@noodleseed/one 0.154.0 → 0.155.0

package/node_modules/@noodle-borg/agent-kit/dist/generated/example-files.js

@@ -36,7 +36,7 @@ export const BUNDLED_EXAMPLE_FILES = [
     { relPath: "examples/acme-discovery/src/helpers.ts", content: "import type { ServerDefinition } from '@noodleseed/one';\nimport { generateHelpers } from '@noodleseed/one/react';\n\nexport type AppType = ServerDefinition;\n\nexport const { useCallTool, useLayout, useOpenExternal, useToolInfo, useViewState } =\n  generateHelpers<AppType>();\n" },
     { relPath: "examples/acme-discovery/src/knowledge/faq.txt", content: "ACME GETAWAYS FAQ\n\nQ: Does the assistant book and take payment?\nA: No. The assistant shapes the trip and hands off to Acmes own checkout with a signed link.\n\nQ: How current are prices?\nA: Starting prices come from Acmes live site; the assistant cites the page it used.\n\nQ: Can I compare destinations?\nA: Yes, ask for a shortlist by vibe, month, or budget.\n" },
     { relPath: "examples/acme-discovery/src/knowledge/product.md", content: "# Acme Getaways product guide\n\nAcme Getaways curates four destination types: beach, mountains, culture, and city escapes. Every listing shows a real starting price and the best months to travel. Bookings, payments, and date selection happen on Acmes own site through a signed handoff link; the assistant never takes payment details.\n\n## Cancellation and support\n\nAll trips can be cancelled free within 48 hours of the handoff. Support runs seven days a week through the chat on book.acme.example.\n" },
-    { relPath: "examples/acme-discovery/src/server.ts", content: "import {\n  annotations,\n  authenticatedWebsite,\n  connector,\n  embeddedAssistant,\n  file,\n  knowledge,\n  noodleManaged,\n  publicWebsite,\n  secret,\n  server,\n  site,\n  tool,\n  variable,\n  z,\n} from '@noodleseed/one';\n\n// Acme Getaways is a fictional travel brand. This app is deliberately top-of-funnel: discovery and\n// configuration happen inside ChatGPT; the booking/transaction happens off-app on Acme's own site,\n// reached through a signed, attributable handoff deep link. Destinations are the partner's own\n// catalog (grounding) — the app never invents a place, price, or best-month.\n//\n// Authoring note: a tool `fulfil` is *recorded*, not run as live JS. Inputs flow through as\n// `${input.x}` substitutions when placed directly into an output string; do not transform them\n// (no URL-encoding, arithmetic, or filtering on an input value — those break substitution). The\n// curated catalog below is static data the runtime returns verbatim.\n\nconst catalog = [\n  {\n    id: 'coral_bay',\n    name: 'Coral Bay',\n    region: 'Adriatic coast',\n    vibe: 'beach',\n    priceFrom: 890,\n    bestMonths: 'May–Sep',\n    why: 'Calm swimming coves and a walkable old town — easy for a relaxed first trip.',\n  },\n  {\n    id: 'monte_alto',\n    name: 'Monte Alto',\n    region: 'Northern Alps',\n    vibe: 'mountains',\n    priceFrom: 1120,\n    bestMonths: 'Dec–Mar',\n    why: 'Ski-in village with beginner slopes and long groomed runs.',\n  },\n  {\n    id: 'old_quarter',\n    name: 'Old Quarter',\n    region: 'Central Europe',\n    vibe: 'culture',\n    priceFrom: 640,\n    bestMonths: 'Apr–Oct',\n    why: 'Dense museum district and food halls, all reachable on foot.',\n  },\n  {\n    id: 'harbor_city',\n    name: 'Harbor City',\n    region: 'Pacific rim',\n    vibe: 'city',\n    priceFrom: 980,\n    bestMonths: 'Sep–Nov',\n    why: 'Waterfront nightlife and day-trip islands a short ferry away.',\n  },\n] as const;\n\n// A closed set of URL-safe month values. A `fulfil` cannot url-encode an input (recording would break\n// substitution), so the deep link carries `month` only if it is already safe — the model maps natural\n// phrasing (\"early June\") onto one of these when it fills the tool.\nconst monthEnum = z\n  .enum([\n    'January',\n    'February',\n    'March',\n    'April',\n    'May',\n    'June',\n    'July',\n    'August',\n    'September',\n    'October',\n    'November',\n    'December',\n  ])\n  .default('June');\n\n// The catalog ids are already url-safe slugs. Constrain the handoff `destination` to this closed set so\n// only a real, url-safe id can reach the deep link.\nconst destinationId = z.enum(['coral_bay', 'monte_alto', 'old_quarter', 'harbor_city']);\n\nconst discoverInput = z.object({\n  vibe: z.enum(['beach', 'mountains', 'culture', 'city']).default('beach'),\n  month: monthEnum,\n  travelers: z.number().int().min(1).default(2),\n});\n\n// Tool annotations for host planners: reads are read-only, the handoff opens an external link, and\n// shortlisting is a local non-destructive write.\nconst readOnly = annotations.readOnly();\nconst openLink = annotations.openAction();\nconst localWrite = annotations.localAction({ destructive: false, confirm: false });\n\nconst destinationOutput = z.object({\n  id: z.string(),\n  name: z.string(),\n  region: z.string(),\n  vibe: z.string(),\n  priceFrom: z.number(),\n  bestMonths: z.string(),\n  why: z.string(),\n});\n\nconst discoverGetaways = tool('discover_getaways', {\n  title: 'Discover getaways',\n  description:\n    'Suggest Acme Getaways destinations for a vibe and month and render a discovery carousel.',\n  annotations: readOnly,\n  input: discoverInput,\n  output: z.object({\n    status: z.string(),\n    vibe: z.string(),\n    month: z.string(),\n    travelers: z.number(),\n    // Bounded list: the curated catalog is fixed and small, and the declared ceiling tells the\n    // model and host the payload cannot grow. `noodle check` reports `tool_design_output_bounds`.\n    options: z.array(destinationOutput).max(20),\n  }),\n  // The carousel presents Acme's curated catalog; the model narrates which fit the stated vibe.\n  // (A tool cannot filter on an input value — that is connector/flow work — so all are returned.)\n  fulfil: ({ input }) => ({\n    status: `Acme Getaways for a ${input.vibe} trip in ${input.month}, ${input.travelers} traveler(s).`,\n    vibe: input.vibe,\n    month: input.month,\n    travelers: input.travelers,\n    options: catalog,\n  }),\n  viewTitle: 'Discover getaways',\n  // ChatGPT host status copy (openai/toolInvocation/*) — required for widget-opening tools.\n  invoking: 'Finding getaways…',\n  invoked: 'Getaways ready',\n  domain: 'https://getaways.acme.example',\n  view: {\n    component: 'discovery-carousel',\n    entry: './views/discovery-carousel.tsx',\n  },\n  viewDescription:\n    'A top-of-funnel discovery carousel: pick a destination, then hand off to Acme to book.',\n  csp: {\n    connectDomains: ['https://acme.example'],\n    resourceDomains: ['https://acme.example'],\n    frameDomains: ['https://acme.example'],\n  },\n});\n\nconst createHandoff = tool('create_handoff', {\n  title: 'Create booking handoff',\n  description:\n    'Create the Acme booking deep link for a chosen destination, carrying the configured trip. ' +\n    'Pass the destination id (url-safe slug, e.g. \"coral_bay\") and its display name.',\n  annotations: openLink,\n  input: z.object({\n    destination: destinationId,\n    destinationName: z.string().min(1),\n    month: monthEnum,\n    travelers: z.number().int().min(1).default(2),\n  }),\n  output: z.object({\n    status: z.string(),\n    destination: z.string(),\n    summary: z.string(),\n    handoffUrl: z.string(),\n  }),\n  // Inline the inputs directly so they substitute at runtime; every value is already url-safe\n  // (id slug, month enum, integer), and `src=chatgpt` is the attribution the partner measures\n  // ChatGPT-sourced conversions on.\n  fulfil: ({ input }) => ({\n    status: `Ready to continue on Acme for ${input.destinationName}.`,\n    destination: input.destination,\n    summary: `${input.destinationName} · ${input.month} · ${input.travelers} traveler(s)`,\n    handoffUrl: `https://book.acme.example/plan?dest=${input.destination}&month=${input.month}&pax=${input.travelers}&src=chatgpt`,\n  }),\n});\n\nconst shortlistGetaway = tool('shortlist_getaway', {\n  visibility: ['app'],\n  description: 'Record the traveler’s shortlisted destination from the discovery widget.',\n  annotations: localWrite,\n  input: z.object({\n    destination: z.string(),\n    note: z.string().default(''),\n  }),\n  output: z.object({\n    status: z.string(),\n    destination: z.string(),\n    note: z.string(),\n  }),\n  fulfil: ({ input }) => ({\n    status: `Shortlisted ${input.destination}.`,\n    destination: input.destination,\n    note: input.note,\n  }),\n});\n\n// The consultative sales gateway (ADR 0214): when a visitor would rather not sign up, the assistant\n// may — with explicit confirmation — take their details and deliver them to Acme's own sink. The\n// recipe is a composition of existing primitives, not a platform feature: an ordinary confirm-gated\n// action plus a declarative HTTP connector whose endpoint and credential are operator-managed\n// (`noodle variables set LEAD_SINK_URL …`, `noodle secrets set LEAD_SINK_TOKEN …`). The payload\n// rests only in Acme's own system; the platform stores no lead. A vendor sink is the same shape as\n// data: Resend/Postmark take `auth: { kind: 'apiKey', … }`, a HubSpot private app takes\n// `auth: { kind: 'bearer', … }` — never a named vendor package.\nconst leadSink = connector('lead_sink')\n  .version('1.0.0')\n  .http({\n    baseUrl: variable('LEAD_SINK_URL'),\n    allowedOrigins: ['https://acme.example'],\n    auth: { kind: 'bearer', secret: secret('LEAD_SINK_TOKEN') },\n    operations: {\n      submit_lead: {\n        type: 'action',\n        method: 'POST',\n        path: '/api/assistant-lead',\n        input: z.object({\n          name: z.string().trim().min(2).max(120),\n          workEmail: z.email().max(240),\n          company: z.string().trim().min(2).max(200),\n          note: z.string().max(500),\n        }),\n        output: z.object({ ok: z.boolean() }),\n        request: {\n          name: '${args.name}',\n          workEmail: '${args.workEmail}',\n          company: '${args.company}',\n          note: '${args.note}',\n          // Fixed attribution, set here rather than model-supplied: Acme's sink can trust it.\n          source: 'website-assistant',\n        },\n        response: { ok: '${response.ok}' },\n      },\n    },\n  });\n\nconst captureLead = tool('capture_lead', {\n  title: 'Send my details to Acme',\n  description:\n    'Send the visitor’s contact details and trip interest to Acme Getaways so the team may follow ' +\n    'up. Call only after the visitor explicitly agrees to be contacted; the confirmation card is ' +\n    'their consent moment. After a confirmed success, say only that the details were sent — never ' +\n    'promise response timing.',\n  annotations: annotations.action({ confirm: true }),\n  input: z.object({\n    name: z.string().trim().min(2).max(120).meta({ title: 'Your name' }),\n    workEmail: z.email().max(240).meta({ title: 'Work email' }),\n    company: z.string().trim().min(2).max(200).meta({ title: 'Company' }),\n    note: z.string().max(500).default('').meta({ title: 'What are you planning?' }),\n  }),\n  output: z.object({ ok: z.boolean() }),\n  fulfil: ({ input, connectors }) => {\n    const result = connectors.leads.submitLead({\n      name: input.name,\n      workEmail: input.workEmail,\n      company: input.company,\n      note: input.note,\n    });\n    return { ok: result.ok };\n  },\n});\n\n// The mixed surface's sign-in trigger (ADR 0201): reading `${user.id}` classifies this tool\n// requires-identity, so an anonymous visitor who reaches for it sees the sign-in card instead of an\n// error — and after signing in on Acme's account origin, the conversation continues under the\n// authenticated surface below.\nconst myTrips = tool('my_trips', {\n  title: 'My saved trips',\n  description: 'Read the signed-in traveler’s saved trips and their booking status.',\n  annotations: readOnly,\n  input: z.object({}),\n  output: z.object({\n    traveler: z.string(),\n    status: z.string(),\n  }),\n  fulfil: ({ user }) => ({\n    traveler: user.id as string,\n    status: 'No trips booked yet — shortlist a getaway to start one.',\n  }),\n});\n\n// Grounding beyond the catalog: two controlled files answer policy/pricing/support questions with\n// citations, and Acme's live public site is crawled on deploy and re-crawled on the declared\n// refresh cadence — no sync job, no handwritten search tool. One declaration, one generated\n// `search_destinations` capability. The managed crawler and index are the defaults; a component\n// can instead bring its own via `crawler: firecrawl({ apiKey: secret('FIRECRAWL_API_KEY') })`\n// and `index: algolia({ appId: variable('ALGOLIA_APP_ID'), apiKey: secret('ALGOLIA_API_KEY') })`\n// — the code names the config, `noodle secrets|variables set` supplies the values.\nconst destinations = knowledge('destinations', {\n  title: 'Acme Getaways destinations',\n  description: 'Public destination, pricing, cancellation, and support information.',\n  documents: [\n    file('./knowledge/product.md', {\n      title: 'Product guide',\n      sourceUrl: 'https://getaways.acme.example/product',\n    }),\n    file('./knowledge/faq.txt', { title: 'FAQ' }),\n  ],\n  sites: [\n    site({\n      origin: 'https://getaways.acme.example',\n      include: ['/destinations/**', '/pricing', '/support'],\n      refresh: '12h',\n    }),\n  ],\n});\n\nexport default server(\n  'acme_discovery',\n  {\n    title: 'Acme Getaways',\n    version: '1.0.0',\n    branding: {\n      name: 'Acme Getaways',\n      accent: '#0EA5A4',\n      surface: '#F0FDFA',\n      surfaceDark: '#0B1B1B',\n      radius: 'lg',\n      density: 'comfortable',\n    },\n    // The only external destinations the app links out to — the compiler derives ChatGPT's\n    // redirect_domains from this so the handoff opens without a safe-link warning.\n    handoff: {\n      allowedDomains: ['https://book.acme.example', 'https://acme.example'],\n    },\n    use: { leads: leadSink },\n    // The same tools also serve Acme's own websites, with no second tool set. The marketing site is\n    // a **mixed** surface (`signIn: true`): a visitor with no account gets discovery, the booking\n    // handoff, and the confirm-gated lead capture — and reaching for `my_trips` raises the sign-in\n    // card instead of an error, with `signUpAction` offering account creation through Acme's own\n    // registration. After the login redirect lands on the account origin, the same conversation\n    // continues under the authenticated surface's capabilities and instructions (ADR 0201).\n    // `capabilities` is the whole externally reachable surface per front door — short enough to\n    // review in one glance, and closed by default when a tool is added to the server later.\n    assistant: embeddedAssistant({\n      model: noodleManaged(),\n      access: [\n        publicWebsite({\n          origins: ['https://getaways.acme.example'],\n          // A browser agent on Acme's marketing page (Gemini-in-Chrome, Claude-in-Chrome) discovers\n          // exactly the capabilities listed below and reaches them over the same authorization,\n          // confirmation, budget, and audit path the panel's own calls take: `capture_lead` still\n          // stops for its confirmation card. `site/index.html` is the page this runs on.\n          webmcp: { enabled: true },\n          capabilities: [\n            destinations,\n            discoverGetaways,\n            createHandoff,\n            shortlistGetaway,\n            captureLead,\n            myTrips,\n          ],\n          signIn: true,\n          instructions:\n            'Be a friendly, consultative travel guide, never pushy. Help visitors narrow a getaway before suggesting the next useful step. Ground recommendations in Acme knowledge, and clearly separate discovery from booking. When a visitor’s plans firm up, invite them to sign in or create an account; if they would rather not, offer — once — to send their details to the Acme team instead.',\n        }),\n        authenticatedWebsite({\n          origins: ['https://account.acme.example'],\n          capabilities: [destinations, discoverGetaways, createHandoff, myTrips],\n          instructions:\n            'The traveler is signed in. Help them plan from their saved trips, and keep booking on Acme’s own pages through the handoff.',\n        }),\n      ],\n      layout: { mode: 'floating', position: 'bottom-right' },\n      labels: {\n        welcomeHeading: 'Where would you like to go?',\n        signInHeading: 'Continue with your Acme account',\n        signInBody: 'Saved trips need an account.',\n        signInAction: 'Sign in',\n        signUpAction: 'Create free account',\n      },\n    }),\n    knowledge: [destinations],\n  },\n  [discoverGetaways, createHandoff, shortlistGetaway, captureLead, myTrips],\n);\n" },
+    { relPath: "examples/acme-discovery/src/server.ts", content: "import {\n  annotations,\n  authenticatedWebsite,\n  connector,\n  embeddedAssistant,\n  file,\n  knowledge,\n  noodleManaged,\n  publicWebsite,\n  secret,\n  server,\n  site,\n  tool,\n  variable,\n  z,\n} from '@noodleseed/one';\n\n// Acme Getaways is a fictional travel brand. This app is deliberately top-of-funnel: discovery and\n// configuration happen inside ChatGPT; the booking/transaction happens off-app on Acme's own site,\n// reached through a signed, attributable handoff deep link. Destinations are the partner's own\n// catalog (grounding) — the app never invents a place, price, or best-month.\n//\n// Authoring note: a tool `fulfil` is *recorded*, not run as live JS. Inputs flow through as\n// `${input.x}` substitutions when placed directly into an output string; do not transform them\n// (no URL-encoding, arithmetic, or filtering on an input value — those break substitution). The\n// curated catalog below is static data the runtime returns verbatim.\n\nconst catalog = [\n  {\n    id: 'coral_bay',\n    name: 'Coral Bay',\n    region: 'Adriatic coast',\n    vibe: 'beach',\n    priceFrom: 890,\n    bestMonths: 'May–Sep',\n    why: 'Calm swimming coves and a walkable old town — easy for a relaxed first trip.',\n  },\n  {\n    id: 'monte_alto',\n    name: 'Monte Alto',\n    region: 'Northern Alps',\n    vibe: 'mountains',\n    priceFrom: 1120,\n    bestMonths: 'Dec–Mar',\n    why: 'Ski-in village with beginner slopes and long groomed runs.',\n  },\n  {\n    id: 'old_quarter',\n    name: 'Old Quarter',\n    region: 'Central Europe',\n    vibe: 'culture',\n    priceFrom: 640,\n    bestMonths: 'Apr–Oct',\n    why: 'Dense museum district and food halls, all reachable on foot.',\n  },\n  {\n    id: 'harbor_city',\n    name: 'Harbor City',\n    region: 'Pacific rim',\n    vibe: 'city',\n    priceFrom: 980,\n    bestMonths: 'Sep–Nov',\n    why: 'Waterfront nightlife and day-trip islands a short ferry away.',\n  },\n] as const;\n\n// A closed set of URL-safe month values. A `fulfil` cannot url-encode an input (recording would break\n// substitution), so the deep link carries `month` only if it is already safe — the model maps natural\n// phrasing (\"early June\") onto one of these when it fills the tool.\nconst monthEnum = z\n  .enum([\n    'January',\n    'February',\n    'March',\n    'April',\n    'May',\n    'June',\n    'July',\n    'August',\n    'September',\n    'October',\n    'November',\n    'December',\n  ])\n  .default('June');\n\n// The catalog ids are already url-safe slugs. Constrain the handoff `destination` to this closed set so\n// only a real, url-safe id can reach the deep link.\nconst destinationId = z.enum(['coral_bay', 'monte_alto', 'old_quarter', 'harbor_city']);\n\nconst discoverInput = z.object({\n  vibe: z.enum(['beach', 'mountains', 'culture', 'city']).default('beach'),\n  month: monthEnum,\n  travelers: z.number().int().min(1).default(2),\n});\n\n// Tool annotations for host planners: reads are read-only, the handoff opens an external link, and\n// shortlisting is a local non-destructive write.\nconst readOnly = annotations.readOnly();\nconst openLink = annotations.openAction();\nconst localWrite = annotations.localAction({ destructive: false, confirm: false });\n\nconst destinationOutput = z.object({\n  id: z.string(),\n  name: z.string(),\n  region: z.string(),\n  vibe: z.string(),\n  priceFrom: z.number(),\n  bestMonths: z.string(),\n  why: z.string(),\n});\n\nconst discoverGetaways = tool('discover_getaways', {\n  title: 'Discover getaways',\n  description:\n    'Suggest Acme Getaways destinations for a vibe and month and render a discovery carousel.',\n  annotations: readOnly,\n  input: discoverInput,\n  output: z.object({\n    status: z.string(),\n    vibe: z.string(),\n    month: z.string(),\n    travelers: z.number(),\n    // Bounded list: the curated catalog is fixed and small, and the declared ceiling tells the\n    // model and host the payload cannot grow. `noodle check` reports `tool_design_output_bounds`.\n    options: z.array(destinationOutput).max(20),\n  }),\n  // The carousel presents Acme's curated catalog; the model narrates which fit the stated vibe.\n  // (A tool cannot filter on an input value — that is connector/flow work — so all are returned.)\n  fulfil: ({ input }) => ({\n    status: `Acme Getaways for a ${input.vibe} trip in ${input.month}, ${input.travelers} traveler(s).`,\n    vibe: input.vibe,\n    month: input.month,\n    travelers: input.travelers,\n    options: catalog,\n  }),\n  viewTitle: 'Discover getaways',\n  // ChatGPT host status copy (openai/toolInvocation/*) — required for widget-opening tools.\n  invoking: 'Finding getaways…',\n  invoked: 'Getaways ready',\n  domain: 'https://getaways.acme.example',\n  view: {\n    component: 'discovery-carousel',\n    entry: './views/discovery-carousel.tsx',\n  },\n  viewDescription:\n    'A top-of-funnel discovery carousel: pick a destination, then hand off to Acme to book.',\n  csp: {\n    connectDomains: ['https://acme.example'],\n    resourceDomains: ['https://acme.example'],\n    frameDomains: ['https://acme.example'],\n  },\n});\n\nconst createHandoff = tool('create_handoff', {\n  title: 'Create booking handoff',\n  description:\n    'Create the Acme booking deep link for a chosen destination, carrying the configured trip. ' +\n    'Pass the destination id (url-safe slug, e.g. \"coral_bay\") and its display name.',\n  annotations: openLink,\n  input: z.object({\n    destination: destinationId,\n    destinationName: z.string().min(1),\n    month: monthEnum,\n    travelers: z.number().int().min(1).default(2),\n  }),\n  output: z.object({\n    status: z.string(),\n    destination: z.string(),\n    summary: z.string(),\n    handoffUrl: z.string(),\n  }),\n  // Inline the inputs directly so they substitute at runtime; every value is already url-safe\n  // (id slug, month enum, integer), and `src=chatgpt` is the attribution the partner measures\n  // ChatGPT-sourced conversions on.\n  fulfil: ({ input }) => ({\n    status: `Ready to continue on Acme for ${input.destinationName}.`,\n    destination: input.destination,\n    summary: `${input.destinationName} · ${input.month} · ${input.travelers} traveler(s)`,\n    handoffUrl: `https://book.acme.example/plan?dest=${input.destination}&month=${input.month}&pax=${input.travelers}&src=chatgpt`,\n  }),\n});\n\nconst shortlistGetaway = tool('shortlist_getaway', {\n  visibility: ['app'],\n  description: 'Record the traveler’s shortlisted destination from the discovery widget.',\n  annotations: localWrite,\n  input: z.object({\n    destination: z.string(),\n    note: z.string().default(''),\n  }),\n  output: z.object({\n    status: z.string(),\n    destination: z.string(),\n    note: z.string(),\n  }),\n  fulfil: ({ input }) => ({\n    status: `Shortlisted ${input.destination}.`,\n    destination: input.destination,\n    note: input.note,\n  }),\n});\n\n// The consultative sales gateway (ADR 0214): when a visitor would rather not sign up, the assistant\n// may — with explicit confirmation — take their details and deliver them to Acme's own sink. The\n// recipe is a composition of existing primitives, not a platform feature: an ordinary confirm-gated\n// action plus a declarative HTTP connector whose endpoint and credential are operator-managed\n// (`noodle variables set LEAD_SINK_URL …`, `noodle secrets set LEAD_SINK_TOKEN …`). The payload\n// rests only in Acme's own system; the platform stores no lead. A vendor sink is the same shape as\n// data: Resend/Postmark take `auth: { kind: 'apiKey', … }`, a HubSpot private app takes\n// `auth: { kind: 'bearer', … }` — never a named vendor package.\nconst leadSink = connector('lead_sink')\n  .version('1.0.0')\n  .http({\n    baseUrl: variable('LEAD_SINK_URL'),\n    allowedOrigins: ['https://acme.example'],\n    auth: { kind: 'bearer', secret: secret('LEAD_SINK_TOKEN') },\n    operations: {\n      submit_lead: {\n        type: 'action',\n        method: 'POST',\n        path: '/api/assistant-lead',\n        input: z.object({\n          name: z.string().trim().min(2).max(120),\n          workEmail: z.email().max(240),\n          company: z.string().trim().min(2).max(200),\n          note: z.string().max(500),\n        }),\n        output: z.object({ ok: z.boolean() }),\n        request: {\n          name: '${args.name}',\n          workEmail: '${args.workEmail}',\n          company: '${args.company}',\n          note: '${args.note}',\n          // Fixed attribution, set here rather than model-supplied: Acme's sink can trust it.\n          source: 'website-assistant',\n        },\n        response: { ok: '${response.ok}' },\n      },\n    },\n  });\n\nconst captureLead = tool('capture_lead', {\n  title: 'Send my details to Acme',\n  description:\n    'Send the visitor’s contact details and trip interest to Acme Getaways so the team may follow ' +\n    'up. Call only after the visitor explicitly agrees to be contacted; the confirmation card is ' +\n    'their consent moment. After a confirmed success, say only that the details were sent — never ' +\n    'promise response timing.',\n  annotations: annotations.action({ confirm: true }),\n  input: z.object({\n    name: z.string().trim().min(2).max(120).meta({ title: 'Your name' }),\n    workEmail: z.email().max(240).meta({ title: 'Work email' }),\n    company: z.string().trim().min(2).max(200).meta({ title: 'Company' }),\n    note: z.string().max(500).default('').meta({ title: 'What are you planning?' }),\n  }),\n  output: z.object({ ok: z.boolean() }),\n  fulfil: ({ input, connectors }) => {\n    const result = connectors.leads.submitLead({\n      name: input.name,\n      workEmail: input.workEmail,\n      company: input.company,\n      note: input.note,\n    });\n    return { ok: result.ok };\n  },\n});\n\n// The mixed surface's sign-in trigger (ADR 0201): reading `${user.id}` classifies this tool\n// requires-identity, so an anonymous visitor who reaches for it sees the sign-in card instead of an\n// error — and after signing in on Acme's account origin, the conversation continues under the\n// authenticated surface below.\nconst myTrips = tool('my_trips', {\n  title: 'My saved trips',\n  description: 'Read the signed-in traveler’s saved trips and their booking status.',\n  annotations: readOnly,\n  input: z.object({}),\n  output: z.object({\n    traveler: z.string(),\n    status: z.string(),\n  }),\n  fulfil: ({ user }) => ({\n    traveler: user.id as string,\n    status: 'No trips booked yet — shortlist a getaway to start one.',\n  }),\n});\n\n// Grounding beyond the catalog: two controlled files answer policy/pricing/support questions with\n// citations, and Acme's live public site is crawled on deploy and re-crawled on the declared\n// refresh cadence — no sync job, no handwritten search tool. One declaration, one generated\n// `search_destinations` capability. The managed crawler and index are the defaults; a component\n// can instead bring its own via `crawler: firecrawl({ apiKey: secret('FIRECRAWL_API_KEY') })`\n// and `index: algolia({ appId: variable('ALGOLIA_APP_ID'), apiKey: secret('ALGOLIA_API_KEY') })`\n// — the code names the config, `noodle secrets|variables set` supplies the values.\nconst destinations = knowledge('destinations', {\n  title: 'Acme Getaways destinations',\n  description: 'Public destination, pricing, cancellation, and support information.',\n  documents: [\n    file('./knowledge/product.md', {\n      title: 'Product guide',\n      sourceUrl: 'https://getaways.acme.example/product',\n    }),\n    file('./knowledge/faq.txt', { title: 'FAQ' }),\n  ],\n  sites: [\n    site({\n      origin: 'https://getaways.acme.example',\n      include: ['/destinations/**', '/pricing', '/support'],\n      refresh: '12h',\n    }),\n  ],\n});\n\nexport default server(\n  'acme_discovery',\n  {\n    title: 'Acme Getaways',\n    version: '1.0.0',\n    branding: {\n      name: 'Acme Getaways',\n      accent: '#0EA5A4',\n      surface: '#F0FDFA',\n      surfaceDark: '#0B1B1B',\n      radius: 'lg',\n      density: 'comfortable',\n    },\n    // The only external destinations the app links out to — the compiler derives ChatGPT's\n    // redirect_domains from this so the handoff opens without a safe-link warning.\n    handoff: {\n      allowedDomains: ['https://book.acme.example', 'https://acme.example'],\n    },\n    use: { leads: leadSink },\n    // The same tools also serve Acme's own websites, with no second tool set. The marketing site is\n    // a **mixed** surface (`signIn: true`): a visitor with no account gets discovery, the booking\n    // handoff, and the confirm-gated lead capture — and reaching for `my_trips` raises the sign-in\n    // card instead of an error, with `signUpAction` offering account creation through Acme's own\n    // registration. After the login redirect lands on the account origin, the same conversation\n    // continues under the authenticated surface's capabilities and instructions (ADR 0201).\n    // `capabilities` is the whole externally reachable surface per front door — short enough to\n    // review in one glance, and closed by default when a tool is added to the server later.\n    assistant: embeddedAssistant({\n      model: noodleManaged(),\n      access: [\n        publicWebsite({\n          origins: ['https://getaways.acme.example'],\n          // A browser agent on Acme's marketing page (Gemini-in-Chrome, Claude-in-Chrome) discovers\n          // exactly the capabilities listed below and reaches them over the same authorization,\n          // confirmation, budget, and audit path the panel's own calls take: `capture_lead` still\n          // stops for its confirmation card. `site/index.html` is the page this runs on.\n          webmcp: { enabled: true },\n          // A visitor who asks about Coral Bay on one page and clicks through to another would\n          // otherwise arrive at an empty panel and have to start over. This carries the text they\n          // have already read onto the next page, on a fresh session — never the old session's\n          // authority, budget, or a half-answered confirmation (ADR 0223). Opt-in because anonymous\n          // conversation text is Acme's content on Acme's page; the defaults below are deliberately\n          // tighter than the platform ceiling.\n          continuity: { enabled: true, windowSeconds: 300, maxRestores: 3 },\n          capabilities: [\n            destinations,\n            discoverGetaways,\n            createHandoff,\n            shortlistGetaway,\n            captureLead,\n            myTrips,\n          ],\n          signIn: true,\n          instructions:\n            'Be a friendly, consultative travel guide, never pushy. Help visitors narrow a getaway before suggesting the next useful step. Ground recommendations in Acme knowledge, and clearly separate discovery from booking. When a visitor’s plans firm up, invite them to sign in or create an account; if they would rather not, offer — once — to send their details to the Acme team instead.',\n        }),\n        authenticatedWebsite({\n          origins: ['https://account.acme.example'],\n          capabilities: [destinations, discoverGetaways, createHandoff, myTrips],\n          instructions:\n            'The traveler is signed in. Help them plan from their saved trips, and keep booking on Acme’s own pages through the handoff.',\n        }),\n      ],\n      layout: { mode: 'floating', position: 'bottom-right' },\n      labels: {\n        welcomeHeading: 'Where would you like to go?',\n        signInHeading: 'Continue with your Acme account',\n        signInBody: 'Saved trips need an account.',\n        signInAction: 'Sign in',\n        signUpAction: 'Create free account',\n      },\n    }),\n    knowledge: [destinations],\n  },\n  [discoverGetaways, createHandoff, shortlistGetaway, captureLead, myTrips],\n);\n" },
     { relPath: "examples/acme-discovery/src/views/discovery-carousel.tsx", content: "import { useState } from 'react';\nimport { useCallTool, useLayout, useOpenExternal, useToolInfo, useViewState } from '../helpers.js';\nimport './widget-style.css';\n\ntype Destination = {\n  readonly id: string;\n  readonly name: string;\n  readonly region: string;\n  readonly vibe: string;\n  readonly priceFrom: number;\n  readonly bestMonths: string;\n  readonly why: string;\n};\n\nfunction asDiscovery(value: unknown) {\n  return value as\n    | {\n        readonly status?: string;\n        readonly month?: string;\n        readonly travelers?: number;\n        readonly options?: readonly Destination[];\n      }\n    | undefined;\n}\n\nexport default function DiscoveryCarousel() {\n  const { displayMode, theme } = useLayout();\n  const openExternal = useOpenExternal();\n  const discovery = asDiscovery(useToolInfo('discover_getaways').structuredContent);\n  const shortlist = useCallTool('shortlist_getaway');\n  const handoff = useCallTool('create_handoff');\n\n  const options = discovery?.options ?? [];\n  const month = discovery?.month ?? 'June';\n  const travelers = discovery?.travelers ?? 2;\n  const [chosen, setChosen] = useViewState('chosen', options[0]?.id ?? '');\n  const [status, setStatus] = useState(discovery?.status ?? 'Pick a getaway to continue.');\n  const selected = options.find((entry) => entry.id === chosen) ?? options[0];\n  const continueLabel = handoff.isPending\n    ? 'Opening Acme…'\n    : `Continue on Acme${selected ? ` · ${selected.name}` : ''}`;\n\n  async function shortlistDestination(destination: Destination) {\n    setChosen(destination.id);\n    try {\n      const result = await shortlist.callTool({ destination: destination.name });\n      const structured = result.structuredContent as { readonly status?: string } | undefined;\n      setStatus(structured?.status ?? `Shortlisted ${destination.name}.`);\n    } catch {\n      setStatus(`Couldn't shortlist ${destination.name} — try again.`);\n    }\n  }\n\n  async function continueOnAcme() {\n    if (selected === undefined) return;\n    // The handoff is the product: configure here, transact off-app. The deep link carries the trip.\n    // Only open the external target on a successful handoff; surface failures instead of failing silently.\n    try {\n      const result = await handoff.callTool({\n        destination: selected.id,\n        destinationName: selected.name,\n        month,\n        travelers,\n      });\n      const structured = result.structuredContent as { readonly handoffUrl?: string } | undefined;\n      if (structured?.handoffUrl) openExternal(structured.handoffUrl);\n      else setStatus('Continue on Acme is unavailable right now — try again.');\n    } catch {\n      setStatus('Continue on Acme failed — try again.');\n    }\n  }\n\n  return (\n    <main\n      className={`nw-shell${theme === 'dark' ? ' dark' : ''}`}\n      data-llm={`Acme Getaways discovery: ${options.length} options for ${month}, ${travelers} traveler(s); shortlisted ${selected?.name ?? 'none'}`}\n    >\n      <section className=\"nw-card\">\n        <header className=\"nw-header\">\n          <span className=\"nw-icon\" aria-hidden=\"true\">\n            <CompassIcon />\n          </span>\n          <div className=\"nw-title-block\">\n            <h1 className=\"nw-title\">Acme Getaways</h1>\n            <p className=\"nw-subtitle\" aria-live=\"polite\">\n              {status}\n            </p>\n          </div>\n          <span className=\"nw-chip\">\n            {displayMode === 'fullscreen' ? 'Fullscreen' : 'Discover'}\n          </span>\n        </header>\n\n        <div className=\"nw-carousel\">\n          {options.map((entry) => (\n            <article\n              className={`nw-dest${entry.id === chosen ? ' nw-dest-active' : ''}`}\n              key={entry.id}\n            >\n              <div className=\"nw-dest-head\">\n                <span className=\"nw-dest-name\">{entry.name}</span>\n                <span className=\"nw-price\">from ${entry.priceFrom}</span>\n              </div>\n              <p className=\"nw-dest-region\">\n                {entry.region} · best {entry.bestMonths}\n              </p>\n              {/* Grounded copy: the \"why\" comes from Acme's catalog, not invented at runtime. */}\n              <p className=\"nw-dest-why\">{entry.why}</p>\n              <button\n                aria-pressed={entry.id === chosen}\n                className=\"nw-button nw-button-ghost\"\n                type=\"button\"\n                onClick={() => shortlistDestination(entry)}\n              >\n                {entry.id === chosen ? 'Shortlisted' : 'Shortlist'}\n              </button>\n            </article>\n          ))}\n        </div>\n\n        <div className=\"nw-actions\">\n          <button\n            className=\"nw-button nw-button-primary\"\n            type=\"button\"\n            disabled={selected === undefined || handoff.isPending}\n            onClick={continueOnAcme}\n          >\n            <ExternalIcon />\n            {continueLabel}\n          </button>\n        </div>\n        <p className=\"nw-note\">Booking and payment happen on acme.example — never inside chat.</p>\n      </section>\n    </main>\n  );\n}\n\nfunction CompassIcon() {\n  return (\n    <svg viewBox=\"0 0 24 24\" aria-hidden=\"true\">\n      <circle cx=\"12\" cy=\"12\" r=\"9\" />\n      <path d=\"m15.5 8.5-2 5-5 2 2-5 5-2Z\" />\n    </svg>\n  );\n}\n\nfunction ExternalIcon() {\n  return (\n    <svg viewBox=\"0 0 24 24\" aria-hidden=\"true\">\n      <path d=\"M14 4h6v6\" />\n      <path d=\"m20 4-9 9\" />\n      <path d=\"M20 14v5a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1V5a1 1 0 0 1 1-1h5\" />\n    </svg>\n  );\n}\n" },
     { relPath: "examples/acme-discovery/src/views/widget-style.css", content: ":root {\n  color-scheme: light dark;\n  font-family:\n    Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif;\n  --nw-bg: #ffffff;\n  --nw-surface: #f4fbfa;\n  --nw-text: #10201f;\n  --nw-muted: #5b6b6a;\n  --nw-border: #d4e6e4;\n  --nw-accent: #0ea5a4;\n  --nw-accent-strong: #0f766e;\n  --nw-accent-soft: #e6faf8;\n  --nw-radius: 10px;\n  --nw-shadow: 0 18px 50px rgb(15 40 40 / 12%);\n}\n\n.dark,\n[data-theme=\"dark\"] {\n  --nw-bg: #0b1b1b;\n  --nw-surface: #102624;\n  --nw-text: #eafaf8;\n  --nw-muted: #9fb6b3;\n  --nw-border: #244341;\n  --nw-accent: #2dd4bf;\n  --nw-accent-strong: #14b8a6;\n  --nw-accent-soft: #0f3835;\n  --nw-shadow: 0 18px 50px rgb(0 0 0 / 30%);\n}\n\n* {\n  box-sizing: border-box;\n}\n\nbody {\n  margin: 0;\n  background: var(--nw-bg);\n  color: var(--nw-text);\n}\n\nbutton {\n  font: inherit;\n}\n\n.nw-shell {\n  min-height: 100vh;\n  padding: 14px;\n  background: var(--nw-bg);\n  color: var(--nw-text);\n}\n\n.nw-card {\n  max-width: 720px;\n  margin: 0 auto;\n  background: var(--nw-surface);\n  border: 1px solid var(--nw-border);\n  border-radius: var(--nw-radius);\n  box-shadow: var(--nw-shadow);\n  overflow: hidden;\n}\n\n.nw-header {\n  display: flex;\n  align-items: center;\n  gap: 12px;\n  padding: 16px;\n  border-bottom: 1px solid var(--nw-border);\n}\n\n.nw-icon svg {\n  width: 26px;\n  height: 26px;\n  fill: none;\n  stroke: var(--nw-accent);\n  stroke-width: 1.7;\n  stroke-linecap: round;\n  stroke-linejoin: round;\n}\n\n.nw-title-block {\n  flex: 1;\n  min-width: 0;\n}\n\n.nw-title {\n  margin: 0;\n  font-size: 17px;\n  font-weight: 700;\n}\n\n.nw-subtitle {\n  margin: 2px 0 0;\n  font-size: 13px;\n  color: var(--nw-muted);\n}\n\n.nw-chip {\n  padding: 4px 10px;\n  border-radius: 999px;\n  background: var(--nw-accent-soft);\n  color: var(--nw-accent-strong);\n  font-size: 12px;\n  font-weight: 600;\n}\n\n.nw-carousel {\n  display: grid;\n  grid-template-columns: repeat(auto-fill, minmax(220px, 1fr));\n  gap: 12px;\n  padding: 16px;\n}\n\n.nw-dest {\n  display: flex;\n  flex-direction: column;\n  gap: 6px;\n  padding: 12px;\n  border: 1px solid var(--nw-border);\n  border-radius: 12px;\n  background: var(--nw-bg);\n}\n\n.nw-dest-active {\n  border-color: var(--nw-accent);\n  box-shadow: 0 0 0 1px var(--nw-accent);\n}\n\n.nw-dest-head {\n  display: flex;\n  align-items: baseline;\n  justify-content: space-between;\n  gap: 8px;\n}\n\n.nw-dest-name {\n  font-weight: 700;\n}\n\n.nw-price {\n  color: var(--nw-accent-strong);\n  font-size: 12px;\n  font-weight: 600;\n}\n\n.nw-dest-region {\n  margin: 0;\n  font-size: 12px;\n  color: var(--nw-muted);\n}\n\n.nw-dest-why {\n  margin: 0;\n  font-size: 13px;\n  flex: 1;\n}\n\n.nw-actions {\n  display: flex;\n  gap: 8px;\n  padding: 0 16px 12px;\n}\n\n.nw-button {\n  display: inline-flex;\n  align-items: center;\n  gap: 6px;\n  padding: 9px 14px;\n  border: 1px solid var(--nw-border);\n  border-radius: 10px;\n  background: var(--nw-bg);\n  color: var(--nw-text);\n  cursor: pointer;\n}\n\n.nw-button svg {\n  width: 16px;\n  height: 16px;\n  fill: none;\n  stroke: currentColor;\n  stroke-width: 1.7;\n  stroke-linecap: round;\n  stroke-linejoin: round;\n}\n\n.nw-button-ghost {\n  align-self: flex-start;\n  padding: 6px 12px;\n  font-size: 13px;\n}\n\n.nw-button-primary {\n  background: var(--nw-accent);\n  border-color: var(--nw-accent);\n  color: #ffffff;\n  font-weight: 600;\n}\n\n.nw-button-primary:disabled {\n  opacity: 0.6;\n  cursor: default;\n}\n\n.nw-note {\n  margin: 0;\n  padding: 0 16px 16px;\n  font-size: 12px;\n  color: var(--nw-muted);\n}\n" },
     { relPath: "examples/acme-discovery/test/server.test.ts", content: "import { describe, expect, it } from 'vitest';\nimport app from '../src/server.js';\n\ndescribe('acme-discovery example', () => {\n  it('exports a Noodle server definition', () => {\n    expect(typeof app.toManifest).toBe('function');\n  });\n\n  it('declares the off-app handoff domain the deep link lands on', async () => {\n    // Top-of-funnel: the only external target is Acme's booking site, declared once at the server.\n    const manifest = await app.toManifest();\n    expect(JSON.stringify(manifest)).toContain('https://book.acme.example');\n  });\n\n  it('exposes the discovery tool and the handoff tool', async () => {\n    const manifest = await app.toManifest();\n    const text = JSON.stringify(manifest);\n    // The discovery tool renders the carousel; the handoff tool emits the deep link; the widget-only\n    // helper records a shortlist.\n    expect(text).toContain('discover_getaways');\n    expect(text).toContain('create_handoff');\n    expect(text).toContain('shortlist_getaway');\n  });\n\n  it('gives the public website a consultative surface-specific goal', async () => {\n    const manifest = await app.toManifest();\n    expect(manifest.server.assistant?.model).toEqual({ kind: 'noodle-managed' });\n    expect(manifest.server.assistant?.surfaces?.[0]?.instructions).toContain(\n      'friendly, consultative travel guide',\n    );\n  });\n\n  it('keeps the lead capture behind explicit confirmation and a managed customer sink', async () => {\n    const manifest = (await app.toManifest()) as {\n      tools: { name: string; annotations?: Record<string, unknown> }[];\n    };\n    const captureLead = manifest.tools.find((tool) => tool.name === 'capture_lead');\n    // The confirmation card is the visitor's consent moment (ADR 0214): a lead may never leave the\n    // conversation without it, and the sink endpoint/credential stay operator-managed data.\n    expect(captureLead?.annotations?.confirm).toBe(true);\n    const catalog = JSON.stringify(\n      (app as unknown as { toConnectorCatalog: () => unknown }).toConnectorCatalog(),\n    );\n    expect(catalog).toContain('${env.LEAD_SINK_URL}');\n    expect(catalog).toContain('LEAD_SINK_TOKEN');\n    // Fixed attribution set in the request mapping, never model-supplied; no named vendor host.\n    expect(catalog).toContain('website-assistant');\n    expect(catalog).not.toContain('api.resend.com');\n    expect(catalog).not.toContain('api.hubapi.com');\n  });\n\n  it('serves a mixed marketing surface and an authenticated account surface from one server', async () => {\n    const manifest = await app.toManifest();\n    const surfaces = manifest.server.assistant?.surfaces ?? [];\n    expect(surfaces.map((surface) => surface.mode)).toEqual(['mixed', 'authenticated']);\n    // The sign-in trigger is listed on the mixed surface so the assistant can offer it; the\n    // authenticated surface carries its own narrowed list and voice.\n    const capabilityNames = (surface: (typeof surfaces)[number]) =>\n      surface.capabilities?.map((capability) => capability.name) ?? [];\n    expect(capabilityNames(surfaces[0]!)).toContain('my_trips');\n    expect(capabilityNames(surfaces[0]!)).toContain('capture_lead');\n    expect(capabilityNames(surfaces[1]!)).toEqual([\n      'destinations',\n      'discover_getaways',\n      'create_handoff',\n      'my_trips',\n    ]);\n    // Authoring the sign-up label is the opt-in for the card's create-account button.\n    expect(manifest.server.assistant?.labels?.signUpAction).toBe('Create free account');\n  });\n\n  it('opens the marketing surface to browser agents and leaves the account surface closed', async () => {\n    const manifest = await app.toManifest();\n    const surfaces = manifest.server.assistant?.surfaces ?? [];\n\n    // Both front doors, asserted by count first: without it the per-surface claims below read a\n    // missing surface as `undefined` and pass, so deleting a surface would silently satisfy them.\n    expect(surfaces).toHaveLength(2);\n    // ADR 0220: the opt-in governs *discovery* — whether the embed registers this session's already\n    // projected tools with `document.modelContext`. A browser agent on Acme's marketing page reaches\n    // exactly the six capabilities above, over the same authorization, confirmation, and budget path\n    // the panel's own calls take. `capture_lead` still stops for its confirmation card.\n    expect(surfaces[0]?.webmcp).toEqual({ enabled: true });\n    // Per-surface opt-in exists so the two front doors can answer differently, and here they do: the\n    // signed-in account surface carries a traveler's identity, so its tools are not advertised to\n    // whatever agent happens to be running in that browser.\n    expect(surfaces[1]?.webmcp).toBeUndefined();\n  });\n\n  it('declares the grounded knowledge component and its live site scope', async () => {\n    const manifest = (await app.toManifest()) as { server: { knowledge?: unknown[] } };\n    // One declaration: controlled files plus the live public site, compiled later into the\n    // generated `search_destinations` capability with citations.\n    expect(manifest.server.knowledge).toHaveLength(1);\n    const text = JSON.stringify(manifest);\n    expect(text).toContain('knowledge/product.md');\n    expect(text).toContain('https://getaways.acme.example');\n  });\n});\n" },

package/node_modules/@noodle-borg/agent-kit/dist/skill-embedded-assistant-ref.js

@@ -202,6 +202,8 @@ export function renderEmbeddedAssistantReference() {
         '',
         "Set `webmcp: { enabled: true }` on the assistant to let a browser agent reach this session's tools through the page's WebMCP API, and set it on an individual access surface to override that default in either direction — a marketing surface can opt in while a signed-in one opts out, or the reverse. Off unless set, and inert in browsers without `document.modelContext`. It governs discovery: whether the embed registers the tools this session already projects, narrowed to those that are both app-callable and model-visible. Every call executes over the same apps-bridge path the assistant's own calls take, so a browser agent gets the session's authority and nothing more, and a `confirm: true` tool still stops for a human in the panel rather than being accepted on the agent's behalf. It is not a second authorization boundary — the session is the only one. Bridge calls spend their own per-session and per-day budgets instead of model turns, and the surface's daily kill switch stops them too. Prefer this over hand-registering page-local tools that borrow the visitor's session: those carry no scoped authority, policy, or audit trail.",
         '',
+        'Set `continuity: { enabled: true }` on a public or mixed access surface to let an anonymous visitor keep the conversation they can see when they navigate to another page of the same site. Off unless set, and refused on an authenticated surface, which reattaches through a backend-verified sign-in instead. It restores the visible text on a fresh session and never the old one: no tool authority, no share of a spent turn budget, and no pending confirmation carried across, so an unanswered confirmation stays unanswered. `windowSeconds` defaults to 300 with a 600 ceiling, `maxRestores` to 3 with a ceiling of 10, and 0 for either disables continuity outright; an operator may lower what you declare and can never raise it. The handle lives in `sessionStorage` so it dies with the tab, is single-use, and is valid only for the embed, origin, and visitor it was issued to. Declare it when a marketing site spreads one conversation across several pages; leave it off when anonymous conversation text should not survive a navigation at all.',
+        '',
         'Give every business action a portable `tool(..., { title: "Complete task", description: "This will mark the task complete for everyone.", input: z.object({ task: z.string().meta({ title: "Task" }) }) })` title. The standard confirmation uses the tool title/description plus schema field `title`, `description`, and `format`; it shows Confirm and Don\'t proceed and keeps technical action details secondary. `behavior.showConfirmationDetails` defaults to `true`; set it to `false` to remove only the built-in card\'s Additional details disclosure and connector mechanics. The business review and decisions remain, `confirm: true` still suspends until acceptance, and headless/BYO `data-confirmation` stays unchanged. Do not put JSON or implementation names in business-facing copy.',
         '',
         '## Configure and deploy',

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-suggestions.js

@@ -1,8 +1,9 @@
 import { requestModelCompletion } from './model-request.js';
 const MAX_MODEL_RESPONSE = 1 << 20;
+const MAX_SUGGESTION_TOKENS = 512;
 /** One bounded, tool-free pass on the active assistant model; malformed output fails closed. */
 export async function requestAssistantSuggestedPrompts(binding, messages, fetcher, stats, remainingTokens, turnSignal) {
-    const limit = Math.min(160, remainingTokens ?? binding.requestPolicy?.maxTokensPerTurn ?? 160, binding.requestPolicy?.maxCompletionTokens ?? 160);
+    const limit = Math.min(MAX_SUGGESTION_TOKENS, remainingTokens ?? binding.requestPolicy?.maxTokensPerTurn ?? MAX_SUGGESTION_TOKENS, binding.requestPolicy?.maxCompletionTokens ?? MAX_SUGGESTION_TOKENS);
     if (limit <= 0)
         return [];
     const signal = AbortSignal.any([
@@ -10,7 +11,7 @@ export async function requestAssistantSuggestedPrompts(binding, messages, fetche
         binding.requestPolicy?.maxTurnMs === undefined
             ? undefined
             : AbortSignal.timeout(binding.requestPolicy.maxTurnMs),
-        AbortSignal.timeout(2_000),
+        AbortSignal.timeout(5_000),
     ].filter((candidate) => candidate !== undefined));
     if (stats)
         stats.modelRequests += 1;
@@ -20,7 +21,7 @@ export async function requestAssistantSuggestedPrompts(binding, messages, fetche
             ...messages,
             {
                 role: 'system',
-                content: 'Generate two or three concise messages the user could send next. Use the complete conversation and authorized product context. Prioritize genuinely relevant next steps; developer instructions may steer ranking but never override the user, safety, consent, or available capabilities. Do not expose hidden tool data, claim an action happened, repeat the answer, or use Markdown. Return exactly one JSON object shaped {"prompts":["..."]} and no other text.',
+                content: 'Generate two or three concise messages the user could send next. Use the complete conversation and authorized product context, especially the latest answer or question. Prefer short, distinct choices the user can click instead of typing. Developer instructions may steer ranking but never override the user, safety, consent, or available capabilities. Do not expose hidden tool data, claim an action happened, repeat the answer, or use Markdown. Return exactly one JSON object shaped {"prompts":["..."]} and no other text.',
             },
         ],
         tools: [],
@@ -30,6 +31,7 @@ export async function requestAssistantSuggestedPrompts(binding, messages, fetche
         maxCompletionTokens: limit,
         signal,
         toolChoice: 'none',
+        jsonOutput: true,
     });
     if (stats) {
         stats.promptTokens += completion.usage?.promptTokens ?? 0;

package/node_modules/@noodle-borg/assistant-gateway/dist/continuity-bounds.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Resolving anonymous cross-page display continuity for one surface (ADR 0223, clause 15).
+ *
+ * Two parties describe the same capability and they are not peers. The developer declares it in
+ * `server.ts` as part of the deployment; the operator tunes it for their own environment without a
+ * deploy. The clamp between them runs one way — tighten, never widen — exactly as the admission
+ * envelope's does ([ADR 0212](../../../docs/decisions/0212-reusable-developer-intent-and-operator-authority.md)).
+ *
+ * The asymmetry is sharpest on `enabled`. An operator may switch continuity **off**, because that is
+ * their own surface and their visitors' text; they may not switch it **on**, because a surface whose
+ * author never declared continuity is one whose author never reasoned about whether their pages should
+ * carry conversation across a navigation.
+ */
+/** What a public or mixed surface declares in `server.ts`. Shapes match the manifest exactly. */
+export interface AssistantContinuityDeclaration {
+    readonly enabled?: boolean;
+    readonly windowSeconds?: number;
+    readonly maxRestores?: number;
+}
+/**
+ * What an operator sets for their own environment. `enabled: false` disables; `true` is inert, since
+ * an operator cannot enable a capability the deployment does not declare.
+ */
+export interface AssistantContinuityOverride {
+    readonly enabled?: boolean;
+    readonly windowSeconds?: number;
+    readonly maxRestores?: number;
+}
+export interface ResolvedAssistantContinuity {
+    readonly enabled: boolean;
+    /** Zero whenever `enabled` is false, so a caller cannot read a live window off a dead surface. */
+    readonly windowMs: number;
+    readonly maxRestores: number;
+}
+export declare function resolveContinuity(declaration: AssistantContinuityDeclaration | undefined, override: AssistantContinuityOverride | undefined): ResolvedAssistantContinuity;
+//# sourceMappingURL=continuity-bounds.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/continuity-bounds.js

@@ -0,0 +1,52 @@
+import { ASSISTANT_CONTINUITY_MAX_RESTORES, ASSISTANT_CONTINUITY_RESTORE_CEILING, ASSISTANT_CONTINUITY_WINDOW_CEILING_MS, ASSISTANT_CONTINUITY_WINDOW_MS, continuityMaxRestores, continuityWindowMs, } from './continuity-store.js';
+const OFF = { enabled: false, windowMs: 0, maxRestores: 0 };
+/**
+ * A declared bound that is not a non-negative integer fails the surface closed rather than falling back
+ * to the shipped default.
+ *
+ * This is deliberately the opposite of the spend ladder's malformed-allowance rule, which fails to
+ * *absent* because an outage costs more than a day of unbudgeted spend. The thing configured here is a
+ * capability, and the safe failure for a capability is not to exist: a typo that silently grants a
+ * 300-second window nobody asked for is worse than a typo that grants nothing.
+ */
+function boundedInteger(value) {
+    if (value === undefined)
+        return undefined;
+    return Number.isInteger(value) && value >= 0 ? value : 'invalid';
+}
+export function resolveContinuity(declaration, override) {
+    if (declaration?.enabled !== true)
+        return OFF;
+    if (override?.enabled === false)
+        return OFF;
+    const declaredWindow = boundedInteger(declaration.windowSeconds);
+    const declaredRestores = boundedInteger(declaration.maxRestores);
+    const overriddenWindow = boundedInteger(override?.windowSeconds);
+    const overriddenRestores = boundedInteger(override?.maxRestores);
+    if (declaredWindow === 'invalid' ||
+        declaredRestores === 'invalid' ||
+        overriddenWindow === 'invalid' ||
+        overriddenRestores === 'invalid') {
+        return OFF;
+    }
+    // Each side is clamped to the structural ceiling first, then the tighter of the two wins. Clamping
+    // before the `Math.min` means an over-eager operator value degrades to the ceiling rather than
+    // becoming one, which is the same shape `surfaceEnvelope` uses for daily budgets.
+    const windowMs = Math.min(declaredWindow === undefined
+        ? ASSISTANT_CONTINUITY_WINDOW_MS
+        : continuityWindowMs(declaredWindow * 1000), overriddenWindow === undefined
+        ? ASSISTANT_CONTINUITY_WINDOW_CEILING_MS
+        : continuityWindowMs(overriddenWindow * 1000));
+    const maxRestores = Math.min(declaredRestores === undefined
+        ? ASSISTANT_CONTINUITY_MAX_RESTORES
+        : continuityMaxRestores(declaredRestores), overriddenRestores === undefined
+        ? ASSISTANT_CONTINUITY_RESTORE_CEILING
+        : continuityMaxRestores(overriddenRestores));
+    // Zero from either party is a real value and is the kill switch, so it must not read as "unset".
+    // Collapsing it to `OFF` here keeps every caller from having to remember that a zero-length window
+    // and a disabled surface are the same thing.
+    if (windowMs === 0 || maxRestores === 0)
+        return OFF;
+    return { enabled: true, windowMs, maxRestores };
+}
+//# sourceMappingURL=continuity-bounds.js.map

package/node_modules/@noodle-borg/assistant-gateway/dist/continuity-store.d.ts

@@ -0,0 +1,115 @@
+import type { TenantRef } from './tenant-ref.js';
+/**
+ * Anonymous cross-page display continuity (ADR 0223, clauses 11-16).
+ *
+ * **A display handle, not a session.** Claiming one returns the conversation's visible text for
+ * rendering and mints a fresh session; it never revives the original, and grants no tool authority, no
+ * share of a spent turn budget, and no bound surface. Deliberately unlike the authenticated reattach in
+ * clause 7, it restores no view descriptor and no pending interaction — a capability that survives a
+ * navigation is exactly what this design refuses to create.
+ *
+ * **Its bounds are shaped by one asymmetry.** A sign-in ticket is safe partly because possession alone
+ * is worthless: spending one also requires the customer's client credentials, held server-side. An
+ * anonymous visitor has no such credential and no server-side counterpart, so possession of a handle is
+ * *sufficient by itself*. Hence four independent bounds — single use, a short window, binding to the
+ * context it was issued to, and a chain that ends — rather than any one of them carrying the weight.
+ */
+/** What a handle is bound to. All three are hashes; no raw origin or visitor id is ever stored. */
+export interface AssistantContinuityContext {
+    readonly embedId: string;
+    readonly originHash: string;
+    readonly visitorHash: string;
+}
+export interface AssistantContinuityRecord {
+    readonly id: string;
+    readonly sessionId: string;
+    readonly tenant: TenantRef;
+    readonly context: AssistantContinuityContext;
+    readonly handleHash: string;
+    /** Restores already spent on this conversation, carried across every rotation. */
+    readonly restoreCount: number;
+    /** Clamped at issue time and stored, so a record describes its own limit rather than trusting a caller. */
+    readonly maxRestores: number;
+    readonly createdAt: string;
+    readonly expiresAt: string;
+    readonly claimedAt?: string;
+}
+export type AssistantContinuityClaim = {
+    readonly ok: true;
+    readonly record: AssistantContinuityRecord;
+    /**
+     * The rotated handle for the next navigation, or `undefined` once the chain is spent. Withholding
+     * it is how continuity ends: the visitor still sees the text they were promised, and the next page
+     * simply has nothing to present, so no refusal code is needed for an ordinary ending.
+     */
+    readonly handle?: string;
+} | {
+    readonly ok: false;
+    /**
+     * One code per refusal, because they are operationally different: `unknown` is a bad or already
+     * spent handle, `expired` is a visitor who took too long, and `context_mismatch` is a handle
+     * presented from an embed, origin, or visitor it was not issued to — the exfiltration signal, and
+     * the one worth alerting on, so it must not collapse into the first.
+     */
+    readonly reason: 'unknown' | 'expired' | 'context_mismatch';
+};
+/** Five minutes: long enough to read a page before clicking through, short enough to bound a leak. */
+export declare const ASSISTANT_CONTINUITY_WINDOW_MS: number;
+/**
+ * Ten minutes, the sign-in ticket's own TTL: an anonymous display handle must never outlive the
+ * authenticated capability it is modelled on, whatever a developer or operator asks for.
+ */
+export declare const ASSISTANT_CONTINUITY_WINDOW_CEILING_MS: number;
+/** Three restores covers the engaged visitor's page depth without letting a chain run indefinitely. */
+export declare const ASSISTANT_CONTINUITY_MAX_RESTORES = 3;
+/** Past ten, chain length stops being a meaningful control, so no configuration may exceed it. */
+export declare const ASSISTANT_CONTINUITY_RESTORE_CEILING = 10;
+export declare function continuityWindowMs(requested?: number): number;
+export declare function continuityMaxRestores(requested?: number): number;
+export interface AssistantContinuityStore {
+    /**
+     * Issue this session's handle for the next navigation, superseding any unclaimed one so a
+     * conversation never accumulates one live key per turn.
+     *
+     * Returns `undefined` when the effective window or chain clamps to zero. The kill switch is enforced
+     * here rather than at the call site, so a caller that forgets to check cannot hand out a handle the
+     * operator has switched off.
+     */
+    issue(input: {
+        readonly sessionId: string;
+        readonly tenant: TenantRef;
+        readonly context: AssistantContinuityContext;
+        readonly windowMs?: number;
+        readonly maxRestores?: number;
+        readonly now: Date;
+    }): Promise<{
+        readonly record: AssistantContinuityRecord;
+        readonly handle: string;
+    } | undefined>;
+    /**
+     * Spend a handle exactly once, rotating to a fresh one until the chain is spent. Atomic: two backends
+     * racing the same value must not both win, which is why this is one store seam rather than a
+     * read-then-write in the route.
+     */
+    claim(input: {
+        readonly handle: string;
+        readonly context: AssistantContinuityContext;
+        readonly now: Date;
+    }): Promise<AssistantContinuityClaim>;
+    /**
+     * Drop spent and expired rows, returning how many went.
+     *
+     * Retention belongs to this store rather than to a caller that may forget: handles are short-lived and
+     * must be swept, not accumulated. Cleanup may lag expiry safely, because `claim` already refuses a
+     * stale handle — the sweep bounds the table, it does not enforce the window.
+     */
+    sweepExpired(input: {
+        readonly now: Date;
+    }): Promise<number>;
+}
+export declare function continuityHandle(): string;
+export declare function continuityDigest(value: string): string;
+export declare function continuityHashesEqual(left: string, right: string): boolean;
+/** Every leg must match: a handle is only valid for the embed, origin, and visitor it was issued to. */
+export declare function sameContinuityContext(left: AssistantContinuityContext, right: AssistantContinuityContext): boolean;
+//# sourceMappingURL=continuity-store.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/continuity-store.js

@@ -0,0 +1,51 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+/** Five minutes: long enough to read a page before clicking through, short enough to bound a leak. */
+export const ASSISTANT_CONTINUITY_WINDOW_MS = 5 * 60 * 1000;
+/**
+ * Ten minutes, the sign-in ticket's own TTL: an anonymous display handle must never outlive the
+ * authenticated capability it is modelled on, whatever a developer or operator asks for.
+ */
+export const ASSISTANT_CONTINUITY_WINDOW_CEILING_MS = 10 * 60 * 1000;
+/** Three restores covers the engaged visitor's page depth without letting a chain run indefinitely. */
+export const ASSISTANT_CONTINUITY_MAX_RESTORES = 3;
+/** Past ten, chain length stops being a meaningful control, so no configuration may exceed it. */
+export const ASSISTANT_CONTINUITY_RESTORE_CEILING = 10;
+/**
+ * Clamp a requested bound the way the admission envelope does: one direction only.
+ *
+ * Zero is the deploy-free kill switch, and anything malformed — negative, fractional, NaN — collapses to
+ * zero rather than to the default. A typo must fail closed here: unlike a spend allowance, where an
+ * outage is worse than a day of unbudgeted cost, a continuity handle is a capability, and the safe
+ * failure for a capability is not to exist.
+ */
+function clampBound(requested, fallback, ceiling) {
+    if (requested === undefined)
+        return fallback;
+    if (!Number.isInteger(requested) || requested < 0)
+        return 0;
+    return Math.min(requested, ceiling);
+}
+export function continuityWindowMs(requested) {
+    return clampBound(requested, ASSISTANT_CONTINUITY_WINDOW_MS, ASSISTANT_CONTINUITY_WINDOW_CEILING_MS);
+}
+export function continuityMaxRestores(requested) {
+    return clampBound(requested, ASSISTANT_CONTINUITY_MAX_RESTORES, ASSISTANT_CONTINUITY_RESTORE_CEILING);
+}
+export function continuityHandle() {
+    return `cnt_${randomBytes(24).toString('base64url')}`;
+}
+export function continuityDigest(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+export function continuityHashesEqual(left, right) {
+    const a = Buffer.from(left, 'utf8');
+    const b = Buffer.from(right, 'utf8');
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+/** Every leg must match: a handle is only valid for the embed, origin, and visitor it was issued to. */
+export function sameContinuityContext(left, right) {
+    return (left.embedId === right.embedId &&
+        left.originHash === right.originHash &&
+        left.visitorHash === right.visitorHash);
+}
+//# sourceMappingURL=continuity-store.js.map

package/node_modules/@noodle-borg/assistant-gateway/dist/in-memory-continuity-store.d.ts

@@ -0,0 +1,26 @@
+import { type AssistantContinuityClaim, type AssistantContinuityContext, type AssistantContinuityRecord, type AssistantContinuityStore } from './continuity-store.js';
+import type { TenantRef } from './tenant-ref.js';
+/** The in-memory half of the pair. Both run the shared parity suite; neither is the only proof. */
+export declare class InMemoryAssistantContinuityStore implements AssistantContinuityStore {
+    #private;
+    issue(input: {
+        readonly sessionId: string;
+        readonly tenant: TenantRef;
+        readonly context: AssistantContinuityContext;
+        readonly windowMs?: number;
+        readonly maxRestores?: number;
+        readonly now: Date;
+    }): Promise<{
+        readonly record: AssistantContinuityRecord;
+        readonly handle: string;
+    } | undefined>;
+    claim(input: {
+        readonly handle: string;
+        readonly context: AssistantContinuityContext;
+        readonly now: Date;
+    }): Promise<AssistantContinuityClaim>;
+    sweepExpired(input: {
+        readonly now: Date;
+    }): Promise<number>;
+}
+//# sourceMappingURL=in-memory-continuity-store.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/in-memory-continuity-store.js

@@ -0,0 +1,80 @@
+import { randomUUID } from 'node:crypto';
+import { continuityDigest, continuityHandle, continuityHashesEqual, continuityMaxRestores, continuityWindowMs, sameContinuityContext, } from './continuity-store.js';
+/** The in-memory half of the pair. Both run the shared parity suite; neither is the only proof. */
+export class InMemoryAssistantContinuityStore {
+    #rows = new Map();
+    async issue(input) {
+        return this.#write({ ...input, restoreCount: 0 });
+    }
+    async claim(input) {
+        const hash = continuityDigest(input.handle);
+        const found = [...this.#rows.values()].find((row) => continuityHashesEqual(row.handleHash, hash));
+        if (!found || found.claimedAt !== undefined)
+            return { ok: false, reason: 'unknown' };
+        // Context before expiry: a handle replayed from somewhere it was never issued should read as the
+        // exfiltration signal it is, whether or not the value happened to be stale by then.
+        if (!sameContinuityContext(found.context, input.context)) {
+            return { ok: false, reason: 'context_mismatch' };
+        }
+        if (Date.parse(found.expiresAt) <= input.now.getTime())
+            return { ok: false, reason: 'expired' };
+        const restoreCount = found.restoreCount + 1;
+        const claimed = {
+            ...found,
+            restoreCount,
+            claimedAt: input.now.toISOString(),
+        };
+        this.#rows.set(found.id, claimed);
+        if (restoreCount >= found.maxRestores)
+            return { ok: true, record: claimed };
+        const rotated = this.#write({
+            sessionId: found.sessionId,
+            tenant: found.tenant,
+            context: found.context,
+            // Re-derive from the record so a rotation can never widen what the first issue clamped.
+            windowMs: Date.parse(found.expiresAt) - Date.parse(found.createdAt),
+            maxRestores: found.maxRestores,
+            restoreCount,
+            now: input.now,
+        });
+        return rotated === undefined
+            ? { ok: true, record: claimed }
+            : { ok: true, record: claimed, handle: rotated.handle };
+    }
+    async sweepExpired(input) {
+        let removed = 0;
+        for (const [id, row] of this.#rows) {
+            if (row.claimedAt !== undefined || Date.parse(row.expiresAt) <= input.now.getTime()) {
+                this.#rows.delete(id);
+                removed++;
+            }
+        }
+        return removed;
+    }
+    #write(input) {
+        const windowMs = continuityWindowMs(input.windowMs);
+        const maxRestores = continuityMaxRestores(input.maxRestores);
+        if (windowMs === 0 || maxRestores === 0)
+            return undefined;
+        // Supersede rather than accumulate: one live handle per session.
+        for (const [id, row] of this.#rows) {
+            if (row.sessionId === input.sessionId && row.claimedAt === undefined)
+                this.#rows.delete(id);
+        }
+        const handle = continuityHandle();
+        const record = {
+            id: `cont_${randomUUID().replaceAll('-', '')}`,
+            sessionId: input.sessionId,
+            tenant: input.tenant,
+            context: input.context,
+            handleHash: continuityDigest(handle),
+            restoreCount: input.restoreCount,
+            maxRestores,
+            createdAt: input.now.toISOString(),
+            expiresAt: new Date(input.now.getTime() + windowMs).toISOString(),
+        };
+        this.#rows.set(record.id, record);
+        return { record, handle };
+    }
+}
+//# sourceMappingURL=in-memory-continuity-store.js.map

package/node_modules/@noodle-borg/assistant-gateway/dist/model-request.d.ts

@@ -94,6 +94,7 @@ export declare function requestModelCompletion(input: {
     readonly messages: readonly AssistantModelMessage[];
     readonly tools: readonly AssistantModelTool[];
     readonly toolChoice?: 'auto' | 'none' | 'required';
+    readonly jsonOutput?: boolean;
     readonly fetcher: (url: string, init: RequestInit) => Promise<Response>;
     readonly onContent?: (delta: string) => void;
     readonly maxResponseBytes?: number;

package/node_modules/@noodle-borg/assistant-gateway/dist/model-request.js

@@ -17,6 +17,7 @@ export async function requestModelCompletion(input) {
             store: false,
             input: responsesInput(input.messages),
             tools: responsesTools(input.tools),
+            ...(input.jsonOutput ? { text: { format: { type: 'json_object' } } } : {}),
             ...(input.toolChoice === undefined ? {} : { tool_choice: input.toolChoice }),
             ...(completionLimit === undefined ? {} : { max_output_tokens: completionLimit }),
         }
@@ -26,6 +27,7 @@ export async function requestModelCompletion(input) {
             stream: true,
             messages: input.messages,
             tools: input.tools,
+            ...(input.jsonOutput ? { response_format: { type: 'json_object' } } : {}),
             ...(input.toolChoice === undefined ? {} : { tool_choice: input.toolChoice }),
             ...(completionLimit === undefined ? {} : { max_completion_tokens: completionLimit }),
         });

package/node_modules/@noodle-borg/assistant-gateway/dist/model-response-values.js

@@ -0,0 +1,11 @@
+export function nonNegativeInteger(value) {
+    return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 ? value : undefined;
+}
+export async function readBoundedText(response, maxBytes) {
+    const text = await response.text();
+    if (new TextEncoder().encode(text).byteLength > maxBytes) {
+        throw new Error('model response too large');
+    }
+    return text;
+}
+//# sourceMappingURL=model-response-values.js.map

package/node_modules/@noodle-borg/assistant-gateway/dist/model-responses.js

@@ -1,3 +1,4 @@
+import { nonNegativeInteger, readBoundedText } from './model-response-values.js';
 export function responsesInput(messages) {
     return messages.flatMap((message) => {
         if (message.role === 'tool') {
@@ -150,14 +151,4 @@ function parseRecord(value) {
     }
     return value;
 }
-function nonNegativeInteger(value) {
-    return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 ? value : undefined;
-}
-async function readBoundedText(response, maxBytes) {
-    const text = await response.text();
-    if (new TextEncoder().encode(text).byteLength > maxBytes) {
-        throw new Error('model response too large');
-    }
-    return text;
-}
 //# sourceMappingURL=model-responses.js.map

package/node_modules/@noodle-borg/assistant-gateway/dist/model-stream.js

@@ -1,3 +1,4 @@
+import { nonNegativeInteger, readBoundedText } from './model-response-values.js';
 export async function readModelCompletion(response, onContent, maxBytes = 1 << 20) {
     const contentType = response.headers.get('content-type') ?? '';
     if (!contentType.includes('text/event-stream')) {
@@ -111,14 +112,4 @@ function normalizeUsageValue(usage) {
         ...(reasoningTokens === undefined ? {} : { reasoningTokens }),
     };
 }
-function nonNegativeInteger(value) {
-    return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 ? value : undefined;
-}
-async function readBoundedText(response, maxBytes) {
-    const text = await response.text();
-    if (new TextEncoder().encode(text).byteLength > maxBytes) {
-        throw new Error('model response too large');
-    }
-    return text;
-}
 //# sourceMappingURL=model-stream.js.map

package/node_modules/@noodle-borg/assistant-gateway/dist/portable.d.ts

@@ -17,12 +17,15 @@ export * from './assistant-store.js';
 export * from './assistant-transcript.js';
 export * from './assistant-transcript-events.js';
 export * from './assistant-view-availability.js';
+export * from './continuity-bounds.js';
+export * from './continuity-store.js';
 export * from './elevation.js';
 export * from './elevation-store.js';
 export * from './embed-operator-view.js';
 export * from './embed-script.js';
 export * from './embed-store.js';
 export * from './in-memory-assistant-appearance-store.js';
+export * from './in-memory-continuity-store.js';
 export * from './in-memory-elevation-store.js';
 export * from './in-memory-embed-store.js';
 export * from './managed-spend.js';

package/node_modules/@noodle-borg/assistant-gateway/dist/portable.js

@@ -17,12 +17,15 @@ export * from './assistant-store.js';
 export * from './assistant-transcript.js';
 export * from './assistant-transcript-events.js';
 export * from './assistant-view-availability.js';
+export * from './continuity-bounds.js';
+export * from './continuity-store.js';
 export * from './elevation.js';
 export * from './elevation-store.js';
 export * from './embed-operator-view.js';
 export * from './embed-script.js';
 export * from './embed-store.js';
 export * from './in-memory-assistant-appearance-store.js';
+export * from './in-memory-continuity-store.js';
 export * from './in-memory-elevation-store.js';
 export * from './in-memory-embed-store.js';
 export * from './managed-spend.js';

package/node_modules/@noodle-borg/authoring/dist/assistant.d.ts

@@ -173,6 +173,31 @@ export interface AuthenticatedWebsiteAccess {
         readonly enabled?: boolean;
     };
 }
+/**
+ * Anonymous cross-page display continuity for one public surface (ADR 0223, clauses 11-16).
+ *
+ * Off unless asked for. Anonymous conversation text is your content on your page, so whether it
+ * survives a navigation is your call rather than a default the platform imposes.
+ *
+ * What a visitor gets is the text they have already read, re-rendered on the next page, on a fresh
+ * session. What it never grants is the old session itself: no tool authority, no share of a spent
+ * turn budget, and no pending confirmation carried across — a capability that survives a navigation
+ * is exactly what this design refuses to create.
+ */
+export interface AssistantContinuityDeclaration {
+    readonly enabled?: boolean;
+    /**
+     * How long a handle stays valid after the turn that issued it, measured from when the visitor last
+     * spoke. Defaults to 300; 600 is the structural ceiling, and 0 disables continuity outright. An
+     * operator may lower what you declare here and can never raise it.
+     */
+    readonly windowSeconds?: number;
+    /**
+     * How many times one conversation may be restored before continuity ends and the next page starts
+     * fresh. Defaults to 3, ceiling 10, and 0 disables continuity outright.
+     */
+    readonly maxRestores?: number;
+}
 export interface PublicWebsiteAccess {
     readonly mode: 'public' | 'mixed';
     readonly origins: readonly string[];
@@ -182,6 +207,8 @@ export interface PublicWebsiteAccess {
     readonly webmcp?: {
         readonly enabled?: boolean;
     };
+    /** @see PublicWebsiteInput.continuity */
+    readonly continuity?: AssistantContinuityDeclaration;
 }
 export type AssistantAccess = AuthenticatedWebsiteAccess | PublicWebsiteAccess;
 export interface AuthenticatedWebsiteInput {
@@ -226,6 +253,14 @@ export interface PublicWebsiteInput {
     readonly webmcp?: {
         readonly enabled?: boolean;
     };
+    /**
+     * Let an anonymous visitor keep the conversation they can see when they navigate to another page
+     * of this site. Omitted means off, and no existing embed changes behavior.
+     *
+     * Declared only here, never on an authenticated surface: that direction reattaches through a
+     * backend-verified sign-in instead, so a declaration there would configure nothing.
+     */
+    readonly continuity?: AssistantContinuityDeclaration;
 }
 export declare function authenticatedWebsite(input: AuthenticatedWebsiteInput): AuthenticatedWebsiteAccess;
 export declare function publicWebsite(input: PublicWebsiteInput): PublicWebsiteAccess;

package/node_modules/@noodle-borg/authoring/dist/assistant.js

@@ -16,6 +16,7 @@ export function publicWebsite(input) {
         capabilities: [...input.capabilities],
         ...(input.instructions === undefined ? {} : { instructions: input.instructions }),
         ...(input.webmcp === undefined ? {} : { webmcp: { ...input.webmcp } }),
+        ...(input.continuity === undefined ? {} : { continuity: { ...input.continuity } }),
     };
 }
 function serializeOrigins(origins, path) {
@@ -59,6 +60,9 @@ export function embeddedAssistant(input) {
                 ? { sessionClaims: structuredClone(surface.sessionClaims) }
                 : {}),
             ...(surface.webmcp === undefined ? {} : { webmcp: { ...surface.webmcp } }),
+            ...(surface.mode !== 'authenticated' && surface.continuity !== undefined
+                ? { continuity: { ...surface.continuity } }
+                : {}),
         })),
         allowedOrigins: surfaces.flatMap((surface) => [...surface.origins]),
         ...structuredClone(ui),

package/node_modules/@noodle-borg/compiler/dist/manifest/branding-schema.js

@@ -0,0 +1,86 @@
+import { z } from 'zod';
+/**
+ * Shared manifest primitives: colors, https URLs, managed variable expressions, assistant origins,
+ * packaged asset references, and the server brand kit.
+ *
+ * Extracted verbatim from `schema.ts` so that file stays inside its size budget as the assistant
+ * surface grows. These are leaf validators with no dependency on tools, prompts, widgets, or the
+ * assistant block, which is what makes the split one-directional and free of an import cycle.
+ */
+const hexColorSchema = z.string().regex(/^#[0-9A-Fa-f]{6}$/, 'must be a 6-digit hex color');
+export const httpsUrlSchema = z.url().regex(/^https:\/\//, 'must use https');
+const managedVariableExpressionPattern = /^\$\{env\.[A-Za-z0-9_]+\}$/;
+export const managedVariableExpressionSchema = z
+    .string()
+    .regex(managedVariableExpressionPattern, 'must be an exact managed variable expression');
+// HTTP is allowed only for loopback development origins (mirrors the host-pattern loopback
+// exception used for connector/CSP origins); production embedding origins stay https-only.
+const assistantOriginOrVariablePattern = /^(?:\$\{env\.[A-Za-z0-9_]+\}|https:\/\/[^/?#@\\]+|http:\/\/(?:localhost|127\.0\.0\.1|\[::1\])(?::\d+)?)$/;
+function isCanonicalAssistantOrigin(value) {
+    try {
+        return new URL(value).origin === value;
+    }
+    catch {
+        return false;
+    }
+}
+export const assistantOriginOrVariableSchema = z
+    .string()
+    .regex(assistantOriginOrVariablePattern, 'must be a canonical bare origin using https (http is allowed only for localhost/127.0.0.1/[::1] loopback development origins)')
+    .refine((value) => managedVariableExpressionPattern.test(value) || isCanonicalAssistantOrigin(value), 'must be a canonical bare origin');
+const packagedAssetSchema = z
+    .object({
+    kind: z.literal('asset'),
+    sourcePath: z.string().min(1),
+    logicalId: z.string().min(1),
+})
+    .strict();
+const brandAssetSchema = z
+    .object({
+    uri: z.union([httpsUrlSchema, packagedAssetSchema]),
+    darkUri: z.union([httpsUrlSchema, packagedAssetSchema]).optional(),
+    alt: z.string().trim().min(1),
+})
+    .strict();
+const brandThemeTokensSchema = z
+    .object({
+    surface: hexColorSchema.optional(),
+    surfaceRaised: hexColorSchema.optional(),
+    surfaceMuted: hexColorSchema.optional(),
+    text: hexColorSchema.optional(),
+    textMuted: hexColorSchema.optional(),
+    accent: hexColorSchema.optional(),
+    accentText: hexColorSchema.optional(),
+    link: hexColorSchema.optional(),
+    border: hexColorSchema.optional(),
+    borderStrong: hexColorSchema.optional(),
+    focus: hexColorSchema.optional(),
+    success: hexColorSchema.optional(),
+    warning: hexColorSchema.optional(),
+    danger: hexColorSchema.optional(),
+    code: hexColorSchema.optional(),
+})
+    .strict();
+export const serverBrandingSchema = z
+    .object({
+    name: z.string().trim().min(1).optional(),
+    accent: hexColorSchema.optional(),
+    surface: hexColorSchema.optional(),
+    surfaceDark: hexColorSchema.optional(),
+    logo: brandAssetSchema.optional(),
+    mark: brandAssetSchema.optional(),
+    avatar: brandAssetSchema.optional(),
+    theme: z
+        .object({
+        light: brandThemeTokensSchema.optional(),
+        dark: brandThemeTokensSchema.optional(),
+    })
+        .strict()
+        .optional(),
+    radius: z.enum(['none', 'sm', 'md', 'lg']).optional(),
+    density: z.enum(['compact', 'comfortable']).optional(),
+    typography: z.enum(['system', 'serif', 'mono']).optional(),
+    colorScheme: z.enum(['auto', 'light', 'dark']).optional(),
+})
+    .strict();
+//# sourceMappingURL=branding-schema.js.map

package/node_modules/@noodle-borg/compiler/dist/manifest/schema.d.ts

@@ -1,5 +1,4 @@
 import { z } from 'zod';
-import type { PackagedAssetReference } from '../assets.js';
 type ToolAuthorizationManifest = {
     readonly requiredScopes?: readonly string[] | undefined;
     readonly allowedRoles?: readonly string[] | undefined;
@@ -381,6 +380,11 @@ export declare const manifestV1Schema: z.ZodObject<{
                 webmcp: z.ZodOptional<z.ZodObject<{
                     enabled: z.ZodOptional<z.ZodBoolean>;
                 }, z.core.$strict>>;
+                continuity: z.ZodOptional<z.ZodObject<{
+                    enabled: z.ZodOptional<z.ZodBoolean>;
+                    windowSeconds: z.ZodOptional<z.ZodNumber>;
+                    maxRestores: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$strict>>;
             }, z.core.$strict>>>;
             sessionClaims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                 exposeToModel: z.ZodOptional<z.ZodBoolean>;
@@ -395,18 +399,18 @@ export declare const manifestV1Schema: z.ZodObject<{
             surface: z.ZodOptional<z.ZodString>;
             surfaceDark: z.ZodOptional<z.ZodString>;
             logo: z.ZodOptional<z.ZodObject<{
-                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>;
-                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>>;
+                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>;
+                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>>;
                 alt: z.ZodString;
             }, z.core.$strict>>;
             mark: z.ZodOptional<z.ZodObject<{
-                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>;
-                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>>;
+                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>;
+                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>>;
                 alt: z.ZodString;
             }, z.core.$strict>>;
             avatar: z.ZodOptional<z.ZodObject<{
-                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>;
-                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>>;
+                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>;
+                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>>;
                 alt: z.ZodString;
             }, z.core.$strict>>;
             theme: z.ZodOptional<z.ZodObject<{
@@ -864,6 +868,11 @@ export declare const manifestV2Schema: z.ZodObject<{
                 webmcp: z.ZodOptional<z.ZodObject<{
                     enabled: z.ZodOptional<z.ZodBoolean>;
                 }, z.core.$strict>>;
+                continuity: z.ZodOptional<z.ZodObject<{
+                    enabled: z.ZodOptional<z.ZodBoolean>;
+                    windowSeconds: z.ZodOptional<z.ZodNumber>;
+                    maxRestores: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$strict>>;
             }, z.core.$strict>>>;
             sessionClaims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                 exposeToModel: z.ZodOptional<z.ZodBoolean>;
@@ -878,18 +887,18 @@ export declare const manifestV2Schema: z.ZodObject<{
             surface: z.ZodOptional<z.ZodString>;
             surfaceDark: z.ZodOptional<z.ZodString>;
             logo: z.ZodOptional<z.ZodObject<{
-                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>;
-                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>>;
+                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>;
+                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>>;
                 alt: z.ZodString;
             }, z.core.$strict>>;
             mark: z.ZodOptional<z.ZodObject<{
-                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>;
-                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>>;
+                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>;
+                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>>;
                 alt: z.ZodString;
             }, z.core.$strict>>;
             avatar: z.ZodOptional<z.ZodObject<{
-                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>;
-                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>>;
+                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>;
+                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>>;
                 alt: z.ZodString;
             }, z.core.$strict>>;
             theme: z.ZodOptional<z.ZodObject<{
@@ -1557,6 +1566,11 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                 webmcp: z.ZodOptional<z.ZodObject<{
                     enabled: z.ZodOptional<z.ZodBoolean>;
                 }, z.core.$strict>>;
+                continuity: z.ZodOptional<z.ZodObject<{
+                    enabled: z.ZodOptional<z.ZodBoolean>;
+                    windowSeconds: z.ZodOptional<z.ZodNumber>;
+                    maxRestores: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$strict>>;
             }, z.core.$strict>>>;
             sessionClaims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                 exposeToModel: z.ZodOptional<z.ZodBoolean>;
@@ -1571,18 +1585,18 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             surface: z.ZodOptional<z.ZodString>;
             surfaceDark: z.ZodOptional<z.ZodString>;
             logo: z.ZodOptional<z.ZodObject<{
-                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>;
-                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>>;
+                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>;
+                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>>;
                 alt: z.ZodString;
             }, z.core.$strict>>;
             mark: z.ZodOptional<z.ZodObject<{
-                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>;
-                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>>;
+                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>;
+                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>>;
                 alt: z.ZodString;
             }, z.core.$strict>>;
             avatar: z.ZodOptional<z.ZodObject<{
-                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>;
-                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>>;
+                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>;
+                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>>;
                 alt: z.ZodString;
             }, z.core.$strict>>;
             theme: z.ZodOptional<z.ZodObject<{
@@ -2039,6 +2053,11 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                 webmcp: z.ZodOptional<z.ZodObject<{
                     enabled: z.ZodOptional<z.ZodBoolean>;
                 }, z.core.$strict>>;
+                continuity: z.ZodOptional<z.ZodObject<{
+                    enabled: z.ZodOptional<z.ZodBoolean>;
+                    windowSeconds: z.ZodOptional<z.ZodNumber>;
+                    maxRestores: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$strict>>;
             }, z.core.$strict>>>;
             sessionClaims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                 exposeToModel: z.ZodOptional<z.ZodBoolean>;
@@ -2053,18 +2072,18 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             surface: z.ZodOptional<z.ZodString>;
             surfaceDark: z.ZodOptional<z.ZodString>;
             logo: z.ZodOptional<z.ZodObject<{
-                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>;
-                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>>;
+                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>;
+                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>>;
                 alt: z.ZodString;
             }, z.core.$strict>>;
             mark: z.ZodOptional<z.ZodObject<{
-                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>;
-                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>>;
+                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>;
+                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>>;
                 alt: z.ZodString;
             }, z.core.$strict>>;
             avatar: z.ZodOptional<z.ZodObject<{
-                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>;
-                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>>;
+                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>;
+                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>>;
                 alt: z.ZodString;
             }, z.core.$strict>>;
             theme: z.ZodOptional<z.ZodObject<{

package/node_modules/@noodle-borg/compiler/dist/manifest/schema.js

@@ -3,6 +3,7 @@ import { z } from 'zod';
 import { MAX_COMPILED_WIDGET_HTML_BYTES, MAX_RAW_WIDGET_HTML_BYTES } from '../widget-limits.js';
 import { agentGuideSchema } from './agent-guide-schema.js';
 import { serverAuthSchema, serverAuthV2Schema } from './auth-schema.js';
+import { assistantOriginOrVariableSchema, httpsUrlSchema, managedVariableExpressionSchema, serverBrandingSchema, } from './branding-schema.js';
 import { NAME_PATTERN } from './naming.js';
 /**
  * Zod schema for Core v1 and v2 manifests (ADRs 0150 and 0157). V1 remains accepted unchanged;
@@ -133,82 +134,6 @@ const promptSchema = z.object({
     arguments: z.array(promptArgumentSchema).optional(),
     fulfilment: fulfilmentSchema,
 });
-const hexColorSchema = z.string().regex(/^#[0-9A-Fa-f]{6}$/, 'must be a 6-digit hex color');
-const httpsUrlSchema = z.url().regex(/^https:\/\//, 'must use https');
-const managedVariableExpressionPattern = /^\$\{env\.[A-Za-z0-9_]+\}$/;
-const managedVariableExpressionSchema = z
-    .string()
-    .regex(managedVariableExpressionPattern, 'must be an exact managed variable expression');
-// HTTP is allowed only for loopback development origins (mirrors the host-pattern loopback
-// exception used for connector/CSP origins); production embedding origins stay https-only.
-const assistantOriginOrVariablePattern = /^(?:\$\{env\.[A-Za-z0-9_]+\}|https:\/\/[^/?#@\\]+|http:\/\/(?:localhost|127\.0\.0\.1|\[::1\])(?::\d+)?)$/;
-function isCanonicalAssistantOrigin(value) {
-    try {
-        return new URL(value).origin === value;
-    }
-    catch {
-        return false;
-    }
-}
-const assistantOriginOrVariableSchema = z
-    .string()
-    .regex(assistantOriginOrVariablePattern, 'must be a canonical bare origin using https (http is allowed only for localhost/127.0.0.1/[::1] loopback development origins)')
-    .refine((value) => managedVariableExpressionPattern.test(value) || isCanonicalAssistantOrigin(value), 'must be a canonical bare origin');
-const packagedAssetSchema = z
-    .object({
-    kind: z.literal('asset'),
-    sourcePath: z.string().min(1),
-    logicalId: z.string().min(1),
-})
-    .strict();
-const brandAssetSchema = z
-    .object({
-    uri: z.union([httpsUrlSchema, packagedAssetSchema]),
-    darkUri: z.union([httpsUrlSchema, packagedAssetSchema]).optional(),
-    alt: z.string().trim().min(1),
-})
-    .strict();
-const brandThemeTokensSchema = z
-    .object({
-    surface: hexColorSchema.optional(),
-    surfaceRaised: hexColorSchema.optional(),
-    surfaceMuted: hexColorSchema.optional(),
-    text: hexColorSchema.optional(),
-    textMuted: hexColorSchema.optional(),
-    accent: hexColorSchema.optional(),
-    accentText: hexColorSchema.optional(),
-    link: hexColorSchema.optional(),
-    border: hexColorSchema.optional(),
-    borderStrong: hexColorSchema.optional(),
-    focus: hexColorSchema.optional(),
-    success: hexColorSchema.optional(),
-    warning: hexColorSchema.optional(),
-    danger: hexColorSchema.optional(),
-    code: hexColorSchema.optional(),
-})
-    .strict();
-const serverBrandingSchema = z
-    .object({
-    name: z.string().trim().min(1).optional(),
-    accent: hexColorSchema.optional(),
-    surface: hexColorSchema.optional(),
-    surfaceDark: hexColorSchema.optional(),
-    logo: brandAssetSchema.optional(),
-    mark: brandAssetSchema.optional(),
-    avatar: brandAssetSchema.optional(),
-    theme: z
-        .object({
-        light: brandThemeTokensSchema.optional(),
-        dark: brandThemeTokensSchema.optional(),
-    })
-        .strict()
-        .optional(),
-    radius: z.enum(['none', 'sm', 'md', 'lg']).optional(),
-    density: z.enum(['compact', 'comfortable']).optional(),
-    typography: z.enum(['system', 'serif', 'mono']).optional(),
-    colorScheme: z.enum(['auto', 'light', 'dark']).optional(),
-})
-    .strict();
 const assistantPresentationToneSchema = z.enum(['neutral', 'success', 'warning', 'danger']);
 const optionalStrictObject = (shape) => z.object(shape).strict().optional();
 const assistantPresentationSchema = z
@@ -357,6 +282,18 @@ const embeddedAssistantSchema = z
         // `assistantUiSchema.shape` — this is not renderer presentation, and a surface that
         // acquired it by a spread would be an accident rather than a decision.
         webmcp: optionalStrictObject({ enabled: z.boolean().optional() }),
+        // Anonymous cross-page display continuity (ADR 0223, clauses 11-16), declared per public
+        // or mixed surface. These bounds mirror the structural ceilings the gateway clamps to at
+        // runtime; the ADR is the single source, and this package cannot import the gateway
+        // because the dependency runs the other way. Refusing rather than clamping is deliberate:
+        // the gateway narrows an operator's value silently by design, but a developer who asks
+        // for more than the ceiling has made a mistake, and silence would hide it until someone
+        // measured the live behaviour.
+        continuity: optionalStrictObject({
+            enabled: z.boolean().optional(),
+            windowSeconds: z.number().int().min(0).max(600).optional(),
+            maxRestores: z.number().int().min(0).max(10).optional(),
+        }),
     })
         .strict())
         .min(1)
@@ -374,6 +311,17 @@ const embeddedAssistantSchema = z
     .strict()
     .superRefine((assistant, ctx) => {
     assistant.surfaces?.forEach((surface, index) => {
+        // The authenticated direction already reattaches through ADR 0223 clause 7, authorized by a
+        // backend-verified subject rather than by possession of a handle. A `continuity` block here
+        // would be a developer believing they configured something nothing reads, so refuse it rather
+        // than drop it silently.
+        if (surface.mode === 'authenticated' && surface.continuity !== undefined) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['surfaces', index, 'continuity'],
+                message: 'continuity belongs on a public or mixed website surface',
+            });
+        }
         if (surface.mode === 'authenticated')
             return;
         // A public surface fails closed: an omitted allowlist would otherwise read as "expose

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/one",
-  "version": "0.154.0",
+  "version": "0.155.0",
   "private": false,
   "description": "Noodle CLI by Noodle Seed — author, run, and deploy declarative MCP servers. Embedding the assistant in your own web app is @noodleseed/assistant.",
   "license": "Apache-2.0",