@noodleseed/one 0.73.1 → 0.74.0

package/node_modules/@noodle-borg/agent-kit/dist/generated/example-files.js

@@ -49,7 +49,7 @@ export const BUNDLED_EXAMPLE_FILES = [
     { relPath: "examples/acme-tasks/src/views/widget-style.css", content: ":root {\n  color-scheme: light dark;\n  font-family:\n    Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif;\n  --nw-bg: #ffffff;\n  --nw-surface: #f7f5ff;\n  --nw-text: #1c1830;\n  --nw-muted: #635d80;\n  --nw-border: #e2ddf5;\n  --nw-accent: #7c3aed;\n  --nw-accent-strong: #6d28d9;\n  --nw-accent-soft: #efe9ff;\n  --nw-high: #dc2626;\n  --nw-medium: #b45309;\n  --nw-low: #2563eb;\n  --nw-radius: 10px;\n  --nw-shadow: 0 18px 50px rgb(30 20 60 / 12%);\n}\n\n.dark,\n[data-theme=\"dark\"] {\n  --nw-bg: #161228;\n  --nw-surface: #1d1735;\n  --nw-text: #f2eeff;\n  --nw-muted: #a99fce;\n  --nw-border: #342a54;\n  --nw-accent: #a78bfa;\n  --nw-accent-strong: #8b5cf6;\n  --nw-accent-soft: #2a2148;\n  --nw-high: #f87171;\n  --nw-medium: #fbbf24;\n  --nw-low: #60a5fa;\n  --nw-shadow: 0 18px 50px rgb(0 0 0 / 32%);\n}\n\n* {\n  box-sizing: border-box;\n}\n\nbody {\n  margin: 0;\n  background: var(--nw-bg);\n  color: var(--nw-text);\n}\n\nbutton,\ninput,\nselect {\n  font: inherit;\n}\n\n.nw-shell {\n  min-height: 100vh;\n  padding: 14px;\n  background: var(--nw-bg);\n  color: var(--nw-text);\n}\n\n.nw-card {\n  max-width: 620px;\n  margin: 0 auto;\n  background: var(--nw-surface);\n  border: 1px solid var(--nw-border);\n  border-radius: var(--nw-radius);\n  box-shadow: var(--nw-shadow);\n  overflow: hidden;\n}\n\n.nw-header {\n  display: flex;\n  align-items: center;\n  gap: 12px;\n  padding: 16px;\n  border-bottom: 1px solid var(--nw-border);\n}\n\n.nw-icon svg {\n  width: 24px;\n  height: 24px;\n  fill: none;\n  stroke: var(--nw-accent);\n  stroke-width: 2;\n  stroke-linecap: round;\n  stroke-linejoin: round;\n}\n\n.nw-title-block {\n  flex: 1;\n  min-width: 0;\n}\n\n.nw-title {\n  margin: 0;\n  font-size: 17px;\n  font-weight: 700;\n}\n\n.nw-subtitle {\n  margin: 2px 0 0;\n  font-size: 13px;\n  color: var(--nw-muted);\n}\n\n.nw-chip {\n  padding: 4px 10px;\n  border-radius: 999px;\n  background: var(--nw-accent-soft);\n  color: var(--nw-accent-strong);\n  font-size: 12px;\n  font-weight: 600;\n}\n\n.nw-capture {\n  display: flex;\n  gap: 8px;\n  padding: 14px 16px 4px;\n}\n\n.nw-input {\n  flex: 1;\n  padding: 9px 12px;\n  border: 1px solid var(--nw-border);\n  border-radius: 10px;\n  background: var(--nw-bg);\n  color: var(--nw-text);\n}\n\n.nw-button {\n  display: inline-flex;\n  align-items: center;\n  gap: 6px;\n  padding: 9px 14px;\n  border: 1px solid var(--nw-border);\n  border-radius: 10px;\n  background: var(--nw-bg);\n  color: var(--nw-text);\n  cursor: pointer;\n}\n\n.nw-button-primary {\n  background: var(--nw-accent);\n  border-color: var(--nw-accent);\n  color: #ffffff;\n  font-weight: 600;\n}\n\n.nw-button-primary:disabled {\n  opacity: 0.6;\n  cursor: default;\n}\n\n.nw-list {\n  list-style: none;\n  margin: 0;\n  padding: 8px 16px 4px;\n  display: flex;\n  flex-direction: column;\n  gap: 8px;\n}\n\n.nw-task {\n  display: flex;\n  align-items: center;\n  gap: 10px;\n  padding: 10px 12px;\n  border: 1px solid var(--nw-border);\n  border-radius: 12px;\n  background: var(--nw-bg);\n}\n\n.nw-task-title {\n  flex: 1;\n  min-width: 0;\n}\n\n.nw-task-done {\n  opacity: 0.55;\n}\n\n.nw-task-done .nw-task-title {\n  text-decoration: line-through;\n}\n\n.nw-check {\n  width: 22px;\n  height: 22px;\n  border: 1.5px solid var(--nw-border);\n  border-radius: 999px;\n  background: transparent;\n  color: #ffffff;\n  cursor: pointer;\n  flex: none;\n}\n\n.nw-check-on {\n  background: var(--nw-accent);\n  border-color: var(--nw-accent);\n}\n\n.nw-priority {\n  padding: 5px 8px;\n  border: 1px solid var(--nw-border);\n  border-radius: 8px;\n  background: var(--nw-bg);\n  color: var(--nw-text);\n  font-size: 12px;\n  font-weight: 600;\n}\n\n.nw-priority-high {\n  color: var(--nw-high);\n}\n\n.nw-priority-medium {\n  color: var(--nw-medium);\n}\n\n.nw-priority-low {\n  color: var(--nw-low);\n}\n\n.nw-note {\n  margin: 0;\n  padding: 8px 16px 16px;\n  font-size: 12px;\n  color: var(--nw-muted);\n}\n" },
     { relPath: "examples/acme-tasks/test/server.test.ts", content: "import { describe, expect, it } from 'vitest';\nimport app from '../src/server.js';\n\ndescribe('acme-tasks example', () => {\n  it('exports a Noodle server definition', () => {\n    expect(typeof app.toManifest).toBe('function');\n  });\n\n  it('exposes a tool for each of the top-3 prioritized flows', async () => {\n    // Capture → add_task, Prioritize → list_today (+ set_priority helper), Complete → complete_task.\n    const text = JSON.stringify(await app.toManifest());\n    expect(text).toContain('add_task');\n    expect(text).toContain('list_today');\n    expect(text).toContain('complete_task');\n    expect(text).toContain('set_priority');\n  });\n\n  it('seeds today’s list highest-priority first', async () => {\n    const text = JSON.stringify(await app.toManifest());\n    expect(text).toMatch(/\"tasks\":\\[\\{\"id\":\"email_vendor\".*\"priority\":\"high\"/);\n  });\n\n  it('opts the conversational completion action into runtime confirmation', async () => {\n    const manifest = await app.toManifest();\n    const completeTask = manifest.tools.find((candidate) => candidate.name === 'complete_task');\n    const addTask = manifest.tools.find((candidate) => candidate.name === 'add_task');\n\n    expect(completeTask?.annotations?.confirm).toBe(true);\n    expect(addTask?.annotations).not.toHaveProperty('confirm');\n  });\n});\n" },
     { relPath: "examples/acme-tasks/vitest.config.ts", content: "import { defineConfig } from 'vitest/config';\n\n// Local config so `npm test` (vitest run) discovers this example's own tests instead of inheriting a\n// parent monorepo config's include globs.\nexport default defineConfig({\n  test: { include: ['test/**/*.test.ts'] },\n});\n" },
-    { relPath: "examples/customer-auth/README.md", content: "# Customer Auth - NoodleSeed.com Firebase customer identity\n\nThis curated example owns the customer/end-user authentication with Firebase bridge capability slot. It is\nthe NoodleSeed.com dogfood app for proving that a SaaS app can protect an MCP endpoint with its own customer\nidentity provider while still using the generic Noodle Seed authoring API.\n\nIt also owns the embedded-assistant showcase: the same authenticated MCP surface can be dropped into the\nSaaS web application as a fully customer-branded assistant with independent light and dark themes. The\nassistant loads the active deployment's instructions and model-visible tools rather than installing a stale\nsecond skill bundle. The standard embedded element also hosts linked MCP Apps behind its sandbox bridge.\n\nThe public developer entrypoint is [`src/server.ts`](src/server.ts). It declares `customerAuth.firebase(...)` with\nthe NoodleSeed.com Firebase project and Firebase Web App public config. It exposes a deliberately small MCP\nsurface for org discovery:\n\n- `list_my_organizations` lists the NoodleSeed.com organizations the signed-in customer belongs to (no\n  arguments — the org set comes from the verified customer session).\n- `list_org_apps` lists apps for one of those organizations through the dev app API.\n\nThe two tools chain: `list_my_organizations` surfaces the `org_id`s the customer can act on, and\n`list_org_apps` takes one of those `org_id`s. There is no NoodleSeed-specific SDK helper. The downstream API\nis an ordinary authored HTTP connector.\n\nDuring MCP OAuth login, Noodle Cloud hosts the Firebase bridge page at\n`https://cloud.noodleseed.dev/oauth/customer/firebase/authorize`. The customer app does not add an\nauthorization route. The SaaS operator only configures Firebase Auth to allow the Noodle Cloud origin, and\nNoodle Cloud signs the customer in with Firebase before posting the Firebase ID token back to its own bridge\ncallback.\n\n## How delegated customer credentials are used\n\nThis flagship uses the legacy Firebase provider bridge because it is runnable today. That is distinct from\nCore-v2 account-selecting connector aliases: those declare catalog `credentialProfiles` and bind each alias\nwith `bind(connector, { profile, connection })`. Hosted bound `managedSecret(...)` connections are runnable;\nbound `externalExchange()` and `clientCredentials(...)` currently compile as portable metadata but fail\nclosed before secret or network access until their provider slice lands. Do not replace this example's\nworking delegated-session-cookie path with either unsupported bound exchange source.\n\nThe example has two declarations that work together:\n\n```ts\nauth: customerAuth.firebase({\n  projectId: variable('FIREBASE_PROJECT_ID'),\n  apiKey: variable('FIREBASE_WEB_API_KEY'),\n  authDomain: variable('FIREBASE_AUTH_DOMAIN'),\n  user: {\n    id: 'sub',\n    email: 'email',\n    name: 'name',\n    tenant: 'firebase.tenant',\n    orgs: 'claims.orgs',\n    roles: 'claims.roles',\n  },\n}),\n```\n\nThat protects the MCP endpoint with the SaaS customer's Firebase identity. The connector then opts into\ndelegated customer credentials:\n\n```ts\nauth: {\n  kind: 'delegatedSessionCookie',\n  provider: 'firebase',\n  sessionUrl: `${noodleseedApiOrigin}/api/auth/session`,\n  tokenField: 'idToken',\n},\n```\n\nTool code calls the connector normally:\n\n```ts\nfulfil({ input, connectors }) {\n  const apps = connectors.app_api.listOrgApps({\n    org_id: input.org_id,\n    skip: input.skip,\n    limit: input.limit,\n  });\n\n  return { result: apps.result };\n}\n```\n\nAt runtime, Noodle Seed verifies the Firebase customer during MCP OAuth, stores that customer's delegated\nFirebase refresh token in the credential broker, and refreshes a short-lived Firebase ID token only when a\nconnector-backed tool calls the NoodleSeed.com API. For this app API, the broker exchanges that ID token at\nthe existing Next.js `/api/auth/session` route and sends the resulting session cookie to the API. The MCP\naccess token remains a Noodle-issued resource-bound token and is never sent to the downstream API.\n\n## Delegated downstream auth for your own API (token exchange)\n\nThe Firebase path above only works for Firebase-session downstreams. When the downstream is **your own\nAPI** with its own token issuance, use `delegatedTokenExchange` instead\n([ADR 0152](../../docs/decisions/0152-delegated-token-exchange-connector-auth.md)): the platform signs a\nshort-lived, JWKS-verifiable assertion of the signed-in user and exchanges it (RFC 8693) at a token\nendpoint you implement, which mints your own user-scoped token — so your API enforces its own per-user\nauthorization on every call. It works for verified direct/federated OIDC, built-in provider identities, and\nembedded assistant sessions, with no per-user OAuth enrollment.\n\n```ts\nauth: {\n  kind: 'delegatedTokenExchange',\n  tokenUrl: 'https://app.example.com/api/assistant/oauth/token', // origin must be in allowedOrigins\n  clientId: variable('EXAMPLE_DELEG_CLIENT_ID'),\n  clientSecret: secret('EXAMPLE_DELEG_CLIENT_SECRET'),\n  scopes: ['time_off'],\n},\n```\n\nYour endpoint authenticates the broker's client credential, verifies the `subject_token` JWT against the\nplatform issuer JWKS (claims include the verified `sub`, `email`, `name`, declared session `claims`,\n`tenant`, and `deployment`), mints a short-lived user-scoped token, and returns the standard\n`{ access_token, token_type, expires_in }` response. The exact wire contract and a copyable endpoint\nimplementation live in [docs/spec/connectors.md](../../docs/spec/connectors.md) and the Agent Kit\nauthoring-workflow reference (\"Delegated downstream auth\"). `noodle auth doctor` reports each declared\nexchange endpoint.\n\n## Validate\n\n```bash\nnoodle auth doctor examples/customer-auth/src/server.ts\nnoodle validate examples/customer-auth/src/server.ts\n```\n\nAgainst a deployed customer-protected environment, set a short-lived real customer token only in\n`NOODLE_CUSTOMER_TOKEN` and add `--live --org <org> --app <app> --env <env>`. The live doctor performs\ncredential exchanges without invoking either business tool.\n\n## Run locally\n\n```bash\nnoodle dev examples/customer-auth/src/server.ts --app noodleseed-customer-auth\n```\n\n## Configuration\n\nThe embedded assistant uses a customer-supplied OpenAI Chat Completions-compatible endpoint. Configure its\nmanaged values at the Noodle deployment environment; none of these values belongs in the customer web\napplication environment, and the API key never reaches the browser:\n\n```bash\nnoodle variables set ASSISTANT_MODEL_BASE_URL https://model.example.com/v1 --scope env\nnoodle variables set ASSISTANT_MODEL your-model --scope env\nnoodle secrets set ASSISTANT_MODEL_API_KEY --scope env\nnoodle variables set FIREBASE_PROJECT_ID your-firebase-project --scope env\nnoodle variables set FIREBASE_WEB_API_KEY your-firebase-web-api-key --scope env\nnoodle variables set FIREBASE_AUTH_DOMAIN your-firebase-project.firebaseapp.com --scope env\nnoodle check --target embedded-assistant src/server.ts\n```\n\nAssistant origins are exact. Production embedding origins must use HTTPS; plain HTTP is accepted only for\nloopback development origins such as `http://localhost:3000`, `http://127.0.0.1:3000`, or\n`http://[::1]:3000`. `noodle dev` serves the MCP project, not that separate embedding application.\n\nThe assistant's panel, launcher, status header, composer, and message treatment are configured through the\nbounded `presentation` object in `src/server.ts`. The Atlas-style product treatment is the supported\ncustomization ceiling. These primitives derive their colors from the shared server `branding` block and\nrequire no edits to `@noodleseed/assistant`; raw HTML, CSS, inline SVG, renderer class names, and callbacks\nare intentionally not accepted in deployment configuration.\n\nCreate the backend credential after deployment. The CLI writes it to a mode-0600 file and never prints the\nsecret:\n\n```bash\nnoodle assistant clients create --name web --org noodleseed --app customer-auth --env prod\n```\n\nOnly the Noodle service URL, assistant client ID, and assistant client secret belong in the authenticated\ncustomer backend. The model URL, model name, and model API key remain managed by the Noodle deployment.\n\nThe customer's authenticated backend calls `createAssistantSession(...)` from\n`@noodleseed/assistant/server`, passing the already-verified user and browser origin. The browser then uses\nthe returned short-lived session through the Web Component or React wrapper:\n\n```bash\npnpm add @noodleseed/assistant\n```\n\n```tsx\nimport { NoodleAssistant } from '@noodleseed/assistant/react';\n\n<NoodleAssistant\n  sessionEndpoint=\"/api/noodle-assistant/session\"\n  theme=\"auto\"\n  onSessionExpired={() => console.info('Assistant session renewed')}\n/>;\n```\n\n`theme=\"auto\"` follows the SaaS application. The server-level `branding` block is inherited by both MCP App\nwidgets and the assistant; documented `--ns-assistant-*` semantic CSS variables remain the final integration\nescape hatch. There is no second assistant branding declaration.\nThe end-user UI contains only customer branding.\nText streams progressively. Expired turns re-exchange through the authenticated backend and retry once;\nconsent-bound tool confirmations never replay automatically.\n\nThe Firebase project ID is required because Firebase ID tokens use the project ID as the token audience and\nissuer suffix. The runtime verifies `aud` against the project ID and `iss` against\n`https://securetoken.google.com/<projectId>`.\n\nThe Firebase Web API key and auth domain are public Firebase browser configuration. They let the Noodle\nCloud-hosted bridge initialize Firebase Auth for this customer project; they are not server secrets. Keep\nthem out of source with `variable(...)`, restrict the Firebase key to the expected browser origins and APIs,\nand use `secret(...)` only for credentials that must never reach a browser.\n\nThe `noodleseed_app_api` connector currently points at the NoodleSeed.com dev app surface:\n\n```text\nhttps://dev.noodleseed.com\n```\n\nWhen the customer app moves from `dev.noodleseed.com` to `app.noodleseed.com`, update the connector's\n`noodleseedApiOrigin` constant to the production API origin that serves the same paths.\n\nThe connector uses delegated Firebase customer credentials. During the customer OAuth bridge, Noodle Seed\nverifies the Firebase ID token, stores the Firebase refresh token through the credential broker, and refreshes\na Firebase ID token when the connector calls the NoodleSeed.com app API. The broker then exchanges that ID\ntoken for the app's existing Next.js session cookie. There is no shared `NOODLESEED_APP_API_TOKEN` for this\nexample.\n\nFirebase Auth must list `cloud.noodleseed.dev` as an authorized domain before browser sign-in works in\nproduction.\n\n## Deploy customer-protected to Noodle Seed Cloud\n\n```bash\nnoodle deploy examples/customer-auth/src/server.ts \\\n  --org noodleseed \\\n  --app customer-auth \\\n  --env prod \\\n  --access customers\n```\n\nEndpoint:\n\n```text\nhttps://cloud.noodleseed.dev/o/noodleseed/customer-auth/mcp\n```\n\n## MCP Primitives\n\n- Tool `list_my_organizations`: calls `GET /api/organizations` and returns the organizations the signed-in\n  customer is a member of. Takes no arguments; the org set is scoped by the verified customer session.\n- Tool `list_org_apps`: calls `GET /api/organizations/{org_id}/apps` for one organization `org_id`.\n\n## Auth boundary\n\nFirebase ID-token verification is handled by Noodle Seed's generic Firebase bridge adapter during OAuth\nissuance. The MCP client receives a Noodle-issued, resource-bound access token marked as a Firebase customer\nidentity; raw Firebase tokens and inbound MCP bearer tokens are never forwarded to tools, connectors,\nwidgets, or downstream systems.\n\nThe connector-backed tools use the credential broker to turn the signed-in Firebase customer session into the\nsame session-cookie credential that the existing NoodleSeed.com Next.js API already expects. The inbound MCP\nbearer token is never used as an app API credential.\n" },
+    { relPath: "examples/customer-auth/README.md", content: "# Customer Auth - NoodleSeed.com Firebase customer identity\n\nThis curated example owns the customer/end-user authentication with Firebase bridge capability slot. It is\nthe NoodleSeed.com dogfood app for proving that a SaaS app can protect an MCP endpoint with its own customer\nidentity provider while still using the generic Noodle Seed authoring API.\n\nIt also owns the embedded-assistant showcase: the same authenticated MCP surface can be dropped into the\nSaaS web application as a fully customer-branded assistant with independent light and dark themes. The\nassistant loads the active deployment's instructions and model-visible tools rather than installing a stale\nsecond skill bundle. The standard embedded element also hosts linked MCP Apps behind its sandbox bridge.\n\nThe public developer entrypoint is [`src/server.ts`](src/server.ts). It declares `customerAuth.firebase(...)` with\nthe NoodleSeed.com Firebase project and Firebase Web App public config. It exposes a deliberately small MCP\nsurface for org discovery:\n\n- `list_my_organizations` lists the NoodleSeed.com organizations the signed-in customer belongs to (no\n  arguments — the org set comes from the verified customer session).\n- `list_org_apps` lists apps for one of those organizations through the dev app API.\n\nThe two tools chain: `list_my_organizations` surfaces the `org_id`s the customer can act on, and\n`list_org_apps` takes one of those `org_id`s. There is no NoodleSeed-specific SDK helper. The downstream API\nis an ordinary authored HTTP connector.\n\nDuring MCP OAuth login, Noodle Cloud hosts the Firebase bridge page at\n`https://cloud.noodleseed.dev/oauth/customer/firebase/authorize`. The customer app does not add an\nauthorization route. The SaaS operator only configures Firebase Auth to allow the Noodle Cloud origin, and\nNoodle Cloud signs the customer in with Firebase before posting the Firebase ID token back to its own bridge\ncallback.\n\n## How delegated customer credentials are used\n\nThis flagship uses the legacy Firebase provider bridge because it is runnable today. That is distinct from\nCore-v2 account-selecting connector aliases: those declare catalog `credentialProfiles` and bind each alias\nwith `bind(connector, { profile, connection })`. Hosted bound `managedSecret(...)` connections are runnable;\nbound `externalExchange()` and `clientCredentials(...)` currently compile as portable metadata but fail\nclosed before secret or network access until their provider slice lands. Do not replace this example's\nworking delegated-session-cookie path with either unsupported bound exchange source.\n\nThe example has two declarations that work together:\n\n```ts\nauth: customerAuth.firebase({\n  projectId: variable('FIREBASE_PROJECT_ID'),\n  apiKey: variable('FIREBASE_WEB_API_KEY'),\n  authDomain: variable('FIREBASE_AUTH_DOMAIN'),\n  user: {\n    id: 'sub',\n    email: 'email',\n    name: 'name',\n    tenant: 'firebase.tenant',\n    orgs: 'claims.orgs',\n    roles: 'claims.roles',\n  },\n}),\n```\n\nThat protects the MCP endpoint with the SaaS customer's Firebase identity. The connector then opts into\ndelegated customer credentials:\n\n```ts\nauth: {\n  kind: 'delegatedSessionCookie',\n  provider: 'firebase',\n  sessionUrl: `${noodleseedApiOrigin}/api/auth/session`,\n  tokenField: 'idToken',\n},\n```\n\nTool code calls the connector normally:\n\n```ts\nfulfil({ input, connectors }) {\n  const apps = connectors.app_api.listOrgApps({\n    org_id: input.org_id,\n    skip: input.skip,\n    limit: input.limit,\n  });\n\n  return { result: apps.result };\n}\n```\n\nAt runtime, Noodle Seed verifies the Firebase customer during MCP OAuth, stores that customer's delegated\nFirebase refresh token in the credential broker, and refreshes a short-lived Firebase ID token only when a\nconnector-backed tool calls the NoodleSeed.com API. For this app API, the broker exchanges that ID token at\nthe existing Next.js `/api/auth/session` route and sends the resulting session cookie to the API. The MCP\naccess token remains a Noodle-issued resource-bound token and is never sent to the downstream API.\n\n## Delegated downstream auth for your own API (token exchange)\n\nThe Firebase path above only works for Firebase-session downstreams. When the downstream is **your own\nAPI** with its own token issuance, use `delegatedTokenExchange` instead\n([ADR 0152](../../docs/decisions/0152-delegated-token-exchange-connector-auth.md)): the platform signs a\nshort-lived, JWKS-verifiable assertion of the signed-in user and exchanges it (RFC 8693) at a token\nendpoint you implement, which mints your own user-scoped token — so your API enforces its own per-user\nauthorization on every call. It works for verified direct/federated OIDC, built-in provider identities, and\nembedded assistant sessions, with no per-user OAuth enrollment.\n\n```ts\nauth: {\n  kind: 'delegatedTokenExchange',\n  tokenUrl: 'https://app.example.com/api/assistant/oauth/token', // origin must be in allowedOrigins\n  clientId: variable('EXAMPLE_DELEG_CLIENT_ID'),\n  clientSecret: secret('EXAMPLE_DELEG_CLIENT_SECRET'),\n  scopes: ['time_off'],\n},\n```\n\nYour endpoint authenticates the broker's client credential, verifies the `subject_token` JWT against the\nplatform issuer JWKS (claims include the verified `sub`, `email`, `name`, declared session `claims`,\n`tenant`, and `deployment`), mints a short-lived user-scoped token, and returns the standard\n`{ access_token, token_type, expires_in }` response. The exact wire contract and a copyable endpoint\nimplementation live in [docs/spec/connectors.md](../../docs/spec/connectors.md) and the Agent Kit\nauthoring-workflow reference (\"Delegated downstream auth\"). `noodle auth doctor` reports each declared\nexchange endpoint.\n\n## Validate\n\n```bash\nnoodle auth doctor examples/customer-auth/src/server.ts\nnoodle validate examples/customer-auth/src/server.ts\n```\n\nAgainst a deployed customer-protected environment, set a short-lived real customer token only in\n`NOODLE_CUSTOMER_TOKEN` and add `--live --org <org> --app <app> --env <env>`. The live doctor performs\ncredential exchanges without invoking either business tool.\n\n## Run locally\n\n```bash\nnoodle dev examples/customer-auth/src/server.ts --app noodleseed-customer-auth\n```\n\n## Configuration\n\nThe embedded assistant uses a customer-supplied OpenAI Chat Completions-compatible endpoint. Configure its\nmanaged values at the Noodle deployment environment; none of these values belongs in the customer web\napplication environment, and the API key never reaches the browser:\n\n```bash\nnoodle variables set ASSISTANT_MODEL_BASE_URL https://model.example.com/v1 --scope env\nnoodle variables set ASSISTANT_MODEL your-model --scope env\nnoodle secrets set ASSISTANT_MODEL_API_KEY --scope env\nnoodle variables set FIREBASE_PROJECT_ID your-firebase-project --scope env\nnoodle variables set FIREBASE_WEB_API_KEY your-firebase-web-api-key --scope env\nnoodle variables set FIREBASE_AUTH_DOMAIN your-firebase-project.firebaseapp.com --scope env\nnoodle check --target embedded-assistant src/server.ts\n```\n\nAssistant origins are exact. Production embedding origins must use HTTPS; plain HTTP is accepted only for\nloopback development origins such as `http://localhost:3000`, `http://127.0.0.1:3000`, or\n`http://[::1]:3000`. `noodle dev` serves the MCP project, not that separate embedding application.\n\nThe assistant's panel, launcher, status header, composer, and message treatment are configured through the\nbounded `presentation` object in `src/server.ts`. The Atlas-style product treatment is the supported\ncustomization ceiling. These primitives derive their colors from the shared server `branding` block and\nrequire no edits to `@noodleseed/assistant`; raw HTML, CSS, inline SVG, renderer class names, and callbacks\nare intentionally not accepted in deployment configuration.\n\nCreate the backend credential after deployment. The CLI writes it to a mode-0600 file and never prints the\nsecret:\n\n```bash\nnoodle assistant clients create --name web --org noodleseed --app customer-auth --env prod\n```\n\nOnly the Noodle service URL, assistant client ID, and assistant client secret belong in the authenticated\ncustomer backend. The model URL, model name, and model API key remain managed by the Noodle deployment.\n\nThe customer's authenticated backend calls `createAssistantSession(...)` from\n`@noodleseed/assistant/server`, passing the already-verified user and browser origin. The browser then uses\nthe returned short-lived session through the managed Web Component/React renderer or a customer-owned UI:\n\n```bash\npnpm add @noodleseed/assistant\n```\n\n```tsx\nimport { NoodleAssistant } from '@noodleseed/assistant/react';\n\n<NoodleAssistant\n  sessionEndpoint=\"/api/noodle-assistant/session\"\n  theme=\"auto\"\n  onSessionExpired={() => console.info('Assistant session renewed')}\n/>;\n```\n\nFor an entirely application-owned React renderer, use the renderer-free hook. It creates no custom element\nand returns the AI SDK transcript plus the canonical client commands:\n\n```tsx\n'use client';\n\nimport { useState } from 'react';\nimport { useNoodleAssistant } from '@noodleseed/assistant/react/client';\n\nexport function CustomerAssistant({ principalKey }: { principalKey: string }) {\n  const [draft, setDraft] = useState('');\n  const { client, messages, status, error } = useNoodleAssistant({\n    sessionEndpoint: '/api/noodle-assistant/session',\n    principalKey,\n  });\n  const busy = status === 'submitted' || status === 'streaming';\n  const settle = (operation: Promise<void>) => {\n    void operation.catch(() => {\n      // The hook exposes this same structured failure through `error`.\n    });\n  };\n\n  return (\n    <section aria-label=\"Assistant\" aria-busy={busy}>\n      {messages.map((message) => (\n        <article key={message.id} data-role={message.role}>\n          {message.parts.map((part, index) => {\n            if (part.type === 'text') return <p key={index}>{part.text}</p>;\n            if (part.type === 'data-confirmation') {\n              const review = part.data;\n              return (\n                <section key={review.id} aria-label=\"Review proposed action\">\n                  <h3>{review.title ?? 'Review proposed action'}</h3>\n                  {review.description ? <p>{review.description}</p> : null}\n                  <pre aria-label=\"Proposed action arguments\">\n                    {JSON.stringify(review.arguments ?? {}, null, 2)}\n                  </pre>\n                  <button\n                    disabled={busy || review.status !== 'pending'}\n                    onClick={() => settle(client.respond(review.id, { action: 'accept' }))}\n                  >\n                    Confirm\n                  </button>\n                  <button\n                    disabled={busy || review.status !== 'pending'}\n                    onClick={() => settle(client.respond(review.id, { action: 'decline' }))}\n                  >\n                    Don't proceed\n                  </button>\n                </section>\n              );\n            }\n            if (part.type === 'data-input-request') {\n              const request = part.data;\n              return (\n                <section key={request.id} aria-label=\"Assistant needs input\">\n                  <p>{request.message}</p>\n                  <p>This renderer has not implemented the requested form.</p>\n                  <button\n                    disabled={busy || request.status !== 'pending'}\n                    onClick={() => settle(client.respond(request.id, { action: 'decline' }))}\n                  >\n                    Cancel request\n                  </button>\n                </section>\n              );\n            }\n            if (part.type === 'data-tool-result') {\n              return (\n                <pre key={part.data.id} aria-label={`${part.data.tool} result`}>\n                  {JSON.stringify(part.data.result, null, 2)}\n                </pre>\n              );\n            }\n            if (part.type === 'data-view') {\n              return (\n                <p key={part.data.id}>\n                  Trusted app view available: {part.data.title ?? part.data.resourceUri}\n                </p>\n              );\n            }\n            return <p key={index}>Unsupported assistant content.</p>;\n          })}\n        </article>\n      ))}\n      {error ? <p role=\"alert\">{error.message}</p> : null}\n      <form\n        onSubmit={(event) => {\n          event.preventDefault();\n          const message = draft.trim();\n          if (!message) return;\n          setDraft('');\n          settle(client.sendMessage(message));\n        }}\n      >\n        <input\n          aria-label=\"Message\"\n          value={draft}\n          onChange={(event) => setDraft(event.currentTarget.value)}\n        />\n        {busy ? (\n          <button type=\"button\" onClick={() => client.abort()}>\n            Stop\n          </button>\n        ) : (\n          <button type=\"submit\">Send</button>\n        )}\n      </form>\n    </section>\n  );\n}\n```\n\n`principalKey` stays in the browser. Change it whenever the authenticated user or tenant changes; the hook\nthen aborts and clears the prior session and transcript. The sample fails closed on input requests until its\nfallback is replaced with a form generated from `requestedSchema`. A production renderer must show the\ncomplete confirmation review and both decisions. For `data-view`, map `resourceUri` or `tool` and the\nbounded/redacted result to a component already trusted by this application. Never inject `part.data.html`,\nassign it to `srcdoc`, or fetch a `ui://` URI.\n\nOutside React, subscribe to the DOM-free client directly. It exposes the same conversation as headless AI\nSDK `UIMessage` state, including typed confirmation, input, tool-result, and linked-view parts:\n\n```ts\nimport { createAssistantClient } from '@noodleseed/assistant/client';\n\nconst assistant = createAssistantClient({\n  sessionEndpoint: '/api/noodle-assistant/session',\n});\n\nassistant.subscribeChat((state) => {\n  renderUIMessageState(state);\n  for (const message of state.messages) {\n    for (const part of message.parts) {\n      if (part.type === 'data-confirmation' && part.data.status === 'pending') {\n        renderConfirmation(part.data, (response) => assistant.respond(part.data.id, response));\n      }\n    }\n  }\n});\n```\n\n`theme=\"auto\"` follows the SaaS application. The server-level `branding` block is inherited by both MCP App\nwidgets and the assistant; documented `--ns-assistant-*` semantic CSS variables remain the final integration\nescape hatch. There is no second assistant branding declaration.\nThe end-user UI contains only customer branding.\nText streams progressively. Expired turns re-exchange through the authenticated backend and retry once;\nconsent-bound tool confirmations never replay automatically.\n\nThe Firebase project ID is required because Firebase ID tokens use the project ID as the token audience and\nissuer suffix. The runtime verifies `aud` against the project ID and `iss` against\n`https://securetoken.google.com/<projectId>`.\n\nThe Firebase Web API key and auth domain are public Firebase browser configuration. They let the Noodle\nCloud-hosted bridge initialize Firebase Auth for this customer project; they are not server secrets. Keep\nthem out of source with `variable(...)`, restrict the Firebase key to the expected browser origins and APIs,\nand use `secret(...)` only for credentials that must never reach a browser.\n\nThe `noodleseed_app_api` connector currently points at the NoodleSeed.com dev app surface:\n\n```text\nhttps://dev.noodleseed.com\n```\n\nWhen the customer app moves from `dev.noodleseed.com` to `app.noodleseed.com`, update the connector's\n`noodleseedApiOrigin` constant to the production API origin that serves the same paths.\n\nThe connector uses delegated Firebase customer credentials. During the customer OAuth bridge, Noodle Seed\nverifies the Firebase ID token, stores the Firebase refresh token through the credential broker, and refreshes\na Firebase ID token when the connector calls the NoodleSeed.com app API. The broker then exchanges that ID\ntoken for the app's existing Next.js session cookie. There is no shared `NOODLESEED_APP_API_TOKEN` for this\nexample.\n\nFirebase Auth must list `cloud.noodleseed.dev` as an authorized domain before browser sign-in works in\nproduction.\n\n## Deploy customer-protected to Noodle Seed Cloud\n\n```bash\nnoodle deploy examples/customer-auth/src/server.ts \\\n  --org noodleseed \\\n  --app customer-auth \\\n  --env prod \\\n  --access customers\n```\n\nEndpoint:\n\n```text\nhttps://cloud.noodleseed.dev/o/noodleseed/customer-auth/mcp\n```\n\n## MCP Primitives\n\n- Tool `list_my_organizations`: calls `GET /api/organizations` and returns the organizations the signed-in\n  customer is a member of. Takes no arguments; the org set is scoped by the verified customer session.\n- Tool `list_org_apps`: calls `GET /api/organizations/{org_id}/apps` for one organization `org_id`.\n\n## Auth boundary\n\nFirebase ID-token verification is handled by Noodle Seed's generic Firebase bridge adapter during OAuth\nissuance. The MCP client receives a Noodle-issued, resource-bound access token marked as a Firebase customer\nidentity; raw Firebase tokens and inbound MCP bearer tokens are never forwarded to tools, connectors,\nwidgets, or downstream systems.\n\nThe connector-backed tools use the credential broker to turn the signed-in Firebase customer session into the\nsame session-cookie credential that the existing NoodleSeed.com Next.js API already expects. The inbound MCP\nbearer token is never used as an app API credential.\n" },
     { relPath: "examples/customer-auth/noodle.json", content: "{\n  \"entrypoint\": \"src/server.ts\",\n  \"name\": \"customer-auth\"\n}\n" },
     { relPath: "examples/customer-auth/package.json", content: "{\n  \"name\": \"customer-auth\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"scripts\": {\n    \"test\": \"vitest run\",\n    \"validate\": \"noodle validate\",\n    \"dev\": \"noodle dev\",\n    \"deploy\": \"noodle deploy\"\n  },\n  \"devDependencies\": {\n    \"@noodleseed/one\": \"latest\",\n    \"vitest\": \"latest\"\n  }\n}\n" },
     { relPath: "examples/customer-auth/src/server.ts", content: "import {\n  annotations,\n  connector,\n  customerAuth,\n  embeddedAssistant,\n  openAICompatible,\n  secret,\n  server,\n  tool,\n  variable,\n  z,\n} from '@noodleseed/one';\n\nconst noodleseedApiOrigin = 'https://dev.noodleseed.com';\n\nconst noodleseedApi = connector('noodleseed_app_api')\n  .version('1.0.0')\n  .http({\n    baseUrl: noodleseedApiOrigin,\n    allowedOrigins: [noodleseedApiOrigin],\n    auth: {\n      kind: 'delegatedSessionCookie',\n      provider: 'firebase',\n      sessionUrl: `${noodleseedApiOrigin}/api/auth/session`,\n      tokenField: 'idToken',\n    },\n    operations: {\n      list_org_apps: {\n        type: 'read',\n        method: 'GET',\n        path: '/api/organizations/${args.org_id}/apps',\n        query: ['skip', 'limit'],\n        input: z.object({\n          org_id: z.string(),\n          skip: z.number().optional(),\n          limit: z.number().optional(),\n        }),\n        output: z.object({ result: z.unknown().optional() }),\n        response: {\n          result: '${response}',\n        },\n      },\n      list_organizations: {\n        type: 'read',\n        method: 'GET',\n        path: '/api/organizations',\n        output: z.object({ organizations: z.array(z.unknown()).optional() }),\n        response: {\n          organizations: '${response.organizations}',\n        },\n      },\n    },\n  });\n\nexport default server(\n  'noodleseed_customer_auth',\n  {\n    title: 'NoodleSeed.com Customer Auth',\n    version: '1.0.0',\n    branding: {\n      name: 'Noodle Seed Assistant',\n      accent: '#E85D24',\n      surface: '#FFFFFF',\n      surfaceDark: '#171310',\n      colorScheme: 'auto',\n      theme: {\n        light: { accentText: '#FFFFFF', text: '#1C1714' },\n        dark: { accent: '#FF8A4C', accentText: '#1C100A', text: '#FFF8F2' },\n      },\n    },\n    use: { app_api: noodleseedApi },\n    auth: customerAuth.firebase({\n      projectId: variable('FIREBASE_PROJECT_ID'),\n      apiKey: variable('FIREBASE_WEB_API_KEY'),\n      authDomain: variable('FIREBASE_AUTH_DOMAIN'),\n      user: {\n        id: 'sub',\n        email: 'email',\n        name: 'name',\n        tenant: 'firebase.tenant',\n        orgs: 'claims.orgs',\n        roles: 'claims.roles',\n      },\n    }),\n    instructions:\n      'Customer-authenticated demo. Firebase proves the customer identity, while read-only NoodleSeed.com API calls use broker-managed delegated Firebase customer credentials.',\n    assistant: embeddedAssistant({\n      model: openAICompatible({\n        baseUrl: variable('ASSISTANT_MODEL_BASE_URL'),\n        model: variable('ASSISTANT_MODEL'),\n        apiKey: secret('ASSISTANT_MODEL_API_KEY'),\n      }),\n      // Production origins are exact HTTPS; http://localhost:<port> is allowed for local development.\n      allowedOrigins: [\n        'https://app.noodleseed.com',\n        'https://dev.noodleseed.com',\n        'http://localhost:3000',\n      ],\n      layout: { mode: 'floating', position: 'bottom-right', panelWidth: 420 },\n      labels: {\n        welcomeHeading: 'How can I help with Noodle Seed?',\n        composerPlaceholder: 'Ask about your apps…',\n      },\n      presentation: {\n        panel: { surface: 'glass', elevation: 'soft', border: 'subtle' },\n        launcher: { icon: 'brand-mark', status: 'session', effect: 'pulse' },\n        header: {\n          mark: 'status',\n          badge: { text: 'Workspace online', tone: 'success', indicator: true },\n        },\n        composer: { leadingIcon: 'brand-mark', shape: 'pill' },\n      },\n      suggestedPrompts: ['Show my organizations', 'List the apps in my organization'],\n    }),\n  },\n  [\n    tool('list_org_apps', {\n      title: 'List organization apps',\n      description: 'List NoodleSeed.com apps for an organization from the dev app API.',\n      input: z.object({\n        org_id: z.string().meta({ title: 'Organization' }),\n        skip: z.number().int().min(0).optional().meta({ title: 'Starting item' }),\n        limit: z.number().int().min(1).max(100).optional().meta({ title: 'Maximum results' }),\n      }),\n      output: z.object({\n        result: z.unknown(),\n      }),\n      annotations: annotations.readOnly(),\n      fulfil({ input, connectors }) {\n        const apps = connectors.app_api.listOrgApps({\n          org_id: input.org_id,\n          skip: input.skip,\n          limit: input.limit,\n        });\n        return {\n          result: apps.result,\n        };\n      },\n    }),\n    tool('list_my_organizations', {\n      title: 'List my organizations',\n      description: 'List the NoodleSeed.com organizations the signed-in customer belongs to.',\n      contextProvider: true,\n      input: z.object({}),\n      output: z.object({\n        organizations: z.array(z.unknown()),\n      }),\n      annotations: annotations.readOnly(),\n      fulfil({ connectors }) {\n        const organizations = connectors.app_api.listOrganizations();\n        return {\n          organizations: organizations.organizations,\n        };\n      },\n    }),\n  ],\n);\n" },

package/node_modules/@noodle-borg/agent-kit/dist/generated/example-files.js.map

@@ -1 +1 @@
-{"version":3,"file":"example-files.js","sourceRoot":"","sources":["../../src/generated/example-files.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,kFAAkF;AAClF,iGAAiG;AAQjG,uGAAuG;AACvG,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,OAAO;IACP,SAAS;IACT,eAAe;IACf,gBAAgB;IAChB,YAAY;IACZ,aAAa;IACb,eAAe;IACf,qBAAqB;IACrB,iBAAiB;CAClB,CAAC;AAEF,yGAAyG;AACzG,MAAM,CAAC,MAAM,qBAAqB,GAAkC;IAClE,EAAE,OAAO,EAAE,gCAAgC,EAAE,OAAO,EAAE,4oEAA4oE,EAAE;IACpsE,EAAE,OAAO,EAAE,4CAA4C,EAAE,OAAO,EAAE,u/wBAAu/wB,EAAE;IAC3jxB,EAAE,OAAO,EAAE,6CAA6C,EAAE,OAAO,EAAE,kkQAAkkQ,EAAE;IACvoQ,EAAE,OAAO,EAAE,4CAA4C,EAAE,OAAO,EAAE,klqDAAklqD,EAAE;IACtpqD,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,wGAAwG,EAAE;IAClK,EAAE,OAAO,EAAE,mCAAmC,EAAE,OAAO,EAAE,mfAAmf,EAAE;IAC9iB,EAAE,OAAO,EAAE,qCAAqC,EAAE,OAAO,EAAE,yRAAyR,EAAE;IACtV,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,i+LAAi+L,EAAE;IAC7hM,EAAE,OAAO,EAAE,8CAA8C,EAAE,OAAO,EAAE,okLAAokL,EAAE;IAC1oL,EAAE,OAAO,EAAE,iDAAiD,EAAE,OAAO,EAAE,8zHAA8zH,EAAE;IACv4H,EAAE,OAAO,EAAE,0CAA0C,EAAE,OAAO,EAAE,wyBAAwyB,EAAE;IAC12B,EAAE,OAAO,EAAE,uCAAuC,EAAE,OAAO,EAAE,uRAAuR,EAAE;IACtV,EAAE,OAAO,EAAE,mCAAmC,EAAE,OAAO,EAAE,2tIAA2tI,EAAE;IACtxI,EAAE,OAAO,EAAE,+CAA+C,EAAE,OAAO,EAAE,mrhCAAmrhC,EAAE;IAC1vhC,EAAE,OAAO,EAAE,+CAA+C,EAAE,OAAO,EAAE,g4sDAAg4sD,EAAE;IACv8sD,EAAE,OAAO,EAAE,qCAAqC,EAAE,OAAO,EAAE,2GAA2G,EAAE;IACxK,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,sfAAsf,EAAE;IACpjB,EAAE,OAAO,EAAE,wCAAwC,EAAE,OAAO,EAAE,yRAAyR,EAAE;IACzV,EAAE,OAAO,EAAE,uCAAuC,EAAE,OAAO,EAAE,grOAAgrO,EAAE;IAC/uO,EAAE,OAAO,EAAE,0DAA0D,EAAE,OAAO,EAAE,4jLAA4jL,EAAE;IAC9oL,EAAE,OAAO,EAAE,oDAAoD,EAAE,OAAO,EAAE,ijHAAijH,EAAE;IAC7nH,EAAE,OAAO,EAAE,6CAA6C,EAAE,OAAO,EAAE,8/BAA8/B,EAAE;IACnkC,EAAE,OAAO,EAAE,0CAA0C,EAAE,OAAO,EAAE,uRAAuR,EAAE;IACzV,EAAE,OAAO,EAAE,+BAA+B,EAAE,OAAO,EAAE,w9LAAw9L,EAAE;IAC/gM,EAAE,OAAO,EAAE,2CAA2C,EAAE,OAAO,EAAE,o8nBAAo8nB,EAAE;IACvgoB,EAAE,OAAO,EAAE,2CAA2C,EAAE,OAAO,EAAE,k1nDAAk1nD,EAAE;IACr5nD,EAAE,OAAO,EAAE,iCAAiC,EAAE,OAAO,EAAE,uGAAuG,EAAE;IAChK,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,kfAAkf,EAAE;IAC5iB,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,qQAAqQ,EAAE;IACjU,EAAE,OAAO,EAAE,mCAAmC,EAAE,OAAO,EAAE,mqLAAmqL,EAAE;IAC9tL,EAAE,OAAO,EAAE,6CAA6C,EAAE,OAAO,EAAE,yrNAAyrN,EAAE;IAC9vN,EAAE,OAAO,EAAE,gDAAgD,EAAE,OAAO,EAAE,o6HAAo6H,EAAE;IAC5+H,EAAE,OAAO,EAAE,yCAAyC,EAAE,OAAO,EAAE,y0CAAy0C,EAAE;IAC14C,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,uRAAuR,EAAE;IACrV,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,i/XAAi/X,EAAE;IAC3iY,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,6EAA6E,EAAE;IACzI,EAAE,OAAO,EAAE,qCAAqC,EAAE,OAAO,EAAE,mXAAmX,EAAE;IAChb,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,48JAA48J,EAAE;IAC1gK,EAAE,OAAO,EAAE,4CAA4C,EAAE,OAAO,EAAE,uyCAAuyC,EAAE;IAC32C,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,26KAA26K,EAAE;IACr+K,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,0GAA0G,EAAE;IACtK,EAAE,OAAO,EAAE,qCAAqC,EAAE,OAAO,EAAE,mlBAAmlB,EAAE;IAChpB,EAAE,OAAO,EAAE,uCAAuC,EAAE,OAAO,EAAE,gqBAAgqB,EAAE;IAC/tB,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,22cAA22c,EAAE;IACz6c,EAAE,OAAO,EAAE,wDAAwD,EAAE,OAAO,EAAE,yzJAAyzJ,EAAE;IACz4J,EAAE,OAAO,EAAE,oDAAoD,EAAE,OAAO,EAAE,qytBAAqytB,EAAE;IACj3tB,EAAE,OAAO,EAAE,mDAAmD,EAAE,OAAO,EAAE,ynYAAynY,EAAE;IACpsY,EAAE,OAAO,EAAE,4CAA4C,EAAE,OAAO,EAAE,osHAAosH,EAAE;IACxwH,EAAE,OAAO,EAAE,yCAAyC,EAAE,OAAO,EAAE,6iCAA6iC,EAAE;IAC9mC,EAAE,OAAO,EAAE,wCAAwC,EAAE,OAAO,EAAE,4sFAA4sF,EAAE;IAC5wF,EAAE,OAAO,EAAE,0CAA0C,EAAE,OAAO,EAAE,mFAAmF,EAAE;IACrJ,EAAE,OAAO,EAAE,2CAA2C,EAAE,OAAO,EAAE,yXAAyX,EAAE;IAC5b,EAAE,OAAO,EAAE,4CAA4C,EAAE,OAAO,EAAE,ollBAAollB,EAAE;IACxplB,EAAE,OAAO,EAAE,kDAAkD,EAAE,OAAO,EAAE,sgVAAsgV,EAAE;IAChlV,EAAE,OAAO,EAAE,+CAA+C,EAAE,OAAO,EAAE,oiCAAoiC,EAAE;IAC3mC,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,44HAA44H,EAAE;IACx8H,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,+EAA+E,EAAE;IAC7I,EAAE,OAAO,EAAE,uCAAuC,EAAE,OAAO,EAAE,qXAAqX,EAAE;IACpb,EAAE,OAAO,EAAE,wCAAwC,EAAE,OAAO,EAAE,w1GAAw1G,EAAE;IACx5G,EAAE,OAAO,EAAE,8CAA8C,EAAE,OAAO,EAAE,68CAA68C,EAAE;IACnhD,EAAE,OAAO,EAAE,2CAA2C,EAAE,OAAO,EAAE,2qBAA2qB,EAAE;IAC9uB,EAAE,OAAO,EAAE,0BAA0B,EAAE,OAAO,EAAE,s/CAAs/C,EAAE;IACxiD,EAAE,OAAO,EAAE,4BAA4B,EAAE,OAAO,EAAE,iGAAiG,EAAE;IACrJ,EAAE,OAAO,EAAE,6BAA6B,EAAE,OAAO,EAAE,2WAA2W,EAAE;IACha,EAAE,OAAO,EAAE,8BAA8B,EAAE,OAAO,EAAE,s1BAAs1B,EAAE;IAC54B,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,msBAAmsB,EAAE;IAC/vB,EAAE,OAAO,EAAE,4BAA4B,EAAE,OAAO,EAAE,q3JAAq3J,EAAE;IACz6J,EAAE,OAAO,EAAE,8BAA8B,EAAE,OAAO,EAAE,uEAAuE,EAAE;IAC7H,EAAE,OAAO,EAAE,+BAA+B,EAAE,OAAO,EAAE,6WAA6W,EAAE;IACpa,EAAE,OAAO,EAAE,gCAAgC,EAAE,OAAO,EAAE,kmTAAkmT,EAAE;IAC1pT,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,gzCAAgzC,EAAE;CAC/2C,CAAC"}
+{"version":3,"file":"example-files.js","sourceRoot":"","sources":["../../src/generated/example-files.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,kFAAkF;AAClF,iGAAiG;AAQjG,uGAAuG;AACvG,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,OAAO;IACP,SAAS;IACT,eAAe;IACf,gBAAgB;IAChB,YAAY;IACZ,aAAa;IACb,eAAe;IACf,qBAAqB;IACrB,iBAAiB;CAClB,CAAC;AAEF,yGAAyG;AACzG,MAAM,CAAC,MAAM,qBAAqB,GAAkC;IAClE,EAAE,OAAO,EAAE,gCAAgC,EAAE,OAAO,EAAE,4oEAA4oE,EAAE;IACpsE,EAAE,OAAO,EAAE,4CAA4C,EAAE,OAAO,EAAE,u/wBAAu/wB,EAAE;IAC3jxB,EAAE,OAAO,EAAE,6CAA6C,EAAE,OAAO,EAAE,kkQAAkkQ,EAAE;IACvoQ,EAAE,OAAO,EAAE,4CAA4C,EAAE,OAAO,EAAE,klqDAAklqD,EAAE;IACtpqD,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,wGAAwG,EAAE;IAClK,EAAE,OAAO,EAAE,mCAAmC,EAAE,OAAO,EAAE,mfAAmf,EAAE;IAC9iB,EAAE,OAAO,EAAE,qCAAqC,EAAE,OAAO,EAAE,yRAAyR,EAAE;IACtV,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,i+LAAi+L,EAAE;IAC7hM,EAAE,OAAO,EAAE,8CAA8C,EAAE,OAAO,EAAE,okLAAokL,EAAE;IAC1oL,EAAE,OAAO,EAAE,iDAAiD,EAAE,OAAO,EAAE,8zHAA8zH,EAAE;IACv4H,EAAE,OAAO,EAAE,0CAA0C,EAAE,OAAO,EAAE,wyBAAwyB,EAAE;IAC12B,EAAE,OAAO,EAAE,uCAAuC,EAAE,OAAO,EAAE,uRAAuR,EAAE;IACtV,EAAE,OAAO,EAAE,mCAAmC,EAAE,OAAO,EAAE,2tIAA2tI,EAAE;IACtxI,EAAE,OAAO,EAAE,+CAA+C,EAAE,OAAO,EAAE,mrhCAAmrhC,EAAE;IAC1vhC,EAAE,OAAO,EAAE,+CAA+C,EAAE,OAAO,EAAE,g4sDAAg4sD,EAAE;IACv8sD,EAAE,OAAO,EAAE,qCAAqC,EAAE,OAAO,EAAE,2GAA2G,EAAE;IACxK,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,sfAAsf,EAAE;IACpjB,EAAE,OAAO,EAAE,wCAAwC,EAAE,OAAO,EAAE,yRAAyR,EAAE;IACzV,EAAE,OAAO,EAAE,uCAAuC,EAAE,OAAO,EAAE,grOAAgrO,EAAE;IAC/uO,EAAE,OAAO,EAAE,0DAA0D,EAAE,OAAO,EAAE,4jLAA4jL,EAAE;IAC9oL,EAAE,OAAO,EAAE,oDAAoD,EAAE,OAAO,EAAE,ijHAAijH,EAAE;IAC7nH,EAAE,OAAO,EAAE,6CAA6C,EAAE,OAAO,EAAE,8/BAA8/B,EAAE;IACnkC,EAAE,OAAO,EAAE,0CAA0C,EAAE,OAAO,EAAE,uRAAuR,EAAE;IACzV,EAAE,OAAO,EAAE,+BAA+B,EAAE,OAAO,EAAE,w9LAAw9L,EAAE;IAC/gM,EAAE,OAAO,EAAE,2CAA2C,EAAE,OAAO,EAAE,o8nBAAo8nB,EAAE;IACvgoB,EAAE,OAAO,EAAE,2CAA2C,EAAE,OAAO,EAAE,k1nDAAk1nD,EAAE;IACr5nD,EAAE,OAAO,EAAE,iCAAiC,EAAE,OAAO,EAAE,uGAAuG,EAAE;IAChK,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,kfAAkf,EAAE;IAC5iB,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,qQAAqQ,EAAE;IACjU,EAAE,OAAO,EAAE,mCAAmC,EAAE,OAAO,EAAE,mqLAAmqL,EAAE;IAC9tL,EAAE,OAAO,EAAE,6CAA6C,EAAE,OAAO,EAAE,yrNAAyrN,EAAE;IAC9vN,EAAE,OAAO,EAAE,gDAAgD,EAAE,OAAO,EAAE,o6HAAo6H,EAAE;IAC5+H,EAAE,OAAO,EAAE,yCAAyC,EAAE,OAAO,EAAE,y0CAAy0C,EAAE;IAC14C,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,uRAAuR,EAAE;IACrV,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,i/iBAAi/iB,EAAE;IAC3ijB,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,6EAA6E,EAAE;IACzI,EAAE,OAAO,EAAE,qCAAqC,EAAE,OAAO,EAAE,mXAAmX,EAAE;IAChb,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,48JAA48J,EAAE;IAC1gK,EAAE,OAAO,EAAE,4CAA4C,EAAE,OAAO,EAAE,uyCAAuyC,EAAE;IAC32C,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,26KAA26K,EAAE;IACr+K,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,0GAA0G,EAAE;IACtK,EAAE,OAAO,EAAE,qCAAqC,EAAE,OAAO,EAAE,mlBAAmlB,EAAE;IAChpB,EAAE,OAAO,EAAE,uCAAuC,EAAE,OAAO,EAAE,gqBAAgqB,EAAE;IAC/tB,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,22cAA22c,EAAE;IACz6c,EAAE,OAAO,EAAE,wDAAwD,EAAE,OAAO,EAAE,yzJAAyzJ,EAAE;IACz4J,EAAE,OAAO,EAAE,oDAAoD,EAAE,OAAO,EAAE,qytBAAqytB,EAAE;IACj3tB,EAAE,OAAO,EAAE,mDAAmD,EAAE,OAAO,EAAE,ynYAAynY,EAAE;IACpsY,EAAE,OAAO,EAAE,4CAA4C,EAAE,OAAO,EAAE,osHAAosH,EAAE;IACxwH,EAAE,OAAO,EAAE,yCAAyC,EAAE,OAAO,EAAE,6iCAA6iC,EAAE;IAC9mC,EAAE,OAAO,EAAE,wCAAwC,EAAE,OAAO,EAAE,4sFAA4sF,EAAE;IAC5wF,EAAE,OAAO,EAAE,0CAA0C,EAAE,OAAO,EAAE,mFAAmF,EAAE;IACrJ,EAAE,OAAO,EAAE,2CAA2C,EAAE,OAAO,EAAE,yXAAyX,EAAE;IAC5b,EAAE,OAAO,EAAE,4CAA4C,EAAE,OAAO,EAAE,ollBAAollB,EAAE;IACxplB,EAAE,OAAO,EAAE,kDAAkD,EAAE,OAAO,EAAE,sgVAAsgV,EAAE;IAChlV,EAAE,OAAO,EAAE,+CAA+C,EAAE,OAAO,EAAE,oiCAAoiC,EAAE;IAC3mC,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,44HAA44H,EAAE;IACx8H,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,+EAA+E,EAAE;IAC7I,EAAE,OAAO,EAAE,uCAAuC,EAAE,OAAO,EAAE,qXAAqX,EAAE;IACpb,EAAE,OAAO,EAAE,wCAAwC,EAAE,OAAO,EAAE,w1GAAw1G,EAAE;IACx5G,EAAE,OAAO,EAAE,8CAA8C,EAAE,OAAO,EAAE,68CAA68C,EAAE;IACnhD,EAAE,OAAO,EAAE,2CAA2C,EAAE,OAAO,EAAE,2qBAA2qB,EAAE;IAC9uB,EAAE,OAAO,EAAE,0BAA0B,EAAE,OAAO,EAAE,s/CAAs/C,EAAE;IACxiD,EAAE,OAAO,EAAE,4BAA4B,EAAE,OAAO,EAAE,iGAAiG,EAAE;IACrJ,EAAE,OAAO,EAAE,6BAA6B,EAAE,OAAO,EAAE,2WAA2W,EAAE;IACha,EAAE,OAAO,EAAE,8BAA8B,EAAE,OAAO,EAAE,s1BAAs1B,EAAE;IAC54B,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,msBAAmsB,EAAE;IAC/vB,EAAE,OAAO,EAAE,4BAA4B,EAAE,OAAO,EAAE,q3JAAq3J,EAAE;IACz6J,EAAE,OAAO,EAAE,8BAA8B,EAAE,OAAO,EAAE,uEAAuE,EAAE;IAC7H,EAAE,OAAO,EAAE,+BAA+B,EAAE,OAAO,EAAE,6WAA6W,EAAE;IACpa,EAAE,OAAO,EAAE,gCAAgC,EAAE,OAAO,EAAE,kmTAAkmT,EAAE;IAC1pT,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,gzCAAgzC,EAAE;CAC/2C,CAAC"}

package/node_modules/@noodle-borg/agent-kit/dist/skill-embedded-assistant-ref.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-embedded-assistant-ref.d.ts","sourceRoot":"","sources":["../src/skill-embedded-assistant-ref.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,wBAAgB,gCAAgC,IAAI,MAAM,CAiVzD"}
+{"version":3,"file":"skill-embedded-assistant-ref.d.ts","sourceRoot":"","sources":["../src/skill-embedded-assistant-ref.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,wBAAgB,gCAAgC,IAAI,MAAM,CAgdzD"}

package/node_modules/@noodle-borg/agent-kit/dist/skill-embedded-assistant-ref.js

@@ -251,7 +251,125 @@ export function renderEmbeddedAssistantReference() {
         '',
         'The component renders a custom element and must mount client-side. In a Next.js App Router tree, put the mount in a `"use client"` component; from a server component or the Pages Router, load it with `next/dynamic` and `ssr: false`.',
         '',
-        'For a customer-owned renderer, use the DOM-free client. It keeps the session token in memory, streams the same typed events, and never registers a custom element:',
+        'For a customer-owned React renderer, use the renderer-free hook. It owns client lifetime and React subscription while `client` remains the one command surface:',
+        '',
+        '```tsx',
+        '"use client";',
+        '',
+        'import { useState } from "react";',
+        'import { useNoodleAssistant } from "@noodleseed/assistant/react/client";',
+        '',
+        'export function CustomAssistant({ principalKey }: { principalKey: string }) {',
+        '  const [draft, setDraft] = useState("");',
+        '  const { client, messages, status, error } = useNoodleAssistant({',
+        '    sessionEndpoint: "/api/assistant/session",',
+        '    principalKey,',
+        '    clientContext: () => ({',
+        '      locale: navigator.language,',
+        '      timeZone: Intl.DateTimeFormat().resolvedOptions().timeZone,',
+        '    }),',
+        '  });',
+        '  const busy = status === "submitted" || status === "streaming";',
+        '  const settle = (operation: Promise<void>) => {',
+        '    void operation.catch(() => {',
+        '      // The hook exposes this same structured failure through `error`.',
+        '    });',
+        '  };',
+        '',
+        '  return (',
+        '    <section aria-label="Assistant" aria-busy={busy}>',
+        '      {messages.map((message) => (',
+        '        <article key={message.id} data-role={message.role}>',
+        '          {message.parts.map((part, index) => {',
+        '            if (part.type === "text") return <p key={index}>{part.text}</p>;',
+        '            if (part.type === "data-confirmation") {',
+        '              const review = part.data;',
+        '              return (',
+        '                <section key={review.id} aria-label="Review proposed action">',
+        '                  <h3>{review.title ?? "Review proposed action"}</h3>',
+        '                  {review.description ? <p>{review.description}</p> : null}',
+        '                  <pre aria-label="Proposed action arguments">',
+        '                    {JSON.stringify(review.arguments ?? {}, null, 2)}',
+        '                  </pre>',
+        '                  <button',
+        '                    disabled={busy || review.status !== "pending"}',
+        '                    onClick={() => settle(client.respond(review.id, { action: "accept" }))}',
+        '                  >',
+        '                    Confirm',
+        '                  </button>',
+        '                  <button',
+        '                    disabled={busy || review.status !== "pending"}',
+        '                    onClick={() => settle(client.respond(review.id, { action: "decline" }))}',
+        '                  >',
+        "                    Don't proceed",
+        '                  </button>',
+        '                </section>',
+        '              );',
+        '            }',
+        '            if (part.type === "data-input-request") {',
+        '              const request = part.data;',
+        '              return (',
+        '                <section key={request.id} aria-label="Assistant needs input">',
+        '                  <p>{request.message}</p>',
+        '                  <p>This renderer has not implemented the requested form.</p>',
+        '                  <button',
+        '                    disabled={busy || request.status !== "pending"}',
+        '                    onClick={() => settle(client.respond(request.id, { action: "decline" }))}',
+        '                  >',
+        '                    Cancel request',
+        '                  </button>',
+        '                </section>',
+        '              );',
+        '            }',
+        '            if (part.type === "data-tool-result") {',
+        '              return (',
+        '                <pre key={part.data.id} aria-label={`${part.data.tool} result`}>',
+        '                  {JSON.stringify(part.data.result, null, 2)}',
+        '                </pre>',
+        '              );',
+        '            }',
+        '            if (part.type === "data-view") {',
+        '              return (',
+        '                <p key={part.data.id}>',
+        '                  Trusted app view available: {part.data.title ?? part.data.resourceUri}',
+        '                </p>',
+        '              );',
+        '            }',
+        '            return <p key={index}>Unsupported assistant content.</p>;',
+        '          })}',
+        '        </article>',
+        '      ))}',
+        '      {error ? <p role="alert">{error.message}</p> : null}',
+        '      <form',
+        '        onSubmit={(event) => {',
+        '          event.preventDefault();',
+        '          const message = draft.trim();',
+        '          if (!message) return;',
+        '          setDraft("");',
+        '          settle(client.sendMessage(message));',
+        '        }}',
+        '      >',
+        '        <input',
+        '          aria-label="Message"',
+        '          value={draft}',
+        '          onChange={(event) => setDraft(event.currentTarget.value)}',
+        '        />',
+        '        {busy ? (',
+        '          <button type="button" onClick={() => client.abort()}>Stop</button>',
+        '        ) : (',
+        '          <button type="submit">Send</button>',
+        '        )}',
+        '      </form>',
+        '    </section>',
+        '  );',
+        '}',
+        '```',
+        '',
+        '`principalKey` is a browser-local identity for the authenticated user/tenant and is never sent to Noodle. Change it whenever that principal changes; the hook then aborts and clears the previous session and transcript. The hook does not register `<noodle-assistant>` or render Noodle markup.',
+        '',
+        'The sample fails closed on input requests until you replace that branch with a form generated from `requestedSchema`. A custom renderer must show the complete confirmation review and both decisions, handle every part it supports, and surface an explicit unsupported state for the rest. For `data-view`, map `resourceUri` or `tool` plus the bounded/redacted `result` to a component already trusted by the application. Never inject `part.data.html`, assign it to `srcdoc`, or fetch a `ui://` URI; the managed element alone supplies Noodle’s sandbox host. Do not wrap this client in another chat transport or invent user messages for interaction continuations.',
+        '',
+        'Outside React, use the same DOM-free client directly. It keeps the session token in memory, exposes a React-free `UIMessage` transcript with typed parts, and never registers a custom element:',
         '',
         '```ts',
         'import { createAssistantClient } from "@noodleseed/assistant/client";',
@@ -269,30 +387,39 @@ export function renderEmbeddedAssistantReference() {
         "  structuredContent: { widget: { name: 'time-off', lifecycle: 'mounted' } },",
         '});',
         '',
-        'let pendingId: string | undefined;',
-        'let requestedSchema: unknown;',
-        'assistant.subscribe((event) => {',
-        '  renderAssistantEvent(event);',
-        "  if (event.event === 'view_available') {",
-        '    renderRegisteredView(event.data.resourceUri, event.data.result);',
-        '  }',
-        "  if ((event.event === 'tool_proposed' || event.event === 'input_requested') && typeof event.data.id === 'string') {",
-        '    pendingId = event.data.id;',
-        "    requestedSchema = event.event === 'input_requested' ? event.data.requestedSchema : undefined;",
+        'let pending: { id: string; requestedSchema?: Readonly<Record<string, unknown>> } | undefined;',
+        'assistant.subscribeChat((state) => {',
+        '  renderUIMessageState(state);',
+        '  pending = undefined;',
+        '  for (const message of state.messages) {',
+        '    for (const part of message.parts) {',
+        "      if (part.type === 'data-confirmation' && part.data.status === 'pending') {",
+        '        pending = { id: part.data.id };',
+        '      }',
+        "      if (part.type === 'data-input-request' && part.data.status === 'pending') {",
+        '        pending = { id: part.data.id, requestedSchema: part.data.requestedSchema };',
+        '      }',
+        "      if (part.type === 'data-view') {",
+        '        renderRegisteredView(part.data.resourceUri, part.data.result);',
+        '      }',
+        '    }',
         '  }',
         '});',
         '',
         'await assistant.sendMessage("Book next Thursday and Friday off");',
-        'if (pendingId) {',
+        'if (pending) {',
+        '  const requestedSchema = pending.requestedSchema;',
         '  const resolution = requestedSchema',
         "    ? { action: 'accept' as const, content: await renderPortableForm(requestedSchema) }",
         "    : { action: 'accept' as const };",
-        '  await assistant.respond(pendingId, resolution);',
+        '  await assistant.respond(pending.id, resolution);',
         '}',
         "// The same pending id also accepts { action: 'decline' } or { action: 'cancel' }.",
         '```',
         '',
-        '`view_available` means a completed tool has a linked MCP App view. It carries the call/interaction id, tool, `ui://` identity, optional title, bounded/redacted public result, and—on current services—the self-contained bridged document. The standard element is an MCP Apps host and mounts that document behind a double iframe. It supports lifecycle, app tool/resource calls, ui/message, ui/update-model-context, links, resize, and inline/fullscreen; sampling, tasks, downloads, and remote DOM are not advertised. It also dispatches `assistant-view-available` for a customer-owned renderer.',
+        '`subscribeChat` immediately emits a detached `{ messages, status, error? }` snapshot and then emits as `UIMessage.parts` change. Text uses `text`; Noodle confirmations, input requests, tool results, and linked views use `data-confirmation`, `data-input-request`, `data-tool-result`, and `data-view`. Interaction data moves through pending/submitting/accepted/declined/cancelled. Use raw `subscribe(...)` only for transport/session lifecycle events that are not transcript content.',
+        '',
+        '`data-view` means a completed tool has a linked MCP App view. It carries the call/interaction id, tool, `ui://` identity, optional title, bounded/redacted public result, and—on current services—the self-contained bridged document. The standard element is an MCP Apps host and mounts that document behind a double iframe; a customer renderer ignores it and maps the identity/result to an application-trusted component. The standard element supports lifecycle, app tool/resource calls, ui/message, ui/update-model-context, links, resize, and inline/fullscreen; sampling, tasks, downloads, and remote DOM are not advertised. It also dispatches `assistant-view-available` for a customer-owned renderer.',
         '',
         '`clientContext` and typed `pageContext` are recomputed for each turn. `updateContext(...)` remains the legacy session-exchange context; `updatePageContext(...)` replaces the fresh per-turn application hint. `updateModelContext({ content, structuredContent })` publishes one cohesive renderer snapshot for later message turns without starting a turn; every call replaces the prior snapshot rather than merging fields. These are untrusted data, not conversation history or authorization input, and the boundaries reject credential-shaped or unbounded updates. A message may re-exchange once after a pre-execution `401`; the client never auto-retries interaction decisions. `tool_proposed.arguments` is a complete schema-aware review projection and, for connector-backed tools, names the sole exact connector version/operation/resolved arguments. Sensitive/write-only fields are redacted; truncating or omitting any non-sensitive action field fails closed. Accept is bound to the server-held action and claims at most one execution attempt—clients cannot replace it. Normal terminal outcomes scrub private arguments and continuations immediately; only an accepted action still executing retains them for the one-hour unknown-outcome recovery window, after which it records `interaction_outcome_unknown` and scrubs. Without downstream idempotency this is not an exactly-once business-effect guarantee. To reconcile a lost response, explicitly repeat the same id and decision: the service returns its durable stored outcome without re-execution.',
         '',
@@ -300,7 +427,7 @@ export function renderEmbeddedAssistantReference() {
         '',
         '- Node.js 20+ for `@noodleseed/assistant/server`.',
         '- The package ships ESM and CommonJS with full export conditions; no bundler aliases, `transpilePackages`, or ambient type shims are needed. If resolution fails, the installed package version is outdated: update `@noodleseed/assistant` instead of adding workarounds.',
-        '- TypeScript `moduleResolution` `bundler` or `node16` recommended; classic `node` also resolves the `/client`, `/react`, and `/server` subpaths.',
+        '- TypeScript `moduleResolution` `bundler` or `node16` recommended; classic `node` also resolves the `/client`, `/react`, `/react/client`, and `/server` subpaths.',
         '',
         '## Verify the boundary',
         '',

package/node_modules/@noodle-borg/agent-kit/dist/skill-embedded-assistant-ref.js.map

@@ -1 +1 @@
-{"version":3,"file":"skill-embedded-assistant-ref.js","sourceRoot":"","sources":["../src/skill-embedded-assistant-ref.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,MAAM,UAAU,gCAAgC;IAC9C,OAAO;QACL,sBAAsB;QACtB,EAAE;QACF,aAAa;QACb,EAAE;QACF,gBAAgB;QAChB,uBAAuB;QACvB,8BAA8B;QAC9B,wBAAwB;QACxB,kCAAkC;QAClC,6BAA6B;QAC7B,kCAAkC;QAClC,iCAAiC;QACjC,kDAAkD;QAClD,wBAAwB;QACxB,6BAA6B;QAC7B,0BAA0B;QAC1B,uBAAuB;QACvB,yCAAyC;QACzC,EAAE;QACF,iBAAiB;QACjB,EAAE;QACF,4SAA4S;QAC5S,EAAE;QACF,2CAA2C;QAC3C,EAAE;QACF,kCAAkC;QAClC,qBAAqB;QACrB,8KAA8K;QAC9K,kNAAkN;QAClN,EAAE;QACF,wBAAwB;QACxB,EAAE;QACF,6IAA6I;QAC7I,EAAE;QACF,OAAO;QACP,gDAAgD;QAChD,wEAAwE;QACxE,gCAAgC;QAChC,6BAA6B;QAC7B,oDAAoD;QACpD,yCAAyC;QACzC,gDAAgD;QAChD,OAAO;QACP,yEAAyE;QACzE,2DAA2D;QAC3D,KAAK;QACL,KAAK;QACL,EAAE;QACF,qUAAqU;QACrU,EAAE;QACF,MAAM;QACN,EAAE;QACF,OAAO;QACP,wBAAwB;QACxB,iDAAiD;QACjD,KAAK;QACL,EAAE;QACF,+FAA+F;QAC/F,EAAE;QACF,+BAA+B;QAC/B,EAAE;QACF,6PAA6P;QAC7P,EAAE;QACF,OAAO;QACP,gCAAgC;QAChC,0BAA0B;QAC1B,0FAA0F;QAC1F,uCAAuC;QACvC,qGAAqG;QACrG,mBAAmB;QACnB,uFAAuF;QACvF,iFAAiF;QACjF,eAAe;QACf,uBAAuB;QACvB,oEAAoE;QACpE,QAAQ;QACR,yFAAyF;QACzF,kEAAkE;QAClE,MAAM;QACN,KAAK;QACL,KAAK;QACL,EAAE;QACF,+WAA+W;QAC/W,EAAE;QACF,kvBAAkvB;QAClvB,EAAE;QACF,ydAAyd;QACzd,EAAE;QACF,yBAAyB;QACzB,EAAE;QACF,gOAAgO;QAChO,EAAE;QACF,OAAO;QACP,8HAA8H;QAC9H,sGAAsG;QACtG,+HAA+H;QAC/H,mDAAmD;QACnD,KAAK;QACL,EAAE;QACF,8LAA8L;QAC9L,EAAE;QACF,mCAAmC;QACnC,EAAE;QACF,kZAAkZ;QAClZ,EAAE;QACF,OAAO;QACP,oCAAoC;QACpC,yFAAyF;QACzF,KAAK;QACL,wEAAwE;QACxE,KAAK;QACL,EAAE;QACF,8BAA8B;QAC9B,EAAE;QACF,iCAAiC;QACjC,EAAE;QACF,OAAO;QACP,gFAAgF;QAChF,KAAK;QACL,EAAE;QACF,iOAAiO;QACjO,EAAE;QACF,wIAAwI;QACxI,EAAE;QACF,OAAO;QACP,2FAA2F;QAC3F,KAAK;QACL,EAAE;QACF,6PAA6P;QAC7P,EAAE;QACF,mCAAmC;QACnC,EAAE;QACF,4KAA4K;QAC5K,EAAE;QACF,oDAAoD;QACpD,EAAE;QACF,OAAO;QACP,wEAAwE;QACxE,EAAE;QACF,gDAAgD;QAChD,mDAAmD;QACnD,6CAA6C;QAC7C,kDAAkD;QAClD,kDAAkD;QAClD,wDAAwD;QACxD,gEAAgE;QAChE,6CAA6C;QAC7C,kEAAkE;QAClE,cAAc;QACd,wEAAwE;QACxE,oEAAoE;QACpE,OAAO;QACP,kCAAkC;QAClC,GAAG;QACH,KAAK;QACL,EAAE;QACF,6SAA6S;QAC7S,EAAE;QACF,0TAA0T;QAC1T,EAAE;QACF,kCAAkC;QAClC,EAAE;QACF,waAAwa;QACxa,EAAE;QACF,iGAAiG;QACjG,EAAE;QACF,OAAO;QACP,YAAY;QACZ,6DAA6D;QAC7D,cAAc;QACd,qFAAqF;QACrF,kDAAkD;QAClD,wDAAwD;QACxD,gCAAgC;QAChC,yCAAyC;QACzC,WAAW;QACX,wFAAwF;QACxF,QAAQ;QACR,MAAM;QACN,IAAI;QACJ,KAAK;QACL,EAAE;QACF,svBAAsvB;QACtvB,EAAE;QACF,6BAA6B;QAC7B,EAAE;QACF,2zDAA2zD;QAC3zD,EAAE;QACF,mDAAmD;QACnD,EAAE;QACF,uHAAuH;QACvH,EAAE;QACF,wHAAwH;QACxH,EAAE;QACF,OAAO;QACP,gDAAgD;QAChD,+CAA+C;QAC/C,8DAA8D;QAC9D,0FAA0F;QAC1F,KAAK;QACL,KAAK;QACL,EAAE;QACF,iLAAiL;QACjL,EAAE;QACF,OAAO;QACP,gCAAgC;QAChC,0BAA0B;QAC1B,oBAAoB;QACpB,2CAA2C;QAC3C,2CAA2C;QAC3C,oDAAoD;QACpD,MAAM;QACN,KAAK;QACL,KAAK;QACL,EAAE;QACF,gGAAgG;QAChG,EAAE;QACF,OAAO;QACP,iBAAiB;QACjB,6CAA6C;QAC7C,wBAAwB;QACxB,wCAAwC;QACxC,+FAA+F;QAC/F,KAAK;QACL,KAAK;QACL,EAAE;QACF,mdAAmd;QACnd,EAAE;QACF,mZAAmZ;QACnZ,EAAE;QACF,igBAAigB;QACjgB,EAAE;QACF,yBAAyB;QACzB,EAAE;QACF,2aAA2a;QAC3a,EAAE;QACF,8BAA8B;QAC9B,EAAE;QACF,8CAA8C;QAC9C,EAAE;QACF,QAAQ;QACR,gEAAgE;QAChE,EAAE;QACF,4EAA4E;QAC5E,KAAK;QACL,EAAE;QACF,oMAAoM;QACpM,EAAE;QACF,0OAA0O;QAC1O,EAAE;QACF,oKAAoK;QACpK,EAAE;QACF,OAAO;QACP,uEAAuE;QACvE,EAAE;QACF,2CAA2C;QAC3C,8CAA8C;QAC9C,2BAA2B;QAC3B,iCAAiC;QACjC,iEAAiE;QACjE,OAAO;QACP,KAAK;QACL,EAAE;QACF,gCAAgC;QAChC,uEAAuE;QACvE,8EAA8E;QAC9E,KAAK;QACL,EAAE;QACF,oCAAoC;QACpC,+BAA+B;QAC/B,kCAAkC;QAClC,gCAAgC;QAChC,2CAA2C;QAC3C,sEAAsE;QACtE,KAAK;QACL,sHAAsH;QACtH,gCAAgC;QAChC,mGAAmG;QACnG,KAAK;QACL,KAAK;QACL,EAAE;QACF,mEAAmE;QACnE,kBAAkB;QAClB,sCAAsC;QACtC,yFAAyF;QACzF,sCAAsC;QACtC,mDAAmD;QACnD,GAAG;QACH,oFAAoF;QACpF,KAAK;QACL,EAAE;QACF,8kBAA8kB;QAC9kB,EAAE;QACF,sgDAAsgD;QACtgD,EAAE;QACF,2BAA2B;QAC3B,EAAE;QACF,mDAAmD;QACnD,4QAA4Q;QAC5Q,kJAAkJ;QAClJ,EAAE;QACF,wBAAwB;QACxB,EAAE;QACF,8CAA8C;QAC9C,2EAA2E;QAC3E,oFAAoF;QACpF,+QAA+Q;QAC/Q,mKAAmK;QACnK,oHAAoH;QACpH,2DAA2D;QAC3D,EAAE;QACF,0CAA0C;QAC1C,EAAE;QACF,+BAA+B;QAC/B,qBAAqB;QACrB,ySAAyS;QACzS,4eAA4e;QAC5e,6NAA6N;QAC7N,iMAAiM;QACjM,gKAAgK;QAChK,iKAAiK;QACjK,wKAAwK;QACxK,+LAA+L;QAC/L,+KAA+K;QAC/K,uRAAuR;QACvR,gNAAgN;QAChN,4JAA4J;QAC5J,yHAAyH;QACzH,oOAAoO;QACpO,mRAAmR;QACnR,mMAAmM;QACnM,6LAA6L;QAC7L,qVAAqV;QACrV,iPAAiP;KAClP,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}
+{"version":3,"file":"skill-embedded-assistant-ref.js","sourceRoot":"","sources":["../src/skill-embedded-assistant-ref.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,MAAM,UAAU,gCAAgC;IAC9C,OAAO;QACL,sBAAsB;QACtB,EAAE;QACF,aAAa;QACb,EAAE;QACF,gBAAgB;QAChB,uBAAuB;QACvB,8BAA8B;QAC9B,wBAAwB;QACxB,kCAAkC;QAClC,6BAA6B;QAC7B,kCAAkC;QAClC,iCAAiC;QACjC,kDAAkD;QAClD,wBAAwB;QACxB,6BAA6B;QAC7B,0BAA0B;QAC1B,uBAAuB;QACvB,yCAAyC;QACzC,EAAE;QACF,iBAAiB;QACjB,EAAE;QACF,4SAA4S;QAC5S,EAAE;QACF,2CAA2C;QAC3C,EAAE;QACF,kCAAkC;QAClC,qBAAqB;QACrB,8KAA8K;QAC9K,kNAAkN;QAClN,EAAE;QACF,wBAAwB;QACxB,EAAE;QACF,6IAA6I;QAC7I,EAAE;QACF,OAAO;QACP,gDAAgD;QAChD,wEAAwE;QACxE,gCAAgC;QAChC,6BAA6B;QAC7B,oDAAoD;QACpD,yCAAyC;QACzC,gDAAgD;QAChD,OAAO;QACP,yEAAyE;QACzE,2DAA2D;QAC3D,KAAK;QACL,KAAK;QACL,EAAE;QACF,qUAAqU;QACrU,EAAE;QACF,MAAM;QACN,EAAE;QACF,OAAO;QACP,wBAAwB;QACxB,iDAAiD;QACjD,KAAK;QACL,EAAE;QACF,+FAA+F;QAC/F,EAAE;QACF,+BAA+B;QAC/B,EAAE;QACF,6PAA6P;QAC7P,EAAE;QACF,OAAO;QACP,gCAAgC;QAChC,0BAA0B;QAC1B,0FAA0F;QAC1F,uCAAuC;QACvC,qGAAqG;QACrG,mBAAmB;QACnB,uFAAuF;QACvF,iFAAiF;QACjF,eAAe;QACf,uBAAuB;QACvB,oEAAoE;QACpE,QAAQ;QACR,yFAAyF;QACzF,kEAAkE;QAClE,MAAM;QACN,KAAK;QACL,KAAK;QACL,EAAE;QACF,+WAA+W;QAC/W,EAAE;QACF,kvBAAkvB;QAClvB,EAAE;QACF,ydAAyd;QACzd,EAAE;QACF,yBAAyB;QACzB,EAAE;QACF,gOAAgO;QAChO,EAAE;QACF,OAAO;QACP,8HAA8H;QAC9H,sGAAsG;QACtG,+HAA+H;QAC/H,mDAAmD;QACnD,KAAK;QACL,EAAE;QACF,8LAA8L;QAC9L,EAAE;QACF,mCAAmC;QACnC,EAAE;QACF,kZAAkZ;QAClZ,EAAE;QACF,OAAO;QACP,oCAAoC;QACpC,yFAAyF;QACzF,KAAK;QACL,wEAAwE;QACxE,KAAK;QACL,EAAE;QACF,8BAA8B;QAC9B,EAAE;QACF,iCAAiC;QACjC,EAAE;QACF,OAAO;QACP,gFAAgF;QAChF,KAAK;QACL,EAAE;QACF,iOAAiO;QACjO,EAAE;QACF,wIAAwI;QACxI,EAAE;QACF,OAAO;QACP,2FAA2F;QAC3F,KAAK;QACL,EAAE;QACF,6PAA6P;QAC7P,EAAE;QACF,mCAAmC;QACnC,EAAE;QACF,4KAA4K;QAC5K,EAAE;QACF,oDAAoD;QACpD,EAAE;QACF,OAAO;QACP,wEAAwE;QACxE,EAAE;QACF,gDAAgD;QAChD,mDAAmD;QACnD,6CAA6C;QAC7C,kDAAkD;QAClD,kDAAkD;QAClD,wDAAwD;QACxD,gEAAgE;QAChE,6CAA6C;QAC7C,kEAAkE;QAClE,cAAc;QACd,wEAAwE;QACxE,oEAAoE;QACpE,OAAO;QACP,kCAAkC;QAClC,GAAG;QACH,KAAK;QACL,EAAE;QACF,6SAA6S;QAC7S,EAAE;QACF,0TAA0T;QAC1T,EAAE;QACF,kCAAkC;QAClC,EAAE;QACF,waAAwa;QACxa,EAAE;QACF,iGAAiG;QACjG,EAAE;QACF,OAAO;QACP,YAAY;QACZ,6DAA6D;QAC7D,cAAc;QACd,qFAAqF;QACrF,kDAAkD;QAClD,wDAAwD;QACxD,gCAAgC;QAChC,yCAAyC;QACzC,WAAW;QACX,wFAAwF;QACxF,QAAQ;QACR,MAAM;QACN,IAAI;QACJ,KAAK;QACL,EAAE;QACF,svBAAsvB;QACtvB,EAAE;QACF,6BAA6B;QAC7B,EAAE;QACF,2zDAA2zD;QAC3zD,EAAE;QACF,mDAAmD;QACnD,EAAE;QACF,uHAAuH;QACvH,EAAE;QACF,wHAAwH;QACxH,EAAE;QACF,OAAO;QACP,gDAAgD;QAChD,+CAA+C;QAC/C,8DAA8D;QAC9D,0FAA0F;QAC1F,KAAK;QACL,KAAK;QACL,EAAE;QACF,iLAAiL;QACjL,EAAE;QACF,OAAO;QACP,gCAAgC;QAChC,0BAA0B;QAC1B,oBAAoB;QACpB,2CAA2C;QAC3C,2CAA2C;QAC3C,oDAAoD;QACpD,MAAM;QACN,KAAK;QACL,KAAK;QACL,EAAE;QACF,gGAAgG;QAChG,EAAE;QACF,OAAO;QACP,iBAAiB;QACjB,6CAA6C;QAC7C,wBAAwB;QACxB,wCAAwC;QACxC,+FAA+F;QAC/F,KAAK;QACL,KAAK;QACL,EAAE;QACF,mdAAmd;QACnd,EAAE;QACF,mZAAmZ;QACnZ,EAAE;QACF,igBAAigB;QACjgB,EAAE;QACF,yBAAyB;QACzB,EAAE;QACF,2aAA2a;QAC3a,EAAE;QACF,8BAA8B;QAC9B,EAAE;QACF,8CAA8C;QAC9C,EAAE;QACF,QAAQ;QACR,gEAAgE;QAChE,EAAE;QACF,4EAA4E;QAC5E,KAAK;QACL,EAAE;QACF,oMAAoM;QACpM,EAAE;QACF,0OAA0O;QAC1O,EAAE;QACF,iKAAiK;QACjK,EAAE;QACF,QAAQ;QACR,eAAe;QACf,EAAE;QACF,mCAAmC;QACnC,0EAA0E;QAC1E,EAAE;QACF,+EAA+E;QAC/E,2CAA2C;QAC3C,oEAAoE;QACpE,gDAAgD;QAChD,mBAAmB;QACnB,6BAA6B;QAC7B,mCAAmC;QACnC,mEAAmE;QACnE,SAAS;QACT,OAAO;QACP,kEAAkE;QAClE,kDAAkD;QAClD,kCAAkC;QAClC,yEAAyE;QACzE,SAAS;QACT,MAAM;QACN,EAAE;QACF,YAAY;QACZ,uDAAuD;QACvD,oCAAoC;QACpC,6DAA6D;QAC7D,iDAAiD;QACjD,8EAA8E;QAC9E,sDAAsD;QACtD,yCAAyC;QACzC,wBAAwB;QACxB,+EAA+E;QAC/E,uEAAuE;QACvE,6EAA6E;QAC7E,gEAAgE;QAChE,uEAAuE;QACvE,0BAA0B;QAC1B,2BAA2B;QAC3B,oEAAoE;QACpE,6FAA6F;QAC7F,qBAAqB;QACrB,6BAA6B;QAC7B,6BAA6B;QAC7B,2BAA2B;QAC3B,oEAAoE;QACpE,8FAA8F;QAC9F,qBAAqB;QACrB,mCAAmC;QACnC,6BAA6B;QAC7B,4BAA4B;QAC5B,kBAAkB;QAClB,eAAe;QACf,uDAAuD;QACvD,0CAA0C;QAC1C,wBAAwB;QACxB,+EAA+E;QAC/E,4CAA4C;QAC5C,gFAAgF;QAChF,2BAA2B;QAC3B,qEAAqE;QACrE,+FAA+F;QAC/F,qBAAqB;QACrB,oCAAoC;QACpC,6BAA6B;QAC7B,4BAA4B;QAC5B,kBAAkB;QAClB,eAAe;QACf,qDAAqD;QACrD,wBAAwB;QACxB,kFAAkF;QAClF,+DAA+D;QAC/D,wBAAwB;QACxB,kBAAkB;QAClB,eAAe;QACf,8CAA8C;QAC9C,wBAAwB;QACxB,wCAAwC;QACxC,0FAA0F;QAC1F,sBAAsB;QACtB,kBAAkB;QAClB,eAAe;QACf,uEAAuE;QACvE,eAAe;QACf,oBAAoB;QACpB,WAAW;QACX,4DAA4D;QAC5D,aAAa;QACb,gCAAgC;QAChC,mCAAmC;QACnC,yCAAyC;QACzC,iCAAiC;QACjC,yBAAyB;QACzB,gDAAgD;QAChD,YAAY;QACZ,SAAS;QACT,gBAAgB;QAChB,gCAAgC;QAChC,yBAAyB;QACzB,qEAAqE;QACrE,YAAY;QACZ,mBAAmB;QACnB,8EAA8E;QAC9E,eAAe;QACf,+CAA+C;QAC/C,YAAY;QACZ,eAAe;QACf,gBAAgB;QAChB,MAAM;QACN,GAAG;QACH,KAAK;QACL,EAAE;QACF,oSAAoS;QACpS,EAAE;QACF,mpBAAmpB;QACnpB,EAAE;QACF,iMAAiM;QACjM,EAAE;QACF,OAAO;QACP,uEAAuE;QACvE,EAAE;QACF,2CAA2C;QAC3C,8CAA8C;QAC9C,2BAA2B;QAC3B,iCAAiC;QACjC,iEAAiE;QACjE,OAAO;QACP,KAAK;QACL,EAAE;QACF,gCAAgC;QAChC,uEAAuE;QACvE,8EAA8E;QAC9E,KAAK;QACL,EAAE;QACF,+FAA+F;QAC/F,sCAAsC;QACtC,gCAAgC;QAChC,wBAAwB;QACxB,2CAA2C;QAC3C,yCAAyC;QACzC,kFAAkF;QAClF,yCAAyC;QACzC,SAAS;QACT,mFAAmF;QACnF,qFAAqF;QACrF,SAAS;QACT,wCAAwC;QACxC,wEAAwE;QACxE,SAAS;QACT,OAAO;QACP,KAAK;QACL,KAAK;QACL,EAAE;QACF,mEAAmE;QACnE,gBAAgB;QAChB,oDAAoD;QACpD,sCAAsC;QACtC,yFAAyF;QACzF,sCAAsC;QACtC,oDAAoD;QACpD,GAAG;QACH,oFAAoF;QACpF,KAAK;QACL,EAAE;QACF,keAAke;QACle,EAAE;QACF,4rBAA4rB;QAC5rB,EAAE;QACF,sgDAAsgD;QACtgD,EAAE;QACF,2BAA2B;QAC3B,EAAE;QACF,mDAAmD;QACnD,4QAA4Q;QAC5Q,mKAAmK;QACnK,EAAE;QACF,wBAAwB;QACxB,EAAE;QACF,8CAA8C;QAC9C,2EAA2E;QAC3E,oFAAoF;QACpF,+QAA+Q;QAC/Q,mKAAmK;QACnK,oHAAoH;QACpH,2DAA2D;QAC3D,EAAE;QACF,0CAA0C;QAC1C,EAAE;QACF,+BAA+B;QAC/B,qBAAqB;QACrB,ySAAyS;QACzS,4eAA4e;QAC5e,6NAA6N;QAC7N,iMAAiM;QACjM,gKAAgK;QAChK,iKAAiK;QACjK,wKAAwK;QACxK,+LAA+L;QAC/L,+KAA+K;QAC/K,uRAAuR;QACvR,gNAAgN;QAChN,4JAA4J;QAC5J,yHAAyH;QACzH,oOAAoO;QACpO,mRAAmR;QACnR,mMAAmM;QACnM,6LAA6L;QAC7L,qVAAqV;QACrV,iPAAiP;KAClP,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/one",
-  "version": "0.73.1",
+  "version": "0.74.0",
   "private": false,
   "description": "Noodle CLI by Noodle Seed — author, run, and deploy declarative MCP servers. Embedding the assistant in your own web app is @noodleseed/assistant.",
   "license": "Apache-2.0",