@noodleseed/agent-kit 0.43.0 → 0.43.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (30) hide show
  1. package/manifest.json +235 -235
  2. package/package.json +1 -1
  3. package/skills/claude-code/SKILL.md +1 -1
  4. package/skills/claude-code/authoring-mcp-servers/SKILL.md +1 -1
  5. package/skills/claude-code/building-mcp-apps/SKILL.md +1 -1
  6. package/skills/claude-code/connecting-apis-to-mcp/SKILL.md +1 -1
  7. package/skills/claude-code/debugging-mcp-delivery/SKILL.md +1 -1
  8. package/skills/claude-code/deploying-mcp-services/SKILL.md +1 -1
  9. package/skills/claude-code/designing-mcp-products/SKILL.md +1 -1
  10. package/skills/claude-code/embedding-mcp-assistants/SKILL.md +1 -1
  11. package/skills/claude-code/examples/customer-auth/README.md +13 -0
  12. package/skills/claude-code/publishing-mcp-integrations/SKILL.md +1 -1
  13. package/skills/claude-code/references/authoring-workflow.md +7 -0
  14. package/skills/claude-code/references/sdk-surface.md +1 -1
  15. package/skills/claude-code/reporting-noodle-feedback/SKILL.md +1 -1
  16. package/skills/claude-code/verifying-mcp-delivery/SKILL.md +1 -1
  17. package/skills/codex/SKILL.md +1 -1
  18. package/skills/codex/authoring-mcp-servers/SKILL.md +1 -1
  19. package/skills/codex/building-mcp-apps/SKILL.md +1 -1
  20. package/skills/codex/connecting-apis-to-mcp/SKILL.md +1 -1
  21. package/skills/codex/debugging-mcp-delivery/SKILL.md +1 -1
  22. package/skills/codex/deploying-mcp-services/SKILL.md +1 -1
  23. package/skills/codex/designing-mcp-products/SKILL.md +1 -1
  24. package/skills/codex/embedding-mcp-assistants/SKILL.md +1 -1
  25. package/skills/codex/examples/customer-auth/README.md +13 -0
  26. package/skills/codex/publishing-mcp-integrations/SKILL.md +1 -1
  27. package/skills/codex/references/authoring-workflow.md +7 -0
  28. package/skills/codex/references/sdk-surface.md +1 -1
  29. package/skills/codex/reporting-noodle-feedback/SKILL.md +1 -1
  30. package/skills/codex/verifying-mcp-delivery/SKILL.md +1 -1
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@noodleseed/agent-kit",
3
- "version": "0.43.0",
3
+ "version": "0.43.1",
4
4
  "private": false,
5
5
  "description": "Self-checking, self-updating agent skills for the Noodle Seed CLI. Authored in this repo by @noodle-borg/agent-kit; this is the published, independently-versioned canonical skills artifact the CLI fetches and verifies.",
6
6
  "license": "Apache-2.0",
package/skills/claude-code/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: noodle-seed
3
3
  description: "Use when building, validating, testing, deploying, or operating a local or hosted Noodle Seed MCP server or app authored in TypeScript with the noodle CLI."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.43.0 hash:cd6ca0d915e6acb9 -->
6
+ <!-- noodle-skill version:0.43.1 hash:cd6ca0d915e6acb9 -->
7
7
 
8
8
  # Noodle Seed
9
9
 
package/skills/claude-code/authoring-mcp-servers/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: authoring-mcp-servers
3
3
  description: "Use when creating or extending a headless Noodle Seed MCP server, tool, resource, prompt, or typed model-facing capability."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.43.0 hash:0b2fd8c7e43fc69f -->
6
+ <!-- noodle-skill version:0.43.1 hash:0b2fd8c7e43fc69f -->
7
7
 
8
8
  # authoring-mcp-servers
9
9
 
package/skills/claude-code/building-mcp-apps/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: building-mcp-apps
3
3
  description: "Use when a Noodle Seed MCP App, widget, interactive card, visual interaction, or host-visible UI is the primary requested outcome."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.43.0 hash:f7fa54992c8d7692 -->
6
+ <!-- noodle-skill version:0.43.1 hash:f7fa54992c8d7692 -->
7
7
 
8
8
  # building-mcp-apps
9
9
 
package/skills/claude-code/connecting-apis-to-mcp/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: connecting-apis-to-mcp
3
3
  description: "Use when credentials, an API URL, an OpenAPI document, or an observed response must become real Noodle Seed MCP behavior."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.43.0 hash:1e86b8704f407bd3 -->
6
+ <!-- noodle-skill version:0.43.1 hash:1e86b8704f407bd3 -->
7
7
 
8
8
  # connecting-apis-to-mcp
9
9
 
package/skills/claude-code/debugging-mcp-delivery/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: debugging-mcp-delivery
3
3
  description: "Use when an existing Noodle Seed MCP project has a concrete validation, runtime, connector, App, host, deployment, or production failure."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.43.0 hash:aa715bae12041d7c -->
6
+ <!-- noodle-skill version:0.43.1 hash:aa715bae12041d7c -->
7
7
 
8
8
  # debugging-mcp-delivery
9
9
 
package/skills/claude-code/deploying-mcp-services/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: deploying-mcp-services
3
3
  description: "Use when the user explicitly requests a Noodle Seed hosted link, configuration write, deployment, access change, rollback, or connection write."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.43.0 hash:93e735b7ffb45df1 -->
6
+ <!-- noodle-skill version:0.43.1 hash:93e735b7ffb45df1 -->
7
7
 
8
8
  # deploying-mcp-services
9
9
 
package/skills/claude-code/designing-mcp-products/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: designing-mcp-products
3
3
  description: "Use when a Noodle Seed MCP product idea needs conversational fit, user benefit, scope, interaction, or evidence design before implementation."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.43.0 hash:76cce86729cffbee -->
6
+ <!-- noodle-skill version:0.43.1 hash:76cce86729cffbee -->
7
7
 
8
8
  # designing-mcp-products
9
9
 
package/skills/claude-code/embedding-mcp-assistants/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: embedding-mcp-assistants
3
3
  description: "Use when embedding a Noodle assistant into an existing SaaS or web application with browser, identity, session, and credential boundaries."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.43.0 hash:5d8f40f904d6ab4b -->
6
+ <!-- noodle-skill version:0.43.1 hash:5d8f40f904d6ab4b -->
7
7
 
8
8
  # embedding-mcp-assistants
9
9
 
package/skills/claude-code/examples/customer-auth/README.md CHANGED
@@ -21,6 +21,19 @@ The two tools chain: `list_my_organizations` surfaces the `org_id`s the customer
21
21
  `list_org_apps` takes one of those `org_id`s. There is no NoodleSeed-specific SDK helper. The downstream API
22
22
  is an ordinary authored HTTP connector.
23
23
 
24
+ ## Direct or federated OIDC instead of the built-in adapter
25
+
26
+ This flagship uses the managed Firebase adapter. If an app replaces it with `customerAuth.oidc(...)` or
27
+ `customerAuth.federatedOidc(...)`, the app developer owns the authorization server. It must publish the
28
+ primary path-inserted RFC 8414 URL as direct HTTP 200 JSON with the exact issuer, HTTPS authorization/token/
29
+ registration/JWKS endpoints, authorization-code and refresh grants, PKCE S256, public-client auth method
30
+ `none`, RFC 8707 resource handling, an access-token `aud` equal to the exact MCP URL, and public signing keys.
31
+
32
+ Run `noodle auth doctor src/server.ts` before sharing the endpoint. Its issuer-readiness probes perform
33
+ bounded read-only GET checks and never register a client. A successful
34
+ `noodle deploy --access customers` reports the same findings as nonblocking warnings; the application team
35
+ repairs the issuer rather than adding a Noodle OAuth proxy.
36
+
24
37
  During MCP OAuth login, Noodle Cloud hosts the Firebase bridge page at
25
38
  `https://cloud.noodleseed.dev/oauth/customer/firebase/authorize`. The customer app does not add an
26
39
  authorization route. The SaaS operator only configures Firebase Auth to allow the Noodle Cloud origin, and
package/skills/claude-code/publishing-mcp-integrations/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: publishing-mcp-integrations
3
3
  description: "Use when preparing, reviewing, or submitting a Noodle Seed MCP integration to a host or app directory."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.43.0 hash:efffbf82007f935d -->
6
+ <!-- noodle-skill version:0.43.1 hash:efffbf82007f935d -->
7
7
 
8
8
  # publishing-mcp-integrations
9
9
 
package/skills/claude-code/references/authoring-workflow.md CHANGED
@@ -7,6 +7,7 @@
7
7
  - Repair loop
8
8
  - Connectors
9
9
  - HTTP connector example (full server)
10
+ - Customer OAuth for remote MCP clients
10
11
  - Delegated downstream auth (call your API as the signed-in user)
11
12
  - Invocation context
12
13
  - Compute connector example
@@ -101,6 +102,12 @@ Naming: connector operation names and tool names are lowercase-with-underscores.
101
102
 
102
103
  More: `auth.kind` is `bearer` | `apiKey` (needs `header`) | `clientCredentials` | `delegatedOAuth` | `delegatedSessionCookie` | `delegatedTokenExchange`. For client credentials use `{ kind: "clientCredentials", tokenUrl, clientId, clientSecret, scopes? }` (RFC-6749 grant); for a non-standard partner token endpoint add `profile: "custom"` with a `custom: { requestFormat, clientIdField, clientSecretField, tokenResponsePath, expirySource }` descriptor. Do not put credential headers in operation `headers`; use connector `auth`. Use `.compute(name, { input, output, run })` for a sandboxed transform; `provides:` (instead of `use:`) exposes a connector only to compute `callOperation`; and `noodle import openapi <file>` generates a connector from an OpenAPI spec.
103
104
 
105
+ ## Customer OAuth for remote MCP clients
106
+
107
+ For `customerAuth.oidc(...)` and `.federatedOidc(...)`, the application developer owns the standards-compliant authorization server. Noodle verifies its access tokens; it does not proxy discovery, create OAuth clients, or repair the upstream server. For issuer `https://id.example.com/oauth`, publish the path-inserted RFC 8414 document at `https://id.example.com/.well-known/oauth-authorization-server/oauth` as direct unauthenticated HTTP 200 JSON — never a login redirect.
108
+
109
+ That metadata must expose HTTPS `authorization_endpoint`, `token_endpoint`, `jwks_uri`, and RFC 7591 `registration_endpoint`; advertise authorization-code and refresh-token grants, Dynamic Client Registration, PKCE with `code_challenge_methods_supported: ["S256"]`, and public clients with `token_endpoint_auth_methods_supported: ["none"]`. Implement RFC 8707 `resource`, mint access-token `aud` for the exact MCP resource URL, and publish only public signing keys in JWKS. Run `noodle auth doctor src/server.ts`; its issuer-readiness probes perform bounded read-only GET checks and never register a client. A successful `noodle deploy --access customers` reports the same readiness without turning a diagnostic failure into a failed deployment.
110
+
104
111
  ## Delegated downstream auth (call your API as the signed-in user)
105
112
 
106
113
  Use delegated connector auth when the downstream API must enforce its own per-user authorization — a shared service credential plus a forwarded user id would bypass it. Three shapes exist; pick by who owns the downstream:
package/skills/claude-code/references/sdk-surface.md CHANGED
@@ -41,7 +41,7 @@ Platform helper connectors are explicit subpath imports from `@noodleseed/one/pl
41
41
 
42
42
  ### Customer auth
43
43
 
44
- - `customerAuth.oidc(...)`, `.firebase(...)`, `.microsoft(...)`, or `.bridge(...)` — end-user/customer identity for `--access customers` deployments. Firebase Web App fields are browser-visible configuration: use `variable(...)`, not `secret(...)`, and restrict the key in Firebase.
44
+ - `customerAuth.oidc(...)`, `.federatedOidc(...)`, `.firebase(...)`, or `.microsoft(...)` — end-user/customer identity for `--access customers` deployments. A direct/federated issuer must publish direct RFC 8414 discovery, Dynamic Client Registration, authorization-code + refresh grants, PKCE `code_challenge_methods_supported: ["S256"]`, public-client `token_endpoint_auth_methods_supported: ["none"]`, and a public JWKS; verify it with `noodle auth doctor src/server.ts`. Firebase Web App fields are browser-visible configuration: use `variable(...)`, not `secret(...)`, and restrict the key in Firebase.
45
45
 
46
46
  ### Sessions
47
47
 
package/skills/claude-code/reporting-noodle-feedback/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: reporting-noodle-feedback
3
3
  description: "Use when a Noodle Seed bug, misleading instruction, missing capability, or concrete product improvement should be proposed to the user."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.43.0 hash:0f404109f4845683 -->
6
+ <!-- noodle-skill version:0.43.1 hash:0f404109f4845683 -->
7
7
 
8
8
  # reporting-noodle-feedback
9
9
 
package/skills/claude-code/verifying-mcp-delivery/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: verifying-mcp-delivery
3
3
  description: "Use when proving a Noodle Seed MCP project works at a named compile, local, connector, App, host, deployment, or production evidence level."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.43.0 hash:6ef6ef551e26b78e -->
6
+ <!-- noodle-skill version:0.43.1 hash:6ef6ef551e26b78e -->
7
7
 
8
8
  # verifying-mcp-delivery
9
9
 
package/skills/codex/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: noodle-seed
3
3
  description: "Use when building, validating, testing, deploying, or operating a local or hosted Noodle Seed MCP server or app authored in TypeScript with the noodle CLI."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.43.0 hash:cd6ca0d915e6acb9 -->
6
+ <!-- noodle-skill version:0.43.1 hash:cd6ca0d915e6acb9 -->
7
7
 
8
8
  # Noodle Seed
9
9
 
package/skills/codex/authoring-mcp-servers/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: authoring-mcp-servers
3
3
  description: "Use when creating or extending a headless Noodle Seed MCP server, tool, resource, prompt, or typed model-facing capability."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.43.0 hash:0b2fd8c7e43fc69f -->
6
+ <!-- noodle-skill version:0.43.1 hash:0b2fd8c7e43fc69f -->
7
7
 
8
8
  # authoring-mcp-servers
9
9
 
package/skills/codex/building-mcp-apps/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: building-mcp-apps
3
3
  description: "Use when a Noodle Seed MCP App, widget, interactive card, visual interaction, or host-visible UI is the primary requested outcome."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.43.0 hash:f7fa54992c8d7692 -->
6
+ <!-- noodle-skill version:0.43.1 hash:f7fa54992c8d7692 -->
7
7
 
8
8
  # building-mcp-apps
9
9
 
package/skills/codex/connecting-apis-to-mcp/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: connecting-apis-to-mcp
3
3
  description: "Use when credentials, an API URL, an OpenAPI document, or an observed response must become real Noodle Seed MCP behavior."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.43.0 hash:1e86b8704f407bd3 -->
6
+ <!-- noodle-skill version:0.43.1 hash:1e86b8704f407bd3 -->
7
7
 
8
8
  # connecting-apis-to-mcp
9
9
 
package/skills/codex/debugging-mcp-delivery/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: debugging-mcp-delivery
3
3
  description: "Use when an existing Noodle Seed MCP project has a concrete validation, runtime, connector, App, host, deployment, or production failure."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.43.0 hash:aa715bae12041d7c -->
6
+ <!-- noodle-skill version:0.43.1 hash:aa715bae12041d7c -->
7
7
 
8
8
  # debugging-mcp-delivery
9
9
 
package/skills/codex/deploying-mcp-services/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: deploying-mcp-services
3
3
  description: "Use when the user explicitly requests a Noodle Seed hosted link, configuration write, deployment, access change, rollback, or connection write."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.43.0 hash:93e735b7ffb45df1 -->
6
+ <!-- noodle-skill version:0.43.1 hash:93e735b7ffb45df1 -->
7
7
 
8
8
  # deploying-mcp-services
9
9
 
package/skills/codex/designing-mcp-products/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: designing-mcp-products
3
3
  description: "Use when a Noodle Seed MCP product idea needs conversational fit, user benefit, scope, interaction, or evidence design before implementation."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.43.0 hash:76cce86729cffbee -->
6
+ <!-- noodle-skill version:0.43.1 hash:76cce86729cffbee -->
7
7
 
8
8
  # designing-mcp-products
9
9
 
package/skills/codex/embedding-mcp-assistants/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: embedding-mcp-assistants
3
3
  description: "Use when embedding a Noodle assistant into an existing SaaS or web application with browser, identity, session, and credential boundaries."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.43.0 hash:5d8f40f904d6ab4b -->
6
+ <!-- noodle-skill version:0.43.1 hash:5d8f40f904d6ab4b -->
7
7
 
8
8
  # embedding-mcp-assistants
9
9
 
package/skills/codex/examples/customer-auth/README.md CHANGED
@@ -21,6 +21,19 @@ The two tools chain: `list_my_organizations` surfaces the `org_id`s the customer
21
21
  `list_org_apps` takes one of those `org_id`s. There is no NoodleSeed-specific SDK helper. The downstream API
22
22
  is an ordinary authored HTTP connector.
23
23
 
24
+ ## Direct or federated OIDC instead of the built-in adapter
25
+
26
+ This flagship uses the managed Firebase adapter. If an app replaces it with `customerAuth.oidc(...)` or
27
+ `customerAuth.federatedOidc(...)`, the app developer owns the authorization server. It must publish the
28
+ primary path-inserted RFC 8414 URL as direct HTTP 200 JSON with the exact issuer, HTTPS authorization/token/
29
+ registration/JWKS endpoints, authorization-code and refresh grants, PKCE S256, public-client auth method
30
+ `none`, RFC 8707 resource handling, an access-token `aud` equal to the exact MCP URL, and public signing keys.
31
+
32
+ Run `noodle auth doctor src/server.ts` before sharing the endpoint. Its issuer-readiness probes perform
33
+ bounded read-only GET checks and never register a client. A successful
34
+ `noodle deploy --access customers` reports the same findings as nonblocking warnings; the application team
35
+ repairs the issuer rather than adding a Noodle OAuth proxy.
36
+
24
37
  During MCP OAuth login, Noodle Cloud hosts the Firebase bridge page at
25
38
  `https://cloud.noodleseed.dev/oauth/customer/firebase/authorize`. The customer app does not add an
26
39
  authorization route. The SaaS operator only configures Firebase Auth to allow the Noodle Cloud origin, and
package/skills/codex/publishing-mcp-integrations/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: publishing-mcp-integrations
3
3
  description: "Use when preparing, reviewing, or submitting a Noodle Seed MCP integration to a host or app directory."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.43.0 hash:efffbf82007f935d -->
6
+ <!-- noodle-skill version:0.43.1 hash:efffbf82007f935d -->
7
7
 
8
8
  # publishing-mcp-integrations
9
9
 
package/skills/codex/references/authoring-workflow.md CHANGED
@@ -7,6 +7,7 @@
7
7
  - Repair loop
8
8
  - Connectors
9
9
  - HTTP connector example (full server)
10
+ - Customer OAuth for remote MCP clients
10
11
  - Delegated downstream auth (call your API as the signed-in user)
11
12
  - Invocation context
12
13
  - Compute connector example
@@ -101,6 +102,12 @@ Naming: connector operation names and tool names are lowercase-with-underscores.
101
102
 
102
103
  More: `auth.kind` is `bearer` | `apiKey` (needs `header`) | `clientCredentials` | `delegatedOAuth` | `delegatedSessionCookie` | `delegatedTokenExchange`. For client credentials use `{ kind: "clientCredentials", tokenUrl, clientId, clientSecret, scopes? }` (RFC-6749 grant); for a non-standard partner token endpoint add `profile: "custom"` with a `custom: { requestFormat, clientIdField, clientSecretField, tokenResponsePath, expirySource }` descriptor. Do not put credential headers in operation `headers`; use connector `auth`. Use `.compute(name, { input, output, run })` for a sandboxed transform; `provides:` (instead of `use:`) exposes a connector only to compute `callOperation`; and `noodle import openapi <file>` generates a connector from an OpenAPI spec.
103
104
 
105
+ ## Customer OAuth for remote MCP clients
106
+
107
+ For `customerAuth.oidc(...)` and `.federatedOidc(...)`, the application developer owns the standards-compliant authorization server. Noodle verifies its access tokens; it does not proxy discovery, create OAuth clients, or repair the upstream server. For issuer `https://id.example.com/oauth`, publish the path-inserted RFC 8414 document at `https://id.example.com/.well-known/oauth-authorization-server/oauth` as direct unauthenticated HTTP 200 JSON — never a login redirect.
108
+
109
+ That metadata must expose HTTPS `authorization_endpoint`, `token_endpoint`, `jwks_uri`, and RFC 7591 `registration_endpoint`; advertise authorization-code and refresh-token grants, Dynamic Client Registration, PKCE with `code_challenge_methods_supported: ["S256"]`, and public clients with `token_endpoint_auth_methods_supported: ["none"]`. Implement RFC 8707 `resource`, mint access-token `aud` for the exact MCP resource URL, and publish only public signing keys in JWKS. Run `noodle auth doctor src/server.ts`; its issuer-readiness probes perform bounded read-only GET checks and never register a client. A successful `noodle deploy --access customers` reports the same readiness without turning a diagnostic failure into a failed deployment.
110
+
104
111
  ## Delegated downstream auth (call your API as the signed-in user)
105
112
 
106
113
  Use delegated connector auth when the downstream API must enforce its own per-user authorization — a shared service credential plus a forwarded user id would bypass it. Three shapes exist; pick by who owns the downstream:
package/skills/codex/references/sdk-surface.md CHANGED
@@ -41,7 +41,7 @@ Platform helper connectors are explicit subpath imports from `@noodleseed/one/pl
41
41
 
42
42
  ### Customer auth
43
43
 
44
- - `customerAuth.oidc(...)`, `.firebase(...)`, `.microsoft(...)`, or `.bridge(...)` — end-user/customer identity for `--access customers` deployments. Firebase Web App fields are browser-visible configuration: use `variable(...)`, not `secret(...)`, and restrict the key in Firebase.
44
+ - `customerAuth.oidc(...)`, `.federatedOidc(...)`, `.firebase(...)`, or `.microsoft(...)` — end-user/customer identity for `--access customers` deployments. A direct/federated issuer must publish direct RFC 8414 discovery, Dynamic Client Registration, authorization-code + refresh grants, PKCE `code_challenge_methods_supported: ["S256"]`, public-client `token_endpoint_auth_methods_supported: ["none"]`, and a public JWKS; verify it with `noodle auth doctor src/server.ts`. Firebase Web App fields are browser-visible configuration: use `variable(...)`, not `secret(...)`, and restrict the key in Firebase.
45
45
 
46
46
  ### Sessions
47
47
 
package/skills/codex/reporting-noodle-feedback/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: reporting-noodle-feedback
3
3
  description: "Use when a Noodle Seed bug, misleading instruction, missing capability, or concrete product improvement should be proposed to the user."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.43.0 hash:0f404109f4845683 -->
6
+ <!-- noodle-skill version:0.43.1 hash:0f404109f4845683 -->
7
7
 
8
8
  # reporting-noodle-feedback
9
9
 
package/skills/codex/verifying-mcp-delivery/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: verifying-mcp-delivery
3
3
  description: "Use when proving a Noodle Seed MCP project works at a named compile, local, connector, App, host, deployment, or production evidence level."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.43.0 hash:6ef6ef551e26b78e -->
6
+ <!-- noodle-skill version:0.43.1 hash:6ef6ef551e26b78e -->
7
7
 
8
8
  # verifying-mcp-delivery
9
9