@noodleseed/one 0.150.0 → 0.151.1

package/node_modules/@noodle-borg/cli-catalog/dist/catalog-data-assistant.js

@@ -154,6 +154,99 @@ const BUDGET_SUBCOMMAND = subcommand({
         }),
     ],
 });
+const SPONSORSHIP_ACCOUNT_ARGUMENT = argument({
+    ...ARGUMENT_FIELDS,
+    name: 'billing-account-id',
+    type: 'string',
+    summary: 'Billing account receiving the sponsored allowance.',
+    required: true,
+});
+const SPONSORSHIP_FLAGS = [SERVICE_FLAG, AUTH_TOKEN_FLAG, JSON_FLAG];
+const SPONSORSHIP_REASON_FLAG = flag({
+    ...FLAG_FIELDS,
+    name: 'reason',
+    type: 'string',
+    value: '<text>',
+    summary: 'Auditable reason for granting or revoking sponsored usage.',
+    required: true,
+});
+const SPONSORSHIP_IDEMPOTENCY_FLAG = flag({
+    ...FLAG_FIELDS,
+    name: 'idempotency-key',
+    type: 'string',
+    value: '<key>',
+    summary: 'Stable retry key for exactly-once mutation semantics.',
+    required: true,
+});
+const SPONSORSHIP_SUBCOMMAND = subcommand({
+    ...SUBCOMMAND_FIELDS,
+    name: 'sponsorship',
+    summary: 'Inspect sponsored managed-assistant usage or operate expiring bonus grants.',
+    subcommands: [
+        subcommand({
+            ...SUBCOMMAND_FIELDS,
+            name: 'inspect',
+            summary: 'Show one billing account’s allowance, usage, reset, and grants.',
+            arguments: [SPONSORSHIP_ACCOUNT_ARGUMENT],
+            flags: [...SPONSORSHIP_FLAGS],
+            jsonOutput: { mode: 'single' },
+        }),
+        subcommand({
+            ...SUBCOMMAND_FIELDS,
+            name: 'grant',
+            summary: 'Add a bounded daily allowance until an explicit expiry.',
+            arguments: [SPONSORSHIP_ACCOUNT_ARGUMENT],
+            flags: [
+                flag({
+                    ...FLAG_FIELDS,
+                    name: 'turns-per-day',
+                    type: 'integer',
+                    value: '<count>',
+                    summary: 'Additional sponsored turns per UTC day.',
+                    required: true,
+                    constraints: { minimum: 1, maximum: 100_000 },
+                }),
+                flag({
+                    ...FLAG_FIELDS,
+                    name: 'starts-at',
+                    type: 'string',
+                    value: '<timestamp>',
+                    summary: 'Optional ISO timestamp; defaults to now.',
+                    constraints: { default: 'now' },
+                }),
+                flag({
+                    ...FLAG_FIELDS,
+                    name: 'expires-at',
+                    type: 'string',
+                    value: '<timestamp>',
+                    summary: 'Required ISO timestamp after which the grant stops applying.',
+                    required: true,
+                }),
+                SPONSORSHIP_REASON_FLAG,
+                SPONSORSHIP_IDEMPOTENCY_FLAG,
+                ...SPONSORSHIP_FLAGS,
+            ],
+            jsonOutput: { mode: 'single' },
+        }),
+        subcommand({
+            ...SUBCOMMAND_FIELDS,
+            name: 'revoke',
+            summary: 'Revoke one bonus grant without deleting its audit history.',
+            arguments: [
+                SPONSORSHIP_ACCOUNT_ARGUMENT,
+                argument({
+                    ...ARGUMENT_FIELDS,
+                    name: 'grant-id',
+                    type: 'string',
+                    summary: 'Managed-assistant sponsorship grant identifier.',
+                    required: true,
+                }),
+            ],
+            flags: [SPONSORSHIP_REASON_FLAG, SPONSORSHIP_IDEMPOTENCY_FLAG, ...SPONSORSHIP_FLAGS],
+            jsonOutput: { mode: 'single' },
+        }),
+    ],
+});
 const CLIENTS_SUBCOMMAND = subcommand({
     ...SUBCOMMAND_FIELDS,
     name: 'clients',
@@ -269,6 +362,7 @@ export const ASSISTANT_COMMAND = {
         CLIENTS_SUBCOMMAND,
         EMBEDS_SUBCOMMAND,
         BUDGET_SUBCOMMAND,
+        SPONSORSHIP_SUBCOMMAND,
         subcommand({
             ...SUBCOMMAND_FIELDS,
             name: 'usage',

package/node_modules/@noodle-borg/cli-catalog/dist/catalog-data-hosted-observability.js

@@ -352,7 +352,7 @@ export const CATALOG_HOSTED_OBSERVABILITY = [
         name: 'intents',
         section: 'operate',
         helpRank: 5,
-        summary: 'Optional model-supplied user-goal insights, enabled per environment.',
+        summary: 'Optional model-supplied user-goal insights for private-preview environments.',
         arguments: [],
         subcommands: [
             subcommand({

package/node_modules/@noodle-borg/module/dist/index.d.ts

@@ -4,6 +4,7 @@ export * from './deployment-activation.js';
 export * from './deployment-automation.js';
 export * from './endpoint-url.js';
 export * from './intent.js';
+export * from './logger.js';
 export * from './organization-provisioning.js';
 export * from './platform-human-identity.js';
 export * from './request-analytics.js';

package/node_modules/@noodle-borg/module/dist/index.js

@@ -4,6 +4,7 @@ export * from './deployment-activation.js';
 export * from './deployment-automation.js';
 export * from './endpoint-url.js';
 export * from './intent.js';
+export * from './logger.js';
 export * from './organization-provisioning.js';
 export * from './platform-human-identity.js';
 export * from './request-analytics.js';

package/node_modules/@noodle-borg/module/dist/logger.d.ts

@@ -0,0 +1,15 @@
+import type { ModuleLogger } from './contract.js';
+export type ModuleLogLevel = 'debug' | 'info' | 'warn' | 'error';
+export type ModuleLogFields = Readonly<Record<string, unknown>>;
+/** Adapt a module host logger to the child-capable shape used by service integrations. */
+export interface AdaptedModuleLogger {
+    readonly level: ModuleLogLevel;
+    log(level: ModuleLogLevel, event: string, fields?: ModuleLogFields): void;
+    debug(event: string, fields?: ModuleLogFields): void;
+    info(event: string, fields?: ModuleLogFields): void;
+    warn(event: string, fields?: ModuleLogFields): void;
+    error(event: string, fields?: ModuleLogFields): void;
+    child(fields: ModuleLogFields): AdaptedModuleLogger;
+}
+export declare function adaptModuleLogger(logger: ModuleLogger, base?: ModuleLogFields): AdaptedModuleLogger;
+//# sourceMappingURL=logger.d.ts.map

package/node_modules/@noodle-borg/module/dist/logger.js

@@ -0,0 +1,16 @@
+export function adaptModuleLogger(logger, base = {}) {
+    const fields = (extra) => ({ ...base, ...extra });
+    const log = (level, event, extra) => {
+        logger[level](event, fields(extra));
+    };
+    return {
+        level: 'debug',
+        log,
+        debug: (event, extra) => log('debug', event, extra),
+        info: (event, extra) => log('info', event, extra),
+        warn: (event, extra) => log('warn', event, extra),
+        error: (event, extra) => log('error', event, extra),
+        child: (extra) => adaptModuleLogger(logger, fields(extra)),
+    };
+}
+//# sourceMappingURL=logger.js.map

package/node_modules/@noodle-borg/observability/dist/assistant-app-tool-usage.js

@@ -1,4 +1,5 @@
 import { randomUUID } from 'node:crypto';
+import { captureAssistantUsage } from './assistant-usage.js';
 /** Project one apps-bridge tool call onto the shared tenant request stream. */
 export function assistantAppToolCallRequestEvent(session, input) {
     const isPublic = session.publicEmbedId !== undefined;
@@ -13,7 +14,7 @@ export function assistantAppToolCallRequestEvent(session, input) {
         surface: input.bridged ? 'webmcp' : isPublic ? 'assistant-public' : 'assistant-authenticated',
         method: 'tools/call',
         kind: 'usage',
-        toolName: input.toolName,
+        ...(input.toolName === undefined ? {} : { toolName: input.toolName }),
         outcome: input.outcome === 'ok' ? 'ok' : input.outcome === 'refused' ? 'tool_error' : 'mcp_error',
         ...(input.errorKind === undefined ? {} : { errorKind: input.errorKind }),
         durationMs: Number.isFinite(input.durationMs) && input.durationMs > 0 ? input.durationMs : 0,
@@ -22,4 +23,25 @@ export function assistantAppToolCallRequestEvent(session, input) {
         details: { eventKind: 'appToolCall', bridged: input.bridged },
     };
 }
+/**
+ * Bind one apps-bridge tool call's fixed facts, leaving the caller a recorder it can run at any
+ * exit. The route reaches several of them -- a budget refusal before any resolution work, an
+ * unprojected tool, bad arguments, a raised confirmation, a result -- and assembling the event at
+ * each one is how one of them ends up forgotten, which is what happened to the budget refusal.
+ */
+export function assistantAppToolCallRecorder(input) {
+    const startedAt = input.clock();
+    return (outcome, errorKind) => {
+        captureAssistantUsage(input.capture, assistantAppToolCallRequestEvent(input.session, {
+            // Absent when the caller named no tool. That row still matters: a nameless call that
+            // exhausts a budget is the shape abusive traffic takes, and it is the row an operator
+            // watching a browser agent would miss if a missing name suppressed the event.
+            ...(input.toolName === undefined ? {} : { toolName: input.toolName }),
+            bridged: input.bridged,
+            outcome,
+            ...(errorKind === undefined ? {} : { errorKind }),
+            durationMs: input.clock() - startedAt,
+        }));
+    };
+}
 //# sourceMappingURL=assistant-app-tool-usage.js.map

package/node_modules/@noodle-borg/service/dist/observability-runtime.js

@@ -8,16 +8,17 @@ export function createObservabilityStores(options) {
         options.intentCaptureSettingsStore ?? new InMemoryIntentCaptureSettingsStore(),
         options.intentEventStore ?? new InMemoryIntentEventStore(),
         options.requestEventStore ?? new InMemoryRequestEventStore(),
+        new Set(options.intentCapturePreviewOrgs ?? []),
     ];
 }
-export async function resolveIntentMode(target, ref, settings) {
+export async function resolveIntentMode(target, ref, previewOrgs, settings) {
     if (target === undefined)
         return undefined;
     const resolved = ref ??
         (target.org !== undefined && target.app !== undefined && target.environment !== undefined
             ? { org: target.org, app: target.app, env: target.environment }
             : undefined);
-    if (resolved === undefined)
+    if (resolved === undefined || !previewOrgs.has(resolved.org))
         return target;
     try {
         const setting = await settings.get(resolved);
@@ -27,8 +28,8 @@ export async function resolveIntentMode(target, ref, settings) {
         return target;
     }
 }
-export function createIntentTargetResolver(settings) {
-    return (target, ref) => resolveIntentMode(target, ref, settings);
+export function createIntentTargetResolver(settings, previewOrgs) {
+    return (target, ref) => resolveIntentMode(target, ref, previewOrgs, settings);
 }
 export function createObservabilityDispatcher(deps) {
     return (req, res, url) => dispatchAnalyticsReads(req, res, url, {
@@ -49,6 +50,7 @@ export function createObservabilityDispatcher(deps) {
             requests: deps.requestEvents,
             audit: deps.audit,
             maxBody: deps.maxBody,
+            previewOrgs: deps.previewOrgs,
             applySecurityHeaders,
             enforceHttps,
             sendJson,

package/node_modules/@noodle-borg/service/dist/routes/assistant-agent.js

@@ -1,6 +1,6 @@
 import { ADMISSION_DEFAULTS } from '@noodle-borg/admission-limits/portable';
 import { assistantCoreModelMessages, assistantTurnModelContextMessages, requestAssistantSuggestedPrompts, requestModelCompletion, resolveAssistantContextProviderModelResult, } from '@noodle-borg/assistant-gateway/model-runtime';
-import { assistantGuideModelContext, assistantModelToolOncePerSession, assistantModelToolRequiredWhenVisible, assistantOmittedToolResult, assistantViewAvailableData, dispatchAssistantTool, projectAssistantGuide, publicSurfaceOf, selectAssistantModelTools, toolTouchesDelegatedAuth, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
+import { assistantGuideModelContext, assistantModelToolOncePerSession, assistantModelToolRequiredWhenVisible, assistantOmittedToolResult, assistantViewAvailableData, dispatchAssistantTool, projectAssistantGuide, publicSurfaceOf, remainingTurnTokens, selectAssistantModelTools, toolTouchesDelegatedAuth, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
 import { validateJsonSchemaWithDefaults } from '@noodle-borg/compiler';
 import { guardedFetch } from '@noodle-borg/connector-http';
 import { evaluateToolAuthorization } from '@noodle-borg/protocol';
@@ -122,7 +122,7 @@ export async function runAgentTurn(target, session, message, context, deps, emit
         stats.reasoningTokens += completion.usage?.reasoningTokens ?? 0;
         stats.totalTokens += completion.usage?.totalTokens ?? 0;
         if (remainingTokens !== undefined) {
-            remainingTokens = Math.max(0, remainingTokens - (completion.usage?.completionTokens ?? requestTokenLimit));
+            remainingTokens = remainingTurnTokens(remainingTokens, completion.usage, requestTokenLimit);
         }
         const response = completion.choices[0]?.message;
         if (!response)

package/node_modules/@noodle-borg/service/dist/routes/assistant.js

@@ -3,7 +3,7 @@ import { assistantModelFailure, assistantModelSource, assistantModelTransport, }
 import { ASSISTANT_SESSION_IDLE_MS, effectiveAssistantBrowserConfiguration, executeAssistantAppToolCall, isAssistantPageContext, isAssistantVerifiedClaims, parseAssistantContextPreferences, parseAssistantCustomerRouting, refuseBridgeToolCall, refusePublicTurn, resolveInvocationContextSnapshot, resumeTurnMessage, resumeUnavailableMessage, shouldAutoResume, surfaceBindingForOrigin, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
 import { canonicalizeAuthorizationClaimValues } from '@noodle-borg/auth';
 import { tenantMcpUrl } from '@noodle-borg/module';
-import { assistantAppToolCallRequestEvent, assistantRefusedTurnUsageRequestEvent, assistantSessionUsageRequestEvent, assistantTurnNumber, assistantTurnUsageRequestEvent, captureAssistantUsage, } from '@noodle-borg/observability';
+import { assistantAppToolCallRecorder, assistantRefusedTurnUsageRequestEvent, assistantSessionUsageRequestEvent, assistantTurnNumber, assistantTurnUsageRequestEvent, captureAssistantUsage, } from '@noodle-borg/observability';
 import { mapExecutionError, mapResourceContents, mapResourcesList, mapToolOutput, mapToolsList, } from '@noodle-borg/protocol';
 import { executeResource } from '@noodle-borg/runtime';
 import { assistantMessageTurnRequestSchema, assistantResumeTurnRequestSchema, assistantSessionResponseSchema, } from '@noodle-borg/wire-contracts';
@@ -385,9 +385,21 @@ export async function handleAssistantAppRequest(req, res, deps) {
     // Answered before any resolution work, so a refused browser agent costs nothing (ADR 0220). The
     // marker is client-declared: it selects a budget, never authority, which the session below decides.
     const bridged = method === 'tools/call' && body.value.bridge === 'webmcp';
+    // Bound before the budget gate below, because that refusal is the one an operator watching a
+    // browser agent most needs to see, and answering it before any resolution work must not mean
+    // answering it silently. `bridged` is attribution only: it labels the row, never authority.
+    const record = assistantAppToolCallRecorder({
+        capture: deps.captureRequestEvent,
+        session,
+        ...(typeof params.name === 'string' ? { toolName: params.name } : { toolName: undefined }),
+        bridged,
+        clock: () => performance.now(),
+    });
     const refusal = bridged ? await refuseBridgeToolCall(deps, session) : undefined;
-    if (refusal)
+    if (refusal) {
+        record('refused', refusal.code);
         return sendJson(res, refusal.status, { error: refusal.message, code: refusal.code });
+    }
     const knowledge = await resolveAssistantKnowledge(target.served);
     if (method === 'tools/list') {
         return sendJson(res, 200, mapToolsList(target.served.artifact, session.caller, {
@@ -423,25 +435,23 @@ export async function handleAssistantAppRequest(req, res, deps) {
         return sendJson(res, 200, mapResourceContents(resource.uri, resource.mimeType, execution.output, resource._meta));
     }
     if (method === 'tools/call') {
-        if (typeof params.name !== 'string')
+        if (typeof params.name !== 'string') {
+            record('refused', 'tool_name_required');
             return sendJson(res, 400, { error: 'tool name required' });
-        const startedAt = performance.now();
+        }
         const toolName = params.name;
-        // Recorded on every exit below, including the refusals: a rejected browser-agent call is
-        // exactly the traffic an operator watching one needs to see (ADR 0220 decision 6).
-        const record = (outcome, errorKind) => captureAssistantUsage(deps.captureRequestEvent, assistantAppToolCallRequestEvent(session, {
-            toolName,
-            // Attribution only. The marker labels the row; the session decided authority above.
-            bridged,
-            outcome,
-            ...(errorKind === undefined ? {} : { errorKind }),
-            durationMs: performance.now() - startedAt,
-        }));
         const knowledgeComponent = findAssistantKnowledgeComponent(knowledge, toolName);
         if (knowledge !== undefined && knowledgeComponent !== undefined) {
             const content = await executeAssistantKnowledgeSearch(knowledge, knowledgeComponent, params.arguments ?? {});
-            record('ok');
-            return sendJson(res, 200, mapToolOutput(JSON.parse(content)));
+            // A knowledge search reports failure in its payload rather than by throwing, so reading the
+            // envelope is the only way not to file a refused or failed search as a successful one.
+            const payload = JSON.parse(content);
+            const failure = isRecord(payload) && typeof payload.error === 'string' ? payload.error : undefined;
+            if (failure === undefined)
+                record('ok');
+            else
+                record(failure === 'invalid_arguments' ? 'refused' : 'failed', failure);
+            return sendJson(res, 200, mapToolOutput(payload));
         }
         const call = await executeAssistantAppToolCall({
             artifact: target.served.artifact,

package/node_modules/@noodle-borg/service/dist/routes/intent-capture.js

@@ -14,6 +14,9 @@ export async function handleIntentCaptureSettings(req, res, ref, deps) {
         const identity = await authorizeTenantControl(req, res, deps.gate, deps.controlPlane, ref.org);
         if (identity === false)
             return;
+        if (!deps.previewOrgs.has(ref.org)) {
+            return sendJson(res, 403, { ok: false, error: 'intent capture preview is unavailable' });
+        }
         const setting = await deps.settings.get(ref);
         return sendJson(res, 200, {
             ok: true,
@@ -29,6 +32,9 @@ export async function handleIntentCaptureSettings(req, res, ref, deps) {
         const identity = await authorizeOwner(req, res, ref, deps);
         if (identity === undefined)
             return;
+        if (!deps.previewOrgs.has(ref.org)) {
+            return sendJson(res, 403, { ok: false, error: 'intent capture preview is unavailable' });
+        }
         const body = await readJsonBody(req, deps.maxBody);
         if (!body.ok)
             return sendJson(res, body.status, { error: body.error });
@@ -68,6 +74,9 @@ export async function handleIntentCaptureSettings(req, res, ref, deps) {
         const identity = await authorizeOwner(req, res, ref, deps);
         if (identity === undefined)
             return;
+        if (!deps.previewOrgs.has(ref.org)) {
+            return sendJson(res, 403, { ok: false, error: 'intent capture preview is unavailable' });
+        }
         await deps.settings.delete(ref);
         const purged = await deps.intents.purge(ref);
         await deps.audit.emit({
@@ -89,6 +98,9 @@ export async function handleIntentInsights(req, res, ref, url, deps) {
     const identity = await authorizeTenantControl(req, res, deps.gate, deps.controlPlane, ref.org);
     if (identity === false)
         return;
+    if (!deps.previewOrgs.has(ref.org)) {
+        return sendJson(res, 403, { ok: false, error: 'intent capture preview is unavailable' });
+    }
     const windowName = url.searchParams.get('window') ?? '7d';
     const windowMs = WINDOWS_MS.get(windowName);
     if (windowMs === undefined) {

package/node_modules/@noodle-borg/service/dist/service.js

@@ -57,7 +57,7 @@ export function createServiceHandler(registry, options = {}) {
     let activeAudit;
     const configStore = options.configStore ?? registry.configStore;
     const alertRuleStore = options.alertRuleStore ?? new InMemoryAlertRuleStore();
-    const [intentSettings, intentEvents, requestEvents] = createObservabilityStores(options);
+    const [intentSettings, intentEvents, requestEvents, intentPreviewOrgs] = createObservabilityStores(options);
     const assistantStore = options.assistantStore ?? new InMemoryAssistantStore();
     const assistantAppearance = options.assistantAppearance ?? new InMemoryAssistantAppearanceSettingsStore();
     const anonymousLimiter = new AnonymousConsumerLimiter();
@@ -76,7 +76,7 @@ export function createServiceHandler(registry, options = {}) {
     activeAudit = audit;
     const { publicTenantRouting } = mcp.mcpRoutingOptions(options, controlPlane);
     const resolveEndpointOptions = (org) => mcp.endpointUrlOptionsForOrg(options, controlPlane, org);
-    const withIntentMode = createIntentTargetResolver(intentSettings);
+    const withIntentMode = createIntentTargetResolver(intentSettings, intentPreviewOrgs);
     const router = createMcpRouter(async (id) => withIntentMode(await registry.getServing(id)), {
         logger,
         tls,
@@ -122,6 +122,7 @@ export function createServiceHandler(registry, options = {}) {
         requestEvents,
         intentEvents,
         intentSettings,
+        previewOrgs: intentPreviewOrgs,
         audit,
         maxBody,
         tls,

package/node_modules/@noodle-borg/service/package.json

@@ -39,7 +39,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.89.0",
+    "@noodle-borg/agent-kit": "0.91.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",
     "@noodle-borg/auth": "0.0.0",

package/node_modules/@noodle-borg/wire-contracts/dist/index.d.ts

@@ -18,6 +18,7 @@ export * from './deployment-package.js';
 export * from './distribution.js';
 export * from './feedback.js';
 export * from './knowledge.js';
+export * from './managed-assistant-sponsorship.js';
 export * from './platform-account-reset.js';
 export * from './platform-auth.js';
 /** Informational origin of a deployment; never an authorization or policy input. */

package/node_modules/@noodle-borg/wire-contracts/dist/index.js

@@ -20,6 +20,7 @@ export * from './deployment-package.js';
 export * from './distribution.js';
 export * from './feedback.js';
 export * from './knowledge.js';
+export * from './managed-assistant-sponsorship.js';
 export * from './platform-account-reset.js';
 export * from './platform-auth.js';
 // ─── Deploy ─────────────────────────────────────────────────────────────────────