@noodleseed/one 0.161.0 → 0.161.2

package/node_modules/@noodle-borg/agent-kit/dist/generated/example-files.js

@@ -91,14 +91,14 @@ export const BUNDLED_EXAMPLE_FILES = [
     { relPath: "examples/hello/package.json", content: "{\n  \"name\": \"hello\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"scripts\": {\n    \"test\": \"vitest run --dir test\",\n    \"validate\": \"noodle validate\",\n    \"dev\": \"noodle dev\",\n    \"deploy\": \"noodle deploy\"\n  },\n  \"devDependencies\": {\n    \"@noodleseed/one\": \"latest\",\n    \"vitest\": \"latest\"\n  }\n}\n" },
     { relPath: "examples/hello/src/server.ts", content: "import { annotations, server, tool, z } from '@noodleseed/one';\n\n// Customer apps stay on the public SDK; @noodle-borg/* packages are runtime implementation details.\n\nexport default server(\n  'hello',\n  {\n    title: 'Hello',\n    version: '1.0.0',\n    branding: {\n      name: 'Hello',\n      accent: '#1D9E75',\n      radius: 'md',\n      density: 'comfortable',\n    },\n  },\n  [\n    tool('greet', {\n      // Every model-visible tool declares a title: hosts show it in tool pickers and confirmation\n      // prompts, and both consumer directories reject tools without one.\n      title: 'Greet someone',\n      description: 'Greet someone by name.',\n      input: z.object({\n        // Defaults are advertised to the model and applied at runtime when the argument is omitted.\n        name: z.string().default('world'),\n      }),\n      output: z.object({\n        message: z.string(),\n      }),\n      // Read-only, closed-world: assistant surfaces run this without a consent prompt.\n      annotations: annotations.readOnly(),\n      fulfil: ({ input }) => {\n        return { message: `Hello, ${input.name}!` };\n      },\n    }),\n  ],\n);\n" },
     { relPath: "examples/hello/test/server.test.ts", content: "import { describe, expect, it } from 'vitest';\nimport app from '../src/server.js';\n\ndescribe('hello example', () => {\n  it('exports a Noodle server definition', () => {\n    expect(typeof app.toManifest).toBe('function');\n  });\n\n  it('advertises the greet default and keeps the argument optional', async () => {\n    const manifest = await app.toManifest();\n    const greet = manifest.tools?.find((tool) => tool.name === 'greet');\n    const schema = greet?.inputSchema as {\n      properties?: { name?: { default?: unknown } };\n      required?: string[];\n    };\n    expect(schema.properties?.name?.default).toBe('world');\n    expect(schema.required ?? []).not.toContain('name');\n  });\n});\n" },
-    { relPath: "examples/stateful-draft/README.md", content: "# Stateful Draft\n\n**Owns:** The flagship for a useful brief before signup, authoritative caller state, and account continuation.\n**Read when:** You want to compose a small conversational onboarding flow from existing platform capabilities.\n**Do not put here:** Customer credentials, a new identity provider, or business-system records.\n**Update when:** The reference tools, state schema, or runnable journey changes.\n\nStart with the visitor's goal. Help them produce something useful before asking for an account. This\nsynthetic example collects a project title, audience, and desired outcome; those fields are illustrative,\nnot requirements for any particular SaaS product.\n\n## The journey\n\n1. The visitor describes a goal. The assistant asks only for missing information and proposes a brief.\n2. `open_draft` opens an editable review and reads authoritative state, including its current revision.\n3. `save_draft` saves the reviewed brief after confirmation. It sends the current revision and the complete\n   value to the state API. Failed or missing responses do not appear as successful saves.\n4. The visitor may choose `continue_draft`. This read requires identity, so an anonymous visitor sees the\n   sign-in/signup card. Your host application completes its existing login and spends the bound ticket.\n5. The authenticated assistant reads the same adopted draft. No project, subscription, or business record\n   is created by signing in.\n\nThe widget's Continue button requests the identity-dependent tool through the conversation. The ordinary\nsignup route should remain available on the embedding page.\n\n## Run the reference\n\nFrom this repository:\n\n```sh\npnpm install\npnpm build\nnoodle validate examples/stateful-draft/src/server.ts\nnoodle test examples/stateful-draft/src/server.ts\nnoodle dev examples/stateful-draft/src/server.ts --org demo --app stateful-draft\n```\n\nThe local runtime and widget preview exercise the typed tools. A complete mixed-assistant journey also\nrequires two host pages and a backend that verifies the user. The declared development origins are\n`http://localhost:3001` for the public page and `http://localhost:3002` for the authenticated page; replace\nthese with your exact deployment origins. The assistant uses `noodleManaged()`, whose hosted availability\nand budget belong to the operator. Local tool tests do not require a model key.\n\nUse the SDK version declared in this example's package file. Older published SDKs may omit the state\nadoption flag when compiling; the example's tests check that the flag reaches the compiled declaration.\n\nUse [signup continuity](https://docs.noodleseed.dev/docs/guides/signup-continuity) for the complete host\nintegration and [customer-auth](../customer-auth/README.md) for customer-owned API authentication.\n\n### Loopback demonstration with a hosted assistant\n\nThe included host serves the public page on port 3001 and a **simulated** account page on port 3002.\nIt binds to loopback and must not be published as a production authentication implementation.\nAfter deploying this app, copy this directory outside the monorepo and run the commands below from that\ncopy. This keeps published dependencies from shadowing the monorepo's workspace SDK.\n\n```sh\npnpm install --ignore-workspace --lockfile=false\nexport NOODLE_EMBED_ID=<embed-id-printed-by-deploy>\npnpm site\n```\n\nThis is enough to test the anonymous conversation and saved brief. To exercise the synthetic account\nhandoff, create an assistant backend client for the same org/app/env with\n`noodle assistant clients create --name first-brief-demo --org <org> --app <app> --env <env> --json`.\nSet `NOODLE_ASSISTANT_CREDENTIALS_FILE` to the returned `secretFile` path and restart `pnpm site`.\nThe host consumes that private file without printing it or sending its contents to the browser.\nOverride `NOODLE_SERVICE_URL` only when deploying to a different hosted service.\n\nThe simulated signup chooses a random temporary demo identity and spends the ticket through the real\nbackend session helper. The host's login transaction lasts ten minutes; it is local process memory and\nis lost on restart. A production integration replaces it with the customer's existing verified login and\nlogin transaction. Do not copy the synthetic identity branch into a real application.\n\n## Customer integration map\n\n| Reference | Adaptation in the customer's application |\n| :--- | :--- |\n| Three-field brief | Select the smallest useful outcome and collect only its missing inputs |\n| Public mixed surface | Mount the public embed on the unauthenticated website with an exact allowlist |\n| Expiring `draft` handle | Keep only temporary, bounded coordination state; omit persistence if unnecessary |\n| `continue_draft` | Trigger the existing signup/login at the point the visitor chooses an account |\n| Host session endpoint | Verify the logged-in user, spend the bound ticket, return the SDK session response |\n| Final business action | Add a typed connector to the existing authorized, idempotent create/update API |\n\nThe final business action belongs in the customer backend. Show the resulting record or its identifier\nonly after that API confirms success. Signup and state adoption alone are not completed onboarding.\nResearch or document parsing can be added later when they remove a demonstrated user burden; they are not\nprerequisites for this reference.\n\n## State and failure behavior\n\nThe draft uses caller scope, a finite 24-hour TTL, and `claimOnAuthentication: true`. Its `v2` schema\nreplaces the earlier title/stage illustration. Widget state is only a display cache. Reads, validation,\nrevision checks, expiry, and persistence belong to the runtime.\n\nA stale edit requires an explicit reload and review before another save. Spending the single-use sign-in\nticket moves only opted-in state to the backend-verified account, preserving its revision and expiry.\nDestination conflicts fail rather than merging two drafts. Abandoned or expired signup leaves the\nanonymous state under its original limits. A 24-hour state TTL does not promise cross-device recovery or\nthat an arbitrary new anonymous visit can recover the conversation.\n\nThe save is a connector-backed side effect on a public/mixed surface, so it has `confirm: true`. Previewing\nthe brief has no side effect and needs neither signup nor confirmation. Do not add a confirmation to each\nconversational answer or treat confirmation as proof of identity.\n\n## Validate before a customer pilot\n\n- Show useful value with no account and without repeating already supplied information.\n- Save, reopen, and edit the actual record; test a stale revision and an unconfirmed save.\n- Verify the same draft after the customer's real signup and login, including cancellation and expiry.\n- Test an existing-account draft conflict and ensure it is not silently overwritten.\n- Ensure signup triggers no unintended business write and account A cannot read account B's draft.\n- Compare onboarding completion and first useful product outcome with the existing flow; count signups\n  separately. A demo is not evidence of improved conversion.\n" },
+    { relPath: "examples/stateful-draft/README.md", content: "# Stateful Draft\n\n**Owns:** The flagship for a useful brief before signup, authoritative caller state, and account continuation.\n**Read when:** You want to compose a small conversational onboarding flow from existing platform capabilities.\n**Do not put here:** Customer credentials, a new identity provider, or business-system records.\n**Update when:** The reference tools, state schema, or runnable journey changes.\n\nStart with the visitor's goal. Help them produce something useful before asking for an account. This\nsynthetic example collects a project title, audience, and desired outcome; those fields are illustrative,\nnot requirements for any particular SaaS product.\n\n## The journey\n\n1. The visitor describes a goal. The assistant asks only for missing information and proposes a brief.\n2. `open_draft` opens an editable review and reads authoritative state, including its current revision.\n3. `save_draft` saves the reviewed brief after confirmation. It sends the current revision and the complete\n   value to the state API. Failed or missing responses do not appear as successful saves.\n4. The visitor may choose `continue_draft`. This read requires identity, so an anonymous visitor sees the\n   sign-in/signup card. Your host application completes its existing login and spends the bound ticket.\n5. The authenticated assistant reads the same adopted draft. No project, subscription, or business record\n   is created by signing in.\n\nThe widget's Continue button requests the identity-dependent tool through the conversation. The ordinary\nsignup route should remain available on the embedding page.\n\n## Run the reference\n\nFrom this repository:\n\n```sh\npnpm install\npnpm build\nnoodle validate examples/stateful-draft/src/server.ts\nnoodle test examples/stateful-draft/src/server.ts\nnoodle dev examples/stateful-draft/src/server.ts --org demo --app stateful-draft\n```\n\nThe local runtime and widget preview exercise the typed tools. A complete mixed-assistant journey also\nrequires two host pages and a backend that verifies the user. The declared development origins are\n`http://localhost:3001` for the public page and `http://localhost:3002` for the authenticated page; replace\nthese with your exact deployment origins. The assistant uses `noodleManaged()`, whose hosted availability\nand budget belong to the operator. Local tool tests do not require a model key.\n\nUse the SDK version declared in this example's package file. Older published SDKs may omit the state\nadoption flag when compiling; the example's tests check that the flag reaches the compiled declaration.\n\nUse [signup continuity](https://docs.noodleseed.dev/docs/guides/signup-continuity) for the complete host\nintegration and [customer-auth](../customer-auth/README.md) for customer-owned API authentication.\n\n### Loopback demonstration with a hosted assistant\n\nThe included host serves the public page on port 3001 and a **simulated** account page on port 3002.\nIt binds to loopback and must not be published as a production authentication implementation.\nAfter deploying this app, copy this directory outside the monorepo and run the commands below from that\ncopy. This keeps published dependencies from shadowing the monorepo's workspace SDK.\n\n```sh\npnpm install --ignore-workspace --lockfile=false\nexport NOODLE_EMBED_ID=<embed-id-printed-by-deploy>\npnpm site\n```\n\nThis is enough to test the anonymous conversation and saved brief. To exercise the synthetic account\nhandoff, create an assistant backend client for the same org/app/env with\n`noodle assistant clients create --name first-brief-demo --org <org> --app <app> --env <env> --json`.\nSet `NOODLE_ASSISTANT_CREDENTIALS_FILE` to the returned `secretFile` path and restart `pnpm site`.\nThe host consumes that private file without printing it or sending its contents to the browser.\nOverride `NOODLE_SERVICE_URL` only when deploying to a different hosted service.\n\nThe simulated signup chooses a random temporary demo identity and spends the ticket through the real\nbackend session helper. The host's login transaction lasts ten minutes; it is local process memory and\nis lost on restart. A production integration replaces it with the customer's existing verified login and\nlogin transaction. Do not copy the synthetic identity branch into a real application.\n\n## Customer integration map\n\n| Reference | Adaptation in the customer's application |\n| :--- | :--- |\n| Three-field brief | Select the smallest useful outcome and collect only its missing inputs |\n| Public mixed surface | Mount the public embed on the unauthenticated website with an exact allowlist |\n| Expiring `draft` handle | Keep only temporary, bounded coordination state; omit persistence if unnecessary |\n| `continue_draft` | Trigger the existing signup/login at the point the visitor chooses an account |\n| Host session endpoint | Verify the logged-in user, spend the bound ticket, return the SDK session response |\n| Final business action | Add a typed connector to the existing authorized, idempotent create/update API |\n\nThe final business action belongs in the customer backend. Show the resulting record or its identifier\nonly after that API confirms success. Signup and state adoption alone are not completed onboarding.\nResearch or document parsing can be added later when they remove a demonstrated user burden; they are not\nprerequisites for this reference.\n\n## State and failure behavior\n\nThe draft uses caller scope, a finite 24-hour TTL, and `claimOnAuthentication: true`. Its `v2` schema\nreplaces the earlier title/stage illustration. Widget state is only a display cache. Reads, validation,\nrevision checks, expiry, and persistence belong to the runtime.\n\nA stale edit requires an explicit reload and review before another save. Spending the single-use sign-in\nticket moves only opted-in state to the backend-verified account, preserving its revision and expiry.\nDestination conflicts fail rather than merging two drafts. Abandoned or expired signup leaves the\nanonymous state under its original limits. A 24-hour state TTL does not promise cross-device recovery or\nthat an arbitrary new anonymous visit can recover the conversation.\n\nThe save is a connector-backed side effect on a public/mixed surface, so it has `confirm: true`. Previewing\nthe brief has no side effect and needs neither signup nor confirmation. Do not add a confirmation to each\nconversational answer or treat confirmation as proof of identity.\nThe example relies on the managed confirmation default: reviewers see the complete business brief and\ndecision controls without connector mechanics. Enable `showConfirmationDetails` only for an audience that\nneeds those technical details.\n\n## Validate before a customer pilot\n\n- Show useful value with no account and without repeating already supplied information.\n- Save, reopen, and edit the actual record; test a stale revision and an unconfirmed save.\n- Verify the same draft after the customer's real signup and login, including cancellation and expiry.\n- Test an existing-account draft conflict and ensure it is not silently overwritten.\n- Ensure signup triggers no unintended business write and account A cannot read account B's draft.\n- Compare onboarding completion and first useful product outcome with the existing flow; count signups\n  separately. A demo is not evidence of improved conversion.\n" },
     { relPath: "examples/stateful-draft/noodle.json", content: "{\n  \"entrypoint\": \"src/server.ts\",\n  \"name\": \"stateful-draft\",\n  \"template\": \"widget\"\n}\n" },
     { relPath: "examples/stateful-draft/package.json", content: "{\n  \"name\": \"stateful-draft\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"scripts\": {\n    \"test\": \"vitest run\",\n    \"validate\": \"noodle validate\",\n    \"dev\": \"noodle dev\",\n    \"deploy\": \"noodle deploy\",\n    \"site\": \"node site/demo.mjs\"\n  },\n  \"devDependencies\": {\n    \"@noodleseed/assistant\": \"^1.33.0\",\n    \"@vitejs/plugin-react\": \"latest\",\n    \"@noodleseed/one\": \"^0.154.0\",\n    \"react\": \"latest\",\n    \"react-dom\": \"latest\",\n    \"vite\": \"latest\",\n    \"vitest\": \"latest\"\n  }\n}\n" },
     { relPath: "examples/stateful-draft/site/client.js", content: "import '/sdk/index.js';\n\nconst config = await fetch('/demo-config').then((response) => response.json());\nconst mount = document.querySelector('#assistant');\nconst status = document.querySelector('#status');\nif (config.authenticated && !config.signedIn) {\n  document.querySelector('#demo-login').hidden = false;\n  status.textContent =\n    'Your draft is ready to come with you. This next step simulates the product’s signup.';\n} else {\n  const assistant = document.createElement('noodle-assistant');\n  assistant.setAttribute('theme', 'light');\n  if (config.authenticated) {\n    assistant.setAttribute('session-endpoint', '/assistant-session');\n    status.textContent =\n      'You are using a synthetic demo account. Open the chat to continue with your saved brief.';\n  } else {\n    assistant.setAttribute('embed-id', config.embedId);\n    assistant.setAttribute('service-url', config.serviceUrl);\n    status.textContent =\n      'Start without an account. Open the chat and describe what you want to achieve.';\n  }\n  mount.append(assistant);\n}\n\ndocument.addEventListener('assistant-sign-in-requested', async (event) => {\n  status.textContent = 'Preparing your account handoff…';\n  try {\n    const response = await fetch('/start', {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({ signInTicket: event.detail.signInTicket }),\n    });\n    const result = await response.json();\n    if (!response.ok) {\n      status.textContent = result.error ?? 'Handoff not started';\n      return;\n    }\n    window.location.assign(result.destination);\n  } catch {\n    status.textContent =\n      'The handoff did not start. Your brief has not been moved. Please try again.';\n  }\n});\n" },
     { relPath: "examples/stateful-draft/site/demo.mjs", content: "/** Loopback-only synthetic host. Replace its demo identity with your existing login in a real app. */\nimport { randomUUID } from 'node:crypto';\nimport { readFile } from 'node:fs/promises';\nimport { createServer } from 'node:http';\nimport { dirname, join } from 'node:path';\nimport { fileURLToPath } from 'node:url';\nimport { createAssistantSession } from '@noodleseed/assistant/server';\n\nconst publicOrigin = 'http://localhost:3001';\nconst appOrigin = 'http://localhost:3002';\nconst serviceUrl = process.env.NOODLE_SERVICE_URL ?? 'https://cloud.noodleseed.dev';\nconst embedId = process.env.NOODLE_EMBED_ID;\nconst credentialFile = process.env.NOODLE_ASSISTANT_CREDENTIALS_FILE;\nif (!embedId?.match(/^pub_[a-z0-9]+$/i)) {\n  throw new Error('Set NOODLE_EMBED_ID from the hosted deployment.');\n}\nif (new URL(serviceUrl).protocol !== 'https:')\n  throw new Error('The hosted service must use HTTPS.');\n// Consume only the explicitly supplied backend credential file. Its content is never sent to the browser.\nconst credentials = credentialFile ? JSON.parse(await readFile(credentialFile, 'utf8')) : undefined;\nif (\n  credentials &&\n  (typeof credentials.clientId !== 'string' || typeof credentials.clientSecret !== 'string')\n) {\n  throw new Error('The backend credential file is not a CLI-created assistant client file.');\n}\nconst sdkDir = dirname(fileURLToPath(import.meta.resolve('@noodleseed/assistant')));\nconst siteDir = dirname(fileURLToPath(import.meta.url));\nconst transactions = new Map();\nconst lifetime = 10 * 60 * 1000;\n\nfunction send(res, status, value, type = 'application/json') {\n  res.writeHead(status, {\n    'Content-Type': type,\n    'Cache-Control': 'no-store',\n    'Referrer-Policy': 'no-referrer',\n    'X-Content-Type-Options': 'nosniff',\n  });\n  res.end(type === 'application/json' ? JSON.stringify(value) : value);\n}\nfunction redirect(res, destination) {\n  res.writeHead(303, { Location: destination, 'Cache-Control': 'no-store' });\n  res.end();\n}\nfunction current(req) {\n  const id = /(?:^|;\\s*)brief_demo=([a-f0-9-]+)/.exec(req.headers.cookie ?? '')?.[1];\n  return id ? transactions.get(id) : undefined;\n}\nasync function jsonBody(req) {\n  let text = '';\n  for await (const chunk of req) {\n    text += chunk.toString();\n    if (Buffer.byteLength(text) > 8192) throw new Error('Request too large');\n  }\n  return JSON.parse(text);\n}\n\nfunction handler(origin) {\n  return async (req, res) => {\n    // The fixed loopback host is intentional: never deploy this synthetic-login server to the internet.\n    if (req.headers.host !== new URL(origin).host) return send(res, 403, { error: 'Wrong host' });\n    for (const [id, transaction] of transactions) {\n      if (transaction.expiresAt <= Date.now()) transactions.delete(id);\n    }\n    const path = new URL(req.url ?? '/', origin).pathname;\n    try {\n      if (req.method === 'GET' && path === '/') {\n        return send(\n          res,\n          200,\n          await readFile(join(siteDir, 'index.html')),\n          'text/html; charset=utf-8',\n        );\n      }\n      if (req.method === 'GET' && path === '/demo-config') {\n        return send(res, 200, {\n          serviceUrl,\n          embedId,\n          authenticated: origin === appOrigin,\n          signedIn: Boolean(current(req)?.user),\n        });\n      }\n      if (req.method === 'GET' && path === '/client.js') {\n        return send(res, 200, await readFile(join(siteDir, 'client.js')), 'text/javascript');\n      }\n      if (req.method === 'GET' && /^\\/sdk\\/[a-z0-9._-]+\\.js$/i.test(path)) {\n        return send(res, 200, await readFile(join(sdkDir, path.slice(5))), 'text/javascript');\n      }\n      if (req.method === 'POST') {\n        if (req.headers.origin !== origin) return send(res, 403, { error: 'Wrong origin' });\n        if (origin === publicOrigin && path === '/start') {\n          if (!credentials)\n            return send(res, 503, {\n              error:\n                'Signup demonstration needs an authorized backend client. The anonymous brief is still available.',\n            });\n          if (transactions.size >= 40) return send(res, 429, { error: 'Please try again later' });\n          const body = await jsonBody(req);\n          if (typeof body.signInTicket !== 'string' || body.signInTicket.length > 4096) {\n            return send(res, 400, { error: 'Missing continuation ticket' });\n          }\n          const id = randomUUID();\n          transactions.set(id, {\n            signInTicket: body.signInTicket,\n            expiresAt: Date.now() + lifetime,\n          });\n          res.setHeader(\n            'Set-Cookie',\n            `brief_demo=${id}; HttpOnly; SameSite=Lax; Path=/; Max-Age=600`,\n          );\n          return send(res, 200, { destination: appOrigin });\n        }\n        if (origin === appOrigin && path === '/demo-login') {\n          const transaction = current(req);\n          if (!transaction)\n            return send(res, 410, { error: 'Demo expired. Start again on the public page.' });\n          // Synthetic identity only. A production route must verify its existing application session.\n          transaction.user ??= { id: `demo_${randomUUID()}`, name: 'Demo visitor' };\n          return redirect(res, '/');\n        }\n      }\n      if (origin === appOrigin && req.method === 'GET' && path === '/assistant-session') {\n        if (!credentials) return send(res, 503, { error: 'Configure the backend client first' });\n        if (req.headers['sec-fetch-site'] !== 'same-origin')\n          return send(res, 403, { error: 'Same-origin request required' });\n        const transaction = current(req);\n        if (!transaction?.user)\n          return send(res, 401, { error: 'Choose the synthetic demo account first' });\n        // Reuse the in-flight result so concurrent mounts cannot spend the single-use ticket twice.\n        transaction.session ??= createAssistantSession({\n          serviceUrl,\n          clientId: credentials.clientId,\n          clientSecret: credentials.clientSecret,\n          origin: appOrigin,\n          user: transaction.user,\n          signInTicket: transaction.signInTicket,\n        });\n        const session = await transaction.session;\n        delete transaction.signInTicket;\n        return send(res, 200, session);\n      }\n      return send(res, 404, { error: 'Not found' });\n    } catch {\n      // Do not log credentials, tickets, requests, or raw provider errors.\n      return send(res, 409, {\n        error: 'Continuation was not completed. Return to the public page and start again.',\n      });\n    }\n  };\n}\nfor (const [port, origin] of [\n  [3001, publicOrigin],\n  [3002, appOrigin],\n]) {\n  createServer(handler(origin)).listen(port, '127.0.0.1');\n}\nconsole.log(`Synthetic onboarding demo: ${publicOrigin}`);\nconsole.log('Loopback only. Uses the hosted assistant; demo signup is not a real account.');\n" },
     { relPath: "examples/stateful-draft/site/index.html", content: "<!doctype html>\n<html lang=\"en\">\n  <head>\n    <meta charset=\"utf-8\">\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n    <title>First Brief · Conversational onboarding demo</title>\n    <style>\n      :root { font-family: system-ui, sans-serif; color: #172033; background: #f6f8fc; }\n      body { margin: 0; }\n      main { max-width: 880px; margin: 0 auto; padding: 64px 28px; }\n      .label { font-size: 12px; font-weight: 700; letter-spacing: .14em; color: #526077; }\n      h1 { max-width: 640px; font-size: clamp(36px, 6vw, 64px); line-height: 1.08; letter-spacing: -.055em; }\n      p { max-width: 570px; line-height: 1.6; color: #526077; }\n      .sample { padding: 24px; border: 1px solid #dce3ee; border-radius: 16px; background: white; margin: 28px 0; max-width: 550px; }\n      a { color: #174bbd; }\n      button { border: none; background: #2563eb; color: white; padding: 14px 20px; border-radius: 9px; font: inherit; cursor: pointer; }\n      :focus-visible { outline: 3px solid #2563eb; outline-offset: 4px; }\n      .notice { font-size: 13px; }\n    </style>\n  </head>\n  <body>\n    <main>\n      <span class=\"label\">FIRST BRIEF · INTERNAL DEMONSTRATION</span>\n      <h1>Make something useful.<br>Then decide to sign up.</h1>\n      <p>Describe a goal. Refine a short brief. See the result before deciding whether to take it into an account.</p>\n      <div class=\"sample\">\n        <strong>Try this in the chat</strong>\n        <p>“I want to help new teammates complete their first useful project in a week.”</p>\n        <p id=\"status\" role=\"status\" aria-live=\"polite\">Connecting…</p>\n      </div>\n      <form id=\"demo-login\" action=\"/demo-login\" method=\"post\" hidden>\n        <p><strong>Simulated signup</strong><br>This creates a temporary demo identity. It does not register an account with any SaaS product.</p>\n        <button type=\"submit\">Continue as a demo user</button>\n        <p><a href=\"http://localhost:3001\">Cancel and return to the public page</a></p>\n      </form>\n      <p class=\"notice\">Use synthetic information only. The assistant and draft storage are hosted by Noodle Seed. Signup is simulated locally; no customer backend is connected. Drafts expire within 24 hours. <a href=\"https://noodleseed.com/privacy\" target=\"_blank\" rel=\"noreferrer\">Privacy</a></p>\n    </main>\n    <div id=\"assistant\"></div>\n    <script type=\"module\" src=\"/client.js\"></script>\n  </body>\n</html>\n" },
     { relPath: "examples/stateful-draft/src/helpers.ts", content: "import type { ServerDefinition } from '@noodleseed/one';\nimport { generateHelpers } from '@noodleseed/one/react';\n\nexport type AppType = ServerDefinition;\n\nexport const { useCallTool, useToolInfo, useSendFollowUpMessage } = generateHelpers<AppType>();\n" },
-    { relPath: "examples/stateful-draft/src/server.ts", content: "import {\n  annotations,\n  authenticatedWebsite,\n  connector,\n  embeddedAssistant,\n  noodleManaged,\n  publicWebsite,\n  server,\n  tool,\n  z,\n} from '@noodleseed/one';\n\nconst draft = z.object({\n  title: z.string().trim().min(1).max(120).optional(),\n  audience: z.string().trim().min(1).max(240).optional(),\n  goal: z.string().trim().min(1).max(240).optional(),\n});\n\nconst snapshot = z.object({\n  value: draft,\n  revision: z.number().int(),\n  status: z.string(),\n});\n\nconst state = connector('noodle_state')\n  .version('1.0.0')\n  .operation('read_state', {\n    type: 'read',\n    input: z.object({ handle: z.string() }),\n    output: snapshot,\n  })\n  .operation('patch_state', {\n    type: 'action',\n    input: z.object({\n      handle: z.string(),\n      expectedRevision: z.number().int().min(0),\n      value: draft,\n    }),\n    output: snapshot,\n  });\n\nconst openDraft = tool('open_draft', {\n  title: 'Review your brief',\n  description:\n    'Preview a proposed brief and read the saved brief with its revision. Pass the proposed title, audience, and goal in proposal to prefill the editable preview without saving it. Omit proposal to reload the saved record after a conflict.',\n  input: z.object({ proposal: draft.default({}) }),\n  output: snapshot.extend({ proposal: draft }),\n  fulfil: ({ input, connectors }) => {\n    const saved = connectors.state.readState({ handle: 'draft' });\n    return {\n      value: saved.value,\n      revision: saved.revision,\n      status: saved.status,\n      proposal: input.proposal,\n    };\n  },\n  viewTitle: 'Your project brief',\n  invoking: 'Loading your saved brief…',\n  invoked: 'Your brief is ready to review',\n  view: { component: 'draft-card', entry: './views/draft-card.tsx' },\n  annotations: annotations.readOnly(),\n  viewDescription: 'Review and edit a saved brief before deciding whether to create an account.',\n  csp: { connectDomains: [], resourceDomains: [], frameDomains: [] },\n});\n\nconst saveDraft = tool('save_draft', {\n  title: 'Save your brief',\n  description:\n    'Save this reviewed brief for up to 24 hours. This does not create an account or a project.',\n  input: draft.required().extend({\n    expectedRevision: z.number().int().min(0).meta({ title: 'Saved version' }),\n  }),\n  output: snapshot,\n  annotations: annotations.localAction({ destructive: false, confirm: true }),\n  fulfil: ({ input, connectors }) => {\n    const saved = connectors.state.patchState({\n      handle: 'draft',\n      expectedRevision: input.expectedRevision,\n      value: { title: input.title, audience: input.audience, goal: input.goal },\n    });\n    return { value: saved.value, revision: saved.revision, status: saved.status };\n  },\n});\n\nconst continueDraft = tool('continue_draft', {\n  title: 'Continue with an account',\n  description:\n    'Read the brief in the signed-in account. Call only when the visitor chooses to continue with an account, after showing useful value. Sign-in carries the saved draft forward; it does not submit, publish, or create a project.',\n  input: z.object({}),\n  output: snapshot.extend({ accountId: z.string() }),\n  annotations: annotations.readOnly(),\n  fulfil: ({ connectors, user }) => {\n    const saved = connectors.state.readState({ handle: 'draft' });\n    return {\n      value: saved.value,\n      revision: saved.revision,\n      status: saved.status,\n      accountId: user.id,\n    };\n  },\n});\n\nexport default server(\n  'stateful_draft',\n  {\n    title: 'Your first useful brief',\n    version: '1.0.0',\n    instructions:\n      'Help someone turn their goal into a concise project brief: a title, audience, and desired outcome. Base the brief on information they supply. Propose a sensible editable title; never require a naming question. If the audience and outcome are already clear, immediately show the complete proposed brief. Otherwise ask one short question for missing information and skip anything already answered. Show the useful proposed brief in chat before offering to save it. Do not request an email, password, document, or external research. Read open_draft before save_draft. Saving requires review and confirmation; an unconfirmed save is not persisted. Never claim an account or project was created. After saving, offer continue_draft only as an optional next step; never require signup to see the brief. This is a synthetic onboarding example, not an integration with a specific SaaS product.',\n    branding: {\n      name: 'First Brief',\n      accent: '#2563EB',\n      surface: '#F8FAFC',\n      surfaceDark: '#111827',\n      radius: 'md',\n      density: 'comfortable',\n      typography: 'system',\n      colorScheme: 'auto',\n    },\n    use: { state },\n    state: {\n      handles: {\n        draft: {\n          kind: 'draft',\n          version: 'v2',\n          scope: 'caller',\n          ttlSeconds: 86400,\n          claimOnAuthentication: true,\n          schema: draft,\n        },\n      },\n    },\n    assistant: embeddedAssistant({\n      model: noodleManaged(),\n      privacyUrl: 'https://noodleseed.com/privacy',\n      behavior: { showConfirmationDetails: false },\n      access: [\n        publicWebsite({\n          origins: ['http://localhost:3001'],\n          capabilities: [openDraft, saveDraft, continueDraft],\n          signIn: true,\n        }),\n        authenticatedWebsite({\n          origins: ['http://localhost:3002'],\n          capabilities: [openDraft, saveDraft, continueDraft],\n        }),\n      ],\n      labels: {\n        welcomeHeading: 'What would you like to achieve?',\n        composerPlaceholder: 'Describe your goal…',\n        signInHeading: 'Take your brief with you',\n        signInBody: 'Continue with an account to use your saved brief inside the product.',\n        signInAction: 'Sign in',\n        signUpAction: 'Create account',\n      },\n    }),\n  },\n  [openDraft, saveDraft, continueDraft],\n);\n" },
+    { relPath: "examples/stateful-draft/src/server.ts", content: "import {\n  annotations,\n  authenticatedWebsite,\n  connector,\n  embeddedAssistant,\n  noodleManaged,\n  publicWebsite,\n  server,\n  tool,\n  z,\n} from '@noodleseed/one';\n\nconst draft = z.object({\n  title: z.string().trim().min(1).max(120).optional(),\n  audience: z.string().trim().min(1).max(240).optional(),\n  goal: z.string().trim().min(1).max(240).optional(),\n});\n\nconst snapshot = z.object({\n  value: draft,\n  revision: z.number().int(),\n  status: z.string(),\n});\n\nconst state = connector('noodle_state')\n  .version('1.0.0')\n  .operation('read_state', {\n    type: 'read',\n    input: z.object({ handle: z.string() }),\n    output: snapshot,\n  })\n  .operation('patch_state', {\n    type: 'action',\n    input: z.object({\n      handle: z.string(),\n      expectedRevision: z.number().int().min(0),\n      value: draft,\n    }),\n    output: snapshot,\n  });\n\nconst openDraft = tool('open_draft', {\n  title: 'Review your brief',\n  description:\n    'Preview a proposed brief and read the saved brief with its revision. Pass the proposed title, audience, and goal in proposal to prefill the editable preview without saving it. Omit proposal to reload the saved record after a conflict.',\n  input: z.object({ proposal: draft.default({}) }),\n  output: snapshot.extend({ proposal: draft }),\n  fulfil: ({ input, connectors }) => {\n    const saved = connectors.state.readState({ handle: 'draft' });\n    return {\n      value: saved.value,\n      revision: saved.revision,\n      status: saved.status,\n      proposal: input.proposal,\n    };\n  },\n  viewTitle: 'Your project brief',\n  invoking: 'Loading your saved brief…',\n  invoked: 'Your brief is ready to review',\n  view: { component: 'draft-card', entry: './views/draft-card.tsx' },\n  annotations: annotations.readOnly(),\n  viewDescription: 'Review and edit a saved brief before deciding whether to create an account.',\n  csp: { connectDomains: [], resourceDomains: [], frameDomains: [] },\n});\n\nconst saveDraft = tool('save_draft', {\n  title: 'Save your brief',\n  description:\n    'Save this reviewed brief for up to 24 hours. This does not create an account or a project.',\n  input: draft.required().extend({\n    expectedRevision: z.number().int().min(0).meta({ title: 'Saved version' }),\n  }),\n  output: snapshot,\n  annotations: annotations.localAction({ destructive: false, confirm: true }),\n  fulfil: ({ input, connectors }) => {\n    const saved = connectors.state.patchState({\n      handle: 'draft',\n      expectedRevision: input.expectedRevision,\n      value: { title: input.title, audience: input.audience, goal: input.goal },\n    });\n    return { value: saved.value, revision: saved.revision, status: saved.status };\n  },\n});\n\nconst continueDraft = tool('continue_draft', {\n  title: 'Continue with an account',\n  description:\n    'Read the brief in the signed-in account. Call only when the visitor chooses to continue with an account, after showing useful value. Sign-in carries the saved draft forward; it does not submit, publish, or create a project.',\n  input: z.object({}),\n  output: snapshot.extend({ accountId: z.string() }),\n  annotations: annotations.readOnly(),\n  fulfil: ({ connectors, user }) => {\n    const saved = connectors.state.readState({ handle: 'draft' });\n    return {\n      value: saved.value,\n      revision: saved.revision,\n      status: saved.status,\n      accountId: user.id,\n    };\n  },\n});\n\nexport default server(\n  'stateful_draft',\n  {\n    title: 'Your first useful brief',\n    version: '1.0.0',\n    instructions:\n      'Help someone turn their goal into a concise project brief: a title, audience, and desired outcome. Base the brief on information they supply. Propose a sensible editable title; never require a naming question. If the audience and outcome are already clear, immediately show the complete proposed brief. Otherwise ask one short question for missing information and skip anything already answered. Show the useful proposed brief in chat before offering to save it. Do not request an email, password, document, or external research. Read open_draft before save_draft. Saving requires review and confirmation; an unconfirmed save is not persisted. Never claim an account or project was created. After saving, offer continue_draft only as an optional next step; never require signup to see the brief. This is a synthetic onboarding example, not an integration with a specific SaaS product.',\n    branding: {\n      name: 'First Brief',\n      accent: '#2563EB',\n      surface: '#F8FAFC',\n      surfaceDark: '#111827',\n      radius: 'md',\n      density: 'comfortable',\n      typography: 'system',\n      colorScheme: 'auto',\n    },\n    use: { state },\n    state: {\n      handles: {\n        draft: {\n          kind: 'draft',\n          version: 'v2',\n          scope: 'caller',\n          ttlSeconds: 86400,\n          claimOnAuthentication: true,\n          schema: draft,\n        },\n      },\n    },\n    assistant: embeddedAssistant({\n      model: noodleManaged(),\n      privacyUrl: 'https://noodleseed.com/privacy',\n      access: [\n        publicWebsite({\n          origins: ['http://localhost:3001'],\n          capabilities: [openDraft, saveDraft, continueDraft],\n          signIn: true,\n        }),\n        authenticatedWebsite({\n          origins: ['http://localhost:3002'],\n          capabilities: [openDraft, saveDraft, continueDraft],\n        }),\n      ],\n      labels: {\n        welcomeHeading: 'What would you like to achieve?',\n        composerPlaceholder: 'Describe your goal…',\n        signInHeading: 'Take your brief with you',\n        signInBody: 'Continue with an account to use your saved brief inside the product.',\n        signInAction: 'Sign in',\n        signUpAction: 'Create account',\n      },\n    }),\n  },\n  [openDraft, saveDraft, continueDraft],\n);\n" },
     { relPath: "examples/stateful-draft/src/views/draft-card.tsx", content: "import { useEffect, useState } from 'react';\nimport { useCallTool, useSendFollowUpMessage, useToolInfo } from '../helpers.js';\nimport './widget-style.css';\n\ntype Brief = { title?: string; audience?: string; goal?: string };\ntype Snapshot = { value: Brief; revision: number; status: string; proposal?: Brief };\n\nfunction displayBrief(data: Snapshot | undefined): Brief {\n  const proposal = data?.proposal;\n  return proposal && (proposal.title || proposal.audience || proposal.goal)\n    ? proposal\n    : (data?.value ?? {});\n}\n\nfunction snapshot(result: unknown): Snapshot | undefined {\n  if (!result || typeof result !== 'object') return;\n  const envelope = result as { isError?: boolean; structuredContent?: Partial<Snapshot> };\n  const data = envelope.structuredContent;\n  if (\n    !envelope.isError &&\n    data &&\n    data.value &&\n    typeof data.value === 'object' &&\n    Number.isInteger(data.revision) &&\n    typeof data.status === 'string'\n  ) {\n    return data as Snapshot;\n  }\n}\n\nexport default function DraftCard() {\n  const info = useToolInfo('open_draft');\n  const read = useCallTool('open_draft');\n  const save = useCallTool('save_draft');\n  const followUp = useSendFollowUpMessage();\n  const [saved, setSaved] = useState(() => snapshot(info));\n  const [brief, setBrief] = useState<Brief>(() => displayBrief(snapshot(info)));\n  const [busy, setBusy] = useState(false);\n  const [reloadRequired, setReloadRequired] = useState(false);\n  const [message, setMessage] = useState('Review your brief. An account is optional.');\n  useEffect(() => {\n    const next = snapshot({ structuredContent: info.structuredContent });\n    if (next) {\n      setSaved(next);\n      setBrief(displayBrief(next));\n    }\n  }, [info.structuredContent]);\n  const complete = Boolean(brief.title?.trim() && brief.audience?.trim() && brief.goal?.trim());\n  const unchanged = ['title', 'audience', 'goal'].every(\n    (key) => brief[key as keyof Brief] === saved?.value[key as keyof Brief],\n  );\n\n  async function run(operation: 'load' | 'save') {\n    setBusy(true);\n    try {\n      const result =\n        operation === 'load'\n          ? await read.callTool({})\n          : await save.callTool({ ...brief, expectedRevision: saved?.revision });\n      const next = snapshot(result);\n      if (!next) throw new Error('No authoritative result');\n      setSaved(next);\n      setBrief(displayBrief(next));\n      setReloadRequired(false);\n      setMessage(operation === 'save' ? 'Your brief is saved.' : 'Saved brief loaded.');\n    } catch {\n      setReloadRequired(true);\n      setMessage(\n        'No save was confirmed. Reload saved to check the latest brief before trying again.',\n      );\n    } finally {\n      setBusy(false);\n    }\n  }\n\n  return (\n    <main className=\"brief-shell\">\n      <header>\n        <p className=\"brief-eyebrow\">YOUR FIRST USEFUL STEP</p>\n        <h1>Your project brief</h1>\n        <p>Make something useful before creating an account.</p>\n      </header>\n      <section className=\"brief-fields\">\n        <label>\n          Project title\n          <input\n            required\n            maxLength={120}\n            value={brief.title ?? ''}\n            placeholder=\"A better first week\"\n            onChange={(event) => setBrief({ ...brief, title: event.currentTarget.value })}\n          />\n        </label>\n        <label>\n          Who is this for?\n          <textarea\n            required\n            maxLength={240}\n            rows={2}\n            value={brief.audience ?? ''}\n            placeholder=\"New teammates joining our product team\"\n            onChange={(event) => setBrief({ ...brief, audience: event.currentTarget.value })}\n          />\n        </label>\n        <label>\n          What would success look like?\n          <textarea\n            required\n            maxLength={240}\n            rows={3}\n            value={brief.goal ?? ''}\n            placeholder=\"Complete their first useful project in a week\"\n            onChange={(event) => setBrief({ ...brief, goal: event.currentTarget.value })}\n          />\n        </label>\n        <p role=\"status\" aria-live=\"polite\">\n          {busy ? 'Waiting for the result…' : message}\n        </p>\n        <div className=\"brief-actions\">\n          <button type=\"button\" disabled={busy} onClick={() => void run('load')}>\n            Reload saved\n          </button>\n          <button\n            className=\"brief-primary\"\n            type=\"button\"\n            onClick={() => void run('save')}\n            disabled={busy || !saved || !complete || reloadRequired}\n          >\n            Save brief\n          </button>\n        </div>\n      </section>\n      <footer>\n        <p>\n          A saved brief lasts up to 24 hours and can follow you when you sign in. No project has\n          been created.\n        </p>\n        <button\n          type=\"button\"\n          disabled={\n            busy || !complete || !unchanged || !saved || saved.revision === 0 || reloadRequired\n          }\n          onClick={() =>\n            void followUp({ prompt: 'I would like to continue with my saved brief in an account.' })\n          }\n        >\n          Continue with an account\n        </button>\n      </footer>\n    </main>\n  );\n}\n" },
     { relPath: "examples/stateful-draft/src/views/widget-style.css", content: "@layer stateful-draft {\n  .brief-shell {\n    box-sizing: border-box;\n    max-width: 600px;\n    margin: 0 auto;\n    padding: 24px;\n    color: var(--ns-text-primary, #172033);\n    background: var(--ns-surface, #f8fafc);\n    font-family: var(--ns-font, system-ui, sans-serif);\n    line-height: 1.5;\n  }\n  .brief-shell * {\n    box-sizing: border-box;\n  }\n  .brief-shell h1 {\n    margin: 4px 0;\n    font-size: 26px;\n    letter-spacing: -0.03em;\n  }\n  .brief-shell p {\n    color: var(--ns-text-secondary, #526077);\n  }\n  .brief-eyebrow {\n    font-size: 11px;\n    font-weight: 700;\n    letter-spacing: 0.12em;\n  }\n  .brief-fields {\n    display: grid;\n    gap: 16px;\n    margin: 24px 0;\n  }\n  .brief-shell label {\n    display: grid;\n    gap: 6px;\n    font-size: 14px;\n    font-weight: 600;\n  }\n  .brief-shell input,\n  .brief-shell textarea {\n    width: 100%;\n    padding: 10px 12px;\n    border: 1px solid var(--ns-border, #cbd5e1);\n    border-radius: var(--ns-radius-md, 8px);\n    color: inherit;\n    background: var(--ns-surface-raised, #fff);\n    font: inherit;\n    font-weight: 400;\n    resize: vertical;\n  }\n  .brief-actions {\n    display: flex;\n    flex-wrap: wrap;\n    gap: 8px;\n  }\n  .brief-shell button {\n    padding: 10px 16px;\n    border: 1px solid var(--ns-border, #cbd5e1);\n    border-radius: var(--ns-radius-md, 8px);\n    background: var(--ns-surface-raised, #fff);\n    color: inherit;\n    font: inherit;\n    font-size: 14px;\n    font-weight: 600;\n    cursor: pointer;\n  }\n  .brief-shell .brief-primary {\n    background: var(--ns-accent, #2563eb);\n    color: var(--ns-accent-text, #fff);\n    border-color: transparent;\n  }\n  .brief-shell button:disabled {\n    opacity: 0.5;\n    cursor: default;\n  }\n  .brief-shell :focus-visible {\n    outline: 2px solid var(--ns-focus, #2563eb);\n    outline-offset: 3px;\n  }\n  .brief-shell footer {\n    border-top: 1px solid var(--ns-border, #cbd5e1);\n    padding-top: 12px;\n    font-size: 13px;\n  }\n  @media (max-width: 380px) {\n    .brief-shell {\n      padding: 16px;\n    }\n    .brief-actions button {\n      width: 100%;\n    }\n  }\n}\n" },
     { relPath: "examples/stateful-draft/test/draft-card.test.tsx", content: "// @vitest-environment happy-dom\nimport { act } from 'react';\nimport { createRoot } from 'react-dom/client';\nimport { afterEach, beforeEach, expect, it, vi } from 'vitest';\n\nconst callTool = vi.fn();\nconst followUp = vi.fn();\nconst initial = {\n  value: { title: 'Team launch', audience: 'New teammates', goal: 'Complete their first project' },\n  revision: 4,\n  status: 'active',\n};\nlet entry: unknown = initial;\nvi.mock('../src/helpers.js', () => ({\n  useToolInfo: () => ({ structuredContent: entry }),\n  useCallTool: () => ({ callTool }),\n  useSendFollowUpMessage: () => followUp,\n}));\n\nimport DraftCard from '../src/views/draft-card.js';\n\nlet host: HTMLDivElement;\nlet root: ReturnType<typeof createRoot>;\nbeforeEach(async () => {\n  vi.stubGlobal('IS_REACT_ACT_ENVIRONMENT', true);\n  callTool.mockReset();\n  followUp.mockReset();\n  entry = initial;\n  host = document.createElement('div');\n  document.body.append(host);\n  root = createRoot(host);\n  await act(async () => root.render(<DraftCard />));\n});\nafterEach(() => {\n  act(() => root.unmount());\n  host.remove();\n});\nfunction button(label: string) {\n  const found = [...host.querySelectorAll('button')].find((entry) => entry.textContent === label);\n  if (!found) throw new Error(`Missing button: ${label}`);\n  return found;\n}\n\nit('saves using the server revision and displays only the returned result', async () => {\n  callTool.mockResolvedValue({ structuredContent: { ...initial, revision: 8 } });\n  await act(async () => button('Save brief').click());\n  expect(callTool).toHaveBeenCalledWith({ ...initial.value, expectedRevision: 4 });\n  expect(host.textContent).toContain('Your brief is saved.');\n  expect(button('Continue with an account').disabled).toBe(false);\n});\n\nit('shows a proposed brief without pretending it is already saved', async () => {\n  entry = { value: {}, revision: 0, status: 'active', proposal: initial.value };\n  await act(async () => root.render(<DraftCard />));\n  expect(host.querySelector('input')?.value).toBe('Team launch');\n  expect(button('Continue with an account').disabled).toBe(true);\n  callTool.mockResolvedValue({ structuredContent: { ...initial, revision: 1 } });\n  await act(async () => button('Save brief').click());\n  expect(callTool).toHaveBeenCalledWith({ ...initial.value, expectedRevision: 0 });\n});\n\nit('does not invent a save when confirmation is pending or the response is missing', async () => {\n  callTool.mockResolvedValue({});\n  await act(async () => button('Save brief').click());\n  expect(host.textContent).not.toContain('Your brief is saved.');\n  expect(host.textContent).toContain('No save was confirmed.');\n});\n\nit('retains edits on a stale write and requires a reload before another save', async () => {\n  callTool.mockResolvedValue({ isError: true });\n  await act(async () => button('Save brief').click());\n  expect(host.querySelector('input')?.value).toBe('Team launch');\n  expect(button('Save brief').disabled).toBe(true);\n  expect(host.textContent).toContain('Reload saved');\n  callTool.mockResolvedValue({ structuredContent: { ...initial, revision: 7 } });\n  await act(async () => button('Reload saved').click());\n  await act(async () => button('Save brief').click());\n  expect(callTool).toHaveBeenLastCalledWith({ ...initial.value, expectedRevision: 7 });\n});\n\nit('keeps continuing separate from saving and makes no project-creation claim', async () => {\n  await act(async () => button('Continue with an account').click());\n  expect(callTool).not.toHaveBeenCalled();\n  expect(followUp).toHaveBeenCalledWith({\n    prompt: 'I would like to continue with my saved brief in an account.',\n  });\n  expect(host.textContent).not.toContain('Project created');\n});\n" },

package/node_modules/@noodle-borg/agent-kit/dist/skill-embedded-assistant-ref.js

@@ -229,7 +229,7 @@ export function renderEmbeddedAssistantReference() {
         '',
         'Set `continuity: { enabled: true }` on a public or mixed access surface to let an anonymous visitor keep the conversation they can see when they navigate to another page of the same site. Off unless set, and refused on an authenticated surface, which reattaches through a backend-verified sign-in instead. It restores the visible text on a fresh session and never the old one: no tool authority, no share of a spent turn budget, and no pending confirmation carried across, so an unanswered confirmation stays unanswered. `windowSeconds` defaults to 300 with a 600 ceiling, `maxRestores` to 3 with a ceiling of 10, and 0 for either disables continuity outright; an operator may lower what you declare and can never raise it. The handle lives in `sessionStorage` so it dies with the tab, is single-use, and is valid only for the embed, origin, and visitor it was issued to. Declare it when a marketing site spreads one conversation across several pages; leave it off when anonymous conversation text should not survive a navigation at all.',
         '',
-        'Give every business action a portable `tool(..., { title: "Complete task", description: "This will mark the task complete for everyone.", input: z.object({ task: z.string().meta({ title: "Task" }) }) })` title. The standard confirmation uses the tool title/description plus schema field `title`, `description`, and `format`; it shows Confirm and Don\'t proceed and keeps technical action details secondary. `behavior.showConfirmationDetails` defaults to `true`; set it to `false` to remove only the built-in card\'s Additional details disclosure and connector mechanics. The business review and decisions remain, `confirm: true` still suspends until acceptance, and headless/BYO `data-confirmation` stays unchanged. Do not put JSON or implementation names in business-facing copy.',
+        'Give every business action a portable `tool(..., { title: "Complete task", description: "This will mark the task complete for everyone.", input: z.object({ task: z.string().meta({ title: "Task" }) }) })` title. The standard confirmation uses the tool title/description plus schema field `title`, `description`, and `format`; it shows Confirm and Don\'t proceed and keeps technical action details out of the default review. `behavior.showConfirmationDetails` defaults to `false`; set it to `true` only when the audience needs the collapsed Additional details disclosure. The complete business review and decisions remain, `confirm: true` still suspends until acceptance, and headless/BYO `data-confirmation` stays unchanged. Do not put JSON or implementation names in business-facing copy.',
         '',
         '## Configure and deploy',
         '',

package/node_modules/@noodle-borg/agent-kit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodle-borg/agent-kit",
-  "version": "0.98.0",
+  "version": "0.99.1",
   "license": "Apache-2.0",
   "type": "module",
   "engines": {

package/node_modules/@noodle-borg/assistant-gateway/package.json

@@ -42,7 +42,7 @@
     "@noodle-borg/module-audit": "0.0.0",
     "@noodle-borg/protocol": "0.0.0",
     "@noodle-borg/runtime": "0.0.0",
-    "@noodleseed/assistant": "1.35.0",
+    "@noodleseed/assistant": "1.35.1",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/node_modules/@noodle-borg/service/package.json

@@ -39,7 +39,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.98.0",
+    "@noodle-borg/agent-kit": "0.99.1",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",
     "@noodle-borg/auth": "0.0.0",

package/node_modules/@noodleseed/assistant/README.md

@@ -159,19 +159,21 @@ With UI overrides omitted, the complete managed baseline remains: a bottom-cente
 morphs into a prompt input before opening; a 970px outer desktop shell with 20px side padding, 85vh height,
 1025px maximum height, and a 24px panel using the built-in `#F8F8F8` light and `#0C0A09` dark surfaces;
 bottom prompt chips and pill composer; plain assistant messages and 85%-wide user bubbles; a Noodle Seed
-attribution row; and safe-area-aware mobile fullscreen.
+attribution row; and safe-area-aware mobile fullscreen. The fullscreen mobile layout is a real modal: it
+marks the page behind it inert, traps focus, closes on Escape, and returns focus to the element that opened
+it. Wider floating panels and inline layouts remain nonmodal.
 The generic prompt chips ship as defaults, while an authored list—including `[]`—replaces them. Set
 `presentation.launcher.style` to `bubble` for a direct-open 44px launcher. The baseline does not include the
 “Available on ChatGPT” promotion. Partial configuration objects merge with the remaining defaults;
 `presentation.panel.surface: "glass"` remains available when a translucent panel is intentional.
 
-`behavior.showConfirmationDetails` defaults to `true`. Set it to `false` to remove the built-in
-confirmation card's Additional details disclosure and connector mechanics while keeping its title,
-description, schema-projected business fields, Confirm, and Don't proceed controls. The option changes only
-the managed Web Component's presentation: `confirm: true` still suspends execution, the connector still runs
-only after acceptance, and decline/cancel still stop. Public `embedId` and authenticated `sessionEndpoint`
-React mounts both honor the deployed value without a client prop. Headless/BYO renderers keep the unchanged
-`data-confirmation` part and choose their own presentation.
+`behavior.showConfirmationDetails` defaults to `false`, so the built-in confirmation card presents the tool
+title, description, complete schema-projected business fields, Confirm, and Don't proceed without exposing
+connector mechanics. Set it to `true` only when the audience needs the collapsed Additional details
+disclosure. The option changes only the managed Web Component's presentation: `confirm: true` still suspends
+execution, the connector still runs only after acceptance, and decline/cancel still stop. Public `embedId`
+and authenticated `sessionEndpoint` React mounts both honor the deployed value without a client prop.
+Headless/BYO renderers keep the unchanged `data-confirmation` part and choose their own presentation.
 
 ### Configure and deploy
 
@@ -439,6 +441,11 @@ viewport. If fullscreen is an intentional part of the customer-owned experience,
 because a widget requests it. After an accepted fullscreen request, the host displays an accessible exit
 control in the top-right corner. It returns the same mounted App to inline mode without resetting its state.
 
+A conforming inline App reports its content size through the Apps bridge. The host grows the iframe with
+that content, up to a 16,384px safety bound, so the conversation transcript remains the only vertical scroll
+area and stays anchored to the latest reply while the App grows. Apps that need more space should compact
+their inline view or use an explicitly allowed fullscreen presentation.
+
 Vue, Angular, and plain DOM renderers use the same host without installing React. Import its dedicated entry
 once, then assign the complex values as element properties. In Vue, the explicit `.prop` modifier makes that
 boundary unambiguous:

package/node_modules/@noodleseed/assistant/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/assistant",
-  "version": "1.35.0",
+  "version": "1.35.1",
   "description": "Embed the Noodle Seed customer-branded assistant in your web app with managed or framework-owned UI, a framework-neutral MCP App host, a DOM-free client, and a backend session helper. Authoring and deploying the server is @noodleseed/one.",
   "license": "Apache-2.0",
   "repository": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/one",
-  "version": "0.161.0",
+  "version": "0.161.2",
   "private": false,
   "description": "Noodle CLI by Noodle Seed — author, run, and deploy declarative MCP servers. Embedding the assistant in your own web app is @noodleseed/assistant.",
   "license": "Apache-2.0",
@@ -235,7 +235,7 @@
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.98.0",
+    "@noodle-borg/agent-kit": "0.99.1",
     "@noodle-borg/app-audit": "0.0.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",