@noodleseed/agent-kit 0.35.0 → 0.37.0

package/skills/claude-code/examples/gmail-multi-account/test/server.test.ts

@@ -0,0 +1,271 @@
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { describe, expect, it } from 'vitest';
+import {
+  compileManifest,
+  InMemoryCatalog,
+  validateJsonSchemaWithDefaults,
+} from '../../../packages/compiler/src/index.js';
+import { compileConnectors } from '../../../packages/connector-defs/src/index.js';
+import {
+  type CredentialBroker,
+  type CredentialRequest,
+  type DownstreamCredential,
+  executePreparedTool,
+  executeTool,
+  InMemoryConnectorRegistry,
+  isConfirmationRequired,
+  prepareToolForConfirmation,
+} from '../../../packages/runtime/src/index.js';
+import app, { PERSONAL_ACCOUNT, WORK_ACCOUNT } from '../src/server.js';
+
+const here = dirname(fileURLToPath(import.meta.url));
+
+async function compiledFixture() {
+  const catalog = structuredClone(app.toConnectorCatalog());
+  if (catalog === undefined) throw new Error('expected connector catalog');
+  for (const connector of catalog.connectors) {
+    if ('http' in connector) {
+      for (const [name, operation] of Object.entries(connector.operations)) {
+        operation.fake = {
+          response: {
+            id: `${name}-fixture`,
+            messages: [{ id: `${name}-message` }],
+            drafts: [{ id: `${name}-draft` }],
+          },
+        };
+      }
+    }
+  }
+  const connectors = compileConnectors(JSON.stringify(catalog), { mode: 'fake' });
+  if (!connectors.ok) throw new Error(JSON.stringify(connectors.errors));
+  const manifest = await app.toManifest();
+  const compiled = compileManifest(manifest, {
+    catalog: new InMemoryCatalog(connectors.catalog),
+  });
+  if (!compiled.ok) throw new Error(JSON.stringify(compiled.errors));
+  const requests: CredentialRequest[] = [];
+  const broker: CredentialBroker = {
+    getCredential(request): Promise<DownstreamCredential> {
+      requests.push(request);
+      return Promise.resolve({ token: `${request.bindingId}-fixture-token` });
+    },
+  };
+  return {
+    artifact: compiled.artifact,
+    deps: { connectors: new InMemoryConnectorRegistry(connectors.connectors), broker },
+    requests,
+  };
+}
+
+describe('multi-account Gmail flagship', () => {
+  it('binds the same curated connector twice without provider ids, credentials, or real labels', async () => {
+    const manifest = await app.toManifest();
+    expect(manifest.connectors).toMatchObject({
+      personal_gmail: {
+        id: 'gmail',
+        binding: {
+          profile: 'user_oauth',
+          connection: { id: 'personal_gmail', source: { kind: 'externalExchange' } },
+        },
+      },
+      work_gmail: {
+        id: 'gmail',
+        binding: {
+          profile: 'user_oauth',
+          connection: { id: 'work_gmail', source: { kind: 'externalExchange' } },
+        },
+      },
+    });
+    const wire = JSON.stringify({ manifest, catalog: app.toConnectorCatalog() });
+    expect(wire).not.toMatch(/access[_-]?token|client[_-]?secret/i);
+  });
+
+  it('emits enforceable canonical account arrays on every tool', async () => {
+    const manifest = await app.toManifest();
+    for (const tool of manifest.tools) {
+      expect(tool.inputSchema.properties).toHaveProperty('accounts');
+      expect(JSON.stringify(tool.inputSchema.properties.accounts)).toContain(PERSONAL_ACCOUNT);
+      expect(JSON.stringify(tool.inputSchema.properties.accounts)).toContain(WORK_ACCOUNT);
+    }
+    const read = manifest.tools.find((tool) => tool.name === 'search_messages');
+    const write = manifest.tools.find((tool) => tool.name === 'trash_message');
+    const readAccountsSchema = JSON.stringify(read?.inputSchema.properties.accounts);
+    const writeAccountsSchema = JSON.stringify(write?.inputSchema.properties.accounts);
+    expect(readAccountsSchema).toContain(PERSONAL_ACCOUNT);
+    expect(readAccountsSchema).toContain(WORK_ACCOUNT);
+    expect(readAccountsSchema).toContain('"maxItems":2');
+    expect(writeAccountsSchema).not.toContain('"maxItems":2');
+  });
+
+  it('allows subject-only or plain-body-only vacation replies but rejects an empty enabled reply', async () => {
+    const manifest = await app.toManifest();
+    const schema = manifest.tools.find((tool) => tool.name === 'update_vacation')?.inputSchema;
+    if (schema === undefined) throw new Error('expected update_vacation schema');
+    const base = { accounts: [PERSONAL_ACCOUNT], settings: { enable_auto_reply: true } };
+
+    expect(
+      validateJsonSchemaWithDefaults(schema, {
+        ...base,
+        settings: { ...base.settings, response_subject: 'Away' },
+      }).issues,
+    ).toHaveLength(0);
+    expect(
+      validateJsonSchemaWithDefaults(schema, {
+        ...base,
+        settings: { ...base.settings, response_body_plain_text: 'Back soon' },
+      }).issues,
+    ).toHaveLength(0);
+    expect(validateJsonSchemaWithDefaults(schema, base).issues).not.toHaveLength(0);
+  });
+
+  it.each([
+    [],
+    ['unknown@example.com'],
+    [PERSONAL_ACCOUNT, PERSONAL_ACCOUNT],
+    [WORK_ACCOUNT, PERSONAL_ACCOUNT],
+  ])('rejects invalid read accounts %j before connector dispatch', async (accounts) => {
+    const setup = await compiledFixture();
+    const schema = setup.artifact.tools.find(
+      (candidate) => candidate.name === 'search_messages',
+    )?.inputSchema;
+    if (!schema) throw new Error('expected search schema');
+    const result = validateJsonSchemaWithDefaults(schema, { accounts, query: '' });
+    expect(result.issues).not.toHaveLength(0);
+    expect(setup.requests).toHaveLength(0);
+  });
+
+  it('rejects multi-account mutations at the write schema boundary', async () => {
+    const setup = await compiledFixture();
+    const schema = setup.artifact.tools.find(
+      (candidate) => candidate.name === 'trash_message',
+    )?.inputSchema;
+    if (!schema) throw new Error('expected trash schema');
+
+    const result = validateJsonSchemaWithDefaults(schema, {
+      accounts: [PERSONAL_ACCOUNT, WORK_ACCOUNT],
+      message_id: 'fixture-message',
+    });
+
+    expect(result.issues).not.toHaveLength(0);
+    expect(setup.requests).toHaveLength(0);
+  });
+
+  it('rejects a no-op label mutation before confirmation or credential lookup', async () => {
+    const setup = await compiledFixture();
+
+    await expect(
+      prepareToolForConfirmation(
+        setup.artifact,
+        'modify_message_labels',
+        { accounts: [PERSONAL_ACCOUNT], message_id: 'fixture-message' },
+        setup.deps,
+      ),
+    ).resolves.toMatchObject({ status: 'failed', error: { code: 'arg_invalid' } });
+    expect(setup.requests).toHaveLength(0);
+  });
+
+  it('routes personal, work, and combined reads to isolated bindings and preserves account labels', async () => {
+    const personal = await compiledFixture();
+    const personalResult = await executeTool(
+      personal.artifact,
+      'search_messages',
+      { accounts: [PERSONAL_ACCOUNT], query: 'is:unread' },
+      personal.deps,
+    );
+    expect(personal.requests.flatMap((request) => request.bindingId ?? [])).toEqual([
+      'personal_gmail',
+    ]);
+    expect(personalResult).toMatchObject({
+      ok: true,
+      output: { results: [{ account: PERSONAL_ACCOUNT }] },
+    });
+
+    const work = await compiledFixture();
+    const workResult = await executeTool(
+      work.artifact,
+      'search_messages',
+      { accounts: [WORK_ACCOUNT], query: 'is:unread' },
+      work.deps,
+    );
+    expect(work.requests.flatMap((request) => request.bindingId ?? [])).toEqual(['work_gmail']);
+    expect(workResult).toMatchObject({
+      ok: true,
+      output: { results: [{ account: WORK_ACCOUNT }] },
+    });
+
+    const both = await compiledFixture();
+    const bothResult = await executeTool(
+      both.artifact,
+      'search_messages',
+      { accounts: [PERSONAL_ACCOUNT, WORK_ACCOUNT], query: 'is:unread' },
+      both.deps,
+    );
+    expect(both.requests.flatMap((request) => request.bindingId ?? [])).toEqual([
+      'personal_gmail',
+      'work_gmail',
+    ]);
+    expect(bothResult).toMatchObject({
+      ok: true,
+      output: {
+        results: [{ account: PERSONAL_ACCOUNT }, { account: WORK_ACCOUNT }],
+      },
+    });
+  });
+
+  it('prepares the exact selected write binding, dispatches only after confirmation, and rejects replay drift', async () => {
+    const setup = await compiledFixture();
+    const prepared = await prepareToolForConfirmation(
+      setup.artifact,
+      'trash_message',
+      { accounts: [WORK_ACCOUNT], message_id: 'fixture-message' },
+      setup.deps,
+    );
+    expect(isConfirmationRequired(prepared)).toBe(true);
+    if (!isConfirmationRequired(prepared)) throw new Error('expected confirmation');
+    expect(setup.requests).toHaveLength(0);
+    expect(prepared.review.action).toMatchObject({
+      bindingId: 'work_gmail',
+      connectionId: 'work_gmail',
+      operation: 'trash_message',
+    });
+
+    await expect(
+      executePreparedTool(setup.artifact, prepared.continuation, setup.deps),
+    ).resolves.toMatchObject({ status: 'completed' });
+    expect(setup.requests.flatMap((request) => request.bindingId ?? [])).toEqual(['work_gmail']);
+
+    const personalPrepared = structuredClone(prepared.continuation);
+    if (personalPrepared.reviewedAction) {
+      (personalPrepared.reviewedAction as { bindingId?: string }).bindingId = 'personal_gmail';
+    }
+    await expect(
+      executePreparedTool(setup.artifact, personalPrepared, setup.deps),
+    ).resolves.toMatchObject({ status: 'failed' });
+  });
+
+  it('makes every mutation confirmable and keeps the personal-email skill concise and safe', async () => {
+    const manifest = await app.toManifest();
+    const catalog = app.toConnectorCatalog();
+    const actionNames = new Set(
+      catalog?.connectors.flatMap((connector) =>
+        Object.entries(connector.operations)
+          .filter(([, operation]) => operation.type === 'action')
+          .map(([name]) => name),
+      ),
+    );
+    for (const tool of manifest.tools.filter((candidate) => actionNames.has(candidate.name))) {
+      expect(tool.annotations?.confirm, tool.name).toBe(true);
+    }
+
+    const skill = readFileSync(join(here, '../skills/personal-email-automation/SKILL.md'), 'utf8');
+    expect(skill).toMatch(/^---\nname: personal-email-automation\ndescription:/);
+    expect(skill.split('\n').length).toBeLessThan(140);
+    expect(skill).toContain('accounts');
+    expect(skill).toMatch(/draft/i);
+    expect(skill).toMatch(/confirm/i);
+    expect(skill).toMatch(/permanent delete/i);
+    expect(skill).not.toMatch(/client[_-]?secret|access[_-]?token/i);
+  });
+});

package/skills/claude-code/examples/gmail-multi-account/vitest.config.ts

@@ -0,0 +1,28 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  resolve: {
+    alias: {
+      '@noodleseed/one': new URL('../../packages/authoring/src/index.ts', import.meta.url).pathname,
+      '@noodle-borg/capabilities': new URL(
+        '../../packages/capabilities/src/index.ts',
+        import.meta.url,
+      ).pathname,
+      '@noodle-borg/compiler': new URL('../../packages/compiler/src/index.ts', import.meta.url)
+        .pathname,
+      '@noodle-borg/compute': new URL('../../packages/compute/src/index.ts', import.meta.url)
+        .pathname,
+      '@noodle-borg/connector-defs': new URL(
+        '../../packages/connector-defs/src/index.ts',
+        import.meta.url,
+      ).pathname,
+      '@noodle-borg/connector-http': new URL(
+        '../../packages/connector-http/src/index.ts',
+        import.meta.url,
+      ).pathname,
+      '@noodle-borg/runtime': new URL('../../packages/runtime/src/index.ts', import.meta.url)
+        .pathname,
+    },
+  },
+  test: { include: ['test/**/*.test.ts'] },
+});

package/skills/claude-code/references/authoring-workflow.md

@@ -41,6 +41,8 @@ Tools record connector calls into a flow; recording is not execution. Do not bra
 
 HTTP connector auth variants: `bearer` (`{ kind: "bearer", secret: secret("API_TOKEN") }`), `apiKey` (`{ kind: "apiKey", header: "X-API-Key", secret: secret("API_KEY") }`), `clientCredentials`, `delegatedOAuth`, `delegatedSessionCookie`, and `delegatedTokenExchange` (per-user calls to your own API — see "Delegated downstream auth" below). Use managed `secret(...)` / `variable(...)` refs for all values that differ by org/app/env.
 
+When one connector needs independently selectable accounts, declare catalog `credentialProfiles` plus each operation’s accepted `credentials.profiles`, then bind each `server.use` alias with `bind(connector, { profile, connection: connection("logical_id", managedSecret(secret("NAME"), { scopes, audience })) })`. The alias is the stable account boundary; never put provider account ids, labels, or credential values in it. `gmailConnector()` is the curated Gmail catalog helper; reuse it under independent aliases and accept canonical `accounts` arrays in tools (one account for writes, or an explicitly ordered supported combination for reads). See the bundled `gmail-multi-account` flagship. Bound managed secrets are supported by hosted execution. `externalExchange()` is runnable only when the deployment operator injects an exact HTTPS provider endpoint/origin/audience and durable shared subject-pin store through service ports; Noodle sends a short-lived platform-signed deployment workload assertion and accepts only a bounded bearer response. Provider implementations must consume assertion replay ids through durable shared atomic storage across instances and restarts. There is intentionally no hosted enrollment or provider CRUD surface yet. The provider wire contract is public, but its conformance kit is workspace/source-only and is not an installable npm package. Bound `clientCredentials(...)` remains fail-closed until its provider slice lands.
+
 ## HTTP connector example (full server)
 
 Declare the API as data, bind it with `use`, then record calls in tools. The operation mapping in detail: `request` builds the JSON request body, `query: [...]` names the input args sent as URL query parameters, and `response` maps the parsed HTTP body (bound to `${response}`) into your typed `output`. `auth` reads a managed `secret(...)` — never inline a key. This whole example is compile-verified on every `pnpm test`.
@@ -273,7 +275,7 @@ tool('prepare_time_off', {
 });
 ```
 
-Use a stable lowercase/number/underscore id and a flat form of string/number/integer/boolean, string choices or multi-select, with optional `email`, `uri`, `date`, or `date-time` formats. Nested objects and credential-shaped fields fail with `invalid_elicitation_schema`. Every interactive flow must place all `ctx.elicit` calls before its first connector operation or compilation fails with `invalid_elicitation_flow`. Embedded/headless clients receive `input_requested`; bidirectional MCP transports map the primitive to standard form `elicitation/create`. On stateless hosts, the adapter returns a structured non-executing `interaction_unavailable` result; linked Apps render its business-user form and retry in request `_meta`, while models can use the advertised reserved retry field. Accept validates and replays only the operation-free input prefix; invalid content returns `arg_invalid`, and decline/cancel stop. Elicitation gathers missing input and does not replace confirmation. In a flow marked `confirm: true`, every eligible `input_requested` precedes `tool_proposed`; the final proposal reviews the original input, elicited values, and sole exact connector action. Accept is bound to that action and only then may execution start. A confirmable flow may contain at most one connector operation; additional operations fail with `invalid_confirmation_flow`. MCP uses final standard form confirmation on capable bidirectional transports and fails closed otherwise. Setting `interactions: { confirmationFallback: "host" }` in the server options explicitly trusts native host approval only when confirmation transport is unavailable and after every elicited field is collected; it is never inferred from client name and does not replace authorization. Omitted or `false` annotations execute directly; hints alone never gate. `annotations.action({ confirm: true })` explicitly enables confirmation; `annotations.action({ confirm: false })` explicitly preserves direct execution.
+Use a stable lowercase/number/underscore id and a flat form of string/number/integer/boolean, string choices or multi-select, with optional `email`, `uri`, `date`, or `date-time` formats. Nested objects and credential-shaped fields fail with `invalid_elicitation_schema`. Every interactive flow must place all `ctx.elicit` calls before its first connector operation or compilation fails with `invalid_elicitation_flow`. Embedded/headless clients receive `input_requested`; bidirectional MCP transports map the primitive to standard form `elicitation/create`. On stateless hosts, the adapter returns a structured non-executing `interaction_unavailable` result; linked Apps render its business-user form and retry in request `_meta`, while models can use the advertised reserved retry field. Accept validates and replays only the operation-free input prefix; invalid content returns `arg_invalid`, and decline/cancel stop. Elicitation gathers missing input and does not replace confirmation. In a flow marked `confirm: true`, every eligible `input_requested` precedes `tool_proposed`; the final proposal reviews the original input, elicited values, and sole exact eligible connector action. Conditional branches may declare multiple candidate actions only when preparation resolves exactly one eligible action from input/context or completed pure steps; zero or multiple actions fail with `invalid_confirmation_flow` before I/O. Acceptance is bound to that exact action. Later read-only operations and pure compute may assemble output, but a second eligible action fails closed. Use `ref.at(index)` for array access in recorded expressions. MCP uses final standard form confirmation on capable bidirectional transports and fails closed otherwise. Setting `interactions: { confirmationFallback: "host" }` in the server options explicitly trusts native host approval only when confirmation transport is unavailable and after every elicited field is collected; it still uses preparation and prepared execution, is never inferred from client name, and does not replace authorization. Omitted or `false` annotations execute directly; hints alone never gate. `annotations.action({ confirm: true })` explicitly enables confirmation; `annotations.action({ confirm: false })` explicitly preserves direct execution.
 
 ## Compute connector example
 

package/skills/claude-code/references/compile-errors.md

@@ -59,5 +59,9 @@ Run `noodle validate` (add `--json` for the machine-readable envelope, `--fix-pr
 | `unknown_connector_alias` | The tool calls a connector alias not declared in `use`/`provides`; add it or fix the alias (see `suggestions`). |
 | `connector_not_in_catalog` | The referenced connector is not in the resolved catalog; add it to the project connectors or correct the reference. |
 | `unknown_operation` | The connector has no such operation; use an operation declared on that connector (see `didYouMean`/`suggestions`). |
+| `connector_binding_required` | Bind the connector alias with `bind(connector, { profile, connection })`; credential-requiring operations cannot use an unbound alias. |
+| `unsupported_credential_profile` | Select a credential profile declared by the connector and accepted by the operation; use the reported suggestions instead of inventing a profile name. |
+| `credential_scope_mismatch` | Declare a connection source whose scopes include every operation-required scope, or select an external exchange provider that can mint them. |
+| `credential_audience_mismatch` | Set the connection source audience to the operation-required audience exactly, or use an external exchange provider that can mint it. |
 | `unused_connector_alias` | A declared connector alias is never called; remove the unused `use` entry or wire it into a tool. |
 | `arg_mismatch` | A connector call is missing or adds arguments; match the operation signature under `expected`/`got`. |

package/skills/claude-code/references/embedded-assistant.md

@@ -184,7 +184,7 @@ The callback records declarative fulfilment at author time; the shared runtime e
 
 ## Structured missing input
 
-A tool authored with `ctx.elicit({ id, message, input })` produces `input_requested` when it reaches missing input. Built-in and headless renderers present it and call `respond(id, { action: "accept", content })`; decline/cancel stop. Accepted content is schema-validated and completed steps are not rerun; invalid content returns `arg_invalid` and keeps the interaction pending. Elicitation gathers an input and does not approve a later write. Every interactive flow collects elicited input before its first connector operation; every eligible `input_requested` precedes `tool_proposed`. In a `confirm: true` flow, the final proposal reviews original input, elicited values, and the sole exact connector action; a confirmable flow has at most one connector operation. Accept is bound to that action. Bidirectional MCP maps missing input to standard `elicitation/create`. On a stateless host, a linked MCP App presents the same normal-user form and re-calls the tool through standard `tools/call`, carrying replay answers in request `_meta` so approval copy contains only business fields; without Apps, the model receives the exact structured schema and an advertised reserved retry field. Both paths replay only the operation-free input prefix and never expose runtime continuation or environment state. Setting `interactions: { confirmationFallback: "host" }` explicitly trusts native host approval only after every elicited field is collected and only when confirmation transport is unavailable; embedded/headless confirmation remains Noodle-owned. Omitted or false annotations execute directly; hints never gate.
+A tool authored with `ctx.elicit({ id, message, input })` produces `input_requested` when it reaches missing input. Built-in and headless renderers present it and call `respond(id, { action: "accept", content })`; decline/cancel stop. Accepted content is schema-validated and completed steps are not rerun; invalid content returns `arg_invalid` and keeps the interaction pending. Elicitation gathers an input and does not approve a later write. Every interactive flow collects elicited input before its first connector operation; every eligible `input_requested` precedes `tool_proposed`. In a `confirm: true` flow, the final proposal reviews original input, elicited values, and the sole exact eligible connector action. Conditional branches may declare candidate actions and later reads only when preparation resolves exactly one action, discloses later eligible operations, and fails with `invalid_confirmation_flow` for zero or multiple actions. Accept is bound to that action. Bidirectional MCP maps missing input to standard `elicitation/create`. On a stateless host, a linked MCP App presents the same normal-user form and re-calls the tool through standard `tools/call`, carrying replay answers in request `_meta` so approval copy contains only business fields; without Apps, the model receives the exact structured schema and an advertised reserved retry field. Both paths replay only the operation-free input prefix and never expose runtime continuation or environment state. Setting `interactions: { confirmationFallback: "host" }` explicitly trusts native host approval only after every elicited field is collected and only when confirmation transport is unavailable; it still uses the same prepared-action safety path. Embedded/headless confirmation remains Noodle-owned. Omitted or false annotations execute directly; hints never gate.
 
 ## Verified session context (identity and claims)
 
@@ -314,6 +314,7 @@ if (pendingId) {
 | Symptom | Diagnosis | Fix |
 | --- | --- | --- |
 | Widget renders but no reply arrives and model usage stays zero | Turns are not reaching the service: outdated `@noodleseed/assistant` package, or the session response was rebuilt/filtered by the backend route | Update the package to the latest version; forward the session response unchanged |
+| Widget card shows its title but an empty/blank frame (or a "could not be displayed" note) | The widget frame could not complete its bridge handshake: the page CSP blocks the hosted sandbox document (`frame-src`), the SDK predates hosted-sandbox rendering, or the deployed artifact was compiled by a now-incompatible CLI | Add the service origin to the page's `frame-src` (and `connect-src`) CSP directives; update `@noodleseed/assistant`; redeploy the app with the current `noodle` CLI |
 | `assistant-error` with code `invalid_response` | The turn endpoint returned HTML or non-SSE content (auth redirect, proxy page) | Check the backend session route path and any middleware/rewrites on the embedding app |
 | Build error `Package path ./react is not exported` | Outdated package version with import-only export conditions | Update `@noodleseed/assistant`; do not add webpack aliases or type shims |
 | Deploy fails with `server_auth_required` | `--access customers` without `server.auth` | Add direct/federated OIDC or a built-in Firebase/Microsoft adapter |

package/skills/claude-code/references/examples.md

@@ -15,6 +15,7 @@ Paths are relative to this skill directory. Assets (images/fonts) are omitted fr
 | `acme-tasks` | A two-way productivity app designed around its top-3 prioritized flows (capture/prioritize/complete), with a design-first flow spec + wireframe. | `examples/acme-tasks/src/server.ts` + `design/` |
 | `acme-bistro` | End-to-end ordering with a payment-only handoff; ships a gold-standard `design/` set (UX doc, wireframe with compliance audit, API contract). | `examples/acme-bistro/src/server.ts` + `design/` |
 | `customer-auth` | End-user (customer) auth via OIDC/Firebase bridge with delegated credentials. | `examples/customer-auth/src/server.ts` |
+| `gmail-multi-account` | One curated Gmail connector reused by two account bindings, canonical account arrays, exact mutation confirmation, and an accompanying personal-automation skill. | `examples/gmail-multi-account/src/server.ts` |
 
 ## In the repository only — `examples/<name>/` on GitHub
 

package/skills/claude-code/references/sdk-surface.md

@@ -50,7 +50,13 @@ Platform helper connectors are explicit subpath imports from `@noodleseed/one/pl
 
 ### Other
 
+- `bind`
+- `clientCredentials`
+- `connection`
 - `embeddedAssistant`
+- `externalExchange`
+- `gmailConnector`
+- `managedSecret`
 - `openAICompatible`
 
 ## Authoring signatures

package/skills/codex/SKILL.md

@@ -3,7 +3,7 @@ name: noodle-seed
 description: Use when building, validating, testing, deploying, or operating a local or hosted Noodle Seed MCP server or app authored in TypeScript with the noodle CLI.
 ---
 
-<!-- noodle-skill version:0.35.0 hash:75dd0f6f85b04858 -->
+<!-- noodle-skill version:0.37.0 hash:75dd0f6f85b04858 -->
 
 # Noodle Seed
 

package/skills/codex/examples/customer-auth/README.md

@@ -29,6 +29,13 @@ callback.
 
 ## How delegated customer credentials are used
 
+This flagship uses the legacy Firebase provider bridge because it is runnable today. That is distinct from
+Core-v2 account-selecting connector aliases: those declare catalog `credentialProfiles` and bind each alias
+with `bind(connector, { profile, connection })`. Hosted bound `managedSecret(...)` connections are runnable;
+bound `externalExchange()` and `clientCredentials(...)` currently compile as portable metadata but fail
+closed before secret or network access until their provider slice lands. Do not replace this example's
+working delegated-session-cookie path with either unsupported bound exchange source.
+
 The example has two declarations that work together:
 
 ```ts

package/skills/codex/examples/gmail-multi-account/README.md

@@ -0,0 +1,46 @@
+# Gmail multi-account automation
+
+**Owns:** The flagship proof that one reusable connector can be bound to multiple independently
+authenticated accounts inside one MCP server.
+
+This fictional example binds `gmailConnector()` twice through separate `externalExchange()` logical
+connections. Public tools always accept `accounts: [...]`; reads accept either account or the canonical
+personal-then-work pair, while mutations accept exactly one account and require runtime confirmation.
+
+Capability slot: **reusable connector + independently authenticated multi-account bindings**. It is distinct
+from `customer-auth`, which owns authentication of the MCP caller rather than downstream connector accounts.
+
+The labels `personal@example.com` and `work@example.com` are static display labels, not provider identities.
+The deployment-owned credential provider maps each logical connection to its real Google authorization.
+No Google client, provider account id, token, or real email address belongs in this project.
+
+## Safety and API boundary
+
+- Search, message/thread reads, draft reads, and vacation-setting reads may target one or both accounts.
+- Draft creation/update/send, label changes, archive, raw send, trash, and vacation updates target one account.
+- Every mutation is prepared against the exact selected binding and must be confirmed before dispatch.
+- `send_message.raw` and draft `raw` are RFC 2822 MIME bytes encoded with base64url. This example does not
+  pretend that `to`/`subject`/`body` strings are sufficient to encode Unicode MIME correctly.
+- Vacation `startTime`/`endTime` schemas enforce only digit-shaped 1–19 character epoch-millisecond strings.
+  When both are supplied, Gmail's backend remains authoritative for the required `startTime < endTime`
+  relationship; this example does not claim cross-field JSON Schema validation.
+- Trash is reversible. Permanent message/thread/draft deletion, delegation, forwarding/sharing settings,
+  and unrestricted raw HTTP requests are intentionally absent.
+
+## Local checks
+
+```sh
+noodle validate
+noodle test
+```
+
+The committed tests compile hermetic fake connector responses. They never contact Gmail or load OAuth
+credentials. A real deployment additionally needs an operator-provided external credential exchange
+endpoint for each logical connection.
+
+## Personal automation skill
+
+The source skill is [`skills/personal-email-automation/SKILL.md`](skills/personal-email-automation/SKILL.md).
+Validate it with the standard skill validator before distribution. The source skill is shipped as part of
+this example; canonical export of an app and its skill as an installable Codex plugin remains roadmap work
+and is not currently provided by Noodle Seed.

package/skills/codex/examples/gmail-multi-account/noodle.json

@@ -0,0 +1,4 @@
+{
+  "entrypoint": "src/server.ts",
+  "name": "gmail-multi-account"
+}

package/skills/codex/examples/gmail-multi-account/package.json

@@ -0,0 +1,16 @@
+{
+  "name": "gmail-multi-account",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "test": "vitest run",
+    "validate": "noodle validate",
+    "dev": "noodle dev",
+    "deploy": "noodle deploy"
+  },
+  "devDependencies": {
+    "@noodleseed/one": "latest",
+    "vitest": "latest"
+  }
+}