@noodleseed/agent-kit 0.99.0 → 0.100.0

package/skills/codex/designing-mcp-products/references/authoring-workflow.md

@@ -17,6 +17,7 @@
 - Tests
 - Secrets and variables
 - Embedded assistant
+- Managed collections
 - Boundaries
 
 ## Input paths
@@ -441,6 +442,12 @@ The compiler validates and hashes every document at build time (bad extensions,
 
 The managed crawler and managed index are the defaults and need no configuration. A component may instead bring its own crawler (`crawler: firecrawl({ apiKey: secret('FIRECRAWL_API_KEY') })` or `tavily(...)`) and/or its own index (`index: algolia({ appId: variable('ALGOLIA_APP_ID'), apiKey: secret('ALGOLIA_API_KEY') })` or `meilisearch({ host: variable(...), apiKey: secret(...) })`). The code declares only config names; operators supply values with `noodle secrets set` / `noodle variables set`, and deploy preflight fails closed naming any unset reference.
 
+## Managed collections
+
+Use `managedCollection(name, { title, description, schemaVersion, record })` when an application needs reusable typed intent for business records that Noodle may later hold. Pass it through `server(..., { collections: [...] }, definitions)`. `record` is one bounded, closed Zod object; names use lowercase letters, numbers, and underscores. Keep payment-card, credentials, passport/government identity, health, and biometric fields out of this surface.
+
+This declaration compiles schema metadata only. It does not create a submit tool, grant access, select retention or residency, provision storage, or make records available to MCP or the embedded assistant. Operators bind lifecycle and authority separately. Until the service intake path is shipped, keep live business operations on their existing connector tools.
+
 ## Boundaries
 
 Import public app authoring only from `@noodleseed/one` (and its documented `/react` or `/platform` subpaths). Packages and subpaths under `@noodle-borg/*` are runtime implementation details, including `/portable` boundaries, and must never appear in customer `server.ts` code. Do not hand-author manifest JSON/YAML, runtime artifacts, connector IR, or hosted asset metadata. Do not read or copy secrets, bearer tokens, refresh tokens, static access keys, `.env`, `.env.noodle`, or `~/.noodle/config.json`. Hosted access is identity-based — do not add static data-plane credential paths.

package/skills/codex/embedding-mcp-assistants/SKILL.md

@@ -3,7 +3,7 @@ name: embedding-mcp-assistants
 description: "Use when embedding a Noodle assistant into an existing SaaS or web application with browser, identity, session, and credential boundaries."
 ---
 
-<!-- noodle-skill version:0.99.0 hash:d554d661ed7ac7be -->
+<!-- noodle-skill version:0.100.0 hash:d554d661ed7ac7be -->
 
 # embedding-mcp-assistants
 

package/skills/codex/embedding-mcp-assistants/references/authoring-workflow.md

@@ -17,6 +17,7 @@
 - Tests
 - Secrets and variables
 - Embedded assistant
+- Managed collections
 - Boundaries
 
 ## Input paths
@@ -441,6 +442,12 @@ The compiler validates and hashes every document at build time (bad extensions,
 
 The managed crawler and managed index are the defaults and need no configuration. A component may instead bring its own crawler (`crawler: firecrawl({ apiKey: secret('FIRECRAWL_API_KEY') })` or `tavily(...)`) and/or its own index (`index: algolia({ appId: variable('ALGOLIA_APP_ID'), apiKey: secret('ALGOLIA_API_KEY') })` or `meilisearch({ host: variable(...), apiKey: secret(...) })`). The code declares only config names; operators supply values with `noodle secrets set` / `noodle variables set`, and deploy preflight fails closed naming any unset reference.
 
+## Managed collections
+
+Use `managedCollection(name, { title, description, schemaVersion, record })` when an application needs reusable typed intent for business records that Noodle may later hold. Pass it through `server(..., { collections: [...] }, definitions)`. `record` is one bounded, closed Zod object; names use lowercase letters, numbers, and underscores. Keep payment-card, credentials, passport/government identity, health, and biometric fields out of this surface.
+
+This declaration compiles schema metadata only. It does not create a submit tool, grant access, select retention or residency, provision storage, or make records available to MCP or the embedded assistant. Operators bind lifecycle and authority separately. Until the service intake path is shipped, keep live business operations on their existing connector tools.
+
 ## Boundaries
 
 Import public app authoring only from `@noodleseed/one` (and its documented `/react` or `/platform` subpaths). Packages and subpaths under `@noodle-borg/*` are runtime implementation details, including `/portable` boundaries, and must never appear in customer `server.ts` code. Do not hand-author manifest JSON/YAML, runtime artifacts, connector IR, or hosted asset metadata. Do not read or copy secrets, bearer tokens, refresh tokens, static access keys, `.env`, `.env.noodle`, or `~/.noodle/config.json`. Hosted access is identity-based — do not add static data-plane credential paths.

package/skills/codex/embedding-mcp-assistants/references/embedded-assistant.md

@@ -224,7 +224,7 @@ Set `webmcp: { enabled: true }` on the assistant to let a browser agent reach th
 
 Set `continuity: { enabled: true }` on a public or mixed access surface to let an anonymous visitor keep the conversation they can see when they navigate to another page of the same site. Off unless set, and refused on an authenticated surface, which reattaches through a backend-verified sign-in instead. It restores the visible text on a fresh session and never the old one: no tool authority, no share of a spent turn budget, and no pending confirmation carried across, so an unanswered confirmation stays unanswered. `windowSeconds` defaults to 300 with a 600 ceiling, `maxRestores` to 3 with a ceiling of 10, and 0 for either disables continuity outright; an operator may lower what you declare and can never raise it. The handle lives in `sessionStorage` so it dies with the tab, is single-use, and is valid only for the embed, origin, and visitor it was issued to. Declare it when a marketing site spreads one conversation across several pages; leave it off when anonymous conversation text should not survive a navigation at all.
 
-Give every business action a portable `tool(..., { title: "Complete task", description: "This will mark the task complete for everyone.", input: z.object({ task: z.string().meta({ title: "Task" }) }) })` title. The standard confirmation uses the tool title/description plus schema field `title`, `description`, and `format`; it shows Confirm and Don't proceed and keeps technical action details secondary. `behavior.showConfirmationDetails` defaults to `true`; set it to `false` to remove only the built-in card's Additional details disclosure and connector mechanics. The business review and decisions remain, `confirm: true` still suspends until acceptance, and headless/BYO `data-confirmation` stays unchanged. Do not put JSON or implementation names in business-facing copy.
+Give every business action a portable `tool(..., { title: "Complete task", description: "This will mark the task complete for everyone.", input: z.object({ task: z.string().meta({ title: "Task" }) }) })` title. The standard confirmation uses the tool title/description plus schema field `title`, `description`, and `format`; it shows Confirm and Don't proceed and keeps technical action details out of the default review. `behavior.showConfirmationDetails` defaults to `false`; set it to `true` only when the audience needs the collapsed Additional details disclosure. The complete business review and decisions remain, `confirm: true` still suspends until acceptance, and headless/BYO `data-confirmation` stays unchanged. Do not put JSON or implementation names in business-facing copy.
 
 ## Configure and deploy
 

package/skills/codex/examples/acme-bistro/README.md

@@ -6,6 +6,10 @@ completes in chat — only **payment** hands off, via a signed checkout deep lin
 the app). It pairs a view-backed `tool` menu/cart with app-only `tool` cart helpers and a model-visible
 `create_checkout` tool backed by `handoff.allowedDomains`.
 
+It also declares a reusable `guest_requests` managed-collection schema. In this foundation slice the
+declaration compiles schema intent only: storage lifecycle, access, and a public submit route are bound by
+the hosting service separately, and no submit tool is generated.
+
 Capability slot: **end-to-end in-chat transaction + payment-only handoff**, plus a worked **design-first**
 deliverable set (`design/` — a UX Document, a single-file HTML wireframe with an embedded OpenAI Apps SDK
 compliance audit, and a Recommended API contract). It sets the quality bar the `noodle-seed` skill's

package/skills/codex/examples/acme-bistro/src/server.ts

@@ -1,4 +1,4 @@
-import { annotations, server, tool, z } from '@noodleseed/one';
+import { annotations, managedCollection, server, tool, z } from '@noodleseed/one';
 
 // Acme Bistro is a fictional restaurant. This app is deliberately END-TO-END: the customer browses the
 // menu and builds the order in chat, and the order completes in chat — only *payment* hands off, via a
@@ -28,6 +28,17 @@ const menuItemOutput = z.object({
   kind: z.string(),
 });
 
+const guestRequests = managedCollection('guest_requests', {
+  title: 'Guest requests',
+  description: 'Guest service requests that restaurant staff can review and resolve.',
+  schemaVersion: 1,
+  record: z.object({
+    locationReference: z.string().min(1).max(120),
+    requestType: z.enum(['reservation_help', 'accessibility', 'dietary_question', 'other']),
+    summary: z.string().min(1).max(1000),
+  }),
+});
+
 // Tool annotations for host planners: the menu read is read-only; cart edits are local writes; checkout
 // opens an external (payment) link.
 const readOnly = annotations.readOnly();
@@ -52,6 +63,8 @@ export default server(
     handoff: {
       allowedDomains: ['https://pay.acme.example', 'https://acme.example'],
     },
+    // Reusable business-record intent. Storage, lifecycle, access, and public intake bind separately.
+    collections: [guestRequests],
   },
   [
     tool('show_menu', {

package/skills/codex/examples/acme-bistro/test/server.test.ts

@@ -18,4 +18,14 @@ describe('acme-bistro example', () => {
     expect(text).toContain('add_to_cart');
     expect(text).toContain('create_checkout');
   });
+
+  it('declares reusable guest-request record intent without generating a submit tool', async () => {
+    const manifest = await app.toManifest();
+    expect(manifest.server.collections).toEqual([
+      expect.objectContaining({ name: 'guest_requests', schemaVersion: 1 }),
+    ]);
+    expect(manifest.tools).not.toContainEqual(
+      expect.objectContaining({ name: 'submit_guest_requests' }),
+    );
+  });
 });

package/skills/codex/examples/stateful-draft/README.md

@@ -103,6 +103,9 @@ that an arbitrary new anonymous visit can recover the conversation.
 The save is a connector-backed side effect on a public/mixed surface, so it has `confirm: true`. Previewing
 the brief has no side effect and needs neither signup nor confirmation. Do not add a confirmation to each
 conversational answer or treat confirmation as proof of identity.
+The example relies on the managed confirmation default: reviewers see the complete business brief and
+decision controls without connector mechanics. Enable `showConfirmationDetails` only for an audience that
+needs those technical details.
 
 ## Validate before a customer pilot
 

package/skills/codex/examples/stateful-draft/src/server.ts

@@ -133,7 +133,6 @@ export default server(
     assistant: embeddedAssistant({
       model: noodleManaged(),
       privacyUrl: 'https://noodleseed.com/privacy',
-      behavior: { showConfirmationDetails: false },
       access: [
         publicWebsite({
           origins: ['http://localhost:3001'],

package/skills/codex/executing-noodle-plans/SKILL.md

@@ -3,7 +3,7 @@ name: executing-noodle-plans
 description: "Use when the user asks to execute an approved, decision-complete implementation plan for a Noodle Seed project task by task with test-first changes, review, recovery, and final verification."
 ---
 
-<!-- noodle-skill version:0.99.0 hash:6a9f132ddb79352e -->
+<!-- noodle-skill version:0.100.0 hash:6a9f132ddb79352e -->
 
 # Execute a Noodle Seed implementation plan
 

package/skills/codex/publishing-mcp-integrations/SKILL.md

@@ -3,7 +3,7 @@ name: publishing-mcp-integrations
 description: "Use when preparing, reviewing, or submitting a Noodle Seed MCP integration to a host or app directory."
 ---
 
-<!-- noodle-skill version:0.99.0 hash:0ccafb222038f553 -->
+<!-- noodle-skill version:0.100.0 hash:0ccafb222038f553 -->
 
 # publishing-mcp-integrations
 

package/skills/codex/references/authoring-workflow.md

@@ -17,6 +17,7 @@
 - Tests
 - Secrets and variables
 - Embedded assistant
+- Managed collections
 - Boundaries
 
 ## Input paths
@@ -441,6 +442,12 @@ The compiler validates and hashes every document at build time (bad extensions,
 
 The managed crawler and managed index are the defaults and need no configuration. A component may instead bring its own crawler (`crawler: firecrawl({ apiKey: secret('FIRECRAWL_API_KEY') })` or `tavily(...)`) and/or its own index (`index: algolia({ appId: variable('ALGOLIA_APP_ID'), apiKey: secret('ALGOLIA_API_KEY') })` or `meilisearch({ host: variable(...), apiKey: secret(...) })`). The code declares only config names; operators supply values with `noodle secrets set` / `noodle variables set`, and deploy preflight fails closed naming any unset reference.
 
+## Managed collections
+
+Use `managedCollection(name, { title, description, schemaVersion, record })` when an application needs reusable typed intent for business records that Noodle may later hold. Pass it through `server(..., { collections: [...] }, definitions)`. `record` is one bounded, closed Zod object; names use lowercase letters, numbers, and underscores. Keep payment-card, credentials, passport/government identity, health, and biometric fields out of this surface.
+
+This declaration compiles schema metadata only. It does not create a submit tool, grant access, select retention or residency, provision storage, or make records available to MCP or the embedded assistant. Operators bind lifecycle and authority separately. Until the service intake path is shipped, keep live business operations on their existing connector tools.
+
 ## Boundaries
 
 Import public app authoring only from `@noodleseed/one` (and its documented `/react` or `/platform` subpaths). Packages and subpaths under `@noodle-borg/*` are runtime implementation details, including `/portable` boundaries, and must never appear in customer `server.ts` code. Do not hand-author manifest JSON/YAML, runtime artifacts, connector IR, or hosted asset metadata. Do not read or copy secrets, bearer tokens, refresh tokens, static access keys, `.env`, `.env.noodle`, or `~/.noodle/config.json`. Hosted access is identity-based — do not add static data-plane credential paths.

package/skills/codex/references/cli-commands.md

@@ -61,6 +61,7 @@ Developer-facing `noodle` commands, grouped by area. Local authoring commands (`
 | `noodle deployments` | List or inspect individual deployments (`deployments list`/`deployments inspect <id>`). |
 | `noodle distributions` | Publish immutable host archives, record their lifecycle, and operate bounded delivery. |
 | `noodle service` | Query hosted service capabilities. |
+| `noodle solutions` | Install managed solutions and operate their grants, records, activity, exports, and deletion. |
 | `noodle login` | Authenticate with Noodle Seed Cloud. |
 | `noodle logout` | Clear saved credentials. |
 | `noodle whoami` | Print the current authenticated user. |

package/skills/codex/references/compile-errors.md

@@ -18,7 +18,7 @@ Run `noodle validate` (add `--json` for the machine-readable envelope, `--fix-pr
 | `invalid_shape` | A field has the wrong type or structure; match the shape the compiler reports under `path` against the SDK builder you used. |
 | `invalid_name` | Rename the identifier to match the allowed pattern (lowercase, no spaces/reserved characters) cited at `path`. |
 | `duplicate_name` | Two tools/components share a name; give each a unique name at the cited `path`. |
-| `reserved_name` | Rename the reserved identifier; `__noodleIntent` is platform-owned, while application context uses one explicit zero-input tool with `contextProvider: true`. |
+| `reserved_name` | Rename the reserved identifier; `__noodleIntent` and future managed-collection `submit_<name>` tools are platform-owned, while application context uses one explicit zero-input tool with `contextProvider: true`. |
 | `unsupported_manifest_version` | Update the SDK/CLI so the emitted manifest version is supported; do not pin an old manifest shape. |
 | `reserved_for_future_version` | The verb at `path` (currently `compute` as a flow step) is reserved for a future core version; express the step with `use` (a connector operation), `map` (a pure mapping), or the shipped `ctx.elicit` input primitive instead. |
 | `invalid_operation_ref` | Fix the connector operation reference to `alias.operation` for an operation that exists on that connector. |
@@ -58,6 +58,7 @@ Run `noodle validate` (add `--json` for the machine-readable envelope, `--fix-pr
 | `state_secret_field` | Remove the secret-shaped field from widget/handle state; secrets must never be stored in state or sent to widgets. |
 | `invalid_knowledge` | Fix the `knowledge()` declaration: documents must be existing UTF-8 `.md`/`.txt` files inside the project root (no symlinks), within the 100-file / 1 MiB / 25 MiB bounds, and sites need an exact HTTPS origin plus at least one include glob. |
 | `knowledge_unhashed` | Compile from the project root (`noodle validate`/`noodle dev`) so declared knowledge documents can be read and hashed. |
+| `invalid_managed_collection` | Fix the `managedCollection()` declaration: use a bounded, closed Zod object without credential, payment-card, government-identity, health, or biometric field names. |
 | `unknown_connector_alias` | The tool calls a connector alias not declared in `use`/`provides`; add it or fix the alias (see `suggestions`). |
 | `connector_not_in_catalog` | The referenced connector is not in the resolved catalog; add it to the project connectors or correct the reference. |
 | `unknown_operation` | The connector has no such operation; use an operation declared on that connector (see `didYouMean`/`suggestions`). |

package/skills/codex/references/embedded-assistant.md

@@ -224,7 +224,7 @@ Set `webmcp: { enabled: true }` on the assistant to let a browser agent reach th
 
 Set `continuity: { enabled: true }` on a public or mixed access surface to let an anonymous visitor keep the conversation they can see when they navigate to another page of the same site. Off unless set, and refused on an authenticated surface, which reattaches through a backend-verified sign-in instead. It restores the visible text on a fresh session and never the old one: no tool authority, no share of a spent turn budget, and no pending confirmation carried across, so an unanswered confirmation stays unanswered. `windowSeconds` defaults to 300 with a 600 ceiling, `maxRestores` to 3 with a ceiling of 10, and 0 for either disables continuity outright; an operator may lower what you declare and can never raise it. The handle lives in `sessionStorage` so it dies with the tab, is single-use, and is valid only for the embed, origin, and visitor it was issued to. Declare it when a marketing site spreads one conversation across several pages; leave it off when anonymous conversation text should not survive a navigation at all.
 
-Give every business action a portable `tool(..., { title: "Complete task", description: "This will mark the task complete for everyone.", input: z.object({ task: z.string().meta({ title: "Task" }) }) })` title. The standard confirmation uses the tool title/description plus schema field `title`, `description`, and `format`; it shows Confirm and Don't proceed and keeps technical action details secondary. `behavior.showConfirmationDetails` defaults to `true`; set it to `false` to remove only the built-in card's Additional details disclosure and connector mechanics. The business review and decisions remain, `confirm: true` still suspends until acceptance, and headless/BYO `data-confirmation` stays unchanged. Do not put JSON or implementation names in business-facing copy.
+Give every business action a portable `tool(..., { title: "Complete task", description: "This will mark the task complete for everyone.", input: z.object({ task: z.string().meta({ title: "Task" }) }) })` title. The standard confirmation uses the tool title/description plus schema field `title`, `description`, and `format`; it shows Confirm and Don't proceed and keeps technical action details out of the default review. `behavior.showConfirmationDetails` defaults to `false`; set it to `true` only when the audience needs the collapsed Additional details disclosure. The complete business review and decisions remain, `confirm: true` still suspends until acceptance, and headless/BYO `data-confirmation` stays unchanged. Do not put JSON or implementation names in business-facing copy.
 
 ## Configure and deploy
 

package/skills/codex/references/sdk-surface.md

@@ -63,6 +63,7 @@ Platform helper connectors are explicit subpath imports from `@noodleseed/one/pl
 - `firecrawl`
 - `gmailConnector`
 - `knowledge`
+- `managedCollection`
 - `managedSecret`
 - `meilisearch`
 - `noodleManaged`

package/skills/codex/reporting-noodle-feedback/SKILL.md

@@ -3,7 +3,7 @@ name: reporting-noodle-feedback
 description: "Use when a Noodle Seed bug, misleading instruction, missing capability, or concrete product improvement should be proposed to the user."
 ---
 
-<!-- noodle-skill version:0.99.0 hash:660cc6ad9469d90f -->
+<!-- noodle-skill version:0.100.0 hash:660cc6ad9469d90f -->
 
 # reporting-noodle-feedback
 

package/skills/codex/verifying-mcp-delivery/SKILL.md

@@ -3,7 +3,7 @@ name: verifying-mcp-delivery
 description: "Use when proving a Noodle Seed MCP project works at a named compile, local, connector, App, host, deployment, or production evidence level."
 ---
 
-<!-- noodle-skill version:0.99.0 hash:292253cbaed9a3c5 -->
+<!-- noodle-skill version:0.100.0 hash:292253cbaed9a3c5 -->
 
 # verifying-mcp-delivery
 

package/skills/codex/wrapping-existing-applications/SKILL.md

@@ -3,7 +3,7 @@ name: wrapping-existing-applications
 description: "Use when an existing application has no stable usable API and needs a read-only, identity-first Noodle Seed integration plan before implementation."
 ---
 
-<!-- noodle-skill version:0.99.0 hash:379ab9f64878f1fe -->
+<!-- noodle-skill version:0.100.0 hash:379ab9f64878f1fe -->
 
 # wrapping-existing-applications
 

package/skills/codex/wrapping-existing-applications/references/authoring-workflow.md

@@ -17,6 +17,7 @@
 - Tests
 - Secrets and variables
 - Embedded assistant
+- Managed collections
 - Boundaries
 
 ## Input paths
@@ -441,6 +442,12 @@ The compiler validates and hashes every document at build time (bad extensions,
 
 The managed crawler and managed index are the defaults and need no configuration. A component may instead bring its own crawler (`crawler: firecrawl({ apiKey: secret('FIRECRAWL_API_KEY') })` or `tavily(...)`) and/or its own index (`index: algolia({ appId: variable('ALGOLIA_APP_ID'), apiKey: secret('ALGOLIA_API_KEY') })` or `meilisearch({ host: variable(...), apiKey: secret(...) })`). The code declares only config names; operators supply values with `noodle secrets set` / `noodle variables set`, and deploy preflight fails closed naming any unset reference.
 
+## Managed collections
+
+Use `managedCollection(name, { title, description, schemaVersion, record })` when an application needs reusable typed intent for business records that Noodle may later hold. Pass it through `server(..., { collections: [...] }, definitions)`. `record` is one bounded, closed Zod object; names use lowercase letters, numbers, and underscores. Keep payment-card, credentials, passport/government identity, health, and biometric fields out of this surface.
+
+This declaration compiles schema metadata only. It does not create a submit tool, grant access, select retention or residency, provision storage, or make records available to MCP or the embedded assistant. Operators bind lifecycle and authority separately. Until the service intake path is shipped, keep live business operations on their existing connector tools.
+
 ## Boundaries
 
 Import public app authoring only from `@noodleseed/one` (and its documented `/react` or `/platform` subpaths). Packages and subpaths under `@noodle-borg/*` are runtime implementation details, including `/portable` boundaries, and must never appear in customer `server.ts` code. Do not hand-author manifest JSON/YAML, runtime artifacts, connector IR, or hosted asset metadata. Do not read or copy secrets, bearer tokens, refresh tokens, static access keys, `.env`, `.env.noodle`, or `~/.noodle/config.json`. Hosted access is identity-based — do not add static data-plane credential paths.