@noodleseed/agent-kit 0.93.0 → 0.95.0

package/skills/codex/examples/customer-auth/README.md

@@ -1,5 +1,8 @@
 # Customer Auth - OIDC identity and customer-routed APIs
 
+For a visitor who starts before signup, use the [Stateful Draft reference](../stateful-draft/README.md)
+alongside this authenticated backend integration.
+
 This curated example owns the customer/end-user authentication capability slot. It proves that a SaaS app
 can protect an MCP endpoint with direct OIDC, retain role/scope-based tool authorization, and route ordinary
 reads and confirmed actions to the API origin selected by the verified customer's identity provider.

package/skills/codex/examples/hello/README.md

@@ -2,8 +2,9 @@
 
 The smallest deployable Noodle app: a single `greet` tool authored in TypeScript with no
 connectors, secrets, flows, widgets, or handoff policy. It still uses the current server options form
-so new authors see where server-level branding belongs. Use it to smoke the author loop
-(`noodle validate` / `noodle dev`) or a first deploy.
+so new authors see where server-level branding belongs. Use it for a local read or first deploy.
+For a new project, `noodle init --template hello` also supplies isolated behavior tests: compilation,
+tool discovery, an expected greeting and invalid-input rejection. Run `npm install` then `npm test`.
 
 Protocol negotiation deliberately does not appear in `src/server.ts` or `noodle.json`. MCP versions
 are platform-owned: the same deployed app automatically serves compatible legacy clients and modern
@@ -30,6 +31,7 @@ empty. One-shot commands write one envelope; streaming commands write NDJSON sna
 terminal-failure envelopes so agents can parse each line independently.
 
 ```sh
+noodle test examples/hello/src/server.ts --tool greet --args '{"name":"Ada"}' --json
 noodle dev examples/hello/src/server.ts --app hello
 noodle deploy examples/hello/src/server.ts --org acme --app hello
 ```

package/skills/codex/examples/stateful-draft/README.md

@@ -0,0 +1,115 @@
+# Stateful Draft
+
+**Owns:** The flagship for a useful brief before signup, authoritative caller state, and account continuation.
+**Read when:** You want to compose a small conversational onboarding flow from existing platform capabilities.
+**Do not put here:** Customer credentials, a new identity provider, or business-system records.
+**Update when:** The reference tools, state schema, or runnable journey changes.
+
+Start with the visitor's goal. Help them produce something useful before asking for an account. This
+synthetic example collects a project title, audience, and desired outcome; those fields are illustrative,
+not requirements for any particular SaaS product.
+
+## The journey
+
+1. The visitor describes a goal. The assistant asks only for missing information and proposes a brief.
+2. `open_draft` opens an editable review and reads authoritative state, including its current revision.
+3. `save_draft` saves the reviewed brief after confirmation. It sends the current revision and the complete
+   value to the state API. Failed or missing responses do not appear as successful saves.
+4. The visitor may choose `continue_draft`. This read requires identity, so an anonymous visitor sees the
+   sign-in/signup card. Your host application completes its existing login and spends the bound ticket.
+5. The authenticated assistant reads the same adopted draft. No project, subscription, or business record
+   is created by signing in.
+
+The widget's Continue button requests the identity-dependent tool through the conversation. The ordinary
+signup route should remain available on the embedding page.
+
+## Run the reference
+
+From this repository:
+
+```sh
+pnpm install
+pnpm build
+noodle validate examples/stateful-draft/src/server.ts
+noodle test examples/stateful-draft/src/server.ts
+noodle dev examples/stateful-draft/src/server.ts --org demo --app stateful-draft
+```
+
+The local runtime and widget preview exercise the typed tools. A complete mixed-assistant journey also
+requires two host pages and a backend that verifies the user. The declared development origins are
+`http://localhost:3001` for the public page and `http://localhost:3002` for the authenticated page; replace
+these with your exact deployment origins. The assistant uses `noodleManaged()`, whose hosted availability
+and budget belong to the operator. Local tool tests do not require a model key.
+
+Use the SDK version declared in this example's package file. Older published SDKs may omit the state
+adoption flag when compiling; the example's tests check that the flag reaches the compiled declaration.
+
+Use [signup continuity](https://docs.noodleseed.dev/docs/guides/signup-continuity) for the complete host
+integration and [customer-auth](../customer-auth/README.md) for customer-owned API authentication.
+
+### Loopback demonstration with a hosted assistant
+
+The included host serves the public page on port 3001 and a **simulated** account page on port 3002.
+It binds to loopback and must not be published as a production authentication implementation.
+After deploying this app, copy this directory outside the monorepo and run the commands below from that
+copy. This keeps published dependencies from shadowing the monorepo's workspace SDK.
+
+```sh
+pnpm install --ignore-workspace --lockfile=false
+export NOODLE_EMBED_ID=<embed-id-printed-by-deploy>
+pnpm site
+```
+
+This is enough to test the anonymous conversation and saved brief. To exercise the synthetic account
+handoff, create an assistant backend client for the same org/app/env with
+`noodle assistant clients create --name first-brief-demo --org <org> --app <app> --env <env> --json`.
+Set `NOODLE_ASSISTANT_CREDENTIALS_FILE` to the returned `secretFile` path and restart `pnpm site`.
+The host consumes that private file without printing it or sending its contents to the browser.
+Override `NOODLE_SERVICE_URL` only when deploying to a different hosted service.
+
+The simulated signup chooses a random temporary demo identity and spends the ticket through the real
+backend session helper. The host's login transaction lasts ten minutes; it is local process memory and
+is lost on restart. A production integration replaces it with the customer's existing verified login and
+login transaction. Do not copy the synthetic identity branch into a real application.
+
+## Customer integration map
+
+| Reference | Adaptation in the customer's application |
+| :--- | :--- |
+| Three-field brief | Select the smallest useful outcome and collect only its missing inputs |
+| Public mixed surface | Mount the public embed on the unauthenticated website with an exact allowlist |
+| Expiring `draft` handle | Keep only temporary, bounded coordination state; omit persistence if unnecessary |
+| `continue_draft` | Trigger the existing signup/login at the point the visitor chooses an account |
+| Host session endpoint | Verify the logged-in user, spend the bound ticket, return the SDK session response |
+| Final business action | Add a typed connector to the existing authorized, idempotent create/update API |
+
+The final business action belongs in the customer backend. Show the resulting record or its identifier
+only after that API confirms success. Signup and state adoption alone are not completed onboarding.
+Research or document parsing can be added later when they remove a demonstrated user burden; they are not
+prerequisites for this reference.
+
+## State and failure behavior
+
+The draft uses caller scope, a finite 24-hour TTL, and `claimOnAuthentication: true`. Its `v2` schema
+replaces the earlier title/stage illustration. Widget state is only a display cache. Reads, validation,
+revision checks, expiry, and persistence belong to the runtime.
+
+A stale edit requires an explicit reload and review before another save. Spending the single-use sign-in
+ticket moves only opted-in state to the backend-verified account, preserving its revision and expiry.
+Destination conflicts fail rather than merging two drafts. Abandoned or expired signup leaves the
+anonymous state under its original limits. A 24-hour state TTL does not promise cross-device recovery or
+that an arbitrary new anonymous visit can recover the conversation.
+
+The save is a connector-backed side effect on a public/mixed surface, so it has `confirm: true`. Previewing
+the brief has no side effect and needs neither signup nor confirmation. Do not add a confirmation to each
+conversational answer or treat confirmation as proof of identity.
+
+## Validate before a customer pilot
+
+- Show useful value with no account and without repeating already supplied information.
+- Save, reopen, and edit the actual record; test a stale revision and an unconfirmed save.
+- Verify the same draft after the customer's real signup and login, including cancellation and expiry.
+- Test an existing-account draft conflict and ensure it is not silently overwritten.
+- Ensure signup triggers no unintended business write and account A cannot read account B's draft.
+- Compare onboarding completion and first useful product outcome with the existing flow; count signups
+  separately. A demo is not evidence of improved conversion.

package/skills/codex/examples/stateful-draft/noodle.json

@@ -0,0 +1,5 @@
+{
+  "entrypoint": "src/server.ts",
+  "name": "stateful-draft",
+  "template": "widget"
+}

package/skills/codex/examples/stateful-draft/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "stateful-draft",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "test": "vitest run",
+    "validate": "noodle validate",
+    "dev": "noodle dev",
+    "deploy": "noodle deploy",
+    "site": "node site/demo.mjs"
+  },
+  "devDependencies": {
+    "@noodleseed/assistant": "^1.33.0",
+    "@vitejs/plugin-react": "latest",
+    "@noodleseed/one": "^0.154.0",
+    "react": "latest",
+    "react-dom": "latest",
+    "vite": "latest",
+    "vitest": "latest"
+  }
+}

package/skills/codex/examples/stateful-draft/site/client.js

@@ -0,0 +1,44 @@
+import '/sdk/index.js';
+
+const config = await fetch('/demo-config').then((response) => response.json());
+const mount = document.querySelector('#assistant');
+const status = document.querySelector('#status');
+if (config.authenticated && !config.signedIn) {
+  document.querySelector('#demo-login').hidden = false;
+  status.textContent =
+    'Your draft is ready to come with you. This next step simulates the product’s signup.';
+} else {
+  const assistant = document.createElement('noodle-assistant');
+  assistant.setAttribute('theme', 'light');
+  if (config.authenticated) {
+    assistant.setAttribute('session-endpoint', '/assistant-session');
+    status.textContent =
+      'You are using a synthetic demo account. Open the chat to continue with your saved brief.';
+  } else {
+    assistant.setAttribute('embed-id', config.embedId);
+    assistant.setAttribute('service-url', config.serviceUrl);
+    status.textContent =
+      'Start without an account. Open the chat and describe what you want to achieve.';
+  }
+  mount.append(assistant);
+}
+
+document.addEventListener('assistant-sign-in-requested', async (event) => {
+  status.textContent = 'Preparing your account handoff…';
+  try {
+    const response = await fetch('/start', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ signInTicket: event.detail.signInTicket }),
+    });
+    const result = await response.json();
+    if (!response.ok) {
+      status.textContent = result.error ?? 'Handoff not started';
+      return;
+    }
+    window.location.assign(result.destination);
+  } catch {
+    status.textContent =
+      'The handoff did not start. Your brief has not been moved. Please try again.';
+  }
+});

package/skills/codex/examples/stateful-draft/site/demo.mjs

@@ -0,0 +1,158 @@
+/** Loopback-only synthetic host. Replace its demo identity with your existing login in a real app. */
+import { randomUUID } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { createServer } from 'node:http';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createAssistantSession } from '@noodleseed/assistant/server';
+
+const publicOrigin = 'http://localhost:3001';
+const appOrigin = 'http://localhost:3002';
+const serviceUrl = process.env.NOODLE_SERVICE_URL ?? 'https://cloud.noodleseed.dev';
+const embedId = process.env.NOODLE_EMBED_ID;
+const credentialFile = process.env.NOODLE_ASSISTANT_CREDENTIALS_FILE;
+if (!embedId?.match(/^pub_[a-z0-9]+$/i)) {
+  throw new Error('Set NOODLE_EMBED_ID from the hosted deployment.');
+}
+if (new URL(serviceUrl).protocol !== 'https:')
+  throw new Error('The hosted service must use HTTPS.');
+// Consume only the explicitly supplied backend credential file. Its content is never sent to the browser.
+const credentials = credentialFile ? JSON.parse(await readFile(credentialFile, 'utf8')) : undefined;
+if (
+  credentials &&
+  (typeof credentials.clientId !== 'string' || typeof credentials.clientSecret !== 'string')
+) {
+  throw new Error('The backend credential file is not a CLI-created assistant client file.');
+}
+const sdkDir = dirname(fileURLToPath(import.meta.resolve('@noodleseed/assistant')));
+const siteDir = dirname(fileURLToPath(import.meta.url));
+const transactions = new Map();
+const lifetime = 10 * 60 * 1000;
+
+function send(res, status, value, type = 'application/json') {
+  res.writeHead(status, {
+    'Content-Type': type,
+    'Cache-Control': 'no-store',
+    'Referrer-Policy': 'no-referrer',
+    'X-Content-Type-Options': 'nosniff',
+  });
+  res.end(type === 'application/json' ? JSON.stringify(value) : value);
+}
+function redirect(res, destination) {
+  res.writeHead(303, { Location: destination, 'Cache-Control': 'no-store' });
+  res.end();
+}
+function current(req) {
+  const id = /(?:^|;\s*)brief_demo=([a-f0-9-]+)/.exec(req.headers.cookie ?? '')?.[1];
+  return id ? transactions.get(id) : undefined;
+}
+async function jsonBody(req) {
+  let text = '';
+  for await (const chunk of req) {
+    text += chunk.toString();
+    if (Buffer.byteLength(text) > 8192) throw new Error('Request too large');
+  }
+  return JSON.parse(text);
+}
+
+function handler(origin) {
+  return async (req, res) => {
+    // The fixed loopback host is intentional: never deploy this synthetic-login server to the internet.
+    if (req.headers.host !== new URL(origin).host) return send(res, 403, { error: 'Wrong host' });
+    for (const [id, transaction] of transactions) {
+      if (transaction.expiresAt <= Date.now()) transactions.delete(id);
+    }
+    const path = new URL(req.url ?? '/', origin).pathname;
+    try {
+      if (req.method === 'GET' && path === '/') {
+        return send(
+          res,
+          200,
+          await readFile(join(siteDir, 'index.html')),
+          'text/html; charset=utf-8',
+        );
+      }
+      if (req.method === 'GET' && path === '/demo-config') {
+        return send(res, 200, {
+          serviceUrl,
+          embedId,
+          authenticated: origin === appOrigin,
+          signedIn: Boolean(current(req)?.user),
+        });
+      }
+      if (req.method === 'GET' && path === '/client.js') {
+        return send(res, 200, await readFile(join(siteDir, 'client.js')), 'text/javascript');
+      }
+      if (req.method === 'GET' && /^\/sdk\/[a-z0-9._-]+\.js$/i.test(path)) {
+        return send(res, 200, await readFile(join(sdkDir, path.slice(5))), 'text/javascript');
+      }
+      if (req.method === 'POST') {
+        if (req.headers.origin !== origin) return send(res, 403, { error: 'Wrong origin' });
+        if (origin === publicOrigin && path === '/start') {
+          if (!credentials)
+            return send(res, 503, {
+              error:
+                'Signup demonstration needs an authorized backend client. The anonymous brief is still available.',
+            });
+          if (transactions.size >= 40) return send(res, 429, { error: 'Please try again later' });
+          const body = await jsonBody(req);
+          if (typeof body.signInTicket !== 'string' || body.signInTicket.length > 4096) {
+            return send(res, 400, { error: 'Missing continuation ticket' });
+          }
+          const id = randomUUID();
+          transactions.set(id, {
+            signInTicket: body.signInTicket,
+            expiresAt: Date.now() + lifetime,
+          });
+          res.setHeader(
+            'Set-Cookie',
+            `brief_demo=${id}; HttpOnly; SameSite=Lax; Path=/; Max-Age=600`,
+          );
+          return send(res, 200, { destination: appOrigin });
+        }
+        if (origin === appOrigin && path === '/demo-login') {
+          const transaction = current(req);
+          if (!transaction)
+            return send(res, 410, { error: 'Demo expired. Start again on the public page.' });
+          // Synthetic identity only. A production route must verify its existing application session.
+          transaction.user ??= { id: `demo_${randomUUID()}`, name: 'Demo visitor' };
+          return redirect(res, '/');
+        }
+      }
+      if (origin === appOrigin && req.method === 'GET' && path === '/assistant-session') {
+        if (!credentials) return send(res, 503, { error: 'Configure the backend client first' });
+        if (req.headers['sec-fetch-site'] !== 'same-origin')
+          return send(res, 403, { error: 'Same-origin request required' });
+        const transaction = current(req);
+        if (!transaction?.user)
+          return send(res, 401, { error: 'Choose the synthetic demo account first' });
+        // Reuse the in-flight result so concurrent mounts cannot spend the single-use ticket twice.
+        transaction.session ??= createAssistantSession({
+          serviceUrl,
+          clientId: credentials.clientId,
+          clientSecret: credentials.clientSecret,
+          origin: appOrigin,
+          user: transaction.user,
+          signInTicket: transaction.signInTicket,
+        });
+        const session = await transaction.session;
+        delete transaction.signInTicket;
+        return send(res, 200, session);
+      }
+      return send(res, 404, { error: 'Not found' });
+    } catch {
+      // Do not log credentials, tickets, requests, or raw provider errors.
+      return send(res, 409, {
+        error: 'Continuation was not completed. Return to the public page and start again.',
+      });
+    }
+  };
+}
+for (const [port, origin] of [
+  [3001, publicOrigin],
+  [3002, appOrigin],
+]) {
+  createServer(handler(origin)).listen(port, '127.0.0.1');
+}
+console.log(`Synthetic onboarding demo: ${publicOrigin}`);
+console.log('Loopback only. Uses the hosted assistant; demo signup is not a real account.');

package/skills/codex/examples/stateful-draft/site/index.html

@@ -0,0 +1,41 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>First Brief · Conversational onboarding demo</title>
+    <style>
+      :root { font-family: system-ui, sans-serif; color: #172033; background: #f6f8fc; }
+      body { margin: 0; }
+      main { max-width: 880px; margin: 0 auto; padding: 64px 28px; }
+      .label { font-size: 12px; font-weight: 700; letter-spacing: .14em; color: #526077; }
+      h1 { max-width: 640px; font-size: clamp(36px, 6vw, 64px); line-height: 1.08; letter-spacing: -.055em; }
+      p { max-width: 570px; line-height: 1.6; color: #526077; }
+      .sample { padding: 24px; border: 1px solid #dce3ee; border-radius: 16px; background: white; margin: 28px 0; max-width: 550px; }
+      a { color: #174bbd; }
+      button { border: none; background: #2563eb; color: white; padding: 14px 20px; border-radius: 9px; font: inherit; cursor: pointer; }
+      :focus-visible { outline: 3px solid #2563eb; outline-offset: 4px; }
+      .notice { font-size: 13px; }
+    </style>
+  </head>
+  <body>
+    <main>
+      <span class="label">FIRST BRIEF · INTERNAL DEMONSTRATION</span>
+      <h1>Make something useful.<br>Then decide to sign up.</h1>
+      <p>Describe a goal. Refine a short brief. See the result before deciding whether to take it into an account.</p>
+      <div class="sample">
+        <strong>Try this in the chat</strong>
+        <p>“I want to help new teammates complete their first useful project in a week.”</p>
+        <p id="status" role="status" aria-live="polite">Connecting…</p>
+      </div>
+      <form id="demo-login" action="/demo-login" method="post" hidden>
+        <p><strong>Simulated signup</strong><br>This creates a temporary demo identity. It does not register an account with any SaaS product.</p>
+        <button type="submit">Continue as a demo user</button>
+        <p><a href="http://localhost:3001">Cancel and return to the public page</a></p>
+      </form>
+      <p class="notice">Use synthetic information only. The assistant and draft storage are hosted by Noodle Seed. Signup is simulated locally; no customer backend is connected. Drafts expire within 24 hours. <a href="https://noodleseed.com/privacy" target="_blank" rel="noreferrer">Privacy</a></p>
+    </main>
+    <div id="assistant"></div>
+    <script type="module" src="/client.js"></script>
+  </body>
+</html>

package/skills/codex/examples/stateful-draft/src/helpers.ts

@@ -0,0 +1,6 @@
+import type { ServerDefinition } from '@noodleseed/one';
+import { generateHelpers } from '@noodleseed/one/react';
+
+export type AppType = ServerDefinition;
+
+export const { useCallTool, useToolInfo, useSendFollowUpMessage } = generateHelpers<AppType>();

package/skills/codex/examples/stateful-draft/src/server.ts

@@ -0,0 +1,159 @@
+import {
+  annotations,
+  authenticatedWebsite,
+  connector,
+  embeddedAssistant,
+  noodleManaged,
+  publicWebsite,
+  server,
+  tool,
+  z,
+} from '@noodleseed/one';
+
+const draft = z.object({
+  title: z.string().trim().min(1).max(120).optional(),
+  audience: z.string().trim().min(1).max(240).optional(),
+  goal: z.string().trim().min(1).max(240).optional(),
+});
+
+const snapshot = z.object({
+  value: draft,
+  revision: z.number().int(),
+  status: z.string(),
+});
+
+const state = connector('noodle_state')
+  .version('1.0.0')
+  .operation('read_state', {
+    type: 'read',
+    input: z.object({ handle: z.string() }),
+    output: snapshot,
+  })
+  .operation('patch_state', {
+    type: 'action',
+    input: z.object({
+      handle: z.string(),
+      expectedRevision: z.number().int().min(0),
+      value: draft,
+    }),
+    output: snapshot,
+  });
+
+const openDraft = tool('open_draft', {
+  title: 'Review your brief',
+  description:
+    'Preview a proposed brief and read the saved brief with its revision. Pass the proposed title, audience, and goal in proposal to prefill the editable preview without saving it. Omit proposal to reload the saved record after a conflict.',
+  input: z.object({ proposal: draft.default({}) }),
+  output: snapshot.extend({ proposal: draft }),
+  fulfil: ({ input, connectors }) => {
+    const saved = connectors.state.readState({ handle: 'draft' });
+    return {
+      value: saved.value,
+      revision: saved.revision,
+      status: saved.status,
+      proposal: input.proposal,
+    };
+  },
+  viewTitle: 'Your project brief',
+  invoking: 'Loading your saved brief…',
+  invoked: 'Your brief is ready to review',
+  view: { component: 'draft-card', entry: './views/draft-card.tsx' },
+  annotations: annotations.readOnly(),
+  viewDescription: 'Review and edit a saved brief before deciding whether to create an account.',
+  csp: { connectDomains: [], resourceDomains: [], frameDomains: [] },
+});
+
+const saveDraft = tool('save_draft', {
+  title: 'Save your brief',
+  description:
+    'Save this reviewed brief for up to 24 hours. This does not create an account or a project.',
+  input: draft.required().extend({
+    expectedRevision: z.number().int().min(0).meta({ title: 'Saved version' }),
+  }),
+  output: snapshot,
+  annotations: annotations.localAction({ destructive: false, confirm: true }),
+  fulfil: ({ input, connectors }) => {
+    const saved = connectors.state.patchState({
+      handle: 'draft',
+      expectedRevision: input.expectedRevision,
+      value: { title: input.title, audience: input.audience, goal: input.goal },
+    });
+    return { value: saved.value, revision: saved.revision, status: saved.status };
+  },
+});
+
+const continueDraft = tool('continue_draft', {
+  title: 'Continue with an account',
+  description:
+    'Read the brief in the signed-in account. Call only when the visitor chooses to continue with an account, after showing useful value. Sign-in carries the saved draft forward; it does not submit, publish, or create a project.',
+  input: z.object({}),
+  output: snapshot.extend({ accountId: z.string() }),
+  annotations: annotations.readOnly(),
+  fulfil: ({ connectors, user }) => {
+    const saved = connectors.state.readState({ handle: 'draft' });
+    return {
+      value: saved.value,
+      revision: saved.revision,
+      status: saved.status,
+      accountId: user.id,
+    };
+  },
+});
+
+export default server(
+  'stateful_draft',
+  {
+    title: 'Your first useful brief',
+    version: '1.0.0',
+    instructions:
+      'Help someone turn their goal into a concise project brief: a title, audience, and desired outcome. Base the brief on information they supply. Propose a sensible editable title; never require a naming question. If the audience and outcome are already clear, immediately show the complete proposed brief. Otherwise ask one short question for missing information and skip anything already answered. Show the useful proposed brief in chat before offering to save it. Do not request an email, password, document, or external research. Read open_draft before save_draft. Saving requires review and confirmation; an unconfirmed save is not persisted. Never claim an account or project was created. After saving, offer continue_draft only as an optional next step; never require signup to see the brief. This is a synthetic onboarding example, not an integration with a specific SaaS product.',
+    branding: {
+      name: 'First Brief',
+      accent: '#2563EB',
+      surface: '#F8FAFC',
+      surfaceDark: '#111827',
+      radius: 'md',
+      density: 'comfortable',
+      typography: 'system',
+      colorScheme: 'auto',
+    },
+    use: { state },
+    state: {
+      handles: {
+        draft: {
+          kind: 'draft',
+          version: 'v2',
+          scope: 'caller',
+          ttlSeconds: 86400,
+          claimOnAuthentication: true,
+          schema: draft,
+        },
+      },
+    },
+    assistant: embeddedAssistant({
+      model: noodleManaged(),
+      privacyUrl: 'https://noodleseed.com/privacy',
+      behavior: { showConfirmationDetails: false },
+      access: [
+        publicWebsite({
+          origins: ['http://localhost:3001'],
+          capabilities: [openDraft, saveDraft, continueDraft],
+          signIn: true,
+        }),
+        authenticatedWebsite({
+          origins: ['http://localhost:3002'],
+          capabilities: [openDraft, saveDraft, continueDraft],
+        }),
+      ],
+      labels: {
+        welcomeHeading: 'What would you like to achieve?',
+        composerPlaceholder: 'Describe your goal…',
+        signInHeading: 'Take your brief with you',
+        signInBody: 'Continue with an account to use your saved brief inside the product.',
+        signInAction: 'Sign in',
+        signUpAction: 'Create account',
+      },
+    }),
+  },
+  [openDraft, saveDraft, continueDraft],
+);