@noodleseed/one 0.152.0 → 0.154.0

package/node_modules/@noodle-borg/compiler/dist/manifest/expression.d.ts

@@ -20,12 +20,12 @@ import type { CompileError } from '../errors.js';
  * Roots an expression may read. Manifest expressions use `input`/`steps`; other contexts (e.g. connector
  * request/response mapping) pass their own allowed-roots set to {@link parseValue}/{@link parseCondition}.
  */
-export type ExprRoot = string;
-export interface PathSegmentProp {
+type ExprRoot = string;
+interface PathSegmentProp {
     readonly kind: 'prop';
     readonly name: string;
 }
-export interface PathSegmentIndex {
+interface PathSegmentIndex {
     readonly kind: 'index';
     readonly value: number;
 }
@@ -37,17 +37,17 @@ export interface PathNode {
     readonly segments: readonly PathSegment[];
 }
 /** A literal value (boolean/number/string/null), type-preserving at runtime. */
-export interface LiteralNode {
+interface LiteralNode {
     readonly kind: 'literal';
     readonly value: string | number | boolean | null;
 }
-export type TemplatePartText = {
+type TemplatePartText = {
     readonly kind: 'text';
     readonly value: string;
 };
-export type TemplatePart = TemplatePartText | PathNode | LiteralNode;
+type TemplatePart = TemplatePartText | PathNode | LiteralNode;
 /** String interpolation; always produces a string at runtime (docs/SPEC.md "Evaluation Rules"). */
-export interface TemplateNode {
+interface TemplateNode {
     readonly kind: 'template';
     readonly parts: readonly TemplatePart[];
 }
@@ -76,8 +76,8 @@ export interface CoalesceNode {
     readonly right: ExprNode;
 }
 declare const FUNCTION_NAMES: readonly ["coalesce", "equals", "lower", "upper", "formatCurrency", "formatNumber", "formatDateTime", "formatRelativeTime", "formatUnit", "formatPlural", "urlEncode"];
-export type FunctionName = (typeof FUNCTION_NAMES)[number];
-export interface FunctionNode {
+type FunctionName = (typeof FUNCTION_NAMES)[number];
+interface FunctionNode {
     readonly kind: 'function';
     readonly name: FunctionName;
     readonly args: readonly ExprNode[];
@@ -85,26 +85,26 @@ export interface FunctionNode {
 /** A value-position expression node (the result of {@link parseValue}). */
 export type ExprNode = PathNode | LiteralNode | TemplateNode | ArrayNode | ObjectNode | CoalesceNode | FunctionNode;
 /** Operand of an equality comparison: a path or a literal. */
-export type Comparable = PathNode | LiteralNode;
-export interface CompareNode {
+type Comparable = PathNode | LiteralNode;
+interface CompareNode {
     readonly kind: 'cond';
     readonly op: 'eq' | 'neq';
     readonly left: Comparable;
     readonly right: Comparable;
 }
-export interface LogicalNode {
+interface LogicalNode {
     readonly kind: 'cond';
     readonly op: 'and' | 'or';
     readonly left: CondNode;
     readonly right: CondNode;
 }
-export interface NotNode {
+interface NotNode {
     readonly kind: 'cond';
     readonly op: 'not';
     readonly operand: CondNode;
 }
 /** Truthiness of a path used as a bare `if` condition (e.g. `${input.is_active}`). */
-export interface TruthyNode {
+interface TruthyNode {
     readonly kind: 'truthy';
     readonly operand: PathNode;
 }

package/node_modules/@noodle-borg/compiler/dist/manifest/naming.d.ts

@@ -3,8 +3,6 @@
  * lowercase letters, numbers, and underscores (docs/SPEC.md "Naming Rules").
  */
 export declare const NAME_PATTERN: RegExp;
-/** Connector operation reference: `<connector>.<operation>`, each segment a valid name. */
-export declare const OPERATION_REF_PATTERN: RegExp;
 export declare function isValidName(name: string): boolean;
 /** Split `<connector>.<operation>` into parts, or return null if it is not well-formed. */
 export declare function parseOperationRef(ref: string): {

package/node_modules/@noodle-borg/compiler/dist/manifest/naming.js

@@ -4,7 +4,7 @@
  */
 export const NAME_PATTERN = /^[a-z0-9_]+$/;
 /** Connector operation reference: `<connector>.<operation>`, each segment a valid name. */
-export const OPERATION_REF_PATTERN = /^[a-z0-9_]+\.[a-z0-9_]+$/;
+const OPERATION_REF_PATTERN = /^[a-z0-9_]+\.[a-z0-9_]+$/;
 export function isValidName(name) {
     return NAME_PATTERN.test(name);
 }

package/node_modules/@noodle-borg/compiler/dist/manifest/website-projection.d.ts

@@ -17,7 +17,7 @@ import type { CompileError } from '../errors.js';
  * re-derived per call, because a new `ArtifactTool` field would be a Core surface change under ADR 0150.
  * ADR 0055's third class — a declared anonymous fallback — stays reserved, not produced.
  */
-export interface AssistantSurfaceInput {
+interface AssistantSurfaceInput {
     readonly mode: 'authenticated' | 'public' | 'mixed';
     readonly capabilities?: readonly {
         readonly kind: string;
@@ -39,4 +39,5 @@ export interface WebsiteProjectionSurfaces {
 /** A tool touches identity when it reads `${user}` or requires verified claims (ADR 0185). */
 export declare function anonymousBehavior(tool: ArtifactTool): 'public-safe' | 'requires-identity';
 export declare function validateWebsiteProjection(assistant: AssistantProjectionInput | undefined, surfaces: WebsiteProjectionSurfaces): readonly CompileError[];
+export {};
 //# sourceMappingURL=website-projection.d.ts.map

package/node_modules/@noodle-borg/compiler/package.json

@@ -28,8 +28,6 @@
     "@noodle-borg/uri-template": "0.0.0",
     "@noodle-borg/knowledge": "0.0.0",
     "@noodle-borg/capabilities": "0.0.0",
-    "react": "^19.2.7",
-    "react-dom": "^19.2.7",
     "tailwindcss": "^4.3.1",
     "tldts": "^7.4.9",
     "yaml": "^2.9.0",
@@ -37,7 +35,6 @@
   },
   "devDependencies": {
     "@types/node": "^24.13.1",
-    "@types/react": "^19.2.17",
-    "@types/react-dom": "^19.2.3"
+    "ajv": "^8.20.0"
   }
 }

package/node_modules/@noodle-borg/connector-defs/dist/credential-profiles.js

@@ -1,5 +1,5 @@
 /** Project catalog operation credential metadata without adding it to compatibility signatures. */
-export function operationCredentials(def) {
+function operationCredentials(def) {
     const requirements = {};
     for (const [name, operation] of Object.entries(def.operations)) {
         const credentials = operation.credentials;

package/node_modules/@noodle-borg/connector-defs/dist/schema.d.ts

@@ -5,11 +5,6 @@ declare const credentialProfileSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     kind: z.ZodLiteral<"apiKey">;
     header: z.ZodString;
 }, z.core.$strict>], "kind">;
-declare const operationCredentialsSchema: z.ZodObject<{
-    profiles: z.ZodArray<z.ZodString>;
-    scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    audience: z.ZodOptional<z.ZodString>;
-}, z.core.$strict>;
 /**
  * A declarative downstream auth scheme: the scheme plus the *name* of the secret the broker should mint.
  * Branches are `.strict()`, so an inline `value`/`token` key fails to parse — secrets can only be
@@ -1739,6 +1734,5 @@ export type ComputeOperationDef = z.infer<typeof computeOperationSchema>;
 export type McpOperationDef = z.infer<typeof mcpOperationSchema>;
 export type HttpAuthDef = z.infer<typeof httpAuthSchema>;
 export type CredentialProfileDef = z.infer<typeof credentialProfileSchema>;
-export type OperationCredentialsDef = z.infer<typeof operationCredentialsSchema>;
 export {};
 //# sourceMappingURL=schema.d.ts.map

package/node_modules/@noodle-borg/connector-http/dist/http-connector.d.ts

@@ -16,8 +16,7 @@ export type HttpAuthScheme = {
 } | {
     readonly kind: 'cookie';
 };
-export type { HttpRetryCategory, HttpRetryPolicy } from './http-response.js';
-export interface HttpOperationResilience {
+interface HttpOperationResilience {
     readonly timeoutMs?: number;
     readonly retry?: HttpRetryPolicy;
 }
@@ -148,4 +147,5 @@ export declare class HttpConnector implements Connector {
     signature(operation: string): OperationSignature | undefined;
     invoke(call: ConnectorCall): Promise<unknown>;
 }
+export {};
 //# sourceMappingURL=http-connector.d.ts.map

package/node_modules/@noodle-borg/connector-http/dist/http-response.d.ts

@@ -1,5 +1,5 @@
 import { type DnsLookup } from './ssrf.js';
-export type HttpRetryCategory = 'timeout' | 'network_error' | 'rate_limited' | 'upstream_5xx';
+type HttpRetryCategory = 'timeout' | 'network_error' | 'rate_limited' | 'upstream_5xx';
 export interface HttpRetryPolicy {
     readonly maxAttempts?: number;
     readonly baseDelayMs?: number;
@@ -24,4 +24,5 @@ export interface ResponseFetchOptions {
     readonly lookup?: DnsLookup;
 }
 export declare function fetchResponseWithResilience(url: URL, op: ResponseOperation, init: RequestInit, options: ResponseFetchOptions): Promise<unknown>;
+export {};
 //# sourceMappingURL=http-response.d.ts.map

package/node_modules/@noodle-borg/connector-http/dist/mcp/config.js

@@ -1,7 +1,7 @@
 import { ConnectorInvocationError } from '@noodle-borg/runtime';
 const VARIABLE = /^\$\{env\.([A-Za-z0-9_]+)\}$/;
 const MAX_RESPONSE_BYTES = 6 * 1024 * 1024;
-export const DEFAULT_RESPONSE_BYTES = 1 << 20;
+const DEFAULT_RESPONSE_BYTES = 1 << 20;
 export function isVariable(value) {
     return VARIABLE.test(value);
 }

package/node_modules/@noodle-borg/control-plane/dist/app-purge-reconciliation-port.d.ts

@@ -0,0 +1,25 @@
+import type { AppPurgeReconciliationApplyRequestV1, AppPurgeReconciliationApplyResponseV1, AppPurgeReconciliationErrorCodeV1, AppPurgeReconciliationPreviewArtifactV1 } from '@noodle-borg/wire-contracts';
+export interface AppPurgeReconciliationActor {
+    readonly subject: string;
+    readonly email?: string;
+}
+export interface AppPurgeReconciliationOperator {
+    preview(input: {
+        readonly releaseSha: string;
+        readonly limit: number;
+        readonly now: Date;
+    }): Promise<AppPurgeReconciliationPreviewArtifactV1>;
+    apply(input: {
+        readonly request: AppPurgeReconciliationApplyRequestV1;
+        readonly actor: AppPurgeReconciliationActor;
+        readonly currentReleaseSha: string;
+        readonly now: Date;
+    }): Promise<AppPurgeReconciliationApplyResponseV1>;
+}
+export type AppPurgeReconciliationConflictCode = Exclude<AppPurgeReconciliationErrorCodeV1, 'app_purge_reconciliation_unavailable'>;
+/** A checked operator conflict; query and transaction failures intentionally remain ordinary errors. */
+export declare class AppPurgeReconciliationError extends Error {
+    readonly code: AppPurgeReconciliationConflictCode;
+    constructor(code: AppPurgeReconciliationConflictCode, message: string);
+}
+//# sourceMappingURL=app-purge-reconciliation-port.d.ts.map

package/node_modules/@noodle-borg/control-plane/dist/app-purge-reconciliation-port.js

@@ -0,0 +1,10 @@
+/** A checked operator conflict; query and transaction failures intentionally remain ordinary errors. */
+export class AppPurgeReconciliationError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'AppPurgeReconciliationError';
+        this.code = code;
+    }
+}
+//# sourceMappingURL=app-purge-reconciliation-port.js.map

package/node_modules/@noodle-borg/control-plane/dist/deploy-auth.d.ts

@@ -1,6 +1,5 @@
 import type { IncomingMessage } from 'node:http';
 import type { ControlPlaneIdentity } from './contracts.js';
-export type { ControlPlaneIdentity } from './contracts.js';
 export type ControlPlaneAuthResult = {
     readonly ok: true;
     readonly identity?: ControlPlaneIdentity;

package/node_modules/@noodle-borg/control-plane/dist/portable.d.ts

@@ -1,3 +1,4 @@
+export { type AppPurgeReconciliationActor, type AppPurgeReconciliationConflictCode, AppPurgeReconciliationError, type AppPurgeReconciliationOperator, } from './app-purge-reconciliation-port.js';
 export type { ActiveMcpSubdomainClaim, ChangeMcpSubdomainInput, ControlPlaneIdentity, CreateOrgWithOwnerInput, McpSubdomainMutationResult, McpSubdomainSetting, OrganizationStore, OrgDomainRecord, OrgInvitationRecord, OrgMemberRecord, OrgOpenAIAppsChallengeRecord, OrgRecord, OrgRole, PersonalWorkspaceProvisionInput, PersonalWorkspaceProvisionResult, SignupAllowlistKind, SignupAllowlistRecord, WelcomeEmailRecord, } from './contracts.js';
 export { allowAllGate, bearerToken, type ControlPlaneAuthResult, type DeployAuthGate, } from './deploy-auth.js';
 export { CompositeControlPlaneGate, type ControlPlaneSignupMode, GoogleControlPlaneGate, type GoogleControlPlaneGateOptions, type GoogleIdTokenVerifier, GoogleWorkloadControlPlaneGate, type GoogleWorkloadControlPlaneGateOptions, NoodleOAuthControlPlaneGate, type NoodleOAuthControlPlaneGateOptions, type SignupAuthorizer, } from './deploy-gates.js';

package/node_modules/@noodle-borg/control-plane/dist/portable.js

@@ -1,3 +1,4 @@
+export { AppPurgeReconciliationError, } from './app-purge-reconciliation-port.js';
 export { allowAllGate, bearerToken, } from './deploy-auth.js';
 export { CompositeControlPlaneGate, GoogleControlPlaneGate, GoogleWorkloadControlPlaneGate, NoodleOAuthControlPlaneGate, } from './deploy-gates.js';
 export { InMemoryControlPlaneStore } from './in-memory-control-plane-store.js';

package/node_modules/@noodle-borg/control-plane/package.json

@@ -26,7 +26,9 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@noodle-borg/module": "0.0.0"
+    "@noodle-borg/module": "0.0.0",
+    "@noodle-borg/module-audit": "0.0.0",
+    "@noodle-borg/wire-contracts": "0.0.0"
   },
   "devDependencies": {
     "@types/node": "^24.13.1",

package/node_modules/@noodle-borg/developer-mcp/dist/widgets/shared.js

@@ -5,7 +5,7 @@ export function WidgetHeader(props) {
 export function Panel(props) {
     return (_jsxs("section", { className: "panel", children: [_jsxs("header", { className: "panel-header", children: [_jsx("h2", { children: props.title }), props.description === undefined ? null : _jsx("p", { children: props.description })] }), props.children] }));
 }
-export function StatusBadge(props) {
+function StatusBadge(props) {
     return (_jsxs("p", { className: "status-badge", role: "status", children: [_jsx("span", { className: "visually-hidden", "data-status-label": "", children: "Status:" }), ' ', _jsx("span", { "data-bind": props.path, children: "Loading" })] }));
 }
 export function BoundValue(props) {

package/node_modules/@noodle-borg/knowledge-operations/dist/crawl-lifecycle.d.ts

@@ -22,7 +22,7 @@ export declare class InMemoryCrawlStateStore implements CrawlStateStore {
     put(tenant: KnowledgeTenantRef, componentName: string, state: SiteCrawlState): Promise<void>;
 }
 /** A provider config reference by name (variable()/secret() doctrine) — never a value. */
-export interface ProviderConfigRef {
+interface ProviderConfigRef {
     readonly kind: 'variable' | 'secret';
     readonly name: string;
 }
@@ -68,4 +68,5 @@ export declare function runDueCrawls(deps: CrawlDeps, servedComponents: () => Pr
 }[]>, at: number): Promise<void>;
 /** Serve the crawled corpus: the bundled index over the site revision, hits remapped to `site`. */
 export declare function searchSiteCorpus(hooks: KnowledgeDeployHooks, tenant: KnowledgeTenantRef, componentName: string, request: SearchRequest): Promise<readonly SearchHit[]>;
+export {};
 //# sourceMappingURL=crawl-lifecycle.d.ts.map

package/node_modules/@noodle-borg/knowledge-operations/package.json

@@ -28,8 +28,7 @@
   "dependencies": {
     "@noodle-borg/knowledge": "0.0.0",
     "@noodle-borg/knowledge-crawl": "0.0.0",
-    "@noodle-borg/wire-contracts": "0.0.0",
-    "zod": "^4.4.3"
+    "@noodle-borg/wire-contracts": "0.0.0"
   },
   "devDependencies": {
     "@types/node": "^24.13.1",

package/node_modules/@noodle-borg/observability/dist/request-events-postgres.js

@@ -207,7 +207,9 @@ function rowToEvent(row) {
         ...(row.deployment_id !== null ? { deploymentId: row.deployment_id } : {}),
         ...(row.server_version !== null ? { serverVersion: row.server_version } : {}),
         ...(row.sdk_protocol_version !== null ? { sdkProtocolVersion: row.sdk_protocol_version } : {}),
-        ...(row.protocol_era !== null ? { protocolEra: row.protocol_era } : {}),
+        ...(row.protocol_era !== null
+            ? { protocolEra: row.protocol_era }
+            : {}),
         ...(row.session_id !== null ? { sessionId: row.session_id } : {}),
         ...(row.client_name !== null ? { clientName: row.client_name } : {}),
         ...(row.client_version !== null ? { clientVersion: row.client_version } : {}),

package/node_modules/@noodle-borg/plugin-distribution/dist/openai-submission-render.js

@@ -1,6 +1,6 @@
 import { createHash } from 'node:crypto';
 import { deterministicZip, skillSlug, } from '@noodle-borg/agent-packaging';
-export const OPENAI_SUBMISSION_SCHEMA = 'https://developers.openai.com/apps-sdk/schemas/chatgpt-app-submission.v1.json';
+const OPENAI_SUBMISSION_SCHEMA = 'https://developers.openai.com/apps-sdk/schemas/chatgpt-app-submission.v1.json';
 export function renderOpenAiSubmissionArtifacts(input, options, markdown) {
     const slug = skillSlug(input.appPackage.app.name);
     const skillArchivePath = `submission/${slug}-skill.zip`;

package/node_modules/@noodle-borg/protocol/dist/index.d.ts

@@ -9,6 +9,6 @@ export { handleStatelessHttp } from './stateless.js';
 export { evaluateToolAuthorization, filterAuthorizedTools, TOOL_AUTHORIZATION_DENIED, type ToolAuthorizationCaller, type ToolAuthorizationDecision, type ToolAuthorizationRuleClass, toolAuthorizationRuleClass, toolAuthorizationRuleFingerprint, } from './tool-authorization.js';
 export { toolRequiresConfirmation } from './tool-confirmation.js';
 export { createDualEraMcpHandler, createPlatformDualEraMcpHandler, } from './v2/handler.js';
-export { type McpProtocolEra, MODERN_MCP_PROTOCOL_VERSION, SERVED_MCP_PROTOCOL_VERSIONS, type ServedMcpProtocolVersion, } from './v2/versions.js';
+export { LEGACY_MCP_PROTOCOL_VERSION, type McpProtocolEra, type McpProtocolMode, MODERN_MCP_PROTOCOL_VERSION, SERVED_MCP_PROTOCOL_VERSIONS, type ServedMcpProtocolVersion, } from './v2/versions.js';
 export { injectWidgetBridge } from './widget/inject.js';
 //# sourceMappingURL=index.d.ts.map

package/node_modules/@noodle-borg/protocol/dist/index.js

@@ -8,6 +8,6 @@ export { handleStatelessHttp } from './stateless.js';
 export { evaluateToolAuthorization, filterAuthorizedTools, TOOL_AUTHORIZATION_DENIED, toolAuthorizationRuleClass, toolAuthorizationRuleFingerprint, } from './tool-authorization.js';
 export { toolRequiresConfirmation } from './tool-confirmation.js';
 export { createDualEraMcpHandler, createPlatformDualEraMcpHandler, } from './v2/handler.js';
-export { MODERN_MCP_PROTOCOL_VERSION, SERVED_MCP_PROTOCOL_VERSIONS, } from './v2/versions.js';
+export { LEGACY_MCP_PROTOCOL_VERSION, MODERN_MCP_PROTOCOL_VERSION, SERVED_MCP_PROTOCOL_VERSIONS, } from './v2/versions.js';
 export { injectWidgetBridge } from './widget/inject.js';
 //# sourceMappingURL=index.js.map

package/node_modules/@noodle-borg/protocol/dist/interaction-envelope.js

@@ -32,7 +32,7 @@ export function toolUsesPortableInteractionArgument(tool) {
         typeof properties === 'object' &&
         Object.hasOwn(properties, '__noodleInteraction'));
 }
-export function interactionResponsesFromMeta(value) {
+function interactionResponsesFromMeta(value) {
     if (value === null || typeof value !== 'object' || Array.isArray(value))
         return {};
     const noodle = value.noodle;
@@ -43,7 +43,7 @@ export function interactionResponsesFromMeta(value) {
         return {};
     return parseElicitationResponses(interaction.responses);
 }
-export function parseElicitationResponses(value) {
+function parseElicitationResponses(value) {
     if (value === null || typeof value !== 'object' || Array.isArray(value))
         return {};
     const responses = {};

package/node_modules/@noodle-borg/protocol/dist/jsonrpc.d.ts

@@ -16,5 +16,5 @@ export interface JsonRpcErrorObject {
     readonly message: string;
     readonly data?: unknown;
 }
-export { LEGACY_MCP_ERROR, RESOURCE_NOT_FOUND, TOOL_AUTHORIZATION_DENIED, } from './error-codes.js';
+export { LEGACY_MCP_ERROR, RESOURCE_NOT_FOUND, } from './error-codes.js';
 //# sourceMappingURL=jsonrpc.d.ts.map

package/node_modules/@noodle-borg/protocol/dist/jsonrpc.js

@@ -11,5 +11,5 @@ export const JSON_RPC = {
     INVALID_PARAMS: -32602,
     INTERNAL_ERROR: -32603,
 };
-export { LEGACY_MCP_ERROR, RESOURCE_NOT_FOUND, TOOL_AUTHORIZATION_DENIED, } from './error-codes.js';
+export { LEGACY_MCP_ERROR, RESOURCE_NOT_FOUND, } from './error-codes.js';
 //# sourceMappingURL=jsonrpc.js.map

package/node_modules/@noodle-borg/protocol/dist/mapping.d.ts

@@ -54,8 +54,6 @@ export declare function mapToolsList(artifact: RuntimeArtifact, caller?: ToolAut
     readonly knowledgeTools?: boolean;
     readonly intentCapture?: boolean;
 }): ToolsListResult;
-/** Generated `search_<name>` descriptors (ADR 0202 D4); listed only when the port is live. */
-export declare function knowledgeToolDescriptors(artifact: RuntimeArtifact, intentCapture?: boolean): ToolsListResult['tools'];
 /**
  * Map a successful tool output to a `tools/call` result. Structured (object) output is returned as
  * `structuredContent` and also serialized into a text block (the spec asks for both, for clients
@@ -63,7 +61,7 @@ export declare function knowledgeToolDescriptors(artifact: RuntimeArtifact, inte
  */
 export declare function mapToolOutput(output: unknown): ToolsCallResult;
 export declare function redactWidgetLinkedOutput(output: unknown): unknown;
-export interface ResourceDescriptor {
+interface ResourceDescriptor {
     readonly uri: string;
     readonly name: string;
     readonly title?: string;
@@ -75,7 +73,7 @@ export interface ResourceDescriptor {
 export interface ResourcesListResult {
     readonly resources: readonly ResourceDescriptor[];
 }
-export interface ResourceTemplateDescriptor {
+interface ResourceTemplateDescriptor {
     readonly uriTemplate: string;
     readonly name: string;
     readonly title?: string;
@@ -108,12 +106,12 @@ export declare function mapResourceTemplatesList(artifact: RuntimeArtifact): Res
  * anything else → a JSON-serialized text content.
  */
 export declare function mapResourceContents(uri: string, mimeType: string | undefined, output: unknown, meta?: Readonly<Record<string, unknown>>, widgetDomain?: WidgetDomainProjection): ReadResourceResult;
-export interface PromptArgumentDescriptor {
+interface PromptArgumentDescriptor {
     readonly name: string;
     readonly description?: string;
     readonly required?: boolean;
 }
-export interface PromptDescriptor {
+interface PromptDescriptor {
     readonly name: string;
     readonly title?: string;
     readonly description?: string;

package/node_modules/@noodle-borg/protocol/dist/mapping.js

@@ -74,7 +74,7 @@ export function mapToolsList(artifact, caller, options) {
     };
 }
 /** Generated `search_<name>` descriptors (ADR 0202 D4); listed only when the port is live. */
-export function knowledgeToolDescriptors(artifact, intentCapture = false) {
+function knowledgeToolDescriptors(artifact, intentCapture = false) {
     return (artifact.server.knowledge ?? []).map((component) => ({
         name: component.generatedTool.name,
         description: component.generatedTool.description,

package/node_modules/@noodle-borg/protocol/dist/observation.d.ts

@@ -19,15 +19,6 @@ export interface ProtocolObservation {
     /** Safe connector failure attribution projected from the execution error (#1309); scalars only. */
     readonly connector?: ConnectorFailureAttribution;
 }
-/**
- * The analytics `errorKind` for an execution error: the stable code, refined with the allowlisted
- * `reason` when one exists (`connector_error.timeout`). Analytics-only — the wire's structured
- * reasons are gated separately (and more narrowly) in `execution-error-mapping.ts`.
- */
-export declare function executionErrorKind(error: {
-    readonly code: string;
-    readonly reason?: string;
-}): string;
 /** The observation slice carried by an execution error, ready to spread into an observe call. */
 export declare function executionErrorObservation(error: {
     readonly code: string;

package/node_modules/@noodle-borg/protocol/dist/observation.js

@@ -3,7 +3,7 @@
  * `reason` when one exists (`connector_error.timeout`). Analytics-only — the wire's structured
  * reasons are gated separately (and more narrowly) in `execution-error-mapping.ts`.
  */
-export function executionErrorKind(error) {
+function executionErrorKind(error) {
     return error.reason === undefined ? error.code : `${error.code}.${error.reason}`;
 }
 /** The observation slice carried by an execution error, ready to spread into an observe call. */

package/node_modules/@noodle-borg/protocol/dist/v2/handler.d.ts

@@ -1,11 +1,12 @@
 import { type McpHttpHandler, type McpServerFactory } from '@modelcontextprotocol/server';
 import type { ProtocolRequestContext, ServedArtifact } from '../sdk-server.js';
+import { type McpProtocolMode } from './versions.js';
 /**
  * The single Noodle MCP entry: SDK-owned era classification/dispatch with a narrow Noodle response seam.
  */
 export declare function createDualEraMcpHandler(target: ServedArtifact, context?: ProtocolRequestContext): McpHttpHandler;
 /** Platform-wide SDK v2 handler used by artifact and first-party MCP surfaces alike. */
 export declare function createPlatformDualEraMcpHandler(factory: McpServerFactory, platformOptions?: {
-    readonly protocolMode?: 'dual' | 'legacy-only';
+    readonly protocolMode?: McpProtocolMode;
 }): McpHttpHandler;
 //# sourceMappingURL=handler.d.ts.map

package/node_modules/@noodle-borg/protocol/dist/v2/versions.d.ts

@@ -3,4 +3,8 @@ export declare const SERVED_MCP_PROTOCOL_VERSIONS: readonly ["2026-07-28", "2025
 export type ServedMcpProtocolVersion = (typeof SERVED_MCP_PROTOCOL_VERSIONS)[number];
 export type McpProtocolEra = 'legacy' | 'modern';
 export declare const MODERN_MCP_PROTOCOL_VERSION: "2026-07-28";
+/** The newest revision served through the legacy (v1 SDK) path. */
+export declare const LEGACY_MCP_PROTOCOL_VERSION: "2025-11-25";
+/** Origin-wide rollout gate: serve both eras, or answer modern requests with method-not-found. */
+export type McpProtocolMode = 'dual' | 'legacy-only';
 //# sourceMappingURL=versions.d.ts.map

package/node_modules/@noodle-borg/protocol/dist/v2/versions.js

@@ -8,4 +8,6 @@ export const SERVED_MCP_PROTOCOL_VERSIONS = [
     '2024-10-07',
 ];
 export const MODERN_MCP_PROTOCOL_VERSION = SERVED_MCP_PROTOCOL_VERSIONS[0];
+/** The newest revision served through the legacy (v1 SDK) path. */
+export const LEGACY_MCP_PROTOCOL_VERSION = SERVED_MCP_PROTOCOL_VERSIONS[1];
 //# sourceMappingURL=versions.js.map

package/node_modules/@noodle-borg/protocol/dist/widget/domain-projection.d.ts

@@ -1,8 +1,9 @@
-export type WidgetHostKind = 'claude' | 'generic';
+type WidgetHostKind = 'claude' | 'generic';
 export interface WidgetDomainProjection {
     readonly host: WidgetHostKind;
     readonly mcpServerUrl?: string;
 }
 export declare function claudeWidgetDomain(mcpServerUrl: string): string | undefined;
 export declare function projectWidgetResourceMeta(meta: Readonly<Record<string, unknown>>, projection?: WidgetDomainProjection): Readonly<Record<string, unknown>>;
+export {};
 //# sourceMappingURL=domain-projection.d.ts.map

package/node_modules/@noodle-borg/protocol/package.json

@@ -24,7 +24,6 @@
   "dependencies": {
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/uri-template": "0.0.0",
-    "@modelcontextprotocol/core": "2.0.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@modelcontextprotocol/server": "2.0.0",
     "@noodle-borg/compiler": "0.0.0",

package/node_modules/@noodle-borg/runtime/dist/broker/types.d.ts

@@ -34,14 +34,14 @@ export declare function credentialUnavailableErrorSnapshot(value: unknown): Cred
  * to business backends (docs/SPEC.md "Auth And Identity").
  */
 export type DownstreamCredential = BearerDownstreamCredential | CookieDownstreamCredential;
-export interface BearerDownstreamCredential {
+interface BearerDownstreamCredential {
     readonly kind?: 'bearer';
     /** Opaque secret material the connector presents to its backing system. */
     readonly token: string;
     /** Optional scope marker, for the broker's own bookkeeping. */
     readonly scope?: string;
 }
-export interface CookieDownstreamCredential {
+interface CookieDownstreamCredential {
     readonly kind: 'cookie';
     /** Cookie header value scoped by the broker to the connector's allowed downstream origin. */
     readonly cookie: string;

package/node_modules/@noodle-borg/service/dist/app-package-snapshot.d.ts

@@ -1,9 +1,8 @@
 import { type ProductSkillPackageInput, type RenderedProductSkillBundleV1 } from '@noodle-borg/agent-kit';
-import { type AppPackageArtifactV1, type AppPackageSnapshotV1, appPackageSnapshotV1Schema } from '@noodle-borg/app-package';
+import { type AppPackageArtifactV1, type AppPackageSnapshotV1 } from '@noodle-borg/app-package';
 import type { DeployError } from './registry-types.js';
 import type { DeployRecord } from './store.js';
 export type { AppPackageSnapshotV1 };
-export { appPackageSnapshotV1Schema };
 export type AppPackageRenderer = (input: ProductSkillPackageInput) => RenderedProductSkillBundleV1;
 export declare class AppPackageSnapshotError extends Error {
     readonly deployError: DeployError;

package/node_modules/@noodle-borg/service/dist/app-package-snapshot.js

@@ -1,6 +1,5 @@
 import { ProductSkillRenderError, renderProductSkillBundle, validateRenderedProductSkillFiles, } from '@noodle-borg/agent-kit';
-import { appPackageSnapshotV1Schema, createAppPackageSnapshotV1, parseAppPackageSnapshotV1, } from '@noodle-borg/app-package';
-export { appPackageSnapshotV1Schema };
+import { createAppPackageSnapshotV1, parseAppPackageSnapshotV1, } from '@noodle-borg/app-package';
 export class AppPackageSnapshotError extends Error {
     deployError;
     constructor(deployError) {

package/node_modules/@noodle-borg/service/dist/archive-preflight.js

@@ -1,4 +1,4 @@
-import { sendJson } from './http-util.js';
+import { sendJson } from '@noodle-borg/transport-http';
 export function createArchivePreflight(registry) {
     return async (ref, _req, res) => {
         let archivedAt;

package/node_modules/@noodle-borg/service/dist/assets.js

@@ -1,6 +1,6 @@
 import { createHash, randomBytes } from 'node:crypto';
 import { readFile } from 'node:fs/promises';
-import { sendJson } from './http-util.js';
+import { sendJson } from '@noodle-borg/transport-http';
 export { AssetPlanError, } from '@noodle-borg/module';
 export class InMemoryAssetStore {
     #objects = new Map();

package/node_modules/@noodle-borg/service/dist/assistant-bindings.js

@@ -2,7 +2,7 @@ import { serverAuthVariableBindings } from './managed-config-expressions.js';
 import { missingSecretErrors, missingVariableErrors } from './registry-helpers.js';
 import { serverAuthSecretBindings } from './server-auth-bindings.js';
 const VARIABLE = /\$\{env\.([A-Za-z0-9_]+)\}/g;
-export function assistantSecretBindings(assistant) {
+function assistantSecretBindings(assistant) {
     return assistant?.model.kind === 'openai-compatible'
         ? [
             {
@@ -14,7 +14,7 @@ export function assistantSecretBindings(assistant) {
         ]
         : [];
 }
-export function assistantVariableBindings(assistant) {
+function assistantVariableBindings(assistant) {
     if (!assistant)
         return [];
     if (assistant.model.kind !== 'openai-compatible')

package/node_modules/@noodle-borg/service/dist/client-compatibility.js

@@ -1,6 +1,5 @@
-import { applySecurityHeaders } from '@noodle-borg/transport-http';
+import { applySecurityHeaders, sendJson } from '@noodle-borg/transport-http';
 import { cliCompatibilityError } from './build-info.js';
-import { sendJson } from './http-util.js';
 export function rejectIncompatibleCli(req, res, buildInfo, tls) {
     const error = cliCompatibilityError(buildInfo, req.headers['x-noodle-cli-version']);
     if (!error)

package/node_modules/@noodle-borg/service/dist/developer-mcp/mount.js

@@ -2,9 +2,9 @@ import { createHash, randomUUID } from 'node:crypto';
 import { bearerToken } from '@noodle-borg/control-plane/portable';
 import { createDeveloperMcpServer, DEVELOPER_MCP_PATH, developerMcpContextSchema, environmentNameSchema, tenantSlugSchema, } from '@noodle-borg/developer-mcp';
 import { createPlatformDualEraMcpHandler } from '@noodle-borg/protocol';
-import { applySecurityHeaders, enforceHttps, toWebRequest, writeWebResponse, } from '@noodle-borg/transport-http';
+import { applySecurityHeaders, enforceHttps, readJsonBody, sendJson, toWebRequest, writeWebResponse, } from '@noodle-borg/transport-http';
 import { activeDeveloperGrantForIdentity } from '../auth/developer-grant-guard.js';
-import { baseFromRequest, normalizeServiceBase, readJsonBody, sendJson } from '../http-util.js';
+import { baseFromRequest, normalizeServiceBase } from '../http-util.js';
 import { ServiceDeveloperControlPlane } from './control-plane-adapter.js';
 export { DEVELOPER_MCP_PATH };
 const DEVELOPER_MCP_SCOPES = ['cloud:read'];