@noodleseed/agent-kit 0.99.1 → 0.100.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/agent-kit",
-  "version": "0.99.1",
+  "version": "0.100.0",
   "private": false,
   "description": "Self-checking, self-updating agent skills for the Noodle Seed CLI. Authored in this repo by @noodle-borg/agent-kit; this is the published, independently-versioned canonical skills artifact the CLI fetches and verifies.",
   "license": "Apache-2.0",

package/skills/claude-code/SKILL.md

@@ -3,7 +3,7 @@ name: noodle-seed
 description: "Use when building, validating, testing, deploying, or operating a local or hosted Noodle Seed MCP server or app authored in TypeScript with the noodle CLI."
 ---
 
-<!-- noodle-skill version:0.99.1 hash:d3ceb1902ef4bb72 -->
+<!-- noodle-skill version:0.100.0 hash:d3ceb1902ef4bb72 -->
 
 # Noodle Seed
 

package/skills/claude-code/authoring-mcp-servers/SKILL.md

@@ -3,7 +3,7 @@ name: authoring-mcp-servers
 description: "Use when creating or extending a headless Noodle Seed MCP server, tool, resource, prompt, or typed model-facing capability."
 ---
 
-<!-- noodle-skill version:0.99.1 hash:dd57a15df15d10b2 -->
+<!-- noodle-skill version:0.100.0 hash:dd57a15df15d10b2 -->
 
 # authoring-mcp-servers
 

package/skills/claude-code/authoring-mcp-servers/references/authoring-workflow.md

@@ -17,6 +17,7 @@
 - Tests
 - Secrets and variables
 - Embedded assistant
+- Managed collections
 - Boundaries
 
 ## Input paths
@@ -441,6 +442,12 @@ The compiler validates and hashes every document at build time (bad extensions,
 
 The managed crawler and managed index are the defaults and need no configuration. A component may instead bring its own crawler (`crawler: firecrawl({ apiKey: secret('FIRECRAWL_API_KEY') })` or `tavily(...)`) and/or its own index (`index: algolia({ appId: variable('ALGOLIA_APP_ID'), apiKey: secret('ALGOLIA_API_KEY') })` or `meilisearch({ host: variable(...), apiKey: secret(...) })`). The code declares only config names; operators supply values with `noodle secrets set` / `noodle variables set`, and deploy preflight fails closed naming any unset reference.
 
+## Managed collections
+
+Use `managedCollection(name, { title, description, schemaVersion, record })` when an application needs reusable typed intent for business records that Noodle may later hold. Pass it through `server(..., { collections: [...] }, definitions)`. `record` is one bounded, closed Zod object; names use lowercase letters, numbers, and underscores. Keep payment-card, credentials, passport/government identity, health, and biometric fields out of this surface.
+
+This declaration compiles schema metadata only. It does not create a submit tool, grant access, select retention or residency, provision storage, or make records available to MCP or the embedded assistant. Operators bind lifecycle and authority separately. Until the service intake path is shipped, keep live business operations on their existing connector tools.
+
 ## Boundaries
 
 Import public app authoring only from `@noodleseed/one` (and its documented `/react` or `/platform` subpaths). Packages and subpaths under `@noodle-borg/*` are runtime implementation details, including `/portable` boundaries, and must never appear in customer `server.ts` code. Do not hand-author manifest JSON/YAML, runtime artifacts, connector IR, or hosted asset metadata. Do not read or copy secrets, bearer tokens, refresh tokens, static access keys, `.env`, `.env.noodle`, or `~/.noodle/config.json`. Hosted access is identity-based — do not add static data-plane credential paths.

package/skills/claude-code/authoring-mcp-servers/references/sdk-surface.md

@@ -63,6 +63,7 @@ Platform helper connectors are explicit subpath imports from `@noodleseed/one/pl
 - `firecrawl`
 - `gmailConnector`
 - `knowledge`
+- `managedCollection`
 - `managedSecret`
 - `meilisearch`
 - `noodleManaged`

package/skills/claude-code/building-mcp-apps/SKILL.md

@@ -3,7 +3,7 @@ name: building-mcp-apps
 description: "Use when a Noodle Seed MCP App, widget, interactive card, visual interaction, or host-visible UI is the primary requested outcome."
 ---
 
-<!-- noodle-skill version:0.99.1 hash:98c7b07c82a7d7ce -->
+<!-- noodle-skill version:0.100.0 hash:98c7b07c82a7d7ce -->
 
 # building-mcp-apps
 

package/skills/claude-code/connecting-apis-to-mcp/SKILL.md

@@ -3,7 +3,7 @@ name: connecting-apis-to-mcp
 description: "Use when all four API-evidence inputs exist—and only then: API base URL, authentication scheme, representative safe read, and observed response."
 ---
 
-<!-- noodle-skill version:0.99.1 hash:8020811f1769c538 -->
+<!-- noodle-skill version:0.100.0 hash:8020811f1769c538 -->
 
 # connecting-apis-to-mcp
 

package/skills/claude-code/connecting-apis-to-mcp/references/authoring-workflow.md

@@ -17,6 +17,7 @@
 - Tests
 - Secrets and variables
 - Embedded assistant
+- Managed collections
 - Boundaries
 
 ## Input paths
@@ -441,6 +442,12 @@ The compiler validates and hashes every document at build time (bad extensions,
 
 The managed crawler and managed index are the defaults and need no configuration. A component may instead bring its own crawler (`crawler: firecrawl({ apiKey: secret('FIRECRAWL_API_KEY') })` or `tavily(...)`) and/or its own index (`index: algolia({ appId: variable('ALGOLIA_APP_ID'), apiKey: secret('ALGOLIA_API_KEY') })` or `meilisearch({ host: variable(...), apiKey: secret(...) })`). The code declares only config names; operators supply values with `noodle secrets set` / `noodle variables set`, and deploy preflight fails closed naming any unset reference.
 
+## Managed collections
+
+Use `managedCollection(name, { title, description, schemaVersion, record })` when an application needs reusable typed intent for business records that Noodle may later hold. Pass it through `server(..., { collections: [...] }, definitions)`. `record` is one bounded, closed Zod object; names use lowercase letters, numbers, and underscores. Keep payment-card, credentials, passport/government identity, health, and biometric fields out of this surface.
+
+This declaration compiles schema metadata only. It does not create a submit tool, grant access, select retention or residency, provision storage, or make records available to MCP or the embedded assistant. Operators bind lifecycle and authority separately. Until the service intake path is shipped, keep live business operations on their existing connector tools.
+
 ## Boundaries
 
 Import public app authoring only from `@noodleseed/one` (and its documented `/react` or `/platform` subpaths). Packages and subpaths under `@noodle-borg/*` are runtime implementation details, including `/portable` boundaries, and must never appear in customer `server.ts` code. Do not hand-author manifest JSON/YAML, runtime artifacts, connector IR, or hosted asset metadata. Do not read or copy secrets, bearer tokens, refresh tokens, static access keys, `.env`, `.env.noodle`, or `~/.noodle/config.json`. Hosted access is identity-based — do not add static data-plane credential paths.

package/skills/claude-code/creating-product-agent-guides/SKILL.md

@@ -3,7 +3,7 @@ name: creating-product-agent-guides
 description: "Use when a Noodle Seed MCP server needs a new or revised product agent guide, App Package skill, or explicit product-skill regeneration."
 ---
 
-<!-- noodle-skill version:0.99.1 hash:0e06e11254563b6a -->
+<!-- noodle-skill version:0.100.0 hash:0e06e11254563b6a -->
 
 # creating-product-agent-guides
 

package/skills/claude-code/debugging-mcp-delivery/SKILL.md

@@ -3,7 +3,7 @@ name: debugging-mcp-delivery
 description: "Use when an existing Noodle Seed MCP project has a concrete validation, runtime, connector, App, host, deployment, or production failure."
 ---
 
-<!-- noodle-skill version:0.99.1 hash:8d75ad13f4b3120a -->
+<!-- noodle-skill version:0.100.0 hash:8d75ad13f4b3120a -->
 
 # debugging-mcp-delivery
 

package/skills/claude-code/deploying-mcp-services/SKILL.md

@@ -3,7 +3,7 @@ name: deploying-mcp-services
 description: "Use when the user explicitly requests a Noodle Seed hosted link, configuration write, deployment, access change, rollback, or connection write."
 ---
 
-<!-- noodle-skill version:0.99.1 hash:3a1e14ff9b98ddbd -->
+<!-- noodle-skill version:0.100.0 hash:3a1e14ff9b98ddbd -->
 
 # deploying-mcp-services
 

package/skills/claude-code/deploying-mcp-services/references/cli-commands.md

@@ -61,6 +61,7 @@ Developer-facing `noodle` commands, grouped by area. Local authoring commands (`
 | `noodle deployments` | List or inspect individual deployments (`deployments list`/`deployments inspect <id>`). |
 | `noodle distributions` | Publish immutable host archives, record their lifecycle, and operate bounded delivery. |
 | `noodle service` | Query hosted service capabilities. |
+| `noodle solutions` | Install managed solutions and operate their grants, records, activity, exports, and deletion. |
 | `noodle login` | Authenticate with Noodle Seed Cloud. |
 | `noodle logout` | Clear saved credentials. |
 | `noodle whoami` | Print the current authenticated user. |

package/skills/claude-code/designing-mcp-products/SKILL.md

@@ -3,7 +3,7 @@ name: designing-mcp-products
 description: "Use when a Noodle Seed MCP product idea needs conversational fit, user benefit, scope, interaction, or evidence design before implementation."
 ---
 
-<!-- noodle-skill version:0.99.1 hash:a21b2ed9997f9454 -->
+<!-- noodle-skill version:0.100.0 hash:a21b2ed9997f9454 -->
 
 # designing-mcp-products
 

package/skills/claude-code/designing-mcp-products/references/authoring-workflow.md

@@ -17,6 +17,7 @@
 - Tests
 - Secrets and variables
 - Embedded assistant
+- Managed collections
 - Boundaries
 
 ## Input paths
@@ -441,6 +442,12 @@ The compiler validates and hashes every document at build time (bad extensions,
 
 The managed crawler and managed index are the defaults and need no configuration. A component may instead bring its own crawler (`crawler: firecrawl({ apiKey: secret('FIRECRAWL_API_KEY') })` or `tavily(...)`) and/or its own index (`index: algolia({ appId: variable('ALGOLIA_APP_ID'), apiKey: secret('ALGOLIA_API_KEY') })` or `meilisearch({ host: variable(...), apiKey: secret(...) })`). The code declares only config names; operators supply values with `noodle secrets set` / `noodle variables set`, and deploy preflight fails closed naming any unset reference.
 
+## Managed collections
+
+Use `managedCollection(name, { title, description, schemaVersion, record })` when an application needs reusable typed intent for business records that Noodle may later hold. Pass it through `server(..., { collections: [...] }, definitions)`. `record` is one bounded, closed Zod object; names use lowercase letters, numbers, and underscores. Keep payment-card, credentials, passport/government identity, health, and biometric fields out of this surface.
+
+This declaration compiles schema metadata only. It does not create a submit tool, grant access, select retention or residency, provision storage, or make records available to MCP or the embedded assistant. Operators bind lifecycle and authority separately. Until the service intake path is shipped, keep live business operations on their existing connector tools.
+
 ## Boundaries
 
 Import public app authoring only from `@noodleseed/one` (and its documented `/react` or `/platform` subpaths). Packages and subpaths under `@noodle-borg/*` are runtime implementation details, including `/portable` boundaries, and must never appear in customer `server.ts` code. Do not hand-author manifest JSON/YAML, runtime artifacts, connector IR, or hosted asset metadata. Do not read or copy secrets, bearer tokens, refresh tokens, static access keys, `.env`, `.env.noodle`, or `~/.noodle/config.json`. Hosted access is identity-based — do not add static data-plane credential paths.

package/skills/claude-code/embedding-mcp-assistants/SKILL.md

@@ -3,7 +3,7 @@ name: embedding-mcp-assistants
 description: "Use when embedding a Noodle assistant into an existing SaaS or web application with browser, identity, session, and credential boundaries."
 ---
 
-<!-- noodle-skill version:0.99.1 hash:d554d661ed7ac7be -->
+<!-- noodle-skill version:0.100.0 hash:d554d661ed7ac7be -->
 
 # embedding-mcp-assistants
 

package/skills/claude-code/embedding-mcp-assistants/references/authoring-workflow.md

@@ -17,6 +17,7 @@
 - Tests
 - Secrets and variables
 - Embedded assistant
+- Managed collections
 - Boundaries
 
 ## Input paths
@@ -441,6 +442,12 @@ The compiler validates and hashes every document at build time (bad extensions,
 
 The managed crawler and managed index are the defaults and need no configuration. A component may instead bring its own crawler (`crawler: firecrawl({ apiKey: secret('FIRECRAWL_API_KEY') })` or `tavily(...)`) and/or its own index (`index: algolia({ appId: variable('ALGOLIA_APP_ID'), apiKey: secret('ALGOLIA_API_KEY') })` or `meilisearch({ host: variable(...), apiKey: secret(...) })`). The code declares only config names; operators supply values with `noodle secrets set` / `noodle variables set`, and deploy preflight fails closed naming any unset reference.
 
+## Managed collections
+
+Use `managedCollection(name, { title, description, schemaVersion, record })` when an application needs reusable typed intent for business records that Noodle may later hold. Pass it through `server(..., { collections: [...] }, definitions)`. `record` is one bounded, closed Zod object; names use lowercase letters, numbers, and underscores. Keep payment-card, credentials, passport/government identity, health, and biometric fields out of this surface.
+
+This declaration compiles schema metadata only. It does not create a submit tool, grant access, select retention or residency, provision storage, or make records available to MCP or the embedded assistant. Operators bind lifecycle and authority separately. Until the service intake path is shipped, keep live business operations on their existing connector tools.
+
 ## Boundaries
 
 Import public app authoring only from `@noodleseed/one` (and its documented `/react` or `/platform` subpaths). Packages and subpaths under `@noodle-borg/*` are runtime implementation details, including `/portable` boundaries, and must never appear in customer `server.ts` code. Do not hand-author manifest JSON/YAML, runtime artifacts, connector IR, or hosted asset metadata. Do not read or copy secrets, bearer tokens, refresh tokens, static access keys, `.env`, `.env.noodle`, or `~/.noodle/config.json`. Hosted access is identity-based — do not add static data-plane credential paths.

package/skills/claude-code/examples/acme-bistro/README.md

@@ -6,6 +6,10 @@ completes in chat — only **payment** hands off, via a signed checkout deep lin
 the app). It pairs a view-backed `tool` menu/cart with app-only `tool` cart helpers and a model-visible
 `create_checkout` tool backed by `handoff.allowedDomains`.
 
+It also declares a reusable `guest_requests` managed-collection schema. In this foundation slice the
+declaration compiles schema intent only: storage lifecycle, access, and a public submit route are bound by
+the hosting service separately, and no submit tool is generated.
+
 Capability slot: **end-to-end in-chat transaction + payment-only handoff**, plus a worked **design-first**
 deliverable set (`design/` — a UX Document, a single-file HTML wireframe with an embedded OpenAI Apps SDK
 compliance audit, and a Recommended API contract). It sets the quality bar the `noodle-seed` skill's

package/skills/claude-code/examples/acme-bistro/src/server.ts

@@ -1,4 +1,4 @@
-import { annotations, server, tool, z } from '@noodleseed/one';
+import { annotations, managedCollection, server, tool, z } from '@noodleseed/one';
 
 // Acme Bistro is a fictional restaurant. This app is deliberately END-TO-END: the customer browses the
 // menu and builds the order in chat, and the order completes in chat — only *payment* hands off, via a
@@ -28,6 +28,17 @@ const menuItemOutput = z.object({
   kind: z.string(),
 });
 
+const guestRequests = managedCollection('guest_requests', {
+  title: 'Guest requests',
+  description: 'Guest service requests that restaurant staff can review and resolve.',
+  schemaVersion: 1,
+  record: z.object({
+    locationReference: z.string().min(1).max(120),
+    requestType: z.enum(['reservation_help', 'accessibility', 'dietary_question', 'other']),
+    summary: z.string().min(1).max(1000),
+  }),
+});
+
 // Tool annotations for host planners: the menu read is read-only; cart edits are local writes; checkout
 // opens an external (payment) link.
 const readOnly = annotations.readOnly();
@@ -52,6 +63,8 @@ export default server(
     handoff: {
       allowedDomains: ['https://pay.acme.example', 'https://acme.example'],
     },
+    // Reusable business-record intent. Storage, lifecycle, access, and public intake bind separately.
+    collections: [guestRequests],
   },
   [
     tool('show_menu', {

package/skills/claude-code/examples/acme-bistro/test/server.test.ts

@@ -18,4 +18,14 @@ describe('acme-bistro example', () => {
     expect(text).toContain('add_to_cart');
     expect(text).toContain('create_checkout');
   });
+
+  it('declares reusable guest-request record intent without generating a submit tool', async () => {
+    const manifest = await app.toManifest();
+    expect(manifest.server.collections).toEqual([
+      expect.objectContaining({ name: 'guest_requests', schemaVersion: 1 }),
+    ]);
+    expect(manifest.tools).not.toContainEqual(
+      expect.objectContaining({ name: 'submit_guest_requests' }),
+    );
+  });
 });

package/skills/claude-code/executing-noodle-plans/SKILL.md

@@ -3,7 +3,7 @@ name: executing-noodle-plans
 description: "Use when the user asks to execute an approved, decision-complete implementation plan for a Noodle Seed project task by task with test-first changes, review, recovery, and final verification."
 ---
 
-<!-- noodle-skill version:0.99.1 hash:6a9f132ddb79352e -->
+<!-- noodle-skill version:0.100.0 hash:6a9f132ddb79352e -->
 
 # Execute a Noodle Seed implementation plan
 

package/skills/claude-code/publishing-mcp-integrations/SKILL.md

@@ -3,7 +3,7 @@ name: publishing-mcp-integrations
 description: "Use when preparing, reviewing, or submitting a Noodle Seed MCP integration to a host or app directory."
 ---
 
-<!-- noodle-skill version:0.99.1 hash:0ccafb222038f553 -->
+<!-- noodle-skill version:0.100.0 hash:0ccafb222038f553 -->
 
 # publishing-mcp-integrations
 

package/skills/claude-code/references/authoring-workflow.md

@@ -17,6 +17,7 @@
 - Tests
 - Secrets and variables
 - Embedded assistant
+- Managed collections
 - Boundaries
 
 ## Input paths
@@ -441,6 +442,12 @@ The compiler validates and hashes every document at build time (bad extensions,
 
 The managed crawler and managed index are the defaults and need no configuration. A component may instead bring its own crawler (`crawler: firecrawl({ apiKey: secret('FIRECRAWL_API_KEY') })` or `tavily(...)`) and/or its own index (`index: algolia({ appId: variable('ALGOLIA_APP_ID'), apiKey: secret('ALGOLIA_API_KEY') })` or `meilisearch({ host: variable(...), apiKey: secret(...) })`). The code declares only config names; operators supply values with `noodle secrets set` / `noodle variables set`, and deploy preflight fails closed naming any unset reference.
 
+## Managed collections
+
+Use `managedCollection(name, { title, description, schemaVersion, record })` when an application needs reusable typed intent for business records that Noodle may later hold. Pass it through `server(..., { collections: [...] }, definitions)`. `record` is one bounded, closed Zod object; names use lowercase letters, numbers, and underscores. Keep payment-card, credentials, passport/government identity, health, and biometric fields out of this surface.
+
+This declaration compiles schema metadata only. It does not create a submit tool, grant access, select retention or residency, provision storage, or make records available to MCP or the embedded assistant. Operators bind lifecycle and authority separately. Until the service intake path is shipped, keep live business operations on their existing connector tools.
+
 ## Boundaries
 
 Import public app authoring only from `@noodleseed/one` (and its documented `/react` or `/platform` subpaths). Packages and subpaths under `@noodle-borg/*` are runtime implementation details, including `/portable` boundaries, and must never appear in customer `server.ts` code. Do not hand-author manifest JSON/YAML, runtime artifacts, connector IR, or hosted asset metadata. Do not read or copy secrets, bearer tokens, refresh tokens, static access keys, `.env`, `.env.noodle`, or `~/.noodle/config.json`. Hosted access is identity-based — do not add static data-plane credential paths.

package/skills/claude-code/references/cli-commands.md

@@ -61,6 +61,7 @@ Developer-facing `noodle` commands, grouped by area. Local authoring commands (`
 | `noodle deployments` | List or inspect individual deployments (`deployments list`/`deployments inspect <id>`). |
 | `noodle distributions` | Publish immutable host archives, record their lifecycle, and operate bounded delivery. |
 | `noodle service` | Query hosted service capabilities. |
+| `noodle solutions` | Install managed solutions and operate their grants, records, activity, exports, and deletion. |
 | `noodle login` | Authenticate with Noodle Seed Cloud. |
 | `noodle logout` | Clear saved credentials. |
 | `noodle whoami` | Print the current authenticated user. |

package/skills/claude-code/references/compile-errors.md

@@ -18,7 +18,7 @@ Run `noodle validate` (add `--json` for the machine-readable envelope, `--fix-pr
 | `invalid_shape` | A field has the wrong type or structure; match the shape the compiler reports under `path` against the SDK builder you used. |
 | `invalid_name` | Rename the identifier to match the allowed pattern (lowercase, no spaces/reserved characters) cited at `path`. |
 | `duplicate_name` | Two tools/components share a name; give each a unique name at the cited `path`. |
-| `reserved_name` | Rename the reserved identifier; `__noodleIntent` is platform-owned, while application context uses one explicit zero-input tool with `contextProvider: true`. |
+| `reserved_name` | Rename the reserved identifier; `__noodleIntent` and future managed-collection `submit_<name>` tools are platform-owned, while application context uses one explicit zero-input tool with `contextProvider: true`. |
 | `unsupported_manifest_version` | Update the SDK/CLI so the emitted manifest version is supported; do not pin an old manifest shape. |
 | `reserved_for_future_version` | The verb at `path` (currently `compute` as a flow step) is reserved for a future core version; express the step with `use` (a connector operation), `map` (a pure mapping), or the shipped `ctx.elicit` input primitive instead. |
 | `invalid_operation_ref` | Fix the connector operation reference to `alias.operation` for an operation that exists on that connector. |
@@ -58,6 +58,7 @@ Run `noodle validate` (add `--json` for the machine-readable envelope, `--fix-pr
 | `state_secret_field` | Remove the secret-shaped field from widget/handle state; secrets must never be stored in state or sent to widgets. |
 | `invalid_knowledge` | Fix the `knowledge()` declaration: documents must be existing UTF-8 `.md`/`.txt` files inside the project root (no symlinks), within the 100-file / 1 MiB / 25 MiB bounds, and sites need an exact HTTPS origin plus at least one include glob. |
 | `knowledge_unhashed` | Compile from the project root (`noodle validate`/`noodle dev`) so declared knowledge documents can be read and hashed. |
+| `invalid_managed_collection` | Fix the `managedCollection()` declaration: use a bounded, closed Zod object without credential, payment-card, government-identity, health, or biometric field names. |
 | `unknown_connector_alias` | The tool calls a connector alias not declared in `use`/`provides`; add it or fix the alias (see `suggestions`). |
 | `connector_not_in_catalog` | The referenced connector is not in the resolved catalog; add it to the project connectors or correct the reference. |
 | `unknown_operation` | The connector has no such operation; use an operation declared on that connector (see `didYouMean`/`suggestions`). |

package/skills/claude-code/references/sdk-surface.md

@@ -63,6 +63,7 @@ Platform helper connectors are explicit subpath imports from `@noodleseed/one/pl
 - `firecrawl`
 - `gmailConnector`
 - `knowledge`
+- `managedCollection`
 - `managedSecret`
 - `meilisearch`
 - `noodleManaged`

package/skills/claude-code/reporting-noodle-feedback/SKILL.md

@@ -3,7 +3,7 @@ name: reporting-noodle-feedback
 description: "Use when a Noodle Seed bug, misleading instruction, missing capability, or concrete product improvement should be proposed to the user."
 ---
 
-<!-- noodle-skill version:0.99.1 hash:660cc6ad9469d90f -->
+<!-- noodle-skill version:0.100.0 hash:660cc6ad9469d90f -->
 
 # reporting-noodle-feedback
 

package/skills/claude-code/verifying-mcp-delivery/SKILL.md

@@ -3,7 +3,7 @@ name: verifying-mcp-delivery
 description: "Use when proving a Noodle Seed MCP project works at a named compile, local, connector, App, host, deployment, or production evidence level."
 ---
 
-<!-- noodle-skill version:0.99.1 hash:292253cbaed9a3c5 -->
+<!-- noodle-skill version:0.100.0 hash:292253cbaed9a3c5 -->
 
 # verifying-mcp-delivery
 

package/skills/claude-code/wrapping-existing-applications/SKILL.md

@@ -3,7 +3,7 @@ name: wrapping-existing-applications
 description: "Use when an existing application has no stable usable API and needs a read-only, identity-first Noodle Seed integration plan before implementation."
 ---
 
-<!-- noodle-skill version:0.99.1 hash:379ab9f64878f1fe -->
+<!-- noodle-skill version:0.100.0 hash:379ab9f64878f1fe -->
 
 # wrapping-existing-applications
 

package/skills/claude-code/wrapping-existing-applications/references/authoring-workflow.md

@@ -17,6 +17,7 @@
 - Tests
 - Secrets and variables
 - Embedded assistant
+- Managed collections
 - Boundaries
 
 ## Input paths
@@ -441,6 +442,12 @@ The compiler validates and hashes every document at build time (bad extensions,
 
 The managed crawler and managed index are the defaults and need no configuration. A component may instead bring its own crawler (`crawler: firecrawl({ apiKey: secret('FIRECRAWL_API_KEY') })` or `tavily(...)`) and/or its own index (`index: algolia({ appId: variable('ALGOLIA_APP_ID'), apiKey: secret('ALGOLIA_API_KEY') })` or `meilisearch({ host: variable(...), apiKey: secret(...) })`). The code declares only config names; operators supply values with `noodle secrets set` / `noodle variables set`, and deploy preflight fails closed naming any unset reference.
 
+## Managed collections
+
+Use `managedCollection(name, { title, description, schemaVersion, record })` when an application needs reusable typed intent for business records that Noodle may later hold. Pass it through `server(..., { collections: [...] }, definitions)`. `record` is one bounded, closed Zod object; names use lowercase letters, numbers, and underscores. Keep payment-card, credentials, passport/government identity, health, and biometric fields out of this surface.
+
+This declaration compiles schema metadata only. It does not create a submit tool, grant access, select retention or residency, provision storage, or make records available to MCP or the embedded assistant. Operators bind lifecycle and authority separately. Until the service intake path is shipped, keep live business operations on their existing connector tools.
+
 ## Boundaries
 
 Import public app authoring only from `@noodleseed/one` (and its documented `/react` or `/platform` subpaths). Packages and subpaths under `@noodle-borg/*` are runtime implementation details, including `/portable` boundaries, and must never appear in customer `server.ts` code. Do not hand-author manifest JSON/YAML, runtime artifacts, connector IR, or hosted asset metadata. Do not read or copy secrets, bearer tokens, refresh tokens, static access keys, `.env`, `.env.noodle`, or `~/.noodle/config.json`. Hosted access is identity-based — do not add static data-plane credential paths.

package/skills/codex/SKILL.md

@@ -3,7 +3,7 @@ name: noodle-seed
 description: "Use when building, validating, testing, deploying, or operating a local or hosted Noodle Seed MCP server or app authored in TypeScript with the noodle CLI."
 ---
 
-<!-- noodle-skill version:0.99.1 hash:d3ceb1902ef4bb72 -->
+<!-- noodle-skill version:0.100.0 hash:d3ceb1902ef4bb72 -->
 
 # Noodle Seed
 

package/skills/codex/authoring-mcp-servers/SKILL.md

@@ -3,7 +3,7 @@ name: authoring-mcp-servers
 description: "Use when creating or extending a headless Noodle Seed MCP server, tool, resource, prompt, or typed model-facing capability."
 ---
 
-<!-- noodle-skill version:0.99.1 hash:dd57a15df15d10b2 -->
+<!-- noodle-skill version:0.100.0 hash:dd57a15df15d10b2 -->
 
 # authoring-mcp-servers
 

package/skills/codex/authoring-mcp-servers/references/authoring-workflow.md

@@ -17,6 +17,7 @@
 - Tests
 - Secrets and variables
 - Embedded assistant
+- Managed collections
 - Boundaries
 
 ## Input paths
@@ -441,6 +442,12 @@ The compiler validates and hashes every document at build time (bad extensions,
 
 The managed crawler and managed index are the defaults and need no configuration. A component may instead bring its own crawler (`crawler: firecrawl({ apiKey: secret('FIRECRAWL_API_KEY') })` or `tavily(...)`) and/or its own index (`index: algolia({ appId: variable('ALGOLIA_APP_ID'), apiKey: secret('ALGOLIA_API_KEY') })` or `meilisearch({ host: variable(...), apiKey: secret(...) })`). The code declares only config names; operators supply values with `noodle secrets set` / `noodle variables set`, and deploy preflight fails closed naming any unset reference.
 
+## Managed collections
+
+Use `managedCollection(name, { title, description, schemaVersion, record })` when an application needs reusable typed intent for business records that Noodle may later hold. Pass it through `server(..., { collections: [...] }, definitions)`. `record` is one bounded, closed Zod object; names use lowercase letters, numbers, and underscores. Keep payment-card, credentials, passport/government identity, health, and biometric fields out of this surface.
+
+This declaration compiles schema metadata only. It does not create a submit tool, grant access, select retention or residency, provision storage, or make records available to MCP or the embedded assistant. Operators bind lifecycle and authority separately. Until the service intake path is shipped, keep live business operations on their existing connector tools.
+
 ## Boundaries
 
 Import public app authoring only from `@noodleseed/one` (and its documented `/react` or `/platform` subpaths). Packages and subpaths under `@noodle-borg/*` are runtime implementation details, including `/portable` boundaries, and must never appear in customer `server.ts` code. Do not hand-author manifest JSON/YAML, runtime artifacts, connector IR, or hosted asset metadata. Do not read or copy secrets, bearer tokens, refresh tokens, static access keys, `.env`, `.env.noodle`, or `~/.noodle/config.json`. Hosted access is identity-based — do not add static data-plane credential paths.

package/skills/codex/authoring-mcp-servers/references/sdk-surface.md

@@ -63,6 +63,7 @@ Platform helper connectors are explicit subpath imports from `@noodleseed/one/pl
 - `firecrawl`
 - `gmailConnector`
 - `knowledge`
+- `managedCollection`
 - `managedSecret`
 - `meilisearch`
 - `noodleManaged`

package/skills/codex/building-mcp-apps/SKILL.md

@@ -3,7 +3,7 @@ name: building-mcp-apps
 description: "Use when a Noodle Seed MCP App, widget, interactive card, visual interaction, or host-visible UI is the primary requested outcome."
 ---
 
-<!-- noodle-skill version:0.99.1 hash:98c7b07c82a7d7ce -->
+<!-- noodle-skill version:0.100.0 hash:98c7b07c82a7d7ce -->
 
 # building-mcp-apps
 

package/skills/codex/connecting-apis-to-mcp/SKILL.md

@@ -3,7 +3,7 @@ name: connecting-apis-to-mcp
 description: "Use when all four API-evidence inputs exist—and only then: API base URL, authentication scheme, representative safe read, and observed response."
 ---
 
-<!-- noodle-skill version:0.99.1 hash:8020811f1769c538 -->
+<!-- noodle-skill version:0.100.0 hash:8020811f1769c538 -->
 
 # connecting-apis-to-mcp
 

package/skills/codex/connecting-apis-to-mcp/references/authoring-workflow.md

@@ -17,6 +17,7 @@
 - Tests
 - Secrets and variables
 - Embedded assistant
+- Managed collections
 - Boundaries
 
 ## Input paths
@@ -441,6 +442,12 @@ The compiler validates and hashes every document at build time (bad extensions,
 
 The managed crawler and managed index are the defaults and need no configuration. A component may instead bring its own crawler (`crawler: firecrawl({ apiKey: secret('FIRECRAWL_API_KEY') })` or `tavily(...)`) and/or its own index (`index: algolia({ appId: variable('ALGOLIA_APP_ID'), apiKey: secret('ALGOLIA_API_KEY') })` or `meilisearch({ host: variable(...), apiKey: secret(...) })`). The code declares only config names; operators supply values with `noodle secrets set` / `noodle variables set`, and deploy preflight fails closed naming any unset reference.
 
+## Managed collections
+
+Use `managedCollection(name, { title, description, schemaVersion, record })` when an application needs reusable typed intent for business records that Noodle may later hold. Pass it through `server(..., { collections: [...] }, definitions)`. `record` is one bounded, closed Zod object; names use lowercase letters, numbers, and underscores. Keep payment-card, credentials, passport/government identity, health, and biometric fields out of this surface.
+
+This declaration compiles schema metadata only. It does not create a submit tool, grant access, select retention or residency, provision storage, or make records available to MCP or the embedded assistant. Operators bind lifecycle and authority separately. Until the service intake path is shipped, keep live business operations on their existing connector tools.
+
 ## Boundaries
 
 Import public app authoring only from `@noodleseed/one` (and its documented `/react` or `/platform` subpaths). Packages and subpaths under `@noodle-borg/*` are runtime implementation details, including `/portable` boundaries, and must never appear in customer `server.ts` code. Do not hand-author manifest JSON/YAML, runtime artifacts, connector IR, or hosted asset metadata. Do not read or copy secrets, bearer tokens, refresh tokens, static access keys, `.env`, `.env.noodle`, or `~/.noodle/config.json`. Hosted access is identity-based — do not add static data-plane credential paths.

package/skills/codex/creating-product-agent-guides/SKILL.md

@@ -3,7 +3,7 @@ name: creating-product-agent-guides
 description: "Use when a Noodle Seed MCP server needs a new or revised product agent guide, App Package skill, or explicit product-skill regeneration."
 ---
 
-<!-- noodle-skill version:0.99.1 hash:0e06e11254563b6a -->
+<!-- noodle-skill version:0.100.0 hash:0e06e11254563b6a -->
 
 # creating-product-agent-guides
 

package/skills/codex/debugging-mcp-delivery/SKILL.md

@@ -3,7 +3,7 @@ name: debugging-mcp-delivery
 description: "Use when an existing Noodle Seed MCP project has a concrete validation, runtime, connector, App, host, deployment, or production failure."
 ---
 
-<!-- noodle-skill version:0.99.1 hash:8d75ad13f4b3120a -->
+<!-- noodle-skill version:0.100.0 hash:8d75ad13f4b3120a -->
 
 # debugging-mcp-delivery
 

package/skills/codex/deploying-mcp-services/SKILL.md

@@ -3,7 +3,7 @@ name: deploying-mcp-services
 description: "Use when the user explicitly requests a Noodle Seed hosted link, configuration write, deployment, access change, rollback, or connection write."
 ---
 
-<!-- noodle-skill version:0.99.1 hash:3a1e14ff9b98ddbd -->
+<!-- noodle-skill version:0.100.0 hash:3a1e14ff9b98ddbd -->
 
 # deploying-mcp-services
 

package/skills/codex/deploying-mcp-services/references/cli-commands.md

@@ -61,6 +61,7 @@ Developer-facing `noodle` commands, grouped by area. Local authoring commands (`
 | `noodle deployments` | List or inspect individual deployments (`deployments list`/`deployments inspect <id>`). |
 | `noodle distributions` | Publish immutable host archives, record their lifecycle, and operate bounded delivery. |
 | `noodle service` | Query hosted service capabilities. |
+| `noodle solutions` | Install managed solutions and operate their grants, records, activity, exports, and deletion. |
 | `noodle login` | Authenticate with Noodle Seed Cloud. |
 | `noodle logout` | Clear saved credentials. |
 | `noodle whoami` | Print the current authenticated user. |

package/skills/codex/designing-mcp-products/SKILL.md

@@ -3,7 +3,7 @@ name: designing-mcp-products
 description: "Use when a Noodle Seed MCP product idea needs conversational fit, user benefit, scope, interaction, or evidence design before implementation."
 ---
 
-<!-- noodle-skill version:0.99.1 hash:a21b2ed9997f9454 -->
+<!-- noodle-skill version:0.100.0 hash:a21b2ed9997f9454 -->
 
 # designing-mcp-products
 

package/skills/codex/designing-mcp-products/references/authoring-workflow.md

@@ -17,6 +17,7 @@
 - Tests
 - Secrets and variables
 - Embedded assistant
+- Managed collections
 - Boundaries
 
 ## Input paths
@@ -441,6 +442,12 @@ The compiler validates and hashes every document at build time (bad extensions,
 
 The managed crawler and managed index are the defaults and need no configuration. A component may instead bring its own crawler (`crawler: firecrawl({ apiKey: secret('FIRECRAWL_API_KEY') })` or `tavily(...)`) and/or its own index (`index: algolia({ appId: variable('ALGOLIA_APP_ID'), apiKey: secret('ALGOLIA_API_KEY') })` or `meilisearch({ host: variable(...), apiKey: secret(...) })`). The code declares only config names; operators supply values with `noodle secrets set` / `noodle variables set`, and deploy preflight fails closed naming any unset reference.
 
+## Managed collections
+
+Use `managedCollection(name, { title, description, schemaVersion, record })` when an application needs reusable typed intent for business records that Noodle may later hold. Pass it through `server(..., { collections: [...] }, definitions)`. `record` is one bounded, closed Zod object; names use lowercase letters, numbers, and underscores. Keep payment-card, credentials, passport/government identity, health, and biometric fields out of this surface.
+
+This declaration compiles schema metadata only. It does not create a submit tool, grant access, select retention or residency, provision storage, or make records available to MCP or the embedded assistant. Operators bind lifecycle and authority separately. Until the service intake path is shipped, keep live business operations on their existing connector tools.
+
 ## Boundaries
 
 Import public app authoring only from `@noodleseed/one` (and its documented `/react` or `/platform` subpaths). Packages and subpaths under `@noodle-borg/*` are runtime implementation details, including `/portable` boundaries, and must never appear in customer `server.ts` code. Do not hand-author manifest JSON/YAML, runtime artifacts, connector IR, or hosted asset metadata. Do not read or copy secrets, bearer tokens, refresh tokens, static access keys, `.env`, `.env.noodle`, or `~/.noodle/config.json`. Hosted access is identity-based — do not add static data-plane credential paths.

package/skills/codex/embedding-mcp-assistants/SKILL.md

@@ -3,7 +3,7 @@ name: embedding-mcp-assistants
 description: "Use when embedding a Noodle assistant into an existing SaaS or web application with browser, identity, session, and credential boundaries."
 ---
 
-<!-- noodle-skill version:0.99.1 hash:d554d661ed7ac7be -->
+<!-- noodle-skill version:0.100.0 hash:d554d661ed7ac7be -->
 
 # embedding-mcp-assistants
 

package/skills/codex/embedding-mcp-assistants/references/authoring-workflow.md

@@ -17,6 +17,7 @@
 - Tests
 - Secrets and variables
 - Embedded assistant
+- Managed collections
 - Boundaries
 
 ## Input paths
@@ -441,6 +442,12 @@ The compiler validates and hashes every document at build time (bad extensions,
 
 The managed crawler and managed index are the defaults and need no configuration. A component may instead bring its own crawler (`crawler: firecrawl({ apiKey: secret('FIRECRAWL_API_KEY') })` or `tavily(...)`) and/or its own index (`index: algolia({ appId: variable('ALGOLIA_APP_ID'), apiKey: secret('ALGOLIA_API_KEY') })` or `meilisearch({ host: variable(...), apiKey: secret(...) })`). The code declares only config names; operators supply values with `noodle secrets set` / `noodle variables set`, and deploy preflight fails closed naming any unset reference.
 
+## Managed collections
+
+Use `managedCollection(name, { title, description, schemaVersion, record })` when an application needs reusable typed intent for business records that Noodle may later hold. Pass it through `server(..., { collections: [...] }, definitions)`. `record` is one bounded, closed Zod object; names use lowercase letters, numbers, and underscores. Keep payment-card, credentials, passport/government identity, health, and biometric fields out of this surface.
+
+This declaration compiles schema metadata only. It does not create a submit tool, grant access, select retention or residency, provision storage, or make records available to MCP or the embedded assistant. Operators bind lifecycle and authority separately. Until the service intake path is shipped, keep live business operations on their existing connector tools.
+
 ## Boundaries
 
 Import public app authoring only from `@noodleseed/one` (and its documented `/react` or `/platform` subpaths). Packages and subpaths under `@noodle-borg/*` are runtime implementation details, including `/portable` boundaries, and must never appear in customer `server.ts` code. Do not hand-author manifest JSON/YAML, runtime artifacts, connector IR, or hosted asset metadata. Do not read or copy secrets, bearer tokens, refresh tokens, static access keys, `.env`, `.env.noodle`, or `~/.noodle/config.json`. Hosted access is identity-based — do not add static data-plane credential paths.