@noodleseed/agent-kit 0.54.0 → 0.56.0

package/skills/claude-code/examples/customer-auth/src/server.ts

@@ -2,6 +2,7 @@ import {
   annotations,
   connector,
   customerAuth,
+  customerEndpoint,
   embeddedAssistant,
   openAICompatible,
   secret,
@@ -11,18 +12,21 @@ import {
   z,
 } from '@noodleseed/one';
 
-const noodleseedApiOrigin = 'https://dev.noodleseed.com';
+const customerApi = customerEndpoint('customer_api', {
+  allowedHttpsHostSuffixes: ['api.noodleseed.dev'],
+});
 
 const noodleseedApi = connector('noodleseed_app_api')
   .version('1.0.0')
   .http({
-    baseUrl: noodleseedApiOrigin,
-    allowedOrigins: [noodleseedApiOrigin],
+    baseUrl: customerApi,
     auth: {
-      kind: 'delegatedSessionCookie',
-      provider: 'firebase',
-      sessionUrl: `${noodleseedApiOrigin}/api/auth/session`,
-      tokenField: 'idToken',
+      kind: 'delegatedTokenExchange',
+      tokenUrl: 'https://id.noodleseed.dev/oauth/token',
+      clientId: variable('CUSTOMER_API_CLIENT_ID'),
+      clientSecret: secret('CUSTOMER_API_CLIENT_SECRET'),
+      scopes: ['organizations:read', 'org_apps:read', 'org_apps:write'],
+      audience: 'noodleseed-customer-api',
     },
     operations: {
       list_org_apps: {
@@ -49,6 +53,19 @@ const noodleseedApi = connector('noodleseed_app_api')
           organizations: '${response.organizations}',
         },
       },
+      archive_org_app: {
+        type: 'action',
+        method: 'POST',
+        path: '/api/organizations/${args.org_id}/apps/${args.app_id}/archive',
+        input: z.object({
+          org_id: z.string(),
+          app_id: z.string(),
+        }),
+        output: z.object({ archived: z.boolean() }),
+        response: {
+          archived: '${response.archived}',
+        },
+      },
     },
   });
 
@@ -69,22 +86,26 @@ export default server(
       },
     },
     use: { app_api: noodleseedApi },
-    auth: customerAuth.firebase({
-      projectId: variable('FIREBASE_PROJECT_ID'),
-      apiKey: variable('FIREBASE_WEB_API_KEY'),
-      authDomain: variable('FIREBASE_AUTH_DOMAIN'),
-      user: {
+    interactions: { confirmationFallback: 'host' },
+    auth: customerAuth.oidc({
+      issuer: 'https://id.noodleseed.dev',
+      audience: 'https://org.cloud.noodleseed.dev/app/mcp',
+      claims: {
         id: 'sub',
         email: 'email',
         name: 'name',
-        tenant: 'firebase.tenant',
-        orgs: 'claims.orgs',
-        roles: 'claims.roles',
-        scopes: 'claims.scopes',
+        orgs: 'permissions.orgs',
+        roles: 'permissions.roles',
+        scopes: 'permissions.scopes',
+      },
+      routing: {
+        endpoints: {
+          customer_api: { claim: 'tenant.api_base_url' },
+        },
       },
     }),
     instructions:
-      'Customer-authenticated demo. Firebase proves the customer identity, while read-only NoodleSeed.com API calls use broker-managed delegated Firebase customer credentials.',
+      'Direct/federated MCP OIDC demo. The customer IdP proves identity and privately selects the tenant API base URL, while the broker supplies delegated credentials and confirmed actions stay bound to the reviewed route.',
     assistant: embeddedAssistant({
       model: openAICompatible({
         baseUrl: variable('ASSISTANT_MODEL_BASE_URL'),
@@ -111,13 +132,13 @@ export default server(
         },
         composer: { leadingIcon: 'brand-mark', shape: 'pill' },
       },
-      suggestedPrompts: ['Show my organizations', 'List the apps in my organization'],
+      suggestedPrompts: ['Explain how to connect this customer-authenticated MCP server'],
     }),
   },
   [
     tool('list_org_apps', {
       title: 'List organization apps',
-      description: 'List NoodleSeed.com apps for an organization from the dev app API.',
+      description: 'List NoodleSeed.com apps for an organization from its customer API.',
       authorization: {
         requiredScopes: ['org_apps:read'],
         allowedRoles: ['org_admin', 'org_member'],
@@ -147,7 +168,7 @@ export default server(
       description: 'List the NoodleSeed.com organizations the signed-in customer belongs to.',
       contextProvider: true,
       input: z.object({}),
-      // The dev app API returns every organization for the signed-in customer in one response, with no
+      // The customer API returns every organization for the signed-in customer in one response, with no
       // page parameter to pass through, so the bound is declared on the shape. A customer belongs to a
       // handful of organizations; `noodle check` reports an unbounded list as
       // `tool_design_output_bounds`.
@@ -162,5 +183,30 @@ export default server(
         };
       },
     }),
+    tool('archive_org_app', {
+      title: 'Archive organization app',
+      description: 'Archive one NoodleSeed.com app through its customer API after confirmation.',
+      authorization: {
+        requiredScopes: ['org_apps:write'],
+        allowedRoles: ['org_admin'],
+      },
+      input: z.object({
+        org_id: z.string().meta({ title: 'Organization' }),
+        app_id: z.string().meta({ title: 'App' }),
+      }),
+      output: z.object({
+        archived: z.boolean(),
+      }),
+      annotations: annotations.openAction({ destructive: false, confirm: true }),
+      fulfil({ input, connectors }) {
+        const result = connectors.app_api.archiveOrgApp({
+          org_id: input.org_id,
+          app_id: input.app_id,
+        });
+        return {
+          archived: result.archived,
+        };
+      },
+    }),
   ],
 );

package/skills/claude-code/examples/customer-auth/test/server.test.ts

@@ -23,17 +23,47 @@ describe('customer-auth example', () => {
       name: 'Noodle Seed Assistant',
       colorScheme: 'auto',
     });
-    expect(manifest.server.auth).toMatchObject({
-      kind: 'bridge',
-      provider: 'firebase',
-      projectId: '${env.FIREBASE_PROJECT_ID}',
-      apiKey: '${env.FIREBASE_WEB_API_KEY}',
-      authDomain: '${env.FIREBASE_AUTH_DOMAIN}',
-      user: {
-        roles: 'claims.roles',
-        scopes: 'claims.scopes',
+    expect(manifest.server.auth).toEqual({
+      kind: 'oidc',
+      issuer: 'https://id.noodleseed.dev',
+      audience: 'https://org.cloud.noodleseed.dev/app/mcp',
+      claims: {
+        id: 'sub',
+        email: 'email',
+        name: 'name',
+        orgs: 'permissions.orgs',
+        roles: 'permissions.roles',
+        scopes: 'permissions.scopes',
+      },
+      routing: {
+        endpoints: {
+          customer_api: { claim: 'tenant.api_base_url' },
+        },
+      },
+    });
+    expect(manifest.server.interactions).toEqual({ confirmationFallback: 'host' });
+    const catalog = app.toConnectorCatalog();
+    expect(catalog?.connectors).toHaveLength(1);
+    expect(catalog?.connectors[0]?.http).toMatchObject({
+      baseUrl: {
+        kind: 'customerEndpoint',
+        name: 'customer_api',
+        policy: { allowedHttpsHostSuffixes: ['api.noodleseed.dev'] },
+      },
+      auth: {
+        kind: 'delegatedTokenExchange',
+        tokenUrl: 'https://id.noodleseed.dev/oauth/token',
+        clientId: '${env.CUSTOMER_API_CLIENT_ID}',
+        clientSecret: 'CUSTOMER_API_CLIENT_SECRET',
       },
     });
+    expect(catalog?.connectors[0]?.operations).toMatchObject({
+      list_org_apps: { type: 'read' },
+      list_organizations: { type: 'read' },
+      archive_org_app: { type: 'action', method: 'POST' },
+    });
+    expect(catalog?.connectors[0]?.http).not.toHaveProperty('allowedOrigins');
+    expect(JSON.stringify({ manifest, catalog })).not.toContain('tenant-a.api.noodleseed.dev');
     expect(manifest.tools.find((tool) => tool.name === 'list_org_apps')?.authorization).toEqual({
       requiredScopes: ['org_apps:read'],
       allowedRoles: ['org_admin', 'org_member'],
@@ -41,5 +71,17 @@ describe('customer-auth example', () => {
     expect(
       manifest.tools.find((tool) => tool.name === 'list_my_organizations')?.authorization,
     ).toBeUndefined();
+    expect(manifest.tools.find((tool) => tool.name === 'archive_org_app')).toMatchObject({
+      authorization: {
+        requiredScopes: ['org_apps:write'],
+        allowedRoles: ['org_admin'],
+      },
+      annotations: {
+        readOnlyHint: false,
+        destructiveHint: false,
+        openWorldHint: true,
+        confirm: true,
+      },
+    });
   });
 });

package/skills/claude-code/executing-noodle-plans/SKILL.md

@@ -3,7 +3,7 @@ name: executing-noodle-plans
 description: "Use when the user asks to execute an approved, decision-complete implementation plan for a Noodle Seed project task by task with test-first changes, review, recovery, and final verification."
 ---
 
-<!-- noodle-skill version:0.54.0 hash:6a9f132ddb79352e -->
+<!-- noodle-skill version:0.56.0 hash:6a9f132ddb79352e -->
 
 # Execute a Noodle Seed implementation plan
 

package/skills/claude-code/publishing-mcp-integrations/SKILL.md

@@ -3,7 +3,7 @@ name: publishing-mcp-integrations
 description: "Use when preparing, reviewing, or submitting a Noodle Seed MCP integration to a host or app directory."
 ---
 
-<!-- noodle-skill version:0.54.0 hash:efffbf82007f935d -->
+<!-- noodle-skill version:0.56.0 hash:efffbf82007f935d -->
 
 # publishing-mcp-integrations
 

package/skills/claude-code/references/authoring-workflow.md

@@ -8,6 +8,7 @@
 - Connectors
 - HTTP connector example (full server)
 - Customer OAuth for remote MCP clients
+- Auth-derived customer API endpoints
 - Per-tool authorization
 - Delegated downstream auth (call your API as the signed-in user)
 - Invocation context
@@ -109,6 +110,94 @@ For `customerAuth.oidc(...)` and `.federatedOidc(...)`, the application develope
 
 That metadata must expose HTTPS `authorization_endpoint`, `token_endpoint`, `jwks_uri`, and RFC 7591 `registration_endpoint`; advertise authorization-code and refresh-token grants, Dynamic Client Registration, PKCE with `code_challenge_methods_supported: ["S256"]`, and public clients with `token_endpoint_auth_methods_supported: ["none"]`. Implement RFC 8707 `resource`, mint access-token `aud` for the exact MCP resource URL, and publish only public signing keys in JWKS. Run `noodle auth doctor src/server.ts`; its issuer-readiness probes perform bounded read-only GET checks and never register a client. A successful `noodle deploy --access customers` reports the same readiness without turning a diagnostic failure into a failed deployment.
 
+## Auth-derived customer API endpoints
+
+Use a customer endpoint when the verified IdP selects a different API base URL for each SaaS customer. The claim contains the complete base URL; tool input and `${user}` do not select it. Declare one named policy, use that reference as the connector `baseUrl`, and map its claim path in direct OIDC or on every federated issuer:
+
+```ts
+import { annotations, connector, customerAuth, customerEndpoint, secret, server, tool, variable, z } from '@noodleseed/one';
+
+const customerApi = customerEndpoint('customer_api', {
+  allowedHttpsHostSuffixes: ['api.noodleseed.dev'],
+});
+
+const api = connector('customer_api_connector').version('1.0.0').http({
+  baseUrl: customerApi,
+  auth: {
+    kind: 'delegatedTokenExchange',
+    tokenUrl: 'https://id.noodleseed.dev/oauth/token',
+    clientId: variable('CUSTOMER_API_CLIENT_ID'),
+    clientSecret: secret('CUSTOMER_API_CLIENT_SECRET'),
+  },
+  operations: {
+    list_records: {
+      type: 'read',
+      method: 'GET',
+      path: '/records',
+      input: z.object({}),
+      output: z.object({ records: z.array(z.unknown()).max(100) }),
+    },
+    archive_record: {
+      type: 'action',
+      method: 'POST',
+      path: '/records/${args.record_id}/archive',
+      input: z.object({ record_id: z.string() }),
+      output: z.object({ archived: z.boolean() }),
+    },
+  },
+});
+
+export default server(
+  'customer_records',
+  {
+    title: 'Customer records',
+    version: '1.0.0',
+    use: { api },
+    interactions: { confirmationFallback: 'host' },
+    auth: customerAuth.oidc({
+      issuer: 'https://id.noodleseed.dev',
+      audience: 'https://org.cloud.noodleseed.dev/app/mcp',
+      routing: {
+        endpoints: {
+          customer_api: { claim: 'tenant.api_base_url' },
+        },
+      },
+    }),
+  },
+  [
+    tool('list_records', {
+      description: 'List records for the signed-in customer.',
+      input: z.object({}),
+      output: z.object({ records: z.array(z.unknown()).max(100) }),
+      fulfil: ({ connectors }) => {
+        const result = connectors.api.listRecords();
+        return { records: result.records };
+      },
+    }),
+    tool('archive_record', {
+      description: 'Archive one record for the signed-in customer.',
+      input: z.object({ record_id: z.string() }),
+      output: z.object({ archived: z.boolean() }),
+      annotations: annotations.openAction({ destructive: false, confirm: true }),
+      fulfil({ input, connectors }) {
+        const result = connectors.api.archiveRecord({ record_id: input.record_id });
+        return { archived: result.archived };
+      },
+    }),
+  ],
+);
+```
+
+`customerEndpoint` accepts exactly one non-empty policy arm: exact HTTPS origins, or HTTPS hostname suffixes. Exact policies may authorize an explicit non-default port; suffix policies allow port 443 and match only the exact host or dot-boundary subdomains. Do not add connector `allowedOrigins` to a customer-routed connector. Its fixed credential/token endpoints are validated independently and cannot come from caller claims.
+
+On a bidirectional MCP transport whose client negotiated form elicitation, Noodle sends the standard confirmation form. The current stateless hosted MCP transport cannot initiate that exchange, so the example explicitly declares `server.interactions.confirmationFallback: 'host'`. That fallback trusts the MCP host to have collected native write approval before the tool call reaches Noodle; it is never inferred from client identity and does not replace authentication, authorization, policy, or accurate action/destructive annotations. Omit it when connected hosts are not trusted to provide that approval; confirmation then fails closed with `interaction_unavailable` when the standard exchange is unavailable.
+
+Every federated issuer must repeat every endpoint key used by the app, although each issuer may choose a different claim path. Endpoint names use lowercase letters, numbers, and underscores. Resolved claims must be exact absolute HTTPS URLs of at most 2,048 UTF-8 bytes with no userinfo, query, fragment, IP literal, special-use host, or unsafe whitespace/control characters. The runtime preserves a canonical optional base path.
+
+Resolved customer URLs are private routing authority: they never enter the manifest/artifact, `${user}`, logs, model output, widgets, public confirmation review, cache keys, or delegated-token-exchange assertions. Routed reads may be used by tools, including declared nested calls. A routed action—including one reached through a connector wrapper—requires exact `annotations.confirm: true`; omitted or `false` fails with `customer_endpoint_action_unsupported`. Routed resources, prompts, and ambient context fail with `customer_endpoint_surface_unsupported`.
+
+At runtime, an initially missing, malformed, or disallowed claim returns the same safe `connector_route_unavailable` tool error before credential lookup or connector egress. Preparation stores only sorted route `{ key, fingerprint }` bindings in the private server-held continuation. Acceptance re-resolves the current request routes; a missing or changed binding returns `invalid_continuation` before policy, credentials, or egress, then the matching frozen snapshot is reused for the action and nested/later calls. `tools/list` remains based only on roles and scopes, so route availability neither reveals tenant topology nor changes the existing authorization filter.
+
 ## Per-tool authorization
 
 Keep endpoint authentication in `customerAuth.*(...)`, then narrow individual tools with the optional typed `authorization` rule. Every `requiredScopes` value is required; any one `allowedRoles` value is sufficient; when both lists are present, both conditions apply. Omit `authorization` for an unrestricted tool. Do not invent a policy expression language or infer authorization from tool arguments, page context, connector output, email domains, or other unverified data.
@@ -135,7 +224,7 @@ Role values are trusted only from the explicitly configured claim path (or the p
 
 Use delegated connector auth when the downstream API must enforce its own per-user authorization — a shared service credential plus a forwarded user id would bypass it. Three shapes exist; pick by who owns the downstream:
 
-- **`delegatedTokenExchange`** — your own API. The platform signs a short-lived, verifiable assertion of the signed-in user and exchanges it at a token endpoint you implement (RFC 8693). Works with verified customer OIDC identities, the built-in Firebase/Microsoft adapters, and embedded-assistant sessions; no per-user OAuth enrollment.
+- **`delegatedTokenExchange`** — your own API. The platform signs a short-lived, verifiable assertion of the signed-in user and exchanges it at a token endpoint you implement (RFC 8693). It works with verified customer OIDC identities and the built-in Firebase/Microsoft adapters; no per-user OAuth enrollment. Embedded-assistant sessions support this exchange for static connectors. Customer-routed connectors require a direct or federated MCP OIDC request and fail closed in embedded-assistant sessions because those sessions carry no IdP endpoint claim.
 - **`delegatedOAuth` with `provider: "firebase" | "microsoft"`** — Noodle-managed bridge providers using stored per-user refresh tokens. Requires the matching `customerAuth` bridge; any other provider string is the compile error `unsupported_delegated_provider`.
 - **`delegatedSessionCookie`** — Firebase-managed session-cookie apps only; not a generic mechanism.
 
@@ -144,7 +233,7 @@ Use delegated connector auth when the downstream API must enforce its own per-us
 ```ts
 auth: {
   kind: 'delegatedTokenExchange',
-  tokenUrl: 'https://app.example.com/api/assistant/oauth/token', // origin must be in allowedOrigins
+  tokenUrl: 'https://app.example.com/api/assistant/oauth/token', // fixed HTTPS; static connectors also allowlist its origin
   clientId: variable('EXAMPLE_DELEG_CLIENT_ID'),
   clientSecret: secret('EXAMPLE_DELEG_CLIENT_SECRET'),
   scopes: ['time_off'],           // optional
@@ -167,7 +256,7 @@ scope=time_off            (space-joined, when configured)
 audience=example-api      (when configured)
 ```
 
-The `subject_token` claims: `iss` (platform issuer; JWKS at `{iss}/.well-known/jwks.json`), `sub` (verified user id), `aud` (your configured audience or the tokenUrl), `email`, `name`, `claims` (declared session claims), `tenant` (`org/app/env`), `deployment`, `iat`, `exp` (about 120 s), `jti`. Respond with `{ "access_token": "...", "token_type": "Bearer", "expires_in": 900 }`; the broker caches per user + connector + scopes until `expires_in` minus 300 s and presents the token downstream as `Authorization: Bearer`.
+The `subject_token` claims: `iss` (platform issuer; JWKS at `{iss}/.well-known/jwks.json`), `sub` (verified user id), `aud` (your configured audience or the tokenUrl), `email`, `name`, `claims` (declared session claims), `tenant` (`org/app/env`), `deployment`, `iat`, `exp` (about 120 s), `jti`. A routed exchange adds `route: { key, fingerprint }`, never the customer URL; credential cache and single-flight keys include that route binding. Respond with `{ "access_token": "...", "token_type": "Bearer", "expires_in": 900 }`; the broker caches per user + connector + scopes + route until `expires_in` minus 300 s and presents the token downstream as `Authorization: Bearer`.
 
 ### The downstream token endpoint (your backend)
 

package/skills/claude-code/references/compile-errors.md

@@ -63,5 +63,14 @@ Run `noodle validate` (add `--json` for the machine-readable envelope, `--fix-pr
 | `unsupported_credential_profile` | Select a credential profile declared by the connector and accepted by the operation; use the reported suggestions instead of inventing a profile name. |
 | `credential_scope_mismatch` | Declare a connection source whose scopes include every operation-required scope, or select an external exchange provider that can mint them. |
 | `credential_audience_mismatch` | Set the connection source audience to the operation-required audience exactly, or use an external exchange provider that can mint it. |
+| `customer_endpoint_auth_required` | Protect the app with direct or federated `customerAuth` OIDC and map every reachable `customerEndpoint` key under auth routing. |
+| `customer_endpoint_mapping_required` | Add the endpoint key at the cited auth routing path; every direct/federated issuer must map every customer endpoint used by the app. |
+| `customer_endpoint_unknown_mapping` | Remove the unknown or unused auth routing key, or use that exact declared `customerEndpoint` key from a reachable connector operation. |
+| `customer_endpoint_bridge_unsupported` | Replace the Firebase/Microsoft bridge with direct or federated OIDC before using auth-derived customer connector endpoints. |
+| `customer_endpoint_action_unsupported` | Set exact `annotations.confirm: true` on the enclosing tool, or keep the customer-routed operation read-only; action hints alone do not enable confirmation. |
+| `customer_endpoint_surface_unsupported` | Move the customer-routed call into a tool fulfilment; routed resources, prompts, and ambient providers are unsupported. |
+| `customer_endpoint_credential_source_unsupported` | Remove the manifest connection binding; a customer-routed connector uses its declared delegated token exchange auth or no auth. |
+| `customer_endpoint_policy_conflict` | Give every reachable declaration of this endpoint key one identical policy, or rename keys whose allowed origins differ. |
+| `customer_endpoint_routing_inconsistent` | Regenerate the connector catalog so every action route includes all of its ordinary customer endpoint dependencies. |
 | `unused_connector_alias` | A declared connector alias is never called; remove the unused `use` entry or wire it into a tool. |
 | `arg_mismatch` | A connector call is missing or adds arguments; match the operation signature under `expected`/`got`. |

package/skills/claude-code/references/examples.md

@@ -14,7 +14,7 @@ Paths are relative to this skill directory. Assets (images/fonts) are omitted fr
 | `acme-discovery` | Top-of-funnel discovery→handoff: a discovery carousel, a `create_handoff` deep link, and a design-first UX spec + wireframe. | `examples/acme-discovery/src/server.ts` + `design/` |
 | `acme-tasks` | A two-way productivity app designed around its top-3 prioritized flows (capture/prioritize/complete), with a design-first flow spec + wireframe. | `examples/acme-tasks/src/server.ts` + `design/` |
 | `acme-bistro` | End-to-end ordering with a payment-only handoff; ships a gold-standard `design/` set (UX doc, wireframe with compliance audit, API contract). | `examples/acme-bistro/src/server.ts` + `design/` |
-| `customer-auth` | End-user (customer) auth via OIDC/Firebase bridge with delegated credentials. | `examples/customer-auth/src/server.ts` |
+| `customer-auth` | End-user OIDC, private customer API routing, route-bound confirmed actions, roles/scopes, and delegated credentials. | `examples/customer-auth/src/server.ts` |
 | `gmail-multi-account` | One curated Gmail connector reused by two account bindings, canonical account arrays, exact mutation confirmation, and an accompanying personal-automation skill. | `examples/gmail-multi-account/src/server.ts` |
 | `google-bigquery` | Keyless Google Workload Identity Federation with optional service-account impersonation, a BigQuery REST connector, and complete developer/operator setup. | `examples/google-bigquery/src/server.ts` |
 

package/skills/claude-code/references/sdk-surface.md

@@ -54,6 +54,7 @@ Platform helper connectors are explicit subpath imports from `@noodleseed/one/pl
 ### Other
 
 - `clientCredentials`
+- `customerEndpoint`
 - `embeddedAssistant`
 - `externalExchange`
 - `gmailConnector`

package/skills/claude-code/reporting-noodle-feedback/SKILL.md

@@ -3,7 +3,7 @@ name: reporting-noodle-feedback
 description: "Use when a Noodle Seed bug, misleading instruction, missing capability, or concrete product improvement should be proposed to the user."
 ---
 
-<!-- noodle-skill version:0.54.0 hash:0f404109f4845683 -->
+<!-- noodle-skill version:0.56.0 hash:0f404109f4845683 -->
 
 # reporting-noodle-feedback
 

package/skills/claude-code/verifying-mcp-delivery/SKILL.md

@@ -3,7 +3,7 @@ name: verifying-mcp-delivery
 description: "Use when proving a Noodle Seed MCP project works at a named compile, local, connector, App, host, deployment, or production evidence level."
 ---
 
-<!-- noodle-skill version:0.54.0 hash:6ef6ef551e26b78e -->
+<!-- noodle-skill version:0.56.0 hash:6ef6ef551e26b78e -->
 
 # verifying-mcp-delivery
 

package/skills/codex/SKILL.md

@@ -3,7 +3,7 @@ name: noodle-seed
 description: "Use when building, validating, testing, deploying, or operating a local or hosted Noodle Seed MCP server or app authored in TypeScript with the noodle CLI."
 ---
 
-<!-- noodle-skill version:0.54.0 hash:ec5bfcd0d8165205 -->
+<!-- noodle-skill version:0.56.0 hash:ec5bfcd0d8165205 -->
 
 # Noodle Seed
 

package/skills/codex/authoring-mcp-servers/SKILL.md

@@ -3,7 +3,7 @@ name: authoring-mcp-servers
 description: "Use when creating or extending a headless Noodle Seed MCP server, tool, resource, prompt, or typed model-facing capability."
 ---
 
-<!-- noodle-skill version:0.54.0 hash:0b2fd8c7e43fc69f -->
+<!-- noodle-skill version:0.56.0 hash:0b2fd8c7e43fc69f -->
 
 # authoring-mcp-servers
 

package/skills/codex/building-mcp-apps/SKILL.md

@@ -3,7 +3,7 @@ name: building-mcp-apps
 description: "Use when a Noodle Seed MCP App, widget, interactive card, visual interaction, or host-visible UI is the primary requested outcome."
 ---
 
-<!-- noodle-skill version:0.54.0 hash:f7fa54992c8d7692 -->
+<!-- noodle-skill version:0.56.0 hash:f7fa54992c8d7692 -->
 
 # building-mcp-apps
 

package/skills/codex/connecting-apis-to-mcp/SKILL.md

@@ -3,7 +3,7 @@ name: connecting-apis-to-mcp
 description: "Use when credentials, an API URL, an OpenAPI document, or an observed response must become real Noodle Seed MCP behavior."
 ---
 
-<!-- noodle-skill version:0.54.0 hash:1e86b8704f407bd3 -->
+<!-- noodle-skill version:0.56.0 hash:1e86b8704f407bd3 -->
 
 # connecting-apis-to-mcp
 

package/skills/codex/debugging-mcp-delivery/SKILL.md

@@ -3,7 +3,7 @@ name: debugging-mcp-delivery
 description: "Use when an existing Noodle Seed MCP project has a concrete validation, runtime, connector, App, host, deployment, or production failure."
 ---
 
-<!-- noodle-skill version:0.54.0 hash:aa715bae12041d7c -->
+<!-- noodle-skill version:0.56.0 hash:aa715bae12041d7c -->
 
 # debugging-mcp-delivery
 

package/skills/codex/deploying-mcp-services/SKILL.md

@@ -3,7 +3,7 @@ name: deploying-mcp-services
 description: "Use when the user explicitly requests a Noodle Seed hosted link, configuration write, deployment, access change, rollback, or connection write."
 ---
 
-<!-- noodle-skill version:0.54.0 hash:93e735b7ffb45df1 -->
+<!-- noodle-skill version:0.56.0 hash:93e735b7ffb45df1 -->
 
 # deploying-mcp-services
 

package/skills/codex/designing-mcp-products/SKILL.md

@@ -3,7 +3,7 @@ name: designing-mcp-products
 description: "Use when a Noodle Seed MCP product idea needs conversational fit, user benefit, scope, interaction, or evidence design before implementation."
 ---
 
-<!-- noodle-skill version:0.54.0 hash:76cce86729cffbee -->
+<!-- noodle-skill version:0.56.0 hash:76cce86729cffbee -->
 
 # designing-mcp-products
 

package/skills/codex/embedding-mcp-assistants/SKILL.md

@@ -3,7 +3,7 @@ name: embedding-mcp-assistants
 description: "Use when embedding a Noodle assistant into an existing SaaS or web application with browser, identity, session, and credential boundaries."
 ---
 
-<!-- noodle-skill version:0.54.0 hash:cc54a67f21c0ecdb -->
+<!-- noodle-skill version:0.56.0 hash:cc54a67f21c0ecdb -->
 
 # embedding-mcp-assistants