@noodleseed/one 0.151.1 → 0.153.0

package/node_modules/@noodle-borg/agent-packaging/dist/host-package-assets.js

@@ -163,7 +163,7 @@ export function resolveHostPackageAssets(distribution, inputs, target) {
         issues,
     };
 }
-export function normalizeHostAssetPath(value) {
+function normalizeHostAssetPath(value) {
     const normalized = value.replace(/\\/g, '/').replace(/^\.\/+/, '');
     return safeRelativePath(normalized) ? normalized : undefined;
 }

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-browser-fields.d.ts

@@ -0,0 +1,3 @@
+/** Positive allowlist of `server.assistant` fields that may reach the browser. */
+export declare const ASSISTANT_BROWSER_UI_FIELDS: readonly ["theme", "layout", "behavior", "labels", "presentation", "suggestedPrompts", "privacyUrl", "termsUrl", "locale", "direction", "webmcp"];
+//# sourceMappingURL=assistant-browser-fields.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-browser-fields.js

@@ -0,0 +1,15 @@
+/** Positive allowlist of `server.assistant` fields that may reach the browser. */
+export const ASSISTANT_BROWSER_UI_FIELDS = [
+    'theme',
+    'layout',
+    'behavior',
+    'labels',
+    'presentation',
+    'suggestedPrompts',
+    'privacyUrl',
+    'termsUrl',
+    'locale',
+    'direction',
+    'webmcp',
+];
+//# sourceMappingURL=assistant-browser-fields.js.map

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-configuration.d.ts

@@ -1,7 +1,7 @@
 import type { ArtifactServer } from '@noodle-borg/compiler';
 import { type AssistantAppearanceOverride } from './assistant-appearance.js';
 import type { AssistantAppearanceSettingsStore } from './assistant-appearance-store.js';
-import { ASSISTANT_BROWSER_UI_FIELDS } from './assistant-store.js';
+import { ASSISTANT_BROWSER_UI_FIELDS } from './assistant-browser-fields.js';
 import type { TenantRef } from './tenant-ref.js';
 /**
  * What the browser is allowed to see.

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-configuration.js

@@ -1,5 +1,5 @@
 import { resolveAssistantAppearanceConfiguration, } from './assistant-appearance.js';
-import { ASSISTANT_BROWSER_UI_FIELDS } from './assistant-store.js';
+import { ASSISTANT_BROWSER_UI_FIELDS } from './assistant-browser-fields.js';
 /**
  * What the browser is allowed to see.
  *
@@ -41,7 +41,8 @@ export function assistantBrowserConfiguration(server, boundSurface) {
 function surfaceOfMode(assistant, mode) {
     if (mode === undefined || !Array.isArray(assistant?.surfaces))
         return undefined;
-    return assistant.surfaces.find((surface) => surface.mode === mode);
+    // A `mixed` surface mints `public` sessions (ADR 0220): it is the public binding's surface.
+    return assistant.surfaces.find((surface) => surface.mode === mode || (mode === 'public' && surface.mode === 'mixed'));
 }
 /** Resolve environment operator state above the immutable deployment projection. */
 export async function effectiveAssistantBrowserConfiguration(server, tenant, store, boundSurface) {

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-store.d.ts

@@ -1,20 +1,14 @@
 import type { ArtifactServer } from '@noodle-borg/compiler';
 import type { CallerIdentity } from '@noodle-borg/runtime';
+import type { ASSISTANT_BROWSER_UI_FIELDS } from './assistant-browser-fields.js';
 import type { AssistantContextPreferences } from './assistant-context.js';
 import type { AssistantCustomerRouting } from './assistant-customer-routing.js';
-import { type AssistantInteractionClaimResult, type AssistantInteractionCompletionResult, type AssistantInteractionCreateInput, type AssistantInteractionRecord, type AssistantInteractionScope, type AssistantInteractionTransitionInput, type AssistantInteractionTransitionResult, type AssistantPendingConfirmationInteractionRecord, type AssistantPendingInputInteractionRecord } from './assistant-interaction-state.js';
+import { type AssistantInteractionClaimResult, type AssistantInteractionCompletionResult, type AssistantInteractionCreateInput, type AssistantInteractionRecord, type AssistantInteractionScope, type AssistantInteractionTransitionInput, type AssistantInteractionTransitionResult, type AssistantPendingConfirmationInteractionRecord, type AssistantPendingInputInteractionRecord, type AssistantPendingInteractionRecord } from './assistant-interaction-state.js';
+import type { AssistantRecoverableView } from './assistant-view-availability.js';
 import type { TenantRef } from './tenant-ref.js';
-export { ASSISTANT_INTERACTION_EXECUTING_GRACE_MS, ASSISTANT_INTERACTION_OUTCOME_RETENTION_MS, type AssistantConfirmationInteractionRecord, AssistantInteractionCapacityError, type AssistantInteractionClaimResult, type AssistantInteractionCompletion, type AssistantInteractionCompletionResult, type AssistantInteractionCreateInput, type AssistantInteractionKind, type AssistantInteractionPublicArray, type AssistantInteractionPublicObject, type AssistantInteractionPublicOutcome, type AssistantInteractionPublicValue, type AssistantInteractionRecord, type AssistantInteractionScope, type AssistantInteractionStatus, type AssistantInteractionTransitionInput, type AssistantInteractionTransitionNext, type AssistantInteractionTransitionResult, type AssistantPendingConfirmationInteractionRecord, type AssistantPendingInputInteractionRecord, DEFAULT_MAX_PENDING_INTERACTIONS_PER_SESSION, } from './assistant-interaction-state.js';
+export { ASSISTANT_INTERACTION_EXECUTING_GRACE_MS, ASSISTANT_INTERACTION_OUTCOME_RETENTION_MS, type AssistantConfirmationInteractionRecord, AssistantInteractionCapacityError, type AssistantInteractionClaimResult, type AssistantInteractionCompletion, type AssistantInteractionCompletionResult, type AssistantInteractionCreateInput, type AssistantInteractionKind, type AssistantInteractionPublicArray, type AssistantInteractionPublicObject, type AssistantInteractionPublicOutcome, type AssistantInteractionPublicValue, type AssistantInteractionRecord, type AssistantInteractionScope, type AssistantInteractionStatus, type AssistantInteractionTransitionInput, type AssistantInteractionTransitionNext, type AssistantInteractionTransitionResult, type AssistantPendingConfirmationInteractionRecord, type AssistantPendingInputInteractionRecord, type AssistantPendingInteractionRecord, DEFAULT_MAX_PENDING_INTERACTIONS_PER_SESSION, } from './assistant-interaction-state.js';
 export declare const ASSISTANT_SESSION_IDLE_MS: number;
-/**
- * The only `server.assistant` fields that may reach a browser.
- *
- * It lives here, beside the record it types, so the allowlist and the shape it produces cannot drift
- * apart: the projection in `packages/service` iterates this same list. A denylist here would be a type
- * that lies — it once admitted `sessionClaims` key names, and would now admit the public surface's
- * capability allowlist — so growth in the manifest must not be able to grow the browser payload.
- */
-export declare const ASSISTANT_BROWSER_UI_FIELDS: readonly ["theme", "layout", "behavior", "labels", "presentation", "suggestedPrompts", "privacyUrl", "termsUrl", "locale", "direction", "webmcp"];
+export { ASSISTANT_BROWSER_UI_FIELDS } from './assistant-browser-fields.js';
 export interface AssistantClientRecord {
     readonly id: string;
     readonly name: string;
@@ -79,6 +73,8 @@ export interface AssistantSessionRecord {
     readonly initialSuggestions?: AssistantInitialSuggestionsState;
     /** Latest validated follow-up suggestions, replayed with the visible transcript. */
     readonly latestSuggestions?: AssistantSuggestedPrompts;
+    /** Latest renderer descriptor; HTML is re-resolved from the current surface artifact on recovery. */
+    readonly latestView?: AssistantRecoverableView;
 }
 export interface AssistantSuggestedPrompts {
     readonly phase: 'initial' | 'follow_up';
@@ -165,6 +161,7 @@ export interface AssistantStore {
     completeInitialSuggestions(id: string, prompts: readonly string[]): Promise<boolean>;
     failInitialSuggestions(id: string): Promise<boolean>;
     replaceLatestSuggestions(id: string, suggestions: AssistantSuggestedPrompts | undefined): Promise<boolean>;
+    replaceLatestView(id: string, view: AssistantRecoverableView | undefined): Promise<boolean>;
     /** Atomically reserve one once-per-session model tool use. */
     claimModelToolUse(id: string, tool: string): Promise<boolean>;
     /** Release a reservation only when execution failed before a usable result or interaction existed. */
@@ -221,6 +218,11 @@ export interface AssistantStore {
     }): Promise<AssistantInteractionCompletionResult>;
     transitionInteraction(input: AssistantInteractionTransitionInput): Promise<AssistantInteractionTransitionResult>;
     getInteraction(input: AssistantInteractionScope): Promise<AssistantInteractionRecord | undefined>;
+    findPendingInteraction(input: {
+        readonly sessionId: string;
+        readonly deploymentId: string;
+        readonly now: Date;
+    }): Promise<AssistantPendingInteractionRecord | undefined>;
     /** @deprecated Temporary compatibility for the accept-only route while it moves to claim/complete. */
     consumeInteraction(id: string, sessionId: string, deploymentId: string, now: Date): Promise<(import('./assistant-interaction-state.js').AssistantConfirmationInteractionRecord & {
         readonly status: 'executing';
@@ -269,6 +271,7 @@ export declare class InMemoryAssistantStore implements AssistantStore {
     completeInitialSuggestions(id: string, prompts: readonly string[]): Promise<boolean>;
     failInitialSuggestions(id: string): Promise<boolean>;
     replaceLatestSuggestions(id: string, suggestions: AssistantSuggestedPrompts | undefined): Promise<boolean>;
+    replaceLatestView(id: string, view: AssistantRecoverableView | undefined): Promise<boolean>;
     claimModelToolUse(id: string, tool: string): Promise<boolean>;
     releaseModelToolUse(id: string, tool: string): Promise<boolean>;
     getSession(token: string, now: Date): Promise<AssistantSessionRecord | undefined>;
@@ -285,6 +288,11 @@ export declare class InMemoryAssistantStore implements AssistantStore {
     }): Promise<AssistantInteractionCompletionResult>;
     transitionInteraction(input: AssistantInteractionTransitionInput): Promise<AssistantInteractionTransitionResult>;
     getInteraction(input: AssistantInteractionScope): Promise<AssistantInteractionRecord | undefined>;
+    findPendingInteraction(input: {
+        readonly sessionId: string;
+        readonly deploymentId: string;
+        readonly now: Date;
+    }): Promise<AssistantPendingInteractionRecord | undefined>;
     consumeInteraction(id: string, sessionId: string, deploymentId: string, now: Date): Promise<(import('./assistant-interaction-state.js').AssistantConfirmationInteractionRecord & {
         readonly status: 'executing';
     }) | undefined>;

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-store.js

@@ -3,29 +3,7 @@ import { ADMISSION_DEFAULTS } from '@noodle-borg/admission-limits/portable';
 import { AssistantInteractionCapacityError, cloneInteraction, completedInteraction, createPendingInteraction, DEFAULT_MAX_PENDING_INTERACTIONS_PER_SESSION, executingInteraction, expireStrandedExecutingInteraction, isPrunableInteraction, isTerminalInteraction, shouldExpireStrandedExecutingInteraction, transitionedInteractions, } from './assistant-interaction-state.js';
 export { ASSISTANT_INTERACTION_EXECUTING_GRACE_MS, ASSISTANT_INTERACTION_OUTCOME_RETENTION_MS, AssistantInteractionCapacityError, DEFAULT_MAX_PENDING_INTERACTIONS_PER_SESSION, } from './assistant-interaction-state.js';
 export const ASSISTANT_SESSION_IDLE_MS = 30 * 60 * 1000;
-/**
- * The only `server.assistant` fields that may reach a browser.
- *
- * It lives here, beside the record it types, so the allowlist and the shape it produces cannot drift
- * apart: the projection in `packages/service` iterates this same list. A denylist here would be a type
- * that lies — it once admitted `sessionClaims` key names, and would now admit the public surface's
- * capability allowlist — so growth in the manifest must not be able to grow the browser payload.
- */
-export const ASSISTANT_BROWSER_UI_FIELDS = [
-    'theme',
-    'layout',
-    'behavior',
-    'labels',
-    'presentation',
-    'suggestedPrompts',
-    'privacyUrl',
-    'termsUrl',
-    'locale',
-    'direction',
-    // Not appearance: the browser must know whether this deployment opted into projecting its tools to
-    // a page agent (ADR 0220). It travels the allowlist like everything else the page may see.
-    'webmcp',
-];
+export { ASSISTANT_BROWSER_UI_FIELDS } from './assistant-browser-fields.js';
 /** Latest prompt messages retained for model continuity; turn admission is tracked separately. */
 export const ASSISTANT_HISTORY_MAX_MESSAGES = 40;
 export class InMemoryAssistantStore {
@@ -199,6 +177,19 @@ export class InMemoryAssistantStore {
         }
         return true;
     }
+    async replaceLatestView(id, view) {
+        const session = this.#sessions.get(id);
+        if (!session)
+            return false;
+        const next = {
+            ...session,
+            ...(view === undefined ? {} : { latestView: structuredClone(view) }),
+        };
+        if (view === undefined)
+            delete next.latestView;
+        this.#sessions.set(id, next);
+        return true;
+    }
     async claimModelToolUse(id, tool) {
         const session = this.#sessions.get(id);
         if (!session || session.modelToolUses.includes(tool))
@@ -319,6 +310,16 @@ export class InMemoryAssistantStore {
         const interaction = this.#scopedInteraction(input);
         return interaction ? cloneInteraction(interaction) : undefined;
     }
+    async findPendingInteraction(input) {
+        this.#pruneInteractions(input.now);
+        const interaction = [...this.#interactions.values()]
+            .filter((candidate) => candidate.sessionId === input.sessionId &&
+            candidate.deploymentId === input.deploymentId &&
+            candidate.status === 'pending' &&
+            Date.parse(candidate.expiresAt) > input.now.getTime())
+            .sort((left, right) => Date.parse(right.createdAt) - Date.parse(left.createdAt))[0];
+        return interaction ? cloneInteraction(interaction) : undefined;
+    }
     async consumeInteraction(id, sessionId, deploymentId, now) {
         const result = this.#claimInteraction({ id, sessionId, deploymentId, now }, 'confirmation');
         return result.disposition === 'claimed' && result.interaction.kind === 'confirmation'

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-transcript-events.d.ts

@@ -0,0 +1,24 @@
+import type { AssistantTranscriptEntry } from './assistant-transcript.js';
+import type { AssistantViewAvailableData } from './assistant-view-availability.js';
+export interface AssistantTranscriptEvent {
+    readonly event: string;
+    readonly data: Readonly<Record<string, unknown>>;
+}
+export interface AssistantRecoveredInteraction {
+    readonly event: 'tool_proposed' | 'input_requested';
+    readonly data: Readonly<Record<string, unknown>>;
+}
+/**
+ * Project retained visual state through the ordinary assistant event protocol. The browser therefore
+ * has one parser and one rendering path for live and recovered turns; this function owns only ordering.
+ */
+export declare function assistantTranscriptEvents(input: {
+    readonly entries: readonly AssistantTranscriptEntry[];
+    readonly latestView?: AssistantViewAvailableData;
+    readonly pendingInteraction?: AssistantRecoveredInteraction;
+    readonly suggestions?: {
+        readonly phase: 'initial' | 'follow_up';
+        readonly prompts: readonly string[];
+    };
+}): readonly AssistantTranscriptEvent[];
+//# sourceMappingURL=assistant-transcript-events.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-transcript-events.js

@@ -0,0 +1,39 @@
+/**
+ * Project retained visual state through the ordinary assistant event protocol. The browser therefore
+ * has one parser and one rendering path for live and recovered turns; this function owns only ordering.
+ */
+export function assistantTranscriptEvents(input) {
+    const events = [];
+    let open = false;
+    let awaitingAssistant = false;
+    for (const entry of input.entries) {
+        if (entry.role === 'user') {
+            if (open)
+                events.push({ event: 'message_completed', data: {} });
+            events.push({ event: 'message_started', data: { message: entry.text } });
+            open = true;
+            awaitingAssistant = true;
+            continue;
+        }
+        if (!open || !awaitingAssistant) {
+            if (open)
+                events.push({ event: 'message_completed', data: {} });
+            events.push({ event: 'resume_started', data: { tool: '' } });
+            open = true;
+        }
+        events.push({ event: 'content', data: { delta: entry.text } });
+        awaitingAssistant = false;
+    }
+    if (open)
+        events.push({ event: 'message_completed', data: {} });
+    if (input.latestView)
+        events.push({ event: 'view_available', data: { ...input.latestView } });
+    if (input.pendingInteraction)
+        events.push(input.pendingInteraction);
+    if (input.suggestions?.phase === 'follow_up') {
+        events.push({ event: 'suggested_prompts', data: { ...input.suggestions } });
+    }
+    events.push({ event: 'done', data: {} });
+    return events;
+}
+//# sourceMappingURL=assistant-transcript-events.js.map

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-transcript.d.ts

@@ -1,4 +1,3 @@
-import type { AssistantHistoryMessage } from './assistant-store.js';
 /**
  * The bounded visible-transcript projection (ADR 0141/0201 amendments 2026-08-26): what a widget may
  * repaint after a full-page navigation — the sign-in redirect above all — from the session's own
@@ -14,5 +13,10 @@ export interface AssistantTranscriptEntry {
     readonly role: 'user' | 'assistant';
     readonly text: string;
 }
-export declare function visibleTranscript(history: readonly AssistantHistoryMessage[]): readonly AssistantTranscriptEntry[];
+export interface AssistantTranscriptHistoryEntry {
+    readonly role: 'user' | 'assistant';
+    readonly content: string;
+    readonly kind?: 'visible' | 'narration';
+}
+export declare function visibleTranscript(history: readonly AssistantTranscriptHistoryEntry[]): readonly AssistantTranscriptEntry[];
 //# sourceMappingURL=assistant-transcript.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-transcript.js

@@ -1,3 +1,14 @@
+/**
+ * The bounded visible-transcript projection (ADR 0141/0201 amendments 2026-08-26): what a widget may
+ * repaint after a full-page navigation — the sign-in redirect above all — from the session's own
+ * short-lived history. Transport-free like every gateway decision; `packages/service` adapts.
+ *
+ * Only rows explicitly tagged `visible` project. Everything else fails closed out of the transcript:
+ * `narration` rows are model-facing scaffolding (resolution summaries carrying tool output,
+ * `[platform]` resume prompts the visitor never saw), and an untagged legacy row cannot prove which
+ * it was. This is a read-only projection over state that already exists and already expires with the
+ * session — it is not a durable transcript, and nothing here may extend a retention window.
+ */
 export function visibleTranscript(history) {
     return history
         .filter((entry) => entry.kind === 'visible')

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-view-availability.d.ts

@@ -14,6 +14,14 @@ export interface AssistantViewAvailableData {
     readonly allowedOpenDomains?: readonly string[];
     readonly replayed?: true;
 }
+/** Persisted renderer descriptor: bounded public data only, never HTML or a resource body. */
+export interface AssistantRecoverableView {
+    readonly id: string;
+    readonly tool: string;
+    readonly result: unknown;
+    readonly arguments?: unknown;
+}
+export declare function recoverableAssistantView(view: Pick<AssistantViewAvailableData, 'id' | 'tool' | 'result' | 'arguments'>): AssistantRecoverableView;
 /** A declared widget the completed tool could not surface — reported so the drop is never silent. */
 export interface AssistantViewUnresolved {
     readonly tool: string;

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-view-availability.js

@@ -1,5 +1,13 @@
 import { injectWidgetBridge } from '@noodle-borg/protocol';
 const MCP_APP_MIME_TYPE = 'text/html;profile=mcp-app';
+export function recoverableAssistantView(view) {
+    return {
+        id: view.id,
+        tool: view.tool,
+        result: structuredClone(view.result),
+        ...(view.arguments === undefined ? {} : { arguments: structuredClone(view.arguments) }),
+    };
+}
 /**
  * Resolve a self-contained, statically compiled MCP App document for the embedded host. The linked
  * resource must be present in the same compiled artifact and carry the MCP App MIME type; arbitrary

package/node_modules/@noodle-borg/assistant-gateway/dist/elevation-store.d.ts

@@ -19,6 +19,8 @@ export interface AssistantElevationRecord {
     readonly tenant: TenantRef;
     /** The capability the visitor was refused, carried so the audit says what they signed in for. */
     readonly tool: string;
+    /** Canonical server-side snapshot of handles eligible when this ticket was issued. */
+    readonly claimableStateHandles: readonly string[];
     readonly continuationHash: string;
     readonly createdAt: string;
     readonly expiresAt: string;
@@ -48,6 +50,7 @@ export interface AssistantElevationStore {
         readonly sessionId: string;
         readonly tenant: TenantRef;
         readonly tool: string;
+        readonly claimableStateHandles?: readonly string[];
         readonly now: Date;
     }): Promise<{
         readonly elevation: AssistantElevationRecord;

package/node_modules/@noodle-borg/assistant-gateway/dist/elevation.d.ts

@@ -66,10 +66,16 @@ export type ElevationResult = {
     readonly token: string;
     /** What the visitor was refused before signing in, for the audit trail. */
     readonly tool: string;
+    /** Whether one-shot auto-resume was actually armed after pending-interaction suppression. */
+    readonly resumeArmed: boolean;
 } | {
     readonly ok: false;
     readonly status: 403 | 409;
-    readonly code: 'elevation_ticket_invalid' | 'elevation_ticket_expired' | 'elevation_tenant_mismatch' | 'elevation_session_unavailable' | 'elevation_already_signed_in';
+    readonly code: 'elevation_ticket_invalid' | 'elevation_ticket_expired' | 'elevation_tenant_mismatch' | 'elevation_session_unavailable' | 'elevation_already_signed_in' | 'elevation_state_conflict';
 };
+/** One commit boundary for ticket spend, state adoption, session rebind, and audit. */
+export interface AssistantElevationCoordinator {
+    complete(request: ElevationRequest): Promise<ElevationResult>;
+}
 export declare function completeElevation(request: ElevationRequest, ports: ElevationPorts): Promise<ElevationResult>;
 //# sourceMappingURL=elevation.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/elevation.js

@@ -45,6 +45,7 @@ export async function completeElevation(request, ports) {
         session: elevated.session,
         token: elevated.token,
         tool: claimed.elevation.tool,
+        resumeArmed: request.resume === true,
     };
 }
 //# sourceMappingURL=elevation.js.map

package/node_modules/@noodle-borg/assistant-gateway/dist/in-memory-elevation-store.d.ts

@@ -7,6 +7,7 @@ export declare class InMemoryAssistantElevationStore implements AssistantElevati
         readonly sessionId: string;
         readonly tenant: TenantRef;
         readonly tool: string;
+        readonly claimableStateHandles?: readonly string[];
         readonly now: Date;
     }): Promise<{
         readonly elevation: AssistantElevationRecord;

package/node_modules/@noodle-borg/assistant-gateway/dist/in-memory-elevation-store.js

@@ -15,6 +15,7 @@ export class InMemoryAssistantElevationStore {
             sessionId: input.sessionId,
             tenant: input.tenant,
             tool: input.tool,
+            claimableStateHandles: [...(input.claimableStateHandles ?? [])].sort(),
             continuationHash: elevationDigest(continuation),
             createdAt: input.now.toISOString(),
             expiresAt: new Date(input.now.getTime() + ASSISTANT_ELEVATION_TTL_MS).toISOString(),

package/node_modules/@noodle-borg/assistant-gateway/dist/portable.d.ts

@@ -15,6 +15,7 @@ export * from './assistant-presentation.js';
 export * from './assistant-sensitive-values.js';
 export * from './assistant-store.js';
 export * from './assistant-transcript.js';
+export * from './assistant-transcript-events.js';
 export * from './assistant-view-availability.js';
 export * from './elevation.js';
 export * from './elevation-store.js';

package/node_modules/@noodle-borg/assistant-gateway/dist/portable.js

@@ -15,6 +15,7 @@ export * from './assistant-presentation.js';
 export * from './assistant-sensitive-values.js';
 export * from './assistant-store.js';
 export * from './assistant-transcript.js';
+export * from './assistant-transcript-events.js';
 export * from './assistant-view-availability.js';
 export * from './elevation.js';
 export * from './elevation-store.js';

package/node_modules/@noodle-borg/assistant-gateway/package.json

@@ -39,9 +39,10 @@
     "@noodle-borg/compiler": "0.0.0",
     "@noodle-borg/connector-defs": "0.0.0",
     "@noodle-borg/module": "0.0.0",
+    "@noodle-borg/module-audit": "0.0.0",
     "@noodle-borg/protocol": "0.0.0",
     "@noodle-borg/runtime": "0.0.0",
-    "@noodleseed/assistant": "1.31.0",
+    "@noodleseed/assistant": "1.32.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/node_modules/@noodle-borg/authoring/dist/assistant.d.ts

@@ -134,7 +134,7 @@ export type AssistantModel = OpenAICompatibleModel | NoodleManagedModel;
  * `${user.claims.<key>}` in tool fulfilment; `exposeToModel: true` additionally places the value
  * in the assistant's identity system line so the model can use it directly.
  */
-export interface SessionClaimDeclaration {
+interface SessionClaimDeclaration {
     readonly exposeToModel?: boolean;
 }
 /**
@@ -275,4 +275,5 @@ export declare function openAICompatible(input: OpenAICompatibleModelInput): Ope
 /** Use Noodle Seed Cloud's operator-selected model. Provider details never enter authored source. */
 export declare function noodleManaged(): NoodleManagedModel;
 export declare function embeddedAssistant(input: EmbeddedAssistantOptions): EmbeddedAssistantConfig;
+export {};
 //# sourceMappingURL=assistant.d.ts.map

package/node_modules/@noodle-borg/authoring/dist/connections.d.ts

@@ -15,8 +15,6 @@ export type { ConnectionBinding, ConnectionRef, ConnectionSource, GoogleWorkload
 type ManifestV2ConnectorBinding = NonNullable<NonNullable<Extract<Manifest, {
     manifestVersion: '2';
 }>['connectors']>[string]['binding']>;
-/** Internal manifest projection: clone readonly author inputs to the mutable generated schema shape. */
-export declare function toManifestConnectionBinding(binding: ConnectionBinding): ManifestV2ConnectorBinding;
 export declare function toManifestConnectorRef(connector: ConnectorRef): {
     readonly id: string;
     readonly version: string;

package/node_modules/@noodle-borg/authoring/dist/connections.js

@@ -25,7 +25,7 @@ export function bind(connector, options) {
     };
 }
 /** Internal manifest projection: clone readonly author inputs to the mutable generated schema shape. */
-export function toManifestConnectionBinding(binding) {
+function toManifestConnectionBinding(binding) {
     const source = binding.connection.source;
     return {
         profile: binding.profile,

package/node_modules/@noodle-borg/authoring/dist/load-authored.js

@@ -33,9 +33,9 @@ export function prepareAuthoringRuntimeDir(dir, options) {
             './react': './react.mjs',
         },
     }));
-    writeFileSync(join(self, 'index.mjs'), "export { annotations, asset, authenticatedWebsite, bind, clientCredentials, connector, connection, customerAuth, customerEndpoint, embeddedAssistant, externalExchange, file, gmailConnector, googleWorkloadIdentity, handoffSession, knowledge, managedSecret, noodleManaged, openAICompatible, prompt, publicWebsite, resource, secret, server, site, tool, variable, when, z } from '@noodle-borg/authoring';\n");
+    writeFileSync(join(self, 'index.mjs'), "export { algolia, annotations, asset, authenticatedWebsite, bind, clientCredentials, connector, connection, customerAuth, customerEndpoint, embeddedAssistant, externalExchange, file, firecrawl, gmailConnector, googleWorkloadIdentity, handoffSession, knowledge, managedSecret, meilisearch, noodleManaged, openAICompatible, prompt, publicWebsite, resource, secret, server, site, tavily, tool, variable, when, z } from '@noodle-borg/authoring';\n");
     writeFileSync(join(self, 'platform.mjs'), "export { noodlePlatform, noodlePlatformCatalog } from '@noodle-borg/authoring';\n");
-    writeFileSync(join(self, 'react.mjs'), "export { generateHelpers } from '@noodle-borg/authoring/react';\n");
+    writeFileSync(join(self, 'react.mjs'), "export * from '@noodle-borg/authoring/react';\n");
 }
 function pathExists(path) {
     try {

package/node_modules/@noodle-borg/authoring/dist/react/bridge.d.ts

@@ -44,12 +44,12 @@ export type ModelContextUpdate = {
     }[];
     readonly structuredContent?: Readonly<Record<string, unknown>>;
 };
-export type RuntimeBrandAsset = {
+type RuntimeBrandAsset = {
     readonly uri: string;
     readonly darkUri?: string;
     readonly alt: string;
 };
-export type RuntimeBrandTheme = {
+type RuntimeBrandTheme = {
     readonly surface?: string;
     readonly surfaceRaised?: string;
     readonly surfaceMuted?: string;
@@ -108,4 +108,5 @@ export declare function globalViewState(): Record<string, unknown>;
 export declare function setGlobalViewState(value: Record<string, unknown>): void;
 export declare function globalLayout(): LayoutState;
 export declare function globalBranding(): RuntimeBranding;
+export {};
 //# sourceMappingURL=bridge.d.ts.map

package/node_modules/@noodle-borg/authoring/dist/react/form-components.d.ts

@@ -58,8 +58,6 @@ export type RadioGroupProps = Omit<HTMLAttributes<HTMLDivElement>, 'defaultValue
     readonly options: readonly RadioOption[];
     readonly value?: string;
     readonly defaultValue?: string;
-    /** @deprecated Use `onValueChange`; retained for source compatibility. */
-    readonly onChange?: (value: string) => void;
     readonly onValueChange?: (value: string) => void;
     /** Shared radio `name`; defaults to a stable generated id. */
     readonly name?: string;
@@ -71,8 +69,6 @@ export declare const RadioGroup: import("react").ForwardRefExoticComponent<Omit<
     readonly options: readonly RadioOption[];
     readonly value?: string;
     readonly defaultValue?: string;
-    /** @deprecated Use `onValueChange`; retained for source compatibility. */
-    readonly onChange?: (value: string) => void;
     readonly onValueChange?: (value: string) => void;
     /** Shared radio `name`; defaults to a stable generated id. */
     readonly name?: string;
@@ -101,8 +97,6 @@ export type SegmentedControlProps = Omit<HTMLAttributes<HTMLDivElement>, 'defaul
     readonly options: readonly SegmentedOption[];
     readonly value?: string;
     readonly defaultValue?: string;
-    /** @deprecated Use `onValueChange`; retained for source compatibility. */
-    readonly onChange?: (value: string) => void;
     readonly onValueChange?: (value: string) => void;
     readonly name?: string;
     readonly disabled?: boolean;
@@ -113,8 +107,6 @@ export declare const SegmentedControl: import("react").ForwardRefExoticComponent
     readonly options: readonly SegmentedOption[];
     readonly value?: string;
     readonly defaultValue?: string;
-    /** @deprecated Use `onValueChange`; retained for source compatibility. */
-    readonly onChange?: (value: string) => void;
     readonly onValueChange?: (value: string) => void;
     readonly name?: string;
     readonly disabled?: boolean;

package/node_modules/@noodle-borg/authoring/dist/react/form-components.js

@@ -152,7 +152,7 @@ export const Checkbox = forwardRef(function Checkbox({ label, className, onChang
         ? box
         : createElement('label', { className: 'nsr-check' }, box, createElement('span', null, label));
 });
-export const RadioGroup = forwardRef(function RadioGroup({ options, value, defaultValue, onChange, onValueChange, name, direction = 'column', disabled, required, className, ...props }, ref) {
+export const RadioGroup = forwardRef(function RadioGroup({ options, value, defaultValue, onValueChange, name, direction = 'column', disabled, required, className, ...props }, ref) {
     const fallbackName = useId();
     const groupName = name ?? fallbackName;
     const field = useFieldControlProps({ ...props, required }, 'group');
@@ -174,7 +174,6 @@ export const RadioGroup = forwardRef(function RadioGroup({ options, value, defau
         required: field.required,
         disabled: disabled || option.disabled,
         onChange: () => {
-            onChange?.(option.value);
             onValueChange?.(option.value);
         },
     }), createElement('span', null, option.label))));
@@ -208,7 +207,7 @@ export const Slider = forwardRef(function Slider({ className, ...props }, ref) {
     });
 });
 /** Single-select value picker implemented with native radios for keyboard and form behavior. */
-export const SegmentedControl = forwardRef(function SegmentedControl({ options, value, defaultValue, onChange, onValueChange, name, disabled, required, className, ...props }, ref) {
+export const SegmentedControl = forwardRef(function SegmentedControl({ options, value, defaultValue, onValueChange, name, disabled, required, className, ...props }, ref) {
     const fallbackName = useId();
     const groupName = name ?? fallbackName;
     const field = useFieldControlProps({ ...props, required }, 'group');
@@ -234,7 +233,6 @@ export const SegmentedControl = forwardRef(function SegmentedControl({ options,
         required: field.required,
         disabled: disabled || option.disabled,
         onChange: () => {
-            onChange?.(option.value);
             onValueChange?.(option.value);
         },
     }), createElement('span', { className: 'nsr-segmented-label' }, option.label))));

package/node_modules/@noodle-borg/authoring/dist/react/hooks.d.ts

@@ -1,7 +1,7 @@
 import { type AppFlow, type AppFlowConfig } from './app-flow.js';
 import { type DisplayMode, type LayoutState, type ModelContextUpdate, type NoodleReactBridge, type RuntimeBranding, type ToolResult } from './bridge.js';
 import { type HandoffController } from './handoff.js';
-import { createViewStore, type StoreHookResult } from './store.js';
+import { createViewStore } from './store.js';
 export type ToolStatus = 'idle' | 'pending' | 'success' | 'error';
 export type CallToolState = {
     readonly status: ToolStatus;
@@ -54,5 +54,5 @@ export declare function useSendFollowUpMessage(): (message: {
 export declare function useUpdateModelContext(): (update: ModelContextUpdate) => Promise<void>;
 /** Publish a portable, structured widget lifecycle summary through the standard model-context path. */
 export declare function useWidgetLifecycle(widgetName: string): (lifecycle: 'mounted' | 'submitted' | 'cancelled' | 'dismissed', summary?: Readonly<Record<string, unknown>>) => Promise<void>;
-export type { DisplayMode, LayoutState, ModelContextUpdate, NoodleReactBridge, RuntimeBranding, StoreHookResult, ToolResult, };
+export type { DisplayMode, LayoutState, ModelContextUpdate, NoodleReactBridge, RuntimeBranding, ToolResult, };
 //# sourceMappingURL=hooks.d.ts.map

package/node_modules/@noodle-borg/authoring/dist/server.d.ts

@@ -19,6 +19,8 @@ export interface StateHandleOptions {
     readonly version: string;
     readonly scope?: StateHandleScope;
     readonly ttlSeconds?: number;
+    /** Move this caller-scoped, finite-lived state to the authenticated caller during ticket elevation. */
+    readonly claimOnAuthentication?: true;
 }
 export interface ServerOptions {
     readonly title: string;

package/node_modules/@noodle-borg/authoring/dist/server.js

@@ -231,6 +231,9 @@ class ServerBuilder {
                                 version: handle.version,
                                 ...(handle.scope !== undefined ? { scope: handle.scope } : {}),
                                 ...(handle.ttlSeconds !== undefined ? { ttlSeconds: handle.ttlSeconds } : {}),
+                                ...(handle.claimOnAuthentication === true
+                                    ? { claimOnAuthentication: true }
+                                    : {}),
                             },
                         ])),
                     },