@noodleseed/one 0.187.0 → 0.189.0

package/node_modules/@noodle-borg/agent-kit/dist/skill-embedded-assistant-split.js

@@ -0,0 +1,68 @@
+import { renderEmbeddedAssistantReference } from './skill-embedded-assistant-ref.js';
+const TOPIC_BY_HEADING = {
+    'Public messaging: WhatsApp, Instagram DMs and SMS': 'messaging',
+    'Collect interactions': 'messaging',
+    Architecture: 'core',
+    'Select the architecture before code': 'core',
+    'Install into the existing application': 'core',
+    'Author and validate': 'core',
+    'Product workflow guidance': 'core',
+    'Customize the presentation': 'rendering',
+    'Configure and deploy': 'operations',
+    'Access modes and customer auth': 'identity',
+    'Create the backend client': 'identity',
+    'Integrate the customer backend': 'identity',
+    'Ground time and ambient facts': 'identity',
+    'Structured missing input': 'identity',
+    'Verified session context (identity and claims)': 'identity',
+    'The session response': 'identity',
+    'Mount a public website surface': 'rendering',
+    'Choose a browser renderer': 'rendering',
+    'Host readiness and promotion': 'operations',
+    'Launch and qualified-usage proof': 'operations',
+    'Toolchain requirements': 'operations',
+    'Verify the boundary': 'operations',
+    'Troubleshooting: symptom to diagnosis': 'operations',
+};
+/** Keep the authored reference single-sourced while loading only the requested topic in an agent. */
+export function renderEmbeddedAssistantTopic(topic) {
+    const source = renderEmbeddedAssistantReference();
+    const sections = source.split(/(?=^## )/m);
+    const selected = sections.slice(1).filter((section) => {
+        const heading = /^## ([^\n]+)/.exec(section)?.[1];
+        if (heading === undefined)
+            throw new Error('embedded assistant reference has no heading');
+        if (heading === 'Contents')
+            return false;
+        if (!(heading in TOPIC_BY_HEADING)) {
+            throw new Error(`unrouted embedded assistant topic: ${heading}`);
+        }
+        return TOPIC_BY_HEADING[heading] === topic;
+    });
+    if (selected.length === 0)
+        throw new Error(`empty embedded assistant topic: ${topic}`);
+    const contents = selected.map((section) => {
+        const heading = /^## ([^\n]+)/.exec(section)?.[1];
+        if (heading === undefined)
+            throw new Error('embedded assistant section has no heading');
+        return `- ${heading}`;
+    });
+    const intro = topic === 'core'
+        ? [
+            '# Embedded assistant',
+            '',
+            'Read this overview for architecture and authoring. Load only the topic needed next:',
+            '- [Messaging and collection](./embedded-assistant-messaging.md)',
+            '- [Identity and backend sessions](./embedded-assistant-identity.md)',
+            '- [Appearance and browser rendering](./embedded-assistant-rendering.md)',
+            '- [Deployment, verification and recovery](./embedded-assistant-operations.md)',
+            '',
+            '## Contents',
+            '',
+            ...contents,
+            '',
+        ].join('\n')
+        : `# Embedded assistant: ${topic}\n\n## Contents\n\n${contents.join('\n')}\n\n`;
+    return `${intro}${selected.join('').trimEnd()}\n`;
+}
+//# sourceMappingURL=skill-embedded-assistant-split.js.map

package/node_modules/@noodle-borg/agent-kit/dist/skill-existing-app-ref.js

@@ -42,7 +42,7 @@ export function renderWrapExistingAppReference() {
         '6. **Reject unstable seams.** Do not call an unstable server-call protocol whose identifier or serialization changes across builds. Never use direct database access, including ORM or SQL; it bypasses application authorization and business rules. Do not log in and copy a browser session into the runtime; copying a browser session or its credentials into the runtime is prohibited. Do not treat a service credential as per-user authorization. Propose a narrow application-owned HTTP handler instead.',
         '7. **Separate implementation ownership.** Produce an existing-application phase for handlers/auth/tests, a Noodle-project phase for TypeScript connector/tools/fakes/tests, and a cross-surface verification phase. If repositories differ, create separate repository-scoped plans and approval boundaries.',
         '8. **Present and stop.** Show the capability map, identity/routing decision, minimum honest application changes, rejected alternatives, test matrix, risks, and phases in the conversation. A design approval is review only. Local implementation requires an explicit “proceed” for the named repository. Local implementation approval does not authorize hosted configuration, live writes, deployment, publication, or issue-state changes; those require their own authority.',
-        '9. **Hand off approved work.** Once a decision-complete local plan is explicitly authorized, persist it when repository workflow requires and hand it to `executing-noodle-plans`. Use the existing server-authoring and API-connection playbooks for implementation and real-output evidence; do not add another task loop here.',
+        '9. **Continue approved work.** After the user authorizes the implementation, follow the repository workflow and the relevant Noodle authoring or API-connection skill. Verify real output without reopening settled decisions.',
         '',
         '## Verification evidence',
         '',

package/node_modules/@noodle-borg/agent-kit/dist/skill-router.d.ts

@@ -1,6 +1,6 @@
-import { type BehaviorSkillName } from './behavior-skills.js';
+import type { BehaviorSkillName } from './behavior-skills.js';
 import type { AgentTarget } from './index.js';
-export declare const SKILL_DESCRIPTION: string;
+export declare const SKILL_DESCRIPTION = "Build or operate a Noodle Seed MCP server or app with TypeScript and the noodle CLI. Use for Noodle project setup, an unclear Noodle workflow, or finding the relevant specialist skill.";
 export type SkillReferencePath = `references/${string}.md`;
 export declare const APP_DIRECTORY_COMPLIANCE_REFERENCE: SkillReferencePath;
 type SkillRouteId = 'design-product' | 'create-product-guide' | 'wrap-existing-app' | 'build-server' | 'connect-api' | 'build-app' | 'verify-recover' | 'debug-recover' | 'inspect-hosted' | 'deploy-hosted' | 'embed-assistant' | 'publish' | 'feedback';
@@ -11,6 +11,7 @@ export interface SkillRoute {
     readonly exitCondition: string;
 }
 export declare const SKILL_ROUTES: readonly SkillRoute[];
+/** A short index for ambiguous requests; installed specialist skills are directly discoverable. */
 export declare function skillRouterBody(_target: AgentTarget): string;
 export {};
 //# sourceMappingURL=skill-router.d.ts.map

package/node_modules/@noodle-borg/agent-kit/dist/skill-router.js

@@ -1,15 +1,12 @@
 // Intent router for the project-local `noodle-seed` skill. Keep this file small: it selects one
 // outcome workflow and bounds progressive disclosure. Detailed MCP guidance belongs in the
 // one-level reference tree rendered by skill-content.ts.
-import { BEHAVIOR_SKILLS } from './behavior-skills.js';
-export const SKILL_DESCRIPTION = 'Use when building, validating, testing, deploying, or operating a local or hosted Noodle Seed ' +
-    'MCP server or app authored in TypeScript with the noodle CLI, or improving signup or onboarding ' +
-    'conversion or selecting a first Noodle workflow for an account-growth product.';
+export const SKILL_DESCRIPTION = 'Build or operate a Noodle Seed MCP server or app with TypeScript and the noodle CLI. Use for Noodle project setup, an unclear Noodle workflow, or finding the relevant specialist skill.';
 export const APP_DIRECTORY_COMPLIANCE_REFERENCE = 'references/app-directory-compliance.md';
 export const SKILL_ROUTES = [
     {
         id: 'design-product',
-        intent: 'Turn a vague MCP product idea into a bounded design before implementation',
+        intent: 'Choose a first Noodle workflow or turn a vague MCP idea into a bounded design',
         skill: 'designing-mcp-products',
         exitCondition: 'The product contract identifies the user benefit, model boundary, evidence, and next implementation skill.',
     },
@@ -86,110 +83,25 @@ export const SKILL_ROUTES = [
         exitCondition: 'A sanitized dry-run preview and exact proposal are shown, then one submission occurs only after explicit approval.',
     },
 ];
-/** Complete lookup catalog. Routes above, not this inventory, own discovery. */
-const REFERENCE_INDEX_LINES = [
-    '- `references/agent-contract.md` — the `--json` envelope, exit codes, and the three output modes.',
-    '- `references/product-agent-guides.md` — decide, interview, propose, prove, preview, and explicitly install one host-neutral product guide.',
-    '- `references/sdk-surface.md` — what to import from `@noodleseed/one` and which builder to use.',
-    '- `references/cli-commands.md` — every `noodle` command, grouped by area.',
-    '- `references/compile-errors.md` — fix `noodle validate` errors by code.',
-    '- `references/build-an-mcp-server.md` — outcome-first workflow for a focused, tested, model-facing MCP product.',
-    '- `references/authoring-workflow.md` — input paths, fit checks, connector patterns, authentication, invocation context, testing, and managed config.',
-    '- `references/tool-design.md` — intent-shaped tools, titles and annotations, bounded outputs, tool-surface budget, and context provisioning.',
-    '- `references/embedded-assistant.md` — HTTPS origins, managed model config, deploy sequencing, session exchange, browser mounting, and credential boundaries.',
-    '- `references/connect-an-api.md` — secure credentials, probe the live API, model the observed shape, and prove real output.',
-    '- `references/wrap-existing-app.md` — read-only identity-first planning for an existing application with no stable usable API.',
-    '- `references/build-an-mcp-app.md` — product-fit, output-boundary, fallback, and evidence workflow for an MCP App.',
-    '- `references/experience-design.md` — design an app experience: funnel boundary, grounding, two users, display modes, and wireframe.',
-    '- `references/widgets-and-apps.md` — MCP Apps, typed views, widget hooks, output shaping, and CSP.',
-    '- `references/test-in-hosts.md` — connect and test in real MCP hosts and protocol inspection clients.',
-    '- `references/verify-and-recover.md` — ordered evidence ladder, bounded repair, and honest completion claims.',
-    '- `references/troubleshooting.md` — runtime symptom to cause and fix, locally and hosted.',
-    '- `references/inspect-hosted.md` — read-only hosted status, logs, metrics, events, and deployment diagnosis.',
-    '- `references/deploy-and-ops.md` — explicitly authorized hosted link, config, deploy, access, connection writes, and rollback.',
-    '- `references/publishing.md` — prepare and submit to app and connector directories.',
-    `- \`${APP_DIRECTORY_COMPLIANCE_REFERENCE}\` — the pre-submission experience and policy checklist.`,
-    '- `references/examples.md` — flagship example index and a canonical `server.ts`.',
-    '- `references/feedback.md` — draft sanitized product feedback and submit only with user approval.',
-];
-function routeTableLines() {
-    return [
-        '| User outcome | Load sibling skill | Canonical playbook | Done when |',
-        '| :--- | :--- | :--- | :--- |',
-        ...SKILL_ROUTES.map((route) => {
-            const skill = BEHAVIOR_SKILLS.find((candidate) => candidate.name === route.skill);
-            if (skill === undefined)
-                throw new Error(`missing behavior skill for route ${route.id}`);
-            const supporting = skill.supportingReferences.length > 0
-                ? skill.supportingReferences.map((reference) => `\`${reference}\``).join(', ')
-                : 'None';
-            return `| ${route.intent} | \`${route.skill}\` | \`${skill.primaryReference}\` (${supporting}) | ${route.exitCondition} |`;
-        }),
-    ];
-}
+/** A short index for ambiguous requests; installed specialist skills are directly discoverable. */
 export function skillRouterBody(_target) {
-    const preamble = 'Use this skill for project-local Noodle Seed authoring in the active coding host; preserve generated and user instruction boundaries.';
     return [
         '# Noodle Seed',
         '',
-        'Build, validate, test, deploy, and operate Noodle Seed MCP servers and apps authored in TypeScript with the `noodle` CLI. Author from the configured entrypoint (usually `server.ts`); keep the authoring surface TypeScript-only.',
-        '',
-        preamble,
-        '',
-        "If the request is unrelated to the Noodle MCP surface, stop here: follow the project's normal instructions and run no Noodle lifecycle commands.",
-        '',
-        '**Installed-plugin execution.** When this skill is supplied by the Noodle Developer plugin, you write and test the application source, then use its supported `noodle-readiness` tools for project setup, build gates, exact-target linking, variables, secret-from-environment transfer, gated deployment, and feedback. Treat the corresponding public `noodle ...` command as recovery text, never as permission to discover or expose an internal launcher. If a tool fails, report its structured error and public `noodle ...` command; do not ask the user to copy a private installation path or perform an operation the authorized tool can perform.',
-        '',
-        '## Route the request',
-        '',
-        'Choose exactly one primary route from the user outcome below, then load the selected sibling skill and hand off the request. Read that primary reference in full; read supporting references only when the sibling or observed evidence requires them. Do not reread the corpus or restart discovery after the handoff.',
-        '',
-        'Apply this precedence when wording overlaps: concrete failure evidence takes the debugging route; an explicit request to create, revise, regenerate, or recover an app product skill takes `creating-product-agent-guides`; an MCP App/UI outcome takes the App route; an existing application with no stable, usable API or specification takes `wrapping-existing-applications`; only when all four API-evidence inputs exist—an API base URL, authentication scheme, representative safe read, and observed response—use `connecting-apis-to-mcp`; missing, stale, inaccessible, undocumented-only, or otherwise unusable evidence remains in `wrapping-existing-applications`; both integration routes take precedence over generic server building; hosted inspection is debugging read-only; hosted mutation requires the explicitly requested deployment route.',
-        '',
-        'Negative routing examples: “Inspect hosted logs/status” → `inspect-hosted` (read-only). “Prepare for deployment” → the applicable build or verification route; with existing access it may inspect `deploy preflight`, then stop with a handoff. Preparation does not authorize `link`, hosted config, publication, rollback, host writes, or submission. “Keep this local” → a build or verification route, never a hosted route.',
-        '',
-        '## First-workflow heuristic',
-        '',
-        'When the user asks what to build first or gives only a broad growth goal, inspect the repository and product context before asking them to invent a workflow. Do not classify the business or choose a design from an industry label alone.',
-        '',
-        'If the evidence shows a public visitor surface, an existing signup or sign-in boundary, a useful pre-account result the assistant can genuinely produce, and a meaningful authenticated outcome inside the product—and more authenticated users are valuable—recommend public-to-product continuous onboarding and route to `embedding-mcp-assistants`. This recommendation is not limited to B2B SaaS. If one of those facts is unclear, ask only for the smallest missing fit fact; if the pattern does not fit, route by the user’s actual outcome instead.',
-        '',
-        ...routeTableLines(),
-        '',
-        '## Common machine loop',
-        '',
-        'Every `--json` command speaks the canonical envelope on stdout. Parse machine state instead of scraping human prose; `references/agent-contract.md` owns the envelope, streaming records, and exit codes.',
-        '',
-        'Inside the installed plugin, perform mapped steps with `noodle-readiness` tools and use the public `noodle ...` spelling only when reporting the logical action or a fallback. Outside the plugin, run the public CLI directly. Never construct a hidden launcher command.',
-        '',
-        "1. **Discover** — use `noodle commands --json` when the required command or flags are uncertain; don't read CLI source.",
-        '2. **Author** — for build routes, edit the configured TypeScript entrypoint, usually `src/server.ts`.',
-        '3. **Validate** — run `noodle validate --json`; repair each `error.errors[]` item at its `path`, then re-run `noodle validate --json`.',
-        '4. **Smoke** — run `noodle test --json` after validation passes.',
-        '5. **Prove the requested level** — connector routes require a safe live read with `noodle tools call`; App routes require `noodle check --json` and `noodle devtools`; hosted or host actions run only when the selected route and current user request authorize that exact level.',
-        '6. **Report evidence** — claim only the highest level actually exercised and name anything not run.',
-        '',
-        '## Reference lookup catalog',
-        '',
-        'This is a lookup catalog, not a discovery checklist. Return here only when the selected primary route names a missing technical detail:',
-        '',
-        ...REFERENCE_INDEX_LINES,
+        'Author Noodle Seed MCP servers and apps in TypeScript. The compiler owns manifests and runtime artifacts. If the request is unrelated to this Noodle project, follow the project instructions without running Noodle lifecycle commands.',
         '',
-        '## Product feedback',
+        '## Find the relevant skill',
         '',
-        'When you discover a bug, missing capability, misleading doc, or improvement idea, draft and sanitize one finding, then preview it with `noodle-readiness.preview_product_feedback` in the installed plugin or `noodle feedback ... --dry-run --json` in the public CLI. Inspect and show the normalized submission, diagnostics, and private destination. Ask for explicit approval of that exact proposal; do not submit it until approval. Then call `noodle-readiness.submit_product_feedback` once with approval, or run the public CLI once without `--dry-run`. Follow `references/feedback.md`; pass structured arguments directly instead of composing a shell command, never include customer code, secrets, personal data, or identifying project details, and never auto-login or retry-loop.',
+        'Use a specialist skill directly when the task is clear. For an ambiguous Noodle request, use this index; a task may need more than one skill as work progresses.',
+        ...SKILL_ROUTES.map((route) => `- ${route.intent}: \`${route.skill}\``),
         '',
-        '## Safety',
+        'For a concrete failure, start with `debugging-mcp-delivery`. For hosted status or logs, inspect read-only. Deployment, configuration writes, rollback, and directory submission require an authorized target and action. API connection needs a usable API origin, auth scheme, safe read, and observed result; when those are missing, inspect the application and establish them before promising a live integration.',
         '',
-        '- Keep secrets, bearer tokens, refresh tokens, static access keys, `.env` / `.env.noodle` values, and `~/.noodle/config.json` out of prompts, logs, docs, tests, and generated files.',
-        '- Never expose an internal launcher or private installation path, ask the user to paste a command the plugin can execute, or use an ad hoc shell/file-parsing pipeline to move a secret. Use the typed secret-from-environment tool or `noodle secrets set ... --from-env NAME`.',
-        '- Do not hand-author manifest JSON/YAML, runtime artifacts, connector IR, or hosted asset metadata.',
-        '- Do not add static data-plane credential paths; hosted access is identity-based.',
-        '- Hosted mutation is opt-in. Run `link`, hosted secret/variable/config/access changes, deploy, rollback, host configuration writes, or directory submission only when the current user request explicitly authorizes the exact mutation and target. An inspect, prepare, validate, test, or local-only request grants no such authority; stop and ask before crossing that boundary.',
+        '## Find current product facts',
         '',
-        '## Customization',
+        'Use [the SDK reference](./references/sdk-surface.md) for TypeScript builders, [the CLI reference](./references/cli-commands.md) or `noodle commands --json` for commands, and [the machine response contract](./references/agent-contract.md) when parsing errors. Read only the reference relevant to the task. Validate authored changes with `noodle validate --json`, then run the relevant local behavior check. A connector-backed capability also needs a representative safe live read before claiming its response mapping works.',
         '',
-        'This skill is regenerated by `noodle agents setup --write`. For project-specific standards, create a separate skill; do not edit this file or its references.',
+        'In the installed Noodle Developer plugin, use supported `noodle-readiness` tools for lifecycle operations; report public `noodle ...` commands for recovery. Outside the plugin, run the public CLI. Keep credentials and internal launcher paths out of prompts and output. Transfer secrets only through supported from-environment operations. Hosted changes need the user-authorized target and action; local checks do not prove hosted behavior.',
     ].join('\n');
 }
 //# sourceMappingURL=skill-router.js.map

package/node_modules/@noodle-borg/agent-kit/dist/skill-server-playbook-ref.js

@@ -50,7 +50,7 @@ export function renderBuildAnMcpServerReference() {
         '- Tool registers but returns empty or `undefined` fields: inspect one sanitized real response, correct `${response...}` mappings, and rerun the same read.',
         '- Credential unavailable: verify `secret(...)` naming and the effective local target; never inline or print the secret.',
         '- Missing product input: ask for the smallest concrete example, schema, or rule that unblocks the selected job. Do not widen the build to compensate.',
-        '- Repeated failure at the same layer: stop after two evidence-backed repair attempts with the same failure signature and report the command, sanitized error, evidence already proven, and exact next action.',
+        '- Repeated failure at the same layer: continue only with a new evidence-backed cause; otherwise preserve the sanitized error and passing evidence, then report the blocker and exact next action.',
         '',
         '## Stop conditions',
         '',

package/node_modules/@noodle-borg/agent-kit/dist/skill-verification-ref.js

@@ -42,7 +42,7 @@ export function renderVerifyAndRecoverReference() {
         '3. Form one evidence-backed cause from the observed output. If the two canonical supports do not cover it, select one matching symptom from the router lookup catalog; do not scan every recovery path.',
         '4. Make the smallest in-scope repair. Do not freeform re-edit adjacent code, change credentials, redeploy, or add product behavior without evidence and authority.',
         '5. Rerun only the same evidence layer that failed. Once it passes, continue upward only to the user-requested level.',
-        '6. Stop after two evidence-backed repair attempts with the same failure signature, or immediately when the next action requires new authority or external state.',
+        '6. If the same failure persists without a new evidence-backed cause, preserve the repro and report the blocker. Stop when the next action requires new authority or external state.',
         '',
         '## Verification evidence',
         '',
@@ -69,7 +69,7 @@ export function renderVerifyAndRecoverReference() {
         '',
         '- Stop complete when the user-requested evidence level and every dependency below it pass in the current target.',
         '- Stop blocked when progress requires credentials, approval, host access, deployment authority, production access, or an external-state change not available in scope.',
-        '- Stop after two evidence-backed repair attempts with the same failure signature at one layer; do not hide repetition behind unrelated edits.',
+        '- Stop when the same failure has no new evidence-backed repair; do not hide repetition behind unrelated edits.',
         '- Never claim fixed or working without rerunning the failed layer, and never upgrade compile, local, deployment, or stale historical evidence into a stronger claim.',
     ].join('\n');
 }

package/node_modules/@noodle-borg/agent-kit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodle-borg/agent-kit",
-  "version": "0.111.0",
+  "version": "0.113.0",
   "license": "Apache-2.0",
   "type": "module",
   "engines": {

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-model-context.js

@@ -107,6 +107,7 @@ function invocationContextMessages(context) {
 }
 /** What each messaging app renders; Instagram caps a reply at 1000 bytes, so the model aims well under. */
 const MESSAGING_PROFILES = {
+    sms: 'SMS surface: concise plain text, no Markdown, at most 300 characters. Use bare URLs and answer one question at a time.',
     whatsapp: 'WhatsApp surface: concise plain text, at most 3500 characters.',
     instagram: 'Instagram DM surface: plain text only, no Markdown or lists, at most 600 characters, bare URLs.',
 };

package/node_modules/@noodle-borg/assistant-gateway/dist/channel-coordinator.d.ts

@@ -36,6 +36,27 @@ export declare class ChannelCoordinator {
         actor: string;
         readyRevision?: number | undefined;
         readyAt?: number | undefined;
+    } | {
+        channel: "sms";
+        provider: "twilio";
+        accountSid: string;
+        phoneNumberSid: string;
+        phoneNumber: string;
+        id: string;
+        tenant: TenantRef;
+        apiKeySecret: string;
+        deploymentId: string;
+        capabilities: readonly import("./channel-types.js").ChannelCapability[];
+        supportEmail: string;
+        revision: number;
+        generation: number;
+        state: "paused" | "enabled" | "disconnected";
+        limits: import("./channel-types.js").ChannelLimits;
+        createdAt: number;
+        updatedAt: number;
+        actor: string;
+        readyRevision?: number | undefined;
+        readyAt?: number | undefined;
     } | {
         provider: import("./channel-types.js").ChannelProvider;
         phoneNumberId: string;
@@ -84,6 +105,27 @@ export declare class ChannelCoordinator {
         actor: string;
         readyRevision?: number | undefined;
         readyAt?: number | undefined;
+    } | {
+        channel: "sms";
+        provider: "twilio";
+        accountSid: string;
+        phoneNumberSid: string;
+        phoneNumber: string;
+        id: string;
+        tenant: TenantRef;
+        apiKeySecret: string;
+        deploymentId: string;
+        capabilities: readonly import("./channel-types.js").ChannelCapability[];
+        supportEmail: string;
+        revision: number;
+        generation: number;
+        state: "paused" | "enabled" | "disconnected";
+        limits: import("./channel-types.js").ChannelLimits;
+        createdAt: number;
+        updatedAt: number;
+        actor: string;
+        readyRevision?: number | undefined;
+        readyAt?: number | undefined;
     } | {
         provider: import("./channel-types.js").ChannelProvider;
         phoneNumberId: string;
@@ -127,6 +169,27 @@ export declare class ChannelCoordinator {
         actor: string;
         readyRevision?: number | undefined;
         readyAt?: number | undefined;
+    } | {
+        channel: "sms";
+        provider: "twilio";
+        accountSid: string;
+        phoneNumberSid: string;
+        phoneNumber: string;
+        id: string;
+        tenant: TenantRef;
+        apiKeySecret: string;
+        deploymentId: string;
+        capabilities: readonly import("./channel-types.js").ChannelCapability[];
+        supportEmail: string;
+        revision: number;
+        generation: number;
+        state: "paused" | "enabled" | "disconnected";
+        limits: import("./channel-types.js").ChannelLimits;
+        createdAt: number;
+        updatedAt: number;
+        actor: string;
+        readyRevision?: number | undefined;
+        readyAt?: number | undefined;
     } | {
         provider: import("./channel-types.js").ChannelProvider;
         phoneNumberId: string;
@@ -151,6 +214,11 @@ export declare class ChannelCoordinator {
     block(id: string, participantId: string, actor: string, key: string, until: number | null): Promise<void>;
     unblock(id: string, participantId: string, actor: string, key: string): Promise<void>;
     blocks(id: string, after?: string): Promise<ChannelBlock[]>;
+    optouts(id: string, after?: string): Promise<{
+        at: number;
+        blocked: boolean;
+        participantId: string;
+    }[]>;
     events(id: string, after?: string): Promise<ChannelEvent[]>;
     forget(id: string, participantId: string, actor: string, key: string): Promise<void>;
     updateLimits(id: string, input: ChannelLimitsInput, actor: string, key: string, revision: number): Promise<{
@@ -173,6 +241,27 @@ export declare class ChannelCoordinator {
         actor: string;
         readyRevision?: number | undefined;
         readyAt?: number | undefined;
+    } | {
+        channel: "sms";
+        provider: "twilio";
+        accountSid: string;
+        phoneNumberSid: string;
+        phoneNumber: string;
+        id: string;
+        tenant: TenantRef;
+        apiKeySecret: string;
+        deploymentId: string;
+        capabilities: readonly import("./channel-types.js").ChannelCapability[];
+        supportEmail: string;
+        revision: number;
+        generation: number;
+        state: "paused" | "enabled" | "disconnected";
+        limits: import("./channel-types.js").ChannelLimits;
+        createdAt: number;
+        updatedAt: number;
+        actor: string;
+        readyRevision?: number | undefined;
+        readyAt?: number | undefined;
     } | {
         provider: import("./channel-types.js").ChannelProvider;
         phoneNumberId: string;

package/node_modules/@noodle-borg/assistant-gateway/dist/channel-coordinator.js

@@ -11,7 +11,8 @@ export async function requireChannel(tx, id) {
 }
 export async function channelBlocked(tx, id, participant, now) {
     const block = await channelValue(tx, id, `block:${participant}`);
-    return !!block && (block.until === null || block.until > now);
+    const optout = await channelValue(tx, id, `optout:${participant}`);
+    return optout?.blocked === true || (!!block && (block.until === null || block.until > now));
 }
 export async function requireChannelLive(tx, id) {
     const binding = await requireChannel(tx, id);
@@ -38,6 +39,8 @@ async function mutation(tx, id, key, input, now, work) {
 }
 /** Validates a channel's provider fields and names the asset its binding will own. */
 function configuredAsset(input) {
+    if (input.channel === 'sms')
+        return channelAssetKey('sms', input.phoneNumber);
     if (input.channel === 'instagram')
         return channelAssetKey('instagram', input.instagramAccountId);
     const meta = input.provider === 'meta';
@@ -47,6 +50,8 @@ function configuredAsset(input) {
     return channelAssetKey('whatsapp', input.phoneNumberId);
 }
 function configuredBinding(input, id, state) {
+    if (input.channel === 'sms')
+        return { ...input, id, provider: 'twilio', ...state };
     if (input.channel === 'instagram')
         return { ...input, id, provider: 'meta', ...state };
     const { provider, channel: _whatsapp, ...configured } = input;
@@ -216,6 +221,20 @@ export class ChannelCoordinator {
             })).map((row) => row.value);
         });
     }
+    async optouts(id, after) {
+        return this.store.transaction([id], async (tx) => {
+            await requireChannel(tx, id);
+            const rows = await tx.list(id, {
+                kind: 'optout',
+                limit: 100,
+                ...(after ? { after: `optout:${after}` } : {}),
+            });
+            return rows.map((row) => ({
+                participantId: row.id.slice('optout:'.length),
+                ...row.value,
+            }));
+        });
+    }
     async events(id, after) {
         return this.store.transaction([id], async (tx) => {
             await requireChannel(tx, id);

package/node_modules/@noodle-borg/assistant-gateway/dist/channel-inbox.js

@@ -63,7 +63,22 @@ export async function receiveChannelMessages(store, id, messages, now, retention
             if ((await channelCounter(tx, id, 'ingress', now, CHANNEL_DAY_MS)) >= 10_000)
                 throw new ChannelError('ingress_capacity');
             const participantId = channelParticipantId(binding, message.address);
-            const code = await refusal(tx, binding, message, participantId, pending, now);
+            let code = await refusal(tx, binding, message, participantId, pending, now);
+            if (binding.channel === 'sms' &&
+                message.control &&
+                message.eventAt >= now - CHANNEL_RETENTION_MS &&
+                message.eventAt <= now + 60_000) {
+                if (message.control !== 'help') {
+                    const key = `optout:${participantId}`;
+                    const prior = await channelValue(tx, id, key);
+                    // Older callbacks cannot undo a newer preference; STOP wins equal-second timestamps.
+                    if (!prior ||
+                        message.eventAt > prior.at ||
+                        (message.eventAt === prior.at && message.control === 'stop'))
+                        await tx.put(id, channelRow(key, 'optout', { at: message.eventAt, blocked: message.control === 'stop' }, now));
+                }
+                code = `provider_${message.control}`;
+            }
             const sequence = ((await channelValue(tx, id, 'sequence')) ?? 0) + 1;
             await tx.put(id, channelRow('sequence', 'counter', sequence, now));
             const eventId = `e_${String(sequence).padStart(20, '0')}`;

package/node_modules/@noodle-borg/assistant-gateway/dist/channel-store.d.ts

@@ -1,7 +1,7 @@
 /** Private channel journal. Each binding is a transaction/lease authority, not a browser session. */
 export interface ChannelRow {
     readonly id: string;
-    readonly kind: 'binding' | 'asset' | 'participant' | 'event' | 'counter' | 'spend' | 'block' | 'mutation' | 'interaction';
+    readonly kind: 'binding' | 'asset' | 'participant' | 'event' | 'counter' | 'spend' | 'block' | 'optout' | 'mutation' | 'interaction';
     readonly state?: string;
     readonly updatedAt: number;
     readonly expiresAt?: number;

package/node_modules/@noodle-borg/assistant-gateway/dist/channel-types.d.ts

@@ -28,7 +28,7 @@ export type ChannelCapability = {
     readonly name: string;
 };
 /** One binding per channel per environment; each channel owns its own provider asset. */
-export declare const CHANNEL_KINDS: readonly ["whatsapp", "instagram"];
+export declare const CHANNEL_KINDS: readonly ["whatsapp", "instagram", "sms"];
 export type ChannelKind = (typeof CHANNEL_KINDS)[number];
 export interface ChannelBindingBase {
     readonly id: string;
@@ -68,7 +68,14 @@ export interface InstagramBinding extends ChannelBindingBase {
     readonly instagramAccountId: string;
     readonly pageId: string;
 }
-export type ChannelBinding = WhatsAppBinding | InstagramBinding;
+export interface SmsBinding extends ChannelBindingBase {
+    readonly channel: 'sms';
+    readonly provider: 'twilio';
+    readonly accountSid: string;
+    readonly phoneNumberSid: string;
+    readonly phoneNumber: string;
+}
+export type ChannelBinding = WhatsAppBinding | InstagramBinding | SmsBinding;
 type ChannelConfigureBase = Pick<ChannelBindingBase, 'tenant' | 'apiKeySecret' | 'deploymentId' | 'capabilities' | 'supportEmail'> & {
     readonly limits?: ChannelLimitsInput | undefined;
 };
@@ -79,7 +86,8 @@ export type WhatsAppConfigure = ChannelConfigureBase & Pick<WhatsAppBinding, 'ph
     readonly provider?: ChannelProvider | undefined;
 };
 export type InstagramConfigure = ChannelConfigureBase & Pick<InstagramBinding, 'channel' | 'instagramAccountId' | 'pageId'>;
-export type ChannelConfigure = WhatsAppConfigure | InstagramConfigure;
+export type SmsConfigure = ChannelConfigureBase & Pick<SmsBinding, 'channel' | 'accountSid' | 'phoneNumberSid' | 'phoneNumber'>;
+export type ChannelConfigure = WhatsAppConfigure | InstagramConfigure | SmsConfigure;
 export interface ChannelAddress {
     readonly kind: 'phone' | 'opaque';
     readonly value: string;
@@ -130,6 +138,8 @@ export interface ChannelEvent {
     readonly code?: string;
 }
 export interface ChannelInbound {
+    /** Authenticated provider opt-out control, never model input. */
+    readonly control?: 'stop' | 'start' | 'help';
     readonly providerId: string;
     readonly address: ChannelAddress;
     readonly eventAt: number;
@@ -179,6 +189,27 @@ export declare function publicChannelBinding(binding: ChannelBinding): {
     actor: string;
     readyRevision?: number | undefined;
     readyAt?: number | undefined;
+} | {
+    channel: "sms";
+    provider: "twilio";
+    accountSid: string;
+    phoneNumberSid: string;
+    phoneNumber: string;
+    id: string;
+    tenant: TenantRef;
+    apiKeySecret: string;
+    deploymentId: string;
+    capabilities: readonly ChannelCapability[];
+    supportEmail: string;
+    revision: number;
+    generation: number;
+    state: "paused" | "enabled" | "disconnected";
+    limits: ChannelLimits;
+    createdAt: number;
+    updatedAt: number;
+    actor: string;
+    readyRevision?: number | undefined;
+    readyAt?: number | undefined;
 } | {
     provider: ChannelProvider;
     phoneNumberId: string;

package/node_modules/@noodle-borg/assistant-gateway/dist/channel-types.js

@@ -15,7 +15,7 @@ export const CHANNEL_DEFAULT_LIMITS = Object.freeze({
     dailyMicroUsd: 20_000_000,
 });
 /** One binding per channel per environment; each channel owns its own provider asset. */
-export const CHANNEL_KINDS = ['whatsapp', 'instagram'];
+export const CHANNEL_KINDS = ['whatsapp', 'instagram', 'sms'];
 export class ChannelError extends Error {
     code;
     constructor(code) {
@@ -39,7 +39,11 @@ export function channelAssetKey(channel, assetId) {
         : `asset:${channel}:${channelDigest(assetId)}`;
 }
 export function channelBindingAsset(binding) {
-    return channelAssetKey(binding.channel, binding.channel === 'whatsapp' ? binding.phoneNumberId : binding.instagramAccountId);
+    return channelAssetKey(binding.channel, binding.channel === 'sms'
+        ? binding.phoneNumber
+        : binding.channel === 'whatsapp'
+            ? binding.phoneNumberId
+            : binding.instagramAccountId);
 }
 export function channelParticipantId(binding, address) {
     return `p_${createHmac('sha256', Buffer.from(binding.indexKey, 'base64'))
@@ -80,7 +84,7 @@ export async function writeChannelEvent(tx, scope, event, now) {
 }
 /** WhatsApp rows are stored without `channel`, byte-identical to rows written before Instagram. */
 function storedChannelBinding(binding) {
-    if (binding.channel === 'instagram')
+    if (binding.channel !== 'whatsapp')
         return binding;
     const { channel: _whatsapp, ...stored } = binding;
     return stored;
@@ -91,7 +95,9 @@ export function channelBindingRow(binding, now) {
 /** Rows written before Instagram carry no `channel`; they are WhatsApp. Nothing is written back. */
 export function readChannelBinding(stored) {
     const binding = stored;
-    return binding.channel === 'instagram' ? binding : { ...binding, channel: 'whatsapp' };
+    return binding.channel === 'instagram' || binding.channel === 'sms'
+        ? binding
+        : { ...binding, channel: 'whatsapp' };
 }
 export function publicChannelBinding(binding) {
     const { indexKey: _privateIndexKey, credentialDigest: _credentialDigest, ...visible } = storedChannelBinding(binding);

package/node_modules/@noodle-borg/authoring/dist/assistant.d.ts

@@ -224,7 +224,7 @@ export interface PublicWebsiteAccess {
 }
 export interface PublicMessagingInput {
     /** One surface per channel; the operator binds each channel's account separately. */
-    readonly channel: 'whatsapp' | 'instagram';
+    readonly channel: 'whatsapp' | 'instagram' | 'sms';
     readonly capabilities: readonly CapabilityRef[];
     readonly instructions?: string;
     /** @see AuthenticatedWebsiteInput.history */