@noodleseed/one 0.192.1 → 0.193.0

package/node_modules/@noodle-borg/agent-kit/dist/skill-authoring-refs.js

@@ -80,7 +80,7 @@ export function renderAuthoringWorkflowReference() {
         'HTTP connector auth variants: `bearer` (`{ kind: "bearer", secret: secret("API_TOKEN") }`), `apiKey` (`{ kind: "apiKey", header: "X-API-Key", secret: secret("API_KEY") }`), `clientCredentials`, `delegatedOAuth`, `delegatedSessionCookie`, and `delegatedTokenExchange` (per-user calls to your own API — see "Delegated downstream auth" below). Use managed `secret(...)` / `variable(...)` refs for all values that differ by org/app/env.',
         'An application-owned adapter may require its own service credential in addition to the operator account credential. Declare `http.transportAuth: { kind: "apiKey", header: "X-Adapter-Key", secret: secret("ADAPTER_SERVICE_KEY") }` alongside bound account credential profiles; the credential broker supplies the two independently. Never put either credential in tool arguments or ordinary headers, and never reuse an inbound MCP bearer. This capability does not imply a provider requires two credentials.',
         '',
-        'When one connector needs independently selectable accounts, declare catalog `credentialProfiles` plus each operation’s accepted `credentials.profiles`, then bind each `server.use` alias with `bind(connector, { profile, connection: connection("logical_id", managedSecret(secret("NAME"), { scopes, audience })) })`. The alias is the stable account boundary; never put provider account ids, labels, or credential values in it. `gmailConnector()` is the curated Gmail catalog helper; reuse it under independent aliases and accept canonical `accounts` arrays in tools (one account for writes, or an explicitly ordered supported combination for reads). See the bundled `gmail-multi-account` flagship. Bound managed secrets are supported by hosted execution. For deployed-server access to Google APIs, use `googleWorkloadIdentity({ provider: variable("GOOGLE_WIF_PROVIDER"), access: { kind: "direct" } })`, or add `serviceAccountImpersonation` with a managed service-account email. This is keyless Google Workload Identity Federation: exact Google scopes/audience come from the catalog operation, while `noodle auth google prepare|status|doctor|revoke` owns operator lifecycle. See the bundled `google-bigquery` flagship. `externalExchange()` is runnable only when the deployment operator injects an exact HTTPS provider endpoint/origin/audience and durable shared subject-pin store through service ports; Noodle sends a short-lived platform-signed deployment workload assertion and accepts only a bounded bearer response. Provider implementations must consume assertion replay ids through durable shared atomic storage across instances and restarts. There is intentionally no hosted enrollment or provider CRUD surface yet. The provider wire contract is public, but its conformance kit is workspace/source-only and is not an installable npm package. Bound `clientCredentials(...)` remains fail-closed until its provider slice lands.',
+        'When one connector needs independently selectable accounts, declare catalog `credentialProfiles` plus each operation’s accepted `credentials.profiles`, then bind each `server.use` alias with `bind(connector, { profile, connection: connection("logical_id", managedSecret(secret("NAME"), { scopes, audience })) })`. The alias is the stable account boundary; never put provider account ids, labels, or credential values in it. `gmailConnector()` is the curated Gmail catalog helper; reuse it under independent aliases and accept canonical `accounts` arrays in tools (one account for writes, or an explicitly ordered supported combination for reads). Bound managed secrets are supported by hosted execution. For deployed-server access to Google APIs, use `googleWorkloadIdentity({ provider: variable("GOOGLE_WIF_PROVIDER"), access: { kind: "direct" } })`, or add `serviceAccountImpersonation` with a managed service-account email. This is keyless Google Workload Identity Federation: exact Google scopes/audience come from the catalog operation, while `noodle auth google prepare|status|doctor|revoke` owns operator lifecycle. `externalExchange()` is runnable only when the deployment operator injects an exact HTTPS provider endpoint/origin/audience and durable shared subject-pin store through service ports; Noodle sends a short-lived platform-signed deployment workload assertion and accepts only a bounded bearer response. Provider implementations must consume assertion replay ids through durable shared atomic storage across instances and restarts. There is intentionally no hosted enrollment or provider CRUD surface yet. The provider wire contract is public, but its conformance kit is workspace/source-only and is not an installable npm package. Bound `clientCredentials(...)` remains fail-closed until its provider slice lands.',
         '',
         '## HTTP connector example (full server)',
         '',
@@ -224,7 +224,7 @@ export function renderAuthoringWorkflowReference() {
         '',
         'Author managed config as `secret("NAME")` / `variable("NAME")` and operate it with `noodle secrets set` / `noodle variables set` (scoped org/app/env). Never inline secret values in `server.ts`, tests, or generated files.',
         '',
-        'For business-editable configuration, declare `const guestExperience = variable("GUEST_EXPERIENCE", { schema: z.object({ notice: z.string().max(500) }), default: { notice: "Welcome" }, portal: { label: "Guest experience" }, requiredFor: ["show_menu"] })` and register it in `server(..., { variables: [guestExperience], ... }, tools)`. Use the whole ref or `guestExperience.field("notice")` in ordinary fulfilment/connector arguments. `.field()` selects a schema-declared object property, can chain for nested objects, and retains the parent variable and full configuration snapshot; it never reads operator data at author time. Keep confirmed action arguments shallow enough for complete review; do not label ordinary settings sensitive to bypass the review. The default is reusable safe intent; each business supplies its own values without editing source. Only explicit `portal` metadata exposes a setting. Name-only references and declared variables without `portal` remain technical configuration; secrets remain credential slots. See the bundled `acme-bistro` source.',
+        'For business-editable configuration, declare `const guestExperience = variable("GUEST_EXPERIENCE", { schema: z.object({ notice: z.string().max(500) }), default: { notice: "Welcome" }, portal: { label: "Guest experience" }, requiredFor: ["show_menu"] })` and register it in `server(..., { variables: [guestExperience], ... }, tools)`. Use the whole ref or `guestExperience.field("notice")` in ordinary fulfilment/connector arguments. `.field()` selects a schema-declared object property, can chain for nested objects, and retains the parent variable and full configuration snapshot; it never reads operator data at author time. Keep confirmed action arguments shallow enough for complete review; do not label ordinary settings sensitive to bypass the review. The default is reusable safe intent; each business supplies its own values without editing source. Only explicit `portal` metadata exposes a setting. Name-only references and declared variables without `portal` remain technical configuration; secrets remain credential slots.',
         '',
         'Business schemas must be bounded: booleans, finite bounded numbers, bounded text, string enums, bounded arrays, and closed objects. Put defaults in the declaration, not inside Zod schema defaults; custom transforms/refinements and arbitrary schema code cannot run in the shared runtime. `requiredFor` names existing tools whose invocation needs the value; unresolved settings must leave only dependent capabilities unavailable. Publisher compilation does not require a future buyer’s values. Application code enforces business rules server-side; exposing a control or placing the rule in a prompt is insufficient.',
         '',
@@ -268,7 +268,7 @@ export function renderAuthoringWorkflowReference() {
         '## Managed collections',
         '',
         'Use `managedCollection(name, { title, description, schemaVersion, record })` when an application needs reusable typed intent for business records that Noodle may later hold. Pass it through `server(..., { collections: [...] }, definitions)`. `record` is one bounded, closed Zod object; names use lowercase letters, numbers, and underscores. Keep payment-card, credentials, passport/government identity, health, and biometric fields out of this surface.',
-        'Native record controls are independent: `management: { assignment: true }`, `{ notes: true }`, both, or neither. Status is an ordinary application field such as `progress: z.enum(["received", "reviewing", "handled"]).default("received")`; no framework transition graph exists. Declare `publicFields` explicitly (default empty), `editableFields` for authorized staff (default all schema properties), optional field labels/help, `summaryFields`, `filterFields` and `sortFields`. References must name actual fields and filters/sorts select scalars. Public callers cannot set staff-only fields; a required private field needs a valid creation default. Staff updates merge only admitted fields and revalidate the complete record. See the notes-only `acme-bistro` collection.',
+        'Native record controls are independent: `management: { assignment: true }`, `{ notes: true }`, both, or neither. Status is an ordinary application field such as `progress: z.enum(["received", "reviewing", "handled"]).default("received")`; no framework transition graph exists. Declare `publicFields` explicitly (default empty), `editableFields` for authorized staff (default all schema properties), optional field labels/help, `summaryFields`, `filterFields` and `sortFields`. References must name actual fields and filters/sorts select scalars. Public callers cannot set staff-only fields; a required private field needs a valid creation default. Staff updates merge only admitted fields and revalidate the complete record.',
         'Operator record queries use `noodle solutions records list --filters \'[{"field":"progress","value":"received"}]\' --sort-field progress`. Only declared scalar equality/sort fields apply. Payload queries scan at most 10,000 candidates; narrow `--created-at-from`/`--created-at-to` if the API returns `query_limit_exceeded`. Ordinary listing/export has no such scan cap. Cursor reuse requires unchanged query/schema and anchor revision. An administrator can explicitly migrate an eligible historical request with `records migrate-schema ... --expected-revision N`; never implement read-time rewrites.',
         '',
         'Omitting `source` makes Noodle authoritative for the collection. To project a read-only collection from an outside system, bind an HTTP connector in `server(..., { use: [...] })` and add `source: { connector: connector.ref(), scan: "scan_operation" }`. The compiler requires the exact normalized scan contract and the same record schema. Noodle ingests a one-way replica; create, update, and delete in the outside system remain ordinary application tools with their own confirmation and policy.',
@@ -568,19 +568,7 @@ const FLAGSHIP_EXAMPLES = [
     ],
     [
         'food-ordering',
-        'Consumer ordering MCP App widgets, app-only helpers, cart state, assets, branding, and handoff.',
-    ],
-    [
-        'acme-discovery',
-        'Top-of-funnel discovery→handoff: a discovery carousel, a `create_handoff` deep link, and a design-first UX spec + wireframe.',
-    ],
-    [
-        'acme-tasks',
-        'A two-way productivity app designed around its top-3 prioritized flows (capture/prioritize/complete), with a design-first flow spec + wireframe.',
-    ],
-    [
-        'acme-bistro',
-        'End-to-end ordering with a payment-only handoff; ships a gold-standard `design/` set (UX doc, wireframe with compliance audit, API contract).',
+        'Consumer ordering MCP App widgets, app-only helpers, cart state, assets, branding, and handoff; ships the gold-standard `design/` set (UX doc, wireframe with compliance audit, API contract).',
     ],
     [
         'customer-auth',
@@ -590,20 +578,9 @@ const FLAGSHIP_EXAMPLES = [
         'stateful-draft',
         'Review and save a brief before signup; carry caller-scoped state into an account.',
     ],
-    ['perplexity', 'A real SaaS API with bearer auth and a managed `secret`.'],
-    ['bitcoin', 'API-key HTTP connector, custom auth header, and compute normalization.'],
     [
-        'gmail-multi-account',
-        'One curated Gmail connector reused by two account bindings, canonical account arrays, exact mutation confirmation, and an accompanying personal-automation skill.',
-    ],
-    [
-        'google-bigquery',
-        'Keyless Google Workload Identity Federation with optional service-account impersonation, a BigQuery REST connector, and complete developer/operator setup.',
-    ],
-    ['sharepoint', 'Microsoft SharePoint delegated Microsoft Entra auth and Graph tools.'],
-    [
-        'internal-ops-demo',
-        'Governed internal connectivity — tools/resources/prompts, role-shaped output.',
+        'shopify-storefront',
+        'Commerce on a real provider: live Shopify search, a composed upstream Storefront MCP server, Noodle-owned views, published store knowledge, an embedded assistant, and hosted-checkout handoff.',
     ],
 ];
 export function renderExamplesReference() {
@@ -624,7 +601,7 @@ export function renderExamplesReference() {
     return [
         '# Examples',
         '',
-        'Flagship examples, one per capability. The **bundled** rows ship inside this skill under `examples/<name>/` (the real `server.ts`, `src/views/*.tsx`, and — for the design-first flagships — a `design/` set); read them locally at the paths shown. The rest live only in the Noodle Seed repository under `examples/<name>/` on GitHub. Extend an existing flagship rather than inventing a new shape.',
+        'Flagship examples, one per capability. The **bundled** rows ship inside this skill under `examples/<name>/` (the real `server.ts`, `src/views/*.tsx`, and — for the design-first flagship — a `design/` set); read them locally at the paths shown. Every curated example is bundled, and each is proven against the CLI it ships with. Extend an existing flagship rather than inventing a new shape.',
         '',
         '## Bundled in this skill — read locally',
         '',
@@ -632,10 +609,14 @@ export function renderExamplesReference() {
         '',
         mdTable(['Example', 'Use when', 'Read'], bundledRows),
         '',
-        '## In the repository only — `examples/<name>/` on GitHub',
-        '',
-        mdTable(['Example', 'Use when'], repoRows),
-        '',
+        ...(repoRows.length
+            ? [
+                '## In the repository only — `examples/<name>/`',
+                '',
+                mdTable(['Example', 'Use when'], repoRows),
+                '',
+            ]
+            : []),
         '## Canonical server.ts',
         '',
         'Author with `server(name, options, definitions)` and top-level helpers:',

package/node_modules/@noodle-borg/agent-kit/dist/skill-connect-refs.js

@@ -129,7 +129,7 @@ export function renderConnectAnApiReference() {
         '',
         '- **A response mapping cannot iterate.** There is no per-item / `map` / `item` construct, so you cannot reshape `[{…30 fields}]` into `[{ id, label }]` inside a `response:` block — bind the whole array.',
         "- **A tool's Zod `output` does not strip at runtime.** It only advertises the JSON Schema; the runtime returns your `fulfil` output verbatim, so `z.array(z.object({ id, label }))` will NOT drop extra element fields.",
-        '- **So narrow in a compute connector.** To reshape each element, synthesize a `label`, or normalize a missing array to `[]`, pass the whole array to a `.compute(...)` op whose `run` maps it (a connector is HTTP **or** compute, not both — use a second connector). To only *drop* known fields without reshaping, `projection: { hiddenFields: [...] }` deletes them from each element. Worked example: `examples/weather` — `search_list` binds the array, then `geo_places.narrow` reshapes to `{ id, label }` and normalizes no-results to `[]`; `examples/sharepoint-lists` shows the same pattern against a real API.',
+        '- **So narrow in a compute connector.** To reshape each element, synthesize a `label`, or normalize a missing array to `[]`, pass the whole array to a `.compute(...)` op whose `run` maps it (a connector is HTTP **or** compute, not both — use a second connector). To only *drop* known fields without reshaping, `projection: { hiddenFields: [...] }` deletes them from each element. Worked example: `examples/weather` — `search_list` binds the array, then `geo_places.narrow` reshapes to `{ id, label }` and normalizes no-results to `[]`.',
         '',
         'For a **paginated** API, collect across pages with a `pagination` config; the collected list is then `${response.items}`:',
         '',

package/node_modules/@noodle-borg/agent-kit/dist/skill-content.js

@@ -249,7 +249,7 @@ const SDK_AUTHORING_SIGNATURES = [
     '- Keep tool input names application-owned and meaningful; `__noodleIntent` is reserved for an optional serve-time operator analytics adapter and never reaches `fulfil`.',
     '- `resource(name, { uri, description?, mimeType?, fulfil })` and `prompt(name, { description?, arguments?, fulfil })` expose MCP resources/prompts.',
     '- View metadata (`viewTitle`, `viewDescription`, `csp`, `domain`, `permissions`) belongs on the tool that renders it; `asset("./path")` packages local files.',
-    '- `customerAuth.*(...)` belongs in `server` options when deployed customer callers need verified identity; inspect `examples/customer-auth` or `examples/sharepoint` before using it.',
+    '- `customerAuth.*(...)` belongs in `server` options when deployed customer callers need verified identity; inspect `examples/customer-auth` before using it.',
     '- `state` defines durable widget state handles; handle schemas may use `.optional()`/`.default()` — defaulted fields are optional on write, so a save that omits them still validates. Add `claimOnAuthentication: true` only to an explicitly caller-scoped handle with a finite TTL when a mixed public assistant should atomically adopt that expiring draft on sign-in-ticket spend. `handoff` declares allowed external domains for safe host handoff.',
 ];
 function renderSdkSurfaceReference() {

package/node_modules/@noodle-borg/agent-kit/dist/skill-design-refs.js

@@ -118,15 +118,14 @@ export function renderExperienceDesignReference() {
         'Expand from one screen to the full journey: entry → configuration → handoff, ending at the off-app',
         'destination. Verify the built app against the design with `noodle check --target chatgpt`.',
         '',
-        'For the full quality bar, open a shipped gold-standard set: in the Noodle Seed repository, the',
-        '`design/` folder of the `acme-discovery` (top-of-funnel), `acme-tasks` (two-way), and `acme-bistro`',
-        '(end-to-end) examples each holds a house-style UX Document and a single-file HTML wireframe with an',
-        'embedded OpenAI Apps SDK compliance audit. Match that bar.',
+        "For the full quality bar, open the shipped gold-standard set: the bundled `food-ordering` example's",
+        '`design/` folder holds a house-style UX Document, a single-file HTML wireframe with an embedded',
+        'OpenAI Apps SDK compliance audit, and an API contract for an end-to-end ordering app. Match that bar.',
         '',
         '## The deliverables',
         '',
-        'The design phase produces up to three artifacts — worked gold-standard versions live in each',
-        "`acme-*` example's `design/` folder (copy their structure, swap the content):",
+        'The design phase produces up to three artifacts — worked gold-standard versions live in the',
+        "`food-ordering` example's `design/` folder (copy its structure, swap the content):",
         '',
         '- **UX Document** — the thinking artifact. House-style sections: product overview / knowledge base,',
         '  competitive landscape, personas, conversational flow (with tool-call playscripts), widget specs +',

package/node_modules/@noodle-borg/agent-kit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodle-borg/agent-kit",
-  "version": "0.113.1",
+  "version": "0.114.0",
   "license": "Apache-2.0",
   "type": "module",
   "engines": {

package/node_modules/@noodle-borg/service/package.json

@@ -41,7 +41,7 @@
     "@noodle-borg/managed-capabilities": "0.0.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.113.1",
+    "@noodle-borg/agent-kit": "0.114.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",
     "@noodle-borg/auth": "0.0.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/one",
-  "version": "0.192.1",
+  "version": "0.193.0",
   "private": false,
   "description": "Noodle CLI by Noodle Seed — author, run, and deploy declarative MCP servers. Embedding the assistant in your own web app is @noodleseed/assistant.",
   "license": "Apache-2.0",
@@ -236,7 +236,7 @@
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.113.1",
+    "@noodle-borg/agent-kit": "0.114.0",
     "@noodle-borg/app-audit": "0.0.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",