@noodleseed/agent-kit 0.1.0

package/README.md

@@ -0,0 +1,35 @@
+# @noodleseed/agent-kit
+
+Self-checking, self-updating **agent skills** for the [Noodle Seed](https://noodleseed.dev) CLI.
+
+This package is the **canonical, independently-versioned skills artifact** the `noodle` CLI fetches and
+verifies. It is **not** meant to be imported directly by apps — it is shipped as data the CLI reconciles
+into a project's `.agents/` and `.claude/` skill directories via `noodle agents setup --write`.
+
+## Contents
+
+- `skills/codex/SKILL.md` — the Codex (Codex CLI / AGENTS.md) skill body.
+- `skills/claude-code/SKILL.md` — the Claude Code skill body.
+- `manifest.json` — `{ packageVersion, files: [{ path, sha256, agentTarget }] }`. The CLI verifies every
+  file's sha256 against this manifest before writing it into a user's project; a mismatch refuses the
+  write. See [ADR 0102](https://github.com/NoodleSeed-com/noodle-borg/blob/main/docs/decisions/0102-self-checking-skills-via-npm.md).
+
+## How the CLI uses it
+
+The installed `noodle` CLI bundles a skills snapshot at its release version. On interactive runs it
+also checks `@noodleseed/agent-kit@latest` on the npm registry and, when newer, prompts:
+
+```
+Skills updated in vX — run `noodle agents setup --write` to refresh.
+```
+
+`noodle agents setup --write` then fetches this package, sha256-verifies it against the manifest, and
+writes the fresh `SKILL.md` bodies into the project (the managed `AGENTS.md`/`CLAUDE.md` block stays
+bundled, since it is project-specific). Offline or on verification failure it falls back to the bundled
+snapshot. Run `noodle agents doctor` to see installed vs registry skill versions.
+
+## License
+
+Apache-2.0. This package is generated and published from the
+[`noodle-borg`](https://github.com/NoodleSeed-com/noodle-borg) repository; the renderer is the private
+`@noodle-borg/agent-kit` workspace package.

package/manifest.json

@@ -0,0 +1,15 @@
+{
+  "packageVersion": "0.1.0",
+  "files": [
+    {
+      "path": "skills/codex/SKILL.md",
+      "sha256": "d6c7e997cdd2ad1f5150293bc48ce59e431217f74f8f0831ee8d96fdb71ba2a3",
+      "agentTarget": "codex"
+    },
+    {
+      "path": "skills/claude-code/SKILL.md",
+      "sha256": "2364efd4186e8e679f2770a30737a4886f330b9087b2c33698ffdf10456dad6d",
+      "agentTarget": "claude-code"
+    }
+  ]
+}

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@noodleseed/agent-kit",
+  "version": "0.1.0",
+  "private": false,
+  "description": "Self-checking, self-updating agent skills for the Noodle Seed CLI. Authored in this repo by @noodle-borg/agent-kit; this is the published, independently-versioned canonical skills artifact the CLI fetches and verifies.",
+  "license": "Apache-2.0",
+  "type": "module",
+  "engines": {
+    "node": ">=18"
+  },
+  "main": "./manifest.json",
+  "exports": {
+    ".": "./manifest.json",
+    "./manifest.json": "./manifest.json",
+    "./skills/*": "./skills/*"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public"
+  },
+  "files": [
+    "skills/",
+    "manifest.json"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/NoodleSeed-com/noodle-borg",
+    "directory": "packages/agent-kit"
+  },
+  "author": "Noodle Seed",
+  "keywords": [
+    "noodle-seed",
+    "mcp",
+    "agent-skills",
+    "codex",
+    "claude-code"
+  ]
+}

package/skills/claude-code/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: noodle-seed
+description: Use when building, testing, or debugging a local Noodle Seed MCP server or app authored in TypeScript with the noodle CLI.
+version: 0.1.0
+hash: 2154da51ab4a13b3
+---
+
+# Noodle Seed
+
+Use this skill for project-local Noodle Seed authoring in Claude Code. Work from the configured TypeScript entrypoint and preserve generated/user instruction boundaries.
+
+## SDK surface
+
+Import from `@noodleseed/one`: `server`, `tool`, `toolWithWidget`, `toolForWidget`, `resource`, `prompt`, `widget`, `connector` (`.http()`/`.compute()`/`.version()`), `annotations`, `asset`, `handoffSession`, `when`, `ui`, and `z`. These are the declarative builders that emit manifest data — do not hand-author the manifest/runtime artifact.
+
+## CLI surface
+
+- Authoring: `noodle init`, `noodle import openapi <file>`, `noodle export manifest`, `noodle validate`, `noodle test`.
+- Local run: `noodle dev`, `noodle check`, `noodle devtools`, `noodle tools`, `noodle resources`, `noodle prompts`.
+- Hosted: `noodle login`, `noodle logout`, `noodle whoami`, `noodle orgs`, `noodle connect`, `noodle link`, `noodle deploy`, `noodle status`, `noodle open`, `noodle access`.
+- Config: `noodle secrets set`, `noodle variables set`, `noodle agents setup`.
+
+## Input paths
+
+1. **Website scrape** — if the user provides a URL, scrape it for surface hints (products, services, hours, contact, pricing). Stop there: the URL does not reveal CRM, booking systems, custom APIs, auth model, eligibility rules, quoting logic, or approval flows. Those live in the business systems and the owner head — ask.
+2. **OpenAPI import** — `noodle import openapi <file>` emits a starter `server.ts` from a spec. Use it when the user provides an OpenAPI document.
+3. **User interview** — Noodle does not interview; you do. Cover: custom APIs/integrations, eligibility rules, quoting/approval logic, and private schemas (SQL DDL or JSON samples for custom `connector` declarations). Do: ask for concrete examples and sample payloads. Do not: guess a schema from a URL or invent endpoints.
+
+## Repair loop
+
+Run `noodle validate`, read the errors, fix the specific errors cited (the `path` locates the field, `expected`/`got`/`didYouMean?`/`suggestions?` describe the fix), then re-validate. Do not freeform re-edit. Once `noodle validate` passes, run `noodle test` for a local MCP smoke, then `noodle dev` to serve.
+
+## Secrets and variables
+
+Use `noodle secrets set` and `noodle variables set` for runtime configuration. Keep secrets, bearer tokens, refresh tokens, static access keys, `.env.noodle` values, and `~/.noodle/config.json` out of prompts, logs, docs, tests, and generated files. Hosted access is identity-based — do not add static data-plane credential paths.
+
+## Customization
+
+This skill is regenerated by `noodle agents setup --write`. For project-specific standards, create a separate skill; do not edit this file.
+
+## Boundaries
+
+Do not hand-author manifest JSON/YAML, runtime artifacts, connector IR, or hosted asset metadata. Do not read or copy secrets, bearer tokens, refresh tokens, static access keys, `.env.noodle`, or `~/.noodle/config.json`.

package/skills/codex/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: noodle-seed
+description: Use when building, testing, or debugging a local Noodle Seed MCP server or app authored in TypeScript with the noodle CLI.
+version: 0.1.0
+hash: 558cd059cf167f41
+---
+
+# Noodle Seed
+
+Use this skill for local Noodle Seed project work. Start from the project entrypoint, usually `server.ts`, and keep the authoring surface TypeScript-only.
+
+## SDK surface
+
+Import from `@noodleseed/one`: `server`, `tool`, `toolWithWidget`, `toolForWidget`, `resource`, `prompt`, `widget`, `connector` (`.http()`/`.compute()`/`.version()`), `annotations`, `asset`, `handoffSession`, `when`, `ui`, and `z`. These are the declarative builders that emit manifest data — do not hand-author the manifest/runtime artifact.
+
+## CLI surface
+
+- Authoring: `noodle init`, `noodle import openapi <file>`, `noodle export manifest`, `noodle validate`, `noodle test`.
+- Local run: `noodle dev`, `noodle check`, `noodle devtools`, `noodle tools`, `noodle resources`, `noodle prompts`.
+- Hosted: `noodle login`, `noodle logout`, `noodle whoami`, `noodle orgs`, `noodle connect`, `noodle link`, `noodle deploy`, `noodle status`, `noodle open`, `noodle access`.
+- Config: `noodle secrets set`, `noodle variables set`, `noodle agents setup`.
+
+## Input paths
+
+1. **Website scrape** — if the user provides a URL, scrape it for surface hints (products, services, hours, contact, pricing). Stop there: the URL does not reveal CRM, booking systems, custom APIs, auth model, eligibility rules, quoting logic, or approval flows. Those live in the business systems and the owner head — ask.
+2. **OpenAPI import** — `noodle import openapi <file>` emits a starter `server.ts` from a spec. Use it when the user provides an OpenAPI document.
+3. **User interview** — Noodle does not interview; you do. Cover: custom APIs/integrations, eligibility rules, quoting/approval logic, and private schemas (SQL DDL or JSON samples for custom `connector` declarations). Do: ask for concrete examples and sample payloads. Do not: guess a schema from a URL or invent endpoints.
+
+## Repair loop
+
+Run `noodle validate`, read the errors, fix the specific errors cited (the `path` locates the field, `expected`/`got`/`didYouMean?`/`suggestions?` describe the fix), then re-validate. Do not freeform re-edit. Once `noodle validate` passes, run `noodle test` for a local MCP smoke, then `noodle dev` to serve.
+
+## Secrets and variables
+
+Use `noodle secrets set` and `noodle variables set` for runtime configuration. Keep secrets, bearer tokens, refresh tokens, static access keys, `.env.noodle` values, and `~/.noodle/config.json` out of prompts, logs, docs, tests, and generated files. Hosted access is identity-based — do not add static data-plane credential paths.
+
+## Customization
+
+This skill is regenerated by `noodle agents setup --write`. For project-specific standards, create a separate skill; do not edit this file.
+
+## Boundaries
+
+Do not hand-author manifest JSON/YAML, runtime artifacts, connector IR, or hosted asset metadata. Do not read or copy secrets, bearer tokens, refresh tokens, static access keys, `.env.noodle`, or `~/.noodle/config.json`.