@noodleseed/agent-kit 0.100.0 → 0.102.0

package/skills/claude-code/examples/acme-bistro/test/server.test.ts

@@ -19,13 +19,13 @@ describe('acme-bistro example', () => {
     expect(text).toContain('create_checkout');
   });
 
-  it('declares reusable guest-request record intent without generating a submit tool', async () => {
+  it('declares guest records and explicitly authors the native submission tool', async () => {
     const manifest = await app.toManifest();
     expect(manifest.server.collections).toEqual([
       expect.objectContaining({ name: 'guest_requests', schemaVersion: 1 }),
     ]);
-    expect(manifest.tools).not.toContainEqual(
-      expect.objectContaining({ name: 'submit_guest_requests' }),
-    );
+    expect(
+      manifest.tools.find((tool) => tool.name === 'submit_guest_request')?.fulfilment.steps,
+    ).toMatchObject([{ use: 'records.submit_record' }]);
   });
 });

package/skills/claude-code/examples/acme-tasks/README.md

@@ -1,16 +1,11 @@
 # Acme Tasks — designed around its top-3 prioritized user flows
 
-A Noodle MCP App for **Acme Tasks**, a fictional productivity tool. It is the flagship for
-**designing an app around its prioritized user flows**: a two-way (read + write) experience where the
-top-3 flows — **Capture, Prioritize, Complete** — all happen in chat, each mapped to a tool and surfaced
-in one `TaskList` widget. It shows the "identify and prioritize the flows first, then build" discipline
-the `noodle-seed` skill's `references/experience-design.md` teaches.
-
-Capability slots: prioritized multi-flow app design, a two-way (read + write) in-chat pattern, a task-list
-widget with `tool` helpers, and a worked **design-first** artifact (the flow spec + wireframe
-below). A real deployment would connect the user's account with the end-user auth pattern — see
-[`../customer-auth/README.md`](../customer-auth/README.md); this example seeds a list so the focus stays
-on the flows.
+A fictional productivity MCP App demonstrating three prioritized flows: **Capture, Prioritize, Complete**.
+Each maps to a tool and the shared `TaskList` widget. The design spec and wireframe demonstrate the
+`noodle-seed` skill's `references/experience-design.md` workflow: prioritize user flows before building.
+
+This read/write example uses fictional seed data. A real deployment connects the user's account through
+[customer authentication](../customer-auth/README.md).
 
 ## Design spec (write this before the code)
 
@@ -150,3 +145,8 @@ do not introduce a second lockfile.
 
 This example has no connector secrets and does not include tokens, caller-key mechanisms, or
 `.env.noodle` values. All tasks are fictional seed data.
+
+## Collection scope
+
+Schema compilation is not hosted activation. External systems are changed through application tools;
+a local read-only replica does not create a second writable authority.

package/skills/claude-code/examples/gmail-multi-account/README.md

@@ -1,31 +1,15 @@
 # Gmail multi-account automation
 
-**Owns:** The flagship proof that one reusable connector can be bound to multiple independently
-authenticated accounts inside one MCP server.
+**Owns:** One reusable connector bound to independently authenticated accounts in one MCP server.
 
-This fictional example binds `gmailConnector()` twice through separate `externalExchange()` logical
-connections. Public tools always accept `accounts: [...]`; reads accept either account or the canonical
-personal-then-work pair, while mutations accept exactly one account and require runtime confirmation.
+[`src/server.ts`](src/server.ts) binds `gmailConnector()` twice using `externalExchange()`. Its
+`accounts` input selects either account or the ordered personal/work pair for reads. Mutations select
+one account and require confirmation against that binding. The displayed email labels are fictional;
+operators supply real authorization through the credential provider.
 
-Capability slot: **reusable connector + independently authenticated multi-account bindings**. It is distinct
-from `customer-auth`, which owns authentication of the MCP caller rather than downstream connector accounts.
-
-The labels `personal@example.com` and `work@example.com` are static display labels, not provider identities.
-The deployment-owned credential provider maps each logical connection to its real Google authorization.
-No Google client, provider account id, token, or real email address belongs in this project.
-
-## Safety and API boundary
-
-- Search, message/thread reads, draft reads, and vacation-setting reads may target one or both accounts.
-- Draft creation/update/send, label changes, archive, raw send, trash, and vacation updates target one account.
-- Every mutation is prepared against the exact selected binding and must be confirmed before dispatch.
-- `send_message.raw` and draft `raw` are RFC 2822 MIME bytes encoded with base64url. This example does not
-  pretend that `to`/`subject`/`body` strings are sufficient to encode Unicode MIME correctly.
-- Vacation `startTime`/`endTime` schemas enforce only digit-shaped 1–19 character epoch-millisecond strings.
-  When both are supplied, Gmail's backend remains authoritative for the required `startTime < endTime`
-  relationship; this example does not claim cross-field JSON Schema validation.
-- Trash is reversible. Permanent message/thread/draft deletion, delegation, forwarding/sharing settings,
-  and unrestricted raw HTTP requests are intentionally absent.
+- Message/draft `raw` values are base64url-encoded RFC 2822 MIME, not separate address/body fields.
+- Vacation timestamps validate digit shape; Gmail enforces the start-before-end relationship.
+- Trash is reversible. Permanent deletion, sharing/delegation and arbitrary HTTP requests are absent.
 
 ## Local checks
 
@@ -34,13 +18,51 @@ noodle validate
 noodle test
 ```
 
-The committed tests compile hermetic fake connector responses. They never contact Gmail or load OAuth
-credentials. A real deployment additionally needs an operator-provided external credential exchange
-endpoint for each logical connection.
+Tests use fake responses; they do not prove live Gmail authorization. Hosted execution requires an
+operator-provided external credential exchange for each logical connection. The installed skill's
+`references/authoring-workflow.md` owns binding and credential setup guidance.
+
+## Optional application-owned gateway
+
+The executable example calls Gmail directly. An application-owned gateway may additionally require a
+service key. Gmail does not require this key, and this example supplies no gateway implementation:
+
+```ts
+import {
+  bind, connection, connector, externalExchange, secret, variable, z,
+} from '@noodleseed/one';
+
+const gateway = connector('mail_gateway').version('1.0.0').http({
+  baseUrl: variable('MAIL_GATEWAY_URL'),
+  allowedOrigins: ['https://gateway.example.com'],
+  transportAuth: {
+    kind: 'apiKey',
+    header: 'X-Gateway-Key',
+    secret: secret('MAIL_GATEWAY_KEY'),
+  },
+  credentialProfiles: { account: { kind: 'bearer' } },
+  operations: {
+    inspect: {
+      type: 'read', method: 'POST', path: '/inspect',
+      credentials: { profiles: ['account'] },
+      input: z.object({}),
+      output: z.object({ available: z.boolean() }),
+    },
+  },
+});
+
+// Register this binding under server(..., { use: { mail: mailGateway } }, ...).
+const mailGateway = bind(gateway, {
+  profile: 'account',
+  connection: connection('work_mail', externalExchange()),
+});
+```
+
+The operator configures the gateway URL/key and account separately. The broker resolves both credentials;
+neither belongs in tool arguments or ordinary headers. The authored compile test checks this composition,
+not live gateway access. See the installed skill's `references/authoring-workflow.md` for transport rules.
 
 ## Personal automation skill
 
-The source skill is [`skills/personal-email-automation/SKILL.md`](skills/personal-email-automation/SKILL.md).
-Validate it with the standard skill validator before distribution. The source skill is shipped as part of
-this example; canonical export of an app and its skill as an installable Codex plugin remains roadmap work
-and is not currently provided by Noodle Seed.
+[`skills/personal-email-automation/SKILL.md`](skills/personal-email-automation/SKILL.md) is the source skill;
+validate it before distribution. Canonical app-plus-skill plugin export remains roadmap work.

package/skills/claude-code/examples/weather/src/server.ts

@@ -158,8 +158,8 @@ const placeNarrow = connector('geo_places')
     type: 'read',
     input: z.object({ results: z.unknown().optional() }),
     output: z.object({ places: z.array(z.unknown()) }),
-    // Self-contained: no imports, no closure over outer variables, synchronous.
-    run: (input) => {
+    // Synchronous and self-contained.
+    run: (input, host) => {
       const raw = input.results;
       const list = Array.isArray(raw) ? raw : [];
       const places = list.map((entry) => {
@@ -169,7 +169,7 @@ const placeNarrow = connector('geo_places')
         const id =
           entry.id !== undefined && entry.id !== null
             ? String(entry.id)
-            : `${entry.latitude},${entry.longitude}`;
+            : host.digest(`${entry.latitude},${entry.longitude}`);
         return { id, label: parts.join(', ') };
       });
       return { places };

package/skills/claude-code/executing-noodle-plans/SKILL.md

@@ -3,7 +3,7 @@ name: executing-noodle-plans
 description: "Use when the user asks to execute an approved, decision-complete implementation plan for a Noodle Seed project task by task with test-first changes, review, recovery, and final verification."
 ---
 
-<!-- noodle-skill version:0.100.0 hash:6a9f132ddb79352e -->
+<!-- noodle-skill version:0.102.0 hash:6a9f132ddb79352e -->
 
 # Execute a Noodle Seed implementation plan
 

package/skills/claude-code/publishing-mcp-integrations/SKILL.md

@@ -3,7 +3,7 @@ name: publishing-mcp-integrations
 description: "Use when preparing, reviewing, or submitting a Noodle Seed MCP integration to a host or app directory."
 ---
 
-<!-- noodle-skill version:0.100.0 hash:0ccafb222038f553 -->
+<!-- noodle-skill version:0.102.0 hash:0ccafb222038f553 -->
 
 # publishing-mcp-integrations
 

package/skills/claude-code/references/authoring-workflow.md

@@ -42,11 +42,14 @@ Author in `server.ts`, then `noodle validate` → fix cited errors (see `compile
 
 ## Connectors
 
-Declare connectors as data, not imperative code:
+Declare typed connectors:
 
-- **HTTP**: `connector("id").version("1.0.0").http({ baseUrl, allowedOrigins, auth, operations })` with per-operation `request`/`response` mapping using `${args...}` / `${response...}` expressions.
+- **HTTP**: `connector("id").version("1.0.0").http({ baseUrl, allowedOrigins, auth, operations })`; map request/response with `${args...}` / `${response...}`. Use `${execution.id}` for provider idempotency, never model input. Optional `evidence: { outcome: "${response.execution_outcome}", reference: "${response.id}" }` classifies completed/rejected/accepted/unknown; reference is a bounded opaque ID, never a bearer URL or payload. No automatic action retry.
 - **MCP**: `connector("id").version("1.0.0").mcp({ endpoint, allowedOrigins, auth?, operations })` where each operation freezes the separate upstream `tool` wire name plus input/output schema. Import with `noodle import mcp`; do not hand-copy a live surface or call `tools/list` at runtime.
 - **Compute**: `connector("id").version("1.0.0").compute(name, { input, output, calls?, run })` — a self-contained, sandboxed function (no imports/closure capture) that may call allowlisted operations via `callOperation`.
+- **Explicit helpers**: `run: (input, host) => ...` can use `host.time.parse(iso)`, `host.time.format(epochMs)`, `host.time.parts(epochMs, timeZone)` and `host.digest(text, "hex")` (or `"base32hex"`). They convert bounded explicit data; there is no ambient clock. Pass trusted `context.temporal.instant` through fulfilment when current time is needed. `examples/weather` demonstrates a stable digest fallback for provider records without IDs.
+- **Expected HTTP errors**: declare `responses: { "409": { response: { status: "conflict" }, evidence: { outcome: "rejected" } } }` alongside the ordinary success `response`. Explicit 4xx overrides exclude 401/403/429; validate against the same output schema. Undeclared errors still fail. Overrides never inherit successful completion evidence or introduce action retries.
+- **Coordinated external actions**: a compute action may declare `coordination: { connectionId, namespace, key: "${args.resource}", reference: "${execution.id}" }` with a bounded execution deadline. It requires an installed application with a live bound connection and durable service coordination. Read `host.coordination.acquired` before writing; a blocked invocation may inspect `previous` through a declared read and call `host.resolveCoordination()` only after exact source proof, then require a fresh invocation/confirmation. The runtime permits at most one nested action when acquired and zero when blocked, even after recovery. Report explicit completed/rejected/unknown evidence with `host.reportOutcome(...)`; a successful return alone never unlocks uncertainty. Do not create an external-record collection for this.
 
 Tools record connector calls into a flow; recording is not execution. Do not branch on runtime outputs with native `if` — use declarative `when(...)` conditions.
 
@@ -58,6 +61,7 @@ not imported or forwarded. The runtime opens one guarded session for one operati
 credential, and closes it; it does not act as an agent for upstream sampling, roots, or elicitation.
 
 HTTP connector auth variants: `bearer` (`{ kind: "bearer", secret: secret("API_TOKEN") }`), `apiKey` (`{ kind: "apiKey", header: "X-API-Key", secret: secret("API_KEY") }`), `clientCredentials`, `delegatedOAuth`, `delegatedSessionCookie`, and `delegatedTokenExchange` (per-user calls to your own API — see "Delegated downstream auth" below). Use managed `secret(...)` / `variable(...)` refs for all values that differ by org/app/env.
+An application-owned adapter may require its own service credential in addition to the operator account credential. Declare `http.transportAuth: { kind: "apiKey", header: "X-Adapter-Key", secret: secret("ADAPTER_SERVICE_KEY") }` alongside bound account credential profiles; the credential broker supplies the two independently. Never put either credential in tool arguments or ordinary headers, and never reuse an inbound MCP bearer. This capability does not imply a provider requires two credentials.
 
 When one connector needs independently selectable accounts, declare catalog `credentialProfiles` plus each operation’s accepted `credentials.profiles`, then bind each `server.use` alias with `bind(connector, { profile, connection: connection("logical_id", managedSecret(secret("NAME"), { scopes, audience })) })`. The alias is the stable account boundary; never put provider account ids, labels, or credential values in it. `gmailConnector()` is the curated Gmail catalog helper; reuse it under independent aliases and accept canonical `accounts` arrays in tools (one account for writes, or an explicitly ordered supported combination for reads). See the bundled `gmail-multi-account` flagship. Bound managed secrets are supported by hosted execution. For deployed-server access to Google APIs, use `googleWorkloadIdentity({ provider: variable("GOOGLE_WIF_PROVIDER"), access: { kind: "direct" } })`, or add `serviceAccountImpersonation` with a managed service-account email. This is keyless Google Workload Identity Federation: exact Google scopes/audience come from the catalog operation, while `noodle auth google prepare|status|doctor|revoke` owns operator lifecycle. See the bundled `google-bigquery` flagship. `externalExchange()` is runnable only when the deployment operator injects an exact HTTPS provider endpoint/origin/audience and durable shared subject-pin store through service ports; Noodle sends a short-lived platform-signed deployment workload assertion and accepts only a bounded bearer response. Provider implementations must consume assertion replay ids through durable shared atomic storage across instances and restarts. There is intentionally no hosted enrollment or provider CRUD surface yet. The provider wire contract is public, but its conformance kit is workspace/source-only and is not an installable npm package. Bound `clientCredentials(...)` remains fail-closed until its provider slice lands.
 
@@ -408,6 +412,12 @@ Adapt the representative arguments and assertions when business contracts change
 
 Author managed config as `secret("NAME")` / `variable("NAME")` and operate it with `noodle secrets set` / `noodle variables set` (scoped org/app/env). Never inline secret values in `server.ts`, tests, or generated files.
 
+For business-editable configuration, declare `const guestExperience = variable("GUEST_EXPERIENCE", { schema: z.object({ notice: z.string().max(500) }), default: { notice: "Welcome" }, portal: { label: "Guest experience" }, requiredFor: ["show_menu"] })` and register it in `server(..., { variables: [guestExperience], ... }, tools)`. Use the whole ref or `guestExperience.field("notice")` in ordinary fulfilment/connector arguments. `.field()` selects a schema-declared object property, can chain for nested objects, and retains the parent variable and full configuration snapshot; it never reads operator data at author time. Keep confirmed action arguments shallow enough for complete review; do not label ordinary settings sensitive to bypass the review. The default is reusable safe intent; each business supplies its own values without editing source. Only explicit `portal` metadata exposes a setting. Name-only references and declared variables without `portal` remain technical configuration; secrets remain credential slots. See the bundled `acme-bistro` source.
+
+Business schemas must be bounded: booleans, finite bounded numbers, bounded text, string enums, bounded arrays, and closed objects. Put defaults in the declaration, not inside Zod schema defaults; custom transforms/refinements and arbitrary schema code cannot run in the shared runtime. `requiredFor` names existing tools whose invocation needs the value; unresolved settings must leave only dependent capabilities unavailable. Publisher compilation does not require a future buyer’s values. Application code enforces business rules server-side; exposing a control or placing the rule in a prompt is insufficient.
+
+For an installed application, use the same `noodle variables list|resolve|set|delete` family with `--installation <id> --org <org> --runtime cloud|other`; do not combine it with app/env/scope flags or secrets. Inspection shows schema metadata, provenance, readiness and revision without saved values. Set inputs are JSON (including quotes for strings), read the current projection and save atomically; `--expected-revision <digest>` pins an explicit prior inspection. Delete resets to the current declared default or unset state. Business-administrator permission is required for mutations, conflicts never retry writes, and mutation output excludes values.
+
 ## Embedded assistant
 
 To place the same server tools inside a SaaS web app, declare `assistant: embeddedAssistant(...)` alongside the one server-level brand kit. Read `embedded-assistant.md` before integrating: it owns the HTTPS-origin rule, managed model configuration, required deploy-before-client sequence, customer-backend exchange, browser mount, and verification checklist.
@@ -445,8 +455,13 @@ The managed crawler and managed index are the defaults and need no configuration
 ## Managed collections
 
 Use `managedCollection(name, { title, description, schemaVersion, record })` when an application needs reusable typed intent for business records that Noodle may later hold. Pass it through `server(..., { collections: [...] }, definitions)`. `record` is one bounded, closed Zod object; names use lowercase letters, numbers, and underscores. Keep payment-card, credentials, passport/government identity, health, and biometric fields out of this surface.
+Native record controls are independent: `management: { assignment: true }`, `{ notes: true }`, both, or neither. Status is an ordinary application field such as `progress: z.enum(["received", "reviewing", "handled"]).default("received")`; no framework transition graph exists. Declare `publicFields` explicitly (default empty), `editableFields` for authorized staff (default all schema properties), optional field labels/help, `summaryFields`, `filterFields` and `sortFields`. References must name actual fields and filters/sorts select scalars. Public callers cannot set staff-only fields; a required private field needs a valid creation default. Staff updates merge only admitted fields and revalidate the complete record. See the notes-only `acme-bistro` collection.
+Operator record queries use `noodle solutions records list --filters '[{"field":"progress","value":"received"}]' --sort-field progress`. Only declared scalar equality/sort fields apply. Payload queries scan at most 10,000 candidates; narrow `--created-at-from`/`--created-at-to` if the API returns `query_limit_exceeded`. Ordinary listing/export has no such scan cap. Cursor reuse requires unchanged query/schema and anchor revision. An administrator can explicitly migrate an eligible historical request with `records migrate-schema ... --expected-revision N`; never implement read-time rewrites.
+
+Omitting `source` makes Noodle authoritative for the collection. To project a read-only collection from an outside system, bind an HTTP connector in `server(..., { use: [...] })` and add `source: { connector: connector.ref(), scan: "scan_operation" }`. The compiler requires the exact normalized scan contract and the same record schema. Noodle ingests a one-way replica; create, update, and delete in the outside system remain ordinary application tools with their own confirmation and policy.
 
-This declaration compiles schema metadata only. It does not create a submit tool, grant access, select retention or residency, provision storage, or make records available to MCP or the embedded assistant. Operators bind lifecycle and authority separately. Until the service intake path is shipped, keep live business operations on their existing connector tools.
+For an explicitly authored native operation, bind `use: { records: noodlePlatform.records.v1 }` and call `connectors.records.submitRecord({ collection: "guest_requests", payload: input })` from an ordinary confirmed tool. Submission accepts only public fields and returns a receipt. `createRecord`, `getRecord`, `listRecords`, `updateRecord`, and `deleteRecord` require a verified platform caller with a live business grant; updates/deletes require the current revision. `updateRecord({ collection, id, expectedRevision, patch, unset: ["optional_field"] })` removes named optional editable fields; omitted keys stay unchanged, `null` is data, and overlap with `patch`, required fields or undeclared fields is rejected. Runtime identity supplies write idempotency and admission; never accept those controls as model arguments. An uninstalled collection is unavailable, including during local tool execution.
+A collection declaration does not create a submit tool, grant access, select retention or residency, provision storage, or expose records to MCP or an embedded assistant. Operators activate the definition and configure lifecycle, access, and any external binding. A connector does not become a collection unless the app explicitly supplies the source contract, and an external collection never becomes a writable mirror.
 
 ## Boundaries
 

package/skills/claude-code/references/compile-errors.md

@@ -59,10 +59,14 @@ Run `noodle validate` (add `--json` for the machine-readable envelope, `--fix-pr
 | `invalid_knowledge` | Fix the `knowledge()` declaration: documents must be existing UTF-8 `.md`/`.txt` files inside the project root (no symlinks), within the 100-file / 1 MiB / 25 MiB bounds, and sites need an exact HTTPS origin plus at least one include glob. |
 | `knowledge_unhashed` | Compile from the project root (`noodle validate`/`noodle dev`) so declared knowledge documents can be read and hashed. |
 | `invalid_managed_collection` | Fix the `managedCollection()` declaration: use a bounded, closed Zod object without credential, payment-card, government-identity, health, or biometric field names. |
+| `invalid_variable_declaration` | Fix the typed `variable()` declaration: use a bounded closed schema, a matching JSON default, plain Portal metadata, existing requiredFor tool names, and one consistent definition per key. |
+| `invalid_managed_collection_source` | Bind the declared source connector and select read-only scan operations whose closed normalized envelopes use the collection record schema exactly. |
 | `unknown_connector_alias` | The tool calls a connector alias not declared in `use`/`provides`; add it or fix the alias (see `suggestions`). |
 | `connector_not_in_catalog` | The referenced connector is not in the resolved catalog; add it to the project connectors or correct the reference. |
 | `unknown_operation` | The connector has no such operation; use an operation declared on that connector (see `didYouMean`/`suggestions`). |
 | `connector_binding_required` | Bind the connector alias with `bind(connector, { profile, connection })`; credential-requiring operations cannot use an unbound alias. |
+| `ambiguous_nested_connector_binding` | Keep one exact bound alias for each connector/version reached by compute; do not let a nested call guess between authorized accounts. |
+| `invalid_connector_call_graph` | Regenerate the system-owned connector catalog from TypeScript and correct missing, cyclic, excessive or mismatched declared compute calls. |
 | `unsupported_credential_profile` | Select a credential profile declared by the connector and accepted by the operation; use the reported suggestions instead of inventing a profile name. |
 | `credential_scope_mismatch` | Declare a connection source whose scopes include every operation-required scope, or select an external exchange provider that can mint them. |
 | `credential_audience_mismatch` | Set the connection source audience to the operation-required audience exactly, or use an external exchange provider that can mint it. |

package/skills/claude-code/references/sdk-surface.md

@@ -37,7 +37,7 @@ Platform helper connectors are explicit subpath imports from `@noodleseed/one/pl
 ### Managed config
 
 - `secret("NAME")` — reference a managed secret (operated via `noodle secrets`).
-- `variable("NAME")` — reference a managed variable (operated via `noodle variables`).
+- `variable("NAME")` — reference managed configuration; add `{ schema, default?, portal?, requiredFor? }` and register in `server.variables` for typed business settings. Operate through `noodle variables` or authorized Portal settings.
 
 ### Customer auth
 
@@ -67,6 +67,7 @@ Platform helper connectors are explicit subpath imports from `@noodleseed/one/pl
 - `managedSecret`
 - `meilisearch`
 - `noodleManaged`
+- `noodlePlatform`
 - `openAICompatible`
 - `publicWebsite`
 - `site`

package/skills/claude-code/reporting-noodle-feedback/SKILL.md

@@ -3,7 +3,7 @@ name: reporting-noodle-feedback
 description: "Use when a Noodle Seed bug, misleading instruction, missing capability, or concrete product improvement should be proposed to the user."
 ---
 
-<!-- noodle-skill version:0.100.0 hash:660cc6ad9469d90f -->
+<!-- noodle-skill version:0.102.0 hash:660cc6ad9469d90f -->
 
 # reporting-noodle-feedback
 

package/skills/claude-code/verifying-mcp-delivery/SKILL.md

@@ -3,7 +3,7 @@ name: verifying-mcp-delivery
 description: "Use when proving a Noodle Seed MCP project works at a named compile, local, connector, App, host, deployment, or production evidence level."
 ---
 
-<!-- noodle-skill version:0.100.0 hash:292253cbaed9a3c5 -->
+<!-- noodle-skill version:0.102.0 hash:292253cbaed9a3c5 -->
 
 # verifying-mcp-delivery
 

package/skills/claude-code/wrapping-existing-applications/SKILL.md

@@ -3,7 +3,7 @@ name: wrapping-existing-applications
 description: "Use when an existing application has no stable usable API and needs a read-only, identity-first Noodle Seed integration plan before implementation."
 ---
 
-<!-- noodle-skill version:0.100.0 hash:379ab9f64878f1fe -->
+<!-- noodle-skill version:0.102.0 hash:379ab9f64878f1fe -->
 
 # wrapping-existing-applications
 

package/skills/claude-code/wrapping-existing-applications/references/authoring-workflow.md

@@ -42,11 +42,14 @@ Author in `server.ts`, then `noodle validate` → fix cited errors (see `compile
 
 ## Connectors
 
-Declare connectors as data, not imperative code:
+Declare typed connectors:
 
-- **HTTP**: `connector("id").version("1.0.0").http({ baseUrl, allowedOrigins, auth, operations })` with per-operation `request`/`response` mapping using `${args...}` / `${response...}` expressions.
+- **HTTP**: `connector("id").version("1.0.0").http({ baseUrl, allowedOrigins, auth, operations })`; map request/response with `${args...}` / `${response...}`. Use `${execution.id}` for provider idempotency, never model input. Optional `evidence: { outcome: "${response.execution_outcome}", reference: "${response.id}" }` classifies completed/rejected/accepted/unknown; reference is a bounded opaque ID, never a bearer URL or payload. No automatic action retry.
 - **MCP**: `connector("id").version("1.0.0").mcp({ endpoint, allowedOrigins, auth?, operations })` where each operation freezes the separate upstream `tool` wire name plus input/output schema. Import with `noodle import mcp`; do not hand-copy a live surface or call `tools/list` at runtime.
 - **Compute**: `connector("id").version("1.0.0").compute(name, { input, output, calls?, run })` — a self-contained, sandboxed function (no imports/closure capture) that may call allowlisted operations via `callOperation`.
+- **Explicit helpers**: `run: (input, host) => ...` can use `host.time.parse(iso)`, `host.time.format(epochMs)`, `host.time.parts(epochMs, timeZone)` and `host.digest(text, "hex")` (or `"base32hex"`). They convert bounded explicit data; there is no ambient clock. Pass trusted `context.temporal.instant` through fulfilment when current time is needed. `examples/weather` demonstrates a stable digest fallback for provider records without IDs.
+- **Expected HTTP errors**: declare `responses: { "409": { response: { status: "conflict" }, evidence: { outcome: "rejected" } } }` alongside the ordinary success `response`. Explicit 4xx overrides exclude 401/403/429; validate against the same output schema. Undeclared errors still fail. Overrides never inherit successful completion evidence or introduce action retries.
+- **Coordinated external actions**: a compute action may declare `coordination: { connectionId, namespace, key: "${args.resource}", reference: "${execution.id}" }` with a bounded execution deadline. It requires an installed application with a live bound connection and durable service coordination. Read `host.coordination.acquired` before writing; a blocked invocation may inspect `previous` through a declared read and call `host.resolveCoordination()` only after exact source proof, then require a fresh invocation/confirmation. The runtime permits at most one nested action when acquired and zero when blocked, even after recovery. Report explicit completed/rejected/unknown evidence with `host.reportOutcome(...)`; a successful return alone never unlocks uncertainty. Do not create an external-record collection for this.
 
 Tools record connector calls into a flow; recording is not execution. Do not branch on runtime outputs with native `if` — use declarative `when(...)` conditions.
 
@@ -58,6 +61,7 @@ not imported or forwarded. The runtime opens one guarded session for one operati
 credential, and closes it; it does not act as an agent for upstream sampling, roots, or elicitation.
 
 HTTP connector auth variants: `bearer` (`{ kind: "bearer", secret: secret("API_TOKEN") }`), `apiKey` (`{ kind: "apiKey", header: "X-API-Key", secret: secret("API_KEY") }`), `clientCredentials`, `delegatedOAuth`, `delegatedSessionCookie`, and `delegatedTokenExchange` (per-user calls to your own API — see "Delegated downstream auth" below). Use managed `secret(...)` / `variable(...)` refs for all values that differ by org/app/env.
+An application-owned adapter may require its own service credential in addition to the operator account credential. Declare `http.transportAuth: { kind: "apiKey", header: "X-Adapter-Key", secret: secret("ADAPTER_SERVICE_KEY") }` alongside bound account credential profiles; the credential broker supplies the two independently. Never put either credential in tool arguments or ordinary headers, and never reuse an inbound MCP bearer. This capability does not imply a provider requires two credentials.
 
 When one connector needs independently selectable accounts, declare catalog `credentialProfiles` plus each operation’s accepted `credentials.profiles`, then bind each `server.use` alias with `bind(connector, { profile, connection: connection("logical_id", managedSecret(secret("NAME"), { scopes, audience })) })`. The alias is the stable account boundary; never put provider account ids, labels, or credential values in it. `gmailConnector()` is the curated Gmail catalog helper; reuse it under independent aliases and accept canonical `accounts` arrays in tools (one account for writes, or an explicitly ordered supported combination for reads). See the bundled `gmail-multi-account` flagship. Bound managed secrets are supported by hosted execution. For deployed-server access to Google APIs, use `googleWorkloadIdentity({ provider: variable("GOOGLE_WIF_PROVIDER"), access: { kind: "direct" } })`, or add `serviceAccountImpersonation` with a managed service-account email. This is keyless Google Workload Identity Federation: exact Google scopes/audience come from the catalog operation, while `noodle auth google prepare|status|doctor|revoke` owns operator lifecycle. See the bundled `google-bigquery` flagship. `externalExchange()` is runnable only when the deployment operator injects an exact HTTPS provider endpoint/origin/audience and durable shared subject-pin store through service ports; Noodle sends a short-lived platform-signed deployment workload assertion and accepts only a bounded bearer response. Provider implementations must consume assertion replay ids through durable shared atomic storage across instances and restarts. There is intentionally no hosted enrollment or provider CRUD surface yet. The provider wire contract is public, but its conformance kit is workspace/source-only and is not an installable npm package. Bound `clientCredentials(...)` remains fail-closed until its provider slice lands.
 
@@ -408,6 +412,12 @@ Adapt the representative arguments and assertions when business contracts change
 
 Author managed config as `secret("NAME")` / `variable("NAME")` and operate it with `noodle secrets set` / `noodle variables set` (scoped org/app/env). Never inline secret values in `server.ts`, tests, or generated files.
 
+For business-editable configuration, declare `const guestExperience = variable("GUEST_EXPERIENCE", { schema: z.object({ notice: z.string().max(500) }), default: { notice: "Welcome" }, portal: { label: "Guest experience" }, requiredFor: ["show_menu"] })` and register it in `server(..., { variables: [guestExperience], ... }, tools)`. Use the whole ref or `guestExperience.field("notice")` in ordinary fulfilment/connector arguments. `.field()` selects a schema-declared object property, can chain for nested objects, and retains the parent variable and full configuration snapshot; it never reads operator data at author time. Keep confirmed action arguments shallow enough for complete review; do not label ordinary settings sensitive to bypass the review. The default is reusable safe intent; each business supplies its own values without editing source. Only explicit `portal` metadata exposes a setting. Name-only references and declared variables without `portal` remain technical configuration; secrets remain credential slots. See the bundled `acme-bistro` source.
+
+Business schemas must be bounded: booleans, finite bounded numbers, bounded text, string enums, bounded arrays, and closed objects. Put defaults in the declaration, not inside Zod schema defaults; custom transforms/refinements and arbitrary schema code cannot run in the shared runtime. `requiredFor` names existing tools whose invocation needs the value; unresolved settings must leave only dependent capabilities unavailable. Publisher compilation does not require a future buyer’s values. Application code enforces business rules server-side; exposing a control or placing the rule in a prompt is insufficient.
+
+For an installed application, use the same `noodle variables list|resolve|set|delete` family with `--installation <id> --org <org> --runtime cloud|other`; do not combine it with app/env/scope flags or secrets. Inspection shows schema metadata, provenance, readiness and revision without saved values. Set inputs are JSON (including quotes for strings), read the current projection and save atomically; `--expected-revision <digest>` pins an explicit prior inspection. Delete resets to the current declared default or unset state. Business-administrator permission is required for mutations, conflicts never retry writes, and mutation output excludes values.
+
 ## Embedded assistant
 
 To place the same server tools inside a SaaS web app, declare `assistant: embeddedAssistant(...)` alongside the one server-level brand kit. Read `embedded-assistant.md` before integrating: it owns the HTTPS-origin rule, managed model configuration, required deploy-before-client sequence, customer-backend exchange, browser mount, and verification checklist.
@@ -445,8 +455,13 @@ The managed crawler and managed index are the defaults and need no configuration
 ## Managed collections
 
 Use `managedCollection(name, { title, description, schemaVersion, record })` when an application needs reusable typed intent for business records that Noodle may later hold. Pass it through `server(..., { collections: [...] }, definitions)`. `record` is one bounded, closed Zod object; names use lowercase letters, numbers, and underscores. Keep payment-card, credentials, passport/government identity, health, and biometric fields out of this surface.
+Native record controls are independent: `management: { assignment: true }`, `{ notes: true }`, both, or neither. Status is an ordinary application field such as `progress: z.enum(["received", "reviewing", "handled"]).default("received")`; no framework transition graph exists. Declare `publicFields` explicitly (default empty), `editableFields` for authorized staff (default all schema properties), optional field labels/help, `summaryFields`, `filterFields` and `sortFields`. References must name actual fields and filters/sorts select scalars. Public callers cannot set staff-only fields; a required private field needs a valid creation default. Staff updates merge only admitted fields and revalidate the complete record. See the notes-only `acme-bistro` collection.
+Operator record queries use `noodle solutions records list --filters '[{"field":"progress","value":"received"}]' --sort-field progress`. Only declared scalar equality/sort fields apply. Payload queries scan at most 10,000 candidates; narrow `--created-at-from`/`--created-at-to` if the API returns `query_limit_exceeded`. Ordinary listing/export has no such scan cap. Cursor reuse requires unchanged query/schema and anchor revision. An administrator can explicitly migrate an eligible historical request with `records migrate-schema ... --expected-revision N`; never implement read-time rewrites.
+
+Omitting `source` makes Noodle authoritative for the collection. To project a read-only collection from an outside system, bind an HTTP connector in `server(..., { use: [...] })` and add `source: { connector: connector.ref(), scan: "scan_operation" }`. The compiler requires the exact normalized scan contract and the same record schema. Noodle ingests a one-way replica; create, update, and delete in the outside system remain ordinary application tools with their own confirmation and policy.
 
-This declaration compiles schema metadata only. It does not create a submit tool, grant access, select retention or residency, provision storage, or make records available to MCP or the embedded assistant. Operators bind lifecycle and authority separately. Until the service intake path is shipped, keep live business operations on their existing connector tools.
+For an explicitly authored native operation, bind `use: { records: noodlePlatform.records.v1 }` and call `connectors.records.submitRecord({ collection: "guest_requests", payload: input })` from an ordinary confirmed tool. Submission accepts only public fields and returns a receipt. `createRecord`, `getRecord`, `listRecords`, `updateRecord`, and `deleteRecord` require a verified platform caller with a live business grant; updates/deletes require the current revision. `updateRecord({ collection, id, expectedRevision, patch, unset: ["optional_field"] })` removes named optional editable fields; omitted keys stay unchanged, `null` is data, and overlap with `patch`, required fields or undeclared fields is rejected. Runtime identity supplies write idempotency and admission; never accept those controls as model arguments. An uninstalled collection is unavailable, including during local tool execution.
+A collection declaration does not create a submit tool, grant access, select retention or residency, provision storage, or expose records to MCP or an embedded assistant. Operators activate the definition and configure lifecycle, access, and any external binding. A connector does not become a collection unless the app explicitly supplies the source contract, and an external collection never becomes a writable mirror.
 
 ## Boundaries
 

package/skills/codex/SKILL.md

@@ -3,7 +3,7 @@ name: noodle-seed
 description: "Use when building, validating, testing, deploying, or operating a local or hosted Noodle Seed MCP server or app authored in TypeScript with the noodle CLI."
 ---
 
-<!-- noodle-skill version:0.100.0 hash:d3ceb1902ef4bb72 -->
+<!-- noodle-skill version:0.102.0 hash:d3ceb1902ef4bb72 -->
 
 # Noodle Seed
 

package/skills/codex/authoring-mcp-servers/SKILL.md

@@ -3,7 +3,7 @@ name: authoring-mcp-servers
 description: "Use when creating or extending a headless Noodle Seed MCP server, tool, resource, prompt, or typed model-facing capability."
 ---
 
-<!-- noodle-skill version:0.100.0 hash:dd57a15df15d10b2 -->
+<!-- noodle-skill version:0.102.0 hash:dd57a15df15d10b2 -->
 
 # authoring-mcp-servers
 

package/skills/codex/authoring-mcp-servers/references/authoring-workflow.md

@@ -42,11 +42,14 @@ Author in `server.ts`, then `noodle validate` → fix cited errors (see `compile
 
 ## Connectors
 
-Declare connectors as data, not imperative code:
+Declare typed connectors:
 
-- **HTTP**: `connector("id").version("1.0.0").http({ baseUrl, allowedOrigins, auth, operations })` with per-operation `request`/`response` mapping using `${args...}` / `${response...}` expressions.
+- **HTTP**: `connector("id").version("1.0.0").http({ baseUrl, allowedOrigins, auth, operations })`; map request/response with `${args...}` / `${response...}`. Use `${execution.id}` for provider idempotency, never model input. Optional `evidence: { outcome: "${response.execution_outcome}", reference: "${response.id}" }` classifies completed/rejected/accepted/unknown; reference is a bounded opaque ID, never a bearer URL or payload. No automatic action retry.
 - **MCP**: `connector("id").version("1.0.0").mcp({ endpoint, allowedOrigins, auth?, operations })` where each operation freezes the separate upstream `tool` wire name plus input/output schema. Import with `noodle import mcp`; do not hand-copy a live surface or call `tools/list` at runtime.
 - **Compute**: `connector("id").version("1.0.0").compute(name, { input, output, calls?, run })` — a self-contained, sandboxed function (no imports/closure capture) that may call allowlisted operations via `callOperation`.
+- **Explicit helpers**: `run: (input, host) => ...` can use `host.time.parse(iso)`, `host.time.format(epochMs)`, `host.time.parts(epochMs, timeZone)` and `host.digest(text, "hex")` (or `"base32hex"`). They convert bounded explicit data; there is no ambient clock. Pass trusted `context.temporal.instant` through fulfilment when current time is needed. `examples/weather` demonstrates a stable digest fallback for provider records without IDs.
+- **Expected HTTP errors**: declare `responses: { "409": { response: { status: "conflict" }, evidence: { outcome: "rejected" } } }` alongside the ordinary success `response`. Explicit 4xx overrides exclude 401/403/429; validate against the same output schema. Undeclared errors still fail. Overrides never inherit successful completion evidence or introduce action retries.
+- **Coordinated external actions**: a compute action may declare `coordination: { connectionId, namespace, key: "${args.resource}", reference: "${execution.id}" }` with a bounded execution deadline. It requires an installed application with a live bound connection and durable service coordination. Read `host.coordination.acquired` before writing; a blocked invocation may inspect `previous` through a declared read and call `host.resolveCoordination()` only after exact source proof, then require a fresh invocation/confirmation. The runtime permits at most one nested action when acquired and zero when blocked, even after recovery. Report explicit completed/rejected/unknown evidence with `host.reportOutcome(...)`; a successful return alone never unlocks uncertainty. Do not create an external-record collection for this.
 
 Tools record connector calls into a flow; recording is not execution. Do not branch on runtime outputs with native `if` — use declarative `when(...)` conditions.
 
@@ -58,6 +61,7 @@ not imported or forwarded. The runtime opens one guarded session for one operati
 credential, and closes it; it does not act as an agent for upstream sampling, roots, or elicitation.
 
 HTTP connector auth variants: `bearer` (`{ kind: "bearer", secret: secret("API_TOKEN") }`), `apiKey` (`{ kind: "apiKey", header: "X-API-Key", secret: secret("API_KEY") }`), `clientCredentials`, `delegatedOAuth`, `delegatedSessionCookie`, and `delegatedTokenExchange` (per-user calls to your own API — see "Delegated downstream auth" below). Use managed `secret(...)` / `variable(...)` refs for all values that differ by org/app/env.
+An application-owned adapter may require its own service credential in addition to the operator account credential. Declare `http.transportAuth: { kind: "apiKey", header: "X-Adapter-Key", secret: secret("ADAPTER_SERVICE_KEY") }` alongside bound account credential profiles; the credential broker supplies the two independently. Never put either credential in tool arguments or ordinary headers, and never reuse an inbound MCP bearer. This capability does not imply a provider requires two credentials.
 
 When one connector needs independently selectable accounts, declare catalog `credentialProfiles` plus each operation’s accepted `credentials.profiles`, then bind each `server.use` alias with `bind(connector, { profile, connection: connection("logical_id", managedSecret(secret("NAME"), { scopes, audience })) })`. The alias is the stable account boundary; never put provider account ids, labels, or credential values in it. `gmailConnector()` is the curated Gmail catalog helper; reuse it under independent aliases and accept canonical `accounts` arrays in tools (one account for writes, or an explicitly ordered supported combination for reads). See the bundled `gmail-multi-account` flagship. Bound managed secrets are supported by hosted execution. For deployed-server access to Google APIs, use `googleWorkloadIdentity({ provider: variable("GOOGLE_WIF_PROVIDER"), access: { kind: "direct" } })`, or add `serviceAccountImpersonation` with a managed service-account email. This is keyless Google Workload Identity Federation: exact Google scopes/audience come from the catalog operation, while `noodle auth google prepare|status|doctor|revoke` owns operator lifecycle. See the bundled `google-bigquery` flagship. `externalExchange()` is runnable only when the deployment operator injects an exact HTTPS provider endpoint/origin/audience and durable shared subject-pin store through service ports; Noodle sends a short-lived platform-signed deployment workload assertion and accepts only a bounded bearer response. Provider implementations must consume assertion replay ids through durable shared atomic storage across instances and restarts. There is intentionally no hosted enrollment or provider CRUD surface yet. The provider wire contract is public, but its conformance kit is workspace/source-only and is not an installable npm package. Bound `clientCredentials(...)` remains fail-closed until its provider slice lands.
 
@@ -408,6 +412,12 @@ Adapt the representative arguments and assertions when business contracts change
 
 Author managed config as `secret("NAME")` / `variable("NAME")` and operate it with `noodle secrets set` / `noodle variables set` (scoped org/app/env). Never inline secret values in `server.ts`, tests, or generated files.
 
+For business-editable configuration, declare `const guestExperience = variable("GUEST_EXPERIENCE", { schema: z.object({ notice: z.string().max(500) }), default: { notice: "Welcome" }, portal: { label: "Guest experience" }, requiredFor: ["show_menu"] })` and register it in `server(..., { variables: [guestExperience], ... }, tools)`. Use the whole ref or `guestExperience.field("notice")` in ordinary fulfilment/connector arguments. `.field()` selects a schema-declared object property, can chain for nested objects, and retains the parent variable and full configuration snapshot; it never reads operator data at author time. Keep confirmed action arguments shallow enough for complete review; do not label ordinary settings sensitive to bypass the review. The default is reusable safe intent; each business supplies its own values without editing source. Only explicit `portal` metadata exposes a setting. Name-only references and declared variables without `portal` remain technical configuration; secrets remain credential slots. See the bundled `acme-bistro` source.
+
+Business schemas must be bounded: booleans, finite bounded numbers, bounded text, string enums, bounded arrays, and closed objects. Put defaults in the declaration, not inside Zod schema defaults; custom transforms/refinements and arbitrary schema code cannot run in the shared runtime. `requiredFor` names existing tools whose invocation needs the value; unresolved settings must leave only dependent capabilities unavailable. Publisher compilation does not require a future buyer’s values. Application code enforces business rules server-side; exposing a control or placing the rule in a prompt is insufficient.
+
+For an installed application, use the same `noodle variables list|resolve|set|delete` family with `--installation <id> --org <org> --runtime cloud|other`; do not combine it with app/env/scope flags or secrets. Inspection shows schema metadata, provenance, readiness and revision without saved values. Set inputs are JSON (including quotes for strings), read the current projection and save atomically; `--expected-revision <digest>` pins an explicit prior inspection. Delete resets to the current declared default or unset state. Business-administrator permission is required for mutations, conflicts never retry writes, and mutation output excludes values.
+
 ## Embedded assistant
 
 To place the same server tools inside a SaaS web app, declare `assistant: embeddedAssistant(...)` alongside the one server-level brand kit. Read `embedded-assistant.md` before integrating: it owns the HTTPS-origin rule, managed model configuration, required deploy-before-client sequence, customer-backend exchange, browser mount, and verification checklist.
@@ -445,8 +455,13 @@ The managed crawler and managed index are the defaults and need no configuration
 ## Managed collections
 
 Use `managedCollection(name, { title, description, schemaVersion, record })` when an application needs reusable typed intent for business records that Noodle may later hold. Pass it through `server(..., { collections: [...] }, definitions)`. `record` is one bounded, closed Zod object; names use lowercase letters, numbers, and underscores. Keep payment-card, credentials, passport/government identity, health, and biometric fields out of this surface.
+Native record controls are independent: `management: { assignment: true }`, `{ notes: true }`, both, or neither. Status is an ordinary application field such as `progress: z.enum(["received", "reviewing", "handled"]).default("received")`; no framework transition graph exists. Declare `publicFields` explicitly (default empty), `editableFields` for authorized staff (default all schema properties), optional field labels/help, `summaryFields`, `filterFields` and `sortFields`. References must name actual fields and filters/sorts select scalars. Public callers cannot set staff-only fields; a required private field needs a valid creation default. Staff updates merge only admitted fields and revalidate the complete record. See the notes-only `acme-bistro` collection.
+Operator record queries use `noodle solutions records list --filters '[{"field":"progress","value":"received"}]' --sort-field progress`. Only declared scalar equality/sort fields apply. Payload queries scan at most 10,000 candidates; narrow `--created-at-from`/`--created-at-to` if the API returns `query_limit_exceeded`. Ordinary listing/export has no such scan cap. Cursor reuse requires unchanged query/schema and anchor revision. An administrator can explicitly migrate an eligible historical request with `records migrate-schema ... --expected-revision N`; never implement read-time rewrites.
+
+Omitting `source` makes Noodle authoritative for the collection. To project a read-only collection from an outside system, bind an HTTP connector in `server(..., { use: [...] })` and add `source: { connector: connector.ref(), scan: "scan_operation" }`. The compiler requires the exact normalized scan contract and the same record schema. Noodle ingests a one-way replica; create, update, and delete in the outside system remain ordinary application tools with their own confirmation and policy.
 
-This declaration compiles schema metadata only. It does not create a submit tool, grant access, select retention or residency, provision storage, or make records available to MCP or the embedded assistant. Operators bind lifecycle and authority separately. Until the service intake path is shipped, keep live business operations on their existing connector tools.
+For an explicitly authored native operation, bind `use: { records: noodlePlatform.records.v1 }` and call `connectors.records.submitRecord({ collection: "guest_requests", payload: input })` from an ordinary confirmed tool. Submission accepts only public fields and returns a receipt. `createRecord`, `getRecord`, `listRecords`, `updateRecord`, and `deleteRecord` require a verified platform caller with a live business grant; updates/deletes require the current revision. `updateRecord({ collection, id, expectedRevision, patch, unset: ["optional_field"] })` removes named optional editable fields; omitted keys stay unchanged, `null` is data, and overlap with `patch`, required fields or undeclared fields is rejected. Runtime identity supplies write idempotency and admission; never accept those controls as model arguments. An uninstalled collection is unavailable, including during local tool execution.
+A collection declaration does not create a submit tool, grant access, select retention or residency, provision storage, or expose records to MCP or an embedded assistant. Operators activate the definition and configure lifecycle, access, and any external binding. A connector does not become a collection unless the app explicitly supplies the source contract, and an external collection never becomes a writable mirror.
 
 ## Boundaries
 

package/skills/codex/authoring-mcp-servers/references/sdk-surface.md

@@ -37,7 +37,7 @@ Platform helper connectors are explicit subpath imports from `@noodleseed/one/pl
 ### Managed config
 
 - `secret("NAME")` — reference a managed secret (operated via `noodle secrets`).
-- `variable("NAME")` — reference a managed variable (operated via `noodle variables`).
+- `variable("NAME")` — reference managed configuration; add `{ schema, default?, portal?, requiredFor? }` and register in `server.variables` for typed business settings. Operate through `noodle variables` or authorized Portal settings.
 
 ### Customer auth
 
@@ -67,6 +67,7 @@ Platform helper connectors are explicit subpath imports from `@noodleseed/one/pl
 - `managedSecret`
 - `meilisearch`
 - `noodleManaged`
+- `noodlePlatform`
 - `openAICompatible`
 - `publicWebsite`
 - `site`

package/skills/codex/building-mcp-apps/SKILL.md

@@ -3,7 +3,7 @@ name: building-mcp-apps
 description: "Use when a Noodle Seed MCP App, widget, interactive card, visual interaction, or host-visible UI is the primary requested outcome."
 ---
 
-<!-- noodle-skill version:0.100.0 hash:98c7b07c82a7d7ce -->
+<!-- noodle-skill version:0.102.0 hash:98c7b07c82a7d7ce -->
 
 # building-mcp-apps
 

package/skills/codex/connecting-apis-to-mcp/SKILL.md

@@ -3,7 +3,7 @@ name: connecting-apis-to-mcp
 description: "Use when all four API-evidence inputs exist—and only then: API base URL, authentication scheme, representative safe read, and observed response."
 ---
 
-<!-- noodle-skill version:0.100.0 hash:8020811f1769c538 -->
+<!-- noodle-skill version:0.102.0 hash:8020811f1769c538 -->
 
 # connecting-apis-to-mcp