@noodleseed/one 0.189.0 → 0.190.1

package/node_modules/@noodle-borg/agent-kit/dist/curated/error-fixes.js

@@ -76,6 +76,7 @@ export const ERROR_FIXES = {
     interaction_field_control_mismatch: 'Match each control to the action input type: `consent` needs `z.literal(true)`, `select` needs `z.enum([...])` of strings, and `text`/`textarea`/`email`/`phone`/`url` need a string schema.',
     interaction_field_missing: 'Collect or seed every required action input (a `fields` entry or an `initialValues` entry), mark a not-required field `optional: true`, and let an optional-but-required string accept `""`.',
     interaction_initial_value_unknown: 'Key `initialValues` by an action input property and set `fromOutput` to a property of this opener’s `output` schema.',
+    interaction_initial_value_private: 'Remove this `initialValues` entry and let the platform collect the `private: true` field; the opener’s output comes from the model, so seeding a private field would route its value through the model.',
     interaction_consent_invalid: 'Keep exactly one `control: "consent"` field; the runtime poses one consent question, never several.',
     interaction_expiry_invalid: 'Set `confirmationExpiry.seconds` to a whole number from 1 to 86400; a developer may only shorten the channel profile’s default.',
     channel_dependency_missing: 'Select the opener and its `interaction.action` together in the same `publicMessaging({ capabilities })` list; natural collection needs the confirmed action it prepares.',

package/node_modules/@noodle-borg/agent-kit/dist/generated/surface.js

@@ -182,6 +182,7 @@ export const COMPILE_ERROR_CODES = [
     'interaction_field_control_mismatch',
     'interaction_field_missing',
     'interaction_initial_value_unknown',
+    'interaction_initial_value_private',
     'interaction_consent_invalid',
     'interaction_expiry_invalid',
     'channel_dependency_missing',

package/node_modules/@noodle-borg/agent-kit/dist/skill-embedded-assistant-ref.js

@@ -44,7 +44,7 @@ export function renderEmbeddedAssistantReference() {
         '- `action` is a tool with `annotations.openAction({ confirm: true })` (never read-only) whose fulfilment saves one native record through `connectors.records`.',
         '- `fields` name the action’s Zod input keys with one of seven controls: `text`, `textarea`, `email`, `phone`, `url`, `select` (a `z.enum` of strings) and `consent` (`z.literal(true)`, at most one; the runtime poses the consent question and never infers it).',
         '- Nothing is private by default. `private: true` keeps that value out of the conversation model, transcript, logs and diagnostics. `optional: true` lets a person skip a field; an optional field the schema still requires must accept `""`.',
-        '- `initialValues: { workflow: { fromOutput: "workflow" } }` seeds action inputs from the opener’s `output`; every other required action input must be a field.',
+        '- `initialValues: { workflow: { fromOutput: "workflow" } }` seeds action inputs from the opener’s `output`; every other required action input must be a field. Never seed a `private: true` field: the opener’s output comes from the model, so the compiler refuses it and the platform collects that value privately.',
         '- `confirmationExpiry: { seconds }` may only shorten the channel’s default (ten minutes on WhatsApp), never lengthen it.',
         '- On `publicMessaging`, list the opener and its action together. The compiler reports `channel_dependency_missing` for an opener selected alone and `channel_requirement_unsupported` for a widget, write or external connector call that has no collect interaction.',
         '',

package/node_modules/@noodle-borg/agent-kit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodle-borg/agent-kit",
-  "version": "0.113.0",
+  "version": "0.113.1",
   "license": "Apache-2.0",
   "type": "module",
   "engines": {

package/node_modules/@noodle-borg/assistant-gateway/package.json

@@ -42,7 +42,7 @@
     "@noodle-borg/module-audit": "0.0.0",
     "@noodle-borg/protocol": "0.0.0",
     "@noodle-borg/runtime": "0.0.0",
-    "@noodleseed/assistant": "1.38.0",
+    "@noodleseed/assistant": "1.39.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/node_modules/@noodle-borg/compiler/dist/errors.d.ts

@@ -1,7 +1,7 @@
 import type { AppPackageArtifactV1 } from '@noodle-borg/app-package';
 import type { RuntimeArtifact } from './artifact/types.js';
 import type { PackagedAsset } from './assets.js';
-export type CompileErrorCode = 'invalid_context_provider' | 'yaml_parse_error' | 'invalid_shape' | 'invalid_name' | 'duplicate_name' | 'reserved_name' | 'unsupported_manifest_version' | 'reserved_for_future_version' | 'invalid_operation_ref' | 'external_ref' | 'invalid_schema_ref' | 'unknown_schema_ref' | 'schema_ref_conflict' | 'invalid_expression' | 'expr_unknown_root' | 'expr_root_unavailable' | 'expr_operator_not_allowed' | 'expr_if_not_boolean' | 'unknown_step_ref' | 'forward_step_ref' | 'self_step_ref' | 'duplicate_step_id' | 'invalid_fulfilment' | 'invalid_elicitation_schema' | 'invalid_elicitation_flow' | 'invalid_confirmation_flow' | 'arg_type_mismatch' | 'ambient_context_action' | 'duplicate_resource' | 'duplicate_prompt' | 'duplicate_resource_uri' | 'unsupported_uri_template' | 'duplicate_widget' | 'unknown_widget_tool' | 'unknown_widget_action_tool' | 'duplicate_widget_tool' | 'invalid_widget_binding' | 'invalid_widget_state_handle' | 'widget_html_too_large' | 'widget_html_total_too_large' | 'invalid_asset' | 'invalid_capability_requirement' | 'state_secret_field' | 'invalid_knowledge' | 'knowledge_unhashed' | 'invalid_managed_collection' | 'invalid_variable_declaration' | 'invalid_managed_collection_source' | 'unknown_connector_alias' | 'connector_not_in_catalog' | 'unknown_operation' | 'connector_binding_required' | 'ambiguous_nested_connector_binding' | 'invalid_connector_call_graph' | 'unsupported_credential_profile' | 'credential_scope_mismatch' | 'credential_audience_mismatch' | 'customer_endpoint_auth_required' | 'customer_endpoint_mapping_required' | 'customer_endpoint_unknown_mapping' | 'customer_endpoint_bridge_unsupported' | 'assistant_messaging_unsupported' | 'assistant_capability_unknown' | 'assistant_public_user_reference' | 'assistant_public_effect_unconfirmed' | 'tool_anonymous_requires_identity' | 'interaction_action_invalid' | 'interaction_field_unknown' | 'interaction_field_control_mismatch' | 'interaction_field_missing' | 'interaction_initial_value_unknown' | 'interaction_consent_invalid' | 'interaction_expiry_invalid' | 'channel_dependency_missing' | 'channel_requirement_unsupported' | 'customer_endpoint_action_unsupported' | 'customer_endpoint_surface_unsupported' | 'customer_endpoint_credential_source_unsupported' | 'customer_endpoint_policy_conflict' | 'customer_endpoint_routing_inconsistent' | 'unused_connector_alias' | 'arg_mismatch' | 'agent_guide_invalid' | 'agent_guide_duplicate_workflow' | 'agent_guide_duplicate_example' | 'agent_guide_example_workflow_missing' | 'agent_guide_capability_missing' | 'agent_guide_capability_kind' | 'app_package_sensitive_content';
+export type CompileErrorCode = 'invalid_context_provider' | 'yaml_parse_error' | 'invalid_shape' | 'invalid_name' | 'duplicate_name' | 'reserved_name' | 'unsupported_manifest_version' | 'reserved_for_future_version' | 'invalid_operation_ref' | 'external_ref' | 'invalid_schema_ref' | 'unknown_schema_ref' | 'schema_ref_conflict' | 'invalid_expression' | 'expr_unknown_root' | 'expr_root_unavailable' | 'expr_operator_not_allowed' | 'expr_if_not_boolean' | 'unknown_step_ref' | 'forward_step_ref' | 'self_step_ref' | 'duplicate_step_id' | 'invalid_fulfilment' | 'invalid_elicitation_schema' | 'invalid_elicitation_flow' | 'invalid_confirmation_flow' | 'arg_type_mismatch' | 'ambient_context_action' | 'duplicate_resource' | 'duplicate_prompt' | 'duplicate_resource_uri' | 'unsupported_uri_template' | 'duplicate_widget' | 'unknown_widget_tool' | 'unknown_widget_action_tool' | 'duplicate_widget_tool' | 'invalid_widget_binding' | 'invalid_widget_state_handle' | 'widget_html_too_large' | 'widget_html_total_too_large' | 'invalid_asset' | 'invalid_capability_requirement' | 'state_secret_field' | 'invalid_knowledge' | 'knowledge_unhashed' | 'invalid_managed_collection' | 'invalid_variable_declaration' | 'invalid_managed_collection_source' | 'unknown_connector_alias' | 'connector_not_in_catalog' | 'unknown_operation' | 'connector_binding_required' | 'ambiguous_nested_connector_binding' | 'invalid_connector_call_graph' | 'unsupported_credential_profile' | 'credential_scope_mismatch' | 'credential_audience_mismatch' | 'customer_endpoint_auth_required' | 'customer_endpoint_mapping_required' | 'customer_endpoint_unknown_mapping' | 'customer_endpoint_bridge_unsupported' | 'assistant_messaging_unsupported' | 'assistant_capability_unknown' | 'assistant_public_user_reference' | 'assistant_public_effect_unconfirmed' | 'tool_anonymous_requires_identity' | 'interaction_action_invalid' | 'interaction_field_unknown' | 'interaction_field_control_mismatch' | 'interaction_field_missing' | 'interaction_initial_value_unknown' | 'interaction_initial_value_private' | 'interaction_consent_invalid' | 'interaction_expiry_invalid' | 'channel_dependency_missing' | 'channel_requirement_unsupported' | 'customer_endpoint_action_unsupported' | 'customer_endpoint_surface_unsupported' | 'customer_endpoint_credential_source_unsupported' | 'customer_endpoint_policy_conflict' | 'customer_endpoint_routing_inconsistent' | 'unused_connector_alias' | 'arg_mismatch' | 'agent_guide_invalid' | 'agent_guide_duplicate_workflow' | 'agent_guide_duplicate_example' | 'agent_guide_example_workflow_missing' | 'agent_guide_capability_missing' | 'agent_guide_capability_kind' | 'app_package_sensitive_content';
 export interface CompileError {
     readonly code: CompileErrorCode;
     /** Dotted path to the offending location (e.g. `tools.1.name`); empty string for the document root. */

package/node_modules/@noodle-borg/compiler/dist/manifest/interaction-validation.js

@@ -101,6 +101,13 @@ function validateCollect(interaction, opener, byName, path, errors) {
                 message: `initial value "${target}" is not an input of action "${action.name}"`,
             });
         }
+        else if (interaction.fields.some((field) => field.key === target && field.private === true)) {
+            errors.push({
+                code: 'interaction_initial_value_private',
+                path: valuePath,
+                message: `private field "${target}" is collected by the platform and cannot be seeded from the opener's output`,
+            });
+        }
         else {
             covered.add(target);
         }

package/node_modules/@noodle-borg/service/package.json

@@ -41,7 +41,7 @@
     "@noodle-borg/managed-capabilities": "0.0.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.113.0",
+    "@noodle-borg/agent-kit": "0.113.1",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",
     "@noodle-borg/auth": "0.0.0",

package/node_modules/@noodle-borg/transport-http/dist/handler.js

@@ -124,6 +124,9 @@ export function createMcpRouter(lookup, options = {}) {
                 ...(route?.kind === 'tenant' && route.publicResourceUrl !== undefined
                     ? { publicResourceUrl: route.publicResourceUrl }
                     : {}),
+                ...(route?.kind === 'tenant' && route.clientAddress !== undefined
+                    ? { clientAddress: route.clientAddress }
+                    : {}),
             }, routeId, maxBody, options.allowedOrigins, tenant);
         })()).then(() => logRequest(logger, logId, req, res, start));
     };

package/node_modules/@noodle-borg/transport-http/dist/routing.d.ts

@@ -10,6 +10,8 @@ type ParsedRoute = {
     readonly ref: TenantRouteRef;
     readonly logId: string;
     readonly publicResourceUrl?: string;
+    /** The caller address the edge Worker observed; present only on edge-authenticated routes. */
+    readonly clientAddress?: string;
 } | {
     readonly kind: 'deployment';
     readonly deploymentId: string;

package/node_modules/@noodle-borg/transport-http/dist/routing.js

@@ -15,6 +15,7 @@ export async function resolveRoute(req, pathname, publicTenantRouting) {
         const ref = await publicTenantRouting.resolveTenant(publicRef);
         if (ref === undefined)
             return { ok: true, route: null };
+        const clientAddress = header(req, 'x-noodle-client-address');
         return {
             ok: true,
             route: {
@@ -22,6 +23,7 @@ export async function resolveRoute(req, pathname, publicTenantRouting) {
                 ref,
                 logId: tenantLogId(ref),
                 publicResourceUrl: canonicalPublicResourceUrl(forwardedHost),
+                ...(clientAddress !== undefined ? { clientAddress } : {}),
             },
         };
     }

package/node_modules/@noodle-borg/transport-http/dist/serve-request.js

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto';
-import { trustedPublicAdmission } from '@noodle-borg/admission-limits/portable';
+import { clientAddressBucket, trustedPublicAdmission, } from '@noodle-borg/admission-limits/portable';
 import { createDualEraMcpHandler, handleStatelessHttp, JSON_RPC, } from '@noodle-borg/protocol';
 import { admissionContexts, requestsInvocationContext } from './admission-context.js';
 import { authorizeIdentityMode, authorizeMixedMode, authorizePublicServiceMode, canonicalResourceUrl, isIdentityMode, } from './identity-authorization.js';
@@ -134,6 +134,7 @@ export async function serveRequest(req, res, target, auth, routeId, maxBody, all
         ...(auth.accessMode !== undefined ? { accessMode: auth.accessMode } : {}),
         ...(req.socket.remoteAddress !== undefined ? { remoteAddress: req.socket.remoteAddress } : {}),
     });
+    const callerNetwork = clientAddressBucket(auth.clientAddress);
     for (const context of contexts) {
         const decision = auth.admissionGate
             ? await auth.admissionGate(context)
@@ -148,6 +149,7 @@ export async function serveRequest(req, res, target, auth, routeId, maxBody, all
             ...(context.env !== undefined ? { env: context.env } : {}),
             ...(context.serverVersion !== undefined ? { serverVersion: context.serverVersion } : {}),
             ...(context.accessMode !== undefined ? { accessMode: context.accessMode } : {}),
+            ...(callerNetwork !== undefined ? { callerNetwork } : {}),
             decision: decision.allow ? 'allow' : 'deny',
             ...(decision.reason !== undefined ? { reason: decision.reason } : {}),
         });

package/node_modules/@noodleseed/assistant/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/assistant",
-  "version": "1.38.0",
+  "version": "1.39.0",
   "description": "Embed the Noodle Seed customer-branded assistant in your web app with managed or framework-owned UI, a framework-neutral MCP App host, a DOM-free client, and a backend session helper. Authoring and deploying the server is @noodleseed/one.",
   "license": "Apache-2.0",
   "repository": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/one",
-  "version": "0.189.0",
+  "version": "0.190.1",
   "private": false,
   "description": "Noodle CLI by Noodle Seed — author, run, and deploy declarative MCP servers. Embedding the assistant in your own web app is @noodleseed/assistant.",
   "license": "Apache-2.0",
@@ -236,7 +236,7 @@
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.113.0",
+    "@noodle-borg/agent-kit": "0.113.1",
     "@noodle-borg/app-audit": "0.0.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",