@noodleseed/one 0.152.0 → 0.154.0

package/node_modules/@noodle-borg/agent-kit/dist/plugin-bundle.d.ts

@@ -1,4 +1,4 @@
-export { BOOTSTRAP_SKILL_DESCRIPTION, PLUGIN_NAME } from './plugin-bootstrap-skill.js';
+export { PLUGIN_NAME } from './plugin-bootstrap-skill.js';
 /** The public marketplace identifier (`/plugin install noodle-seed@noodleseed`). */
 export declare const MARKETPLACE_NAME = "noodleseed";
 /** Where the plugin lives inside the marketplace repo (relative sources must start with "./"). */

package/node_modules/@noodle-borg/agent-kit/dist/skill-content.js

@@ -23,7 +23,7 @@ import { APP_DIRECTORY_COMPLIANCE_REFERENCE } from './skill-router.js';
 import { renderBuildAnMcpServerReference } from './skill-server-playbook-ref.js';
 import { renderToolDesignReference } from './skill-tool-design-ref.js';
 import { renderVerifyAndRecoverReference } from './skill-verification-ref.js';
-export { REFERENCE_INDEX_LINES, SKILL_DESCRIPTION, SKILL_ROUTES, skillRouterBody, } from './skill-router.js';
+export { skillRouterBody } from './skill-router.js';
 // ----------------------------------------------------------------------------
 // references/sdk-surface.md (GENERATED from SDK_EXPORTS + curated recipes)
 // ----------------------------------------------------------------------------
@@ -251,7 +251,7 @@ const SDK_AUTHORING_SIGNATURES = [
     '- `customerAuth.*(...)` belongs in `server` options when deployed customer callers need verified identity; inspect `examples/customer-auth` or `examples/sharepoint` before using it.',
     '- `state` defines durable widget state handles; handle schemas may use `.optional()`/`.default()` — defaulted fields are optional on write, so a save that omits them still validates. Add `claimOnAuthentication: true` only to an explicitly caller-scoped handle with a finite TTL when a mixed public assistant should atomically adopt that expiring draft on sign-in-ticket spend. `handoff` declares allowed external domains for safe host handoff.',
 ];
-export function renderSdkSurfaceReference() {
+function renderSdkSurfaceReference() {
     const remaining = new Set(SDK_EXPORTS);
     const sections = [];
     for (const group of SDK_GROUPS) {
@@ -290,7 +290,7 @@ export function renderSdkSurfaceReference() {
 // ----------------------------------------------------------------------------
 // references/cli-commands.md (GENERATED from CLI_COMMANDS + curated groups)
 // ----------------------------------------------------------------------------
-export function renderCliCommandsReference() {
+function renderCliCommandsReference() {
     const groupOrder = [...COMMAND_GROUP_ORDER, 'Other'];
     const byGroup = new Map();
     for (const name of CLI_COMMANDS) {
@@ -327,7 +327,7 @@ export function renderCliCommandsReference() {
 // ----------------------------------------------------------------------------
 // references/agent-contract.md (CURATED)
 // ----------------------------------------------------------------------------
-export function renderAgentContractReference() {
+function renderAgentContractReference() {
     return [
         '# Agent contract: --json, exit codes, output modes',
         '',
@@ -378,7 +378,7 @@ export function renderAgentContractReference() {
 // ----------------------------------------------------------------------------
 // references/compile-errors.md (GENERATED codes + curated fixes)
 // ----------------------------------------------------------------------------
-export function renderCompileErrorsReference() {
+function renderCompileErrorsReference() {
     const rows = COMPILE_ERROR_CODES.map((code) => [`\`${code}\``, ERROR_FIXES[code] ?? '—']);
     return [
         '# Fixing noodle validate errors',

package/node_modules/@noodle-borg/agent-kit/dist/skill-router.d.ts

@@ -3,7 +3,7 @@ import type { AgentTarget } from './index.js';
 export declare const SKILL_DESCRIPTION: string;
 export type SkillReferencePath = `references/${string}.md`;
 export declare const APP_DIRECTORY_COMPLIANCE_REFERENCE: SkillReferencePath;
-export type SkillRouteId = 'design-product' | 'create-product-guide' | 'wrap-existing-app' | 'build-server' | 'connect-api' | 'build-app' | 'verify-recover' | 'debug-recover' | 'inspect-hosted' | 'deploy-hosted' | 'embed-assistant' | 'publish' | 'feedback';
+type SkillRouteId = 'design-product' | 'create-product-guide' | 'wrap-existing-app' | 'build-server' | 'connect-api' | 'build-app' | 'verify-recover' | 'debug-recover' | 'inspect-hosted' | 'deploy-hosted' | 'embed-assistant' | 'publish' | 'feedback';
 export interface SkillRoute {
     readonly id: SkillRouteId;
     readonly intent: string;
@@ -11,7 +11,6 @@ export interface SkillRoute {
     readonly exitCondition: string;
 }
 export declare const SKILL_ROUTES: readonly SkillRoute[];
-/** Complete lookup catalog. Routes above, not this inventory, own discovery. */
-export declare const REFERENCE_INDEX_LINES: readonly string[];
 export declare function skillRouterBody(_target: AgentTarget): string;
+export {};
 //# sourceMappingURL=skill-router.d.ts.map

package/node_modules/@noodle-borg/agent-kit/dist/skill-router.js

@@ -86,7 +86,7 @@ export const SKILL_ROUTES = [
     },
 ];
 /** Complete lookup catalog. Routes above, not this inventory, own discovery. */
-export const REFERENCE_INDEX_LINES = [
+const REFERENCE_INDEX_LINES = [
     '- `references/agent-contract.md` — the `--json` envelope, exit codes, and the three output modes.',
     '- `references/product-agent-guides.md` — decide, interview, propose, prove, preview, and explicitly install one host-neutral product guide.',
     '- `references/sdk-surface.md` — what to import from `@noodleseed/one` and which builder to use.',

package/node_modules/@noodle-borg/agent-kit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodle-borg/agent-kit",
-  "version": "0.91.0",
+  "version": "0.93.0",
   "license": "Apache-2.0",
   "type": "module",
   "engines": {

package/node_modules/@noodle-borg/agent-packaging/dist/host-package-assets.js

@@ -163,7 +163,7 @@ export function resolveHostPackageAssets(distribution, inputs, target) {
         issues,
     };
 }
-export function normalizeHostAssetPath(value) {
+function normalizeHostAssetPath(value) {
     const normalized = value.replace(/\\/g, '/').replace(/^\.\/+/, '');
     return safeRelativePath(normalized) ? normalized : undefined;
 }

package/node_modules/@noodle-borg/assistant-gateway/dist/assistant-configuration.js

@@ -41,7 +41,8 @@ export function assistantBrowserConfiguration(server, boundSurface) {
 function surfaceOfMode(assistant, mode) {
     if (mode === undefined || !Array.isArray(assistant?.surfaces))
         return undefined;
-    return assistant.surfaces.find((surface) => surface.mode === mode);
+    // A `mixed` surface mints `public` sessions (ADR 0220): it is the public binding's surface.
+    return assistant.surfaces.find((surface) => surface.mode === mode || (mode === 'public' && surface.mode === 'mixed'));
 }
 /** Resolve environment operator state above the immutable deployment projection. */
 export async function effectiveAssistantBrowserConfiguration(server, tenant, store, boundSurface) {

package/node_modules/@noodle-borg/assistant-gateway/package.json

@@ -42,7 +42,7 @@
     "@noodle-borg/module-audit": "0.0.0",
     "@noodle-borg/protocol": "0.0.0",
     "@noodle-borg/runtime": "0.0.0",
-    "@noodleseed/assistant": "1.31.0",
+    "@noodleseed/assistant": "1.33.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/node_modules/@noodle-borg/authoring/dist/assistant.d.ts

@@ -134,7 +134,7 @@ export type AssistantModel = OpenAICompatibleModel | NoodleManagedModel;
  * `${user.claims.<key>}` in tool fulfilment; `exposeToModel: true` additionally places the value
  * in the assistant's identity system line so the model can use it directly.
  */
-export interface SessionClaimDeclaration {
+interface SessionClaimDeclaration {
     readonly exposeToModel?: boolean;
 }
 /**
@@ -275,4 +275,5 @@ export declare function openAICompatible(input: OpenAICompatibleModelInput): Ope
 /** Use Noodle Seed Cloud's operator-selected model. Provider details never enter authored source. */
 export declare function noodleManaged(): NoodleManagedModel;
 export declare function embeddedAssistant(input: EmbeddedAssistantOptions): EmbeddedAssistantConfig;
+export {};
 //# sourceMappingURL=assistant.d.ts.map

package/node_modules/@noodle-borg/authoring/dist/connections.d.ts

@@ -15,8 +15,6 @@ export type { ConnectionBinding, ConnectionRef, ConnectionSource, GoogleWorkload
 type ManifestV2ConnectorBinding = NonNullable<NonNullable<Extract<Manifest, {
     manifestVersion: '2';
 }>['connectors']>[string]['binding']>;
-/** Internal manifest projection: clone readonly author inputs to the mutable generated schema shape. */
-export declare function toManifestConnectionBinding(binding: ConnectionBinding): ManifestV2ConnectorBinding;
 export declare function toManifestConnectorRef(connector: ConnectorRef): {
     readonly id: string;
     readonly version: string;

package/node_modules/@noodle-borg/authoring/dist/connections.js

@@ -25,7 +25,7 @@ export function bind(connector, options) {
     };
 }
 /** Internal manifest projection: clone readonly author inputs to the mutable generated schema shape. */
-export function toManifestConnectionBinding(binding) {
+function toManifestConnectionBinding(binding) {
     const source = binding.connection.source;
     return {
         profile: binding.profile,

package/node_modules/@noodle-borg/authoring/dist/load-authored.js

@@ -33,9 +33,9 @@ export function prepareAuthoringRuntimeDir(dir, options) {
             './react': './react.mjs',
         },
     }));
-    writeFileSync(join(self, 'index.mjs'), "export { annotations, asset, authenticatedWebsite, bind, clientCredentials, connector, connection, customerAuth, customerEndpoint, embeddedAssistant, externalExchange, file, gmailConnector, googleWorkloadIdentity, handoffSession, knowledge, managedSecret, noodleManaged, openAICompatible, prompt, publicWebsite, resource, secret, server, site, tool, variable, when, z } from '@noodle-borg/authoring';\n");
+    writeFileSync(join(self, 'index.mjs'), "export { algolia, annotations, asset, authenticatedWebsite, bind, clientCredentials, connector, connection, customerAuth, customerEndpoint, embeddedAssistant, externalExchange, file, firecrawl, gmailConnector, googleWorkloadIdentity, handoffSession, knowledge, managedSecret, meilisearch, noodleManaged, openAICompatible, prompt, publicWebsite, resource, secret, server, site, tavily, tool, variable, when, z } from '@noodle-borg/authoring';\n");
     writeFileSync(join(self, 'platform.mjs'), "export { noodlePlatform, noodlePlatformCatalog } from '@noodle-borg/authoring';\n");
-    writeFileSync(join(self, 'react.mjs'), "export { generateHelpers } from '@noodle-borg/authoring/react';\n");
+    writeFileSync(join(self, 'react.mjs'), "export * from '@noodle-borg/authoring/react';\n");
 }
 function pathExists(path) {
     try {

package/node_modules/@noodle-borg/authoring/dist/react/bridge.d.ts

@@ -44,12 +44,12 @@ export type ModelContextUpdate = {
     }[];
     readonly structuredContent?: Readonly<Record<string, unknown>>;
 };
-export type RuntimeBrandAsset = {
+type RuntimeBrandAsset = {
     readonly uri: string;
     readonly darkUri?: string;
     readonly alt: string;
 };
-export type RuntimeBrandTheme = {
+type RuntimeBrandTheme = {
     readonly surface?: string;
     readonly surfaceRaised?: string;
     readonly surfaceMuted?: string;
@@ -108,4 +108,5 @@ export declare function globalViewState(): Record<string, unknown>;
 export declare function setGlobalViewState(value: Record<string, unknown>): void;
 export declare function globalLayout(): LayoutState;
 export declare function globalBranding(): RuntimeBranding;
+export {};
 //# sourceMappingURL=bridge.d.ts.map

package/node_modules/@noodle-borg/authoring/dist/react/form-components.d.ts

@@ -58,8 +58,6 @@ export type RadioGroupProps = Omit<HTMLAttributes<HTMLDivElement>, 'defaultValue
     readonly options: readonly RadioOption[];
     readonly value?: string;
     readonly defaultValue?: string;
-    /** @deprecated Use `onValueChange`; retained for source compatibility. */
-    readonly onChange?: (value: string) => void;
     readonly onValueChange?: (value: string) => void;
     /** Shared radio `name`; defaults to a stable generated id. */
     readonly name?: string;
@@ -71,8 +69,6 @@ export declare const RadioGroup: import("react").ForwardRefExoticComponent<Omit<
     readonly options: readonly RadioOption[];
     readonly value?: string;
     readonly defaultValue?: string;
-    /** @deprecated Use `onValueChange`; retained for source compatibility. */
-    readonly onChange?: (value: string) => void;
     readonly onValueChange?: (value: string) => void;
     /** Shared radio `name`; defaults to a stable generated id. */
     readonly name?: string;
@@ -101,8 +97,6 @@ export type SegmentedControlProps = Omit<HTMLAttributes<HTMLDivElement>, 'defaul
     readonly options: readonly SegmentedOption[];
     readonly value?: string;
     readonly defaultValue?: string;
-    /** @deprecated Use `onValueChange`; retained for source compatibility. */
-    readonly onChange?: (value: string) => void;
     readonly onValueChange?: (value: string) => void;
     readonly name?: string;
     readonly disabled?: boolean;
@@ -113,8 +107,6 @@ export declare const SegmentedControl: import("react").ForwardRefExoticComponent
     readonly options: readonly SegmentedOption[];
     readonly value?: string;
     readonly defaultValue?: string;
-    /** @deprecated Use `onValueChange`; retained for source compatibility. */
-    readonly onChange?: (value: string) => void;
     readonly onValueChange?: (value: string) => void;
     readonly name?: string;
     readonly disabled?: boolean;

package/node_modules/@noodle-borg/authoring/dist/react/form-components.js

@@ -152,7 +152,7 @@ export const Checkbox = forwardRef(function Checkbox({ label, className, onChang
         ? box
         : createElement('label', { className: 'nsr-check' }, box, createElement('span', null, label));
 });
-export const RadioGroup = forwardRef(function RadioGroup({ options, value, defaultValue, onChange, onValueChange, name, direction = 'column', disabled, required, className, ...props }, ref) {
+export const RadioGroup = forwardRef(function RadioGroup({ options, value, defaultValue, onValueChange, name, direction = 'column', disabled, required, className, ...props }, ref) {
     const fallbackName = useId();
     const groupName = name ?? fallbackName;
     const field = useFieldControlProps({ ...props, required }, 'group');
@@ -174,7 +174,6 @@ export const RadioGroup = forwardRef(function RadioGroup({ options, value, defau
         required: field.required,
         disabled: disabled || option.disabled,
         onChange: () => {
-            onChange?.(option.value);
             onValueChange?.(option.value);
         },
     }), createElement('span', null, option.label))));
@@ -208,7 +207,7 @@ export const Slider = forwardRef(function Slider({ className, ...props }, ref) {
     });
 });
 /** Single-select value picker implemented with native radios for keyboard and form behavior. */
-export const SegmentedControl = forwardRef(function SegmentedControl({ options, value, defaultValue, onChange, onValueChange, name, disabled, required, className, ...props }, ref) {
+export const SegmentedControl = forwardRef(function SegmentedControl({ options, value, defaultValue, onValueChange, name, disabled, required, className, ...props }, ref) {
     const fallbackName = useId();
     const groupName = name ?? fallbackName;
     const field = useFieldControlProps({ ...props, required }, 'group');
@@ -234,7 +233,6 @@ export const SegmentedControl = forwardRef(function SegmentedControl({ options,
         required: field.required,
         disabled: disabled || option.disabled,
         onChange: () => {
-            onChange?.(option.value);
             onValueChange?.(option.value);
         },
     }), createElement('span', { className: 'nsr-segmented-label' }, option.label))));

package/node_modules/@noodle-borg/authoring/dist/react/hooks.d.ts

@@ -1,7 +1,7 @@
 import { type AppFlow, type AppFlowConfig } from './app-flow.js';
 import { type DisplayMode, type LayoutState, type ModelContextUpdate, type NoodleReactBridge, type RuntimeBranding, type ToolResult } from './bridge.js';
 import { type HandoffController } from './handoff.js';
-import { createViewStore, type StoreHookResult } from './store.js';
+import { createViewStore } from './store.js';
 export type ToolStatus = 'idle' | 'pending' | 'success' | 'error';
 export type CallToolState = {
     readonly status: ToolStatus;
@@ -54,5 +54,5 @@ export declare function useSendFollowUpMessage(): (message: {
 export declare function useUpdateModelContext(): (update: ModelContextUpdate) => Promise<void>;
 /** Publish a portable, structured widget lifecycle summary through the standard model-context path. */
 export declare function useWidgetLifecycle(widgetName: string): (lifecycle: 'mounted' | 'submitted' | 'cancelled' | 'dismissed', summary?: Readonly<Record<string, unknown>>) => Promise<void>;
-export type { DisplayMode, LayoutState, ModelContextUpdate, NoodleReactBridge, RuntimeBranding, StoreHookResult, ToolResult, };
+export type { DisplayMode, LayoutState, ModelContextUpdate, NoodleReactBridge, RuntimeBranding, ToolResult, };
 //# sourceMappingURL=hooks.d.ts.map

package/node_modules/@noodle-borg/cli-catalog/dist/catalog-data-account.js

@@ -26,6 +26,11 @@ const JSON_FLAG = {
     type: 'boolean',
     summary: 'Emit JSON output.',
 };
+const REQUIRED_STRING_FLAG = {
+    ...OPTIONAL_FLAG,
+    type: 'string',
+    required: true,
+};
 const CAPABILITY_NAMES = [
     'identity',
     'access',
@@ -190,6 +195,97 @@ export const CATALOG_ACCOUNT = [
                 ],
                 jsonOutput: { mode: 'single' },
             },
+            {
+                name: 'app-purge',
+                summary: 'Reconcile historical app anchors after an already-recorded retention purge.',
+                arguments: [],
+                flags: [],
+                subcommands: [
+                    {
+                        name: 'preview',
+                        summary: 'Write a bounded exact-set reconciliation preview artifact.',
+                        arguments: [],
+                        flags: [
+                            {
+                                ...REQUIRED_STRING_FLAG,
+                                name: 'output',
+                                value: '<absolute-path>',
+                                summary: 'New absolute path for the exclusive 0600 preview artifact.',
+                                sensitive: false,
+                            },
+                            SERVICE,
+                            AUTH_TOKEN,
+                            JSON_FLAG,
+                        ],
+                        jsonOutput: { mode: 'single' },
+                    },
+                    {
+                        name: 'apply',
+                        summary: 'Apply one approved exact preview with recovery and approval evidence.',
+                        arguments: [],
+                        flags: [
+                            {
+                                ...REQUIRED_STRING_FLAG,
+                                name: 'approved-preview',
+                                value: '<absolute-path>',
+                                summary: 'Absolute path to the approved exact 0600 preview artifact.',
+                                sensitive: true,
+                            },
+                            {
+                                ...REQUIRED_STRING_FLAG,
+                                name: 'release-sha',
+                                value: '<sha>',
+                                summary: 'Exact deployed System Release SHA.',
+                                sensitive: false,
+                                constraints: { minLength: 40, maxLength: 40 },
+                            },
+                            {
+                                ...REQUIRED_STRING_FLAG,
+                                name: 'approval-reference',
+                                value: '<reference>',
+                                summary: 'Restricted founder or product-owner approval reference.',
+                                sensitive: true,
+                                constraints: { minLength: 1, maxLength: 256 },
+                            },
+                            {
+                                ...REQUIRED_STRING_FLAG,
+                                name: 'recovery-checkpoint',
+                                value: '<reference>',
+                                summary: 'Verified backup or point-in-time recovery checkpoint reference.',
+                                sensitive: true,
+                                constraints: { minLength: 1, maxLength: 256 },
+                            },
+                            {
+                                ...REQUIRED_STRING_FLAG,
+                                name: 'reason',
+                                value: '<reason>',
+                                summary: 'Bounded reconciliation reason.',
+                                sensitive: true,
+                                constraints: { minLength: 1, maxLength: 500 },
+                            },
+                            {
+                                ...REQUIRED_STRING_FLAG,
+                                name: 'idempotency-key',
+                                value: '<key>',
+                                summary: 'Private key for exact replay.',
+                                sensitive: true,
+                                constraints: { minLength: 8, maxLength: 256 },
+                            },
+                            {
+                                ...OPTIONAL_FLAG,
+                                name: 'yes',
+                                type: 'boolean',
+                                summary: 'Confirm the approved destructive operation.',
+                                required: true,
+                            },
+                            SERVICE,
+                            AUTH_TOKEN,
+                            JSON_FLAG,
+                        ],
+                        jsonOutput: { mode: 'single' },
+                    },
+                ],
+            },
         ],
     },
     {

package/node_modules/@noodle-borg/cli-catalog/dist/catalog-data-billing.js

@@ -62,6 +62,75 @@ const IDEMPOTENCY_FLAG = flag({
     required: true,
     sensitive: true,
 });
+const TRANSFER_ACCOUNT_FLAG = flag({
+    ...FLAG_FIELDS,
+    name: 'account',
+    type: 'string',
+    value: '<destination-id>',
+    summary: 'Destination billing account identifier.',
+    required: true,
+});
+const TRANSFER_ORG_FLAG = flag({
+    ...FLAG_FIELDS,
+    name: 'org',
+    type: 'string',
+    value: '<org>',
+    summary: 'Organization slug to transfer.',
+    required: true,
+});
+const TRANSFER_QUERY_FLAG = flag({
+    ...FLAG_FIELDS,
+    name: 'query',
+    type: 'string',
+    value: '<text>',
+    summary: 'Filter owned organizations by name or slug.',
+    constraints: { minLength: 1, maxLength: 100 },
+});
+const TRANSFER_CURSOR_FLAG = flag({
+    ...FLAG_FIELDS,
+    name: 'cursor',
+    type: 'string',
+    value: '<cursor>',
+    summary: 'Opaque continuation cursor.',
+    constraints: { maxLength: 512 },
+});
+const TRANSFER_LIMIT_FLAG = flag({
+    ...FLAG_FIELDS,
+    name: 'limit',
+    type: 'integer',
+    value: '<n>',
+    summary: 'Maximum organization candidates returned.',
+    constraints: { default: 50, minimum: 1, maximum: 100 },
+});
+const TRANSFER_OUT_FLAG = flag({
+    ...FLAG_FIELDS,
+    name: 'out',
+    type: 'string',
+    value: '<reviewed-preview.json>',
+    summary: 'New private path for the reviewed preview artifact.',
+    required: true,
+    sensitive: true,
+});
+const TRANSFER_PREVIEW_FILE_FLAG = flag({
+    ...FLAG_FIELDS,
+    name: 'preview-file',
+    type: 'string',
+    value: '<reviewed-preview.json>',
+    summary: 'Private reviewed billing transfer preview artifact.',
+    required: true,
+    sensitive: true,
+});
+const TRANSFER_IDEMPOTENCY_FLAG = flag({
+    ...IDEMPOTENCY_FLAG,
+    constraints: { minLength: 8, maxLength: 256 },
+});
+const TRANSFER_YES_FLAG = flag({ ...YES_FLAG, required: true });
+const TRANSFER_ADMIN_REASON_FLAG = flag({
+    ...REASON_FLAG,
+    summary: 'Restricted administrative reason recorded with the transfer.',
+    sensitive: true,
+    constraints: { minLength: 1, maxLength: 256 },
+});
 function leaf(name, summary, options) {
     return subcommand({
         ...SUBCOMMAND_FIELDS,
@@ -281,6 +350,50 @@ const MIGRATION = branch('migration', 'Run the super-admin-only legacy shadow-mi
         ],
     }),
 ]);
+const CUSTOMER_TRANSFER = branch('transfer', 'Move an owned organization to an eligible billing account.', [
+    leaf('candidates', 'List owned organizations with billing transfer status and eligibility.', {
+        ...LEAF_FIELDS,
+        flags: [
+            TRANSFER_ACCOUNT_FLAG,
+            TRANSFER_QUERY_FLAG,
+            TRANSFER_CURSOR_FLAG,
+            TRANSFER_LIMIT_FLAG,
+        ],
+    }),
+    leaf('preview', 'Preview an exact customer billing transfer without changing state.', {
+        arguments: [
+            argument({
+                ...ARGUMENT_FIELDS,
+                name: 'org-slug',
+                type: 'string',
+                summary: 'Owned organization slug to transfer.',
+                required: true,
+            }),
+        ],
+        flags: [TRANSFER_ACCOUNT_FLAG, TRANSFER_OUT_FLAG],
+    }),
+    leaf('apply', 'Apply an exact reviewed customer billing transfer.', {
+        ...LEAF_FIELDS,
+        flags: [TRANSFER_PREVIEW_FILE_FLAG, TRANSFER_IDEMPOTENCY_FLAG, TRANSFER_YES_FLAG],
+    }),
+]);
+const ADMINISTRATION = branch('administration', 'Perform restricted super-admin billing operations on behalf of users.', [
+    branch('transfer', 'Move organization billing with explicit super-admin authority.', [
+        leaf('preview', 'Preview an exact administrative billing transfer.', {
+            ...LEAF_FIELDS,
+            flags: [
+                TRANSFER_ORG_FLAG,
+                TRANSFER_ACCOUNT_FLAG,
+                TRANSFER_ADMIN_REASON_FLAG,
+                TRANSFER_OUT_FLAG,
+            ],
+        }),
+        leaf('apply', 'Apply an exact reviewed administrative billing transfer.', {
+            ...LEAF_FIELDS,
+            flags: [TRANSFER_PREVIEW_FILE_FLAG, TRANSFER_IDEMPOTENCY_FLAG, TRANSFER_YES_FLAG],
+        }),
+    ]),
+]);
 export const BILLING_COMMAND = {
     name: 'billing',
     section: 'operate',
@@ -289,7 +402,7 @@ export const BILLING_COMMAND = {
     arguments: [],
     subcommands: [
         ACCOUNTS,
-        branch('org', 'Inspect an organization’s effective billing entitlements.', [
+        branch('org', 'Inspect or transfer an organization’s effective billing.', [
             leaf('inspect', 'Inspect effective billing entitlements for one organization.', {
                 ...LEAF_FIELDS,
                 arguments: [
@@ -302,7 +415,9 @@ export const BILLING_COMMAND = {
                     }),
                 ],
             }),
+            CUSTOMER_TRANSFER,
         ]),
+        ADMINISTRATION,
         ENFORCEMENT,
         METERING,
         MIGRATION,

package/node_modules/@noodle-borg/compiler/dist/artifact/types.d.ts

@@ -74,8 +74,8 @@ export interface WidgetUiMeta {
      */
     readonly visibility?: readonly ('model' | 'app')[];
 }
-export type WidgetPermissionGrant = Readonly<Record<string, never>>;
-export interface WidgetPermissions {
+type WidgetPermissionGrant = Readonly<Record<string, never>>;
+interface WidgetPermissions {
     readonly camera?: WidgetPermissionGrant;
     readonly microphone?: WidgetPermissionGrant;
     readonly geolocation?: WidgetPermissionGrant;
@@ -165,14 +165,14 @@ export interface ArtifactServerContext {
         readonly fulfilment: ArtifactFulfilment;
     };
 }
-export interface ArtifactOidcAuth {
+interface ArtifactOidcAuth {
     readonly kind?: 'oidc' | undefined;
     readonly issuer: string;
     readonly audience: string;
     readonly claims?: ArtifactAuthClaimMap | undefined;
     readonly routing?: ArtifactCustomerAuthRouting | undefined;
 }
-export interface ArtifactFederatedOidcAuth {
+interface ArtifactFederatedOidcAuth {
     readonly kind: 'federatedOidc';
     readonly issuers: readonly {
         readonly issuer: string;
@@ -186,7 +186,7 @@ export interface ArtifactCustomerAuthRouting {
         readonly claim: string;
     }>>;
 }
-export interface ArtifactBridgeAuth {
+interface ArtifactBridgeAuth {
     readonly kind: 'bridge';
     readonly provider: string;
     readonly verifyUrl?: string | undefined;
@@ -204,8 +204,8 @@ export interface ArtifactBridgeAuth {
     readonly authMethod?: 'client_secret_basic' | 'client_secret_post' | undefined;
     readonly user?: ArtifactAuthClaimMap | undefined;
 }
-export type ArtifactAuth = ArtifactOidcAuth | ArtifactFederatedOidcAuth | ArtifactBridgeAuth;
-export interface ArtifactAuthClaimMap {
+type ArtifactAuth = ArtifactOidcAuth | ArtifactFederatedOidcAuth | ArtifactBridgeAuth;
+interface ArtifactAuthClaimMap {
     readonly id?: string | undefined;
     readonly email?: string | undefined;
     readonly name?: string | undefined;
@@ -285,7 +285,7 @@ export interface ArtifactServer {
     };
     readonly state?: ArtifactState;
 }
-export interface ArtifactBrandTheme {
+interface ArtifactBrandTheme {
     readonly surface?: string | undefined;
     readonly surfaceRaised?: string | undefined;
     readonly surfaceMuted?: string | undefined;
@@ -302,19 +302,19 @@ export interface ArtifactBrandTheme {
     readonly danger?: string | undefined;
     readonly code?: string | undefined;
 }
-export interface ArtifactSource {
+interface ArtifactSource {
     readonly manifestName: string;
     /** Application version retained for artifact compatibility. */
     readonly manifestVersion: string;
     /** Core manifest language version that produced this internal artifact. */
     readonly coreVersion?: '1' | '2';
 }
-export interface ArtifactCapabilities {
+interface ArtifactCapabilities {
     readonly tools: readonly string[];
     readonly resources?: readonly string[];
     readonly prompts?: readonly string[];
 }
-export interface ArtifactRequirements {
+interface ArtifactRequirements {
     readonly capabilities?: readonly CapabilityRequirementName[];
 }
 export type ArtifactConnectionSource = {

package/node_modules/@noodle-borg/compiler/dist/compile.d.ts

@@ -1,7 +1,6 @@
 import { type HostedAssetOptions, type LocalAssetOptions } from './assets.js';
 import type { ConnectorCatalog } from './catalog/types.js';
 import type { CompileError, CompileResult } from './errors.js';
-export type { StructuralTool } from './artifact/catalog-emission.js';
 export interface CompileOptions {
     /**
      * Connector catalog used to resolve operation references. When supplied, the compiler resolves

package/node_modules/@noodle-borg/compiler/dist/fulfilment-structural.d.ts

@@ -14,7 +14,7 @@ export interface StructOp {
  * A structurally-validated flow step with parsed expressions; connector refs resolve later. The Core v1
  * verb set is `operation` + `map` + portable `elicit`; `compute` remains reserved (ADR 0150).
  */
-export type StructStep = {
+type StructStep = {
     readonly id: string;
     readonly kind: 'operation';
     readonly cond?: CondNode;