean;
+        grant: z.ZodObject<{
+            id: z.ZodString;
+            billingAccountId: z.ZodString;
+            additionalTurnsPerDay: z.ZodNumber;
+            startsAt: z.ZodISODateTime;
+            expiresAt: z.ZodISODateTime;
+            reason: z.ZodString;
+            status: z.ZodEnum<{
+                active: "active";
+                revoked: "revoked";
+                scheduled: "scheduled";
+                expired: "expired";
+            }>;
+            createdAt: z.ZodISODateTime;
+            revokedAt: z.ZodOptional<z.ZodISODateTime>;
+            revocationReason: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+        sponsorship: z.ZodObject<{
+            spend: z.ZodObject<{
+                state: z.ZodEnum<{
+                    normal: "normal";
+                    approaching: "approaching";
+                    near: "near";
+                    limited: "limited";
+                    closed: "closed";
+                }>;
+                allowanceUnits: z.ZodNumber;
+                usedUnitsToday: z.ZodNumber;
+                turnsRemaining: z.ZodNumber;
+            }, z.core.$strip>;
+            grants: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                billingAccountId: z.ZodString;
+                additionalTurnsPerDay: z.ZodNumber;
+                startsAt: z.ZodISODateTime;
+                expiresAt: z.ZodISODateTime;
+                reason: z.ZodString;
+                status: z.ZodEnum<{
+                    active: "active";
+                    revoked: "revoked";
+                    scheduled: "scheduled";
+                    expired: "expired";
+                }>;
+                createdAt: z.ZodISODateTime;
+                revokedAt: z.ZodOptional<z.ZodISODateTime>;
+                revocationReason: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>;
+            platform: z.ZodOptional<z.ZodObject<{
+                globalTurnsPerDay: z.ZodNumber;
+                spend: z.ZodObject<{
+                    state: z.ZodEnum<{
+                        normal: "normal";
+                        approaching: "approaching";
+                        near: "near";
+                        limited: "limited";
+                        closed: "closed";
+                    }>;
+                    allowanceUnits: z.ZodNumber;
+                    usedUnitsToday: z.ZodNumber;
+                    turnsRemaining: z.ZodNumber;
+                }, z.core.$strip>;
+            }, z.core.$strip>>;
+            billingAccountId: z.ZodString;
+            mode: z.ZodLiteral<"sponsored_beta">;
+            defaultTurnsPerDay: z.ZodNumber;
+            bonusTurnsPerDay: z.ZodNumber;
+            totalTurnsPerDay: z.ZodNumber;
+            resetAt: z.ZodISODateTime;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+//# sourceMappingURL=managed-assistant-sponsorship.d.ts.map

package/node_modules/@noodle-borg/wire-contracts/dist/managed-assistant-sponsorship.js

@@ -0,0 +1,94 @@
+import { z } from 'zod';
+const strictObject = (shape) => z.strictObject(shape);
+const additiveObject = (shape) => z.object(shape);
+const timestamp = z.iso.datetime({ offset: true });
+const billingAccountId = z.string().min(1).max(160);
+const grantId = z.string().regex(/^masg_[A-Za-z0-9_-]{16,80}$/);
+const reason = z.string().trim().min(3).max(500);
+const idempotencyKey = z.string().trim().min(8).max(200);
+export const MANAGED_ASSISTANT_SPONSORSHIP_MAX_GRANT_TURNS_PER_DAY = 100_000;
+export const ManagedAssistantSponsorshipGrantCreateRequestSchema = strictObject({
+    additionalTurnsPerDay: z
+        .number()
+        .int()
+        .positive()
+        .max(MANAGED_ASSISTANT_SPONSORSHIP_MAX_GRANT_TURNS_PER_DAY),
+    startsAt: timestamp.optional(),
+    expiresAt: timestamp,
+    reason,
+    idempotencyKey,
+});
+export const ManagedAssistantSponsorshipGrantRevokeRequestSchema = strictObject({
+    reason,
+    idempotencyKey,
+});
+const grantShape = {
+    id: grantId,
+    billingAccountId,
+    additionalTurnsPerDay: z.number().int().positive(),
+    startsAt: timestamp,
+    expiresAt: timestamp,
+    reason,
+    status: z.enum(['scheduled', 'active', 'expired', 'revoked']),
+    createdAt: timestamp,
+    revokedAt: timestamp.optional(),
+    revocationReason: reason.optional(),
+};
+export const ManagedAssistantSponsorshipGrantSchema = strictObject(grantShape);
+const spendShape = {
+    state: z.enum(['normal', 'approaching', 'near', 'limited', 'closed']),
+    allowanceUnits: z.number().int().nonnegative(),
+    usedUnitsToday: z.number().int().nonnegative(),
+    turnsRemaining: z.number().int().nonnegative(),
+};
+const sponsorshipDataShape = {
+    billingAccountId,
+    mode: z.literal('sponsored_beta'),
+    defaultTurnsPerDay: z.number().int().nonnegative(),
+    bonusTurnsPerDay: z.number().int().nonnegative(),
+    totalTurnsPerDay: z.number().int().nonnegative(),
+    spend: strictObject(spendShape),
+    resetAt: timestamp,
+    grants: z.array(ManagedAssistantSponsorshipGrantSchema),
+    platform: strictObject({
+        globalTurnsPerDay: z.number().int().nonnegative(),
+        spend: strictObject(spendShape),
+    }).optional(),
+};
+export const ManagedAssistantSponsorshipResponseSchema = strictObject({
+    ok: z.literal(true),
+    data: strictObject(sponsorshipDataShape),
+});
+const grantClientSchema = additiveObject(grantShape);
+const spendClientSchema = additiveObject(spendShape);
+const sponsorshipClientDataSchema = additiveObject({
+    ...sponsorshipDataShape,
+    spend: spendClientSchema,
+    grants: z.array(grantClientSchema),
+    platform: additiveObject({
+        globalTurnsPerDay: z.number().int().nonnegative(),
+        spend: spendClientSchema,
+    }).optional(),
+});
+/** Client reader strips additive fields at every layer while the service output stays strict. */
+export const ManagedAssistantSponsorshipClientResponseSchema = additiveObject({
+    ok: z.literal(true),
+    data: sponsorshipClientDataSchema,
+});
+export const ManagedAssistantSponsorshipGrantMutationResponseSchema = strictObject({
+    ok: z.literal(true),
+    data: strictObject({
+        replayed: z.boolean(),
+        grant: ManagedAssistantSponsorshipGrantSchema,
+        sponsorship: strictObject(sponsorshipDataShape),
+    }),
+});
+export const ManagedAssistantSponsorshipGrantMutationClientResponseSchema = additiveObject({
+    ok: z.literal(true),
+    data: additiveObject({
+        replayed: z.boolean(),
+        grant: grantClientSchema,
+        sponsorship: sponsorshipClientDataSchema,
+    }),
+});
+//# sourceMappingURL=managed-assistant-sponsorship.js.map

package/node_modules/@noodleseed/assistant/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/assistant",
-  "version": "1.30.0",
+  "version": "1.31.0",
   "description": "Embed the Noodle Seed customer-branded assistant in your web app with managed or framework-owned UI, a framework-neutral MCP App host, a DOM-free client, and a backend session helper. Authoring and deploying the server is @noodleseed/one.",
   "license": "Apache-2.0",
   "repository": {