@noodleseed/one 0.136.0 → 0.138.0

package/node_modules/@noodle-borg/wire-contracts/dist/control-plane.d.ts

@@ -1,5 +1,7 @@
 /** Strict service-output contracts for control-plane reads and mutations (ADR 0128). */
 import { z } from 'zod';
+/** Exact OAuth subject bound by an operator to an owner-only deployment. */
+export declare const deploymentOwnerSubjectSchema: z.ZodString;
 export declare const accessUpdateRequestSchema: z.ZodObject<{
     accessMode: z.ZodEnum<{
         "owner-only": "owner-only";
@@ -9,8 +11,118 @@ export declare const accessUpdateRequestSchema: z.ZodObject<{
         mixed: "mixed";
         customers: "customers";
     }>;
+    ownerSubject: z.ZodOptional<z.ZodString>;
     serverVersion: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
+export declare const accessUpdateResponseSchema: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    target: z.ZodObject<{
+        org: z.ZodString;
+        app: z.ZodString;
+        env: z.ZodString;
+    }, z.core.$strict>;
+    deployment: z.ZodObject<{
+        deploymentId: z.ZodString;
+        serverVersion: z.ZodOptional<z.ZodString>;
+        accessMode: z.ZodEnum<{
+            "owner-only": "owner-only";
+            "org-members": "org-members";
+            authenticated: "authenticated";
+            public: "public";
+            mixed: "mixed";
+            customers: "customers";
+        }>;
+        ownerSubject: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    previousAccessMode: z.ZodEnum<{
+        "owner-only": "owner-only";
+        "org-members": "org-members";
+        authenticated: "authenticated";
+        public: "public";
+        mixed: "mixed";
+        customers: "customers";
+    }>;
+    previousOwnerSubject: z.ZodOptional<z.ZodString>;
+    accessChanged: z.ZodBoolean;
+    ownerChanged: z.ZodBoolean;
+    changed: z.ZodBoolean;
+}, z.core.$strict>;
+export type AccessUpdateResponse = z.output<typeof accessUpdateResponseSchema>;
+/**
+ * Additive client reader for the access mutation response. Older services emitted only the aggregate
+ * `changed` bit, so the mode component is derived from the authoritative previous/current modes while an
+ * unobservable owner component remains omitted. Modern component bits retain the strict cross-field check.
+ */
+export declare const accessUpdateClientResponseSchema: z.ZodPipe<z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    target: z.ZodObject<{
+        org: z.ZodString;
+        app: z.ZodString;
+        env: z.ZodString;
+    }, z.core.$strip>;
+    deployment: z.ZodObject<{
+        deploymentId: z.ZodString;
+        serverVersion: z.ZodOptional<z.ZodString>;
+        accessMode: z.ZodEnum<{
+            "owner-only": "owner-only";
+            "org-members": "org-members";
+            authenticated: "authenticated";
+            public: "public";
+            mixed: "mixed";
+            customers: "customers";
+        }>;
+        ownerSubject: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    previousAccessMode: z.ZodEnum<{
+        "owner-only": "owner-only";
+        "org-members": "org-members";
+        authenticated: "authenticated";
+        public: "public";
+        mixed: "mixed";
+        customers: "customers";
+    }>;
+    previousOwnerSubject: z.ZodOptional<z.ZodString>;
+    accessChanged: z.ZodOptional<z.ZodBoolean>;
+    ownerChanged: z.ZodOptional<z.ZodBoolean>;
+    changed: z.ZodBoolean;
+}, z.core.$strip>, z.ZodTransform<{
+    accessChanged: boolean;
+    ok: true;
+    target: {
+        org: string;
+        app: string;
+        env: string;
+    };
+    deployment: {
+        deploymentId: string;
+        accessMode: "owner-only" | "org-members" | "authenticated" | "public" | "mixed" | "customers";
+        serverVersion?: string | undefined;
+        ownerSubject?: string | undefined;
+    };
+    previousAccessMode: "owner-only" | "org-members" | "authenticated" | "public" | "mixed" | "customers";
+    changed: boolean;
+    previousOwnerSubject?: string | undefined;
+    ownerChanged?: boolean | undefined;
+}, {
+    ok: true;
+    target: {
+        org: string;
+        app: string;
+        env: string;
+    };
+    deployment: {
+        deploymentId: string;
+        accessMode: "owner-only" | "org-members" | "authenticated" | "public" | "mixed" | "customers";
+        serverVersion?: string | undefined;
+        ownerSubject?: string | undefined;
+    };
+    previousAccessMode: "owner-only" | "org-members" | "authenticated" | "public" | "mixed" | "customers";
+    changed: boolean;
+    previousOwnerSubject?: string | undefined;
+    accessChanged?: boolean | undefined;
+    ownerChanged?: boolean | undefined;
+}>>;
+export type AccessUpdateClientResponse = z.output<typeof accessUpdateClientResponseSchema>;
 export declare const deploymentLockRequestSchema: z.ZodObject<{
     serverVersion: z.ZodString;
     expectedDeploymentId: z.ZodString;
@@ -27,6 +139,7 @@ export declare const DeploymentSummarySchema: z.ZodObject<{
     serverName: z.ZodString;
     createdAt: z.ZodString;
     createdByEmail: z.ZodOptional<z.ZodString>;
+    ownerSubject: z.ZodOptional<z.ZodString>;
     deploymentSource: z.ZodOptional<z.ZodString>;
     accessMode: z.ZodEnum<{
         "owner-only": "owner-only";
@@ -66,6 +179,7 @@ export declare const AppSummarySchema: z.ZodObject<{
         serverName: z.ZodString;
         createdAt: z.ZodString;
         createdByEmail: z.ZodOptional<z.ZodString>;
+        ownerSubject: z.ZodOptional<z.ZodString>;
         deploymentSource: z.ZodOptional<z.ZodString>;
         accessMode: z.ZodEnum<{
             "owner-only": "owner-only";
@@ -107,6 +221,7 @@ export declare const AppsListResponseSchema: z.ZodObject<{
                 serverName: z.ZodString;
                 createdAt: z.ZodString;
                 createdByEmail: z.ZodOptional<z.ZodString>;
+                ownerSubject: z.ZodOptional<z.ZodString>;
                 deploymentSource: z.ZodOptional<z.ZodString>;
                 accessMode: z.ZodEnum<{
                     "owner-only": "owner-only";
@@ -150,6 +265,7 @@ export declare const AppResponseSchema: z.ZodObject<{
             serverName: z.ZodString;
             createdAt: z.ZodString;
             createdByEmail: z.ZodOptional<z.ZodString>;
+            ownerSubject: z.ZodOptional<z.ZodString>;
             deploymentSource: z.ZodOptional<z.ZodString>;
             accessMode: z.ZodEnum<{
                 "owner-only": "owner-only";
@@ -190,6 +306,7 @@ export declare const EnvSummarySchema: z.ZodObject<{
         serverName: z.ZodString;
         createdAt: z.ZodString;
         createdByEmail: z.ZodOptional<z.ZodString>;
+        ownerSubject: z.ZodOptional<z.ZodString>;
         deploymentSource: z.ZodOptional<z.ZodString>;
         accessMode: z.ZodEnum<{
             "owner-only": "owner-only";
@@ -233,6 +350,7 @@ export declare const EnvsListResponseSchema: z.ZodObject<{
                 serverName: z.ZodString;
                 createdAt: z.ZodString;
                 createdByEmail: z.ZodOptional<z.ZodString>;
+                ownerSubject: z.ZodOptional<z.ZodString>;
                 deploymentSource: z.ZodOptional<z.ZodString>;
                 accessMode: z.ZodEnum<{
                     "owner-only": "owner-only";
@@ -277,6 +395,7 @@ export declare const EnvResponseSchema: z.ZodObject<{
             serverName: z.ZodString;
             createdAt: z.ZodString;
             createdByEmail: z.ZodOptional<z.ZodString>;
+            ownerSubject: z.ZodOptional<z.ZodString>;
             deploymentSource: z.ZodOptional<z.ZodString>;
             accessMode: z.ZodEnum<{
                 "owner-only": "owner-only";
@@ -358,6 +477,7 @@ export declare const DeploymentResponseSchema: z.ZodObject<{
         serverName: z.ZodString;
         createdAt: z.ZodString;
         createdByEmail: z.ZodOptional<z.ZodString>;
+        ownerSubject: z.ZodOptional<z.ZodString>;
         deploymentSource: z.ZodOptional<z.ZodString>;
         accessMode: z.ZodEnum<{
             "owner-only": "owner-only";

package/node_modules/@noodle-borg/wire-contracts/dist/control-plane.js

@@ -1,12 +1,133 @@
 /** Strict service-output contracts for control-plane reads and mutations (ADR 0128). */
 import { z } from 'zod';
 import { accessModeSchema } from './access-mode.js';
+function containsC0OrDel(value) {
+    for (let index = 0; index < value.length; index += 1) {
+        const codeUnit = value.charCodeAt(index);
+        if (codeUnit <= 0x1f || codeUnit === 0x7f)
+            return true;
+    }
+    return false;
+}
+/** Exact OAuth subject bound by an operator to an owner-only deployment. */
+export const deploymentOwnerSubjectSchema = z
+    .string()
+    .min(1)
+    .max(512)
+    .refine((value) => value.trim() === value && !containsC0OrDel(value), 'owner subject must not contain outer whitespace or C0/DEL control characters');
 export const accessUpdateRequestSchema = z
     .object({
     accessMode: accessModeSchema,
+    ownerSubject: deploymentOwnerSubjectSchema.optional(),
     serverVersion: z.string().min(1).optional(),
 })
-    .strict();
+    .strict()
+    .superRefine((value, context) => {
+    if (value.ownerSubject !== undefined && value.accessMode !== 'owner-only') {
+        context.addIssue({
+            code: 'custom',
+            path: ['ownerSubject'],
+            message: 'ownerSubject is valid only with owner-only access',
+        });
+    }
+});
+export const accessUpdateResponseSchema = z
+    .object({
+    ok: z.literal(true),
+    target: z
+        .object({
+        org: z.string().min(1),
+        app: z.string().min(1),
+        env: z.string().min(1),
+    })
+        .strict(),
+    deployment: z
+        .object({
+        deploymentId: z.string().min(1),
+        serverVersion: z.string().min(1).optional(),
+        accessMode: accessModeSchema,
+        ownerSubject: deploymentOwnerSubjectSchema.optional(),
+    })
+        .strict(),
+    previousAccessMode: accessModeSchema,
+    previousOwnerSubject: deploymentOwnerSubjectSchema.optional(),
+    accessChanged: z.boolean(),
+    ownerChanged: z.boolean(),
+    changed: z.boolean(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.deployment.accessMode === 'owner-only' &&
+        value.deployment.ownerSubject === undefined) {
+        context.addIssue({
+            code: 'custom',
+            path: ['deployment', 'ownerSubject'],
+            message: 'owner-only access requires a current owner subject',
+        });
+    }
+    if (value.changed !== (value.accessChanged || value.ownerChanged)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['changed'],
+            message: 'changed must equal accessChanged || ownerChanged',
+        });
+    }
+});
+/**
+ * Additive client reader for the access mutation response. Older services emitted only the aggregate
+ * `changed` bit, so the mode component is derived from the authoritative previous/current modes while an
+ * unobservable owner component remains omitted. Modern component bits retain the strict cross-field check.
+ */
+export const accessUpdateClientResponseSchema = z
+    .object({
+    ok: z.literal(true),
+    target: z.object({
+        org: z.string().min(1),
+        app: z.string().min(1),
+        env: z.string().min(1),
+    }),
+    deployment: z.object({
+        deploymentId: z.string().min(1),
+        serverVersion: z.string().min(1).optional(),
+        accessMode: accessModeSchema,
+        ownerSubject: deploymentOwnerSubjectSchema.optional(),
+    }),
+    previousAccessMode: accessModeSchema,
+    previousOwnerSubject: deploymentOwnerSubjectSchema.optional(),
+    accessChanged: z.boolean().optional(),
+    ownerChanged: z.boolean().optional(),
+    changed: z.boolean(),
+})
+    .superRefine((value, context) => {
+    const modernComponents = value.accessChanged !== undefined && value.ownerChanged !== undefined;
+    if ((value.accessChanged === undefined) !== (value.ownerChanged === undefined)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['accessChanged'],
+            message: 'accessChanged and ownerChanged must be present together',
+        });
+    }
+    if (modernComponents &&
+        value.deployment.accessMode === 'owner-only' &&
+        value.deployment.ownerSubject === undefined) {
+        context.addIssue({
+            code: 'custom',
+            path: ['deployment', 'ownerSubject'],
+            message: 'owner-only access requires a current owner subject',
+        });
+    }
+    if (modernComponents && value.changed !== (value.accessChanged || value.ownerChanged)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['changed'],
+            message: 'changed must equal accessChanged || ownerChanged',
+        });
+    }
+})
+    .transform((value) => ({
+    ...value,
+    accessChanged: value.accessChanged ?? value.previousAccessMode !== value.deployment.accessMode,
+}));
 export const deploymentLockRequestSchema = z
     .object({
     serverVersion: z.string().min(1),
@@ -32,6 +153,7 @@ export const DeploymentSummarySchema = z
     serverName: z.string(),
     createdAt: z.string(),
     createdByEmail: z.string().optional(),
+    ownerSubject: deploymentOwnerSubjectSchema.optional(),
     deploymentSource: z.string().optional(),
     accessMode: accessModeSchema,
     deploymentLock: DeploymentLockMetadataSchema.optional(),

package/node_modules/@noodle-borg/wire-contracts/dist/index.d.ts

@@ -80,6 +80,7 @@ export declare const deployRequestSchema: z.ZodObject<{
         mixed: "mixed";
         customers: "customers";
     }>>;
+    ownerSubject: z.ZodOptional<z.ZodString>;
     orgMembershipSources: z.ZodOptional<z.ZodArray<z.ZodEnum<{
         explicit: "explicit";
         domain: "domain";
@@ -115,6 +116,7 @@ export declare const deploySuccessResponseSchema: z.ZodObject<{
         mixed: "mixed";
         customers: "customers";
     }>;
+    ownerSubject: z.ZodOptional<z.ZodString>;
     url: z.ZodString;
     defaultUrl: z.ZodString;
     embedId: z.ZodOptional<z.ZodString>;
@@ -158,6 +160,7 @@ export declare const deployPreflightRequestSchema: z.ZodObject<{
         mixed: "mixed";
         customers: "customers";
     }>>;
+    ownerSubject: z.ZodOptional<z.ZodString>;
     orgMembershipSources: z.ZodOptional<z.ZodArray<z.ZodEnum<{
         explicit: "explicit";
         domain: "domain";
@@ -183,6 +186,7 @@ export type DeployTargetState = z.infer<typeof deployTargetStateSchema>;
 export declare const deployPreflightResponseSchema: z.ZodObject<{
     ok: z.ZodLiteral<true>;
     ready: z.ZodBoolean;
+    ownerSubject: z.ZodOptional<z.ZodString>;
     target: z.ZodObject<{
         org: z.ZodString;
         app: z.ZodString;

package/node_modules/@noodle-borg/wire-contracts/dist/index.js

@@ -9,6 +9,7 @@
  */
 import { z } from 'zod';
 import { accessModeSchema } from './access-mode.js';
+import { deploymentOwnerSubjectSchema } from './control-plane.js';
 export * from './access-mode.js';
 export * from './assistant.js';
 export * from './billing-operations.js';
@@ -50,14 +51,25 @@ export const hostedAssetSchema = z.object({
  */
 export const ORG_MEMBERSHIP_SOURCES = ['explicit', 'domain'];
 export const orgMembershipSourceSchema = z.enum(ORG_MEMBERSHIP_SOURCES);
-export const deployRequestSchema = z.object({
+export const deployRequestSchema = z
+    .object({
     manifest: z.string().min(1),
     connectors: z.string().min(1).optional(),
     hostedAssets: z.array(hostedAssetSchema).optional(),
     accessMode: accessModeSchema.optional(),
+    ownerSubject: deploymentOwnerSubjectSchema.optional(),
     orgMembershipSources: z.array(orgMembershipSourceSchema).min(1).optional(),
     serverVersion: z.string().min(1).optional(),
     deploymentSource: deploymentSourceSchema.optional(),
+})
+    .superRefine((value, context) => {
+    if (value.ownerSubject !== undefined && (value.accessMode ?? 'owner-only') !== 'owner-only') {
+        context.addIssue({
+            code: 'custom',
+            path: ['ownerSubject'],
+            message: 'ownerSubject is valid only with owner-only access',
+        });
+    }
 });
 /** Exact bytes both sides bind when deriving a retry-safe deploy key. */
 export function deployIdempotencyMaterial(target, requestBody) {
@@ -72,6 +84,7 @@ export const deploySuccessResponseSchema = z.object({
     deploymentId: z.string().min(1),
     serverVersion: z.string().min(1),
     accessMode: accessModeSchema,
+    ownerSubject: deploymentOwnerSubjectSchema.optional(),
     url: z.string().min(1),
     defaultUrl: z.string().min(1),
     /**
@@ -111,6 +124,7 @@ const deployPreflightErrorSchema = z.object({
 export const deployPreflightResponseSchema = z.object({
     ok: z.literal(true),
     ready: z.boolean(),
+    ownerSubject: deploymentOwnerSubjectSchema.optional(),
     target: z.object({
         org: z.string().min(1),
         app: z.string().min(1),

package/node_modules/@noodleseed/assistant/README.md

@@ -2,8 +2,9 @@
 
 Customer-branded embedded assistant surfaces for Noodle Seed deployments.
 
-The package exports the canonical `<noodle-assistant>` Web Component, a managed React wrapper and secure
-`NoodleAppView` MCP App renderer from `@noodleseed/assistant/react`, a renderer-free React hook from
+The package exports the canonical `<noodle-assistant>` managed Web Component, the framework-neutral
+`<noodle-app-view>` MCP App host from `@noodleseed/assistant/app-view`, a managed React wrapper and
+`NoodleAppView` adapter from `@noodleseed/assistant/react`, a renderer-free React hook from
 `@noodleseed/assistant/react/client`, a DOM-free client from `@noodleseed/assistant/client`, and the
 backend-only `createAssistantSession` helper from `@noodleseed/assistant/server`. Light, dark, and automatic
 themes work without configuration; the component inherits the deployed MCP server's brand kit while slots,
@@ -376,20 +377,54 @@ if (part.type === "data-view") {
 }
 ```
 
-`NoodleAppView` owns the double iframe and AppBridge. Its lifecycle identity is the supplied client plus
+`<noodle-app-view>` owns the double iframe and AppBridge; `NoodleAppView` delegates to it. Its lifecycle identity is the supplied client plus
 `view.id` plus `view.resourceUri`: ordinary parent rerenders and fresh view/callback objects retain the
 iframe, while a semantic view replacement or unmount requests standard App teardown and closes the bridge.
 Do not also key an ancestor by the whole view object or a callback. Pass the embedding application's
 resolved `"light"` or `"dark"` theme; later changes are published through MCP Apps host context without
 replacing the iframe.
 
+App views stay inline by default. The host advertises only inline presentation and rejects an untrusted
+App's fullscreen request, so stale or third-party widget code cannot take over the embedding application's
+viewport. If fullscreen is an intentional part of the customer-owned experience, opt in explicitly with
+`allowFullscreen` on `NoodleAppView` or `allow-fullscreen` on `<noodle-app-view>`; do not enable it merely
+because a widget requests it. After an accepted fullscreen request, the host displays an accessible exit
+control in the top-right corner. It returns the same mounted App to inline mode without resetting its state.
+
+Vue, Angular, and plain DOM renderers use the same host without installing React. Import its dedicated entry
+once, then assign the complex values as element properties. In Vue, the explicit `.prop` modifier makes that
+boundary unambiguous:
+
+```vue
+<script setup lang="ts">
+import "@noodleseed/assistant/app-view";
+</script>
+
+<template>
+  <noodle-app-view
+    :client.prop="assistant"
+    :view.prop="part.data"
+    :theme="resolvedTheme"
+    @assistant-error="reportAssistantError"
+  />
+</template>
+```
+
+Configure Vue's `isCustomElement` for `noodle-app-view`. Angular uses the same element with `[client]`,
+`[view]`, and `[theme]` property bindings. Do not serialize `client` or `view` into attributes.
+
+`<noodle-app-view>` is the canonical host; `NoodleAppView` delegates to it. Both use the
+service-advertised sandbox URL, route App calls through the supplied client, publish theme changes without
+replacing the iframe, and request standard teardown on semantic replacement, disconnect, or an App teardown
+request.
+
 The App document owns its action intent: it calls standard `tools/call` after connecting and never relies on
 native form navigation. If that call needs input or confirmation, the same `client` publishes the normal
 pending interaction part for either managed or customer-owned rendering. The original App call stays pending
 and receives its MCP result after `client.respond(...)`; applications must not retry or translate the click.
 
-Outside React, subscribe to the DOM-free AI SDK `UIMessage` state without registering a custom element or
-touching browser storage:
+Outside React, subscribe to the DOM-free AI SDK `UIMessage` state without touching browser storage. The
+client itself registers no element; import `/app-view` only when the transcript renders linked MCP Apps:
 
 ```ts
 import { createAssistantClient } from "@noodleseed/assistant/client";
@@ -491,8 +526,8 @@ flow collects all elicited input before its first connector operation.
 
 A completed widget-linked tool emits typed `view_available` data with its call/interaction id, tool,
 `ui://` resource identity, optional title, bounded/redacted public result, and—on current services—the
-self-contained App document. This is an availability signal, not proof of rendering. A customer-owned React
-renderer either mounts the actual App with `NoodleAppView` or deliberately substitutes a component already
+self-contained App document. This is an availability signal, not proof of rendering. A customer-owned
+renderer either mounts the actual App with `<noodle-app-view>` (or its React `NoodleAppView` adapter) or deliberately substitutes a component already
 trusted by the application and selected by `resourceUri`/tool. The JSON `result` is data for a native
 component; serializing it is not a rendering of the linked App. Never fetch the `ui://` URI, inject
 `part.data.html`, or assign it to `srcdoc` yourself. The standard element also forwards the same detail as a
@@ -615,7 +650,7 @@ shadow-DOM selectors and classes are not public API.
 
 `theme="auto"` follows the browser's operating-system color preference. When the embedding application has
 its own theme toggle, pass its resolved `"light"` or `"dark"` value to `NoodleAssistant` and every
-`NoodleAppView`. Updates change the assistant in place and notify mounted MCP Apps through standard host
+`<noodle-app-view>`/`NoodleAppView`. Updates change the assistant in place and notify mounted MCP Apps through standard host
 context.
 
 Server branding controls customer name, themed logo/mark/avatar assets, semantic light/dark colors, density,

package/node_modules/@noodleseed/assistant/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@noodleseed/assistant",
-  "version": "1.22.0",
-  "description": "Embed the Noodle Seed customer-branded assistant in your web app with a Web Component, managed or custom React UI, DOM-free client, and backend session helper. Authoring and deploying the server is @noodleseed/one.",
+  "version": "1.23.0",
+  "description": "Embed the Noodle Seed customer-branded assistant in your web app with managed or framework-owned UI, a framework-neutral MCP App host, a DOM-free client, and a backend session helper. Authoring and deploying the server is @noodleseed/one.",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -26,6 +26,17 @@
       },
       "default": "./dist/index.js"
     },
+    "./app-view": {
+      "import": {
+        "types": "./dist/app-view.d.ts",
+        "default": "./dist/app-view.js"
+      },
+      "require": {
+        "types": "./dist/app-view.d.cts",
+        "default": "./dist/app-view.cjs"
+      },
+      "default": "./dist/app-view.js"
+    },
     "./client": {
       "import": {
         "types": "./dist/client.d.ts",
@@ -103,6 +114,9 @@
   "module": "./dist/index.js",
   "typesVersions": {
     "*": {
+      "app-view": [
+        "./dist/app-view.d.ts"
+      ],
       "react": [
         "./dist/react.d.ts"
       ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/one",
-  "version": "0.136.0",
+  "version": "0.138.0",
   "private": false,
   "description": "Noodle CLI by Noodle Seed — author, run, and deploy declarative MCP servers. Embedding the assistant in your own web app is @noodleseed/assistant.",
   "license": "Apache-2.0",
@@ -236,7 +236,7 @@
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.81.0",
+    "@noodle-borg/agent-kit": "0.82.0",
     "@noodle-borg/app-audit": "0.0.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",