@noodleseed/one 0.67.0 → 0.69.0

package/node_modules/@noodle-borg/agent-kit/dist/skill-operations-refs.js

@@ -2,6 +2,7 @@
 // publishing. Facts here mirror the shipped CLI commands and host connection flows; keep prose
 // aligned with `noodle connect`, `noodle check`, and the analytics command surface.
 import { mdTable } from './md.js';
+import { APP_DIRECTORY_COMPLIANCE_REFERENCE } from './skill-router.js';
 // ----------------------------------------------------------------------------
 // references/test-in-hosts.md (CURATED)
 // ----------------------------------------------------------------------------
@@ -149,99 +150,68 @@ export function renderTroubleshootingReference() {
     ].join('\n');
 }
 // ----------------------------------------------------------------------------
-// references/deploy-and-ops.md (CURATED)
+// references/inspect-hosted.md (CURATED)
 // ----------------------------------------------------------------------------
-export function renderDeployAndOpsReference() {
+export function renderInspectHostedReference() {
     return [
-        '# Deploy and operations',
-        '',
-        '## Contents',
-        '',
-        '- Authenticate',
-        '- Link and target',
-        '- Deploy and inspect',
-        '- Installed Developer plugin handoff',
-        '- Eject path (portable manifest)',
-        '- Connect into a host',
-        '- Access modes',
-        '- Org and members',
-        '- Config and observability',
-        '- Agent-safe CLI recipes',
-        '- Analytics',
-        '',
-        '## Authenticate',
-        '',
-        '`noodle login` to authenticate with Noodle Seed Cloud, `noodle whoami` to confirm, `noodle logout` to clear credentials. Local commands (`dev`/`validate`/`test`) need none of this.',
-        '',
-        '## Link and target',
-        '',
-        '`noodle link --org <slug> --app <slug> [--env <slug>]` binds the directory to a target. Unlinked, `noodle deploy` uses your default org, the project name as the app, and `prod`. `noodle target show|set` inspects or changes the target.',
-        '',
-        '## Deploy and inspect',
-        '',
-        '`noodle deploy` deploys the server. Then `noodle open` (latest URL), `noodle status`, `noodle inspect` (metadata, no secrets), `noodle smoke` (readiness diagnostics), and `noodle rollback <deploymentId>` to revert.',
+        '# Inspect hosted state',
         '',
-        '## Installed Developer plugin handoff',
+        'Read hosted evidence without changing target, credentials, configuration, access, host wiring, revisions, or directory state.',
         '',
-        "When this project was bootstrapped by the installed Noodle Developer plugin, preserve its managed launcher invocation for every local CLI command. After `deploy --json`, take the returned deployment ID to the connected remote `noodle-developer.inspect_deployment` tool. Use `noodle-developer.diagnose_app` only when the Cloud evidence needs diagnosis. Those tools inspect the selected organization and environment; they do not edit or replace the application source, which remains the coding agent's responsibility.",
+        '## Use when',
         '',
-        '## Eject path (portable manifest)',
+        '- The user asks for hosted status, deployment metadata, health, logs, events, metrics, audit evidence, or diagnosis.',
+        '- The request is inspect-only, diagnose-only, or asks whether an existing deployment works.',
         '',
-        '`noodle export manifest [--output <file>]` compiles the entrypoint locally and emits the portable, vendor-neutral manifest JSON — no service, no login, no account. A Noodle app is just `src/server.ts` plus this manifest: the user can read it, diff it, and keep it.',
+        '## Authority boundary',
         '',
-        '## Connect into a host',
+        'This route is read-only. It never authorizes `login`, `logout`, `link`, `target set`, hosted secret/variable/config/access changes, `deploy`, `rollback`, host configuration writes, or directory submission. If evidence shows one of those actions is needed, report the exact proposed action and target, then stop for a new explicit user request.',
         '',
-        'Once deployed, register the server as a tool in a host with `noodle connect <host>` (`claude-code`, `codex`, `chatgpt`, `cursor`, `vscode`, `claude`, `inspector`) — it prints the exact config to paste.',
+        '## Workflow',
         '',
-        "- **Claude Code / Claude Desktop** (verified) — add the `mcpServers` block, or one-shot `claude mcp add-json noodle-server '<json>'`:",
+        '1. Resolve the requested org, app, environment, and deployment from existing non-secret context. Do not change the effective target to make inspection easier.',
+        '2. Choose the narrowest read-only command: `noodle target show`, `noodle status`, `noodle inspect`, `noodle smoke`, `noodle metrics --agent-output`, `noodle events --json`, `noodle logs`, or `noodle audit`.',
+        '3. Prefer machine output when the selected command supports it. Record the target, revision/deployment ID, timestamp, result, and any request ID without exposing secrets or customer payloads.',
+        '4. When the installed Developer MCP is available, use its deployment inspection or diagnosis tool only for the selected org/app/env. Treat it as evidence gathering, not mutation authority.',
+        '5. If a command fails, distinguish missing authentication/access from unhealthy application behavior. Do not repair, relink, redeploy, rotate config, or roll back under this route.',
         '',
-        '```json',
-        '{',
-        '  "mcpServers": {',
-        '    "noodle-server": { "type": "https", "url": "https://<app>.mcp.noodleseed.dev" }',
-        '  }',
-        '}',
-        '```',
+        '## Stop conditions',
         '',
-        "- **Codex / Cursor / VS Code** — the same `mcpServers` block is emitted as a starting point (these hosts' config formats are not officially documented). Wiring a deployed Noodle server into Codex means registering that block in Codex's MCP config.",
-        "- **ChatGPT / Claude.ai** — no config file: open the host's Settings → Connectors → Add custom connector, paste the MCP URL, then authenticate.",
-        '- `noodle connect codex|claude-code --write` writes the project-local agent files (only these two targets).',
-        '',
-        '## Access modes',
-        '',
-        '`noodle access set owner-only|org-members|authenticated|customers` controls who can call the deployed server. Hosted access is identity-based; never add static data-plane keys.',
+        '- Stop complete when the requested hosted fact is supported by current evidence and higher untested levels are named.',
+        '- Stop blocked when existing access cannot read the target or the requested evidence requires a host/user journey unavailable in scope.',
+        '- Stop for authorization when the next useful action would mutate local targeting, hosted state, host configuration, or directory state.',
+    ].join('\n');
+}
+// ----------------------------------------------------------------------------
+// references/deploy-and-ops.md (CURATED)
+// ----------------------------------------------------------------------------
+export function renderDeployAndOpsReference() {
+    return [
+        '# Hosted mutation authorization',
         '',
-        '## Org and members',
+        '> This route changes hosted or external state. Use it only when the current user request explicitly authorizes the exact mutation and target.',
         '',
-        '`noodle orgs list|create` and `noodle members list|add|remove --org <slug>` manage organizations and membership.',
+        '## Route boundary',
         '',
-        '## Config and observability',
+        '- Select this route only for the exact hosted mutation the user requested.',
+        '- Route inspection, diagnosis, preparation, validation, testing, and other read-only work to their read-only references. Those requests do not authorize a mutation.',
+        '- Authentication, target binding, configuration, access changes, deployment, connection writes, and rollback are separate mutations. Authorization for one does not imply another.',
         '',
-        'Manage runtime config with `noodle secrets` / `noodle variables` (scoped org/app/env). Operators use `noodle logs`, `noodle audit`, and `noodle policy` for logs, governance audit, and policy.',
+        '## Authorization check',
         '',
-        '## Agent-safe CLI recipes',
+        'Before any mutation, require the current request to name both the action and its complete target. A mutation-capable target consists of an explicit organization, application, and environment. When the environment is absent, stop and ask for it instead of applying a default, reusing local state, or selecting a target implicitly.',
         '',
-        'Use explicit flags in headless runs so commands never wait for a prompt:',
+        'Do not broaden a request to prepare, inspect, diagnose, or validate into permission to authenticate, bind a target, change configuration or access, deploy, connect, submit, or roll back.',
         '',
-        '```sh',
-        'noodle link --org acme --app support-assistant --env prod',
-        'noodle secrets set CRM_TOKEN --scope env --org acme --app support-assistant --env prod --from-env CRM_TOKEN',
-        'noodle secrets set CRM_CERT --scope env --org acme --app support-assistant --env prod --from-file ./cert.pem',
-        'printf %s "$CRM_TOKEN" | noodle secrets set CRM_TOKEN --scope env --org acme --app support-assistant --env prod --from-stdin',
-        'noodle variables set CRM_BASE_URL --scope env --org acme --app support-assistant --env prod --value https://crm.example.com',
-        'noodle secrets list --scope env --org acme --app support-assistant --env prod --json',
-        'noodle validate --json',
-        'noodle test --json',
-        'noodle deploy --json',
-        'noodle smoke --json',
-        'noodle agents doctor --json',
-        '```',
+        '## Command and service contract',
         '',
-        '`secrets resolve` is for local diagnostics only; do not print resolved values into prompts, logs, tests, or docs. Prefer `--from-env`, `--from-file`, or `--from-stdin` over inline `--value` for sensitive values. Variables may use `--value` when the value is non-secret.',
+        'Use `references/cli-commands.md` as the generated command, flag, and exit-code contract. Consult the live command catalog before acting, and treat the service response as the authority for resulting hosted state. This reference intentionally does not duplicate operational command sequences, defaults, or status semantics.',
         '',
-        '## Analytics (verify after deploy, debug errors)',
+        '## Evidence and stop conditions',
         '',
-        'After a deploy gets traffic, verify with `noodle metrics --agent-output` — it returns a `health` verdict (`ok`/`attention`), a one-line summary, and `attention[]` items each carrying the exact next command. When a tool errors, drill in with `noodle events --tool <name> --json` (filters: `--status tool_error|mcp_error`, `--client <name>`); `noodle events --session <id> --json` replays one session chronologically. `--json` on both returns the full payload; human runs get the branded report. Two-tier errors: `tool_error` is recoverable (handed back to the model), `mcp_error` needs attention (protocol/timeout/internal). Wire edge-triggered webhooks on error share, error count, calls, or p95 latency with `noodle alerts add|list|remove|test`.',
+        '- Stop before execution when the action or complete target is missing.',
+        '- After an authorized mutation, report only the state evidenced by the command and service response.',
+        '- Do not claim host behavior, production health, or successful external registration without direct evidence at that layer.',
     ].join('\n');
 }
 // ----------------------------------------------------------------------------
@@ -251,105 +221,99 @@ export function renderPublishingReference() {
     return [
         '# Publish to app directories',
         '',
-        'Directory requirements evolve — treat this as the workflow map and verify against the host’s current submission docs before submitting.',
+        '> Preparation is read-only unless the current user request explicitly authorizes the exact deploy, access change, host write, or submission target. A request to prepare must report missing readiness work and stop before mutation.',
+        '',
+        'Directory requirements evolve. Identify the requested directory first and verify its current official requirements before preparing directory-specific evidence.',
         '',
         '## Contents',
         '',
-        '- Readiness gate',
-        '- ChatGPT apps directory',
-        '- Claude connectors directory',
+        '- Shared readiness gate',
+        '- Directory-specific evidence',
+        '- Submission boundary',
         '',
-        '## Readiness gate',
+        '## Shared readiness gate',
         '',
         'Before any submission:',
         '',
-        '1. `noodle check --target chatgpt` must be clean — every widget needs `domain` (one https origin per app) and an exact `csp` (hosts require the CSP to list precisely the domains you fetch from).',
-        '2. Audit tool responses in developer mode: run realistic prompts and strip anything not strictly needed — PII, internal identifiers (session/trace/request IDs, internal account IDs), and any secrets.',
-        '3. The server must be deployed and publicly reachable: `noodle deploy`, confirm with `noodle open --print` and `noodle smoke`. Reviewers connect to the real endpoint — never submit a placeholder or loopback URL, and the access mode must not be `owner-only` (`noodle access set`).',
-        '4. Polish the listing surface: tool descriptions, widget titles, and the `server` branding tokens are what reviewers and users see.',
+        `Use \`${APP_DIRECTORY_COMPLIANCE_REFERENCE}\` as this route’s canonical shared compliance checklist.`,
+        '',
+        'Prepare evidence for a reachable production MCP endpoint, accurate capability descriptions and schemas, useful fallback behavior, realistic positive and negative tests, data minimization, privacy disclosures, support ownership, and any interactive surface the directory will review.',
         '',
-        '## ChatGPT apps directory',
+        '## Directory-specific evidence',
         '',
-        'Submit from the OpenAI developer dashboard (platform.openai.com → Apps):',
+        'Read the selected directory’s current official submission documentation at review time. Record each additional requirement separately from the shared checklist, including listing fields, identity verification, test credentials, screenshots, policy declarations, review limits, and appeal or resubmission steps. Never project one directory’s requirements onto another.',
         '',
-        '- Complete organization identity verification first (individual or business) — it is enforced at review time.',
-        '- The submission form asks for the app name, logo, description, company and privacy policy URLs, MCP server URL and tool information, screenshots, test prompts with expected responses, and localization details.',
-        '- One version may be published and one in review at a time; to revise a pending submission, cancel the review and resubmit rather than creating a new app.',
-        '- Review combines automated checks and manual evaluation; rejections come with feedback — fix and resubmit, or reply to appeal. An approved app is also distributed as a Codex plugin.',
+        'When a requirement cannot be verified from the selected directory’s current documentation or direct review evidence, mark it unknown instead of borrowing a rule from another host.',
         '',
-        '## Claude connectors directory',
+        '## Submission boundary',
         '',
-        'Anthropic runs a connectors directory for Claude; submission goes through Anthropic’s published process (see the Anthropic connectors directory FAQ on support.claude.com). The same readiness gate applies: deployed public endpoint, clean `noodle check`, and graceful degradation where Apps rendering is unavailable.',
+        'Preparation is read-only. Deployment, access changes, directory registration, and final submission each require explicit authorization for the exact target. Report remaining evidence gaps and stop when that authority or required directory access is absent.',
     ].join('\n');
 }
 // ----------------------------------------------------------------------------
-// references/chatgpt-compliance.md (CURATED)
+// references/app-directory-compliance.md (CURATED)
 // ----------------------------------------------------------------------------
-export function renderChatgptComplianceReference() {
+export function renderAppDirectoryComplianceReference() {
     return [
-        '# ChatGPT App compliance (pre-submission)',
+        '# App directory compliance (pre-submission)',
         '',
-        '`noodle check --target chatgpt` verifies the *metadata* prerequisites; app-store submission also faces a',
-        'human review against OpenAI’s Apps SDK UX principles. Run this checklist against the built app before',
-        'submitting, and render it as an audit table in the design wireframe (`design/wireframe.html` in the',
-        '`acme-*` examples) so partners and reviewers see it up front.',
+        'Use this shared checklist against the built integration before preparing a directory submission. It',
+        'covers evidence common to app and connector directories without assuming a particular host, review',
+        'portal, client framework, or vendor policy.',
         '',
         '## Contents',
         '',
-        '- Metadata gate vs review',
-        '- Pre-submission checklist',
-        '- UI guidelines',
-        '- Domain guardrails',
-        '- Privacy and data',
-        '',
-        '## Metadata gate vs review',
-        '',
-        '`noodle check --target chatgpt --json` returning `ok:true` means the widget is *metadata-ready* (widget',
-        '`domain`, `openai/outputTemplate`, CSP, tool annotations, and `invoking`/`invoked` invocation copy are',
-        'present) — it does NOT prove host rendering, conversation UX, or submission acceptance. Validate real',
-        'rendering in ChatGPT Developer Mode / MCP Inspector, then run the checklist below.',
-        '',
-        '## Pre-submission checklist (what review looks for)',
-        '',
-        '1. **Conversational value** — at least one capability relies on ChatGPT’s strengths: natural-language',
-        '   actions no tap-driven app can do (e.g. "two margheritas and a lemon tart" parses into a cart). Cite',
-        '   concrete app behavior, not aspirations.',
-        '2. **Beyond base ChatGPT** — new knowledge, actions, or presentation (grounded partner data, live',
-        '   inventory, signed handoffs, real-world routing).',
-        '3. **Atomic, model-friendly actions** — self-contained tools with explicit input/output schemas, and an',
-        '   annotation on every tool (`annotations.readOnly()` / `.action()` / `.openAction()`).',
-        '4. **Helpful UI only** — justify each widget (would plain text degrade UX?), and note what you',
-        '   deliberately did NOT build a widget for (payment is off-app → no payment widget).',
-        '5. **In-chat task completion** — the user finishes a meaningful task in chat. For a top-of-funnel app,',
-        '   the task is the discovery/config loop completed in-chat with an intentional handoff.',
-        '6. **Performance** — tool calls scoped per step; response-time targets stated.',
-        '7. **Discoverability** — broad, natural trigger prompts listed; description keywords planned. Golden',
-        '   prompt sets and metadata optimization are a launch workstream, not polish.',
-        '8. **Platform fit** — multi-turn dialogue, conversation memory, and multimodality where genuinely useful.',
-        '',
-        '## UI guidelines',
-        '',
-        'System fonts, monochrome outlined icons, WCAG AA contrast, at most two actions on inline cards, no nested',
-        'scroll, and the right display mode per intent (inline by default; fullscreen only where browsing needs',
-        'it; picture-in-picture only for live state). Brand only through `server` `branding` tokens — accent on',
-        'the primary CTA, logo, and badges, nothing else; the compiler derives the palette. Never inject raw',
-        'global CSS.',
-        '',
-        '## Domain guardrails',
-        '',
-        'For regulated-adjacent apps, add app-specific trust behaviors and **show them in the rendered pixels**:',
-        'cite the source and its revision for consequential lookups; frame regulated content as "considerations,',
-        'not a ruling"; never invent compatibility, availability, or pricing; and always show the relevant',
-        'caution/disclaimer. These are what make a regulated-adjacent app approvable.',
-        '',
-        '## Privacy and data',
-        '',
-        'Data flows through OpenAI; tool payloads and whatever the server stores must match the partner’s privacy',
-        'policy. No payment happens in chat (PCI stays off-app). Avoid per-user OAuth in a top-of-funnel v1 (use',
-        'service credentials via a `connector`); add end-user auth only for two-way apps (`customerAuth`). Keep',
-        'secrets out of tool output, widgets, and logs. If the partner’s published policy predates the app, flag a',
-        'privacy gap for their counsel before submission. Re-run this checklist against the *built* app before',
-        'every submission — not just the wireframe.',
+        '- Validation evidence',
+        '- Capability and interaction quality',
+        '- Safety, privacy, and data handling',
+        '- Reliability and accessibility',
+        '- Directory-specific delta',
+        '',
+        '## Validation evidence',
+        '',
+        'A clean local validation result proves only the checks that actually ran. Record server validation,',
+        'behavior tests, protocol conformance, production reachability, and interactive rendering as separate',
+        'evidence levels. Never treat metadata readiness as proof of host rendering or directory acceptance.',
+        '',
+        '## Capability and interaction quality',
+        '',
+        '1. **User value** — each exposed capability solves a concrete user job and cites built behavior rather',
+        '   than an aspiration.',
+        '2. **Grounded capability** — knowledge, actions, and presentation come from authoritative application',
+        '   data or bounded operations instead of invented state.',
+        '3. **Atomic interfaces** — every action has a focused purpose, explicit input and output schemas, honest',
+        '   effect annotations, and useful failure output.',
+        '4. **Helpful UI only** — every interactive surface earns its place and preserves a useful text or',
+        '   structured fallback when rendering is unavailable.',
+        '5. **Meaningful completion** — the user can complete the promised task within the declared boundary,',
+        '   with any external handoff clearly identified.',
+        '',
+        '## Safety, privacy, and data handling',
+        '',
+        '- Minimize model-visible and UI-visible data; remove secrets, internal identifiers, unnecessary personal',
+        '  data, and continuation credentials from results and logs.',
+        '- Document authentication, authorization scopes, retention, deletion, subprocessors, and external',
+        '  handoffs accurately in the public privacy and support material.',
+        '- Make mutations explicit, bounded, and confirmation-aware. Never imply that a read or preparation',
+        '  request authorizes a write.',
+        '- For regulated or consequential workflows, show source provenance, uncertainty, cautions, and the',
+        '  boundary between information and a professional decision.',
+        '',
+        '## Reliability and accessibility',
+        '',
+        '- Exercise representative positive, negative, empty, loading, error, and recovery cases against the',
+        '  production-shaped endpoint.',
+        '- Preserve keyboard access, readable contrast, responsive layout, concise status feedback, and graceful',
+        '  degradation when an interactive surface is unsupported.',
+        '- State latency, availability, rate-limit, and support expectations using observed evidence rather than',
+        '  unverified claims.',
+        '',
+        '## Directory-specific delta',
+        '',
+        'After the shared checklist passes, read the selected directory’s current official documentation and add',
+        'only its verified requirements. Keep directory-specific metadata, screenshots, test accounts, policy',
+        'statements, and review procedures in that submission evidence—not in this shared skill reference. Mark',
+        'unknown or untested requirements explicitly, and never reuse another directory’s checklist as a proxy.',
     ].join('\n');
 }
 //# sourceMappingURL=skill-operations-refs.js.map

package/node_modules/@noodle-borg/agent-kit/dist/skill-operations-refs.js.map

@@ -1 +1 @@
-{"version":3,"file":"skill-operations-refs.js","sourceRoot":"","sources":["../src/skill-operations-refs.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,+FAA+F;AAC/F,oFAAoF;AACpF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,+EAA+E;AAC/E,wCAAwC;AACxC,+EAA+E;AAE/E,MAAM,UAAU,0BAA0B;IACxC,OAAO;QACL,sBAAsB;QACtB,EAAE;QACF,2LAA2L;QAC3L,EAAE;QACF,aAAa;QACb,EAAE;QACF,0BAA0B;QAC1B,6CAA6C;QAC7C,4BAA4B;QAC5B,UAAU;QACV,iCAAiC;QACjC,kBAAkB;QAClB,EAAE;QACF,2BAA2B;QAC3B,EAAE;QACF,6OAA6O;QAC7O,EAAE;QACF,8CAA8C;QAC9C,EAAE;QACF,sXAAsX;QACtX,EAAE;QACF,6BAA6B;QAC7B,EAAE;QACF,sIAAsI;QACtI,gIAAgI;QAChI,sJAAsJ;QACtJ,6GAA6G;QAC7G,EAAE;QACF,WAAW;QACX,EAAE;QACF,wPAAwP;QACxP,EAAE;QACF,kCAAkC;QAClC,EAAE;QACF,2QAA2Q;QAC3Q,EAAE;QACF,mBAAmB;QACnB,EAAE;QACF,uZAAuZ;KACxZ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,0CAA0C;AAC1C,+EAA+E;AAE/E,MAAM,UAAU,8BAA8B;IAC5C,MAAM,IAAI,GAAqD;QAC7D;YACE,uDAAuD;YACvD,yEAAyE;YACzE,yLAAyL;SAC1L;QACD;YACE,uCAAuC;YACvC,8BAA8B;YAC9B,4DAA4D;SAC7D;QACD;YACE,0CAA0C;YAC1C,+DAA+D;YAC/D,qEAAqE;SACtE;QACD;YACE,wDAAwD;YACxD,8EAA8E;YAC9E,uHAAuH;SACxH;QACD;YACE,qCAAqC;YACrC,oEAAoE;YACpE,8HAA8H;SAC/H;QACD;YACE,oCAAoC;YACpC,4EAA4E;YAC5E,2IAA2I;SAC5I;QACD;YACE,qCAAqC;YACrC,yDAAyD;YACzD,kFAAkF;SACnF;QACD;YACE,2EAA2E;YAC3E,kFAAkF;YAClF,8EAA8E;SAC/E;QACD;YACE,uCAAuC;YACvC,8EAA8E;YAC9E,iHAAiH;SAClH;QACD;YACE,+BAA+B;YAC/B,6EAA6E;YAC7E,0JAA0J;SAC3J;QACD;YACE,+EAA+E;YAC/E,2LAA2L;YAC3L,iQAAiQ;SAClQ;QACD;YACE,8FAA8F;YAC9F,yJAAyJ;YACzJ,mJAAmJ;SACpJ;QACD;YACE,8FAA8F;YAC9F,+KAA+K;YAC/K,wSAAwS;SACzS;QACD;YACE,yCAAyC;YACzC,gIAAgI;YAChI,8VAA8V;SAC/V;QACD;YACE,6DAA6D;YAC7D,wFAAwF;YACxF,+MAA+M;SAChN;KACF,CAAC;IACF,OAAO;QACL,4BAA4B;QAC5B,EAAE;QACF,aAAa;QACb,EAAE;QACF,eAAe;QACf,eAAe;QACf,EAAE;QACF,gBAAgB;QAChB,EAAE;QACF,+cAA+c;QAC/c,EAAE;QACF,qPAAqP;QACrP,EAAE;QACF,gBAAgB;QAChB,EAAE;QACF,OAAO,CAAC,CAAC,SAAS,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC;KAClD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,yCAAyC;AACzC,+EAA+E;AAE/E,MAAM,UAAU,2BAA2B;IACzC,OAAO;QACL,yBAAyB;QACzB,EAAE;QACF,aAAa;QACb,EAAE;QACF,gBAAgB;QAChB,mBAAmB;QACnB,sBAAsB;QACtB,sCAAsC;QACtC,kCAAkC;QAClC,uBAAuB;QACvB,gBAAgB;QAChB,mBAAmB;QACnB,4BAA4B;QAC5B,0BAA0B;QAC1B,aAAa;QACb,EAAE;QACF,iBAAiB;QACjB,EAAE;QACF,sLAAsL;QACtL,EAAE;QACF,oBAAoB;QACpB,EAAE;QACF,4OAA4O;QAC5O,EAAE;QACF,uBAAuB;QACvB,EAAE;QACF,wNAAwN;QACxN,EAAE;QACF,uCAAuC;QACvC,EAAE;QACF,qgBAAqgB;QACrgB,EAAE;QACF,mCAAmC;QACnC,EAAE;QACF,0QAA0Q;QAC1Q,EAAE;QACF,wBAAwB;QACxB,EAAE;QACF,2MAA2M;QAC3M,EAAE;QACF,uIAAuI;QACvI,EAAE;QACF,SAAS;QACT,GAAG;QACH,mBAAmB;QACnB,qFAAqF;QACrF,KAAK;QACL,GAAG;QACH,KAAK;QACL,EAAE;QACF,yPAAyP;QACzP,iJAAiJ;QACjJ,6GAA6G;QAC7G,EAAE;QACF,iBAAiB;QACjB,EAAE;QACF,kLAAkL;QAClL,EAAE;QACF,oBAAoB;QACpB,EAAE;QACF,kHAAkH;QAClH,EAAE;QACF,6BAA6B;QAC7B,EAAE;QACF,iMAAiM;QACjM,EAAE;QACF,2BAA2B;QAC3B,EAAE;QACF,0EAA0E;QAC1E,EAAE;QACF,OAAO;QACP,2DAA2D;QAC3D,6GAA6G;QAC7G,8GAA8G;QAC9G,8HAA8H;QAC9H,6HAA6H;QAC7H,sFAAsF;QACtF,wBAAwB;QACxB,oBAAoB;QACpB,sBAAsB;QACtB,qBAAqB;QACrB,6BAA6B;QAC7B,KAAK;QACL,EAAE;QACF,+QAA+Q;QAC/Q,EAAE;QACF,kDAAkD;QAClD,EAAE;QACF,4uBAA4uB;KAC7uB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,qCAAqC;AACrC,+EAA+E;AAE/E,MAAM,UAAU,yBAAyB;IACvC,OAAO;QACL,8BAA8B;QAC9B,EAAE;QACF,yIAAyI;QACzI,EAAE;QACF,aAAa;QACb,EAAE;QACF,kBAAkB;QAClB,0BAA0B;QAC1B,+BAA+B;QAC/B,EAAE;QACF,mBAAmB;QACnB,EAAE;QACF,wBAAwB;QACxB,EAAE;QACF,oMAAoM;QACpM,yMAAyM;QACzM,yRAAyR;QACzR,qIAAqI;QACrI,EAAE;QACF,2BAA2B;QAC3B,EAAE;QACF,0EAA0E;QAC1E,EAAE;QACF,+GAA+G;QAC/G,oNAAoN;QACpN,4JAA4J;QAC5J,wLAAwL;QACxL,EAAE;QACF,gCAAgC;QAChC,EAAE;QACF,4TAA4T;KAC7T,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,6CAA6C;AAC7C,+EAA+E;AAE/E,MAAM,UAAU,gCAAgC;IAC9C,OAAO;QACL,2CAA2C;QAC3C,EAAE;QACF,0GAA0G;QAC1G,uGAAuG;QACvG,qGAAqG;QACrG,+DAA+D;QAC/D,EAAE;QACF,aAAa;QACb,EAAE;QACF,2BAA2B;QAC3B,4BAA4B;QAC5B,iBAAiB;QACjB,qBAAqB;QACrB,oBAAoB;QACpB,EAAE;QACF,4BAA4B;QAC5B,EAAE;QACF,yGAAyG;QACzG,wGAAwG;QACxG,uGAAuG;QACvG,oFAAoF;QACpF,EAAE;QACF,qDAAqD;QACrD,EAAE;QACF,uGAAuG;QACvG,wGAAwG;QACxG,4CAA4C;QAC5C,mGAAmG;QACnG,qDAAqD;QACrD,yGAAyG;QACzG,yFAAyF;QACzF,gGAAgG;QAChG,sFAAsF;QACtF,wGAAwG;QACxG,yFAAyF;QACzF,gFAAgF;QAChF,sGAAsG;QACtG,+EAA+E;QAC/E,2GAA2G;QAC3G,EAAE;QACF,kBAAkB;QAClB,EAAE;QACF,2GAA2G;QAC3G,wGAAwG;QACxG,wGAAwG;QACxG,qGAAqG;QACrG,aAAa;QACb,EAAE;QACF,sBAAsB;QACtB,EAAE;QACF,yGAAyG;QACzG,yGAAyG;QACzG,mGAAmG;QACnG,8EAA8E;QAC9E,EAAE;QACF,qBAAqB;QACrB,EAAE;QACF,0GAA0G;QAC1G,yGAAyG;QACzG,wGAAwG;QACxG,2GAA2G;QAC3G,uGAAuG;QACvG,4CAA4C;KAC7C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}
+{"version":3,"file":"skill-operations-refs.js","sourceRoot":"","sources":["../src/skill-operations-refs.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,+FAA+F;AAC/F,oFAAoF;AACpF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,kCAAkC,EAAE,MAAM,mBAAmB,CAAC;AAEvE,+EAA+E;AAC/E,wCAAwC;AACxC,+EAA+E;AAE/E,MAAM,UAAU,0BAA0B;IACxC,OAAO;QACL,sBAAsB;QACtB,EAAE;QACF,2LAA2L;QAC3L,EAAE;QACF,aAAa;QACb,EAAE;QACF,0BAA0B;QAC1B,6CAA6C;QAC7C,4BAA4B;QAC5B,UAAU;QACV,iCAAiC;QACjC,kBAAkB;QAClB,EAAE;QACF,2BAA2B;QAC3B,EAAE;QACF,6OAA6O;QAC7O,EAAE;QACF,8CAA8C;QAC9C,EAAE;QACF,sXAAsX;QACtX,EAAE;QACF,6BAA6B;QAC7B,EAAE;QACF,sIAAsI;QACtI,gIAAgI;QAChI,sJAAsJ;QACtJ,6GAA6G;QAC7G,EAAE;QACF,WAAW;QACX,EAAE;QACF,wPAAwP;QACxP,EAAE;QACF,kCAAkC;QAClC,EAAE;QACF,2QAA2Q;QAC3Q,EAAE;QACF,mBAAmB;QACnB,EAAE;QACF,uZAAuZ;KACxZ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,0CAA0C;AAC1C,+EAA+E;AAE/E,MAAM,UAAU,8BAA8B;IAC5C,MAAM,IAAI,GAAqD;QAC7D;YACE,uDAAuD;YACvD,yEAAyE;YACzE,yLAAyL;SAC1L;QACD;YACE,uCAAuC;YACvC,8BAA8B;YAC9B,4DAA4D;SAC7D;QACD;YACE,0CAA0C;YAC1C,+DAA+D;YAC/D,qEAAqE;SACtE;QACD;YACE,wDAAwD;YACxD,8EAA8E;YAC9E,uHAAuH;SACxH;QACD;YACE,qCAAqC;YACrC,oEAAoE;YACpE,8HAA8H;SAC/H;QACD;YACE,oCAAoC;YACpC,4EAA4E;YAC5E,2IAA2I;SAC5I;QACD;YACE,qCAAqC;YACrC,yDAAyD;YACzD,kFAAkF;SACnF;QACD;YACE,2EAA2E;YAC3E,kFAAkF;YAClF,8EAA8E;SAC/E;QACD;YACE,uCAAuC;YACvC,8EAA8E;YAC9E,iHAAiH;SAClH;QACD;YACE,+BAA+B;YAC/B,6EAA6E;YAC7E,0JAA0J;SAC3J;QACD;YACE,+EAA+E;YAC/E,2LAA2L;YAC3L,iQAAiQ;SAClQ;QACD;YACE,8FAA8F;YAC9F,yJAAyJ;YACzJ,mJAAmJ;SACpJ;QACD;YACE,8FAA8F;YAC9F,+KAA+K;YAC/K,wSAAwS;SACzS;QACD;YACE,yCAAyC;YACzC,gIAAgI;YAChI,8VAA8V;SAC/V;QACD;YACE,6DAA6D;YAC7D,wFAAwF;YACxF,+MAA+M;SAChN;KACF,CAAC;IACF,OAAO;QACL,4BAA4B;QAC5B,EAAE;QACF,aAAa;QACb,EAAE;QACF,eAAe;QACf,eAAe;QACf,EAAE;QACF,gBAAgB;QAChB,EAAE;QACF,+cAA+c;QAC/c,EAAE;QACF,qPAAqP;QACrP,EAAE;QACF,gBAAgB;QAChB,EAAE;QACF,OAAO,CAAC,CAAC,SAAS,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC;KAClD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,yCAAyC;AACzC,+EAA+E;AAE/E,MAAM,UAAU,4BAA4B;IAC1C,OAAO;QACL,wBAAwB;QACxB,EAAE;QACF,+HAA+H;QAC/H,EAAE;QACF,aAAa;QACb,EAAE;QACF,sHAAsH;QACtH,6FAA6F;QAC7F,EAAE;QACF,uBAAuB;QACvB,EAAE;QACF,yVAAyV;QACzV,EAAE;QACF,aAAa;QACb,EAAE;QACF,gKAAgK;QAChK,gNAAgN;QAChN,iMAAiM;QACjM,8LAA8L;QAC9L,sLAAsL;QACtL,EAAE;QACF,oBAAoB;QACpB,EAAE;QACF,uHAAuH;QACvH,yIAAyI;QACzI,0IAA0I;KAC3I,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,yCAAyC;AACzC,+EAA+E;AAE/E,MAAM,UAAU,2BAA2B;IACzC,OAAO;QACL,iCAAiC;QACjC,EAAE;QACF,+IAA+I;QAC/I,EAAE;QACF,mBAAmB;QACnB,EAAE;QACF,4EAA4E;QAC5E,sKAAsK;QACtK,oLAAoL;QACpL,EAAE;QACF,wBAAwB;QACxB,EAAE;QACF,2UAA2U;QAC3U,EAAE;QACF,4LAA4L;QAC5L,EAAE;QACF,iCAAiC;QACjC,EAAE;QACF,oUAAoU;QACpU,EAAE;QACF,iCAAiC;QACjC,EAAE;QACF,wEAAwE;QACxE,sGAAsG;QACtG,6HAA6H;KAC9H,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,qCAAqC;AACrC,+EAA+E;AAE/E,MAAM,UAAU,yBAAyB;IACvC,OAAO;QACL,8BAA8B;QAC9B,EAAE;QACF,uOAAuO;QACvO,EAAE;QACF,kKAAkK;QAClK,EAAE;QACF,aAAa;QACb,EAAE;QACF,yBAAyB;QACzB,+BAA+B;QAC/B,uBAAuB;QACvB,EAAE;QACF,0BAA0B;QAC1B,EAAE;QACF,wBAAwB;QACxB,EAAE;QACF,SAAS,kCAAkC,2DAA2D;QACtG,EAAE;QACF,4RAA4R;QAC5R,EAAE;QACF,gCAAgC;QAChC,EAAE;QACF,iXAAiX;QACjX,EAAE;QACF,qLAAqL;QACrL,EAAE;QACF,wBAAwB;QACxB,EAAE;QACF,kQAAkQ;KACnQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,mDAAmD;AACnD,+EAA+E;AAE/E,MAAM,UAAU,qCAAqC;IACnD,OAAO;QACL,6CAA6C;QAC7C,EAAE;QACF,qGAAqG;QACrG,oGAAoG;QACpG,6CAA6C;QAC7C,EAAE;QACF,aAAa;QACb,EAAE;QACF,uBAAuB;QACvB,sCAAsC;QACtC,sCAAsC;QACtC,iCAAiC;QACjC,4BAA4B;QAC5B,EAAE;QACF,wBAAwB;QACxB,EAAE;QACF,qGAAqG;QACrG,sGAAsG;QACtG,qGAAqG;QACrG,EAAE;QACF,uCAAuC;QACvC,EAAE;QACF,wGAAwG;QACxG,wBAAwB;QACxB,uGAAuG;QACvG,0DAA0D;QAC1D,0GAA0G;QAC1G,mDAAmD;QACnD,mGAAmG;QACnG,uDAAuD;QACvD,sGAAsG;QACtG,kDAAkD;QAClD,EAAE;QACF,uCAAuC;QACvC,EAAE;QACF,0GAA0G;QAC1G,6DAA6D;QAC7D,mGAAmG;QACnG,mEAAmE;QACnE,oGAAoG;QACpG,+BAA+B;QAC/B,oGAAoG;QACpG,6DAA6D;QAC7D,EAAE;QACF,kCAAkC;QAClC,EAAE;QACF,qGAAqG;QACrG,+BAA+B;QAC/B,yGAAyG;QACzG,2DAA2D;QAC3D,yGAAyG;QACzG,sBAAsB;QACtB,EAAE;QACF,6BAA6B;QAC7B,EAAE;QACF,yGAAyG;QACzG,sGAAsG;QACtG,wGAAwG;QACxG,wGAAwG;KACzG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/node_modules/@noodle-borg/agent-kit/dist/skill-router.d.ts

@@ -0,0 +1,17 @@
+import type { AgentTarget } from './index.js';
+export declare const SKILL_DESCRIPTION: string;
+export type SkillReferencePath = `references/${string}.md`;
+export declare const APP_DIRECTORY_COMPLIANCE_REFERENCE: SkillReferencePath;
+export type SkillRouteId = 'build-server' | 'connect-api' | 'build-app' | 'verify-recover' | 'inspect-hosted' | 'deploy-hosted' | 'embed-assistant' | 'publish' | 'feedback';
+export interface SkillRoute {
+    readonly id: SkillRouteId;
+    readonly intent: string;
+    readonly primaryReference: SkillReferencePath;
+    readonly supportingReferences: readonly SkillReferencePath[];
+    readonly exitCondition: string;
+}
+export declare const SKILL_ROUTES: readonly SkillRoute[];
+/** Complete lookup catalog. Routes above, not this inventory, own discovery. */
+export declare const REFERENCE_INDEX_LINES: readonly string[];
+export declare function skillRouterBody(_target: AgentTarget): string;
+//# sourceMappingURL=skill-router.d.ts.map

package/node_modules/@noodle-borg/agent-kit/dist/skill-router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-router.d.ts","sourceRoot":"","sources":["../src/skill-router.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,eAAO,MAAM,iBAAiB,QAEmC,CAAC;AAElE,MAAM,MAAM,kBAAkB,GAAG,cAAc,MAAM,KAAK,CAAC;AAE3D,eAAO,MAAM,kCAAkC,EAAE,kBACP,CAAC;AAE3C,MAAM,MAAM,YAAY,GACpB,cAAc,GACd,aAAa,GACb,WAAW,GACX,gBAAgB,GAChB,gBAAgB,GAChB,eAAe,GACf,iBAAiB,GACjB,SAAS,GACT,UAAU,CAAC;AAEf,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;IAC9C,QAAQ,CAAC,oBAAoB,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC7D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,eAAO,MAAM,YAAY,EAAE,SAAS,UAAU,EA2E7C,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAqBlD,CAAC;AAgBF,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAwD5D"}

package/node_modules/@noodle-borg/agent-kit/dist/skill-router.js

@@ -0,0 +1,160 @@
+export const SKILL_DESCRIPTION = 'Use when building, validating, testing, deploying, or operating a local or hosted Noodle Seed ' +
+    'MCP server or app authored in TypeScript with the noodle CLI.';
+export const APP_DIRECTORY_COMPLIANCE_REFERENCE = 'references/app-directory-compliance.md';
+export const SKILL_ROUTES = [
+    {
+        id: 'build-server',
+        intent: 'Create or extend a headless MCP server whose external API contract is already modeled',
+        primaryReference: 'references/build-an-mcp-server.md',
+        supportingReferences: ['references/authoring-workflow.md', 'references/sdk-surface.md'],
+        exitCondition: 'The requested server behavior is locally validated and tested; connector reads have real-output evidence.',
+    },
+    {
+        id: 'connect-api',
+        intent: 'Connect a real API when credentials or an API specification are available',
+        primaryReference: 'references/connect-an-api.md',
+        supportingReferences: ['references/authoring-workflow.md'],
+        exitCondition: 'A representative live read returns populated, intentionally mapped fields without exposing credentials.',
+    },
+    {
+        id: 'build-app',
+        intent: 'Build or change an MCP App, widget, or host-visible UI',
+        primaryReference: 'references/build-an-mcp-app.md',
+        supportingReferences: ['references/experience-design.md', 'references/widgets-and-apps.md'],
+        exitCondition: 'The UI has a stated user benefit, passes the requested checks, and degrades to useful text.',
+    },
+    {
+        id: 'verify-recover',
+        intent: 'Validate, test, diagnose, or recover a failing local or hosted project',
+        primaryReference: 'references/verify-and-recover.md',
+        supportingReferences: ['references/agent-contract.md', 'references/compile-errors.md'],
+        exitCondition: 'The failing evidence layer is repaired and rerun, or the remaining blocker and exact next action are reported.',
+    },
+    {
+        id: 'inspect-hosted',
+        intent: 'Inspect or diagnose hosted status, logs, metrics, events, or deployment metadata read-only',
+        primaryReference: 'references/inspect-hosted.md',
+        supportingReferences: [],
+        exitCondition: 'The requested hosted evidence is reported without changing target, configuration, access, or deployment state.',
+    },
+    {
+        id: 'deploy-hosted',
+        intent: 'Deploy, configure, connect with writes, change access, or roll back a hosted MCP service when explicitly requested',
+        primaryReference: 'references/deploy-and-ops.md',
+        supportingReferences: ['references/cli-commands.md'],
+        exitCondition: 'The requested hosted state is evidenced without claiming unperformed host or production checks.',
+    },
+    {
+        id: 'embed-assistant',
+        intent: 'Embed a Noodle assistant in an existing SaaS or web application',
+        primaryReference: 'references/embedded-assistant.md',
+        supportingReferences: ['references/authoring-workflow.md'],
+        exitCondition: 'The requested embed boundary works with verified identity and credential separation at the tested level.',
+    },
+    {
+        id: 'publish',
+        intent: 'Prepare or submit an integration to a host directory',
+        primaryReference: 'references/publishing.md',
+        supportingReferences: [APP_DIRECTORY_COMPLIANCE_REFERENCE],
+        exitCondition: 'The requested submission evidence is complete and any host-review uncertainty is explicit.',
+    },
+    {
+        id: 'feedback',
+        intent: 'Report a Noodle Seed bug, documentation gap, or product improvement',
+        primaryReference: 'references/feedback.md',
+        supportingReferences: [],
+        exitCondition: 'A sanitized command is shown to the user and is submitted only after explicit approval.',
+    },
+];
+/** Complete lookup catalog. Routes above, not this inventory, own discovery. */
+export const REFERENCE_INDEX_LINES = [
+    '- `references/agent-contract.md` — the `--json` envelope, exit codes, and the three output modes.',
+    '- `references/sdk-surface.md` — what to import from `@noodleseed/one` and which builder to use.',
+    '- `references/cli-commands.md` — every `noodle` command, grouped by area.',
+    '- `references/compile-errors.md` — fix `noodle validate` errors by code.',
+    '- `references/build-an-mcp-server.md` — outcome-first workflow for a focused, tested, model-facing MCP product.',
+    '- `references/authoring-workflow.md` — input paths, fit checks, connector patterns, authentication, tool design, testing, and managed config.',
+    '- `references/embedded-assistant.md` — HTTPS origins, managed model config, deploy sequencing, session exchange, browser mounting, and credential boundaries.',
+    '- `references/connect-an-api.md` — secure credentials, probe the live API, model the observed shape, and prove real output.',
+    '- `references/build-an-mcp-app.md` — product-fit, output-boundary, fallback, and evidence workflow for an MCP App.',
+    '- `references/experience-design.md` — design an app experience: funnel boundary, grounding, two users, display modes, and wireframe.',
+    '- `references/widgets-and-apps.md` — MCP Apps, typed views, widget hooks, output shaping, and CSP.',
+    '- `references/test-in-hosts.md` — connect and test in real MCP hosts and protocol inspection clients.',
+    '- `references/verify-and-recover.md` — ordered evidence ladder, bounded repair, and honest completion claims.',
+    '- `references/troubleshooting.md` — runtime symptom to cause and fix, locally and hosted.',
+    '- `references/inspect-hosted.md` — read-only hosted status, logs, metrics, events, and deployment diagnosis.',
+    '- `references/deploy-and-ops.md` — explicitly authorized hosted link, config, deploy, access, connection writes, and rollback.',
+    '- `references/publishing.md` — prepare and submit to app and connector directories.',
+    `- \`${APP_DIRECTORY_COMPLIANCE_REFERENCE}\` — the pre-submission experience and policy checklist.`,
+    '- `references/examples.md` — flagship example index and a canonical `server.ts`.',
+    '- `references/feedback.md` — draft sanitized product feedback and submit only with user approval.',
+];
+function routeTableLines() {
+    return [
+        '| User outcome | Primary reference | Supporting references only when needed | Done when |',
+        '| :--- | :--- | :--- | :--- |',
+        ...SKILL_ROUTES.map((route) => {
+            const supporting = route.supportingReferences.length > 0
+                ? route.supportingReferences.map((reference) => `\`${reference}\``).join(', ')
+                : 'None';
+            return `| ${route.intent} | \`${route.primaryReference}\` | ${supporting} | ${route.exitCondition} |`;
+        }),
+    ];
+}
+export function skillRouterBody(_target) {
+    const preamble = 'Use this skill for project-local Noodle Seed authoring in the active coding host; preserve generated and user instruction boundaries.';
+    return [
+        '# Noodle Seed',
+        '',
+        'Build, validate, test, deploy, and operate Noodle Seed MCP servers and apps authored in TypeScript with the `noodle` CLI. Author from the configured entrypoint (usually `server.ts`); keep the authoring surface TypeScript-only.',
+        '',
+        preamble,
+        '',
+        "If the request is unrelated to the Noodle MCP surface, stop here: follow the project's normal instructions and run no Noodle lifecycle commands.",
+        '',
+        "**Installed-plugin execution.** When this skill is supplied by the Noodle Developer plugin, preserve the managed invocation path established by the plugin bootstrap and invoke every `noodle` command through that host bundle's managed launcher. Do not install or update a global CLI. Noodle guides and operates the lifecycle; you write and test the application source in the user's project.",
+        '',
+        '## Route the request',
+        '',
+        'Choose exactly one primary route from the user outcome below. Read that primary reference in full, then begin the work. Read supporting references only when the primary workflow sends you there or the named evidence exposes that concern. Stop discovery once the route is selected.',
+        '',
+        'Apply this precedence when wording overlaps: diagnosis of an existing failure takes the verification route; an MCP App/UI outcome takes the App route; external API integration from credentials, a URL, or an API specification takes precedence over generic server building; hosted inspection is the read-only route; hosted mutation requires the explicitly requested deployment route.',
+        '',
+        'Negative routing examples: “Inspect hosted logs/status” → `inspect-hosted` (read-only). “Prepare for deployment” → the applicable build or verification route and stop with a handoff; preparation does not authorize `link`, hosted config, deployment, rollback, host writes, or submission. “Keep this local” → a build or verification route, never a hosted route.',
+        '',
+        ...routeTableLines(),
+        '',
+        '## Common machine loop',
+        '',
+        'The cold-agent commands speak the `--json` envelope. Parse machine state instead of scraping human prose; `references/agent-contract.md` owns the envelope and exit codes.',
+        '',
+        "1. **Discover** — use `noodle commands --json` when the required command or flags are uncertain; don't read CLI source.",
+        '2. **Author** — for build routes, edit the configured TypeScript entrypoint, usually `src/server.ts`.',
+        '3. **Validate** — run `noodle validate --json`; repair each `error.errors[]` item at its `path`, then re-run `noodle validate --json`.',
+        '4. **Smoke** — run `noodle test --json` after validation passes.',
+        '5. **Prove the requested level** — connector routes require a safe live read with `noodle tools call`; App routes require `noodle check --json` and `noodle devtools`; hosted or host actions run only when the selected route and current user request authorize that exact level.',
+        '6. **Report evidence** — claim only the highest level actually exercised and name anything not run.',
+        '',
+        '## Reference lookup catalog',
+        '',
+        'This is a lookup catalog, not a discovery checklist. Return here only when the selected primary route names a missing technical detail:',
+        '',
+        ...REFERENCE_INDEX_LINES,
+        '',
+        '## Product feedback',
+        '',
+        'When you discover a bug, missing capability, misleading doc, or improvement idea, draft one sanitized `noodle feedback` command per finding. Show the user the exact command and ask for explicit user approval. Do not run or submit it until approval is given. Follow `references/feedback.md`; never include customer code, secrets, personal data, or identifying project details.',
+        '',
+        '## Safety',
+        '',
+        '- Keep secrets, bearer tokens, refresh tokens, static access keys, `.env.noodle` values, and `~/.noodle/config.json` out of prompts, logs, docs, tests, and generated files.',
+        '- Do not hand-author manifest JSON/YAML, runtime artifacts, connector IR, or hosted asset metadata.',
+        '- Do not add static data-plane credential paths; hosted access is identity-based.',
+        '- Hosted mutation is opt-in. Run `link`, hosted secret/variable/config/access changes, deploy, rollback, host configuration writes, or directory submission only when the current user request explicitly authorizes the exact mutation and target. An inspect, prepare, validate, test, or local-only request grants no such authority; stop and ask before crossing that boundary.',
+        '',
+        '## Customization',
+        '',
+        'This skill is regenerated by `noodle agents setup --write`. For project-specific standards, create a separate skill; do not edit this file or its references.',
+    ].join('\n');
+}
+//# sourceMappingURL=skill-router.js.map

package/node_modules/@noodle-borg/agent-kit/dist/skill-router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-router.js","sourceRoot":"","sources":["../src/skill-router.ts"],"names":[],"mappings":"AAKA,MAAM,CAAC,MAAM,iBAAiB,GAC5B,gGAAgG;IAChG,+DAA+D,CAAC;AAIlE,MAAM,CAAC,MAAM,kCAAkC,GAC7C,wCAAwC,CAAC;AAqB3C,MAAM,CAAC,MAAM,YAAY,GAA0B;IACjD;QACE,EAAE,EAAE,cAAc;QAClB,MAAM,EAAE,uFAAuF;QAC/F,gBAAgB,EAAE,mCAAmC;QACrD,oBAAoB,EAAE,CAAC,kCAAkC,EAAE,2BAA2B,CAAC;QACvF,aAAa,EACX,2GAA2G;KAC9G;IACD;QACE,EAAE,EAAE,aAAa;QACjB,MAAM,EAAE,2EAA2E;QACnF,gBAAgB,EAAE,8BAA8B;QAChD,oBAAoB,EAAE,CAAC,kCAAkC,CAAC;QAC1D,aAAa,EACX,yGAAyG;KAC5G;IACD;QACE,EAAE,EAAE,WAAW;QACf,MAAM,EAAE,wDAAwD;QAChE,gBAAgB,EAAE,gCAAgC;QAClD,oBAAoB,EAAE,CAAC,iCAAiC,EAAE,gCAAgC,CAAC;QAC3F,aAAa,EACX,6FAA6F;KAChG;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,MAAM,EAAE,wEAAwE;QAChF,gBAAgB,EAAE,kCAAkC;QACpD,oBAAoB,EAAE,CAAC,8BAA8B,EAAE,8BAA8B,CAAC;QACtF,aAAa,EACX,gHAAgH;KACnH;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,MAAM,EACJ,4FAA4F;QAC9F,gBAAgB,EAAE,8BAA8B;QAChD,oBAAoB,EAAE,EAAE;QACxB,aAAa,EACX,gHAAgH;KACnH;IACD;QACE,EAAE,EAAE,eAAe;QACnB,MAAM,EACJ,oHAAoH;QACtH,gBAAgB,EAAE,8BAA8B;QAChD,oBAAoB,EAAE,CAAC,4BAA4B,CAAC;QACpD,aAAa,EACX,iGAAiG;KACpG;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,MAAM,EAAE,iEAAiE;QACzE,gBAAgB,EAAE,kCAAkC;QACpD,oBAAoB,EAAE,CAAC,kCAAkC,CAAC;QAC1D,aAAa,EACX,0GAA0G;KAC7G;IACD;QACE,EAAE,EAAE,SAAS;QACb,MAAM,EAAE,sDAAsD;QAC9D,gBAAgB,EAAE,0BAA0B;QAC5C,oBAAoB,EAAE,CAAC,kCAAkC,CAAC;QAC1D,aAAa,EACX,4FAA4F;KAC/F;IACD;QACE,EAAE,EAAE,UAAU;QACd,MAAM,EAAE,qEAAqE;QAC7E,gBAAgB,EAAE,wBAAwB;QAC1C,oBAAoB,EAAE,EAAE;QACxB,aAAa,EACX,yFAAyF;KAC5F;CACF,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,mGAAmG;IACnG,iGAAiG;IACjG,2EAA2E;IAC3E,0EAA0E;IAC1E,iHAAiH;IACjH,+IAA+I;IAC/I,+JAA+J;IAC/J,6HAA6H;IAC7H,oHAAoH;IACpH,sIAAsI;IACtI,oGAAoG;IACpG,uGAAuG;IACvG,+GAA+G;IAC/G,2FAA2F;IAC3F,8GAA8G;IAC9G,gIAAgI;IAChI,qFAAqF;IACrF,OAAO,kCAAkC,0DAA0D;IACnG,kFAAkF;IAClF,mGAAmG;CACpG,CAAC;AAEF,SAAS,eAAe;IACtB,OAAO;QACL,2FAA2F;QAC3F,+BAA+B;QAC/B,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAC5B,MAAM,UAAU,GACd,KAAK,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC;gBACnC,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC9E,CAAC,CAAC,MAAM,CAAC;YACb,OAAO,KAAK,KAAK,CAAC,MAAM,QAAQ,KAAK,CAAC,gBAAgB,QAAQ,UAAU,MAAM,KAAK,CAAC,aAAa,IAAI,CAAC;QACxG,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAoB;IAClD,MAAM,QAAQ,GACZ,uIAAuI,CAAC;IAC1I,OAAO;QACL,eAAe;QACf,EAAE;QACF,oOAAoO;QACpO,EAAE;QACF,QAAQ;QACR,EAAE;QACF,kJAAkJ;QAClJ,EAAE;QACF,uYAAuY;QACvY,EAAE;QACF,sBAAsB;QACtB,EAAE;QACF,0RAA0R;QAC1R,EAAE;QACF,+XAA+X;QAC/X,EAAE;QACF,yWAAyW;QACzW,EAAE;QACF,GAAG,eAAe,EAAE;QACpB,EAAE;QACF,wBAAwB;QACxB,EAAE;QACF,4KAA4K;QAC5K,EAAE;QACF,yHAAyH;QACzH,uGAAuG;QACvG,wIAAwI;QACxI,kEAAkE;QAClE,qRAAqR;QACrR,qGAAqG;QACrG,EAAE;QACF,6BAA6B;QAC7B,EAAE;QACF,yIAAyI;QACzI,EAAE;QACF,GAAG,qBAAqB;QACxB,EAAE;QACF,qBAAqB;QACrB,EAAE;QACF,yXAAyX;QACzX,EAAE;QACF,WAAW;QACX,EAAE;QACF,8KAA8K;QAC9K,qGAAqG;QACrG,mFAAmF;QACnF,sXAAsX;QACtX,EAAE;QACF,kBAAkB;QAClB,EAAE;QACF,+JAA+J;KAChK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/node_modules/@noodle-borg/agent-kit/dist/skill-server-playbook-ref.d.ts

@@ -0,0 +1,2 @@
+export declare function renderBuildAnMcpServerReference(): string;
+//# sourceMappingURL=skill-server-playbook-ref.d.ts.map

package/node_modules/@noodle-borg/agent-kit/dist/skill-server-playbook-ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-server-playbook-ref.d.ts","sourceRoot":"","sources":["../src/skill-server-playbook-ref.ts"],"names":[],"mappings":"AAGA,wBAAgB,+BAA+B,IAAI,MAAM,CAyDxD"}