@noodleseed/one 0.162.0 → 0.164.0

package/node_modules/@noodle-borg/runtime/dist/interactive.js

@@ -1,3 +1,4 @@
+import { resolveVariableEnvironment, validateVariableContinuation } from './business-variables.js';
 import { preflightFulfilmentCustomerRoutes } from './customer-routing.js';
 import { validateElicitationContent } from './elicitation-response.js';
 import { ExpressionEvalError, evaluateCondition } from './eval/evaluate.js';
@@ -13,6 +14,10 @@ export async function executeToolInteractive(artifact, toolName, input, deps) {
     const tool = artifact.tools.find((candidate) => candidate.name === toolName);
     if (!tool)
         return interactiveFail('unknown_tool', `no tool named "${toolName}"`);
+    const variables = resolveVariableEnvironment(artifact.server.variables ?? [], await resolveEnv(deps), toolName);
+    if (!variables.ok)
+        return { status: 'failed', error: variables.error };
+    deps = { ...deps, env: variables.env };
     if (tool.fulfilment.kind !== 'flow' || !tool.fulfilment.steps.some((s) => s.kind === 'elicit')) {
         return toInteractive(await runFulfilment(tool.fulfilment, input, toolName, deps, deps.beforeDispatch));
     }
@@ -32,6 +37,12 @@ export async function resumeTool(artifact, continuation, response, deps) {
     }
     if (response.action !== 'accept')
         return { status: 'stopped', action: response.action };
+    if ((artifact.server.variables?.length ?? 0) > 0) {
+        const variables = resolveVariableEnvironment(artifact.server.variables ?? [], await resolveEnv(deps), continuation.toolName);
+        const configurationError = validateVariableContinuation(artifact, continuation.env, variables);
+        if (configurationError)
+            return { status: 'failed', error: configurationError };
+    }
     const validated = validateElicitationContent(response.content ?? {}, continuation.pending.requestedSchema, `steps.${continuation.pending.id}`);
     if (!validated.ok)
         return { status: 'failed', error: validated.error };

package/node_modules/@noodle-borg/runtime/dist/managed-origins.d.ts

@@ -11,6 +11,8 @@ export type ManagedOriginResolutionResult = {
     readonly errors: readonly ManagedOriginError[];
 };
 /** Bind operator-owned exact origins into every runtime authority and host projection. */
-export declare function resolveManagedOrigins(artifact: RuntimeArtifact, variables: Readonly<Record<string, string>>): ManagedOriginResolutionResult;
+export declare function resolveManagedOrigins(artifact: RuntimeArtifact, variables: Readonly<Record<string, unknown>>, options?: {
+    readonly allowUnconfiguredPortal?: boolean;
+}): ManagedOriginResolutionResult;
 export {};
 //# sourceMappingURL=managed-origins.d.ts.map

package/node_modules/@noodle-borg/runtime/dist/managed-origins.js

@@ -1,9 +1,10 @@
+import { resolveVariableEnvironment } from './business-variables.js';
 const MANAGED_ORIGIN = /^\$\{env\.([A-Za-z0-9_]+)\}$/;
 /** Bind operator-owned exact origins into every runtime authority and host projection. */
-export function resolveManagedOrigins(artifact, variables) {
+export function resolveManagedOrigins(artifact, variables, options = {}) {
     const errors = [];
     const replacements = new Map();
-    const resolveList = (values, path, allowLoopback) => values.map((value, index) => resolveManagedOrigin(value, variables, `${path}.${index}`, allowLoopback, replacements, errors));
+    const resolveList = (values, path, allowLoopback) => values.flatMap((value, index) => resolveManagedOrigin(value, variables, `${path}.${index}`, allowLoopback, replacements, errors, artifact.server.variables?.find((declaration) => declaration.name === MANAGED_ORIGIN.exec(value)?.[1]), options.allowUnconfiguredPortal === true));
     const assistant = artifact.server.assistant;
     const resolvedAssistant = assistant === undefined
         ? undefined
@@ -26,6 +27,21 @@ export function resolveManagedOrigins(artifact, variables) {
             ...handoff,
             allowedDomains: resolveList(handoff.allowedDomains, 'handoff.allowedDomains', false),
         };
+    const owners = new Map();
+    resolvedAssistant?.surfaces?.forEach((surface, index) => {
+        for (const origin of surface.origins) {
+            const prior = owners.get(origin);
+            if (prior !== undefined && prior !== index)
+                errors.push({
+                    code: 'invalid_shape',
+                    path: `server.assistant.surfaces.${index}.origins`,
+                    variableName: '',
+                    reason: 'invalid',
+                    message: 'Assistant surfaces must have distinct configured origins.',
+                });
+            owners.set(origin, index);
+        }
+    });
     if (errors.length > 0)
         return { ok: false, errors };
     return {
@@ -45,12 +61,17 @@ export function resolveManagedOrigins(artifact, variables) {
         },
     };
 }
-function resolveManagedOrigin(value, variables, path, allowLoopback, replacements, errors) {
+function resolveManagedOrigin(value, variables, path, allowLoopback, replacements, errors, declaration, allowUnconfiguredPortal) {
     const match = MANAGED_ORIGIN.exec(value);
     if (match?.[1] === undefined)
         return value;
-    const resolved = variables[match[1]];
-    if (resolved === undefined) {
+    const decoded = declaration === undefined ? undefined : resolveVariableEnvironment([declaration], variables);
+    const resolved = decoded?.ok ? decoded.env[match[1]] : variables[match[1]];
+    if (resolved === undefined && decoded?.ok !== false) {
+        if (allowUnconfiguredPortal && declaration?.portal !== undefined) {
+            replacements.set(value, '');
+            return [];
+        }
         errors.push({
             code: 'invalid_shape',
             variableName: match[1],
@@ -60,7 +81,9 @@ function resolveManagedOrigin(value, variables, path, allowLoopback, replacement
         });
         return value;
     }
-    if (!isCanonicalOrigin(resolved, allowLoopback)) {
+    if (decoded?.ok === false ||
+        typeof resolved !== 'string' ||
+        !isCanonicalOrigin(resolved, allowLoopback)) {
         errors.push({
             code: 'invalid_shape',
             variableName: match[1],
@@ -94,7 +117,9 @@ function replaceValue(value, replacements) {
     if (typeof value === 'string')
         return replaceStrings(value, replacements);
     if (Array.isArray(value))
-        return value.map((item) => replaceValue(item, replacements));
+        return value.flatMap((item) => typeof item === 'string' && replacements.get(item) === ''
+            ? []
+            : [replaceValue(item, replacements)]);
     if (value !== null && typeof value === 'object') {
         return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, replaceValue(item, replacements)]));
     }

package/node_modules/@noodle-borg/runtime/dist/operation-credential.js

@@ -7,6 +7,12 @@ export async function acquireOperationCredential(ref, deps, customerRoute) {
             connectorVersion: ref.connectorVersion,
             operation: ref.operation,
             ...(ref.credentialBinding ?? {}),
+            ...(ref.credentialBinding?.connectionId === undefined ||
+                deps.executionBinding?.connections[ref.credentialBinding.connectionId] === undefined
+                ? {}
+                : {
+                    expectedConnectionGeneration: deps.executionBinding.connections[ref.credentialBinding.connectionId],
+                }),
             ...(deps.tenantId !== undefined ? { tenantId: deps.tenantId } : {}),
             ...(deps.deploymentId !== undefined ? { deploymentId: deps.deploymentId } : {}),
             ...(deps.caller !== undefined ? { caller: deps.caller } : {}),

package/node_modules/@noodle-borg/runtime/dist/operation-evidence.d.ts

@@ -0,0 +1,30 @@
+import type { ResolvedOperationRef } from '@noodle-borg/compiler';
+import type { CallerIdentity } from './connector/types.js';
+import type { ExecutionResult } from './result.js';
+/** Explicit connector evidence. A returned tool result alone does not prove a business task completed. */
+export interface OperationEvidence {
+    readonly outcome: 'completed' | 'rejected' | 'accepted' | 'unknown' | 'returned';
+    /** Opaque provider resource/job reference; protected by the service, never an authorization grant. */
+    readonly reference?: string;
+}
+export interface OperationEvidenceIntent {
+    readonly id: string;
+    readonly tool: string;
+    readonly operation: ResolvedOperationRef;
+    readonly arguments: Readonly<Record<string, unknown>>;
+    readonly executionRevision?: string;
+    readonly executionBoundMs?: number;
+    readonly caller?: CallerIdentity;
+}
+/** Hosting-owned durable intent/evidence authority. No provider transport or business-record custody. */
+export interface OperationEvidencePort {
+    /** Atomically claims an original invocation before I/O; undefined means it was already spent. */
+    begin(intent: OperationEvidenceIntent): Promise<{
+        finish(evidence: OperationEvidence): Promise<void>;
+    } | undefined>;
+}
+/** Shared by every connector action, including nested calls; persistence failure cannot enable I/O. */
+export declare function withOperationEvidence(port: OperationEvidencePort | undefined, intent: OperationEvidenceIntent, work: (report: (evidence: OperationEvidence) => void) => Promise<ExecutionResult>): Promise<ExecutionResult>;
+/** Invalid or credential-like reference mappings never become success evidence or retained payloads. */
+export declare function safeOperationEvidence(value: OperationEvidence): OperationEvidence;
+//# sourceMappingURL=operation-evidence.d.ts.map

package/node_modules/@noodle-borg/runtime/dist/operation-evidence.js

@@ -0,0 +1,68 @@
+/** Shared by every connector action, including nested calls; persistence failure cannot enable I/O. */
+export async function withOperationEvidence(port, intent, work) {
+    let claimed;
+    try {
+        claimed = await port?.begin(intent);
+    }
+    catch {
+        return {
+            ok: false,
+            error: {
+                code: 'execution_admission_error',
+                message: 'Operation evidence unavailable; no action dispatched.',
+            },
+        };
+    }
+    if (port && !claimed)
+        return {
+            ok: false,
+            error: {
+                code: 'duplicate_execution_suppressed',
+                message: 'This operation was already dispatched. Verify its original outcome before making a new request.',
+            },
+        };
+    let evidence;
+    let result;
+    try {
+        result = await work((value) => {
+            evidence = safeOperationEvidence(value);
+        });
+    }
+    catch {
+        result = {
+            ok: false,
+            error: {
+                code: 'connector_error',
+                reason: 'operation_outcome_unknown',
+                message: 'Operation outcome is unknown; verify the original effect before trying again.',
+            },
+        };
+    }
+    try {
+        await claimed?.finish(evidence ?? { outcome: result.ok ? 'returned' : 'unknown' });
+    }
+    catch {
+        return {
+            ok: false,
+            error: {
+                code: 'connector_error',
+                reason: 'operation_outcome_unknown',
+                message: 'Operation outcome could not be recorded. Do not repeat the write; verify its original outcome.',
+            },
+        };
+    }
+    return result;
+}
+/** Invalid or credential-like reference mappings never become success evidence or retained payloads. */
+export function safeOperationEvidence(value) {
+    if (!['completed', 'rejected', 'accepted', 'unknown', 'returned'].includes(value.outcome))
+        return { outcome: 'unknown' };
+    if (value.reference !== undefined &&
+        (!/^[A-Za-z0-9._:@/-]{1,256}$/.test(value.reference) || value.reference.includes('://')))
+        return { outcome: 'unknown' };
+    return Object.freeze({
+        outcome: value.outcome,
+        ...(value.reference === undefined ? {} : { reference: value.reference }),
+    });
+}
+//# sourceMappingURL=operation-evidence.js.map

package/node_modules/@noodle-borg/runtime/dist/operation-execution.d.ts

@@ -13,7 +13,7 @@ import { type ToolDispatchHook } from './tool-dispatch.js';
 /** @internal Shared with the suspension-aware flow executor. */
 export declare function runOperation(ref: ResolvedOperationRef | {
     resolved: false;
-}, argsAst: ExprMap, scope: EvalScope, toolName: string, deps: ExecuteDeps, policy: PolicyGate, host: ConnectorCallHost, env: Record<string, string>, argsPath: string, outputPath: string, reviewedAction?: PreparedOperationAction, beforeDispatch?: ToolDispatchHook): Promise<ExecutionResult>;
+}, argsAst: ExprMap, scope: EvalScope, toolName: string, deps: ExecuteDeps, policy: PolicyGate, host: ConnectorCallHost, env: Record<string, unknown>, argsPath: string, outputPath: string, reviewedAction?: PreparedOperationAction, beforeDispatch?: ToolDispatchHook): Promise<ExecutionResult>;
 type PreparedOperationActionResult = {
     readonly ok: true;
     readonly action: PreparedOperationAction;
@@ -28,7 +28,7 @@ export declare function prepareOperationAction(ref: ResolvedOperationRef | {
     resolved: false;
 }, argsAst: ExprMap, scope: EvalScope, deps: ExecuteDeps, argsPath: string, additionalOperationCount?: number): PreparedOperationActionResult;
 /** @internal Shared with the suspension-aware flow executor. */
-export declare function createHost(toolName: string, deps: ExecuteDeps, policy: PolicyGate, env: Record<string, string>, callStack: string[], beforeDispatch?: ToolDispatchHook): ConnectorCallHost;
+export declare function createHost(toolName: string, deps: ExecuteDeps, policy: PolicyGate, env: Record<string, unknown>, callStack: string[], beforeDispatch?: ToolDispatchHook): ConnectorCallHost;
 export declare function fail(code: ExecutionError['code'], message: string, pathOrDetails?: string | Pick<ExecutionError, 'reason' | 'fix' | 'next' | 'connector'>): ExecutionResult;
 export {};
 //# sourceMappingURL=operation-execution.d.ts.map

package/node_modules/@noodle-borg/runtime/dist/operation-execution.js

@@ -1,13 +1,15 @@
+import { createHash, randomUUID } from 'node:crypto';
 import { sanitizeConnectorFailureDetails } from './connector/failure-details.js';
 import { isConnectorInvocationError } from './connector/types.js';
 import { preflightOperationCustomerRoutes, resolveCustomerActionRouteBindings, resolveCustomerConnectorRoute, } from './customer-routing.js';
 import { ExpressionEvalError } from './eval/evaluate.js';
 import { acquireOperationCredential } from './operation-credential.js';
+import { withOperationEvidence } from './operation-evidence.js';
 import { checkSignature, evalExprMap, validateAgainstSchema } from './operation-validation.js';
 import { samePreparedAction } from './prepared-action-match.js';
 import { splitResultMeta } from './result-meta.js';
 import { cloneRoutedOutput } from './routed-output-guard.js';
-import { admitToolDispatch } from './tool-dispatch.js';
+import { admitToolDispatch, admittedExecutionSignal, executionCancellation, } from './tool-dispatch.js';
 /**
  * Run one connector operation end to end: resolve the connector, verify the signature has not
  * drifted, gate with policy, evaluate + validate arguments, mint a downstream credential, invoke,
@@ -111,11 +113,15 @@ export function prepareOperationAction(ref, argsAst, scope, deps, argsPath, addi
  * manifest operation steps and host-mediated sandbox calls.
  */
 async function invokeOperation(ref, args, sig, toolName, deps, policy, host, env, argsPath, outputPath, beforeDispatch) {
+    const initialCancellation = executionCancellation(deps.signal, beforeDispatch);
+    if (initialCancellation)
+        return { ok: false, error: initialCancellation };
     const callKey = operationKey(ref);
     if (hostCallStack(host).includes(callKey)) {
         return fail('circular_call_dependency', `circular connector operation call detected at ${callKey}`, outputPath);
     }
     hostCallStack(host).push(callKey);
+    let disposeSignal;
     try {
         const connector = deps.connectors.resolve(ref);
         if (!connector) {
@@ -143,6 +149,9 @@ async function invokeOperation(ref, args, sig, toolName, deps, policy, host, env
         }
         if (!decision.allow)
             return fail('policy_denied', decision.reason);
+        const cancellation = executionCancellation(deps.signal, beforeDispatch);
+        if (cancellation)
+            return { ok: false, error: cancellation };
         const acquired = await acquireOperationCredential(ref, deps, customerRoute);
         if (!acquired.ok)
             return { ok: false, error: acquired.error };
@@ -157,89 +166,133 @@ async function invokeOperation(ref, args, sig, toolName, deps, policy, host, env
         const admissionError = await admitToolDispatch(beforeDispatch, { toolName });
         if (admissionError !== null)
             return { ok: false, error: admissionError };
-        let output;
-        try {
-            output = await connector.invoke({
-                operation: ref.operation,
-                args: connectorArgs,
-                env,
-                ...(deps.signal === undefined ? {} : { signal: deps.signal }),
-                credential,
-                ...(ref.credentialBinding === undefined
-                    ? {}
-                    : { credentialPresentation: ref.credentialBinding.presentation }),
-                ...(deps.caller !== undefined ? { caller: deps.caller } : {}),
-                ...(customerRoute === undefined ? {} : { route: customerRoute }),
-                host,
-                ...(deps.trace === undefined ? {} : { trace: deps.trace }),
-            });
-        }
-        catch (error) {
-            const hostCall = hostCallErrorSnapshot(error);
-            if (hostCall !== undefined) {
-                return fail(hostCall.code, hostCall.message, hostCall.path);
-            }
-            if (isConnectorInvocationError(error)) {
-                const failureDetails = sanitizeConnectorFailureDetails(error, {
-                    includeResponseExcerpt: customerRoute === undefined,
-                });
-                deps.trace?.record({
-                    kind: 'connector',
-                    connectorId: ref.connectorId,
-                    connectorVersion: ref.connectorVersion,
+        const admitted = admittedExecutionSignal(deps.signal);
+        disposeSignal = admitted.dispose;
+        const execution = operationIdentity(host, deps, toolName, ref, argsPath);
+        const executionBoundMs = connector.executionBoundMs?.(ref.operation);
+        const deadline = executionBoundMs === undefined ? undefined : AbortSignal.timeout(executionBoundMs);
+        const signal = deadline === undefined
+            ? admitted.signal
+            : admitted.signal === undefined
+                ? deadline
+                : AbortSignal.any([deadline, admitted.signal]);
+        return await withOperationEvidence(sig.type === 'action' ? deps.operationEvidence : undefined, {
+            id: execution.id,
+            tool: toolName,
+            operation: ref,
+            arguments: connectorArgs,
+            ...(deps.caller === undefined ? {} : { caller: deps.caller }),
+            ...(deps.executionBinding === undefined
+                ? {}
+                : { executionRevision: deps.executionBinding.revision }),
+            ...(executionBoundMs === undefined ? {} : { executionBoundMs }),
+        }, async (reportOutcome) => {
+            let output;
+            try {
+                if (signal?.aborted)
+                    return fail('execution_cancelled', 'Execution deadline elapsed before connector dispatch.');
+                output = await connector.invoke({
                     operation: ref.operation,
-                    ...failureDetails,
+                    execution,
+                    reportOutcome,
+                    ...(deps.publicAdmission === undefined
+                        ? {}
+                        : { publicAdmission: deps.publicAdmission }),
+                    args: connectorArgs,
+                    env,
+                    ...(signal === undefined ? {} : { signal }),
+                    credential,
+                    acquireTransportCredential: async () => {
+                        const { credentialBinding: _accountBinding, ...transportRef } = ref;
+                        const transport = await acquireOperationCredential(transportRef, deps, customerRoute);
+                        if (!transport.ok)
+                            throw new Error('Independent transport credential unavailable');
+                        return transport.credential;
+                    },
+                    ...(ref.credentialBinding === undefined
+                        ? {}
+                        : { credentialPresentation: ref.credentialBinding.presentation }),
+                    ...(deps.caller !== undefined ? { caller: deps.caller } : {}),
+                    ...(customerRoute === undefined ? {} : { route: customerRoute }),
+                    host,
+                    ...(deps.trace === undefined ? {} : { trace: deps.trace }),
                 });
-                // Attribution keeps the sanitized classification (never the excerpt) so analytics can name
-                // the failing connector/operation/stage while the wire result stays generic (#1309).
-                const status = statusClass(failureDetails.status);
+            }
+            catch (error) {
+                const hostCall = hostCallErrorSnapshot(error);
+                if (hostCall !== undefined) {
+                    return fail(hostCall.code, hostCall.message, hostCall.path);
+                }
+                if (isConnectorInvocationError(error)) {
+                    const failureDetails = sanitizeConnectorFailureDetails(error, {
+                        includeResponseExcerpt: customerRoute === undefined,
+                    });
+                    deps.trace?.record({
+                        kind: 'connector',
+                        connectorId: ref.connectorId,
+                        connectorVersion: ref.connectorVersion,
+                        operation: ref.operation,
+                        ...failureDetails,
+                    });
+                    // Attribution keeps the sanitized classification (never the excerpt) so analytics can name
+                    // the failing connector/operation/stage while the wire result stays generic (#1309).
+                    const status = statusClass(failureDetails.status);
+                    const reason = failureDetails.status === 401 || failureDetails.status === 403
+                        ? 'upstream_authentication_lost'
+                        : failureDetails.category;
+                    return fail('connector_error', `connector failed for operation "${ref.operation}"`, {
+                        ...(reason === undefined ? {} : { reason }),
+                        connector: {
+                            connectorId: ref.connectorId,
+                            connectorVersion: ref.connectorVersion,
+                            operation: ref.operation,
+                            ...(failureDetails.category === undefined
+                                ? {}
+                                : { category: failureDetails.category }),
+                            ...(status === undefined ? {} : { statusClass: status }),
+                            ...(failureDetails.attempts === undefined
+                                ? {}
+                                : { attempts: failureDetails.attempts }),
+                            ...(failureDetails.retryable === undefined
+                                ? {}
+                                : { retryable: failureDetails.retryable }),
+                        },
+                    });
+                }
+                // Normalize connector failures; never surface backend internals or credentials.
                 return fail('connector_error', `connector failed for operation "${ref.operation}"`, {
-                    ...(failureDetails.category === undefined ? {} : { reason: failureDetails.category }),
                     connector: {
                         connectorId: ref.connectorId,
                         connectorVersion: ref.connectorVersion,
                         operation: ref.operation,
-                        ...(failureDetails.category === undefined ? {} : { category: failureDetails.category }),
-                        ...(status === undefined ? {} : { statusClass: status }),
-                        ...(failureDetails.attempts === undefined ? {} : { attempts: failureDetails.attempts }),
-                        ...(failureDetails.retryable === undefined
-                            ? {}
-                            : { retryable: failureDetails.retryable }),
                     },
                 });
             }
-            // Normalize connector failures; never surface backend internals or credentials.
-            return fail('connector_error', `connector failed for operation "${ref.operation}"`, {
-                connector: {
-                    connectorId: ref.connectorId,
-                    connectorVersion: ref.connectorVersion,
-                    operation: ref.operation,
-                },
-            });
-        }
-        if (customerRoute !== undefined) {
-            const cloned = cloneRoutedOutput(output, customerRoute.baseUrl);
-            if (!cloned.ok) {
-                return fail('connector_error', `connector failed for operation "${ref.operation}"`);
+            if (customerRoute !== undefined) {
+                const cloned = cloneRoutedOutput(output, customerRoute.baseUrl);
+                if (!cloned.ok) {
+                    return fail('connector_error', `connector failed for operation "${ref.operation}"`);
+                }
+                output = cloned.value;
             }
-            output = cloned.value;
-        }
-        let redacted;
-        try {
-            redacted = await policy.after(context, output);
-        }
-        catch {
-            return fail('policy_error', 'policy after hook failed');
-        }
-        // Projection metadata is a reserved runtime envelope, not part of the connector's visible output
-        // contract. Validate the visible value deeply while preserving policy-processed metadata for the
-        // flow/result projection channel.
-        const outputError = validateAgainstSchema(splitResultMeta(redacted).visible, sig.output, outputPath, 'output_invalid', 'output field');
-        if (outputError)
-            return { ok: false, error: outputError };
-        return { ok: true, output: redacted };
+            let redacted;
+            try {
+                redacted = await policy.after(context, output);
+            }
+            catch {
+                return fail('policy_error', 'policy after hook failed');
+            }
+            // Projection metadata is a reserved runtime envelope, not part of the connector's visible output
+            // contract. Validate the visible value deeply while preserving policy-processed metadata for the
+            // flow/result projection channel.
+            const outputError = validateAgainstSchema(splitResultMeta(redacted).visible, sig.output, outputPath, 'output_invalid', 'output field');
+            if (outputError)
+                return { ok: false, error: outputError };
+            return { ok: true, output: redacted };
+        });
     }
     finally {
+        disposeSignal?.();
         hostCallStack(host).pop();
     }
 }
@@ -247,6 +300,7 @@ async function invokeOperation(ref, args, sig, toolName, deps, policy, host, env
 export function createHost(toolName, deps, policy, env, callStack, beforeDispatch) {
     const host = {
         [CALL_STACK]: callStack,
+        [INVOCATION]: { id: deps.invocationId ?? randomUUID(), occurrences: new Map() },
         async callOperation(ref, args, path) {
             const connector = deps.connectors.resolve(ref);
             if (!connector)
@@ -269,6 +323,23 @@ export function createHost(toolName, deps, policy, env, callStack, beforeDispatc
     return host;
 }
 const CALL_STACK = Symbol('noodle.connectorCallStack');
+const INVOCATION = Symbol('noodle.connectorInvocation');
+function operationIdentity(host, deps, tool, ref, path) {
+    const invocation = host[INVOCATION];
+    const location = JSON.stringify([hostCallStack(host), path]);
+    const occurrence = invocation.occurrences.get(location) ?? 0;
+    invocation.occurrences.set(location, occurrence + 1);
+    const binding = [
+        invocation.id,
+        deps.tenantId,
+        deps.deploymentId,
+        tool,
+        operationKey(ref),
+        location,
+        occurrence,
+    ];
+    return Object.freeze({ id: createHash('sha256').update(JSON.stringify(binding)).digest('hex') });
+}
 function operationKey(ref) {
     return JSON.stringify([ref.connectorId, ref.connectorVersion, ref.operation]);
 }

package/node_modules/@noodle-borg/runtime/dist/result.d.ts

@@ -2,7 +2,7 @@ import type { CredentialProfile } from '@noodle-borg/compiler';
 import type { ConnectorFailureCategory } from './connector/types.js';
 import type { CustomerRouteBinding } from './customer-routing.js';
 /** Why a tool call could not be fulfilled. Protocol and embedded adapters map this internal contract. */
-export type ExecutionErrorCode = 'shape_only_artifact' | 'unknown_tool' | 'unknown_resource' | 'unknown_prompt' | 'unsupported_fulfilment' | 'connector_unavailable' | 'connector_route_unavailable' | 'credential_unavailable' | 'signature_drift' | 'policy_denied' | 'policy_error' | 'dispatch_denied' | 'usage_limit_exceeded' | 'duplicate_execution_suppressed' | 'execution_admission_error' | 'execution_cancelled' | 'arg_invalid' | 'invalid_continuation' | 'invalid_elicitation_flow' | 'invalid_confirmation_flow' | 'expression_error' | 'circular_call_dependency' | 'connector_error' | 'output_invalid';
+export type ExecutionErrorCode = 'shape_only_artifact' | 'unknown_tool' | 'unknown_resource' | 'unknown_prompt' | 'configuration_required' | 'configuration_invalid' | 'configuration_changed' | 'unsupported_fulfilment' | 'connector_unavailable' | 'connector_route_unavailable' | 'credential_unavailable' | 'signature_drift' | 'policy_denied' | 'policy_error' | 'dispatch_denied' | 'usage_limit_exceeded' | 'duplicate_execution_suppressed' | 'execution_admission_error' | 'execution_cancelled' | 'arg_invalid' | 'invalid_continuation' | 'invalid_elicitation_flow' | 'invalid_confirmation_flow' | 'expression_error' | 'circular_call_dependency' | 'connector_error' | 'output_invalid';
 /**
  * Safe connector failure attribution for operator analytics (issue #1309): platform identifiers and
  * bounded classification only — never an upstream message, response body, credential, or exact URL.
@@ -72,7 +72,7 @@ export interface ToolContinuation {
     readonly nextStepIndex: number;
     readonly completedSteps: Readonly<Record<string, unknown>>;
     readonly resultMetas: readonly Readonly<Record<string, unknown>>[];
-    readonly env: Readonly<Record<string, string>>;
+    readonly env: Readonly<Record<string, unknown>>;
     readonly pending: ElicitationRequest;
 }
 interface ContinuationArtifactIdentity {
@@ -94,7 +94,7 @@ export interface ToolPreparationContinuation {
     readonly nextStepIndex: number;
     readonly completedSteps: Readonly<Record<string, unknown>>;
     readonly elicited: Readonly<Record<string, unknown>>;
-    readonly env: Readonly<Record<string, string>>;
+    readonly env: Readonly<Record<string, unknown>>;
     readonly pending: ElicitationRequest;
 }
 /**
@@ -103,6 +103,8 @@ export interface ToolPreparationContinuation {
  */
 export interface PreparedToolContinuation {
     readonly kind: 'prepared_confirmation';
+    /** Private hosting snapshot; never projected into a model-visible confirmation. */
+    readonly executionRevision?: string;
     readonly version: 1;
     readonly artifact: ContinuationArtifactIdentity;
     readonly toolName: string;
@@ -110,7 +112,7 @@ export interface PreparedToolContinuation {
     /** First flow step not evaluated during preparation; zero for a single-operation fulfilment. */
     readonly nextStepIndex: number;
     readonly completedSteps: Readonly<Record<string, unknown>>;
-    readonly env: Readonly<Record<string, string>>;
+    readonly env: Readonly<Record<string, unknown>>;
     /** Exact first connector invocation approved by the user; absent for a pure flow. */
     readonly reviewedAction?: PreparedOperationAction;
 }

package/node_modules/@noodle-borg/runtime/dist/tool-dispatch.d.ts

@@ -6,6 +6,13 @@ export interface ToolDispatchContext {
 }
 /** Called at connector boundaries and successful connector-free completion; latched once per logical call. */
 export type ToolDispatchHook = (context: ToolDispatchContext) => ToolDispatchDecision | Promise<ToolDispatchDecision>;
+/** Client cancellation stops unadmitted work; a host execution deadline remains authoritative. */
+export declare function executionCancellation(signal: AbortSignal | undefined, admission: ToolDispatchHook | undefined): ExecutionError | null;
+/** After admission a client disconnect cannot cancel the effect, but a hard deadline still can. */
+export declare function admittedExecutionSignal(parent: AbortSignal | undefined): {
+    readonly signal: AbortSignal | undefined;
+    dispose(): void;
+};
 /** Latch cancellation and admission once for every logical protocol operation. */
 export declare function latchToolDispatchAdmission(hook: ToolDispatchHook | undefined, signal: AbortSignal | undefined): ToolDispatchHook | undefined;
 /** Apply a hook as a fail-closed runtime admission decision without exposing implementation errors. */