@noodleseed/agent-kit 0.25.0 → 0.27.0

package/manifest.json

@@ -1,9 +1,9 @@
 {
-  "packageVersion": "0.25.0",
+  "packageVersion": "0.27.0",
   "files": [
     {
       "path": "skills/codex/SKILL.md",
-      "sha256": "16692acb9bc49afa05c81356a46dcf005bcae810089a596d32f59d241abc84f2",
+      "sha256": "85902e1189172c389d0811b5f07d0ead7a686b9099f4f1eb48858c57f15b6ae8",
       "agentTarget": "codex"
     },
     {
@@ -23,7 +23,7 @@
     },
     {
       "path": "skills/codex/references/compile-errors.md",
-      "sha256": "d67bafe1aea7fb38c374a61cbebfa7af11eb5f3bdb8552ddb367918a2d415294",
+      "sha256": "f3e791d3eb7b95641791b9e63efd03852aa517d9b29e535f447fed3080fd61e4",
       "agentTarget": "codex"
     },
     {
@@ -38,7 +38,7 @@
     },
     {
       "path": "skills/codex/references/connect-an-api.md",
-      "sha256": "497221256ebb78300b5e4055daff3f222052a7b78fb829fd24171668dd7fc0fa",
+      "sha256": "982b5652635706793bf20b0d2b6abb7887302e3ab39886002b23f09d1515ac26",
       "agentTarget": "codex"
     },
     {
@@ -48,7 +48,7 @@
     },
     {
       "path": "skills/codex/references/widgets-and-apps.md",
-      "sha256": "3aee540c20e23f73d78b4ab1dc8b7dba9b71cf213c8570431190cf6ef48506e6",
+      "sha256": "921d05b7f7a8044f4b9c4f8816972839eb792499b99f095ff1fbcda89a2b48b3",
       "agentTarget": "codex"
     },
     {
@@ -278,7 +278,7 @@
     },
     {
       "path": "skills/codex/examples/food-ordering/README.md",
-      "sha256": "1e8a08868efa70fe79bacc02d27effa5a65fbb5b497e76a7ce1268586ec559dc",
+      "sha256": "41fdd5b9ca345a5f0daf4633cb53e65f11d1f211f283f6ba902db3366f872809",
       "agentTarget": "codex"
     },
     {
@@ -353,7 +353,7 @@
     },
     {
       "path": "skills/codex/examples/weather/README.md",
-      "sha256": "59dd103ae387b4ef0f32e155dbe9a11d79e260310a07c0f266a16add2e8e31bd",
+      "sha256": "43ee8447a0a3f9fdcce30544c5ef3801a93eb6b9fe5e2e8791e65a6587a65545",
       "agentTarget": "codex"
     },
     {
@@ -378,7 +378,7 @@
     },
     {
       "path": "skills/claude-code/SKILL.md",
-      "sha256": "728ddf5381fc4acce82d749565628f73b1164ece57319a6d50e287f3d99d1113",
+      "sha256": "5e0ca0a074ddfa6c839cc8d8233d20a0a11e3991bb0f9972539b9896b6072bbf",
       "agentTarget": "claude-code"
     },
     {
@@ -398,7 +398,7 @@
     },
     {
       "path": "skills/claude-code/references/compile-errors.md",
-      "sha256": "d67bafe1aea7fb38c374a61cbebfa7af11eb5f3bdb8552ddb367918a2d415294",
+      "sha256": "f3e791d3eb7b95641791b9e63efd03852aa517d9b29e535f447fed3080fd61e4",
       "agentTarget": "claude-code"
     },
     {
@@ -413,7 +413,7 @@
     },
     {
       "path": "skills/claude-code/references/connect-an-api.md",
-      "sha256": "497221256ebb78300b5e4055daff3f222052a7b78fb829fd24171668dd7fc0fa",
+      "sha256": "982b5652635706793bf20b0d2b6abb7887302e3ab39886002b23f09d1515ac26",
       "agentTarget": "claude-code"
     },
     {
@@ -423,7 +423,7 @@
     },
     {
       "path": "skills/claude-code/references/widgets-and-apps.md",
-      "sha256": "3aee540c20e23f73d78b4ab1dc8b7dba9b71cf213c8570431190cf6ef48506e6",
+      "sha256": "921d05b7f7a8044f4b9c4f8816972839eb792499b99f095ff1fbcda89a2b48b3",
       "agentTarget": "claude-code"
     },
     {
@@ -653,7 +653,7 @@
     },
     {
       "path": "skills/claude-code/examples/food-ordering/README.md",
-      "sha256": "1e8a08868efa70fe79bacc02d27effa5a65fbb5b497e76a7ce1268586ec559dc",
+      "sha256": "41fdd5b9ca345a5f0daf4633cb53e65f11d1f211f283f6ba902db3366f872809",
       "agentTarget": "claude-code"
     },
     {
@@ -728,7 +728,7 @@
     },
     {
       "path": "skills/claude-code/examples/weather/README.md",
-      "sha256": "59dd103ae387b4ef0f32e155dbe9a11d79e260310a07c0f266a16add2e8e31bd",
+      "sha256": "43ee8447a0a3f9fdcce30544c5ef3801a93eb6b9fe5e2e8791e65a6587a65545",
       "agentTarget": "claude-code"
     },
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/agent-kit",
-  "version": "0.25.0",
+  "version": "0.27.0",
   "private": false,
   "description": "Self-checking, self-updating agent skills for the Noodle Seed CLI. Authored in this repo by @noodle-borg/agent-kit; this is the published, independently-versioned canonical skills artifact the CLI fetches and verifies.",
   "license": "Apache-2.0",

package/skills/claude-code/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: noodle-seed
 description: Use when building, validating, testing, deploying, or operating a local or hosted Noodle Seed MCP server or app authored in TypeScript with the noodle CLI.
-version: 0.25.0
+version: 0.27.0
 hash: b4fc528d406e2149
 ---
 

package/skills/claude-code/examples/food-ordering/README.md

@@ -32,6 +32,10 @@ error/retry, and success states must remain readable without nested vertical scr
 
 Like the comprehensive default `noodle init my-app` scaffold, this flagship keeps the server feature-rich
 while making each individual widget view focused; server capability breadth and screen density are separate.
+The compiled initial widget should normally remain under the 1 MiB performance recommendation; Noodle Seed's
+hard ceilings are 10 MiB per compiled widget and 20 MiB across one deployment. Run `noodle check` to see raw
+and gzip-estimated sizes, and keep menu images or large live datasets in assets/resources and app-only tools
+rather than embedding them into the initial HTML bundle.
 
 ## Local Author Loop
 

package/skills/claude-code/examples/weather/README.md

@@ -33,6 +33,33 @@ It exercises, in one TypeScript-authored app:
 - **Sandboxed compute** (no network/fs/env/clock) turning raw numbers into conditions + advice.
 - **Typed input/output schemas** emitted as JSON Schema 2020-12.
 
+## APIs that require form-urlencoded search bodies
+
+The live Open-Meteo calls above are GET requests. For APIs whose search endpoint is a POST expecting
+`application/x-www-form-urlencoded`, keep authoring a request object and select the encoding explicitly:
+
+```ts
+search_quotes: {
+  type: 'read',
+  method: 'POST',
+  path: '/quotes/search',
+  requestEncoding: 'form-urlencoded',
+  input: z.object({
+    fromAirportId: z.string(),
+    categories: z.array(z.string()),
+  }),
+  request: {
+    'from airport id': '${args.fromAirportId}',
+    'aircraft[categories]': '${args.categories}',
+  },
+  // output and response mapping omitted
+},
+```
+
+Noodle builds a `URLSearchParams` body: spaces and punctuation in field names are encoded normally, while
+each array or nested object is JSON-stringified into its individual form field. Do not pre-encode the body
+or set `Content-Type` manually; the connector owns both.
+
 ## Run it locally
 
 From the repo root, with the workspace built (`pnpm build`):

package/skills/claude-code/references/compile-errors.md

@@ -51,6 +51,8 @@ Run `noodle validate` (add `--json` for the machine-readable envelope, `--fix-pr
 | `duplicate_widget_tool` | A tool is bound to more than one widget; bind each tool to a single widget. |
 | `invalid_widget_binding` | Fix the `data-bind`/binding expression in the widget; it does not resolve against the tool output. |
 | `invalid_widget_state_handle` | Correct the state handle reference; declare it under `server(..., { state: { handles } })` and reference it by its declared name. |
+| `widget_html_too_large` | Reduce the compiled widget below 10 MiB UTF-8 (or raw HTML below 256 KiB) by moving large media and dynamic data into hosted resources or bounded app-only tools. |
+| `widget_html_total_too_large` | Reduce aggregate widget HTML below 20 MiB UTF-8; share or externalize large payloads instead of duplicating them across initial widget resources. |
 | `invalid_asset` | Fix the `asset("./path")` reference; the file must exist and be a supported asset type. |
 | `invalid_capability_requirement` | Correct the declared capability/permission requirement to a supported value. |
 | `state_secret_field` | Remove the secret-shaped field from widget/handle state; secrets must never be stored in state or sent to widgets. |

package/skills/claude-code/references/connect-an-api.md

@@ -90,9 +90,25 @@ response: { tasks: '${response.items}' },
 ## Create, update, delete
 
 Pair the read/list with the mutations your intent tools need:
-- **Create / update** — `method: 'POST'` / `'PATCH'`; the request body is authored as `request: { field: '${input.x}' }` — the `request` object **is** the JSON body (do not nest it under `body`), and URL query params are the operation-level `query: [...]` array.
+- **Create / update** — `method: 'POST'` / `'PATCH'`; author the body as `request: { field: '${input.x}' }` (do not nest it under `body`). It is JSON by default; use `requestEncoding: 'form-urlencoded'` only when the API requires a URLSearchParams body. URL query params remain the operation-level `query: [...]` array.
 - **Delete / close** — many endpoints return `204 No Content`. Set `responseType: 'empty'`, which enforces the status and binds `{}` (there is no body to map).
 
+```ts
+search_quotes: {
+  type: 'read', method: 'POST', path: '/quotes/search',
+  requestEncoding: 'form-urlencoded',
+  request: {
+    'from airport id': '${args.fromAirportId}',
+    'aircraft[categories]': '${args.categories}', // arrays become one JSON field
+  },
+  // input / output / response omitted
+},
+```
+
+`form-urlencoded` accepts a request object, not a pre-encoded string. Noodle preserves field order,
+omits `undefined`, stringifies primitive values, JSON-stringifies arrays/nested objects into one
+field each, and owns the exact `application/x-www-form-urlencoded;charset=UTF-8` content type.
+
 ```ts
 close_task: {
   type: 'action', method: 'POST', path: '/tasks/{id}/close',

package/skills/claude-code/references/widgets-and-apps.md

@@ -22,6 +22,8 @@ Generated widgets, official examples, and agent-authored MCP Apps must start wit
 
 The default composition rule is: build the smallest useful conversational surface. Inline has one purpose, one primary action, and at most two visible actions. Use progressive disclosure or a later conversational turn for secondary detail; request fullscreen only when the user asks or the task genuinely needs it. Never use nested scrolling. At 280px and wider, the widget must remain one-column, readable, touch-safe, and free of horizontal overflow. Remove secondary chrome before shrinking essential content.
 
+Treat 1 MiB of uncompressed UTF-8 HTML as the recommended initial React-widget budget, not a compatibility wall. Noodle Seed accepts up to 10 MiB per compiled widget and 20 MiB across a deployment; `noodle check` reports raw and gzip-estimated sizes. Keep large media and dynamic datasets in hosted assets/resources or bounded app-only tool responses instead of inflating the initial widget resource.
+
 Every production widget handles loading, empty, partial, stale, error, retry, and success states. Prefill fields from known tool results and choose safe, reversible defaults; preserve the user’s work across rerenders, and never preselect a consequential action. Use public React primitives and branding tokens. Never author against `ns-*`, `nsr-*`, or example-local `--nw-*` classes/tokens; those are implementation details, not alternate design systems.
 
 ## React hook surface

package/skills/codex/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: noodle-seed
 description: Use when building, validating, testing, deploying, or operating a local or hosted Noodle Seed MCP server or app authored in TypeScript with the noodle CLI.
-version: 0.25.0
+version: 0.27.0
 hash: cd25535e1d6dbf4f
 ---
 

package/skills/codex/examples/food-ordering/README.md

@@ -32,6 +32,10 @@ error/retry, and success states must remain readable without nested vertical scr
 
 Like the comprehensive default `noodle init my-app` scaffold, this flagship keeps the server feature-rich
 while making each individual widget view focused; server capability breadth and screen density are separate.
+The compiled initial widget should normally remain under the 1 MiB performance recommendation; Noodle Seed's
+hard ceilings are 10 MiB per compiled widget and 20 MiB across one deployment. Run `noodle check` to see raw
+and gzip-estimated sizes, and keep menu images or large live datasets in assets/resources and app-only tools
+rather than embedding them into the initial HTML bundle.
 
 ## Local Author Loop
 

package/skills/codex/examples/weather/README.md

@@ -33,6 +33,33 @@ It exercises, in one TypeScript-authored app:
 - **Sandboxed compute** (no network/fs/env/clock) turning raw numbers into conditions + advice.
 - **Typed input/output schemas** emitted as JSON Schema 2020-12.
 
+## APIs that require form-urlencoded search bodies
+
+The live Open-Meteo calls above are GET requests. For APIs whose search endpoint is a POST expecting
+`application/x-www-form-urlencoded`, keep authoring a request object and select the encoding explicitly:
+
+```ts
+search_quotes: {
+  type: 'read',
+  method: 'POST',
+  path: '/quotes/search',
+  requestEncoding: 'form-urlencoded',
+  input: z.object({
+    fromAirportId: z.string(),
+    categories: z.array(z.string()),
+  }),
+  request: {
+    'from airport id': '${args.fromAirportId}',
+    'aircraft[categories]': '${args.categories}',
+  },
+  // output and response mapping omitted
+},
+```
+
+Noodle builds a `URLSearchParams` body: spaces and punctuation in field names are encoded normally, while
+each array or nested object is JSON-stringified into its individual form field. Do not pre-encode the body
+or set `Content-Type` manually; the connector owns both.
+
 ## Run it locally
 
 From the repo root, with the workspace built (`pnpm build`):

package/skills/codex/references/compile-errors.md

@@ -51,6 +51,8 @@ Run `noodle validate` (add `--json` for the machine-readable envelope, `--fix-pr
 | `duplicate_widget_tool` | A tool is bound to more than one widget; bind each tool to a single widget. |
 | `invalid_widget_binding` | Fix the `data-bind`/binding expression in the widget; it does not resolve against the tool output. |
 | `invalid_widget_state_handle` | Correct the state handle reference; declare it under `server(..., { state: { handles } })` and reference it by its declared name. |
+| `widget_html_too_large` | Reduce the compiled widget below 10 MiB UTF-8 (or raw HTML below 256 KiB) by moving large media and dynamic data into hosted resources or bounded app-only tools. |
+| `widget_html_total_too_large` | Reduce aggregate widget HTML below 20 MiB UTF-8; share or externalize large payloads instead of duplicating them across initial widget resources. |
 | `invalid_asset` | Fix the `asset("./path")` reference; the file must exist and be a supported asset type. |
 | `invalid_capability_requirement` | Correct the declared capability/permission requirement to a supported value. |
 | `state_secret_field` | Remove the secret-shaped field from widget/handle state; secrets must never be stored in state or sent to widgets. |

package/skills/codex/references/connect-an-api.md

@@ -90,9 +90,25 @@ response: { tasks: '${response.items}' },
 ## Create, update, delete
 
 Pair the read/list with the mutations your intent tools need:
-- **Create / update** — `method: 'POST'` / `'PATCH'`; the request body is authored as `request: { field: '${input.x}' }` — the `request` object **is** the JSON body (do not nest it under `body`), and URL query params are the operation-level `query: [...]` array.
+- **Create / update** — `method: 'POST'` / `'PATCH'`; author the body as `request: { field: '${input.x}' }` (do not nest it under `body`). It is JSON by default; use `requestEncoding: 'form-urlencoded'` only when the API requires a URLSearchParams body. URL query params remain the operation-level `query: [...]` array.
 - **Delete / close** — many endpoints return `204 No Content`. Set `responseType: 'empty'`, which enforces the status and binds `{}` (there is no body to map).
 
+```ts
+search_quotes: {
+  type: 'read', method: 'POST', path: '/quotes/search',
+  requestEncoding: 'form-urlencoded',
+  request: {
+    'from airport id': '${args.fromAirportId}',
+    'aircraft[categories]': '${args.categories}', // arrays become one JSON field
+  },
+  // input / output / response omitted
+},
+```
+
+`form-urlencoded` accepts a request object, not a pre-encoded string. Noodle preserves field order,
+omits `undefined`, stringifies primitive values, JSON-stringifies arrays/nested objects into one
+field each, and owns the exact `application/x-www-form-urlencoded;charset=UTF-8` content type.
+
 ```ts
 close_task: {
   type: 'action', method: 'POST', path: '/tasks/{id}/close',

package/skills/codex/references/widgets-and-apps.md

@@ -22,6 +22,8 @@ Generated widgets, official examples, and agent-authored MCP Apps must start wit
 
 The default composition rule is: build the smallest useful conversational surface. Inline has one purpose, one primary action, and at most two visible actions. Use progressive disclosure or a later conversational turn for secondary detail; request fullscreen only when the user asks or the task genuinely needs it. Never use nested scrolling. At 280px and wider, the widget must remain one-column, readable, touch-safe, and free of horizontal overflow. Remove secondary chrome before shrinking essential content.
 
+Treat 1 MiB of uncompressed UTF-8 HTML as the recommended initial React-widget budget, not a compatibility wall. Noodle Seed accepts up to 10 MiB per compiled widget and 20 MiB across a deployment; `noodle check` reports raw and gzip-estimated sizes. Keep large media and dynamic datasets in hosted assets/resources or bounded app-only tool responses instead of inflating the initial widget resource.
+
 Every production widget handles loading, empty, partial, stale, error, retry, and success states. Prefill fields from known tool results and choose safe, reversible defaults; preserve the user’s work across rerenders, and never preselect a consequential action. Use public React primitives and branding tokens. Never author against `ns-*`, `nsr-*`, or example-local `--nw-*` classes/tokens; those are implementation details, not alternate design systems.
 
 ## React hook surface