@noodleseed/one 0.151.0 → 0.152.0

package/node_modules/@noodle-borg/compiler/dist/artifact/types.d.ts

@@ -150,6 +150,7 @@ export interface ArtifactStateHandle {
     readonly version: string;
     readonly scope: ArtifactStateHandleScope;
     readonly ttlSeconds?: number;
+    readonly claimOnAuthentication?: true;
 }
 export interface ArtifactState {
     readonly handles: Readonly<Record<string, ArtifactStateHandle>>;

package/node_modules/@noodle-borg/compiler/dist/artifact/version.d.ts

@@ -47,8 +47,11 @@
  * endpoint claim mappings, resolved operation references may carry ordinary/action endpoint dependency
  * keys, and artifacts carry only endpoint policies. Resolved customer URLs remain request-private runtime
  * state.
+ *
+ * `0.16.0` (Anonymous-to-authenticated onboarding): additive — finite caller-scoped state handles may
+ * opt into atomic ownership adoption when a single-use assistant sign-in ticket is spent.
  */
-export declare const ARTIFACT_SCHEMA_VERSION = "0.15.0";
+export declare const ARTIFACT_SCHEMA_VERSION = "0.16.0";
 /** mimeType for an MCP Apps UI resource (SEP-1865). Widgets are served under this profile. */
 export declare const MCP_APP_MIME_TYPE = "text/html;profile=mcp-app";
 //# sourceMappingURL=version.d.ts.map

package/node_modules/@noodle-borg/compiler/dist/artifact/version.js

@@ -47,8 +47,11 @@
  * endpoint claim mappings, resolved operation references may carry ordinary/action endpoint dependency
  * keys, and artifacts carry only endpoint policies. Resolved customer URLs remain request-private runtime
  * state.
+ *
+ * `0.16.0` (Anonymous-to-authenticated onboarding): additive — finite caller-scoped state handles may
+ * opt into atomic ownership adoption when a single-use assistant sign-in ticket is spent.
  */
-export const ARTIFACT_SCHEMA_VERSION = '0.15.0';
+export const ARTIFACT_SCHEMA_VERSION = '0.16.0';
 /** mimeType for an MCP Apps UI resource (SEP-1865). Widgets are served under this profile. */
 export const MCP_APP_MIME_TYPE = 'text/html;profile=mcp-app';
 //# sourceMappingURL=version.js.map

package/node_modules/@noodle-borg/compiler/dist/manifest/schema.d.ts

@@ -25,6 +25,7 @@ export declare const manifestV1Schema: z.ZodObject<{
                 caller: "caller";
             }>>;
             ttlSeconds: z.ZodOptional<z.ZodNumber>;
+            claimOnAuthentication: z.ZodOptional<z.ZodLiteral<true>>;
         }, z.core.$strict>>;
     }, z.core.$strict>>;
     requires: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodBoolean>>;
@@ -549,6 +550,7 @@ export declare const manifestV2Schema: z.ZodObject<{
                 caller: "caller";
             }>>;
             ttlSeconds: z.ZodOptional<z.ZodNumber>;
+            claimOnAuthentication: z.ZodOptional<z.ZodLiteral<true>>;
         }, z.core.$strict>>;
     }, z.core.$strict>>;
     requires: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodBoolean>>;
@@ -1199,6 +1201,7 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                 caller: "caller";
             }>>;
             ttlSeconds: z.ZodOptional<z.ZodNumber>;
+            claimOnAuthentication: z.ZodOptional<z.ZodLiteral<true>>;
         }, z.core.$strict>>;
     }, z.core.$strict>>;
     requires: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodBoolean>>;
@@ -1722,6 +1725,7 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                 caller: "caller";
             }>>;
             ttlSeconds: z.ZodOptional<z.ZodNumber>;
+            claimOnAuthentication: z.ZodOptional<z.ZodLiteral<true>>;
         }, z.core.$strict>>;
     }, z.core.$strict>>;
     requires: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodBoolean>>;

package/node_modules/@noodle-borg/compiler/dist/manifest/schema.js

@@ -490,8 +490,27 @@ const stateHandleSchema = z
         .positive()
         .max(60 * 60 * 24 * 30)
         .optional(),
+    claimOnAuthentication: z.literal(true).optional(),
 })
-    .strict();
+    .strict()
+    .superRefine((handle, ctx) => {
+    if (handle.claimOnAuthentication !== true)
+        return;
+    if (handle.scope !== 'caller') {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['scope'],
+            message: 'claimOnAuthentication requires an explicit caller scope',
+        });
+    }
+    if (handle.ttlSeconds === undefined) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['ttlSeconds'],
+            message: 'claimOnAuthentication requires a finite ttlSeconds',
+        });
+    }
+});
 const stateSchema = z
     .object({
     handles: z

package/node_modules/@noodle-borg/compiler/dist/state-handles.js

@@ -27,6 +27,7 @@ export function compileState(manifest, schemasMap, errors) {
             version: handle.version,
             scope: handle.scope ?? 'deployment',
             ...(handle.ttlSeconds !== undefined ? { ttlSeconds: handle.ttlSeconds } : {}),
+            ...(handle.claimOnAuthentication === true ? { claimOnAuthentication: true } : {}),
         };
     }
     return { handles };

package/node_modules/@noodle-borg/runtime/dist/index.d.ts

@@ -18,6 +18,7 @@ export { AllowAllPolicy } from './policy/allow-all.js';
 export type { PolicyContext, PolicyDecision, PolicyGate } from './policy/types.js';
 export { type ConfirmationActionReview, type ConfirmationPreparationResult, type ConfirmationReview, type ConnectorFailureAttribution, type ElicitationRequest, type ElicitationResponse, type ExecutionError, type ExecutionErrorCode, type ExecutionResult, type InteractiveExecutionResult, isConfirmationRequired, isInputRequired, isInputRequiredForConfirmation, type PreparedOperationAction, type PreparedToolContinuation, type ToolContinuation, type ToolPreparationContinuation, } from './result.js';
 export { splitResultMeta } from './result-meta.js';
+export { type CallerStateAdoptionInput, type CallerStateAdoptionResult, claimableStateHandleNames, } from './state-handle-ownership.js';
 export { assertExpectedStateRevision, assertNoSecretValue, assertSchemaValue, assertStateHandleNotCompleted, COMPLETE_STATE_OPERATION, createMutableStateHandleRecord, createStateConnector, InMemoryStateHandleStore, type MutableStateHandleRecord, PATCH_STATE_OPERATION, READ_STATE_OPERATION, STATE_CONNECTOR_ID, STATE_CONNECTOR_VERSION, STATE_OPERATION_SIGNATURES, StateConnector, type StateHandleRecord, type StateHandleStore, type StateInput, type StateMutationInput, type StatePatchInput, stateHandleRecordForMutation, toPublicStateHandleRecord, } from './state-handles.js';
 export type { ToolDispatchContext, ToolDispatchDecision, ToolDispatchHook, } from './tool-dispatch.js';
 //# sourceMappingURL=index.d.ts.map

package/node_modules/@noodle-borg/runtime/dist/index.js

@@ -15,5 +15,6 @@ export { resolveManagedOrigins, } from './managed-origins.js';
 export { AllowAllPolicy } from './policy/allow-all.js';
 export { isConfirmationRequired, isInputRequired, isInputRequiredForConfirmation, } from './result.js';
 export { splitResultMeta } from './result-meta.js';
+export { claimableStateHandleNames, } from './state-handle-ownership.js';
 export { assertExpectedStateRevision, assertNoSecretValue, assertSchemaValue, assertStateHandleNotCompleted, COMPLETE_STATE_OPERATION, createMutableStateHandleRecord, createStateConnector, InMemoryStateHandleStore, PATCH_STATE_OPERATION, READ_STATE_OPERATION, STATE_CONNECTOR_ID, STATE_CONNECTOR_VERSION, STATE_OPERATION_SIGNATURES, StateConnector, stateHandleRecordForMutation, toPublicStateHandleRecord, } from './state-handles.js';
 //# sourceMappingURL=index.js.map

package/node_modules/@noodle-borg/runtime/dist/state-handle-ownership.d.ts

@@ -0,0 +1,21 @@
+import type { ArtifactState } from '@noodle-borg/compiler';
+export interface CallerStateAdoptionInput {
+    readonly deploymentId: string;
+    readonly handles: readonly string[];
+    readonly sourceCallerSubject: string;
+    readonly targetCallerSubject: string;
+    /** The old anonymous session's absolute expiry; redirects never extend its authority. */
+    readonly redirectExpiresAt: Date;
+    readonly now: Date;
+}
+export type CallerStateAdoptionResult = {
+    readonly ok: true;
+    readonly adoptedHandles: readonly string[];
+    readonly adoptedRecords: number;
+} | {
+    readonly ok: false;
+    readonly reason: 'state_key_conflict';
+};
+/** The canonical sorted declaration projection stored on an elevation ticket. */
+export declare function claimableStateHandleNames(state: ArtifactState | undefined): readonly string[];
+//# sourceMappingURL=state-handle-ownership.d.ts.map

package/node_modules/@noodle-borg/runtime/dist/state-handle-ownership.js

@@ -0,0 +1,10 @@
+/** The canonical sorted declaration projection stored on an elevation ticket. */
+export function claimableStateHandleNames(state) {
+    if (state === undefined)
+        return [];
+    return Object.entries(state.handles)
+        .filter(([, handle]) => handle.claimOnAuthentication === true)
+        .map(([name]) => name)
+        .sort();
+}
+//# sourceMappingURL=state-handle-ownership.js.map

package/node_modules/@noodle-borg/runtime/package.json

@@ -12,6 +12,10 @@
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
+    },
+    "./postgres": {
+      "types": "./dist/postgres.d.ts",
+      "import": "./dist/postgres.js"
     }
   },
   "files": [
@@ -26,6 +30,7 @@
     "@noodle-borg/module": "0.0.0"
   },
   "devDependencies": {
-    "@types/node": "^24.13.1"
+    "@types/node": "^24.13.1",
+    "@types/pg": "^8.20.0"
   }
 }

package/node_modules/@noodle-borg/service/dist/routes/assistant-agent.js

@@ -1,6 +1,6 @@
 import { ADMISSION_DEFAULTS } from '@noodle-borg/admission-limits/portable';
 import { assistantCoreModelMessages, assistantTurnModelContextMessages, requestAssistantSuggestedPrompts, requestModelCompletion, resolveAssistantContextProviderModelResult, } from '@noodle-borg/assistant-gateway/model-runtime';
-import { assistantGuideModelContext, assistantModelToolOncePerSession, assistantModelToolRequiredWhenVisible, assistantOmittedToolResult, assistantViewAvailableData, dispatchAssistantTool, projectAssistantGuide, publicSurfaceOf, selectAssistantModelTools, toolTouchesDelegatedAuth, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
+import { assistantGuideModelContext, assistantModelToolOncePerSession, assistantModelToolRequiredWhenVisible, assistantOmittedToolResult, assistantViewAvailableData, dispatchAssistantTool, projectAssistantGuide, publicSurfaceOf, recoverableAssistantView, remainingTurnTokens, selectAssistantModelTools, toolTouchesDelegatedAuth, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
 import { validateJsonSchemaWithDefaults } from '@noodle-borg/compiler';
 import { guardedFetch } from '@noodle-borg/connector-http';
 import { evaluateToolAuthorization } from '@noodle-borg/protocol';
@@ -122,7 +122,7 @@ export async function runAgentTurn(target, session, message, context, deps, emit
         stats.reasoningTokens += completion.usage?.reasoningTokens ?? 0;
         stats.totalTokens += completion.usage?.totalTokens ?? 0;
         if (remainingTokens !== undefined) {
-            remainingTokens = Math.max(0, remainingTokens - (completion.usage?.completionTokens ?? requestTokenLimit));
+            remainingTokens = remainingTurnTokens(remainingTokens, completion.usage, requestTokenLimit);
         }
         const response = completion.choices[0]?.message;
         if (!response)
@@ -207,6 +207,9 @@ export async function runAgentTurn(target, session, message, context, deps, emit
                 tool,
                 session,
                 assistant,
+                ...(target.served.artifact.server.state === undefined
+                    ? {}
+                    : { state: target.served.artifact.server.state }),
                 elevations: deps.elevations,
                 ...(delegatedKeys !== undefined && delegatedKeys.size > 0
                     ? {
@@ -269,8 +272,10 @@ export async function runAgentTurn(target, session, message, context, deps, emit
                 result: dispatch.output,
                 arguments: args,
             }, (failure) => deps.logger?.warn('assistant.view.unresolved', { ...failure }));
-            if (view)
+            if (view) {
+                await deps.store.replaceLatestView(session.id, recoverableAssistantView(view));
                 emit({ event: 'view_available', data: { ...view } });
+            }
             messages.push({
                 role: 'tool',
                 tool_call_id: call.id,

package/node_modules/@noodle-borg/service/dist/routes/assistant-elevation.js

@@ -1,5 +1,6 @@
 import { completeElevation, publicSurfaceOf } from '@noodle-borg/assistant-gateway/portable';
 import { anonymousBehavior } from '@noodle-borg/compiler';
+import { claimableStateHandleNames } from '@noodle-borg/runtime';
 import { assistantSessionResponseSchema } from '@noodle-borg/wire-contracts';
 import { sendJson } from '../http-util.js';
 function isMixed(surface) {
@@ -16,6 +17,7 @@ const ELEVATION_REFUSAL_MESSAGES = {
     elevation_tenant_mismatch: 'sign-in ticket belongs to a different tenant',
     elevation_session_unavailable: 'the conversation behind this sign-in is no longer available',
     elevation_already_signed_in: 'this conversation is already signed in',
+    elevation_state_conflict: 'the signed-in account already has state at the same key; restart or resolve that draft first',
 };
 /**
  * Decide whether this call is an elevation instead of an execution.
@@ -40,6 +42,7 @@ export async function interceptForElevation(input) {
         sessionId: input.session.id,
         tenant: input.session.tenant,
         tool: input.tool.name,
+        claimableStateHandles: claimableStateHandleNames(input.state),
         now: input.now,
     });
     return {
@@ -84,7 +87,7 @@ export async function elevateAssistantSession(res, deps, input) {
             code: 'elevation_unavailable',
         });
     }
-    const elevated = await completeElevation({
+    const request = {
         continuation: input.signInTicket,
         tenant: input.client.tenant,
         caller: input.caller,
@@ -95,11 +98,14 @@ export async function elevateAssistantSession(res, deps, input) {
         ...(input.customerRouting ? { customerRouting: input.customerRouting } : {}),
         ...(input.boundSurface ? { boundSurface: input.boundSurface } : {}),
         resume: input.resume,
-    }, {
-        elevations: deps.elevations,
-        elevateSession: (request) => deps.store.elevateSession(request),
-        now: () => deps.clock?.() ?? new Date(),
-    });
+    };
+    const elevated = deps.elevationCoordinator
+        ? await deps.elevationCoordinator.complete(request)
+        : await completeElevation(request, {
+            elevations: deps.elevations,
+            elevateSession: (elevation) => deps.store.elevateSession(elevation),
+            now: () => deps.clock?.() ?? new Date(),
+        });
     if (!elevated.ok) {
         await deps.audit.emit({
             eventType: 'assistant.session.elevation_refused',
@@ -137,7 +143,8 @@ export async function elevateAssistantSession(res, deps, input) {
         endpoints: input.endpoints,
         ...(input.configuration ? { configuration: input.configuration } : {}),
         // The armed hint: the widget answers with one { resume: true } turn on the turns endpoint.
-        ...(input.resume ? { resume: { tool: elevated.tool } } : {}),
+        ...(elevated.resumeArmed ? { resume: { tool: elevated.tool } } : {}),
+        continuedAfterAuthentication: true,
     };
     assistantSessionResponseSchema.parse(body);
     return sendJson(res, 200, body);

package/node_modules/@noodle-borg/service/dist/routes/assistant-interaction-replay.js

@@ -1,4 +1,4 @@
-import { assistantInteractionTool, assistantViewAvailableData, auditAssistantInteraction, } from '@noodle-borg/assistant-gateway/portable';
+import { assistantInteractionTool, assistantViewAvailableData, auditAssistantInteraction, recoverableAssistantView, } from '@noodle-borg/assistant-gateway/portable';
 import { sendJson } from '../http-util.js';
 import { now } from './assistant.js';
 import { assistantInteractionScope } from './assistant-interaction-resolution.js';
@@ -71,8 +71,10 @@ export async function replayOrConflict(res, deps, session, interaction, action)
                 replayed: true,
             }, (failure) => deps.logger?.warn('assistant.view.unresolved', { ...failure }))
             : undefined;
-        if (view)
+        if (view) {
+            await deps.store.replaceLatestView(session.id, recoverableAssistantView(view));
             writeViewAvailable(res, view);
+        }
     }
     else if (current.status === 'failed') {
         writeInteractionError(res, current.publicOutcome.code, false);

package/node_modules/@noodle-borg/service/dist/routes/assistant-interactions.js

@@ -1,4 +1,4 @@
-import { AssistantInteractionCapacityError, assistantConfirmationReview, assistantConfirmationTransition, assistantInputTransition, assistantInteractionTool, assistantPreparedArgumentReview, assistantPreparedToolContinuation, assistantSafeOutput, assistantToolContinuation, assistantViewAvailableData, auditAssistantInteraction, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
+import { AssistantInteractionCapacityError, assistantConfirmationReview, assistantConfirmationTransition, assistantInputTransition, assistantInteractionTool, assistantPreparedArgumentReview, assistantPreparedToolContinuation, assistantSafeOutput, assistantToolContinuation, assistantViewAvailableData, auditAssistantInteraction, recoverableAssistantView, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
 import { executePreparedTool, executeToolInteractive, resumeTool, resumeToolPreparation, } from '@noodle-borg/runtime';
 import { readJsonBody, sendJson } from '../http-util.js';
 import { applyBrowserCors, authenticateSession, now, } from './assistant.js';
@@ -364,8 +364,10 @@ async function finishExecution(res, deps, session, interaction, context, result,
         tool: toolName,
         result: safeOutput,
     }, (failure) => deps.logger?.warn('assistant.view.unresolved', { ...failure }));
-    if (view)
+    if (view) {
+        await deps.store.replaceLatestView(session.id, recoverableAssistantView(view));
         writeViewAvailable(res, view);
+    }
     await narrateResolvedInteraction(res, deps, target, session, toolName, 'accept', safeOutput, context, suggestions);
     return endInteractionSse(res);
 }

package/node_modules/@noodle-borg/service/dist/routes/assistant-transcript.js

@@ -1,7 +1,7 @@
-import { visibleTranscript } from '@noodle-borg/assistant-gateway/portable';
-import { assistantTranscriptResponseSchema } from '@noodle-borg/wire-contracts';
-import { sendJson } from '../http-util.js';
+import { assistantConfirmationProposal, assistantTranscriptEvents, assistantViewAvailableData, visibleTranscript, } from '@noodle-borg/assistant-gateway/portable';
+import { assistantWireEventSchema } from '@noodle-borg/wire-contracts';
 import { applyBrowserCors, authenticateSession } from './assistant-route-http.js';
+import { sessionScopedTarget } from './assistant-session-target.js';
 /**
  * The bounded visible-transcript read (ADR 0141/0201 amendments 2026-08-26), in its own module for
  * the same reason `assistant-elevation.ts` is: `assistant.ts` is at its size limit, and this is a
@@ -18,15 +18,54 @@ export async function handleAssistantTranscript(req, res, deps) {
     if (!session)
         return;
     applyBrowserCors(req, res, session.origin);
-    const body = {
+    const target = await sessionScopedTarget(deps.registry, session);
+    const latestView = target && session.latestView
+        ? assistantViewAvailableData(target.served.artifact, { ...session.latestView, replayed: true }, (failure) => deps.logger?.warn('assistant.view.unresolved', { ...failure }))
+        : undefined;
+    const pending = await deps.store.findPendingInteraction({
+        sessionId: session.id,
+        deploymentId: session.deploymentId,
+        now: deps.clock?.() ?? new Date(),
+    });
+    const pendingInteraction = target && pending && target.served.artifact.tools.some((tool) => tool.name === pending.tool)
+        ? pending.kind === 'confirmation'
+            ? {
+                event: 'tool_proposed',
+                data: {
+                    id: pending.id,
+                    tool: pending.tool,
+                    ...assistantConfirmationProposal(pending.review),
+                    expiresAt: pending.expiresAt,
+                    requiresConfirmation: true,
+                },
+            }
+            : {
+                event: 'input_requested',
+                data: {
+                    id: pending.id,
+                    message: pending.message,
+                    requestedSchema: pending.requestedSchema,
+                    expiresAt: pending.expiresAt,
+                },
+            }
+        : undefined;
+    const events = assistantTranscriptEvents({
         entries: visibleTranscript(session.history),
         ...(session.latestSuggestions?.phase === 'follow_up'
             ? { suggestions: session.latestSuggestions }
             : {}),
-    };
-    // Parse before sending, like the session exchange: a contract break fails loudly here rather than
-    // stranding deployed widgets (ADR 0151).
-    assistantTranscriptResponseSchema.parse(body);
-    return sendJson(res, 200, body);
+        ...(latestView === undefined ? {} : { latestView }),
+        ...(pendingInteraction === undefined ? {} : { pendingInteraction }),
+    });
+    res.writeHead(200, {
+        'content-type': 'text/event-stream; charset=utf-8',
+        'cache-control': 'no-store',
+    });
+    for (const event of events) {
+        // Parse before sending, like every assistant stream: contract drift fails at the service seam.
+        assistantWireEventSchema.parse(event);
+        res.write(`event: ${event.event}\ndata: ${JSON.stringify(event.data)}\n\n`);
+    }
+    res.end();
 }
 //# sourceMappingURL=assistant-transcript.js.map

package/node_modules/@noodle-borg/service/dist/service.js

@@ -241,6 +241,9 @@ export function createServiceHandler(registry, options = {}) {
             appearance: assistantAppearance,
             ...(options.publicEmbeds !== undefined ? { publicEmbeds: options.publicEmbeds } : {}),
             ...(options.elevations !== undefined ? { elevations: options.elevations } : {}),
+            ...(options.elevationCoordinator !== undefined
+                ? { elevationCoordinator: options.elevationCoordinator }
+                : {}),
             ...(options.admissionCounters !== undefined
                 ? { admissionCounters: options.admissionCounters }
                 : {}),

package/node_modules/@noodle-borg/service/package.json

@@ -39,7 +39,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.90.0",
+    "@noodle-borg/agent-kit": "0.91.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",
     "@noodle-borg/auth": "0.0.0",

package/node_modules/@noodle-borg/wire-contracts/dist/assistant.d.ts

@@ -30,28 +30,9 @@ export declare const assistantSessionResponseSchema: z.ZodObject<{
     resume: z.ZodOptional<z.ZodObject<{
         tool: z.ZodString;
     }, z.core.$strip>>;
+    continuedAfterAuthentication: z.ZodOptional<z.ZodLiteral<true>>;
 }, z.core.$strip>;
 export type AssistantSessionResponse = z.infer<typeof assistantSessionResponseSchema>;
-/**
- * The bounded visible transcript (ADR 0141/0201 amendments 2026-08-26): only rows that actually
- * appeared in the panel — never tool internals, tickets, or model-facing scaffolding. Bounded by the
- * session history window (40 messages); a read spends no turn budget. Strict, because the service
- * parses its own response before sending, like the session exchange.
- */
-export declare const assistantTranscriptResponseSchema: z.ZodObject<{
-    entries: z.ZodArray<z.ZodObject<{
-        role: z.ZodEnum<{
-            assistant: "assistant";
-            user: "user";
-        }>;
-        text: z.ZodString;
-    }, z.core.$strict>>;
-    suggestions: z.ZodOptional<z.ZodObject<{
-        phase: z.ZodLiteral<"follow_up">;
-        prompts: z.ZodArray<z.ZodString>;
-    }, z.core.$strict>>;
-}, z.core.$strict>;
-export type AssistantTranscriptResponse = z.infer<typeof assistantTranscriptResponseSchema>;
 /** MCP-Apps-shaped, author-selected renderer summary included on one assistant turn. */
 export declare const assistantModelContextUpdateSchema: z.ZodObject<{
     content: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -150,6 +131,19 @@ export type AssistantInteractionRequest = z.infer<typeof assistantInteractionReq
  * proposal/completion payloads while clients talking to older services tolerate absent new fields.
  */
 export declare const assistantWireEventSchema: z.ZodUnion<readonly [z.ZodObject<{
+    event: z.ZodLiteral<string>;
+    data: z.ZodObject<{
+        message: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+    event: z.ZodLiteral<string>;
+    data: z.ZodObject<{
+        tool: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+    event: z.ZodLiteral<string>;
+    data: z.ZodObject<{}, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
     event: z.ZodLiteral<string>;
     data: z.ZodObject<{
         turnId: z.ZodOptional<z.ZodString>;
@@ -210,18 +204,18 @@ export declare const assistantWireEventSchema: z.ZodUnion<readonly [z.ZodObject<
 }, z.core.$strip>, z.ZodObject<{
     event: z.ZodLiteral<string>;
     data: z.ZodObject<{
-        turnId: z.ZodOptional<z.ZodString>;
-        id: z.ZodString;
         tool: z.ZodString;
+        id: z.ZodString;
         resourceUri: z.ZodString;
         title: z.ZodOptional<z.ZodString>;
         result: z.ZodJSONSchema;
         arguments: z.ZodOptional<z.ZodJSONSchema>;
-        html: z.ZodOptional<z.ZodString>;
         resourceMeta: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         allowedOpenDomains: z.ZodOptional<z.ZodArray<z.ZodURL>>;
+        turnId: z.ZodOptional<z.ZodString>;
+        html: z.ZodOptional<z.ZodString>;
         replayed: z.ZodOptional<z.ZodLiteral<true>>;
-    }, z.core.$strip>;
+    }, z.core.$strict>;
 }, z.core.$strip>, z.ZodObject<{
     event: z.ZodLiteral<string>;
     data: z.ZodObject<{
@@ -237,8 +231,8 @@ export declare const assistantWireEventSchema: z.ZodUnion<readonly [z.ZodObject<
     data: z.ZodObject<{
         turnId: z.ZodOptional<z.ZodString>;
         phase: z.ZodEnum<{
-            follow_up: "follow_up";
             initial: "initial";
+            follow_up: "follow_up";
         }>;
         prompts: z.ZodArray<z.ZodString>;
     }, z.core.$strip>;

package/node_modules/@noodle-borg/wire-contracts/dist/assistant.js

@@ -44,9 +44,9 @@ export const assistantSessionResponseSchema = z.object({
         sandbox: z.url().optional(),
         /**
          * Additive bounded visible-transcript endpoint (ADR 0141/0201 amendments 2026-08-26): a
-         * session-token-authenticated POST returning what the panel may repaint after a full-page
-         * navigation — the sign-in redirect above all. Absent on older services; the widget then
-         * starts visually fresh exactly as before.
+         * session-token-authenticated POST replaying standard assistant events after a full-page
+         * navigation — the sign-in redirect above all. Absent on older services; the widget then starts
+         * visually fresh exactly as before.
          */
         transcript: z.url().optional(),
         /** Additive model-generated prompt suggestions; its presence is the client capability gate. */
@@ -59,30 +59,21 @@ export const assistantSessionResponseSchema = z.object({
      * existing turns endpoint; older widgets strip unknown keys and simply never auto-resume.
      */
     resume: z.object({ tool: z.string().min(1) }).optional(),
+    /** Additive elevation marker; the client renders one bounded continuation status. */
+    continuedAfterAuthentication: z.literal(true).optional(),
 });
-/**
- * The bounded visible transcript (ADR 0141/0201 amendments 2026-08-26): only rows that actually
- * appeared in the panel — never tool internals, tickets, or model-facing scaffolding. Bounded by the
- * session history window (40 messages); a read spends no turn budget. Strict, because the service
- * parses its own response before sending, like the session exchange.
- */
-export const assistantTranscriptResponseSchema = z
+const recoverableViewSchema = z
     .object({
-    entries: z
-        .array(z
-        .object({
-        role: z.enum(['user', 'assistant']),
-        text: z.string(),
-    })
-        .strict())
-        .max(40),
-    suggestions: z
-        .object({
-        phase: z.literal('follow_up'),
-        prompts: z.array(z.string().trim().min(1).max(240)).max(3),
-    })
-        .strict()
-        .optional(),
+    id: z.string().min(1),
+    tool: z.string().min(1),
+    resourceUri: z.string().startsWith('ui://'),
+    title: z.string().min(1).optional(),
+    result: z.json(),
+    arguments: z.json().optional(),
+    html: z.string().min(1),
+    resourceMeta: z.record(z.string(), z.unknown()).optional(),
+    allowedOpenDomains: z.array(z.url().startsWith('https://')).optional(),
+    replayed: z.literal(true),
 })
     .strict();
 const assistantModelContentPartSchema = z
@@ -185,6 +176,9 @@ const eventEnvelope = (event, data) => z.object({ event: z.literal(event), data
  * proposal/completion payloads while clients talking to older services tolerate absent new fields.
  */
 export const assistantWireEventSchema = z.union([
+    eventEnvelope('message_started', z.object({ message: z.string().min(1) })),
+    eventEnvelope('resume_started', z.object({ tool: z.string() })),
+    eventEnvelope('message_completed', z.object({})),
     eventEnvelope('content', z.object({ turnId: optionalTurnId, delta: z.string() })),
     eventEnvelope('tool_started', z.object({
         turnId: optionalTurnId,
@@ -224,17 +218,9 @@ export const assistantWireEventSchema = z.union([
         resourceMeta: z.record(z.string(), z.unknown()).optional(),
         replayed: z.literal(true).optional(),
     })),
-    eventEnvelope('view_available', z.object({
+    eventEnvelope('view_available', recoverableViewSchema.omit({ replayed: true }).extend({
         turnId: optionalTurnId,
-        id: z.string().min(1),
-        tool: z.string().min(1),
-        resourceUri: z.string().startsWith('ui://'),
-        title: z.string().min(1).optional(),
-        result: z.json(),
-        arguments: z.json().optional(),
         html: z.string().min(1).optional(),
-        resourceMeta: z.record(z.string(), z.unknown()).optional(),
-        allowedOpenDomains: z.array(z.url().startsWith('https://')).optional(),
         replayed: z.literal(true).optional(),
     })),
     eventEnvelope('auth_requested', z.object({

package/node_modules/@noodleseed/assistant/README.md

@@ -31,7 +31,7 @@ Runtime requirements: Node.js 20+ for the server helper; the package ships ESM a
 export conditions, so bundlers and plain Node resolve it without aliases or type shims.
 
 The full, always-current integration guide (access modes, session response contract, framework notes, and
-troubleshooting) lives at <https://docs.noodleseed.dev/guides/embedded-assistant>. Authoring and deploying
+troubleshooting) lives at <https://docs.noodleseed.dev/docs/guides/embedded-assistant>. Authoring and deploying
 the server itself is `@noodleseed/one` (`npm install -g @noodleseed/one`).
 
 If your page sends a `Content-Security-Policy`, allow the Noodle service origin in `connect-src` (turns and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/one",
-  "version": "0.151.0",
+  "version": "0.152.0",
   "private": false,
   "description": "Noodle CLI by Noodle Seed — author, run, and deploy declarative MCP servers. Embedding the assistant in your own web app is @noodleseed/assistant.",
   "license": "Apache-2.0",
@@ -236,7 +236,7 @@
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.90.0",
+    "@noodle-borg/agent-kit": "0.91.0",
     "@noodle-borg/app-audit": "0.0.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",