@noodleseed/one 0.162.0 → 0.163.0

package/node_modules/@noodle-borg/agent-kit/dist/generated/surface.js

@@ -91,6 +91,7 @@ export const SDK_EXPORTS = [
     'managedSecret',
     'meilisearch',
     'noodleManaged',
+    'noodlePlatform',
     'openAICompatible',
     'prompt',
     'publicWebsite',
@@ -152,6 +153,8 @@ export const COMPILE_ERROR_CODES = [
     'invalid_knowledge',
     'knowledge_unhashed',
     'invalid_managed_collection',
+    'invalid_variable_declaration',
+    'invalid_managed_collection_source',
     'unknown_connector_alias',
     'connector_not_in_catalog',
     'unknown_operation',

package/node_modules/@noodle-borg/agent-kit/dist/skill-authoring-refs.js

@@ -59,9 +59,9 @@ export function renderAuthoringWorkflowReference() {
         '',
         '## Connectors',
         '',
-        'Declare connectors as data, not imperative code:',
+        'Declare typed connectors:',
         '',
-        '- **HTTP**: `connector("id").version("1.0.0").http({ baseUrl, allowedOrigins, auth, operations })` with per-operation `request`/`response` mapping using `${args...}` / `${response...}` expressions.',
+        '- **HTTP**: `connector("id").version("1.0.0").http({ baseUrl, allowedOrigins, auth, operations })`; map request/response with `${args...}` / `${response...}`. Use `${execution.id}` for provider idempotency, never model input. Optional `evidence: { outcome: "${response.execution_outcome}", reference: "${response.id}" }` classifies completed/rejected/accepted/unknown; reference is a bounded opaque ID, never a bearer URL or payload. No automatic action retry.',
         '- **MCP**: `connector("id").version("1.0.0").mcp({ endpoint, allowedOrigins, auth?, operations })` where each operation freezes the separate upstream `tool` wire name plus input/output schema. Import with `noodle import mcp`; do not hand-copy a live surface or call `tools/list` at runtime.',
         '- **Compute**: `connector("id").version("1.0.0").compute(name, { input, output, calls?, run })` — a self-contained, sandboxed function (no imports/closure capture) that may call allowlisted operations via `callOperation`.',
         '',
@@ -75,6 +75,7 @@ export function renderAuthoringWorkflowReference() {
         'credential, and closes it; it does not act as an agent for upstream sampling, roots, or elicitation.',
         '',
         'HTTP connector auth variants: `bearer` (`{ kind: "bearer", secret: secret("API_TOKEN") }`), `apiKey` (`{ kind: "apiKey", header: "X-API-Key", secret: secret("API_KEY") }`), `clientCredentials`, `delegatedOAuth`, `delegatedSessionCookie`, and `delegatedTokenExchange` (per-user calls to your own API — see "Delegated downstream auth" below). Use managed `secret(...)` / `variable(...)` refs for all values that differ by org/app/env.',
+        'An application-owned adapter may require its own service credential in addition to the operator account credential. Declare `http.transportAuth: { kind: "apiKey", header: "X-Adapter-Key", secret: secret("ADAPTER_SERVICE_KEY") }` alongside bound account credential profiles; the credential broker supplies the two independently. Never put either credential in tool arguments or ordinary headers, and never reuse an inbound MCP bearer. This capability does not imply a provider requires two credentials.',
         '',
         'When one connector needs independently selectable accounts, declare catalog `credentialProfiles` plus each operation’s accepted `credentials.profiles`, then bind each `server.use` alias with `bind(connector, { profile, connection: connection("logical_id", managedSecret(secret("NAME"), { scopes, audience })) })`. The alias is the stable account boundary; never put provider account ids, labels, or credential values in it. `gmailConnector()` is the curated Gmail catalog helper; reuse it under independent aliases and accept canonical `accounts` arrays in tools (one account for writes, or an explicitly ordered supported combination for reads). See the bundled `gmail-multi-account` flagship. Bound managed secrets are supported by hosted execution. For deployed-server access to Google APIs, use `googleWorkloadIdentity({ provider: variable("GOOGLE_WIF_PROVIDER"), access: { kind: "direct" } })`, or add `serviceAccountImpersonation` with a managed service-account email. This is keyless Google Workload Identity Federation: exact Google scopes/audience come from the catalog operation, while `noodle auth google prepare|status|doctor|revoke` owns operator lifecycle. See the bundled `google-bigquery` flagship. `externalExchange()` is runnable only when the deployment operator injects an exact HTTPS provider endpoint/origin/audience and durable shared subject-pin store through service ports; Noodle sends a short-lived platform-signed deployment workload assertion and accepts only a bounded bearer response. Provider implementations must consume assertion replay ids through durable shared atomic storage across instances and restarts. There is intentionally no hosted enrollment or provider CRUD surface yet. The provider wire contract is public, but its conformance kit is workspace/source-only and is not an installable npm package. Bound `clientCredentials(...)` remains fail-closed until its provider slice lands.',
         '',
@@ -220,6 +221,12 @@ export function renderAuthoringWorkflowReference() {
         '',
         'Author managed config as `secret("NAME")` / `variable("NAME")` and operate it with `noodle secrets set` / `noodle variables set` (scoped org/app/env). Never inline secret values in `server.ts`, tests, or generated files.',
         '',
+        'For business-editable configuration, declare `const notice = variable("SERVICE_NOTICE", { schema: z.string().max(500), default: "Welcome", portal: { label: "Service notice", group: "Guest experience" }, requiredFor: ["show_menu"] })` and register it in `server(..., { variables: [notice], ... }, tools)`. Use the same ref in ordinary fulfilment/connector arguments. The default is reusable safe intent; each business supplies its own values without editing source. Only explicit `portal` metadata exposes a setting. Name-only references and declared variables without `portal` remain technical configuration; secrets remain credential slots. See the bundled `acme-bistro` source.',
+        '',
+        'Business schemas must be bounded: booleans, finite bounded numbers, bounded text, string enums, bounded arrays, and closed objects. Put defaults in the declaration, not inside Zod schema defaults; custom transforms/refinements and arbitrary schema code cannot run in the shared runtime. `requiredFor` names existing tools whose invocation needs the value; unresolved settings must leave only dependent capabilities unavailable. Publisher compilation does not require a future buyer’s values. Application code enforces business rules server-side; exposing a control or placing the rule in a prompt is insufficient.',
+        '',
+        'For an installed application, use the same `noodle variables list|resolve|set|delete` family with `--installation <id> --org <org> --runtime cloud|other`; do not combine it with app/env/scope flags or secrets. Inspection shows schema metadata, provenance, readiness and revision without saved values. Set inputs are JSON (including quotes for strings), read the current projection and save atomically; `--expected-revision <digest>` pins an explicit prior inspection. Delete resets to the current declared default or unset state. Business-administrator permission is required for mutations, conflicts never retry writes, and mutation output excludes values.',
+        '',
         '## Embedded assistant',
         '',
         'To place the same server tools inside a SaaS web app, declare `assistant: embeddedAssistant(...)` alongside the one server-level brand kit. Read `embedded-assistant.md` before integrating: it owns the HTTPS-origin rule, managed model configuration, required deploy-before-client sequence, customer-backend exchange, browser mount, and verification checklist.',
@@ -257,8 +264,13 @@ export function renderAuthoringWorkflowReference() {
         '## Managed collections',
         '',
         'Use `managedCollection(name, { title, description, schemaVersion, record })` when an application needs reusable typed intent for business records that Noodle may later hold. Pass it through `server(..., { collections: [...] }, definitions)`. `record` is one bounded, closed Zod object; names use lowercase letters, numbers, and underscores. Keep payment-card, credentials, passport/government identity, health, and biometric fields out of this surface.',
+        'Native record controls are independent: `management: { assignment: true }`, `{ notes: true }`, both, or neither. Status is an ordinary application field such as `progress: z.enum(["received", "reviewing", "handled"]).default("received")`; no framework transition graph exists. Declare `publicFields` explicitly (default empty), `editableFields` for authorized staff (default all schema properties), optional field labels/help, `summaryFields`, `filterFields` and `sortFields`. References must name actual fields and filters/sorts select scalars. Public callers cannot set staff-only fields; a required private field needs a valid creation default. Staff updates merge only admitted fields and revalidate the complete record. See the notes-only `acme-bistro` collection.',
+        'Operator record queries use `noodle solutions records list --filters \'[{"field":"progress","value":"received"}]\' --sort-field progress`. Only declared scalar equality/sort fields apply. Payload queries scan at most 10,000 candidates; narrow `--created-at-from`/`--created-at-to` if the API returns `query_limit_exceeded`. Ordinary listing/export has no such scan cap. Cursor reuse requires unchanged query/schema and anchor revision. An administrator can explicitly migrate an eligible historical request with `records migrate-schema ... --expected-revision N`; never implement read-time rewrites.',
+        '',
+        'Omitting `source` makes Noodle authoritative for the collection. To project a read-only collection from an outside system, bind an HTTP connector in `server(..., { use: [...] })` and add `source: { connector: connector.ref(), scan: "scan_operation" }`. The compiler requires the exact normalized scan contract and the same record schema. Noodle ingests a one-way replica; create, update, and delete in the outside system remain ordinary application tools with their own confirmation and policy.',
         '',
-        'This declaration compiles schema metadata only. It does not create a submit tool, grant access, select retention or residency, provision storage, or make records available to MCP or the embedded assistant. Operators bind lifecycle and authority separately. Until the service intake path is shipped, keep live business operations on their existing connector tools.',
+        'For an explicitly authored native operation, bind `use: { records: noodlePlatform.records.v1 }` and call `connectors.records.submitRecord({ collection: "guest_requests", payload: input })` from an ordinary confirmed tool. Submission accepts only public fields and returns a receipt. `createRecord`, `getRecord`, `listRecords`, `updateRecord`, and `deleteRecord` require a verified platform caller with a live business grant; updates/deletes require the current revision. `updateRecord({ collection, id, expectedRevision, patch, unset: ["optional_field"] })` removes named optional editable fields; omitted keys stay unchanged, `null` is data, and overlap with `patch`, required fields or undeclared fields is rejected. Runtime identity supplies write idempotency and admission; never accept those controls as model arguments. An uninstalled collection is unavailable, including during local tool execution.',
+        'A collection declaration does not create a submit tool, grant access, select retention or residency, provision storage, or expose records to MCP or an embedded assistant. Operators activate the definition and configure lifecycle, access, and any external binding. A connector does not become a collection unless the app explicitly supplies the source contract, and an external collection never becomes a writable mirror.',
         '',
         '## Boundaries',
         '',

package/node_modules/@noodle-borg/agent-kit/dist/skill-content.js

@@ -53,7 +53,7 @@ const SDK_NOTES = {
     resource: '`resource(name, { ... })` — an MCP resource.',
     prompt: '`prompt(name, { ... })` — an MCP prompt.',
     secret: '`secret("NAME")` — reference a managed secret (operated via `noodle secrets`).',
-    variable: '`variable("NAME")` — reference a managed variable (operated via `noodle variables`).',
+    variable: '`variable("NAME")` — reference managed configuration; add `{ schema, default?, portal?, requiredFor? }` and register in `server.variables` for typed business settings. Operate through `noodle variables` or authorized Portal settings.',
     customerAuth: '`customerAuth.oidc(...)`, `.federatedOidc(...)`, `.firebase(...)`, or `.microsoft(...)` — end-user/customer identity for `--access customers` deployments. A direct/federated issuer must publish direct RFC 8414 discovery, Dynamic Client Registration, authorization-code + refresh grants, PKCE `code_challenge_methods_supported: ["S256"]`, public-client `token_endpoint_auth_methods_supported: ["none"]`, and a public JWKS; verify it with `noodle auth doctor src/server.ts`. Firebase Web App fields are browser-visible configuration: use `variable(...)`, not `secret(...)`, and restrict the key in Firebase.',
     handoffSession: '`handoffSession(...)` — typed cross-host handoff session envelopes.',
     z: '`z` — Zod, for input/output schemas (compiles to JSON Schema 2020-12).',

package/node_modules/@noodle-borg/agent-kit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodle-borg/agent-kit",
-  "version": "0.99.1",
+  "version": "0.100.0",
   "license": "Apache-2.0",
   "type": "module",
   "engines": {

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-configuration.d.ts

@@ -3,6 +3,13 @@ import { type AssistantAppearanceOverride } from './assistant-appearance.js';
 import type { AssistantAppearanceSettingsStore } from './assistant-appearance-store.js';
 import { ASSISTANT_BROWSER_UI_FIELDS } from './assistant-browser-fields.js';
 import type { TenantRef } from './tenant-ref.js';
+type BusinessNoticeDisplay = {
+    readonly displayName: string;
+    readonly privacyUrl: string;
+    readonly supportUrl: string;
+};
+/** A current action must not silently use a different recipient from the session's visible notice. */
+export declare function assistantConfigurationHasBusinessNotice(configuration: AssistantAppearanceOverride | undefined, notice: BusinessNoticeDisplay): boolean;
 /**
  * What the browser is allowed to see.
  *
@@ -18,7 +25,7 @@ import type { TenantRef } from './tenant-ref.js';
  */
 export declare function assistantBrowserConfiguration(server: ArtifactServer, boundSurface?: 'public' | 'authenticated'): AssistantAppearanceOverride | undefined;
 /** Resolve environment operator state above the immutable deployment projection. */
-export declare function effectiveAssistantBrowserConfiguration(server: ArtifactServer, tenant: TenantRef, store: AssistantAppearanceSettingsStore | undefined, boundSurface?: 'public' | 'authenticated'): Promise<{
+export declare function effectiveAssistantBrowserConfiguration(server: ArtifactServer, tenant: TenantRef, store: AssistantAppearanceSettingsStore | undefined, boundSurface?: 'public' | 'authenticated', notice?: BusinessNoticeDisplay): Promise<{
     effective: AssistantAppearanceOverride | undefined;
     fallback: "halo";
     provenance: import("./assistant-appearance.js").AssistantAppearanceProvenance;
@@ -28,4 +35,5 @@ export declare function effectiveAssistantBrowserConfiguration(server: ArtifactS
     } | undefined;
     record: import("./assistant-appearance-store.js").AssistantAppearanceSettingsRecord | undefined;
 }>;
+export {};
 //# sourceMappingURL=assistant-configuration.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-configuration.js

@@ -1,5 +1,14 @@
 import { resolveAssistantAppearanceConfiguration, } from './assistant-appearance.js';
 import { ASSISTANT_BROWSER_UI_FIELDS } from './assistant-browser-fields.js';
+const noticeText = (notice) => `Information is shared with ${notice.displayName}. Support: ${notice.supportUrl}`;
+/** A current action must not silently use a different recipient from the session's visible notice. */
+export function assistantConfigurationHasBusinessNotice(configuration, notice) {
+    const text = noticeText(notice);
+    const welcome = configuration?.assistant?.labels?.welcomeMessage;
+    return (configuration?.branding?.name === notice.displayName &&
+        configuration?.assistant?.privacyUrl === notice.privacyUrl &&
+        (welcome === text || welcome?.startsWith(`${text}\n\n`) === true));
+}
 /**
  * What the browser is allowed to see.
  *
@@ -45,13 +54,35 @@ function surfaceOfMode(assistant, mode) {
     return assistant.surfaces.find((surface) => surface.mode === mode || (mode === 'public' && surface.mode === 'mixed'));
 }
 /** Resolve environment operator state above the immutable deployment projection. */
-export async function effectiveAssistantBrowserConfiguration(server, tenant, store, boundSurface) {
+export async function effectiveAssistantBrowserConfiguration(server, tenant, store, boundSurface, notice) {
     const developer = assistantBrowserConfiguration(server, boundSurface);
     const record = await store?.get(tenant);
+    const resolved = resolveAssistantAppearanceConfiguration(developer, record?.override);
+    // Receiving-business authority is separate from optional appearance; use fields old widgets render.
+    const requiredNotice = notice && noticeText(notice);
+    const originalWelcome = resolved.effective?.assistant?.labels?.welcomeMessage;
+    const welcome = requiredNotice &&
+        requiredNotice +
+            (originalWelcome
+                ? `\n\n${originalWelcome}`.slice(0, Math.max(0, 1000 - requiredNotice.length))
+                : '');
     return {
         developer,
         record,
-        ...resolveAssistantAppearanceConfiguration(developer, record?.override),
+        ...resolved,
+        ...(notice
+            ? {
+                effective: {
+                    ...resolved.effective,
+                    branding: { ...resolved.effective?.branding, name: notice.displayName },
+                    assistant: {
+                        ...resolved.effective?.assistant,
+                        privacyUrl: notice.privacyUrl,
+                        labels: { ...resolved.effective?.assistant?.labels, welcomeMessage: welcome ?? '' },
+                    },
+                },
+            }
+            : {}),
     };
 }
 //# sourceMappingURL=assistant-configuration.js.map

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-execution-bound.d.ts

@@ -0,0 +1,3 @@
+/** Enforce the same accepted-flow bound used by durable unknown-outcome cleanup. */
+export declare function boundedAssistantExecution<T>(work: (signal: AbortSignal) => Promise<T>, unknown: () => T, timeoutMs?: number): Promise<T>;
+//# sourceMappingURL=assistant-execution-bound.d.ts.map

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-execution-bound.js

@@ -0,0 +1,29 @@
+import { ASSISTANT_INTERACTION_EXECUTION_LIMIT_MS } from './assistant-interaction-state.js';
+/** Enforce the same accepted-flow bound used by durable unknown-outcome cleanup. */
+export async function boundedAssistantExecution(work, unknown, timeoutMs = ASSISTANT_INTERACTION_EXECUTION_LIMIT_MS) {
+    if (!Number.isInteger(timeoutMs) ||
+        timeoutMs < 1 ||
+        timeoutMs > ASSISTANT_INTERACTION_EXECUTION_LIMIT_MS)
+        throw new Error('Invalid assistant execution bound');
+    const controller = new AbortController();
+    let timer;
+    try {
+        return await Promise.race([
+            Promise.resolve().then(() => work(controller.signal)),
+            new Promise((resolve) => {
+                timer = setTimeout(() => {
+                    controller.abort(new DOMException('Assistant execution deadline elapsed', 'TimeoutError'));
+                    resolve(unknown());
+                }, timeoutMs);
+            }),
+        ]);
+    }
+    catch {
+        return unknown();
+    }
+    finally {
+        clearTimeout(timer);
+        controller.abort();
+    }
+}
+//# sourceMappingURL=assistant-execution-bound.js.map

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-interaction-state.d.ts

@@ -1,8 +1,8 @@
 import type { InvocationContext } from '@noodle-borg/runtime';
 export declare const DEFAULT_MAX_PENDING_INTERACTIONS_PER_SESSION = 8;
 export declare const ASSISTANT_INTERACTION_OUTCOME_RETENTION_MS: number;
-/** Recovery grace for an in-flight action before its outcome becomes unknowable and payload is scrubbed. */
-export declare const ASSISTANT_INTERACTION_EXECUTING_GRACE_MS: number;
+/** Enforced maximum for one accepted flow; individual connector actions keep their shorter bounds. */
+export declare const ASSISTANT_INTERACTION_EXECUTION_LIMIT_MS = 120000;
 export type AssistantInteractionKind = 'confirmation' | 'input';
 export type AssistantInteractionStatus = 'pending' | 'executing' | 'succeeded' | 'failed' | 'declined' | 'cancelled';
 export type AssistantInteractionPublicScalar = string | number | boolean | null;
@@ -27,7 +27,7 @@ interface AssistantInteractionCommon {
     readonly deploymentId: string;
     /** Immutable proposal-time snapshot reused when the interaction resumes. */
     readonly context?: InvocationContext;
-    /** Set when a terminal interaction's exact private payload has been removed. */
+    /** Set when an interaction's exact private payload has left durable custody. */
     readonly payloadScrubbedAt?: string;
     readonly createdAt: string;
     readonly expiresAt: string;
@@ -175,6 +175,8 @@ export declare function isPrunableInteraction(interaction: AssistantInteractionR
 export declare function shouldExpireStrandedExecutingInteraction(interaction: AssistantInteractionRecord, now: Date): interaction is AssistantInteractionRecord & AssistantExecutingInteractionState;
 /** Preserve a non-retryable unknown outcome without retaining its exact private payload. */
 export declare function expireStrandedExecutingInteraction(interaction: AssistantInteractionRecord & AssistantExecutingInteractionState, scrubbedAt: Date): AssistantInteractionRecord & AssistantFailedInteractionState;
+/** Exact inputs leave durable custody when handed to the single executor, before connector I/O. */
+export declare function scrubExecutingInteraction(interaction: AssistantInteractionRecord & AssistantExecutingInteractionState): AssistantInteractionRecord & AssistantExecutingInteractionState;
 export declare function cloneInteraction<T extends AssistantInteractionRecord>(interaction: T): T;
 export declare function normalizePublicOutcome(input: AssistantInteractionPublicOutcome): AssistantInteractionPublicOutcome;
 export {};

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-interaction-state.js

@@ -1,8 +1,8 @@
 import { isCredentialShapedAssistantText } from './assistant-sensitive-values.js';
 export const DEFAULT_MAX_PENDING_INTERACTIONS_PER_SESSION = 8;
 export const ASSISTANT_INTERACTION_OUTCOME_RETENTION_MS = 24 * 60 * 60 * 1000;
-/** Recovery grace for an in-flight action before its outcome becomes unknowable and payload is scrubbed. */
-export const ASSISTANT_INTERACTION_EXECUTING_GRACE_MS = 60 * 60 * 1000;
+/** Enforced maximum for one accepted flow; individual connector actions keep their shorter bounds. */
+export const ASSISTANT_INTERACTION_EXECUTION_LIMIT_MS = 120_000;
 export const ASSISTANT_INTERACTION_UNKNOWN_OUTCOME = {
     code: 'interaction_outcome_unknown',
     summary: 'The action may have completed, but its outcome could not be verified.',
@@ -125,8 +125,7 @@ export function isPrunableInteraction(interaction, now) {
 }
 export function shouldExpireStrandedExecutingInteraction(interaction, now) {
     return (interaction.status === 'executing' &&
-        interaction.payloadScrubbedAt === undefined &&
-        Date.parse(interaction.claimedAt) + ASSISTANT_INTERACTION_EXECUTING_GRACE_MS <= now.getTime());
+        Date.parse(interaction.claimedAt) + ASSISTANT_INTERACTION_EXECUTION_LIMIT_MS <= now.getTime());
 }
 /** Preserve a non-retryable unknown outcome without retaining its exact private payload. */
 export function expireStrandedExecutingInteraction(interaction, scrubbedAt) {
@@ -138,21 +137,33 @@ export function expireStrandedExecutingInteraction(interaction, scrubbedAt) {
         publicOutcome: ASSISTANT_INTERACTION_UNKNOWN_OUTCOME,
     });
 }
-/** Retain only replay-safe public state once no execution path needs the exact payload. */
+/** Exact inputs leave durable custody when handed to the single executor, before connector I/O. */
+export function scrubExecutingInteraction(interaction) {
+    const scrubbed = scrubInteractionPayload(interaction, interaction.claimedAt);
+    if (scrubbed.status !== 'executing')
+        throw new Error('interaction status changed during scrub');
+    return scrubbed;
+}
 function scrubTerminalInteraction(interaction) {
+    const scrubbed = scrubInteractionPayload(interaction, interaction.completedAt);
+    if (!isTerminalInteraction(scrubbed))
+        throw new Error('interaction status changed during scrub');
+    return scrubbed;
+}
+function scrubInteractionPayload(interaction, instant) {
     if (interaction.kind === 'confirmation') {
-        const { context: _context, payloadScrubbedAt: _payloadScrubbedAt, continuation: _continuation, review: _review, ...withoutPrivatePayload } = interaction;
+        const { context: _context, continuation: _continuation, review: _review, ...withoutPrivate } = interaction;
         return cloneInteraction({
-            ...withoutPrivatePayload,
+            ...withoutPrivate,
             arguments: null,
-            payloadScrubbedAt: interaction.completedAt,
+            payloadScrubbedAt: instant,
         });
     }
-    const { context: _context, payloadScrubbedAt: _payloadScrubbedAt, ...withoutContext } = interaction;
+    const { context: _context, ...withoutContext } = interaction;
     return cloneInteraction({
         ...withoutContext,
         continuation: null,
-        payloadScrubbedAt: interaction.completedAt,
+        payloadScrubbedAt: instant,
     });
 }
 export function cloneInteraction(interaction) {

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-store.d.ts

@@ -6,7 +6,7 @@ import type { AssistantCustomerRouting } from './assistant-customer-routing.js';
 import { type AssistantInteractionClaimResult, type AssistantInteractionCompletionResult, type AssistantInteractionCreateInput, type AssistantInteractionRecord, type AssistantInteractionScope, type AssistantInteractionTransitionInput, type AssistantInteractionTransitionResult, type AssistantPendingConfirmationInteractionRecord, type AssistantPendingInputInteractionRecord, type AssistantPendingInteractionRecord } from './assistant-interaction-state.js';
 import type { AssistantRecoverableView } from './assistant-view-availability.js';
 import type { TenantRef } from './tenant-ref.js';
-export { ASSISTANT_INTERACTION_EXECUTING_GRACE_MS, ASSISTANT_INTERACTION_OUTCOME_RETENTION_MS, type AssistantConfirmationInteractionRecord, AssistantInteractionCapacityError, type AssistantInteractionClaimResult, type AssistantInteractionCompletion, type AssistantInteractionCompletionResult, type AssistantInteractionCreateInput, type AssistantInteractionKind, type AssistantInteractionPublicArray, type AssistantInteractionPublicObject, type AssistantInteractionPublicOutcome, type AssistantInteractionPublicValue, type AssistantInteractionRecord, type AssistantInteractionScope, type AssistantInteractionStatus, type AssistantInteractionTransitionInput, type AssistantInteractionTransitionNext, type AssistantInteractionTransitionResult, type AssistantPendingConfirmationInteractionRecord, type AssistantPendingInputInteractionRecord, type AssistantPendingInteractionRecord, DEFAULT_MAX_PENDING_INTERACTIONS_PER_SESSION, } from './assistant-interaction-state.js';
+export { ASSISTANT_INTERACTION_EXECUTION_LIMIT_MS, ASSISTANT_INTERACTION_OUTCOME_RETENTION_MS, type AssistantConfirmationInteractionRecord, AssistantInteractionCapacityError, type AssistantInteractionClaimResult, type AssistantInteractionCompletion, type AssistantInteractionCompletionResult, type AssistantInteractionCreateInput, type AssistantInteractionKind, type AssistantInteractionPublicArray, type AssistantInteractionPublicObject, type AssistantInteractionPublicOutcome, type AssistantInteractionPublicValue, type AssistantInteractionRecord, type AssistantInteractionScope, type AssistantInteractionStatus, type AssistantInteractionTransitionInput, type AssistantInteractionTransitionNext, type AssistantInteractionTransitionResult, type AssistantPendingConfirmationInteractionRecord, type AssistantPendingInputInteractionRecord, type AssistantPendingInteractionRecord, DEFAULT_MAX_PENDING_INTERACTIONS_PER_SESSION, } from './assistant-interaction-state.js';
 export declare const ASSISTANT_SESSION_IDLE_MS: number;
 export { ASSISTANT_BROWSER_UI_FIELDS } from './assistant-browser-fields.js';
 export interface AssistantClientRecord {

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-store.js

@@ -1,7 +1,7 @@
 import { createHash, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
 import { ADMISSION_DEFAULTS } from '@noodle-borg/admission-limits/portable';
-import { AssistantInteractionCapacityError, cloneInteraction, completedInteraction, createPendingInteraction, DEFAULT_MAX_PENDING_INTERACTIONS_PER_SESSION, executingInteraction, expireStrandedExecutingInteraction, isPrunableInteraction, isTerminalInteraction, shouldExpireStrandedExecutingInteraction, transitionedInteractions, } from './assistant-interaction-state.js';
-export { ASSISTANT_INTERACTION_EXECUTING_GRACE_MS, ASSISTANT_INTERACTION_OUTCOME_RETENTION_MS, AssistantInteractionCapacityError, DEFAULT_MAX_PENDING_INTERACTIONS_PER_SESSION, } from './assistant-interaction-state.js';
+import { AssistantInteractionCapacityError, cloneInteraction, completedInteraction, createPendingInteraction, DEFAULT_MAX_PENDING_INTERACTIONS_PER_SESSION, executingInteraction, expireStrandedExecutingInteraction, isPrunableInteraction, isTerminalInteraction, scrubExecutingInteraction, shouldExpireStrandedExecutingInteraction, transitionedInteractions, } from './assistant-interaction-state.js';
+export { ASSISTANT_INTERACTION_EXECUTION_LIMIT_MS, ASSISTANT_INTERACTION_OUTCOME_RETENTION_MS, AssistantInteractionCapacityError, DEFAULT_MAX_PENDING_INTERACTIONS_PER_SESSION, } from './assistant-interaction-state.js';
 export const ASSISTANT_SESSION_IDLE_MS = 30 * 60 * 1000;
 export { ASSISTANT_BROWSER_UI_FIELDS } from './assistant-browser-fields.js';
 /** Latest prompt messages retained for model continuity; turn admission is tracked separately. */
@@ -346,7 +346,7 @@ export class InMemoryAssistantStore {
             return { disposition: 'replay', interaction: cloneInteraction(current) };
         }
         const claimed = executingInteraction(current, input.now);
-        this.#interactions.set(claimed.id, claimed);
+        this.#interactions.set(claimed.id, scrubExecutingInteraction(claimed));
         return { disposition: 'claimed', interaction: cloneInteraction(claimed) };
     }
     #scopedInteraction(input) {

package/node_modules/@noodle-borg/assistant-gateway/dist/portable.d.ts

@@ -8,6 +8,7 @@ export * from './assistant-context.js';
 export * from './assistant-customer-issuer.js';
 export * from './assistant-customer-routing.js';
 export * from './assistant-delegated-projection.js';
+export * from './assistant-execution-bound.js';
 export * from './assistant-guide.js';
 export * from './assistant-interaction-state.js';
 export * from './assistant-interactive.js';

package/node_modules/@noodle-borg/assistant-gateway/dist/portable.js

@@ -8,6 +8,7 @@ export * from './assistant-context.js';
 export * from './assistant-customer-issuer.js';
 export * from './assistant-customer-routing.js';
 export * from './assistant-delegated-projection.js';
+export * from './assistant-execution-bound.js';
 export * from './assistant-guide.js';
 export * from './assistant-interaction-state.js';
 export * from './assistant-interactive.js';

package/node_modules/@noodle-borg/assistant-gateway/dist/session-target.js

@@ -6,8 +6,9 @@ export async function resolveAssistantSessionTarget(load, session) {
         return undefined;
     const assistant = target.served.artifact.server.assistant;
     const bound = session.boundSurface ?? deriveLegacyBinding(assistant, session);
-    if (bound === 'pre-surfaces')
-        return target;
+    if (bound === 'pre-surfaces') {
+        return assistant?.allowedOrigins.includes(session.origin) ? target : undefined;
+    }
     // Fail closed: an origin no surface owns must never widen to the whole server.
     if (bound === 'unowned')
         return undefined;
@@ -15,7 +16,7 @@ export async function resolveAssistantSessionTarget(load, session) {
     // session's reach, never hand it the unprojected server.
     if (bound === 'authenticated') {
         const surface = authenticatedSurfaceOf(assistant);
-        if (surface === undefined)
+        if (surface === undefined || !surface.origins.includes(session.origin))
             return undefined;
         // An omitted allowlist on an authenticated surface is the authored whole-server intent, so the
         // exact binding still holds (instructions, budgets, attribution) without narrowing capabilities.
@@ -24,7 +25,7 @@ export async function resolveAssistantSessionTarget(load, session) {
         return projected(target, surface.capabilities);
     }
     const surface = publicSurfaceOf(assistant);
-    if (surface === undefined)
+    if (surface === undefined || !surface.origins.includes(session.origin))
         return undefined;
     return projected(target, surface.capabilities);
 }

package/node_modules/@noodle-borg/authoring/dist/config.d.ts

@@ -7,10 +7,30 @@ export interface ConfigRef {
     toExpression(): string;
     toString(): string;
 }
+export interface VariableOptions<Schema extends z.ZodType> {
+    readonly schema: Schema;
+    readonly default?: z.output<Schema>;
+    readonly portal?: {
+        readonly label: string;
+        readonly help?: string;
+        readonly group?: string;
+    };
+    readonly requiredFor?: readonly string[];
+}
+export interface DeclaredVariableRef extends ConfigRef {
+    readonly kind: 'variable';
+    readonly declaration: VariableDeclarationManifest;
+}
 export declare function variable(name: string): ConfigRef;
+export declare function variable<Schema extends z.ZodType>(name: string, options: VariableOptions<Schema>): DeclaredVariableRef;
+export declare function manifestVariables(refs: readonly DeclaredVariableRef[] | undefined): {
+    variables?: VariableDeclarationManifest[];
+};
 export declare function secret(name: string): ConfigRef;
 export declare function isConfigRef(value: unknown): value is ConfigRef;
 export declare function serializeVariableRef(ref: ConfigRef, path: string): string;
 export declare function serializeSecretRef(ref: ConfigRef, path: string): string;
+import { type VariableDeclarationManifest } from '@noodle-borg/compiler';
+import type { z } from 'zod';
 export {};
 //# sourceMappingURL=config.d.ts.map

package/node_modules/@noodle-borg/authoring/dist/config.js

@@ -1,7 +1,32 @@
 const CONFIG_REF = Symbol.for('noodle.authoring.configRef');
 const CONFIG_REF_NAME = /^[A-Za-z0-9_]+$/;
-export function variable(name) {
-    return makeConfigRef('variable', name);
+export function variable(name, options) {
+    const ref = makeConfigRef('variable', name);
+    if (options === undefined)
+        return ref;
+    const declaration = {
+        name,
+        schemaVersion: 1,
+        valueSchema: toJsonSchema(options.schema, 'output', true),
+        ...(Object.hasOwn(options, 'default') ? { default: options.default } : {}),
+        ...(options.portal === undefined ? {} : { portal: { ...options.portal } }),
+        requiredFor: [...new Set(options.requiredFor ?? [])].sort(),
+    };
+    const errors = validateVariableDeclaration(declaration);
+    if (errors.length > 0)
+        throw new Error(`variable("${name}") ${errors.map((error) => `${error.path}: ${error.message}`).join('; ')}`);
+    return { ...ref, kind: 'variable', declaration: structuredClone(declaration) };
+}
+export function manifestVariables(refs) {
+    if (refs === undefined || refs.length === 0)
+        return {};
+    return {
+        variables: refs.map((ref) => {
+            if (!isConfigRef(ref) || ref.kind !== 'variable' || ref.declaration === undefined)
+                throw new Error('server.variables requires typed variable declarations');
+            return structuredClone(ref.declaration);
+        }),
+    };
 }
 export function secret(name) {
     return makeConfigRef('secret', name);
@@ -40,4 +65,6 @@ function makeConfigRef(kind, name) {
         },
     };
 }
+import { validateVariableDeclaration, } from '@noodle-borg/compiler';
+import { toJsonSchema } from './json-schema.js';
 //# sourceMappingURL=config.js.map

package/node_modules/@noodle-borg/authoring/dist/connectors.d.ts

@@ -77,7 +77,12 @@ type HttpOperationOptionsWithRefs = Omit<HttpConnectorDef['operations'][string],
     readonly input?: OperationIoOptions;
     readonly output?: OperationIoOptions;
 };
-export type HttpConnectorOptions = Omit<HttpConnectorDef['http'], 'baseUrl' | 'allowedOrigins' | 'auth'> & {
+export type HttpConnectorOptions = Omit<HttpConnectorDef['http'], 'baseUrl' | 'allowedOrigins' | 'auth' | 'transportAuth'> & {
+    readonly transportAuth?: {
+        readonly kind: 'apiKey';
+        readonly header: string;
+        readonly secret: string | ConfigRef;
+    };
     readonly baseUrl: string | ConfigRef | CustomerEndpointRef;
     /** Exact literal or operator-managed origins that may receive connector requests. */
     readonly allowedOrigins?: readonly (string | ConfigRef)[];

package/node_modules/@noodle-borg/authoring/dist/connectors.js

@@ -241,6 +241,11 @@ function normalizeHttpOptions(id, options) {
         ...(options.auth !== undefined
             ? { auth: normalizeAuth(options.auth, `connectors.${id}.http.auth`) }
             : {}),
+        ...(options.transportAuth === undefined
+            ? {}
+            : {
+                transportAuth: normalizeAuth(options.transportAuth, `connectors.${id}.http.transportAuth`),
+            }),
         operations,
     };
     return normalized;

package/node_modules/@noodle-borg/authoring/dist/index.d.ts

@@ -3,7 +3,7 @@ import { z } from 'zod';
 export type { PackagedAssetReference } from '@noodle-borg/compiler';
 export type { AgentCapabilityKind, AgentCapabilityRef, AgentExampleSource, AgentGuideSource, AgentWorkflowSource, AgentWorkflowStepSource, } from './agent-guide.js';
 export { type AssistantAccess, type AssistantCapability, type AssistantLabels, type AssistantLayoutMode, type AssistantModel, type AssistantPosition, type AssistantPresentationOptions, type AssistantPresentationTone, type AssistantSurfaceConfig, type AssistantSurfaceMode, type AssistantThemeMode, type AssistantUiOptions, type AuthenticatedWebsiteAccess, type AuthenticatedWebsiteInput, authenticatedWebsite, type CapabilityRef, type EmbeddedAssistantConfig, type EmbeddedAssistantOptions, embeddedAssistant, type NoodleManagedModel, noodleManaged, type OpenAICompatibleModel, type OpenAICompatibleModelInput, type OpenAICompatibleTransport, openAICompatible, type PublicWebsiteAccess, type PublicWebsiteInput, publicWebsite, } from './assistant.js';
-export { type ConfigRef, type ConfigRefKind, secret, variable, } from './config.js';
+export { type ConfigRef, type ConfigRefKind, type DeclaredVariableRef, secret, type VariableOptions, variable, } from './config.js';
 export { type BoundConnectorRef, bind, type ConnectionBinding, type ConnectionRef, type ConnectionSource, clientCredentials, connection, externalExchange, type GoogleWorkloadIdentityAccess, googleWorkloadIdentity, managedSecret, } from './connections.js';
 export { type ComputeHost, type ComputeLimits, type ComputeOperationOptions, ConnectorBuilder, type ConnectorCatalogDoc, type ConnectorOpDefinition, type ConnectorOperationOptions, type ConnectorRef, connector, type HttpConnectorOptions, type McpAuthOptions, type McpConnectorOptions, } from './connectors.js';
 export type { AmbientContextOptions, AmbientProviderContext, ServerContextOptions, } from './context.js';
@@ -13,7 +13,7 @@ export type { DistributionImageSource, DistributionMetadataSource, DistributionM
 export { gmailConnector } from './gmail.js';
 export { type HandoffPurpose, type HandoffSession, type HandoffStateHandleLink, handoffSession, } from './handoff.js';
 export { algolia, file, firecrawl, type KnowledgeCrawlerDeclaration, type KnowledgeIndexDeclaration, type KnowledgeInput, knowledge, meilisearch, site, tavily, } from './knowledge.js';
-export { type ManagedCollectionDeclaration, type ManagedCollectionInput, managedCollection, } from './managed-collection.js';
+export { type ManagedCollectionDeclaration, type ManagedCollectionInput, type ManagedCollectionSource, managedCollection, } from './managed-collection.js';
 export { noodlePlatform, noodlePlatformCatalog } from './platform.js';
 export { type Cond, type ConnectorClient, type Ref, type SymbolicScope, when, } from './recording.js';
 export { annotations, asset, type BrandThemeTokens, type ElicitationOptions, isServerDefinition, type PromptArgument, type PromptOptions, prompt, type ResourceContext, type ResourceFulfilResult, type ResourceOptions, resource, type ServerComponent, type ServerDefinition, type ServerOptions, server, type ToolAuthorizationOptions, type ToolContext, type ToolOptions, type ToolViewOptions, tool, type WidgetCsp, type WidgetPermissionGrant, type WidgetPermissions, widgetResult, } from './server.js';

package/node_modules/@noodle-borg/authoring/dist/json-schema.d.ts

@@ -15,5 +15,5 @@ export type JsonSchema = Record<string, unknown>;
  * `.default()` as optional. Zod only forces `additionalProperties:false` under `io:'output'`, so for
  * `io:'input'` we re-assert it on every emitted object node to keep input objects closed.
  */
-export declare function toJsonSchema(schema: JsonSchema | z.ZodType, io?: 'input' | 'output'): JsonSchema;
+export declare function toJsonSchema(schema: JsonSchema | z.ZodType, io?: 'input' | 'output', rejectRuntimeChecks?: boolean): JsonSchema;
 //# sourceMappingURL=json-schema.d.ts.map

package/node_modules/@noodle-borg/authoring/dist/json-schema.js

@@ -13,9 +13,22 @@ import { z } from 'zod';
  * `.default()` as optional. Zod only forces `additionalProperties:false` under `io:'output'`, so for
  * `io:'input'` we re-assert it on every emitted object node to keep input objects closed.
  */
-export function toJsonSchema(schema, io = 'output') {
+export function toJsonSchema(schema, io = 'output', rejectRuntimeChecks = false) {
     if (schema instanceof z.ZodType) {
-        const json = z.toJSONSchema(schema, { target: 'draft-2020-12', io });
+        const json = z.toJSONSchema(schema, {
+            target: 'draft-2020-12',
+            io,
+            ...(rejectRuntimeChecks
+                ? {
+                    override: ({ zodSchema }) => {
+                        const definition = zodSchema._zod.def;
+                        if (definition.checks?.some((check) => ['custom', 'overwrite'].includes(check._zod.def.check))) {
+                            throw new Error('business variable schemas cannot contain runtime refinements or transforms');
+                        }
+                    },
+                }
+                : {}),
+        });
         if (io === 'input')
             closeObjectSchemas(json);
         return json;

package/node_modules/@noodle-borg/authoring/dist/load-authored.js

@@ -33,7 +33,7 @@ export function prepareAuthoringRuntimeDir(dir, options) {
             './react': './react.mjs',
         },
     }));
-    writeFileSync(join(self, 'index.mjs'), "export { algolia, annotations, asset, authenticatedWebsite, bind, clientCredentials, connector, connection, customerAuth, customerEndpoint, embeddedAssistant, externalExchange, file, firecrawl, gmailConnector, googleWorkloadIdentity, handoffSession, knowledge, managedCollection, managedSecret, meilisearch, noodleManaged, openAICompatible, prompt, publicWebsite, resource, secret, server, site, tavily, tool, variable, when, z } from '@noodle-borg/authoring';\n");
+    writeFileSync(join(self, 'index.mjs'), "export { algolia, annotations, asset, authenticatedWebsite, bind, clientCredentials, connector, connection, customerAuth, customerEndpoint, embeddedAssistant, externalExchange, file, firecrawl, gmailConnector, googleWorkloadIdentity, handoffSession, knowledge, managedCollection, managedSecret, meilisearch, noodleManaged, noodlePlatform, openAICompatible, prompt, publicWebsite, resource, secret, server, site, tavily, tool, variable, when, z } from '@noodle-borg/authoring';\n");
     writeFileSync(join(self, 'platform.mjs'), "export { noodlePlatform, noodlePlatformCatalog } from '@noodle-borg/authoring';\n");
     writeFileSync(join(self, 'react.mjs'), "export * from '@noodle-borg/authoring/react';\n");
 }

package/node_modules/@noodle-borg/authoring/dist/managed-collection.d.ts

@@ -1,26 +1,40 @@
+import { type ManagedCollectionControls, projectManagedCollectionControls } from '@noodle-borg/compiler';
 import type { z } from 'zod';
+import type { ConnectorRef } from './connectors.js';
 import { type JsonSchema } from './json-schema.js';
-export interface ManagedCollectionInput {
+export interface ManagedCollectionSource {
+    /** An existing connector from the enclosing server's `use` map. */
+    readonly connector: ConnectorRef;
+    /** Read operation implementing the normalized bounded scan contract. */
+    readonly scan: string;
+}
+export interface ManagedCollectionInput extends ManagedCollectionControls {
     readonly title: string;
     readonly description: string;
     readonly schemaVersion: number;
     readonly record: z.ZodType;
+    /** Omission makes Noodle Seed the authoritative native store. */
+    readonly source?: ManagedCollectionSource;
 }
 export interface ManagedCollectionDeclaration extends ManagedCollectionInput {
     readonly kind: 'managedCollection';
     readonly name: string;
 }
-export interface ManifestManagedCollection {
+export interface ManifestManagedCollection extends ReturnType<typeof projectManagedCollectionControls> {
     readonly name: string;
     readonly title: string;
     readonly description: string;
     readonly schemaVersion: number;
     readonly recordSchema: JsonSchema;
+    readonly source?: {
+        readonly connector: string;
+        readonly scan: string;
+    };
 }
 /** Declare one typed collection whose lifecycle is bound later by an authorized operator. */
 export declare function managedCollection(name: string, input: ManagedCollectionInput): ManagedCollectionDeclaration;
-export declare function manifestManagedCollection(declaration: ManagedCollectionDeclaration): ManifestManagedCollection;
-export declare function manifestCollections(declarations: readonly ManagedCollectionDeclaration[] | undefined): {
+export declare function manifestManagedCollection(declaration: ManagedCollectionDeclaration, connectors: Readonly<Record<string, ConnectorRef>>): ManifestManagedCollection;
+export declare function manifestCollections(declarations: readonly ManagedCollectionDeclaration[] | undefined, connectors: Readonly<Record<string, ConnectorRef>>): {
     readonly collections?: ManifestManagedCollection[];
 };
 //# sourceMappingURL=managed-collection.d.ts.map