@noodleseed/one 0.86.1 → 0.87.0

package/node_modules/@noodle-borg/agent-kit/dist/generated/example-files.js

@@ -49,11 +49,11 @@ export const BUNDLED_EXAMPLE_FILES = [
     { relPath: "examples/acme-tasks/src/views/widget-style.css", content: ":root {\n  color-scheme: light dark;\n  font-family:\n    Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif;\n  --nw-bg: #ffffff;\n  --nw-surface: #f7f5ff;\n  --nw-text: #1c1830;\n  --nw-muted: #635d80;\n  --nw-border: #e2ddf5;\n  --nw-accent: #7c3aed;\n  --nw-accent-strong: #6d28d9;\n  --nw-accent-soft: #efe9ff;\n  --nw-high: #dc2626;\n  --nw-medium: #b45309;\n  --nw-low: #2563eb;\n  --nw-radius: 10px;\n  --nw-shadow: 0 18px 50px rgb(30 20 60 / 12%);\n}\n\n.dark,\n[data-theme=\"dark\"] {\n  --nw-bg: #161228;\n  --nw-surface: #1d1735;\n  --nw-text: #f2eeff;\n  --nw-muted: #a99fce;\n  --nw-border: #342a54;\n  --nw-accent: #a78bfa;\n  --nw-accent-strong: #8b5cf6;\n  --nw-accent-soft: #2a2148;\n  --nw-high: #f87171;\n  --nw-medium: #fbbf24;\n  --nw-low: #60a5fa;\n  --nw-shadow: 0 18px 50px rgb(0 0 0 / 32%);\n}\n\n* {\n  box-sizing: border-box;\n}\n\nbody {\n  margin: 0;\n  background: var(--nw-bg);\n  color: var(--nw-text);\n}\n\nbutton,\ninput,\nselect {\n  font: inherit;\n}\n\n.nw-shell {\n  min-height: 100vh;\n  padding: 14px;\n  background: var(--nw-bg);\n  color: var(--nw-text);\n}\n\n.nw-card {\n  max-width: 620px;\n  margin: 0 auto;\n  background: var(--nw-surface);\n  border: 1px solid var(--nw-border);\n  border-radius: var(--nw-radius);\n  box-shadow: var(--nw-shadow);\n  overflow: hidden;\n}\n\n.nw-header {\n  display: flex;\n  align-items: center;\n  gap: 12px;\n  padding: 16px;\n  border-bottom: 1px solid var(--nw-border);\n}\n\n.nw-icon svg {\n  width: 24px;\n  height: 24px;\n  fill: none;\n  stroke: var(--nw-accent);\n  stroke-width: 2;\n  stroke-linecap: round;\n  stroke-linejoin: round;\n}\n\n.nw-title-block {\n  flex: 1;\n  min-width: 0;\n}\n\n.nw-title {\n  margin: 0;\n  font-size: 17px;\n  font-weight: 700;\n}\n\n.nw-subtitle {\n  margin: 2px 0 0;\n  font-size: 13px;\n  color: var(--nw-muted);\n}\n\n.nw-chip {\n  padding: 4px 10px;\n  border-radius: 999px;\n  background: var(--nw-accent-soft);\n  color: var(--nw-accent-strong);\n  font-size: 12px;\n  font-weight: 600;\n}\n\n.nw-capture {\n  display: flex;\n  gap: 8px;\n  padding: 14px 16px 4px;\n}\n\n.nw-input {\n  flex: 1;\n  padding: 9px 12px;\n  border: 1px solid var(--nw-border);\n  border-radius: 10px;\n  background: var(--nw-bg);\n  color: var(--nw-text);\n}\n\n.nw-button {\n  display: inline-flex;\n  align-items: center;\n  gap: 6px;\n  padding: 9px 14px;\n  border: 1px solid var(--nw-border);\n  border-radius: 10px;\n  background: var(--nw-bg);\n  color: var(--nw-text);\n  cursor: pointer;\n}\n\n.nw-button-primary {\n  background: var(--nw-accent);\n  border-color: var(--nw-accent);\n  color: #ffffff;\n  font-weight: 600;\n}\n\n.nw-button-primary:disabled {\n  opacity: 0.6;\n  cursor: default;\n}\n\n.nw-list {\n  list-style: none;\n  margin: 0;\n  padding: 8px 16px 4px;\n  display: flex;\n  flex-direction: column;\n  gap: 8px;\n}\n\n.nw-task {\n  display: flex;\n  align-items: center;\n  gap: 10px;\n  padding: 10px 12px;\n  border: 1px solid var(--nw-border);\n  border-radius: 12px;\n  background: var(--nw-bg);\n}\n\n.nw-task-title {\n  flex: 1;\n  min-width: 0;\n}\n\n.nw-task-done {\n  opacity: 0.55;\n}\n\n.nw-task-done .nw-task-title {\n  text-decoration: line-through;\n}\n\n.nw-check {\n  width: 22px;\n  height: 22px;\n  border: 1.5px solid var(--nw-border);\n  border-radius: 999px;\n  background: transparent;\n  color: #ffffff;\n  cursor: pointer;\n  flex: none;\n}\n\n.nw-check-on {\n  background: var(--nw-accent);\n  border-color: var(--nw-accent);\n}\n\n.nw-priority {\n  padding: 5px 8px;\n  border: 1px solid var(--nw-border);\n  border-radius: 8px;\n  background: var(--nw-bg);\n  color: var(--nw-text);\n  font-size: 12px;\n  font-weight: 600;\n}\n\n.nw-priority-high {\n  color: var(--nw-high);\n}\n\n.nw-priority-medium {\n  color: var(--nw-medium);\n}\n\n.nw-priority-low {\n  color: var(--nw-low);\n}\n\n.nw-note {\n  margin: 0;\n  padding: 8px 16px 16px;\n  font-size: 12px;\n  color: var(--nw-muted);\n}\n" },
     { relPath: "examples/acme-tasks/test/server.test.ts", content: "import { describe, expect, it } from 'vitest';\nimport app from '../src/server.js';\n\ndescribe('acme-tasks example', () => {\n  it('exports a Noodle server definition', () => {\n    expect(typeof app.toManifest).toBe('function');\n  });\n\n  it('exposes a tool for each of the top-3 prioritized flows', async () => {\n    // Capture → add_task, Prioritize → list_today (+ set_priority helper), Complete → complete_task.\n    const text = JSON.stringify(await app.toManifest());\n    expect(text).toContain('add_task');\n    expect(text).toContain('list_today');\n    expect(text).toContain('complete_task');\n    expect(text).toContain('set_priority');\n  });\n\n  it('seeds today’s list highest-priority first', async () => {\n    const text = JSON.stringify(await app.toManifest());\n    expect(text).toMatch(/\"tasks\":\\[\\{\"id\":\"email_vendor\".*\"priority\":\"high\"/);\n  });\n\n  it('opts the conversational completion action into runtime confirmation', async () => {\n    const manifest = await app.toManifest();\n    const completeTask = manifest.tools.find((candidate) => candidate.name === 'complete_task');\n    const addTask = manifest.tools.find((candidate) => candidate.name === 'add_task');\n\n    expect(completeTask?.annotations?.confirm).toBe(true);\n    expect(addTask?.annotations).not.toHaveProperty('confirm');\n  });\n});\n" },
     { relPath: "examples/acme-tasks/vitest.config.ts", content: "import { defineConfig } from 'vitest/config';\n\n// Local config so `npm test` (vitest run) discovers this example's own tests instead of inheriting a\n// parent monorepo config's include globs.\nexport default defineConfig({\n  test: { include: ['test/**/*.test.ts'] },\n});\n" },
-    { relPath: "examples/customer-auth/README.md", content: "# Customer Auth - NoodleSeed.com Firebase customer identity\n\nThis curated example owns the customer/end-user authentication with Firebase bridge capability slot. It is\nthe NoodleSeed.com dogfood app for proving that a SaaS app can protect an MCP endpoint with its own customer\nidentity provider while still using the generic Noodle Seed authoring API.\n\nIt also owns the embedded-assistant showcase: the same authenticated MCP surface can be dropped into the\nSaaS web application as a fully customer-branded assistant with independent light and dark themes. The\nassistant loads the active deployment's instructions and model-visible tools rather than installing a stale\nsecond skill bundle. The standard embedded element also hosts linked MCP Apps behind its sandbox bridge.\n\nThe public developer entrypoint is [`src/server.ts`](src/server.ts). It declares `customerAuth.firebase(...)` with\nthe NoodleSeed.com Firebase project and Firebase Web App public config. It exposes a deliberately small MCP\nsurface for org discovery:\n\n- `list_my_organizations` lists the NoodleSeed.com organizations the signed-in customer belongs to (no\n  arguments — the org set comes from the verified customer session).\n- `list_org_apps` lists apps for one of those organizations through the dev app API.\n\nThe two tools chain: `list_my_organizations` surfaces the `org_id`s the customer can act on, and\n`list_org_apps` takes one of those `org_id`s. There is no NoodleSeed-specific SDK helper. The downstream API\nis an ordinary authored HTTP connector.\n\n## Direct or federated OIDC instead of the built-in adapter\n\nThis flagship uses the managed Firebase adapter. If an app replaces it with `customerAuth.oidc(...)` or\n`customerAuth.federatedOidc(...)`, the app developer owns the authorization server. It must publish the\nprimary path-inserted RFC 8414 URL as direct HTTP 200 JSON with the exact issuer, HTTPS authorization/token/\nregistration/JWKS endpoints, authorization-code and refresh grants, PKCE S256, public-client auth method\n`none`, RFC 8707 resource handling, an access-token `aud` equal to the exact MCP URL, and public signing keys.\n\nRun `noodle auth doctor src/server.ts` before sharing the endpoint. Its issuer-readiness probes perform\nbounded read-only GET checks and never register a client. A successful\n`noodle deploy --access customers` reports the same findings as nonblocking warnings; the application team\nrepairs the issuer rather than adding a Noodle OAuth proxy.\n\nAdding the embedded assistant does not choose or rewrite MCP customer auth. Inspect the exact active\ndeployment before changing configuration:\n\n```sh\nnoodle deployments list --org <org> --app <app> --env <env> --json\n```\n\nThis Firebase bridge intentionally advertises the Noodle authorization server. A direct or federated\nreplacement must advertise its configured tenant issuer. If the exact active direct/federated `customers`\ndeployment instead advertises the platform issuer, report `customer_auth_state_inconsistent` with only the\nendpoint, deployment ID, server version, and sanitized protected-resource metadata. Do not share tokens or\nsecrets, proxy or rewrite metadata, rotate credentials, or redeploy repeatedly to conceal the mismatch.\n\nDuring MCP OAuth login, Noodle Cloud hosts the Firebase bridge page at\n`https://cloud.noodleseed.dev/oauth/customer/firebase/authorize`. The customer app does not add an\nauthorization route. The SaaS operator only configures Firebase Auth to allow the Noodle Cloud origin, and\nNoodle Cloud signs the customer in with Firebase before posting the Firebase ID token back to its own bridge\ncallback.\n\n## How delegated customer credentials are used\n\nThis flagship uses the legacy Firebase provider bridge because it is runnable today. That is distinct from\nCore-v2 account-selecting connector aliases: those declare catalog `credentialProfiles` and bind each alias\nwith `bind(connector, { profile, connection })`. Hosted bound `managedSecret(...)` connections are runnable;\nbound `externalExchange()` and `clientCredentials(...)` currently compile as portable metadata but fail\nclosed before secret or network access until their provider slice lands. Do not replace this example's\nworking delegated-session-cookie path with either unsupported bound exchange source.\n\nThe example has two declarations that work together:\n\n```ts\nauth: customerAuth.firebase({\n  projectId: variable('FIREBASE_PROJECT_ID'),\n  apiKey: variable('FIREBASE_WEB_API_KEY'),\n  authDomain: variable('FIREBASE_AUTH_DOMAIN'),\n  user: {\n    id: 'sub',\n    email: 'email',\n    name: 'name',\n    tenant: 'firebase.tenant',\n    orgs: 'claims.orgs',\n    roles: 'claims.roles',\n  },\n}),\n```\n\nThat protects the MCP endpoint with the SaaS customer's Firebase identity. The connector then opts into\ndelegated customer credentials:\n\n```ts\nauth: {\n  kind: 'delegatedSessionCookie',\n  provider: 'firebase',\n  sessionUrl: `${noodleseedApiOrigin}/api/auth/session`,\n  tokenField: 'idToken',\n},\n```\n\nTool code calls the connector normally:\n\n```ts\nfulfil({ input, connectors }) {\n  const apps = connectors.app_api.listOrgApps({\n    org_id: input.org_id,\n    skip: input.skip,\n    limit: input.limit,\n  });\n\n  return { result: apps.result };\n}\n```\n\nAt runtime, Noodle Seed verifies the Firebase customer during MCP OAuth, stores that customer's delegated\nFirebase refresh token in the credential broker, and refreshes a short-lived Firebase ID token only when a\nconnector-backed tool calls the NoodleSeed.com API. For this app API, the broker exchanges that ID token at\nthe existing Next.js `/api/auth/session` route and sends the resulting session cookie to the API. The MCP\naccess token remains a Noodle-issued resource-bound token and is never sent to the downstream API.\n\n## Delegated downstream auth for your own API (token exchange)\n\nThe Firebase path above only works for Firebase-session downstreams. When the downstream is **your own\nAPI** with its own token issuance, use `delegatedTokenExchange` instead\n([ADR 0152](../../docs/decisions/0152-delegated-token-exchange-connector-auth.md)): the platform signs a\nshort-lived, JWKS-verifiable assertion of the signed-in user and exchanges it (RFC 8693) at a token\nendpoint you implement, which mints your own user-scoped token — so your API enforces its own per-user\nauthorization on every call. It works for verified direct/federated OIDC, built-in provider identities, and\nembedded assistant sessions, with no per-user OAuth enrollment.\n\n```ts\nauth: {\n  kind: 'delegatedTokenExchange',\n  tokenUrl: 'https://app.example.com/api/assistant/oauth/token', // origin must be in allowedOrigins\n  clientId: variable('EXAMPLE_DELEG_CLIENT_ID'),\n  clientSecret: secret('EXAMPLE_DELEG_CLIENT_SECRET'),\n  scopes: ['time_off'],\n},\n```\n\nYour endpoint authenticates the broker's client credential, verifies the `subject_token` JWT against the\nplatform issuer JWKS (claims include the verified `sub`, `email`, `name`, declared session `claims`,\n`tenant`, and `deployment`), mints a short-lived user-scoped token, and returns the standard\n`{ access_token, token_type, expires_in }` response. The exact wire contract and a copyable endpoint\nimplementation live in [docs/spec/connectors.md](../../docs/spec/connectors.md) and the Agent Kit\nauthoring-workflow reference (\"Delegated downstream auth\"). `noodle auth doctor` reports each declared\nexchange endpoint.\n\n## Validate\n\n```bash\nnoodle auth doctor examples/customer-auth/src/server.ts\nnoodle validate examples/customer-auth/src/server.ts\n```\n\nAgainst a deployed customer-protected environment, set a short-lived real customer token only in\n`NOODLE_CUSTOMER_TOKEN` and add `--live --org <org> --app <app> --env <env>`. The live doctor performs\ncredential exchanges without invoking either business tool.\n\n## Run locally\n\n```bash\nnoodle dev examples/customer-auth/src/server.ts --app noodleseed-customer-auth\n```\n\n## Configuration\n\nThe embedded assistant uses a customer-supplied OpenAI Chat Completions-compatible endpoint. Configure its\nmanaged values at the Noodle deployment environment; none of these values belongs in the customer web\napplication environment, and the API key never reaches the browser:\n\n```bash\nnoodle variables set ASSISTANT_MODEL_BASE_URL https://model.example.com/v1 --scope env\nnoodle variables set ASSISTANT_MODEL your-model --scope env\nnoodle secrets set ASSISTANT_MODEL_API_KEY --scope env\nnoodle variables set FIREBASE_PROJECT_ID your-firebase-project --scope env\nnoodle variables set FIREBASE_WEB_API_KEY your-firebase-web-api-key --scope env\nnoodle variables set FIREBASE_AUTH_DOMAIN your-firebase-project.firebaseapp.com --scope env\nnoodle check --target embedded-assistant src/server.ts\n```\n\nAssistant origins are exact. Production embedding origins must use HTTPS; plain HTTP is accepted only for\nloopback development origins such as `http://localhost:3000`, `http://127.0.0.1:3000`, or\n`http://[::1]:3000`. `noodle dev` serves the MCP project, not that separate embedding application.\n\nThe assistant's panel, launcher, status header, composer, and message treatment are configured through the\nbounded `presentation` object in `src/server.ts`. The Atlas-style product treatment is the supported\ncustomization ceiling. These primitives derive their colors from the shared server `branding` block and\nrequire no edits to `@noodleseed/assistant`; raw HTML, CSS, inline SVG, renderer class names, and callbacks\nare intentionally not accepted in deployment configuration.\n\nCreate the backend credential after deployment. The CLI writes it to a mode-0600 file and never prints the\nsecret:\n\n```bash\nnoodle assistant clients create --name web --org noodleseed --app customer-auth --env prod\n```\n\nOnly the Noodle service URL, assistant client ID, and assistant client secret belong in the authenticated\ncustomer backend. The model URL, model name, and model API key remain managed by the Noodle deployment.\n\nThe customer's authenticated backend calls `createAssistantSession(...)` from\n`@noodleseed/assistant/server`, passing the already-verified user and browser origin. The browser then uses\nthe returned short-lived session through the managed Web Component/React renderer or a customer-owned UI:\n\n```bash\npnpm add @noodleseed/assistant\n```\n\n```tsx\nimport { NoodleAssistant } from '@noodleseed/assistant/react';\n\n<NoodleAssistant\n  sessionEndpoint=\"/api/noodle-assistant/session\"\n  theme={resolvedTheme}\n  onSessionExpired={() => console.info('Assistant session renewed')}\n/>;\n```\n\n`resolvedTheme` is the application's current `'light' | 'dark'` value. Use `theme=\"auto\"` only when the\nbrowser operating-system preference is intentionally authoritative.\n\nFor an entirely application-owned React renderer, use the renderer-free hook. It creates no custom element\nand returns the AI SDK transcript plus the canonical client commands:\n\n```tsx\n'use client';\n\nimport { useEffect, useState } from 'react';\nimport { NoodleAppView } from '@noodleseed/assistant/react';\nimport { useNoodleAssistant } from '@noodleseed/assistant/react/client';\n\nexport function CustomerAssistant({\n  principalKey,\n  resolvedTheme,\n}: {\n  principalKey: string;\n  resolvedTheme: 'light' | 'dark';\n}) {\n  const [draft, setDraft] = useState('');\n  const { client, messages, status, error } = useNoodleAssistant({\n    sessionEndpoint: '/api/noodle-assistant/session',\n    principalKey,\n  });\n  const busy = status === 'submitted' || status === 'streaming';\n  const settle = (operation: Promise<void>) => {\n    void operation.catch(() => {\n      // The hook exposes this same structured failure through `error`.\n    });\n  };\n\n  return (\n    <section aria-label=\"Assistant\" aria-busy={busy}>\n      {messages.map((message) => (\n        <article key={message.id} data-role={message.role}>\n          {message.parts.map((part, index) => {\n            if (part.type === 'text') return <p key={index}>{part.text}</p>;\n            if (part.type === 'data-confirmation') {\n              const review = part.data;\n              return (\n                <section key={review.id} aria-label=\"Review proposed action\">\n                  <h3>{review.title ?? 'Review proposed action'}</h3>\n                  {review.description ? <p>{review.description}</p> : null}\n                  <pre aria-label=\"Proposed action arguments\">\n                    {JSON.stringify(review.arguments ?? {}, null, 2)}\n                  </pre>\n                  <button\n                    disabled={busy || review.status !== 'pending'}\n                    onClick={() => settle(client.respond(review.id, { action: 'accept' }))}\n                  >\n                    Confirm\n                  </button>\n                  <button\n                    disabled={busy || review.status !== 'pending'}\n                    onClick={() => settle(client.respond(review.id, { action: 'decline' }))}\n                  >\n                    Don't proceed\n                  </button>\n                </section>\n              );\n            }\n            if (part.type === 'data-input-request') {\n              const request = part.data;\n              return (\n                <section key={request.id} aria-label=\"Assistant needs input\">\n                  <p>{request.message}</p>\n                  <p>This renderer has not implemented the requested form.</p>\n                  <button\n                    disabled={busy || request.status !== 'pending'}\n                    onClick={() => settle(client.respond(request.id, { action: 'decline' }))}\n                  >\n                    Cancel request\n                  </button>\n                </section>\n              );\n            }\n            if (part.type === 'data-tool-result') {\n              return (\n                <pre key={part.data.id} aria-label={`${part.data.tool} result`}>\n                  {JSON.stringify(part.data.result, null, 2)}\n                </pre>\n              );\n            }\n            if (part.type === 'data-view') {\n              return (\n                <NoodleAppView\n                  key={`${part.data.id}:${part.data.resourceUri}`}\n                  client={client}\n                  view={part.data}\n                  theme={resolvedTheme}\n                />\n              );\n            }\n            return <p key={index}>Unsupported assistant content.</p>;\n          })}\n        </article>\n      ))}\n      {error ? <p role=\"alert\">{error.message}</p> : null}\n      <form\n        onSubmit={(event) => {\n          event.preventDefault();\n          const message = draft.trim();\n          if (!message) return;\n          setDraft('');\n          settle(client.sendMessage(message));\n        }}\n      >\n        <input\n          aria-label=\"Message\"\n          value={draft}\n          onChange={(event) => setDraft(event.currentTarget.value)}\n        />\n        {busy ? (\n          <button type=\"button\" onClick={() => client.abort()}>\n            Stop\n          </button>\n        ) : (\n          <button type=\"submit\">Send</button>\n        )}\n      </form>\n    </section>\n  );\n}\n```\n\n`principalKey` stays in the browser. Change it whenever the authenticated user or tenant changes; the hook\nthen aborts and clears the prior session and transcript. The sample fails closed on input requests until its\nfallback is replaced with a form generated from `requestedSchema`. A production renderer must show the\ncomplete confirmation review and both decisions. For `data-view`, map `resourceUri` or `tool` and the\nbounded/redacted result to a component already trusted by this application only when intentionally replacing\nthe linked App with a native UI. Otherwise use `NoodleAppView`; JSON result data is not the App UI. Its\nsemantic lifecycle identity is the client plus `view.id` plus `view.resourceUri`, so parent payload/callback\nrerenders keep the iframe and only a different view or unmount tears down the bridge.\nNever inject `part.data.html`, assign it to `srcdoc`, fetch a `ui://` URI, or reproduce the bridge directly. Pages with a\nContent-Security-Policy must include the Noodle service origin in both `connect-src` and `frame-src`.\n\nBefore the production-equivalent host build, run the presence-only handoff check:\n\n```sh\nnoodle assistant embed --check --json\n```\n\nAdd application-owned delegated-exchange requirements with repeatable `--require-env NAME` flags. The JSON\nreports required and missing names, CSP status, and post-deploy probes without returning environment values\nor writing scaffold files. Map the names through the production secret manager, CI environment, and any\nsecret allowlist; regenerate existing framework-owned environment binding types before the build. Default\nDevtools/model exercises to synthetic data, and obtain approval before sending real connector data to an\nexternal model.\n\nAfter deployment, verify the public delegated exchange without extracting a customer bearer token or invoking\na business operation:\n\n```sh\nnoodle assistant doctor --user-id <real-test-user> --origin \"$PUBLIC_APP_ORIGIN\" --org <org> --app <app> --env <env>\n```\n\nIf the application deliberately sends a first turn on mount, do not combine a persistent \"sent\" ref with a\nmount effect. React Strict Mode can abort that provisional request and then suppress the stable remount.\nSchedule the send after the provisional cleanup and settle its promise:\n\n```tsx\nuseEffect(() => {\n  let active = true;\n  queueMicrotask(() => {\n    if (active) settle(client.sendMessage(initialMessage));\n  });\n  return () => {\n    active = false;\n  };\n}, [client, initialMessage]);\n```\n\nFor a chat-first custom host, raw `tool_started` supplies the direct call `id` and technical tool name. Map\nknown tools to concise application copy and use a neutral fallback. Reserve a stable `role=\"status\"` region\nfor thinking, tool activity, and the view skeleton; switch to the ready `NoodleAppView` on `view_available`\nor to `role=\"alert\"` on error. Decorative skeleton shapes stay hidden from assistive technology, and shimmer\nor transition motion is disabled under `prefers-reduced-motion`.\n\nUse `${view.id}:${view.resourceUri}` as transport identity. Different call IDs are distinct invocations and\nmust not be deduplicated generically. If this application intentionally owns one current panel for a known\nresource, declare an application-owned slot for that resource and replace only that slot.\n\nOutside React, subscribe to the DOM-free client directly. It exposes the same conversation as headless AI\nSDK `UIMessage` state, including typed confirmation, input, tool-result, and linked-view parts:\n\n```ts\nimport { createAssistantClient } from '@noodleseed/assistant/client';\n\nconst assistant = createAssistantClient({\n  sessionEndpoint: '/api/noodle-assistant/session',\n});\n\nassistant.subscribeChat((state) => {\n  renderUIMessageState(state);\n  for (const message of state.messages) {\n    for (const part of message.parts) {\n      if (part.type === 'data-confirmation' && part.data.status === 'pending') {\n        renderConfirmation(part.data, (response) => assistant.respond(part.data.id, response));\n      }\n    }\n  }\n});\n```\n\n`theme=\"auto\"` follows the browser operating-system preference, not a SaaS-owned theme toggle. Pass the\napplication's resolved `light`/`dark` theme to both `NoodleAssistant` and `NoodleAppView`; later updates\nreach mounted MCP Apps without remounting them. CSS custom properties inherit through the assistant host, so\ntyped appearance roles may reuse existing application tokens with `var(--app-token)`. The server-level\n`branding` block is inherited by both MCP App widgets and the assistant; documented `--ns-assistant-*`\nsemantic CSS variables remain the final integration escape hatch. There is no second assistant branding\ndeclaration.\nThe end-user UI contains only customer branding.\nText streams progressively. Expired turns re-exchange through the authenticated backend and retry once;\nconsent-bound tool confirmations never replay automatically.\n\nThe Firebase project ID is required because Firebase ID tokens use the project ID as the token audience and\nissuer suffix. The runtime verifies `aud` against the project ID and `iss` against\n`https://securetoken.google.com/<projectId>`.\n\nThe Firebase Web API key and auth domain are public Firebase browser configuration. They let the Noodle\nCloud-hosted bridge initialize Firebase Auth for this customer project; they are not server secrets. Keep\nthem out of source with `variable(...)`, restrict the Firebase key to the expected browser origins and APIs,\nand use `secret(...)` only for credentials that must never reach a browser.\n\nThe `noodleseed_app_api` connector currently points at the NoodleSeed.com dev app surface:\n\n```text\nhttps://dev.noodleseed.com\n```\n\nWhen the customer app moves from `dev.noodleseed.com` to `app.noodleseed.com`, update the connector's\n`noodleseedApiOrigin` constant to the production API origin that serves the same paths.\n\nThe connector uses delegated Firebase customer credentials. During the customer OAuth bridge, Noodle Seed\nverifies the Firebase ID token, stores the Firebase refresh token through the credential broker, and refreshes\na Firebase ID token when the connector calls the NoodleSeed.com app API. The broker then exchanges that ID\ntoken for the app's existing Next.js session cookie. There is no shared `NOODLESEED_APP_API_TOKEN` for this\nexample.\n\nFirebase Auth must list `cloud.noodleseed.dev` as an authorized domain before browser sign-in works in\nproduction.\n\n## Deploy customer-protected to Noodle Seed Cloud\n\n```bash\nnoodle deploy examples/customer-auth/src/server.ts \\\n  --org noodleseed \\\n  --app customer-auth \\\n  --env prod \\\n  --access customers\n```\n\nEndpoint:\n\n```text\nhttps://cloud.noodleseed.dev/o/noodleseed/customer-auth/mcp\n```\n\n## MCP Primitives\n\n- Tool `list_my_organizations`: calls `GET /api/organizations` and returns the organizations the signed-in\n  customer is a member of. Takes no arguments; the org set is scoped by the verified customer session.\n- Tool `list_org_apps`: calls `GET /api/organizations/{org_id}/apps` for one organization `org_id`.\n\n## Auth boundary\n\nFirebase ID-token verification is handled by Noodle Seed's generic Firebase bridge adapter during OAuth\nissuance. The MCP client receives a Noodle-issued, resource-bound access token marked as a Firebase customer\nidentity; raw Firebase tokens and inbound MCP bearer tokens are never forwarded to tools, connectors,\nwidgets, or downstream systems.\n\nThe connector-backed tools use the credential broker to turn the signed-in Firebase customer session into the\nsame session-cookie credential that the existing NoodleSeed.com Next.js API already expects. The inbound MCP\nbearer token is never used as an app API credential.\n" },
+    { relPath: "examples/customer-auth/README.md", content: "# Customer Auth - NoodleSeed.com Firebase customer identity\n\nThis curated example owns the customer/end-user authentication with Firebase bridge capability slot. It is\nthe NoodleSeed.com dogfood app for proving that a SaaS app can protect an MCP endpoint with its own customer\nidentity provider while still using the generic Noodle Seed authoring API.\n\nIt also owns the embedded-assistant showcase: the same authenticated MCP surface can be dropped into the\nSaaS web application as a fully customer-branded assistant with independent light and dark themes. The\nassistant loads the active deployment's instructions and model-visible tools rather than installing a stale\nsecond skill bundle. The standard embedded element also hosts linked MCP Apps behind its sandbox bridge.\n\nThe public developer entrypoint is [`src/server.ts`](src/server.ts). It declares `customerAuth.firebase(...)` with\nthe NoodleSeed.com Firebase project and Firebase Web App public config. It exposes a deliberately small MCP\nsurface for org discovery:\n\n- `list_my_organizations` lists the NoodleSeed.com organizations the signed-in customer belongs to (no\n  arguments — the org set comes from the verified customer session).\n- `list_org_apps` lists apps for one of those organizations through the dev app API. It is visible and\n  callable only when the verified customer has the `org_apps:read` scope and either the `org_admin` or\n  `org_member` role.\n\nThe two tools chain: `list_my_organizations` surfaces the `org_id`s the customer can act on, and\n`list_org_apps` takes one of those `org_id`s. There is no NoodleSeed-specific SDK helper. The downstream API\nis an ordinary authored HTTP connector.\n\n## Direct or federated OIDC instead of the built-in adapter\n\nThis flagship uses the managed Firebase adapter. If an app replaces it with `customerAuth.oidc(...)` or\n`customerAuth.federatedOidc(...)`, the app developer owns the authorization server. It must publish the\nprimary path-inserted RFC 8414 URL as direct HTTP 200 JSON with the exact issuer, HTTPS authorization/token/\nregistration/JWKS endpoints, authorization-code and refresh grants, PKCE S256, public-client auth method\n`none`, RFC 8707 resource handling, an access-token `aud` equal to the exact MCP URL, and public signing keys.\n\nRun `noodle auth doctor src/server.ts` before sharing the endpoint. Its issuer-readiness probes perform\nbounded read-only GET checks and never register a client. A successful\n`noodle deploy --access customers` reports the same findings as nonblocking warnings; the application team\nrepairs the issuer rather than adding a Noodle OAuth proxy.\n\nAdding the embedded assistant does not choose or rewrite MCP customer auth. Inspect the exact active\ndeployment before changing configuration:\n\n```sh\nnoodle deployments list --org <org> --app <app> --env <env> --json\n```\n\nThis Firebase bridge intentionally advertises the Noodle authorization server. A direct or federated\nreplacement must advertise its configured tenant issuer. If the exact active direct/federated `customers`\ndeployment instead advertises the platform issuer, report `customer_auth_state_inconsistent` with only the\nendpoint, deployment ID, server version, and sanitized protected-resource metadata. Do not share tokens or\nsecrets, proxy or rewrite metadata, rotate credentials, or redeploy repeatedly to conceal the mismatch.\n\nDuring MCP OAuth login, Noodle Cloud hosts the Firebase bridge page at\n`https://cloud.noodleseed.dev/oauth/customer/firebase/authorize`. The customer app does not add an\nauthorization route. The SaaS operator only configures Firebase Auth to allow the Noodle Cloud origin, and\nNoodle Cloud signs the customer in with Firebase before posting the Firebase ID token back to its own bridge\ncallback.\n\n## How delegated customer credentials are used\n\nThis flagship uses the legacy Firebase provider bridge because it is runnable today. That is distinct from\nCore-v2 account-selecting connector aliases: those declare catalog `credentialProfiles` and bind each alias\nwith `bind(connector, { profile, connection })`. Hosted bound `managedSecret(...)` connections are runnable;\nbound `externalExchange()` and `clientCredentials(...)` currently compile as portable metadata but fail\nclosed before secret or network access until their provider slice lands. Do not replace this example's\nworking delegated-session-cookie path with either unsupported bound exchange source.\n\nThe example has two declarations that work together:\n\n```ts\nauth: customerAuth.firebase({\n  projectId: variable('FIREBASE_PROJECT_ID'),\n  apiKey: variable('FIREBASE_WEB_API_KEY'),\n  authDomain: variable('FIREBASE_AUTH_DOMAIN'),\n  user: {\n    id: 'sub',\n    email: 'email',\n    name: 'name',\n    tenant: 'firebase.tenant',\n        orgs: 'claims.orgs',\n        roles: 'claims.roles',\n        scopes: 'claims.scopes',\n      },\n}),\n```\n\nThat protects the MCP endpoint with the SaaS customer's Firebase identity. The connector then opts into\ndelegated customer credentials:\n\n```ts\nauth: {\n  kind: 'delegatedSessionCookie',\n  provider: 'firebase',\n  sessionUrl: `${noodleseedApiOrigin}/api/auth/session`,\n  tokenField: 'idToken',\n},\n```\n\nThe mapped `roles` and `scopes` paths are read only after Firebase verifies the ID token. The restricted\ntool declares its rule beside the rest of its public contract:\n\n```ts\ntool('list_org_apps', {\n  authorization: {\n    requiredScopes: ['org_apps:read'],\n    allowedRoles: ['org_admin', 'org_member'],\n  },\n  // input, output, and fulfilment...\n});\n```\n\nEvery required scope must be present and at least one allowed role must match. When both lists are declared,\nboth conditions apply. A restricted tool is omitted from `tools/list` for an ineligible customer and a\ndirect `tools/call` still fails closed. Do not use unverified page context, request arguments, connector\nresponses, or an arbitrary generic `roles` claim as authorization input.\n\nTool code calls the connector normally:\n\n```ts\nfulfil({ input, connectors }) {\n  const apps = connectors.app_api.listOrgApps({\n    org_id: input.org_id,\n    skip: input.skip,\n    limit: input.limit,\n  });\n\n  return { result: apps.result };\n}\n```\n\nAt runtime, Noodle Seed verifies the Firebase customer during MCP OAuth, stores that customer's delegated\nFirebase refresh token in the credential broker, and refreshes a short-lived Firebase ID token only when a\nconnector-backed tool calls the NoodleSeed.com API. For this app API, the broker exchanges that ID token at\nthe existing Next.js `/api/auth/session` route and sends the resulting session cookie to the API. The MCP\naccess token remains a Noodle-issued resource-bound token and is never sent to the downstream API.\n\n## Delegated downstream auth for your own API (token exchange)\n\nThe Firebase path above only works for Firebase-session downstreams. When the downstream is **your own\nAPI** with its own token issuance, use `delegatedTokenExchange` instead\n([ADR 0152](../../docs/decisions/0152-delegated-token-exchange-connector-auth.md)): the platform signs a\nshort-lived, JWKS-verifiable assertion of the signed-in user and exchanges it (RFC 8693) at a token\nendpoint you implement, which mints your own user-scoped token — so your API enforces its own per-user\nauthorization on every call. It works for verified direct/federated OIDC, built-in provider identities, and\nembedded assistant sessions, with no per-user OAuth enrollment.\n\n```ts\nauth: {\n  kind: 'delegatedTokenExchange',\n  tokenUrl: 'https://app.example.com/api/assistant/oauth/token', // origin must be in allowedOrigins\n  clientId: variable('EXAMPLE_DELEG_CLIENT_ID'),\n  clientSecret: secret('EXAMPLE_DELEG_CLIENT_SECRET'),\n  scopes: ['time_off'],\n},\n```\n\nYour endpoint authenticates the broker's client credential, verifies the `subject_token` JWT against the\nplatform issuer JWKS (claims include the verified `sub`, `email`, `name`, declared session `claims`,\n`tenant`, and `deployment`), mints a short-lived user-scoped token, and returns the standard\n`{ access_token, token_type, expires_in }` response. The exact wire contract and a copyable endpoint\nimplementation live in [docs/spec/connectors.md](../../docs/spec/connectors.md) and the Agent Kit\nauthoring-workflow reference (\"Delegated downstream auth\"). `noodle auth doctor` reports each declared\nexchange endpoint.\n\n## Validate\n\n```bash\nnoodle auth doctor examples/customer-auth/src/server.ts\nnoodle validate examples/customer-auth/src/server.ts\n```\n\nAgainst a deployed customer-protected environment, set a short-lived real customer token only in\n`NOODLE_CUSTOMER_TOKEN` and add `--live --org <org> --app <app> --env <env>`. The live doctor performs\ncredential exchanges without invoking either business tool.\n\n## Run locally\n\n```bash\nnoodle dev examples/customer-auth/src/server.ts --app noodleseed-customer-auth\n```\n\n## Configuration\n\nThe embedded assistant uses a customer-supplied OpenAI Chat Completions-compatible endpoint. Configure its\nmanaged values at the Noodle deployment environment; none of these values belongs in the customer web\napplication environment, and the API key never reaches the browser:\n\n```bash\nnoodle variables set ASSISTANT_MODEL_BASE_URL https://model.example.com/v1 --scope env\nnoodle variables set ASSISTANT_MODEL your-model --scope env\nnoodle secrets set ASSISTANT_MODEL_API_KEY --scope env\nnoodle variables set FIREBASE_PROJECT_ID your-firebase-project --scope env\nnoodle variables set FIREBASE_WEB_API_KEY your-firebase-web-api-key --scope env\nnoodle variables set FIREBASE_AUTH_DOMAIN your-firebase-project.firebaseapp.com --scope env\nnoodle check --target embedded-assistant src/server.ts\n```\n\nAssistant origins are exact. Production embedding origins must use HTTPS; plain HTTP is accepted only for\nloopback development origins such as `http://localhost:3000`, `http://127.0.0.1:3000`, or\n`http://[::1]:3000`. `noodle dev` serves the MCP project, not that separate embedding application.\n\nThe assistant's panel, launcher, status header, composer, and message treatment are configured through the\nbounded `presentation` object in `src/server.ts`. The Atlas-style product treatment is the supported\ncustomization ceiling. These primitives derive their colors from the shared server `branding` block and\nrequire no edits to `@noodleseed/assistant`; raw HTML, CSS, inline SVG, renderer class names, and callbacks\nare intentionally not accepted in deployment configuration.\n\nCreate the backend credential after deployment. The CLI writes it to a mode-0600 file and never prints the\nsecret:\n\n```bash\nnoodle assistant clients create --name web --org noodleseed --app customer-auth --env prod\n```\n\nOnly the Noodle service URL, assistant client ID, and assistant client secret belong in the authenticated\ncustomer backend. The model URL, model name, and model API key remain managed by the Noodle deployment.\n\nThe customer's authenticated backend calls `createAssistantSession(...)` from\n`@noodleseed/assistant/server`, passing the already-verified user and browser origin. The browser then uses\nthe returned short-lived session through the managed Web Component/React renderer or a customer-owned UI:\n\n```bash\npnpm add @noodleseed/assistant\n```\n\n```tsx\nimport { NoodleAssistant } from '@noodleseed/assistant/react';\n\n<NoodleAssistant\n  sessionEndpoint=\"/api/noodle-assistant/session\"\n  theme={resolvedTheme}\n  onSessionExpired={() => console.info('Assistant session renewed')}\n/>;\n```\n\n`resolvedTheme` is the application's current `'light' | 'dark'` value. Use `theme=\"auto\"` only when the\nbrowser operating-system preference is intentionally authoritative.\n\nFor an entirely application-owned React renderer, use the renderer-free hook. It creates no custom element\nand returns the AI SDK transcript plus the canonical client commands:\n\n```tsx\n'use client';\n\nimport { useEffect, useState } from 'react';\nimport { NoodleAppView } from '@noodleseed/assistant/react';\nimport { useNoodleAssistant } from '@noodleseed/assistant/react/client';\n\nexport function CustomerAssistant({\n  principalKey,\n  resolvedTheme,\n}: {\n  principalKey: string;\n  resolvedTheme: 'light' | 'dark';\n}) {\n  const [draft, setDraft] = useState('');\n  const { client, messages, status, error } = useNoodleAssistant({\n    sessionEndpoint: '/api/noodle-assistant/session',\n    principalKey,\n  });\n  const busy = status === 'submitted' || status === 'streaming';\n  const settle = (operation: Promise<void>) => {\n    void operation.catch(() => {\n      // The hook exposes this same structured failure through `error`.\n    });\n  };\n\n  return (\n    <section aria-label=\"Assistant\" aria-busy={busy}>\n      {messages.map((message) => (\n        <article key={message.id} data-role={message.role}>\n          {message.parts.map((part, index) => {\n            if (part.type === 'text') return <p key={index}>{part.text}</p>;\n            if (part.type === 'data-confirmation') {\n              const review = part.data;\n              return (\n                <section key={review.id} aria-label=\"Review proposed action\">\n                  <h3>{review.title ?? 'Review proposed action'}</h3>\n                  {review.description ? <p>{review.description}</p> : null}\n                  <pre aria-label=\"Proposed action arguments\">\n                    {JSON.stringify(review.arguments ?? {}, null, 2)}\n                  </pre>\n                  <button\n                    disabled={busy || review.status !== 'pending'}\n                    onClick={() => settle(client.respond(review.id, { action: 'accept' }))}\n                  >\n                    Confirm\n                  </button>\n                  <button\n                    disabled={busy || review.status !== 'pending'}\n                    onClick={() => settle(client.respond(review.id, { action: 'decline' }))}\n                  >\n                    Don't proceed\n                  </button>\n                </section>\n              );\n            }\n            if (part.type === 'data-input-request') {\n              const request = part.data;\n              return (\n                <section key={request.id} aria-label=\"Assistant needs input\">\n                  <p>{request.message}</p>\n                  <p>This renderer has not implemented the requested form.</p>\n                  <button\n                    disabled={busy || request.status !== 'pending'}\n                    onClick={() => settle(client.respond(request.id, { action: 'decline' }))}\n                  >\n                    Cancel request\n                  </button>\n                </section>\n              );\n            }\n            if (part.type === 'data-tool-result') {\n              return (\n                <pre key={part.data.id} aria-label={`${part.data.tool} result`}>\n                  {JSON.stringify(part.data.result, null, 2)}\n                </pre>\n              );\n            }\n            if (part.type === 'data-view') {\n              return (\n                <NoodleAppView\n                  key={`${part.data.id}:${part.data.resourceUri}`}\n                  client={client}\n                  view={part.data}\n                  theme={resolvedTheme}\n                />\n              );\n            }\n            return <p key={index}>Unsupported assistant content.</p>;\n          })}\n        </article>\n      ))}\n      {error ? <p role=\"alert\">{error.message}</p> : null}\n      <form\n        onSubmit={(event) => {\n          event.preventDefault();\n          const message = draft.trim();\n          if (!message) return;\n          setDraft('');\n          settle(client.sendMessage(message));\n        }}\n      >\n        <input\n          aria-label=\"Message\"\n          value={draft}\n          onChange={(event) => setDraft(event.currentTarget.value)}\n        />\n        {busy ? (\n          <button type=\"button\" onClick={() => client.abort()}>\n            Stop\n          </button>\n        ) : (\n          <button type=\"submit\">Send</button>\n        )}\n      </form>\n    </section>\n  );\n}\n```\n\n`principalKey` stays in the browser. Change it whenever the authenticated user or tenant changes; the hook\nthen aborts and clears the prior session and transcript. The sample fails closed on input requests until its\nfallback is replaced with a form generated from `requestedSchema`. A production renderer must show the\ncomplete confirmation review and both decisions. For `data-view`, map `resourceUri` or `tool` and the\nbounded/redacted result to a component already trusted by this application only when intentionally replacing\nthe linked App with a native UI. Otherwise use `NoodleAppView`; JSON result data is not the App UI. Its\nsemantic lifecycle identity is the client plus `view.id` plus `view.resourceUri`, so parent payload/callback\nrerenders keep the iframe and only a different view or unmount tears down the bridge.\nNever inject `part.data.html`, assign it to `srcdoc`, fetch a `ui://` URI, or reproduce the bridge directly. Pages with a\nContent-Security-Policy must include the Noodle service origin in both `connect-src` and `frame-src`.\n\nBefore the production-equivalent host build, run the presence-only handoff check:\n\n```sh\nnoodle assistant embed --check --json\n```\n\nAdd application-owned delegated-exchange requirements with repeatable `--require-env NAME` flags. The JSON\nreports required and missing names, CSP status, and post-deploy probes without returning environment values\nor writing scaffold files. Map the names through the production secret manager, CI environment, and any\nsecret allowlist; regenerate existing framework-owned environment binding types before the build. Default\nDevtools/model exercises to synthetic data, and obtain approval before sending real connector data to an\nexternal model.\n\nAfter deployment, verify the public delegated exchange without extracting a customer bearer token or invoking\na business operation:\n\n```sh\nnoodle assistant doctor --user-id <real-test-user> --origin \"$PUBLIC_APP_ORIGIN\" --org <org> --app <app> --env <env>\n```\n\nIf the application deliberately sends a first turn on mount, do not combine a persistent \"sent\" ref with a\nmount effect. React Strict Mode can abort that provisional request and then suppress the stable remount.\nSchedule the send after the provisional cleanup and settle its promise:\n\n```tsx\nuseEffect(() => {\n  let active = true;\n  queueMicrotask(() => {\n    if (active) settle(client.sendMessage(initialMessage));\n  });\n  return () => {\n    active = false;\n  };\n}, [client, initialMessage]);\n```\n\nFor a chat-first custom host, raw `tool_started` supplies the direct call `id` and technical tool name. Map\nknown tools to concise application copy and use a neutral fallback. Reserve a stable `role=\"status\"` region\nfor thinking, tool activity, and the view skeleton; switch to the ready `NoodleAppView` on `view_available`\nor to `role=\"alert\"` on error. Decorative skeleton shapes stay hidden from assistive technology, and shimmer\nor transition motion is disabled under `prefers-reduced-motion`.\n\nUse `${view.id}:${view.resourceUri}` as transport identity. Different call IDs are distinct invocations and\nmust not be deduplicated generically. If this application intentionally owns one current panel for a known\nresource, declare an application-owned slot for that resource and replace only that slot.\n\nOutside React, subscribe to the DOM-free client directly. It exposes the same conversation as headless AI\nSDK `UIMessage` state, including typed confirmation, input, tool-result, and linked-view parts:\n\n```ts\nimport { createAssistantClient } from '@noodleseed/assistant/client';\n\nconst assistant = createAssistantClient({\n  sessionEndpoint: '/api/noodle-assistant/session',\n});\n\nassistant.subscribeChat((state) => {\n  renderUIMessageState(state);\n  for (const message of state.messages) {\n    for (const part of message.parts) {\n      if (part.type === 'data-confirmation' && part.data.status === 'pending') {\n        renderConfirmation(part.data, (response) => assistant.respond(part.data.id, response));\n      }\n    }\n  }\n});\n```\n\n`theme=\"auto\"` follows the browser operating-system preference, not a SaaS-owned theme toggle. Pass the\napplication's resolved `light`/`dark` theme to both `NoodleAssistant` and `NoodleAppView`; later updates\nreach mounted MCP Apps without remounting them. CSS custom properties inherit through the assistant host, so\ntyped appearance roles may reuse existing application tokens with `var(--app-token)`. The server-level\n`branding` block is inherited by both MCP App widgets and the assistant; documented `--ns-assistant-*`\nsemantic CSS variables remain the final integration escape hatch. There is no second assistant branding\ndeclaration.\nThe end-user UI contains only customer branding.\nText streams progressively. Expired turns re-exchange through the authenticated backend and retry once;\nconsent-bound tool confirmations never replay automatically.\n\nThe Firebase project ID is required because Firebase ID tokens use the project ID as the token audience and\nissuer suffix. The runtime verifies `aud` against the project ID and `iss` against\n`https://securetoken.google.com/<projectId>`.\n\nThe Firebase Web API key and auth domain are public Firebase browser configuration. They let the Noodle\nCloud-hosted bridge initialize Firebase Auth for this customer project; they are not server secrets. Keep\nthem out of source with `variable(...)`, restrict the Firebase key to the expected browser origins and APIs,\nand use `secret(...)` only for credentials that must never reach a browser.\n\nThe `noodleseed_app_api` connector currently points at the NoodleSeed.com dev app surface:\n\n```text\nhttps://dev.noodleseed.com\n```\n\nWhen the customer app moves from `dev.noodleseed.com` to `app.noodleseed.com`, update the connector's\n`noodleseedApiOrigin` constant to the production API origin that serves the same paths.\n\nThe connector uses delegated Firebase customer credentials. During the customer OAuth bridge, Noodle Seed\nverifies the Firebase ID token, stores the Firebase refresh token through the credential broker, and refreshes\na Firebase ID token when the connector calls the NoodleSeed.com app API. The broker then exchanges that ID\ntoken for the app's existing Next.js session cookie. There is no shared `NOODLESEED_APP_API_TOKEN` for this\nexample.\n\nFirebase Auth must list `cloud.noodleseed.dev` as an authorized domain before browser sign-in works in\nproduction.\n\n## Deploy customer-protected to Noodle Seed Cloud\n\n```bash\nnoodle deploy examples/customer-auth/src/server.ts \\\n  --org noodleseed \\\n  --app customer-auth \\\n  --env prod \\\n  --access customers\n```\n\nEndpoint:\n\n```text\nhttps://cloud.noodleseed.dev/o/noodleseed/customer-auth/mcp\n```\n\n## MCP Primitives\n\n- Tool `list_my_organizations`: calls `GET /api/organizations` and returns the organizations the signed-in\n  customer is a member of. Takes no arguments; the org set is scoped by the verified customer session.\n- Tool `list_org_apps`: calls `GET /api/organizations/{org_id}/apps` for one organization `org_id`.\n\n## Auth boundary\n\nFirebase ID-token verification is handled by Noodle Seed's generic Firebase bridge adapter during OAuth\nissuance. The MCP client receives a Noodle-issued, resource-bound access token marked as a Firebase customer\nidentity; raw Firebase tokens and inbound MCP bearer tokens are never forwarded to tools, connectors,\nwidgets, or downstream systems.\n\nThe connector-backed tools use the credential broker to turn the signed-in Firebase customer session into the\nsame session-cookie credential that the existing NoodleSeed.com Next.js API already expects. The inbound MCP\nbearer token is never used as an app API credential.\n" },
     { relPath: "examples/customer-auth/noodle.json", content: "{\n  \"entrypoint\": \"src/server.ts\",\n  \"name\": \"customer-auth\"\n}\n" },
     { relPath: "examples/customer-auth/package.json", content: "{\n  \"name\": \"customer-auth\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"scripts\": {\n    \"test\": \"vitest run\",\n    \"validate\": \"noodle validate\",\n    \"dev\": \"noodle dev\",\n    \"deploy\": \"noodle deploy\"\n  },\n  \"devDependencies\": {\n    \"@noodleseed/one\": \"latest\",\n    \"vitest\": \"latest\"\n  }\n}\n" },
-    { relPath: "examples/customer-auth/src/server.ts", content: "import {\n  annotations,\n  connector,\n  customerAuth,\n  embeddedAssistant,\n  openAICompatible,\n  secret,\n  server,\n  tool,\n  variable,\n  z,\n} from '@noodleseed/one';\n\nconst noodleseedApiOrigin = 'https://dev.noodleseed.com';\n\nconst noodleseedApi = connector('noodleseed_app_api')\n  .version('1.0.0')\n  .http({\n    baseUrl: noodleseedApiOrigin,\n    allowedOrigins: [noodleseedApiOrigin],\n    auth: {\n      kind: 'delegatedSessionCookie',\n      provider: 'firebase',\n      sessionUrl: `${noodleseedApiOrigin}/api/auth/session`,\n      tokenField: 'idToken',\n    },\n    operations: {\n      list_org_apps: {\n        type: 'read',\n        method: 'GET',\n        path: '/api/organizations/${args.org_id}/apps',\n        query: ['skip', 'limit'],\n        input: z.object({\n          org_id: z.string(),\n          skip: z.number().optional(),\n          limit: z.number().optional(),\n        }),\n        output: z.object({ result: z.unknown().optional() }),\n        response: {\n          result: '${response}',\n        },\n      },\n      list_organizations: {\n        type: 'read',\n        method: 'GET',\n        path: '/api/organizations',\n        output: z.object({ organizations: z.array(z.unknown()).optional() }),\n        response: {\n          organizations: '${response.organizations}',\n        },\n      },\n    },\n  });\n\nexport default server(\n  'noodleseed_customer_auth',\n  {\n    title: 'NoodleSeed.com Customer Auth',\n    version: '1.0.0',\n    branding: {\n      name: 'Noodle Seed Assistant',\n      accent: '#E85D24',\n      surface: '#FFFFFF',\n      surfaceDark: '#171310',\n      colorScheme: 'auto',\n      theme: {\n        light: { accentText: '#FFFFFF', text: '#1C1714' },\n        dark: { accent: '#FF8A4C', accentText: '#1C100A', text: '#FFF8F2' },\n      },\n    },\n    use: { app_api: noodleseedApi },\n    auth: customerAuth.firebase({\n      projectId: variable('FIREBASE_PROJECT_ID'),\n      apiKey: variable('FIREBASE_WEB_API_KEY'),\n      authDomain: variable('FIREBASE_AUTH_DOMAIN'),\n      user: {\n        id: 'sub',\n        email: 'email',\n        name: 'name',\n        tenant: 'firebase.tenant',\n        orgs: 'claims.orgs',\n        roles: 'claims.roles',\n      },\n    }),\n    instructions:\n      'Customer-authenticated demo. Firebase proves the customer identity, while read-only NoodleSeed.com API calls use broker-managed delegated Firebase customer credentials.',\n    assistant: embeddedAssistant({\n      model: openAICompatible({\n        baseUrl: variable('ASSISTANT_MODEL_BASE_URL'),\n        model: variable('ASSISTANT_MODEL'),\n        apiKey: secret('ASSISTANT_MODEL_API_KEY'),\n      }),\n      // Production origins are exact HTTPS; http://localhost:<port> is allowed for local development.\n      allowedOrigins: [\n        'https://app.noodleseed.com',\n        'https://dev.noodleseed.com',\n        'http://localhost:3000',\n      ],\n      layout: { mode: 'floating', position: 'bottom-right', panelWidth: 420 },\n      labels: {\n        welcomeHeading: 'How can I help with Noodle Seed?',\n        composerPlaceholder: 'Ask about your apps…',\n      },\n      presentation: {\n        panel: { surface: 'glass', elevation: 'soft', border: 'subtle' },\n        launcher: { icon: 'brand-mark', status: 'session', effect: 'pulse' },\n        header: {\n          mark: 'status',\n          badge: { text: 'Workspace online', tone: 'success', indicator: true },\n        },\n        composer: { leadingIcon: 'brand-mark', shape: 'pill' },\n      },\n      suggestedPrompts: ['Show my organizations', 'List the apps in my organization'],\n    }),\n  },\n  [\n    tool('list_org_apps', {\n      title: 'List organization apps',\n      description: 'List NoodleSeed.com apps for an organization from the dev app API.',\n      input: z.object({\n        org_id: z.string().meta({ title: 'Organization' }),\n        skip: z.number().int().min(0).optional().meta({ title: 'Starting item' }),\n        limit: z.number().int().min(1).max(100).optional().meta({ title: 'Maximum results' }),\n      }),\n      output: z.object({\n        result: z.unknown(),\n      }),\n      annotations: annotations.readOnly(),\n      fulfil({ input, connectors }) {\n        const apps = connectors.app_api.listOrgApps({\n          org_id: input.org_id,\n          skip: input.skip,\n          limit: input.limit,\n        });\n        return {\n          result: apps.result,\n        };\n      },\n    }),\n    tool('list_my_organizations', {\n      title: 'List my organizations',\n      description: 'List the NoodleSeed.com organizations the signed-in customer belongs to.',\n      contextProvider: true,\n      input: z.object({}),\n      // The dev app API returns every organization for the signed-in customer in one response, with no\n      // page parameter to pass through, so the bound is declared on the shape. A customer belongs to a\n      // handful of organizations; `noodle check` reports an unbounded list as\n      // `tool_design_output_bounds`.\n      output: z.object({\n        organizations: z.array(z.unknown()).max(100),\n      }),\n      annotations: annotations.readOnly(),\n      fulfil({ connectors }) {\n        const organizations = connectors.app_api.listOrganizations();\n        return {\n          organizations: organizations.organizations,\n        };\n      },\n    }),\n  ],\n);\n" },
-    { relPath: "examples/customer-auth/test/server.test.ts", content: "import { describe, expect, it } from 'vitest';\nimport app from '../src/server.js';\n\ndescribe('customer-auth example', () => {\n  it('exports a customer-authenticated, customer-branded embedded assistant', async () => {\n    expect(typeof app.toManifest).toBe('function');\n    const manifest = await app.toManifest();\n    expect(manifest.server.assistant).toMatchObject({\n      model: { kind: 'openai-compatible', apiKey: 'ASSISTANT_MODEL_API_KEY' },\n      layout: { mode: 'floating' },\n      presentation: {\n        panel: { surface: 'glass', elevation: 'soft', border: 'subtle' },\n        launcher: { icon: 'brand-mark', status: 'session', effect: 'pulse' },\n        header: { mark: 'status', badge: { text: 'Workspace online', tone: 'success' } },\n      },\n    });\n    expect(\n      manifest.server.assistant?.allowedOrigins.every(\n        (origin) => origin.startsWith('https://') || origin.startsWith('http://localhost:'),\n      ),\n    ).toBe(true);\n    expect(manifest.server.branding).toMatchObject({\n      name: 'Noodle Seed Assistant',\n      colorScheme: 'auto',\n    });\n    expect(manifest.server.auth).toMatchObject({\n      kind: 'bridge',\n      provider: 'firebase',\n      projectId: '${env.FIREBASE_PROJECT_ID}',\n      apiKey: '${env.FIREBASE_WEB_API_KEY}',\n      authDomain: '${env.FIREBASE_AUTH_DOMAIN}',\n    });\n  });\n});\n" },
+    { relPath: "examples/customer-auth/src/server.ts", content: "import {\n  annotations,\n  connector,\n  customerAuth,\n  embeddedAssistant,\n  openAICompatible,\n  secret,\n  server,\n  tool,\n  variable,\n  z,\n} from '@noodleseed/one';\n\nconst noodleseedApiOrigin = 'https://dev.noodleseed.com';\n\nconst noodleseedApi = connector('noodleseed_app_api')\n  .version('1.0.0')\n  .http({\n    baseUrl: noodleseedApiOrigin,\n    allowedOrigins: [noodleseedApiOrigin],\n    auth: {\n      kind: 'delegatedSessionCookie',\n      provider: 'firebase',\n      sessionUrl: `${noodleseedApiOrigin}/api/auth/session`,\n      tokenField: 'idToken',\n    },\n    operations: {\n      list_org_apps: {\n        type: 'read',\n        method: 'GET',\n        path: '/api/organizations/${args.org_id}/apps',\n        query: ['skip', 'limit'],\n        input: z.object({\n          org_id: z.string(),\n          skip: z.number().optional(),\n          limit: z.number().optional(),\n        }),\n        output: z.object({ result: z.unknown().optional() }),\n        response: {\n          result: '${response}',\n        },\n      },\n      list_organizations: {\n        type: 'read',\n        method: 'GET',\n        path: '/api/organizations',\n        output: z.object({ organizations: z.array(z.unknown()).optional() }),\n        response: {\n          organizations: '${response.organizations}',\n        },\n      },\n    },\n  });\n\nexport default server(\n  'noodleseed_customer_auth',\n  {\n    title: 'NoodleSeed.com Customer Auth',\n    version: '1.0.0',\n    branding: {\n      name: 'Noodle Seed Assistant',\n      accent: '#E85D24',\n      surface: '#FFFFFF',\n      surfaceDark: '#171310',\n      colorScheme: 'auto',\n      theme: {\n        light: { accentText: '#FFFFFF', text: '#1C1714' },\n        dark: { accent: '#FF8A4C', accentText: '#1C100A', text: '#FFF8F2' },\n      },\n    },\n    use: { app_api: noodleseedApi },\n    auth: customerAuth.firebase({\n      projectId: variable('FIREBASE_PROJECT_ID'),\n      apiKey: variable('FIREBASE_WEB_API_KEY'),\n      authDomain: variable('FIREBASE_AUTH_DOMAIN'),\n      user: {\n        id: 'sub',\n        email: 'email',\n        name: 'name',\n        tenant: 'firebase.tenant',\n        orgs: 'claims.orgs',\n        roles: 'claims.roles',\n        scopes: 'claims.scopes',\n      },\n    }),\n    instructions:\n      'Customer-authenticated demo. Firebase proves the customer identity, while read-only NoodleSeed.com API calls use broker-managed delegated Firebase customer credentials.',\n    assistant: embeddedAssistant({\n      model: openAICompatible({\n        baseUrl: variable('ASSISTANT_MODEL_BASE_URL'),\n        model: variable('ASSISTANT_MODEL'),\n        apiKey: secret('ASSISTANT_MODEL_API_KEY'),\n      }),\n      // Production origins are exact HTTPS; http://localhost:<port> is allowed for local development.\n      allowedOrigins: [\n        'https://app.noodleseed.com',\n        'https://dev.noodleseed.com',\n        'http://localhost:3000',\n      ],\n      layout: { mode: 'floating', position: 'bottom-right', panelWidth: 420 },\n      labels: {\n        welcomeHeading: 'How can I help with Noodle Seed?',\n        composerPlaceholder: 'Ask about your apps…',\n      },\n      presentation: {\n        panel: { surface: 'glass', elevation: 'soft', border: 'subtle' },\n        launcher: { icon: 'brand-mark', status: 'session', effect: 'pulse' },\n        header: {\n          mark: 'status',\n          badge: { text: 'Workspace online', tone: 'success', indicator: true },\n        },\n        composer: { leadingIcon: 'brand-mark', shape: 'pill' },\n      },\n      suggestedPrompts: ['Show my organizations', 'List the apps in my organization'],\n    }),\n  },\n  [\n    tool('list_org_apps', {\n      title: 'List organization apps',\n      description: 'List NoodleSeed.com apps for an organization from the dev app API.',\n      authorization: {\n        requiredScopes: ['org_apps:read'],\n        allowedRoles: ['org_admin', 'org_member'],\n      },\n      input: z.object({\n        org_id: z.string().meta({ title: 'Organization' }),\n        skip: z.number().int().min(0).optional().meta({ title: 'Starting item' }),\n        limit: z.number().int().min(1).max(100).optional().meta({ title: 'Maximum results' }),\n      }),\n      output: z.object({\n        result: z.unknown(),\n      }),\n      annotations: annotations.readOnly(),\n      fulfil({ input, connectors }) {\n        const apps = connectors.app_api.listOrgApps({\n          org_id: input.org_id,\n          skip: input.skip,\n          limit: input.limit,\n        });\n        return {\n          result: apps.result,\n        };\n      },\n    }),\n    tool('list_my_organizations', {\n      title: 'List my organizations',\n      description: 'List the NoodleSeed.com organizations the signed-in customer belongs to.',\n      contextProvider: true,\n      input: z.object({}),\n      // The dev app API returns every organization for the signed-in customer in one response, with no\n      // page parameter to pass through, so the bound is declared on the shape. A customer belongs to a\n      // handful of organizations; `noodle check` reports an unbounded list as\n      // `tool_design_output_bounds`.\n      output: z.object({\n        organizations: z.array(z.unknown()).max(100),\n      }),\n      annotations: annotations.readOnly(),\n      fulfil({ connectors }) {\n        const organizations = connectors.app_api.listOrganizations();\n        return {\n          organizations: organizations.organizations,\n        };\n      },\n    }),\n  ],\n);\n" },
+    { relPath: "examples/customer-auth/test/server.test.ts", content: "import { describe, expect, it } from 'vitest';\nimport app from '../src/server.js';\n\ndescribe('customer-auth example', () => {\n  it('exports a customer-authenticated, customer-branded embedded assistant', async () => {\n    expect(typeof app.toManifest).toBe('function');\n    const manifest = await app.toManifest();\n    expect(manifest.server.assistant).toMatchObject({\n      model: { kind: 'openai-compatible', apiKey: 'ASSISTANT_MODEL_API_KEY' },\n      layout: { mode: 'floating' },\n      presentation: {\n        panel: { surface: 'glass', elevation: 'soft', border: 'subtle' },\n        launcher: { icon: 'brand-mark', status: 'session', effect: 'pulse' },\n        header: { mark: 'status', badge: { text: 'Workspace online', tone: 'success' } },\n      },\n    });\n    expect(\n      manifest.server.assistant?.allowedOrigins.every(\n        (origin) => origin.startsWith('https://') || origin.startsWith('http://localhost:'),\n      ),\n    ).toBe(true);\n    expect(manifest.server.branding).toMatchObject({\n      name: 'Noodle Seed Assistant',\n      colorScheme: 'auto',\n    });\n    expect(manifest.server.auth).toMatchObject({\n      kind: 'bridge',\n      provider: 'firebase',\n      projectId: '${env.FIREBASE_PROJECT_ID}',\n      apiKey: '${env.FIREBASE_WEB_API_KEY}',\n      authDomain: '${env.FIREBASE_AUTH_DOMAIN}',\n      user: {\n        roles: 'claims.roles',\n        scopes: 'claims.scopes',\n      },\n    });\n    expect(manifest.tools.find((tool) => tool.name === 'list_org_apps')?.authorization).toEqual({\n      requiredScopes: ['org_apps:read'],\n      allowedRoles: ['org_admin', 'org_member'],\n    });\n    expect(\n      manifest.tools.find((tool) => tool.name === 'list_my_organizations')?.authorization,\n    ).toBeUndefined();\n  });\n});\n" },
     { relPath: "examples/food-ordering/README.md", content: "# Food Ordering\n\n**Owns:** The flagship consumer ordering MCP App example: React view authoring, app-only helper tools,\ncaller-scoped cart state handles, invocation context, model-visible widget state/lifecycle, packaged image\nassets, portable structured elicitation, checkout handoff policy, host actions, CSP/permissions metadata,\nand widget preview coverage.\n\nFood Ordering is a generic, synthetic version of a live marketplace ordering app. It lets a user search\nstores, browse menus, customize an item, build a multi-line cart, review the order, and hand off checkout to\nan allowlisted example domain. It does not use real restaurant APIs, real checkout, customer credentials, or\nprivate customer data.\n\n## What It Shows\n\n| Capability | Example |\n| :--- | :--- |\n| Public entry tool | `open_ordering` returns structured fallback content and renders the React widget |\n| App-only helper tools | `search_stores`, `load_menu`, `load_item`, `read_cart`, `sync_cart`, `prepare_checkout`; mutating widget-owned helpers use `confirm: false` (equivalent to omission) and execute directly because action hints alone never gate |\n| Durable cart state | `server(..., { state: { handles: { cart } }, use: { state } })` with caller scope and revision checks |\n| React app runtime kit | `@noodleseed/one/react` supplies app flow, shell/nav/view, async state, form, quantity, choice, and handoff primitives |\n| Multi-step widget flow | One React shell navigates stores, menu, item customization, cart, review, and handoff views through `useAppFlow` |\n| Invocation context | `server.context` sets locale/time-zone defaults, derives an ambient service area/date, and makes the same snapshot available to tools and the reserved `noodle_context` MCP adapter |\n| Structured missing input | `plan_order` uses `ctx.elicit` to collect a fulfilment method and date through embedded/headless forms, standard bidirectional elicitation, a linked MCP App form, or an exact structured conversational retry on stateless hosts |\n| Model-visible widget state | `useUpdateModelContext` publishes one cohesive replacement snapshot when supported; `useWidgetLifecycle` auto-publishes mounted/cancelled/dismissed and reports author-owned submitted milestones for future context (not host-presentation proof), while the user-triggered submit pairs `useSendFollowUpMessage` for an immediate reply |\n| Handoff | `handoff.allowedDomains` allows only `https://orders.example.com` checkout URLs |\n| Progressive enhancement | Non-Apps hosts still receive stores, featured items, and a readable fallback summary |\n| Fail-closed hydration | The React view treats only the unhydrated, pre-result `{}` envelope as pending; a hydrated empty success remains distinct. It surfaces `isError`, validates required records and identifiers, and withholds ordering actions from malformed results |\n\nThe example is intentionally richer than the generated starter, but each inline view still follows the\nsame default: one immediate purpose, one primary action, at most one subordinate action, and progressive\ndisclosure for the rest. Preview it at 280px before adding navigation or local CSS; loading, empty, stale,\nerror/retry, and success states must remain readable without nested vertical scrolling.\n\nLike the comprehensive default `noodle init my-app` scaffold, this flagship keeps the server feature-rich\nwhile making each individual widget view focused; server capability breadth and screen density are separate.\nThe compiled initial widget should normally remain under the 1 MiB performance recommendation; Noodle Seed's\nhard ceilings are 10 MiB per compiled widget and 20 MiB across one deployment. Run `noodle check` to see raw\nand gzip-estimated sizes. Deploy requests are gzip-compressed as one stream so repeated self-contained React\nruntime bytes deduplicate on the wire without a cross-tenant CDN. Keep menu images or large live datasets in assets/resources and app-only tools\nrather than embedding them into the initial HTML bundle.\n\n## Local Author Loop\n\n```sh\nnoodle validate\nnoodle test\nnoodle dev\n```\n\nIn another terminal:\n\n```sh\nnoodle tools list\nnoodle tools call open_ordering --args '{\"customer\":\"Asha\",\"query\":\"noodles\"}'\nnoodle tools call summarize_ordering_options --args '{}'\n```\n\nFor Apps metadata conformance, start `noodle dev`, copy the loopback MCP endpoint, then run:\n\n```sh\nnpx @mcpjam/cli@latest apps conformance --url http://127.0.0.1:<port>/o/demo/food-ordering/mcp --quiet --format json\n```\n\n## Client Setup\n\nUse the CLI to print the exact setup flow for your MCP client:\n\n```sh\nnoodle connect claude\nnoodle connect chatgpt\nnoodle connect inspector\n```\n\n## Deploy\n\n```sh\nnoodle link --org demo --app food-ordering\nnoodle deploy --access owner-only\nnoodle open\n```\n\nUse `--access org-members` for an org-wide internal demo. This example has no connector secrets and does not\ninclude tokens, caller-key mechanisms, or `.env.noodle` values.\n\n## Demo Assets\n\nThe packaged demo images live under `assets/` and are public web assets when deployed. The current app uses\n`assets/noodle-bowl.jpg` as the server branding image.\n\nImage sources:\n\n- `assets/noodle-bowl.jpg` — Unsplash photo\n  [`IRv8V9Hb8gI`](https://unsplash.com/photos/IRv8V9Hb8gI), downloaded from Unsplash.\n- `assets/lentil-soup.jpg` — Unsplash image\n  [`photo-1510431198580-7727c9fa1e3a`](https://images.unsplash.com/photo-1510431198580-7727c9fa1e3a), downloaded from Unsplash.\n- `assets/mint-lemonade.jpg` — Unsplash photo\n  [`X7Nx327NtuA`](https://unsplash.com/photos/X7Nx327NtuA) by Imad 786.\n\nUnsplash photos are free to use under the [Unsplash License](https://unsplash.com/license); attribution is\nnot required, but source notes are kept here for provenance.\n" },
     { relPath: "examples/food-ordering/noodle.json", content: "{\n  \"entrypoint\": \"src/server.ts\",\n  \"name\": \"food-ordering\",\n  \"template\": \"widget\"\n}\n" },
     { relPath: "examples/food-ordering/package.json", content: "{\n  \"name\": \"food-ordering\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"scripts\": {\n    \"test\": \"vitest run test\",\n    \"validate\": \"noodle validate\",\n    \"dev\": \"noodle dev\",\n    \"deploy\": \"noodle deploy\"\n  },\n  \"devDependencies\": {\n    \"@vitejs/plugin-react\": \"latest\",\n    \"@noodleseed/one\": \"latest\",\n    \"@types/react\": \"latest\",\n    \"@types/react-dom\": \"latest\",\n    \"react\": \"latest\",\n    \"react-dom\": \"latest\",\n    \"vite\": \"latest\",\n    \"vitest\": \"latest\"\n  }\n}\n" },

package/node_modules/@noodle-borg/agent-kit/dist/generated/example-files.js.map

@@ -1 +1 @@
-{"version":3,"file":"example-files.js","sourceRoot":"","sources":["../../src/generated/example-files.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,kFAAkF;AAClF,iGAAiG;AAQjG,uGAAuG;AACvG,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,OAAO;IACP,SAAS;IACT,eAAe;IACf,gBAAgB;IAChB,YAAY;IACZ,aAAa;IACb,eAAe;IACf,qBAAqB;IACrB,iBAAiB;CAClB,CAAC;AAEF,yGAAyG;AACzG,MAAM,CAAC,MAAM,qBAAqB,GAAkC;IAClE,EAAE,OAAO,EAAE,gCAAgC,EAAE,OAAO,EAAE,4oEAA4oE,EAAE;IACpsE,EAAE,OAAO,EAAE,4CAA4C,EAAE,OAAO,EAAE,u/wBAAu/wB,EAAE;IAC3jxB,EAAE,OAAO,EAAE,6CAA6C,EAAE,OAAO,EAAE,kkQAAkkQ,EAAE;IACvoQ,EAAE,OAAO,EAAE,4CAA4C,EAAE,OAAO,EAAE,klqDAAklqD,EAAE;IACtpqD,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,wGAAwG,EAAE;IAClK,EAAE,OAAO,EAAE,mCAAmC,EAAE,OAAO,EAAE,mfAAmf,EAAE;IAC9iB,EAAE,OAAO,EAAE,qCAAqC,EAAE,OAAO,EAAE,yRAAyR,EAAE;IACtV,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,ivMAAivM,EAAE;IAC7yM,EAAE,OAAO,EAAE,8CAA8C,EAAE,OAAO,EAAE,okLAAokL,EAAE;IAC1oL,EAAE,OAAO,EAAE,iDAAiD,EAAE,OAAO,EAAE,8zHAA8zH,EAAE;IACv4H,EAAE,OAAO,EAAE,0CAA0C,EAAE,OAAO,EAAE,wyBAAwyB,EAAE;IAC12B,EAAE,OAAO,EAAE,uCAAuC,EAAE,OAAO,EAAE,uRAAuR,EAAE;IACtV,EAAE,OAAO,EAAE,mCAAmC,EAAE,OAAO,EAAE,2tIAA2tI,EAAE;IACtxI,EAAE,OAAO,EAAE,+CAA+C,EAAE,OAAO,EAAE,mrhCAAmrhC,EAAE;IAC1vhC,EAAE,OAAO,EAAE,+CAA+C,EAAE,OAAO,EAAE,g4sDAAg4sD,EAAE;IACv8sD,EAAE,OAAO,EAAE,qCAAqC,EAAE,OAAO,EAAE,2GAA2G,EAAE;IACxK,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,sfAAsf,EAAE;IACpjB,EAAE,OAAO,EAAE,wCAAwC,EAAE,OAAO,EAAE,yRAAyR,EAAE;IACzV,EAAE,OAAO,EAAE,uCAAuC,EAAE,OAAO,EAAE,g9OAAg9O,EAAE;IAC/gP,EAAE,OAAO,EAAE,0DAA0D,EAAE,OAAO,EAAE,4jLAA4jL,EAAE;IAC9oL,EAAE,OAAO,EAAE,oDAAoD,EAAE,OAAO,EAAE,ijHAAijH,EAAE;IAC7nH,EAAE,OAAO,EAAE,6CAA6C,EAAE,OAAO,EAAE,8/BAA8/B,EAAE;IACnkC,EAAE,OAAO,EAAE,0CAA0C,EAAE,OAAO,EAAE,uRAAuR,EAAE;IACzV,EAAE,OAAO,EAAE,+BAA+B,EAAE,OAAO,EAAE,w9LAAw9L,EAAE;IAC/gM,EAAE,OAAO,EAAE,2CAA2C,EAAE,OAAO,EAAE,o8nBAAo8nB,EAAE;IACvgoB,EAAE,OAAO,EAAE,2CAA2C,EAAE,OAAO,EAAE,k1nDAAk1nD,EAAE;IACr5nD,EAAE,OAAO,EAAE,iCAAiC,EAAE,OAAO,EAAE,uGAAuG,EAAE;IAChK,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,kfAAkf,EAAE;IAC5iB,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,qQAAqQ,EAAE;IACjU,EAAE,OAAO,EAAE,mCAAmC,EAAE,OAAO,EAAE,k+LAAk+L,EAAE;IAC7hM,EAAE,OAAO,EAAE,6CAA6C,EAAE,OAAO,EAAE,yrNAAyrN,EAAE;IAC9vN,EAAE,OAAO,EAAE,gDAAgD,EAAE,OAAO,EAAE,o6HAAo6H,EAAE;IAC5+H,EAAE,OAAO,EAAE,yCAAyC,EAAE,OAAO,EAAE,y0CAAy0C,EAAE;IAC14C,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,uRAAuR,EAAE;IACrV,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,0ntBAA0ntB,EAAE;IACprtB,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,6EAA6E,EAAE;IACzI,EAAE,OAAO,EAAE,qCAAqC,EAAE,OAAO,EAAE,mXAAmX,EAAE;IAChb,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,8xKAA8xK,EAAE;IAC51K,EAAE,OAAO,EAAE,4CAA4C,EAAE,OAAO,EAAE,21CAA21C,EAAE;IAC/5C,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,4rLAA4rL,EAAE;IACtvL,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,0GAA0G,EAAE;IACtK,EAAE,OAAO,EAAE,qCAAqC,EAAE,OAAO,EAAE,okBAAokB,EAAE;IACjoB,EAAE,OAAO,EAAE,uCAAuC,EAAE,OAAO,EAAE,6qBAA6qB,EAAE;IAC5uB,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,uheAAuhe,EAAE;IACrle,EAAE,OAAO,EAAE,wDAAwD,EAAE,OAAO,EAAE,yzJAAyzJ,EAAE;IACz4J,EAAE,OAAO,EAAE,oDAAoD,EAAE,OAAO,EAAE,+9tBAA+9tB,EAAE;IAC3iuB,EAAE,OAAO,EAAE,qDAAqD,EAAE,OAAO,EAAE,mmFAAmmF,EAAE;IAChrF,EAAE,OAAO,EAAE,mDAAmD,EAAE,OAAO,EAAE,ynYAAynY,EAAE;IACpsY,EAAE,OAAO,EAAE,mDAAmD,EAAE,OAAO,EAAE,6rMAA6rM,EAAE;IACxwM,EAAE,OAAO,EAAE,4CAA4C,EAAE,OAAO,EAAE,osHAAosH,EAAE;IACxwH,EAAE,OAAO,EAAE,yCAAyC,EAAE,OAAO,EAAE,6iCAA6iC,EAAE;IAC9mC,EAAE,OAAO,EAAE,wCAAwC,EAAE,OAAO,EAAE,4sFAA4sF,EAAE;IAC5wF,EAAE,OAAO,EAAE,0CAA0C,EAAE,OAAO,EAAE,mFAAmF,EAAE;IACrJ,EAAE,OAAO,EAAE,2CAA2C,EAAE,OAAO,EAAE,yXAAyX,EAAE;IAC5b,EAAE,OAAO,EAAE,4CAA4C,EAAE,OAAO,EAAE,0zmBAA0zmB,EAAE;IAC93mB,EAAE,OAAO,EAAE,kDAAkD,EAAE,OAAO,EAAE,sgVAAsgV,EAAE;IAChlV,EAAE,OAAO,EAAE,+CAA+C,EAAE,OAAO,EAAE,oiCAAoiC,EAAE;IAC3mC,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,44HAA44H,EAAE;IACx8H,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,+EAA+E,EAAE;IAC7I,EAAE,OAAO,EAAE,uCAAuC,EAAE,OAAO,EAAE,qXAAqX,EAAE;IACpb,EAAE,OAAO,EAAE,wCAAwC,EAAE,OAAO,EAAE,w1GAAw1G,EAAE;IACx5G,EAAE,OAAO,EAAE,8CAA8C,EAAE,OAAO,EAAE,68CAA68C,EAAE;IACnhD,EAAE,OAAO,EAAE,2CAA2C,EAAE,OAAO,EAAE,2qBAA2qB,EAAE;IAC9uB,EAAE,OAAO,EAAE,0BAA0B,EAAE,OAAO,EAAE,wmEAAwmE,EAAE;IAC1pE,EAAE,OAAO,EAAE,4BAA4B,EAAE,OAAO,EAAE,iGAAiG,EAAE;IACrJ,EAAE,OAAO,EAAE,6BAA6B,EAAE,OAAO,EAAE,2WAA2W,EAAE;IACha,EAAE,OAAO,EAAE,8BAA8B,EAAE,OAAO,EAAE,oiCAAoiC,EAAE;IAC1lC,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,msBAAmsB,EAAE;IAC/vB,EAAE,OAAO,EAAE,4BAA4B,EAAE,OAAO,EAAE,q3JAAq3J,EAAE;IACz6J,EAAE,OAAO,EAAE,8BAA8B,EAAE,OAAO,EAAE,uEAAuE,EAAE;IAC7H,EAAE,OAAO,EAAE,+BAA+B,EAAE,OAAO,EAAE,6WAA6W,EAAE;IACpa,EAAE,OAAO,EAAE,gCAAgC,EAAE,OAAO,EAAE,uiUAAuiU,EAAE;IAC/lU,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,gzCAAgzC,EAAE;CAC/2C,CAAC"}
+{"version":3,"file":"example-files.js","sourceRoot":"","sources":["../../src/generated/example-files.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,kFAAkF;AAClF,iGAAiG;AAQjG,uGAAuG;AACvG,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,OAAO;IACP,SAAS;IACT,eAAe;IACf,gBAAgB;IAChB,YAAY;IACZ,aAAa;IACb,eAAe;IACf,qBAAqB;IACrB,iBAAiB;CAClB,CAAC;AAEF,yGAAyG;AACzG,MAAM,CAAC,MAAM,qBAAqB,GAAkC;IAClE,EAAE,OAAO,EAAE,gCAAgC,EAAE,OAAO,EAAE,4oEAA4oE,EAAE;IACpsE,EAAE,OAAO,EAAE,4CAA4C,EAAE,OAAO,EAAE,u/wBAAu/wB,EAAE;IAC3jxB,EAAE,OAAO,EAAE,6CAA6C,EAAE,OAAO,EAAE,kkQAAkkQ,EAAE;IACvoQ,EAAE,OAAO,EAAE,4CAA4C,EAAE,OAAO,EAAE,klqDAAklqD,EAAE;IACtpqD,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,wGAAwG,EAAE;IAClK,EAAE,OAAO,EAAE,mCAAmC,EAAE,OAAO,EAAE,mfAAmf,EAAE;IAC9iB,EAAE,OAAO,EAAE,qCAAqC,EAAE,OAAO,EAAE,yRAAyR,EAAE;IACtV,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,ivMAAivM,EAAE;IAC7yM,EAAE,OAAO,EAAE,8CAA8C,EAAE,OAAO,EAAE,okLAAokL,EAAE;IAC1oL,EAAE,OAAO,EAAE,iDAAiD,EAAE,OAAO,EAAE,8zHAA8zH,EAAE;IACv4H,EAAE,OAAO,EAAE,0CAA0C,EAAE,OAAO,EAAE,wyBAAwyB,EAAE;IAC12B,EAAE,OAAO,EAAE,uCAAuC,EAAE,OAAO,EAAE,uRAAuR,EAAE;IACtV,EAAE,OAAO,EAAE,mCAAmC,EAAE,OAAO,EAAE,2tIAA2tI,EAAE;IACtxI,EAAE,OAAO,EAAE,+CAA+C,EAAE,OAAO,EAAE,mrhCAAmrhC,EAAE;IAC1vhC,EAAE,OAAO,EAAE,+CAA+C,EAAE,OAAO,EAAE,g4sDAAg4sD,EAAE;IACv8sD,EAAE,OAAO,EAAE,qCAAqC,EAAE,OAAO,EAAE,2GAA2G,EAAE;IACxK,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,sfAAsf,EAAE;IACpjB,EAAE,OAAO,EAAE,wCAAwC,EAAE,OAAO,EAAE,yRAAyR,EAAE;IACzV,EAAE,OAAO,EAAE,uCAAuC,EAAE,OAAO,EAAE,g9OAAg9O,EAAE;IAC/gP,EAAE,OAAO,EAAE,0DAA0D,EAAE,OAAO,EAAE,4jLAA4jL,EAAE;IAC9oL,EAAE,OAAO,EAAE,oDAAoD,EAAE,OAAO,EAAE,ijHAAijH,EAAE;IAC7nH,EAAE,OAAO,EAAE,6CAA6C,EAAE,OAAO,EAAE,8/BAA8/B,EAAE;IACnkC,EAAE,OAAO,EAAE,0CAA0C,EAAE,OAAO,EAAE,uRAAuR,EAAE;IACzV,EAAE,OAAO,EAAE,+BAA+B,EAAE,OAAO,EAAE,w9LAAw9L,EAAE;IAC/gM,EAAE,OAAO,EAAE,2CAA2C,EAAE,OAAO,EAAE,o8nBAAo8nB,EAAE;IACvgoB,EAAE,OAAO,EAAE,2CAA2C,EAAE,OAAO,EAAE,k1nDAAk1nD,EAAE;IACr5nD,EAAE,OAAO,EAAE,iCAAiC,EAAE,OAAO,EAAE,uGAAuG,EAAE;IAChK,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,kfAAkf,EAAE;IAC5iB,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,qQAAqQ,EAAE;IACjU,EAAE,OAAO,EAAE,mCAAmC,EAAE,OAAO,EAAE,k+LAAk+L,EAAE;IAC7hM,EAAE,OAAO,EAAE,6CAA6C,EAAE,OAAO,EAAE,yrNAAyrN,EAAE;IAC9vN,EAAE,OAAO,EAAE,gDAAgD,EAAE,OAAO,EAAE,o6HAAo6H,EAAE;IAC5+H,EAAE,OAAO,EAAE,yCAAyC,EAAE,OAAO,EAAE,y0CAAy0C,EAAE;IAC14C,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,uRAAuR,EAAE;IACrV,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,qjvBAAqjvB,EAAE;IAC/mvB,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,6EAA6E,EAAE;IACzI,EAAE,OAAO,EAAE,qCAAqC,EAAE,OAAO,EAAE,mXAAmX,EAAE;IAChb,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,k8KAAk8K,EAAE;IAChgL,EAAE,OAAO,EAAE,4CAA4C,EAAE,OAAO,EAAE,+vDAA+vD,EAAE;IACn0D,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,4rLAA4rL,EAAE;IACtvL,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,0GAA0G,EAAE;IACtK,EAAE,OAAO,EAAE,qCAAqC,EAAE,OAAO,EAAE,okBAAokB,EAAE;IACjoB,EAAE,OAAO,EAAE,uCAAuC,EAAE,OAAO,EAAE,6qBAA6qB,EAAE;IAC5uB,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,uheAAuhe,EAAE;IACrle,EAAE,OAAO,EAAE,wDAAwD,EAAE,OAAO,EAAE,yzJAAyzJ,EAAE;IACz4J,EAAE,OAAO,EAAE,oDAAoD,EAAE,OAAO,EAAE,+9tBAA+9tB,EAAE;IAC3iuB,EAAE,OAAO,EAAE,qDAAqD,EAAE,OAAO,EAAE,mmFAAmmF,EAAE;IAChrF,EAAE,OAAO,EAAE,mDAAmD,EAAE,OAAO,EAAE,ynYAAynY,EAAE;IACpsY,EAAE,OAAO,EAAE,mDAAmD,EAAE,OAAO,EAAE,6rMAA6rM,EAAE;IACxwM,EAAE,OAAO,EAAE,4CAA4C,EAAE,OAAO,EAAE,osHAAosH,EAAE;IACxwH,EAAE,OAAO,EAAE,yCAAyC,EAAE,OAAO,EAAE,6iCAA6iC,EAAE;IAC9mC,EAAE,OAAO,EAAE,wCAAwC,EAAE,OAAO,EAAE,4sFAA4sF,EAAE;IAC5wF,EAAE,OAAO,EAAE,0CAA0C,EAAE,OAAO,EAAE,mFAAmF,EAAE;IACrJ,EAAE,OAAO,EAAE,2CAA2C,EAAE,OAAO,EAAE,yXAAyX,EAAE;IAC5b,EAAE,OAAO,EAAE,4CAA4C,EAAE,OAAO,EAAE,0zmBAA0zmB,EAAE;IAC93mB,EAAE,OAAO,EAAE,kDAAkD,EAAE,OAAO,EAAE,sgVAAsgV,EAAE;IAChlV,EAAE,OAAO,EAAE,+CAA+C,EAAE,OAAO,EAAE,oiCAAoiC,EAAE;IAC3mC,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,44HAA44H,EAAE;IACx8H,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,+EAA+E,EAAE;IAC7I,EAAE,OAAO,EAAE,uCAAuC,EAAE,OAAO,EAAE,qXAAqX,EAAE;IACpb,EAAE,OAAO,EAAE,wCAAwC,EAAE,OAAO,EAAE,w1GAAw1G,EAAE;IACx5G,EAAE,OAAO,EAAE,8CAA8C,EAAE,OAAO,EAAE,68CAA68C,EAAE;IACnhD,EAAE,OAAO,EAAE,2CAA2C,EAAE,OAAO,EAAE,2qBAA2qB,EAAE;IAC9uB,EAAE,OAAO,EAAE,0BAA0B,EAAE,OAAO,EAAE,wmEAAwmE,EAAE;IAC1pE,EAAE,OAAO,EAAE,4BAA4B,EAAE,OAAO,EAAE,iGAAiG,EAAE;IACrJ,EAAE,OAAO,EAAE,6BAA6B,EAAE,OAAO,EAAE,2WAA2W,EAAE;IACha,EAAE,OAAO,EAAE,8BAA8B,EAAE,OAAO,EAAE,oiCAAoiC,EAAE;IAC1lC,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,msBAAmsB,EAAE;IAC/vB,EAAE,OAAO,EAAE,4BAA4B,EAAE,OAAO,EAAE,q3JAAq3J,EAAE;IACz6J,EAAE,OAAO,EAAE,8BAA8B,EAAE,OAAO,EAAE,uEAAuE,EAAE;IAC7H,EAAE,OAAO,EAAE,+BAA+B,EAAE,OAAO,EAAE,6WAA6W,EAAE;IACpa,EAAE,OAAO,EAAE,gCAAgC,EAAE,OAAO,EAAE,uiUAAuiU,EAAE;IAC/lU,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,gzCAAgzC,EAAE;CAC/2C,CAAC"}

package/node_modules/@noodle-borg/agent-kit/dist/skill-authoring-refs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-authoring-refs.d.ts","sourceRoot":"","sources":["../src/skill-authoring-refs.ts"],"names":[],"mappings":"AAgBA,wBAAgB,gCAAgC,IAAI,MAAM,CAmRzD;AAWD,wBAAgB,6BAA6B,IAAI,MAAM,CA0QtD;AAmDD,wBAAgB,uBAAuB,IAAI,MAAM,CA0DhD"}
+{"version":3,"file":"skill-authoring-refs.d.ts","sourceRoot":"","sources":["../src/skill-authoring-refs.ts"],"names":[],"mappings":"AAgBA,wBAAgB,gCAAgC,IAAI,MAAM,CA0SzD;AAWD,wBAAgB,6BAA6B,IAAI,MAAM,CA0QtD;AAmDD,wBAAgB,uBAAuB,IAAI,MAAM,CA0DhD"}

package/node_modules/@noodle-borg/agent-kit/dist/skill-authoring-refs.js

@@ -24,6 +24,7 @@ export function renderAuthoringWorkflowReference() {
         '- Connectors',
         '- HTTP connector example (full server)',
         '- Customer OAuth for remote MCP clients',
+        '- Per-tool authorization',
         '- Delegated downstream auth (call your API as the signed-in user)',
         '- Invocation context',
         '- Compute connector example',
@@ -124,6 +125,28 @@ export function renderAuthoringWorkflowReference() {
         '',
         'That metadata must expose HTTPS `authorization_endpoint`, `token_endpoint`, `jwks_uri`, and RFC 7591 `registration_endpoint`; advertise authorization-code and refresh-token grants, Dynamic Client Registration, PKCE with `code_challenge_methods_supported: ["S256"]`, and public clients with `token_endpoint_auth_methods_supported: ["none"]`. Implement RFC 8707 `resource`, mint access-token `aud` for the exact MCP resource URL, and publish only public signing keys in JWKS. Run `noodle auth doctor src/server.ts`; its issuer-readiness probes perform bounded read-only GET checks and never register a client. A successful `noodle deploy --access customers` reports the same readiness without turning a diagnostic failure into a failed deployment.',
         '',
+        '## Per-tool authorization',
+        '',
+        'Keep endpoint authentication in `customerAuth.*(...)`, then narrow individual tools with the optional typed `authorization` rule. Every `requiredScopes` value is required; any one `allowedRoles` value is sufficient; when both lists are present, both conditions apply. Omit `authorization` for an unrestricted tool. Do not invent a policy expression language or infer authorization from tool arguments, page context, connector output, email domains, or other unverified data.',
+        '',
+        '```ts',
+        'auth: customerAuth.oidc({',
+        "  issuer: 'https://id.example.com',",
+        "  audience: 'https://api.example.com/mcp',",
+        "  claims: { roles: 'permissions.roles', scopes: 'permissions.scopes' },",
+        '}),',
+        '',
+        "tool('list_org_apps', {",
+        '  authorization: {',
+        "    requiredScopes: ['org_apps:read'],",
+        "    allowedRoles: ['org_admin', 'org_member'],",
+        '  },',
+        '  // input, output, and fulfilment...',
+        '})',
+        '```',
+        '',
+        'Role values are trusted only from the explicitly configured claim path (or the platform-private bridge role claim). Direct OIDC scopes default to standard `scope`, `scp`, or `scopes` claims unless `claims.scopes` is configured. Embedded-assistant backends pass verified `user.roles` and `user.scopes` separately during `createAssistantSession(...)`; page context never grants either. Claim values must be a string or string array; malformed or oversized values fail closed. Eligible tools remain in authored order in `tools/list`; ineligible tools are omitted and a guessed direct call is still denied before argument validation or connector execution. Scope denials use MCP OAuth step-up metadata without disclosing role names.',
+        '',
         '## Delegated downstream auth (call your API as the signed-in user)',
         '',
         'Use delegated connector auth when the downstream API must enforce its own per-user authorization — a shared service credential plus a forwarded user id would bypass it. Three shapes exist; pick by who owns the downstream:',

package/node_modules/@noodle-borg/agent-kit/dist/skill-authoring-refs.js.map

@@ -1 +1 @@
-{"version":3,"file":"skill-authoring-refs.js","sourceRoot":"","sources":["../src/skill-authoring-refs.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,8FAA8F;AAC9F,4FAA4F;AAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,+EAA+E;AAC/E,6CAA6C;AAC7C,EAAE;AACF,iGAAiG;AACjG,qGAAqG;AACrG,gGAAgG;AAChG,+EAA+E;AAE/E,MAAM,UAAU,gCAAgC;IAC9C,OAAO;QACL,sBAAsB;QACtB,EAAE;QACF,aAAa;QACb,EAAE;QACF,eAAe;QACf,aAAa;QACb,eAAe;QACf,cAAc;QACd,wCAAwC;QACxC,yCAAyC;QACzC,mEAAmE;QACnE,sBAAsB;QACtB,6BAA6B;QAC7B,SAAS;QACT,yBAAyB;QACzB,sBAAsB;QACtB,cAAc;QACd,EAAE;QACF,gBAAgB;QAChB,EAAE;QACF,oUAAoU;QACpU,oJAAoJ;QACpJ,+TAA+T;QAC/T,EAAE;QACF,cAAc;QACd,EAAE;QACF,gVAAgV;QAChV,EAAE;QACF,gBAAgB;QAChB,EAAE;QACF,gLAAgL;QAChL,EAAE;QACF,eAAe;QACf,EAAE;QACF,kDAAkD;QAClD,EAAE;QACF,uMAAuM;QACvM,+NAA+N;QAC/N,EAAE;QACF,mKAAmK;QACnK,EAAE;QACF,kbAAkb;QAClb,EAAE;QACF,w4DAAw4D;QACx4D,EAAE;QACF,yCAAyC;QACzC,EAAE;QACF,yaAAya;QACza,EAAE;QACF,OAAO;QACP,iFAAiF;QACjF,EAAE;QACF,sDAAsD;QACtD,sCAAsC;QACtC,gDAAgD;QAChD,0DAA0D;QAC1D,iBAAiB;QACjB,sBAAsB;QACtB,qBAAqB;QACrB,sBAAsB;QACtB,2BAA2B;QAC3B,yBAAyB;QACzB,+CAA+C;QAC/C,0EAA0E;QAC1E,qFAAqF;QACrF,QAAQ;QACR,sBAAsB;QACtB,uBAAuB;QACvB,uBAAuB;QACvB,yBAAyB;QACzB,uEAAuE;QACvE,oDAAoD;QACpD,8EAA8E;QAC9E,kDAAkD;QAClD,QAAQ;QACR,MAAM;QACN,KAAK;QACL,EAAE;QACF,0FAA0F;QAC1F,2BAA2B;QAC3B,uDAAuD;QACvD,6CAA6C;QAC7C,wEAAwE;QACxE,0CAA0C;QAC1C,8EAA8E;QAC9E,wDAAwD;QACxD,QAAQ;QACR,OAAO;QACP,yBAAyB;QACzB,2DAA2D;QAC3D,qEAAqE;QACrE,kDAAkD;QAClD,0CAA0C;QAC1C,0GAA0G;QAC1G,+CAA+C;QAC/C,QAAQ;QACR,OAAO;QACP,KAAK;QACL,KAAK;QACL,EAAE;QACF,koBAAkoB;QACloB,EAAE;QACF,+vBAA+vB;QAC/vB,EAAE;QACF,0CAA0C;QAC1C,EAAE;QACF,6dAA6d;QAC7d,EAAE;QACF,2uBAA2uB;QAC3uB,EAAE;QACF,oEAAoE;QACpE,EAAE;QACF,+NAA+N;QAC/N,EAAE;QACF,mVAAmV;QACnV,wQAAwQ;QACxQ,sGAAsG;QACtG,EAAE;QACF,sCAAsC;QACtC,EAAE;QACF,OAAO;QACP,SAAS;QACT,mCAAmC;QACnC,sGAAsG;QACtG,kDAAkD;QAClD,wDAAwD;QACxD,+CAA+C;QAC/C,mGAAmG;QACnG,+EAA+E;QAC/E,GAAG;QACH,KAAK;QACL,EAAE;QACF,2PAA2P;QAC3P,EAAE;QACF,iDAAiD;QACjD,EAAE;QACF,qMAAqM;QACrM,EAAE;QACF,KAAK;QACL,4DAA4D;QAC5D,kDAAkD;QAClD,yDAAyD;QACzD,2DAA2D;QAC3D,6CAA6C;QAC7C,KAAK;QACL,EAAE;QACF,2gBAA2gB;QAC3gB,EAAE;QACF,kDAAkD;QAClD,EAAE;QACF,OAAO;QACP,8DAA8D;QAC9D,uDAAuD;QACvD,EAAE;QACF,mGAAmG;QACnG,uFAAuF;QACvF,EAAE;QACF,wEAAwE;QACxE,0EAA0E;QAC1E,yDAAyD;QACzD,mFAAmF;QACnF,2FAA2F;QAC3F,sFAAsF;QACtF,uDAAuD;QACvD,gFAAgF;QAChF,8BAA8B;QAC9B,4GAA4G;QAC5G,OAAO;QACP,0FAA0F;QAC1F,0FAA0F;QAC1F,KAAK;QACL,gGAAgG;QAChG,uGAAuG;QACvG,+FAA+F;QAC/F,GAAG;QACH,KAAK;QACL,EAAE;QACF,2gBAA2gB;QAC3gB,EAAE;QACF,+BAA+B;QAC/B,EAAE;QACF,+NAA+N;QAC/N,EAAE;QACF,uBAAuB;QACvB,EAAE;QACF,wcAAwc;QACxc,EAAE;QACF,OAAO;QACP,YAAY;QACZ,6DAA6D;QAC7D,cAAc;QACd,qFAAqF;QACrF,kDAAkD;QAClD,wDAAwD;QACxD,gCAAgC;QAChC,yCAAyC;QACzC,WAAW;QACX,wFAAwF;QACxF,QAAQ;QACR,MAAM;QACN,IAAI;QACJ,KAAK;QACL,EAAE;QACF,miBAAmiB;QACniB,EAAE;QACF,qCAAqC;QACrC,EAAE;QACF,2MAA2M;QAC3M,EAAE;QACF,OAAO;QACP,4BAA4B;QAC5B,0EAA0E;QAC1E,4DAA4D;QAC5D,iFAAiF;QACjF,oCAAoC;QACpC,6BAA6B;QAC7B,0BAA0B;QAC1B,2DAA2D;QAC3D,iEAAiE;QACjE,SAAS;QACT,2EAA2E;QAC3E,MAAM;QACN,KAAK;QACL,KAAK;QACL,EAAE;QACF,iwEAAiwE;QACjwE,EAAE;QACF,8BAA8B;QAC9B,EAAE;QACF,OAAO;QACP,8EAA8E;QAC9E,4EAA4E;QAC5E,4CAA4C;QAC5C,kDAAkD;QAClD,iDAAiD;QACjD,mCAAmC;QACnC,iGAAiG;QACjG,4EAA4E;QAC5E,MAAM;QACN,KAAK;QACL,KAAK;QACL,EAAE;QACF,uUAAuU;QACvU,EAAE;QACF,UAAU;QACV,EAAE;QACF,uPAAuP;QACvP,EAAE;QACF,OAAO;QACP,gDAAgD;QAChD,qCAAqC;QACrC,EAAE;QACF,4BAA4B;QAC5B,oDAAoD;QACpD,iDAAiD;QACjD,OAAO;QACP,KAAK;QACL,KAAK;QACL,EAAE;QACF,yIAAyI;QACzI,EAAE;QACF,0BAA0B;QAC1B,EAAE;QACF,8NAA8N;QAC9N,EAAE;QACF,uBAAuB;QACvB,EAAE;QACF,wWAAwW;QACxW,EAAE;QACF,eAAe;QACf,EAAE;QACF,+SAA+S;KAChT,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,kGAAkG;AAClG,EAAE;AACF,+FAA+F;AAC/F,oGAAoG;AACpG,oGAAoG;AACpG,2EAA2E;AAC3E,+EAA+E;AAE/E,MAAM,UAAU,6BAA6B;IAC3C,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IACrF,OAAO;QACL,wBAAwB;QACxB,EAAE;QACF,aAAa;QACb,EAAE;QACF,mBAAmB;QACnB,sBAAsB;QACtB,wBAAwB;QACxB,wCAAwC;QACxC,0CAA0C;QAC1C,+BAA+B;QAC/B,4BAA4B;QAC5B,EAAE;QACF,oBAAoB;QACpB,EAAE;QACF,uVAAuV;QACvV,EAAE;QACF,0BAA0B;QAC1B,EAAE;QACF,uRAAuR;QACvR,EAAE;QACF,uWAAuW;QACvW,EAAE;QACF,kgBAAkgB;QAClgB,EAAE;QACF,kZAAkZ;QAClZ,EAAE;QACF,wcAAwc;QACxc,EAAE;QACF,4bAA4b;QAC5b,EAAE;QACF,uBAAuB;QACvB,EAAE;QACF,sIAAsI;QACtI,EAAE;QACF,OAAO,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC;QACtC,EAAE;QACF,m1DAAm1D;QACn1D,EAAE;QACF,yBAAyB;QACzB,EAAE;QACF,mOAAmO;QACnO,EAAE;QACF,2BAA2B;QAC3B,EAAE;QACF,gZAAgZ;QAChZ,EAAE;QACF,QAAQ;QACR,oCAAoC;QACpC,0DAA0D;QAC1D,0IAA0I;QAC1I,EAAE;QACF,qFAAqF;QACrF,mJAAmJ;QACnJ,wCAAwC;QACxC,EAAE;QACF,sBAAsB;QACtB,8BAA8B;QAC9B,0BAA0B;QAC1B,2BAA2B;QAC3B,iCAAiC;QACjC,IAAI;QACJ,EAAE;QACF,gEAAgE;QAChE,kEAAkE;QAClE,iDAAiD;QACjD,YAAY;QACZ,0EAA0E;QAC1E,kEAAkE;QAClE,0EAA0E;QAC1E,yFAAyF;QACzF,MAAM;QACN,GAAG;QACH,EAAE;QACF,yCAAyC;QACzC,+CAA+C;QAC/C,yDAAyD;QACzD,qGAAqG;QACrG,uFAAuF;QACvF,qCAAqC;QACrC,2CAA2C;QAC3C,yDAAyD;QACzD,uDAAuD;QACvD,gEAAgE;QAChE,sGAAsG;QACtG,qGAAqG;QACrG,oCAAoC;QACpC,iDAAiD;QACjD,EAAE;QACF,qBAAqB;QACrB,oDAAoD;QACpD,+BAA+B;QAC/B,mFAAmF;QACnF,6GAA6G;QAC7G,SAAS;QACT,yEAAyE;QACzE,EAAE;QACF,kCAAkC;QAClC,yBAAyB;QACzB,oEAAoE;QACpE,mCAAmC;QACnC,oGAAoG;QACpG,OAAO;QACP,sCAAsC;QACtC,iHAAiH;QACjH,OAAO;QACP,KAAK;QACL,EAAE;QACF,mFAAmF;QACnF,+FAA+F;QAC/F,4FAA4F;QAC5F,EAAE;QACF,YAAY;QACZ,kGAAkG;QAClG,8HAA8H;QAC9H,8BAA8B;QAC9B,oGAAoG;QACpG,wEAAwE;QACxE,4BAA4B;QAC5B,kGAAkG;QAClG,6DAA6D;QAC7D,2DAA2D;QAC3D,+DAA+D;QAC/D,eAAe;QACf,gBAAgB;QAChB,iBAAiB;QACjB,6FAA6F;QAC7F,mBAAmB;QACnB,wFAAwF;QACxF,+BAA+B;QAC/B,SAAS;QACT,qBAAqB;QACrB,iBAAiB;QACjB,0DAA0D;QAC1D,2BAA2B;QAC3B,iBAAiB;QACjB,oBAAoB;QACpB,wBAAwB;QACxB,eAAe;QACf,cAAc;QACd,MAAM;QACN,GAAG;QACH,KAAK;QACL,EAAE;QACF,6BAA6B;QAC7B,EAAE;QACF,2bAA2b;QAC3b,EAAE;QACF,OAAO;QACP,iEAAiE;QACjE,EAAE;QACF,gGAAgG;QAChG,2CAA2C;QAC3C,6DAA6D;QAC7D,EAAE;QACF,wBAAwB;QACxB,aAAa;QACb,KAAK;QACL,sBAAsB;QACtB,uBAAuB;QACvB,yGAAyG;QACzG,kEAAkE;QAClE,MAAM;QACN,KAAK;QACL,0BAA0B;QAC1B,6EAA6E;QAC7E,8FAA8F;QAC9F,4CAA4C;QAC5C,mEAAmE;QACnE,0BAA0B;QAC1B,+BAA+B;QAC/B,2BAA2B;QAC3B,4BAA4B;QAC5B,kCAAkC;QAClC,WAAW;QACX,iCAAiC;QACjC,mCAAmC;QACnC,+BAA+B;QAC/B,oBAAoB;QACpB,mDAAmD;QACnD,WAAW;QACX,kCAAkC;QAClC,kEAAkE;QAClE,6EAA6E;QAC7E,6CAA6C;QAC7C,+EAA+E;QAC/E,cAAc;QACd,yDAAyD;QACzD,mDAAmD;QACnD,gGAAgG;QAChG,yFAAyF;QACzF,UAAU;QACV,SAAS;QACT,kGAAkG;QAClG,2BAA2B;QAC3B,4BAA4B;QAC5B,6DAA6D;QAC7D,gGAAgG;QAChG,4DAA4D;QAC5D,yEAAyE;QACzE,4FAA4F;QAC5F,iCAAiC;QACjC,wDAAwD;QACxD,2BAA2B;QAC3B,mDAAmD;QACnD,WAAW;QACX,SAAS;QACT,MAAM;QACN,IAAI;QACJ,KAAK;QACL,EAAE;QACF,yCAAyC;QACzC,EAAE;QACF,2KAA2K;QAC3K,EAAE;QACF,yHAAyH;QACzH,4TAA4T;QAC5T,0FAA0F;QAC1F,EAAE;QACF,qXAAqX;QACrX,EAAE;QACF,sbAAsb;QACtb,EAAE;QACF,odAAod;QACpd,EAAE;QACF,oDAAoD;QACpD,EAAE;QACF,2PAA2P;QAC3P,EAAE;QACF,OAAO;QACP,iEAAiE;QACjE,EAAE;QACF,8EAA8E;QAC9E,oBAAoB;QACpB,wEAAwE;QACxE,0CAA0C;QAC1C,6CAA6C;QAC7C,wBAAwB;QACxB,2FAA2F;QAC3F,SAAS;QACT,gIAAgI;QAChI,OAAO;QACP,mBAAmB;QACnB,4DAA4D;QAC5D,0CAA0C;QAC1C,0CAA0C;QAC1C,iGAAiG;QACjG,6HAA6H;QAC7H,OAAO;QACP,KAAK;QACL,KAAK;QACL,EAAE;QACF,oKAAoK;QACpK,EAAE;QACF,gCAAgC;QAChC,EAAE;QACF,mSAAmS;QACnS,EAAE;QACF,6BAA6B;QAC7B,EAAE;QACF,wKAAwK;QACxK,EAAE;QACF,4OAA4O;KAC7O,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,mEAAmE;AACnE,+EAA+E;AAE/E,MAAM,iBAAiB,GAA6C;IAClE,CAAC,OAAO,EAAE,uEAAuE,CAAC;IAClF;QACE,SAAS;QACT,+IAA+I;KAChJ;IACD;QACE,eAAe;QACf,iGAAiG;KAClG;IACD;QACE,gBAAgB;QAChB,8HAA8H;KAC/H;IACD;QACE,YAAY;QACZ,kJAAkJ;KACnJ;IACD;QACE,aAAa;QACb,+IAA+I;KAChJ;IACD;QACE,eAAe;QACf,+EAA+E;KAChF;IACD,CAAC,gBAAgB,EAAE,wEAAwE,CAAC;IAC5F,CAAC,YAAY,EAAE,0DAA0D,CAAC;IAC1E,CAAC,SAAS,EAAE,wEAAwE,CAAC;IACrF;QACE,qBAAqB;QACrB,mKAAmK;KACpK;IACD;QACE,iBAAiB;QACjB,4JAA4J;KAC7J;IACD,CAAC,YAAY,EAAE,sEAAsE,CAAC;IACtF;QACE,mBAAmB;QACnB,+EAA+E;KAChF;IACD,CAAC,gBAAgB,EAAE,2EAA2E,CAAC;CAChG,CAAC;AAEF,MAAM,UAAU,uBAAuB;IACrC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC/C,gGAAgG;IAChG,oGAAoG;IACpG,MAAM,YAAY,GAAG,qBAAqB,CAAC,MAAM,CAC/C,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,SAAS,KAAK,IAAI,CAAC,CACvE,CAAC;IACF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,+EAA+E,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzG,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,IAAY,EAAW,EAAE,CAC1C,qBAAqB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,IAAI,UAAU,CAAC,CAAC,CAAC;IAE5F,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAC7E,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QACnB,KAAK,IAAI,IAAI;QACb,OAAO;QACP,cAAc,IAAI,mBAAmB,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE;KAC7E,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAC3E,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,EAAE,OAAO,CAAC,CAC9C,CAAC;IAEF,OAAO;QACL,YAAY;QACZ,EAAE;QACF,0YAA0Y;QAC1Y,EAAE;QACF,yCAAyC;QACzC,EAAE;QACF,+OAA+O;QAC/O,EAAE;QACF,OAAO,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,CAAC;QACrD,EAAE;QACF,0DAA0D;QAC1D,EAAE;QACF,OAAO,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC;QAC1C,EAAE;QACF,wBAAwB;QACxB,EAAE;QACF,yEAAyE;QACzE,EAAE;QACF,OAAO;QACP,oDAAoD;QACpD,EAAE;QACF,wEAAwE;QACxE,mBAAmB;QACnB,4CAA4C;QAC5C,4CAA4C;QAC5C,iDAAiD;QACjD,qEAAqE;QACrE,OAAO;QACP,KAAK;QACL,KAAK;KACN,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}
+{"version":3,"file":"skill-authoring-refs.js","sourceRoot":"","sources":["../src/skill-authoring-refs.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,8FAA8F;AAC9F,4FAA4F;AAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,+EAA+E;AAC/E,6CAA6C;AAC7C,EAAE;AACF,iGAAiG;AACjG,qGAAqG;AACrG,gGAAgG;AAChG,+EAA+E;AAE/E,MAAM,UAAU,gCAAgC;IAC9C,OAAO;QACL,sBAAsB;QACtB,EAAE;QACF,aAAa;QACb,EAAE;QACF,eAAe;QACf,aAAa;QACb,eAAe;QACf,cAAc;QACd,wCAAwC;QACxC,yCAAyC;QACzC,0BAA0B;QAC1B,mEAAmE;QACnE,sBAAsB;QACtB,6BAA6B;QAC7B,SAAS;QACT,yBAAyB;QACzB,sBAAsB;QACtB,cAAc;QACd,EAAE;QACF,gBAAgB;QAChB,EAAE;QACF,oUAAoU;QACpU,oJAAoJ;QACpJ,+TAA+T;QAC/T,EAAE;QACF,cAAc;QACd,EAAE;QACF,gVAAgV;QAChV,EAAE;QACF,gBAAgB;QAChB,EAAE;QACF,gLAAgL;QAChL,EAAE;QACF,eAAe;QACf,EAAE;QACF,kDAAkD;QAClD,EAAE;QACF,uMAAuM;QACvM,+NAA+N;QAC/N,EAAE;QACF,mKAAmK;QACnK,EAAE;QACF,kbAAkb;QAClb,EAAE;QACF,w4DAAw4D;QACx4D,EAAE;QACF,yCAAyC;QACzC,EAAE;QACF,yaAAya;QACza,EAAE;QACF,OAAO;QACP,iFAAiF;QACjF,EAAE;QACF,sDAAsD;QACtD,sCAAsC;QACtC,gDAAgD;QAChD,0DAA0D;QAC1D,iBAAiB;QACjB,sBAAsB;QACtB,qBAAqB;QACrB,sBAAsB;QACtB,2BAA2B;QAC3B,yBAAyB;QACzB,+CAA+C;QAC/C,0EAA0E;QAC1E,qFAAqF;QACrF,QAAQ;QACR,sBAAsB;QACtB,uBAAuB;QACvB,uBAAuB;QACvB,yBAAyB;QACzB,uEAAuE;QACvE,oDAAoD;QACpD,8EAA8E;QAC9E,kDAAkD;QAClD,QAAQ;QACR,MAAM;QACN,KAAK;QACL,EAAE;QACF,0FAA0F;QAC1F,2BAA2B;QAC3B,uDAAuD;QACvD,6CAA6C;QAC7C,wEAAwE;QACxE,0CAA0C;QAC1C,8EAA8E;QAC9E,wDAAwD;QACxD,QAAQ;QACR,OAAO;QACP,yBAAyB;QACzB,2DAA2D;QAC3D,qEAAqE;QACrE,kDAAkD;QAClD,0CAA0C;QAC1C,0GAA0G;QAC1G,+CAA+C;QAC/C,QAAQ;QACR,OAAO;QACP,KAAK;QACL,KAAK;QACL,EAAE;QACF,koBAAkoB;QACloB,EAAE;QACF,+vBAA+vB;QAC/vB,EAAE;QACF,0CAA0C;QAC1C,EAAE;QACF,6dAA6d;QAC7d,EAAE;QACF,2uBAA2uB;QAC3uB,EAAE;QACF,2BAA2B;QAC3B,EAAE;QACF,4dAA4d;QAC5d,EAAE;QACF,OAAO;QACP,2BAA2B;QAC3B,qCAAqC;QACrC,4CAA4C;QAC5C,yEAAyE;QACzE,KAAK;QACL,EAAE;QACF,yBAAyB;QACzB,oBAAoB;QACpB,wCAAwC;QACxC,gDAAgD;QAChD,MAAM;QACN,uCAAuC;QACvC,IAAI;QACJ,KAAK;QACL,EAAE;QACF,0tBAA0tB;QAC1tB,EAAE;QACF,oEAAoE;QACpE,EAAE;QACF,+NAA+N;QAC/N,EAAE;QACF,mVAAmV;QACnV,wQAAwQ;QACxQ,sGAAsG;QACtG,EAAE;QACF,sCAAsC;QACtC,EAAE;QACF,OAAO;QACP,SAAS;QACT,mCAAmC;QACnC,sGAAsG;QACtG,kDAAkD;QAClD,wDAAwD;QACxD,+CAA+C;QAC/C,mGAAmG;QACnG,+EAA+E;QAC/E,GAAG;QACH,KAAK;QACL,EAAE;QACF,2PAA2P;QAC3P,EAAE;QACF,iDAAiD;QACjD,EAAE;QACF,qMAAqM;QACrM,EAAE;QACF,KAAK;QACL,4DAA4D;QAC5D,kDAAkD;QAClD,yDAAyD;QACzD,2DAA2D;QAC3D,6CAA6C;QAC7C,KAAK;QACL,EAAE;QACF,2gBAA2gB;QAC3gB,EAAE;QACF,kDAAkD;QAClD,EAAE;QACF,OAAO;QACP,8DAA8D;QAC9D,uDAAuD;QACvD,EAAE;QACF,mGAAmG;QACnG,uFAAuF;QACvF,EAAE;QACF,wEAAwE;QACxE,0EAA0E;QAC1E,yDAAyD;QACzD,mFAAmF;QACnF,2FAA2F;QAC3F,sFAAsF;QACtF,uDAAuD;QACvD,gFAAgF;QAChF,8BAA8B;QAC9B,4GAA4G;QAC5G,OAAO;QACP,0FAA0F;QAC1F,0FAA0F;QAC1F,KAAK;QACL,gGAAgG;QAChG,uGAAuG;QACvG,+FAA+F;QAC/F,GAAG;QACH,KAAK;QACL,EAAE;QACF,2gBAA2gB;QAC3gB,EAAE;QACF,+BAA+B;QAC/B,EAAE;QACF,+NAA+N;QAC/N,EAAE;QACF,uBAAuB;QACvB,EAAE;QACF,wcAAwc;QACxc,EAAE;QACF,OAAO;QACP,YAAY;QACZ,6DAA6D;QAC7D,cAAc;QACd,qFAAqF;QACrF,kDAAkD;QAClD,wDAAwD;QACxD,gCAAgC;QAChC,yCAAyC;QACzC,WAAW;QACX,wFAAwF;QACxF,QAAQ;QACR,MAAM;QACN,IAAI;QACJ,KAAK;QACL,EAAE;QACF,miBAAmiB;QACniB,EAAE;QACF,qCAAqC;QACrC,EAAE;QACF,2MAA2M;QAC3M,EAAE;QACF,OAAO;QACP,4BAA4B;QAC5B,0EAA0E;QAC1E,4DAA4D;QAC5D,iFAAiF;QACjF,oCAAoC;QACpC,6BAA6B;QAC7B,0BAA0B;QAC1B,2DAA2D;QAC3D,iEAAiE;QACjE,SAAS;QACT,2EAA2E;QAC3E,MAAM;QACN,KAAK;QACL,KAAK;QACL,EAAE;QACF,iwEAAiwE;QACjwE,EAAE;QACF,8BAA8B;QAC9B,EAAE;QACF,OAAO;QACP,8EAA8E;QAC9E,4EAA4E;QAC5E,4CAA4C;QAC5C,kDAAkD;QAClD,iDAAiD;QACjD,mCAAmC;QACnC,iGAAiG;QACjG,4EAA4E;QAC5E,MAAM;QACN,KAAK;QACL,KAAK;QACL,EAAE;QACF,uUAAuU;QACvU,EAAE;QACF,UAAU;QACV,EAAE;QACF,uPAAuP;QACvP,EAAE;QACF,OAAO;QACP,gDAAgD;QAChD,qCAAqC;QACrC,EAAE;QACF,4BAA4B;QAC5B,oDAAoD;QACpD,iDAAiD;QACjD,OAAO;QACP,KAAK;QACL,KAAK;QACL,EAAE;QACF,yIAAyI;QACzI,EAAE;QACF,0BAA0B;QAC1B,EAAE;QACF,8NAA8N;QAC9N,EAAE;QACF,uBAAuB;QACvB,EAAE;QACF,wWAAwW;QACxW,EAAE;QACF,eAAe;QACf,EAAE;QACF,+SAA+S;KAChT,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,kGAAkG;AAClG,EAAE;AACF,+FAA+F;AAC/F,oGAAoG;AACpG,oGAAoG;AACpG,2EAA2E;AAC3E,+EAA+E;AAE/E,MAAM,UAAU,6BAA6B;IAC3C,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IACrF,OAAO;QACL,wBAAwB;QACxB,EAAE;QACF,aAAa;QACb,EAAE;QACF,mBAAmB;QACnB,sBAAsB;QACtB,wBAAwB;QACxB,wCAAwC;QACxC,0CAA0C;QAC1C,+BAA+B;QAC/B,4BAA4B;QAC5B,EAAE;QACF,oBAAoB;QACpB,EAAE;QACF,uVAAuV;QACvV,EAAE;QACF,0BAA0B;QAC1B,EAAE;QACF,uRAAuR;QACvR,EAAE;QACF,uWAAuW;QACvW,EAAE;QACF,kgBAAkgB;QAClgB,EAAE;QACF,kZAAkZ;QAClZ,EAAE;QACF,wcAAwc;QACxc,EAAE;QACF,4bAA4b;QAC5b,EAAE;QACF,uBAAuB;QACvB,EAAE;QACF,sIAAsI;QACtI,EAAE;QACF,OAAO,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC;QACtC,EAAE;QACF,m1DAAm1D;QACn1D,EAAE;QACF,yBAAyB;QACzB,EAAE;QACF,mOAAmO;QACnO,EAAE;QACF,2BAA2B;QAC3B,EAAE;QACF,gZAAgZ;QAChZ,EAAE;QACF,QAAQ;QACR,oCAAoC;QACpC,0DAA0D;QAC1D,0IAA0I;QAC1I,EAAE;QACF,qFAAqF;QACrF,mJAAmJ;QACnJ,wCAAwC;QACxC,EAAE;QACF,sBAAsB;QACtB,8BAA8B;QAC9B,0BAA0B;QAC1B,2BAA2B;QAC3B,iCAAiC;QACjC,IAAI;QACJ,EAAE;QACF,gEAAgE;QAChE,kEAAkE;QAClE,iDAAiD;QACjD,YAAY;QACZ,0EAA0E;QAC1E,kEAAkE;QAClE,0EAA0E;QAC1E,yFAAyF;QACzF,MAAM;QACN,GAAG;QACH,EAAE;QACF,yCAAyC;QACzC,+CAA+C;QAC/C,yDAAyD;QACzD,qGAAqG;QACrG,uFAAuF;QACvF,qCAAqC;QACrC,2CAA2C;QAC3C,yDAAyD;QACzD,uDAAuD;QACvD,gEAAgE;QAChE,sGAAsG;QACtG,qGAAqG;QACrG,oCAAoC;QACpC,iDAAiD;QACjD,EAAE;QACF,qBAAqB;QACrB,oDAAoD;QACpD,+BAA+B;QAC/B,mFAAmF;QACnF,6GAA6G;QAC7G,SAAS;QACT,yEAAyE;QACzE,EAAE;QACF,kCAAkC;QAClC,yBAAyB;QACzB,oEAAoE;QACpE,mCAAmC;QACnC,oGAAoG;QACpG,OAAO;QACP,sCAAsC;QACtC,iHAAiH;QACjH,OAAO;QACP,KAAK;QACL,EAAE;QACF,mFAAmF;QACnF,+FAA+F;QAC/F,4FAA4F;QAC5F,EAAE;QACF,YAAY;QACZ,kGAAkG;QAClG,8HAA8H;QAC9H,8BAA8B;QAC9B,oGAAoG;QACpG,wEAAwE;QACxE,4BAA4B;QAC5B,kGAAkG;QAClG,6DAA6D;QAC7D,2DAA2D;QAC3D,+DAA+D;QAC/D,eAAe;QACf,gBAAgB;QAChB,iBAAiB;QACjB,6FAA6F;QAC7F,mBAAmB;QACnB,wFAAwF;QACxF,+BAA+B;QAC/B,SAAS;QACT,qBAAqB;QACrB,iBAAiB;QACjB,0DAA0D;QAC1D,2BAA2B;QAC3B,iBAAiB;QACjB,oBAAoB;QACpB,wBAAwB;QACxB,eAAe;QACf,cAAc;QACd,MAAM;QACN,GAAG;QACH,KAAK;QACL,EAAE;QACF,6BAA6B;QAC7B,EAAE;QACF,2bAA2b;QAC3b,EAAE;QACF,OAAO;QACP,iEAAiE;QACjE,EAAE;QACF,gGAAgG;QAChG,2CAA2C;QAC3C,6DAA6D;QAC7D,EAAE;QACF,wBAAwB;QACxB,aAAa;QACb,KAAK;QACL,sBAAsB;QACtB,uBAAuB;QACvB,yGAAyG;QACzG,kEAAkE;QAClE,MAAM;QACN,KAAK;QACL,0BAA0B;QAC1B,6EAA6E;QAC7E,8FAA8F;QAC9F,4CAA4C;QAC5C,mEAAmE;QACnE,0BAA0B;QAC1B,+BAA+B;QAC/B,2BAA2B;QAC3B,4BAA4B;QAC5B,kCAAkC;QAClC,WAAW;QACX,iCAAiC;QACjC,mCAAmC;QACnC,+BAA+B;QAC/B,oBAAoB;QACpB,mDAAmD;QACnD,WAAW;QACX,kCAAkC;QAClC,kEAAkE;QAClE,6EAA6E;QAC7E,6CAA6C;QAC7C,+EAA+E;QAC/E,cAAc;QACd,yDAAyD;QACzD,mDAAmD;QACnD,gGAAgG;QAChG,yFAAyF;QACzF,UAAU;QACV,SAAS;QACT,kGAAkG;QAClG,2BAA2B;QAC3B,4BAA4B;QAC5B,6DAA6D;QAC7D,gGAAgG;QAChG,4DAA4D;QAC5D,yEAAyE;QACzE,4FAA4F;QAC5F,iCAAiC;QACjC,wDAAwD;QACxD,2BAA2B;QAC3B,mDAAmD;QACnD,WAAW;QACX,SAAS;QACT,MAAM;QACN,IAAI;QACJ,KAAK;QACL,EAAE;QACF,yCAAyC;QACzC,EAAE;QACF,2KAA2K;QAC3K,EAAE;QACF,yHAAyH;QACzH,4TAA4T;QAC5T,0FAA0F;QAC1F,EAAE;QACF,qXAAqX;QACrX,EAAE;QACF,sbAAsb;QACtb,EAAE;QACF,odAAod;QACpd,EAAE;QACF,oDAAoD;QACpD,EAAE;QACF,2PAA2P;QAC3P,EAAE;QACF,OAAO;QACP,iEAAiE;QACjE,EAAE;QACF,8EAA8E;QAC9E,oBAAoB;QACpB,wEAAwE;QACxE,0CAA0C;QAC1C,6CAA6C;QAC7C,wBAAwB;QACxB,2FAA2F;QAC3F,SAAS;QACT,gIAAgI;QAChI,OAAO;QACP,mBAAmB;QACnB,4DAA4D;QAC5D,0CAA0C;QAC1C,0CAA0C;QAC1C,iGAAiG;QACjG,6HAA6H;QAC7H,OAAO;QACP,KAAK;QACL,KAAK;QACL,EAAE;QACF,oKAAoK;QACpK,EAAE;QACF,gCAAgC;QAChC,EAAE;QACF,mSAAmS;QACnS,EAAE;QACF,6BAA6B;QAC7B,EAAE;QACF,wKAAwK;QACxK,EAAE;QACF,4OAA4O;KAC7O,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,mEAAmE;AACnE,+EAA+E;AAE/E,MAAM,iBAAiB,GAA6C;IAClE,CAAC,OAAO,EAAE,uEAAuE,CAAC;IAClF;QACE,SAAS;QACT,+IAA+I;KAChJ;IACD;QACE,eAAe;QACf,iGAAiG;KAClG;IACD;QACE,gBAAgB;QAChB,8HAA8H;KAC/H;IACD;QACE,YAAY;QACZ,kJAAkJ;KACnJ;IACD;QACE,aAAa;QACb,+IAA+I;KAChJ;IACD;QACE,eAAe;QACf,+EAA+E;KAChF;IACD,CAAC,gBAAgB,EAAE,wEAAwE,CAAC;IAC5F,CAAC,YAAY,EAAE,0DAA0D,CAAC;IAC1E,CAAC,SAAS,EAAE,wEAAwE,CAAC;IACrF;QACE,qBAAqB;QACrB,mKAAmK;KACpK;IACD;QACE,iBAAiB;QACjB,4JAA4J;KAC7J;IACD,CAAC,YAAY,EAAE,sEAAsE,CAAC;IACtF;QACE,mBAAmB;QACnB,+EAA+E;KAChF;IACD,CAAC,gBAAgB,EAAE,2EAA2E,CAAC;CAChG,CAAC;AAEF,MAAM,UAAU,uBAAuB;IACrC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC/C,gGAAgG;IAChG,oGAAoG;IACpG,MAAM,YAAY,GAAG,qBAAqB,CAAC,MAAM,CAC/C,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,SAAS,KAAK,IAAI,CAAC,CACvE,CAAC;IACF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,+EAA+E,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzG,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,IAAY,EAAW,EAAE,CAC1C,qBAAqB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,IAAI,UAAU,CAAC,CAAC,CAAC;IAE5F,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAC7E,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QACnB,KAAK,IAAI,IAAI;QACb,OAAO;QACP,cAAc,IAAI,mBAAmB,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE;KAC7E,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAC3E,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,EAAE,OAAO,CAAC,CAC9C,CAAC;IAEF,OAAO;QACL,YAAY;QACZ,EAAE;QACF,0YAA0Y;QAC1Y,EAAE;QACF,yCAAyC;QACzC,EAAE;QACF,+OAA+O;QAC/O,EAAE;QACF,OAAO,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,CAAC;QACrD,EAAE;QACF,0DAA0D;QAC1D,EAAE;QACF,OAAO,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC;QAC1C,EAAE;QACF,wBAAwB;QACxB,EAAE;QACF,yEAAyE;QACzE,EAAE;QACF,OAAO;QACP,oDAAoD;QACpD,EAAE;QACF,wEAAwE;QACxE,mBAAmB;QACnB,4CAA4C;QAC5C,4CAA4C;QAC5C,iDAAiD;QACjD,qEAAqE;QACrE,OAAO;QACP,KAAK;QACL,KAAK;KACN,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/node_modules/@noodle-borg/agent-kit/dist/skill-embedded-assistant-ref.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-embedded-assistant-ref.d.ts","sourceRoot":"","sources":["../src/skill-embedded-assistant-ref.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,wBAAgB,gCAAgC,IAAI,MAAM,CA8hBzD"}
+{"version":3,"file":"skill-embedded-assistant-ref.d.ts","sourceRoot":"","sources":["../src/skill-embedded-assistant-ref.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,wBAAgB,gCAAgC,IAAI,MAAM,CAyiBzD"}

package/node_modules/@noodle-borg/agent-kit/dist/skill-embedded-assistant-ref.js

@@ -159,7 +159,12 @@ export function renderEmbeddedAssistantReference() {
         '    clientId: process.env.NOODLE_ASSISTANT_CLIENT_ID!,',
         '    clientSecret: process.env.NOODLE_ASSISTANT_CLIENT_SECRET!,',
         '    origin: process.env.PUBLIC_APP_ORIGIN!,',
-        '    user: { id: user.id, email: user.email, roles: user.roles },',
+        '    user: {',
+        '      id: user.id,',
+        '      email: user.email,',
+        '      roles: user.roles,',
+        '      scopes: user.scopes,',
+        '    },',
         '    context,',
         '    // Saved, backend-verified user preferences outrank browser hints.',
         '    preferences: { locale: user.locale, timeZone: user.timeZone },',
@@ -168,7 +173,7 @@ export function renderEmbeddedAssistantReference() {
         '}',
         '```',
         '',
-        'Authenticate before exchange. Source `origin` from trusted server configuration or strictly match the request origin against the same exact allowlist; never accept an arbitrary request header. Treat page context as untrusted model context, never authorization. Forward the helper response unchanged.',
+        'Authenticate before exchange. Pass backend-verified `user.roles` and OAuth-style `user.scopes` separately; they govern the same per-tool authorization rules as verified MCP bearer claims. Source `origin` from trusted server configuration or strictly match the request origin against the same exact allowlist; never accept an arbitrary request header. Treat page context as untrusted model context, never authorization. Forward the helper response unchanged.',
         '',
         '`serviceUrl` is the Noodle Seed control-plane base URL: the value `noodle assistant clients create` prints, also stored as `serviceUrl` in `deployment.json`. It is NOT the deployment MCP endpoint (`url`, which ends in `/v1/mcp` and rejects session exchange). Never probe or guess endpoints with real credentials.',
         '',
@@ -209,7 +214,13 @@ export function renderEmbeddedAssistantReference() {
         '```ts',
         'const session = await createAssistantSession({',
         '  serviceUrl, clientId, clientSecret, origin,',
-        '  user: { id: user.id, email: user.email, name: user.name },',
+        '  user: {',
+        '    id: user.id,',
+        '    email: user.email,',
+        '    name: user.name,',
+        '    roles: user.roles,',
+        '    scopes: user.scopes,',
+        '  },',
         '  claims: { displayName: user.name, accountTier: account.tier, region: account.region },',
         '});',
         '```',

package/node_modules/@noodle-borg/agent-kit/dist/skill-embedded-assistant-ref.js.map

@@ -1 +1 @@
-{"version":3,"file":"skill-embedded-assistant-ref.js","sourceRoot":"","sources":["../src/skill-embedded-assistant-ref.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,MAAM,UAAU,gCAAgC;IAC9C,OAAO;QACL,sBAAsB;QACtB,EAAE;QACF,aAAa;QACb,EAAE;QACF,gBAAgB;QAChB,8BAA8B;QAC9B,uBAAuB;QACvB,8BAA8B;QAC9B,wBAAwB;QACxB,kCAAkC;QAClC,6BAA6B;QAC7B,kCAAkC;QAClC,iCAAiC;QACjC,kDAAkD;QAClD,wBAAwB;QACxB,6BAA6B;QAC7B,gCAAgC;QAChC,0BAA0B;QAC1B,uBAAuB;QACvB,yCAAyC;QACzC,EAAE;QACF,iBAAiB;QACjB,EAAE;QACF,4SAA4S;QAC5S,EAAE;QACF,oDAAoD;QACpD,EAAE;QACF,kCAAkC;QAClC,qBAAqB;QACrB,4HAA4H;QAC5H,8KAA8K;QAC9K,wLAAwL;QACxL,4NAA4N;QAC5N,kJAAkJ;QAClJ,EAAE;QACF,+BAA+B;QAC/B,EAAE;QACF,kbAAkb;QAClb,EAAE;QACF,wBAAwB;QACxB,EAAE;QACF,6IAA6I;QAC7I,EAAE;QACF,OAAO;QACP,gDAAgD;QAChD,wEAAwE;QACxE,gCAAgC;QAChC,6BAA6B;QAC7B,oDAAoD;QACpD,yCAAyC;QACzC,gDAAgD;QAChD,OAAO;QACP,yEAAyE;QACzE,2DAA2D;QAC3D,KAAK;QACL,KAAK;QACL,EAAE;QACF,qUAAqU;QACrU,EAAE;QACF,MAAM;QACN,EAAE;QACF,OAAO;QACP,wBAAwB;QACxB,iDAAiD;QACjD,KAAK;QACL,EAAE;QACF,+FAA+F;QAC/F,EAAE;QACF,+BAA+B;QAC/B,EAAE;QACF,6PAA6P;QAC7P,EAAE;QACF,OAAO;QACP,gCAAgC;QAChC,0BAA0B;QAC1B,0FAA0F;QAC1F,uCAAuC;QACvC,qGAAqG;QACrG,mBAAmB;QACnB,uFAAuF;QACvF,iFAAiF;QACjF,eAAe;QACf,uBAAuB;QACvB,oEAAoE;QACpE,QAAQ;QACR,yFAAyF;QACzF,kEAAkE;QAClE,MAAM;QACN,KAAK;QACL,KAAK;QACL,EAAE;QACF,+WAA+W;QAC/W,EAAE;QACF,4jCAA4jC;QAC5jC,EAAE;QACF,ydAAyd;QACzd,EAAE;QACF,yBAAyB;QACzB,EAAE;QACF,gOAAgO;QAChO,EAAE;QACF,OAAO;QACP,8IAA8I;QAC9I,sHAAsH;QACtH,+IAA+I;QAC/I,mDAAmD;QACnD,KAAK;QACL,EAAE;QACF,8LAA8L;QAC9L,EAAE;QACF,mCAAmC;QACnC,EAAE;QACF,2WAA2W;QAC3W,EAAE;QACF,gSAAgS;QAChS,EAAE;QACF,OAAO;QACP,oCAAoC;QACpC,yFAAyF;QACzF,KAAK;QACL,wEAAwE;QACxE,KAAK;QACL,EAAE;QACF,8BAA8B;QAC9B,EAAE;QACF,iCAAiC;QACjC,EAAE;QACF,OAAO;QACP,gFAAgF;QAChF,KAAK;QACL,EAAE;QACF,iOAAiO;QACjO,EAAE;QACF,wIAAwI;QACxI,EAAE;QACF,OAAO;QACP,2FAA2F;QAC3F,KAAK;QACL,EAAE;QACF,6PAA6P;QAC7P,EAAE;QACF,mCAAmC;QACnC,EAAE;QACF,4KAA4K;QAC5K,EAAE;QACF,oDAAoD;QACpD,EAAE;QACF,OAAO;QACP,wEAAwE;QACxE,EAAE;QACF,gDAAgD;QAChD,mDAAmD;QACnD,6CAA6C;QAC7C,kDAAkD;QAClD,kDAAkD;QAClD,wDAAwD;QACxD,gEAAgE;QAChE,6CAA6C;QAC7C,kEAAkE;QAClE,cAAc;QACd,wEAAwE;QACxE,oEAAoE;QACpE,OAAO;QACP,kCAAkC;QAClC,GAAG;QACH,KAAK;QACL,EAAE;QACF,6SAA6S;QAC7S,EAAE;QACF,0TAA0T;QAC1T,EAAE;QACF,kCAAkC;QAClC,EAAE;QACF,waAAwa;QACxa,EAAE;QACF,iGAAiG;QACjG,EAAE;QACF,OAAO;QACP,YAAY;QACZ,6DAA6D;QAC7D,cAAc;QACd,qFAAqF;QACrF,kDAAkD;QAClD,wDAAwD;QACxD,gCAAgC;QAChC,yCAAyC;QACzC,WAAW;QACX,wFAAwF;QACxF,QAAQ;QACR,MAAM;QACN,IAAI;QACJ,KAAK;QACL,EAAE;QACF,svBAAsvB;QACtvB,EAAE;QACF,6BAA6B;QAC7B,EAAE;QACF,2zDAA2zD;QAC3zD,EAAE;QACF,mDAAmD;QACnD,EAAE;QACF,uHAAuH;QACvH,EAAE;QACF,wHAAwH;QACxH,EAAE;QACF,OAAO;QACP,gDAAgD;QAChD,+CAA+C;QAC/C,8DAA8D;QAC9D,0FAA0F;QAC1F,KAAK;QACL,KAAK;QACL,EAAE;QACF,iLAAiL;QACjL,EAAE;QACF,OAAO;QACP,gCAAgC;QAChC,0BAA0B;QAC1B,oBAAoB;QACpB,2CAA2C;QAC3C,2CAA2C;QAC3C,oDAAoD;QACpD,MAAM;QACN,KAAK;QACL,KAAK;QACL,EAAE;QACF,gGAAgG;QAChG,EAAE;QACF,OAAO;QACP,iBAAiB;QACjB,6CAA6C;QAC7C,wBAAwB;QACxB,wCAAwC;QACxC,+FAA+F;QAC/F,KAAK;QACL,KAAK;QACL,EAAE;QACF,mdAAmd;QACnd,EAAE;QACF,mZAAmZ;QACnZ,EAAE;QACF,igBAAigB;QACjgB,EAAE;QACF,yBAAyB;QACzB,EAAE;QACF,2aAA2a;QAC3a,EAAE;QACF,8BAA8B;QAC9B,EAAE;QACF,8CAA8C;QAC9C,EAAE;QACF,QAAQ;QACR,gEAAgE;QAChE,EAAE;QACF,qFAAqF;QACrF,KAAK;QACL,EAAE;QACF,oMAAoM;QACpM,EAAE;QACF,4SAA4S;QAC5S,EAAE;QACF,0OAA0O;QAC1O,EAAE;QACF,iKAAiK;QACjK,EAAE;QACF,QAAQ;QACR,eAAe;QACf,EAAE;QACF,8CAA8C;QAC9C,8DAA8D;QAC9D,0EAA0E;QAC1E,EAAE;QACF,+HAA+H;QAC/H,2CAA2C;QAC3C,oEAAoE;QACpE,gDAAgD;QAChD,mBAAmB;QACnB,6BAA6B;QAC7B,mCAAmC;QACnC,mEAAmE;QACnE,SAAS;QACT,OAAO;QACP,kEAAkE;QAClE,kDAAkD;QAClD,kCAAkC;QAClC,yEAAyE;QACzE,SAAS;QACT,MAAM;QACN,EAAE;QACF,YAAY;QACZ,uDAAuD;QACvD,oCAAoC;QACpC,6DAA6D;QAC7D,iDAAiD;QACjD,8EAA8E;QAC9E,sDAAsD;QACtD,yCAAyC;QACzC,wBAAwB;QACxB,+EAA+E;QAC/E,uEAAuE;QACvE,6EAA6E;QAC7E,gEAAgE;QAChE,uEAAuE;QACvE,0BAA0B;QAC1B,2BAA2B;QAC3B,oEAAoE;QACpE,6FAA6F;QAC7F,qBAAqB;QACrB,6BAA6B;QAC7B,6BAA6B;QAC7B,2BAA2B;QAC3B,oEAAoE;QACpE,8FAA8F;QAC9F,qBAAqB;QACrB,mCAAmC;QACnC,6BAA6B;QAC7B,4BAA4B;QAC5B,kBAAkB;QAClB,eAAe;QACf,uDAAuD;QACvD,0CAA0C;QAC1C,wBAAwB;QACxB,+EAA+E;QAC/E,4CAA4C;QAC5C,gFAAgF;QAChF,2BAA2B;QAC3B,qEAAqE;QACrE,+FAA+F;QAC/F,qBAAqB;QACrB,oCAAoC;QACpC,6BAA6B;QAC7B,4BAA4B;QAC5B,kBAAkB;QAClB,eAAe;QACf,qDAAqD;QACrD,wBAAwB;QACxB,kFAAkF;QAClF,+DAA+D;QAC/D,wBAAwB;QACxB,kBAAkB;QAClB,eAAe;QACf,8CAA8C;QAC9C,wBAAwB;QACxB,gCAAgC;QAChC,oEAAoE;QACpE,mCAAmC;QACnC,oCAAoC;QACpC,yCAAyC;QACzC,oBAAoB;QACpB,kBAAkB;QAClB,eAAe;QACf,uEAAuE;QACvE,eAAe;QACf,oBAAoB;QACpB,WAAW;QACX,4DAA4D;QAC5D,aAAa;QACb,gCAAgC;QAChC,mCAAmC;QACnC,yCAAyC;QACzC,iCAAiC;QACjC,yBAAyB;QACzB,gDAAgD;QAChD,YAAY;QACZ,SAAS;QACT,gBAAgB;QAChB,gCAAgC;QAChC,yBAAyB;QACzB,qEAAqE;QACrE,YAAY;QACZ,mBAAmB;QACnB,8EAA8E;QAC9E,eAAe;QACf,+CAA+C;QAC/C,YAAY;QACZ,eAAe;QACf,gBAAgB;QAChB,MAAM;QACN,GAAG;QACH,KAAK;QACL,EAAE;QACF,oSAAoS;QACpS,EAAE;QACF,gNAAgN;QAChN,EAAE;QACF,QAAQ;QACR,mBAAmB;QACnB,sBAAsB;QACtB,0BAA0B;QAC1B,6DAA6D;QAC7D,OAAO;QACP,kBAAkB;QAClB,qBAAqB;QACrB,MAAM;QACN,+BAA+B;QAC/B,KAAK;QACL,EAAE;QACF,uHAAuH;QACvH,EAAE;QACF,6uBAA6uB;QAC7uB,EAAE;QACF,ynBAAynB;QACznB,EAAE;QACF,iMAAiM;QACjM,EAAE;QACF,OAAO;QACP,uEAAuE;QACvE,EAAE;QACF,2CAA2C;QAC3C,8CAA8C;QAC9C,2BAA2B;QAC3B,iCAAiC;QACjC,iEAAiE;QACjE,OAAO;QACP,KAAK;QACL,EAAE;QACF,gCAAgC;QAChC,uEAAuE;QACvE,8EAA8E;QAC9E,KAAK;QACL,EAAE;QACF,+FAA+F;QAC/F,sCAAsC;QACtC,gCAAgC;QAChC,wBAAwB;QACxB,2CAA2C;QAC3C,yCAAyC;QACzC,kFAAkF;QAClF,yCAAyC;QACzC,SAAS;QACT,mFAAmF;QACnF,qFAAqF;QACrF,SAAS;QACT,wCAAwC;QACxC,wEAAwE;QACxE,SAAS;QACT,OAAO;QACP,KAAK;QACL,KAAK;QACL,EAAE;QACF,mEAAmE;QACnE,gBAAgB;QAChB,oDAAoD;QACpD,sCAAsC;QACtC,yFAAyF;QACzF,sCAAsC;QACtC,oDAAoD;QACpD,GAAG;QACH,oFAAoF;QACpF,KAAK;QACL,EAAE;QACF,keAAke;QACle,EAAE;QACF,+qBAA+qB;QAC/qB,EAAE;QACF,OAAO;QACP,4DAA4D;QAC5D,0CAA0C;QAC1C,IAAI;QACJ,+EAA+E;QAC/E,EAAE;QACF,kCAAkC;QAClC,yCAAyC;QACzC,gFAAgF;QAChF,KAAK;QACL,2CAA2C;QAC3C,wGAAwG;QACxG,qCAAqC;QACrC,KAAK;QACL,oEAAoE;QACpE,KAAK;QACL,KAAK;QACL,EAAE;QACF,sqBAAsqB;QACtqB,EAAE;QACF,sgDAAsgD;QACtgD,EAAE;QACF,iCAAiC;QACjC,EAAE;QACF,iGAAiG;QACjG,EAAE;QACF,OAAO;QACP,uCAAuC;QACvC,iFAAiF;QACjF,KAAK;QACL,EAAE;QACF,yaAAya;QACza,EAAE;QACF,6SAA6S;QAC7S,EAAE;QACF,0YAA0Y;QAC1Y,EAAE;QACF,mQAAmQ;QACnQ,EAAE;QACF,2BAA2B;QAC3B,EAAE;QACF,mDAAmD;QACnD,4QAA4Q;QAC5Q,mKAAmK;QACnK,EAAE;QACF,wBAAwB;QACxB,EAAE;QACF,8CAA8C;QAC9C,2EAA2E;QAC3E,oFAAoF;QACpF,+QAA+Q;QAC/Q,mKAAmK;QACnK,oHAAoH;QACpH,2DAA2D;QAC3D,qFAAqF;QACrF,6LAA6L;QAC7L,EAAE;QACF,0CAA0C;QAC1C,EAAE;QACF,+BAA+B;QAC/B,qBAAqB;QACrB,ySAAyS;QACzS,4eAA4e;QAC5e,6NAA6N;QAC7N,iMAAiM;QACjM,gKAAgK;QAChK,iKAAiK;QACjK,wKAAwK;QACxK,+LAA+L;QAC/L,oOAAoO;QACpO,8RAA8R;QAC9R,0NAA0N;QAC1N,wPAAwP;QACxP,+KAA+K;QAC/K,uRAAuR;QACvR,gNAAgN;QAChN,4JAA4J;QAC5J,yHAAyH;QACzH,oOAAoO;QACpO,mRAAmR;QACnR,mMAAmM;QACnM,6LAA6L;QAC7L,gbAAgb;QAChb,iPAAiP;KAClP,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}
+{"version":3,"file":"skill-embedded-assistant-ref.js","sourceRoot":"","sources":["../src/skill-embedded-assistant-ref.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,MAAM,UAAU,gCAAgC;IAC9C,OAAO;QACL,sBAAsB;QACtB,EAAE;QACF,aAAa;QACb,EAAE;QACF,gBAAgB;QAChB,8BAA8B;QAC9B,uBAAuB;QACvB,8BAA8B;QAC9B,wBAAwB;QACxB,kCAAkC;QAClC,6BAA6B;QAC7B,kCAAkC;QAClC,iCAAiC;QACjC,kDAAkD;QAClD,wBAAwB;QACxB,6BAA6B;QAC7B,gCAAgC;QAChC,0BAA0B;QAC1B,uBAAuB;QACvB,yCAAyC;QACzC,EAAE;QACF,iBAAiB;QACjB,EAAE;QACF,4SAA4S;QAC5S,EAAE;QACF,oDAAoD;QACpD,EAAE;QACF,kCAAkC;QAClC,qBAAqB;QACrB,4HAA4H;QAC5H,8KAA8K;QAC9K,wLAAwL;QACxL,4NAA4N;QAC5N,kJAAkJ;QAClJ,EAAE;QACF,+BAA+B;QAC/B,EAAE;QACF,kbAAkb;QAClb,EAAE;QACF,wBAAwB;QACxB,EAAE;QACF,6IAA6I;QAC7I,EAAE;QACF,OAAO;QACP,gDAAgD;QAChD,wEAAwE;QACxE,gCAAgC;QAChC,6BAA6B;QAC7B,oDAAoD;QACpD,yCAAyC;QACzC,gDAAgD;QAChD,OAAO;QACP,yEAAyE;QACzE,2DAA2D;QAC3D,KAAK;QACL,KAAK;QACL,EAAE;QACF,qUAAqU;QACrU,EAAE;QACF,MAAM;QACN,EAAE;QACF,OAAO;QACP,wBAAwB;QACxB,iDAAiD;QACjD,KAAK;QACL,EAAE;QACF,+FAA+F;QAC/F,EAAE;QACF,+BAA+B;QAC/B,EAAE;QACF,6PAA6P;QAC7P,EAAE;QACF,OAAO;QACP,gCAAgC;QAChC,0BAA0B;QAC1B,0FAA0F;QAC1F,uCAAuC;QACvC,qGAAqG;QACrG,mBAAmB;QACnB,uFAAuF;QACvF,iFAAiF;QACjF,eAAe;QACf,uBAAuB;QACvB,oEAAoE;QACpE,QAAQ;QACR,yFAAyF;QACzF,kEAAkE;QAClE,MAAM;QACN,KAAK;QACL,KAAK;QACL,EAAE;QACF,+WAA+W;QAC/W,EAAE;QACF,4jCAA4jC;QAC5jC,EAAE;QACF,ydAAyd;QACzd,EAAE;QACF,yBAAyB;QACzB,EAAE;QACF,gOAAgO;QAChO,EAAE;QACF,OAAO;QACP,8IAA8I;QAC9I,sHAAsH;QACtH,+IAA+I;QAC/I,mDAAmD;QACnD,KAAK;QACL,EAAE;QACF,8LAA8L;QAC9L,EAAE;QACF,mCAAmC;QACnC,EAAE;QACF,2WAA2W;QAC3W,EAAE;QACF,gSAAgS;QAChS,EAAE;QACF,OAAO;QACP,oCAAoC;QACpC,yFAAyF;QACzF,KAAK;QACL,wEAAwE;QACxE,KAAK;QACL,EAAE;QACF,8BAA8B;QAC9B,EAAE;QACF,iCAAiC;QACjC,EAAE;QACF,OAAO;QACP,gFAAgF;QAChF,KAAK;QACL,EAAE;QACF,iOAAiO;QACjO,EAAE;QACF,wIAAwI;QACxI,EAAE;QACF,OAAO;QACP,2FAA2F;QAC3F,KAAK;QACL,EAAE;QACF,6PAA6P;QAC7P,EAAE;QACF,mCAAmC;QACnC,EAAE;QACF,4KAA4K;QAC5K,EAAE;QACF,oDAAoD;QACpD,EAAE;QACF,OAAO;QACP,wEAAwE;QACxE,EAAE;QACF,gDAAgD;QAChD,mDAAmD;QACnD,6CAA6C;QAC7C,kDAAkD;QAClD,kDAAkD;QAClD,wDAAwD;QACxD,gEAAgE;QAChE,6CAA6C;QAC7C,aAAa;QACb,oBAAoB;QACpB,0BAA0B;QAC1B,0BAA0B;QAC1B,4BAA4B;QAC5B,QAAQ;QACR,cAAc;QACd,wEAAwE;QACxE,oEAAoE;QACpE,OAAO;QACP,kCAAkC;QAClC,GAAG;QACH,KAAK;QACL,EAAE;QACF,2cAA2c;QAC3c,EAAE;QACF,0TAA0T;QAC1T,EAAE;QACF,kCAAkC;QAClC,EAAE;QACF,waAAwa;QACxa,EAAE;QACF,iGAAiG;QACjG,EAAE;QACF,OAAO;QACP,YAAY;QACZ,6DAA6D;QAC7D,cAAc;QACd,qFAAqF;QACrF,kDAAkD;QAClD,wDAAwD;QACxD,gCAAgC;QAChC,yCAAyC;QACzC,WAAW;QACX,wFAAwF;QACxF,QAAQ;QACR,MAAM;QACN,IAAI;QACJ,KAAK;QACL,EAAE;QACF,svBAAsvB;QACtvB,EAAE;QACF,6BAA6B;QAC7B,EAAE;QACF,2zDAA2zD;QAC3zD,EAAE;QACF,mDAAmD;QACnD,EAAE;QACF,uHAAuH;QACvH,EAAE;QACF,wHAAwH;QACxH,EAAE;QACF,OAAO;QACP,gDAAgD;QAChD,+CAA+C;QAC/C,WAAW;QACX,kBAAkB;QAClB,wBAAwB;QACxB,sBAAsB;QACtB,wBAAwB;QACxB,0BAA0B;QAC1B,MAAM;QACN,0FAA0F;QAC1F,KAAK;QACL,KAAK;QACL,EAAE;QACF,iLAAiL;QACjL,EAAE;QACF,OAAO;QACP,gCAAgC;QAChC,0BAA0B;QAC1B,oBAAoB;QACpB,2CAA2C;QAC3C,2CAA2C;QAC3C,oDAAoD;QACpD,MAAM;QACN,KAAK;QACL,KAAK;QACL,EAAE;QACF,gGAAgG;QAChG,EAAE;QACF,OAAO;QACP,iBAAiB;QACjB,6CAA6C;QAC7C,wBAAwB;QACxB,wCAAwC;QACxC,+FAA+F;QAC/F,KAAK;QACL,KAAK;QACL,EAAE;QACF,mdAAmd;QACnd,EAAE;QACF,mZAAmZ;QACnZ,EAAE;QACF,igBAAigB;QACjgB,EAAE;QACF,yBAAyB;QACzB,EAAE;QACF,2aAA2a;QAC3a,EAAE;QACF,8BAA8B;QAC9B,EAAE;QACF,8CAA8C;QAC9C,EAAE;QACF,QAAQ;QACR,gEAAgE;QAChE,EAAE;QACF,qFAAqF;QACrF,KAAK;QACL,EAAE;QACF,oMAAoM;QACpM,EAAE;QACF,4SAA4S;QAC5S,EAAE;QACF,0OAA0O;QAC1O,EAAE;QACF,iKAAiK;QACjK,EAAE;QACF,QAAQ;QACR,eAAe;QACf,EAAE;QACF,8CAA8C;QAC9C,8DAA8D;QAC9D,0EAA0E;QAC1E,EAAE;QACF,+HAA+H;QAC/H,2CAA2C;QAC3C,oEAAoE;QACpE,gDAAgD;QAChD,mBAAmB;QACnB,6BAA6B;QAC7B,mCAAmC;QACnC,mEAAmE;QACnE,SAAS;QACT,OAAO;QACP,kEAAkE;QAClE,kDAAkD;QAClD,kCAAkC;QAClC,yEAAyE;QACzE,SAAS;QACT,MAAM;QACN,EAAE;QACF,YAAY;QACZ,uDAAuD;QACvD,oCAAoC;QACpC,6DAA6D;QAC7D,iDAAiD;QACjD,8EAA8E;QAC9E,sDAAsD;QACtD,yCAAyC;QACzC,wBAAwB;QACxB,+EAA+E;QAC/E,uEAAuE;QACvE,6EAA6E;QAC7E,gEAAgE;QAChE,uEAAuE;QACvE,0BAA0B;QAC1B,2BAA2B;QAC3B,oEAAoE;QACpE,6FAA6F;QAC7F,qBAAqB;QACrB,6BAA6B;QAC7B,6BAA6B;QAC7B,2BAA2B;QAC3B,oEAAoE;QACpE,8FAA8F;QAC9F,qBAAqB;QACrB,mCAAmC;QACnC,6BAA6B;QAC7B,4BAA4B;QAC5B,kBAAkB;QAClB,eAAe;QACf,uDAAuD;QACvD,0CAA0C;QAC1C,wBAAwB;QACxB,+EAA+E;QAC/E,4CAA4C;QAC5C,gFAAgF;QAChF,2BAA2B;QAC3B,qEAAqE;QACrE,+FAA+F;QAC/F,qBAAqB;QACrB,oCAAoC;QACpC,6BAA6B;QAC7B,4BAA4B;QAC5B,kBAAkB;QAClB,eAAe;QACf,qDAAqD;QACrD,wBAAwB;QACxB,kFAAkF;QAClF,+DAA+D;QAC/D,wBAAwB;QACxB,kBAAkB;QAClB,eAAe;QACf,8CAA8C;QAC9C,wBAAwB;QACxB,gCAAgC;QAChC,oEAAoE;QACpE,mCAAmC;QACnC,oCAAoC;QACpC,yCAAyC;QACzC,oBAAoB;QACpB,kBAAkB;QAClB,eAAe;QACf,uEAAuE;QACvE,eAAe;QACf,oBAAoB;QACpB,WAAW;QACX,4DAA4D;QAC5D,aAAa;QACb,gCAAgC;QAChC,mCAAmC;QACnC,yCAAyC;QACzC,iCAAiC;QACjC,yBAAyB;QACzB,gDAAgD;QAChD,YAAY;QACZ,SAAS;QACT,gBAAgB;QAChB,gCAAgC;QAChC,yBAAyB;QACzB,qEAAqE;QACrE,YAAY;QACZ,mBAAmB;QACnB,8EAA8E;QAC9E,eAAe;QACf,+CAA+C;QAC/C,YAAY;QACZ,eAAe;QACf,gBAAgB;QAChB,MAAM;QACN,GAAG;QACH,KAAK;QACL,EAAE;QACF,oSAAoS;QACpS,EAAE;QACF,gNAAgN;QAChN,EAAE;QACF,QAAQ;QACR,mBAAmB;QACnB,sBAAsB;QACtB,0BAA0B;QAC1B,6DAA6D;QAC7D,OAAO;QACP,kBAAkB;QAClB,qBAAqB;QACrB,MAAM;QACN,+BAA+B;QAC/B,KAAK;QACL,EAAE;QACF,uHAAuH;QACvH,EAAE;QACF,6uBAA6uB;QAC7uB,EAAE;QACF,ynBAAynB;QACznB,EAAE;QACF,iMAAiM;QACjM,EAAE;QACF,OAAO;QACP,uEAAuE;QACvE,EAAE;QACF,2CAA2C;QAC3C,8CAA8C;QAC9C,2BAA2B;QAC3B,iCAAiC;QACjC,iEAAiE;QACjE,OAAO;QACP,KAAK;QACL,EAAE;QACF,gCAAgC;QAChC,uEAAuE;QACvE,8EAA8E;QAC9E,KAAK;QACL,EAAE;QACF,+FAA+F;QAC/F,sCAAsC;QACtC,gCAAgC;QAChC,wBAAwB;QACxB,2CAA2C;QAC3C,yCAAyC;QACzC,kFAAkF;QAClF,yCAAyC;QACzC,SAAS;QACT,mFAAmF;QACnF,qFAAqF;QACrF,SAAS;QACT,wCAAwC;QACxC,wEAAwE;QACxE,SAAS;QACT,OAAO;QACP,KAAK;QACL,KAAK;QACL,EAAE;QACF,mEAAmE;QACnE,gBAAgB;QAChB,oDAAoD;QACpD,sCAAsC;QACtC,yFAAyF;QACzF,sCAAsC;QACtC,oDAAoD;QACpD,GAAG;QACH,oFAAoF;QACpF,KAAK;QACL,EAAE;QACF,keAAke;QACle,EAAE;QACF,+qBAA+qB;QAC/qB,EAAE;QACF,OAAO;QACP,4DAA4D;QAC5D,0CAA0C;QAC1C,IAAI;QACJ,+EAA+E;QAC/E,EAAE;QACF,kCAAkC;QAClC,yCAAyC;QACzC,gFAAgF;QAChF,KAAK;QACL,2CAA2C;QAC3C,wGAAwG;QACxG,qCAAqC;QACrC,KAAK;QACL,oEAAoE;QACpE,KAAK;QACL,KAAK;QACL,EAAE;QACF,sqBAAsqB;QACtqB,EAAE;QACF,sgDAAsgD;QACtgD,EAAE;QACF,iCAAiC;QACjC,EAAE;QACF,iGAAiG;QACjG,EAAE;QACF,OAAO;QACP,uCAAuC;QACvC,iFAAiF;QACjF,KAAK;QACL,EAAE;QACF,yaAAya;QACza,EAAE;QACF,6SAA6S;QAC7S,EAAE;QACF,0YAA0Y;QAC1Y,EAAE;QACF,mQAAmQ;QACnQ,EAAE;QACF,2BAA2B;QAC3B,EAAE;QACF,mDAAmD;QACnD,4QAA4Q;QAC5Q,mKAAmK;QACnK,EAAE;QACF,wBAAwB;QACxB,EAAE;QACF,8CAA8C;QAC9C,2EAA2E;QAC3E,oFAAoF;QACpF,+QAA+Q;QAC/Q,mKAAmK;QACnK,oHAAoH;QACpH,2DAA2D;QAC3D,qFAAqF;QACrF,6LAA6L;QAC7L,EAAE;QACF,0CAA0C;QAC1C,EAAE;QACF,+BAA+B;QAC/B,qBAAqB;QACrB,ySAAyS;QACzS,4eAA4e;QAC5e,6NAA6N;QAC7N,iMAAiM;QACjM,gKAAgK;QAChK,iKAAiK;QACjK,wKAAwK;QACxK,+LAA+L;QAC/L,oOAAoO;QACpO,8RAA8R;QAC9R,0NAA0N;QAC1N,wPAAwP;QACxP,+KAA+K;QAC/K,uRAAuR;QACvR,gNAAgN;QAChN,4JAA4J;QAC5J,yHAAyH;QACzH,oOAAoO;QACpO,mRAAmR;QACnR,mMAAmM;QACnM,6LAA6L;QAC7L,gbAAgb;QAChb,iPAAiP;KAClP,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/node_modules/@noodle-borg/auth/dist/claims.d.ts

@@ -0,0 +1,22 @@
+import type { JWTPayload } from 'jose';
+export declare const MAX_AUTHORIZATION_CLAIM_VALUES = 128;
+export declare const MAX_SCOPE_LENGTH = 512;
+export declare const MAX_ROLE_LENGTH = 200;
+export interface AuthorizationClaimMap {
+    readonly roles?: string;
+    readonly scopes?: string;
+}
+type AuthorizationClaimKind = 'role' | 'scope';
+/**
+ * Project one explicitly configured nested claim into a bounded canonical set. A malformed value fails
+ * closed as an empty set; mixed arrays are never partially accepted.
+ */
+export declare function projectMappedAuthorizationClaim(payload: Readonly<Record<string, unknown>>, path: string | undefined, kind: AuthorizationClaimKind): readonly string[];
+/** Project the Noodle-owned private role claim used by customer-auth bridge access tokens. */
+export declare function projectNoodleRoles(payload: Readonly<Record<string, unknown>>): readonly string[];
+/** Project standard OAuth scope claims (`scope`, `scp`, then `scopes`) into one canonical set. */
+export declare function projectStandardScopes(payload: JWTPayload): readonly string[];
+/** Canonicalize an already selected claim value at a trusted non-JWT boundary. */
+export declare function canonicalizeAuthorizationClaimValues(raw: unknown, kind: AuthorizationClaimKind): readonly string[];
+export {};
+//# sourceMappingURL=claims.d.ts.map

package/node_modules/@noodle-borg/auth/dist/claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../src/claims.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAEvC,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAClD,eAAO,MAAM,gBAAgB,MAAM,CAAC;AACpC,eAAO,MAAM,eAAe,MAAM,CAAC;AAEnC,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,KAAK,sBAAsB,GAAG,MAAM,GAAG,OAAO,CAAC;AAE/C;;;GAGG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC1C,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE,sBAAsB,GAC3B,SAAS,MAAM,EAAE,CAGnB;AAED,8FAA8F;AAC9F,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,MAAM,EAAE,CAEhG;AAED,kGAAkG;AAClG,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,MAAM,EAAE,CAO5E;AAED,kFAAkF;AAClF,wBAAgB,oCAAoC,CAClD,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,sBAAsB,GAC3B,SAAS,MAAM,EAAE,CAEnB"}

package/node_modules/@noodle-borg/auth/dist/claims.js

@@ -0,0 +1,70 @@
+export const MAX_AUTHORIZATION_CLAIM_VALUES = 128;
+export const MAX_SCOPE_LENGTH = 512;
+export const MAX_ROLE_LENGTH = 200;
+/**
+ * Project one explicitly configured nested claim into a bounded canonical set. A malformed value fails
+ * closed as an empty set; mixed arrays are never partially accepted.
+ */
+export function projectMappedAuthorizationClaim(payload, path, kind) {
+    if (path === undefined)
+        return [];
+    return canonicalAuthorizationClaimValues(resolveClaimPath(payload, path), kind, kind === 'scope');
+}
+/** Project the Noodle-owned private role claim used by customer-auth bridge access tokens. */
+export function projectNoodleRoles(payload) {
+    return canonicalAuthorizationClaimValues(payload.noodle_roles, 'role', false);
+}
+/** Project standard OAuth scope claims (`scope`, `scp`, then `scopes`) into one canonical set. */
+export function projectStandardScopes(payload) {
+    const claims = payload;
+    return canonicalAuthorizationClaimValues(claims.scope ?? claims.scp ?? claims.scopes, 'scope', true);
+}
+/** Canonicalize an already selected claim value at a trusted non-JWT boundary. */
+export function canonicalizeAuthorizationClaimValues(raw, kind) {
+    return canonicalAuthorizationClaimValues(raw, kind, false);
+}
+function resolveClaimPath(payload, path) {
+    const segments = path.split('.');
+    if (segments.some((segment) => segment.length === 0))
+        return undefined;
+    let value = payload;
+    for (const segment of segments) {
+        if (!isRecord(value) || !Object.hasOwn(value, segment))
+            return undefined;
+        value = value[segment];
+    }
+    return value;
+}
+function canonicalAuthorizationClaimValues(raw, kind, splitScopeString) {
+    const values = typeof raw === 'string'
+        ? splitScopeString && kind === 'scope'
+            ? raw.split(' ').filter((value) => value.length > 0)
+            : [raw]
+        : Array.isArray(raw) && raw.every((value) => typeof value === 'string')
+            ? raw
+            : undefined;
+    if (values === undefined || values.length > MAX_AUTHORIZATION_CLAIM_VALUES)
+        return [];
+    const canonical = new Set();
+    for (const value of values) {
+        const normalized = value.trim();
+        if (!isValidAuthorizationClaim(normalized, kind))
+            return [];
+        canonical.add(normalized);
+    }
+    return [...canonical].sort();
+}
+function isValidAuthorizationClaim(value, kind) {
+    if (value.length === 0)
+        return false;
+    if (kind === 'scope') {
+        return (value.length <= MAX_SCOPE_LENGTH &&
+            // RFC 6749 scope-token = %x21 / %x23-5B / %x5D-7E.
+            /^[\x21\x23-\x5B\x5D-\x7E]+$/.test(value));
+    }
+    return value.length <= MAX_ROLE_LENGTH && !/\p{Cc}/u.test(value);
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=claims.js.map

package/node_modules/@noodle-borg/auth/dist/claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.js","sourceRoot":"","sources":["../src/claims.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAClD,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AACpC,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAC;AASnC;;;GAGG;AACH,MAAM,UAAU,+BAA+B,CAC7C,OAA0C,EAC1C,IAAwB,EACxB,IAA4B;IAE5B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAClC,OAAO,iCAAiC,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC;AACpG,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,kBAAkB,CAAC,OAA0C;IAC3E,OAAO,iCAAiC,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,qBAAqB,CAAC,OAAmB;IACvD,MAAM,MAAM,GAAG,OAA4C,CAAC;IAC5D,OAAO,iCAAiC,CACtC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,MAAM,EAC3C,OAAO,EACP,IAAI,CACL,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,oCAAoC,CAClD,GAAY,EACZ,IAA4B;IAE5B,OAAO,iCAAiC,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,gBAAgB,CAAC,OAA0C,EAAE,IAAY;IAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACvE,IAAI,KAAK,GAAY,OAAO,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QACzE,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iCAAiC,CACxC,GAAY,EACZ,IAA4B,EAC5B,gBAAyB;IAEzB,MAAM,MAAM,GACV,OAAO,GAAG,KAAK,QAAQ;QACrB,CAAC,CAAC,gBAAgB,IAAI,IAAI,KAAK,OAAO;YACpC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC,GAAG,CAAC;QACT,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;YACtF,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,SAAS,CAAC;IAClB,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,8BAA8B;QAAE,OAAO,EAAE,CAAC;IAEtF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,yBAAyB,CAAC,UAAU,EAAE,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QAC5D,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAa,EAAE,IAA4B;IAC5E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,OAAO,CACL,KAAK,CAAC,MAAM,IAAI,gBAAgB;YAChC,mDAAmD;YACnD,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,CAC1C,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,IAAI,eAAe,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/node_modules/@noodle-borg/auth/dist/index.d.ts

@@ -7,6 +7,7 @@
  * Express-typed `OAuthServerProvider` shell and Google-federation routes live in `packages/service` so this
  * package stays Express-free.
  */
+export { type AuthorizationClaimMap, canonicalizeAuthorizationClaimValues, MAX_AUTHORIZATION_CLAIM_VALUES, MAX_ROLE_LENGTH, MAX_SCOPE_LENGTH, projectMappedAuthorizationClaim, projectNoodleRoles, projectStandardScopes, } from './claims.js';
 export { type DiscoveredIssuerMetadata, discoverIssuerMetadata, type IssuerMetadataCandidate, type IssuerMetadataKind, issuerMetadataCandidates, } from './discovery.js';
 export { type AccessTokenClaims, mintAccessToken } from './jwt-issuer.js';
 export { type ProtectedResourceMetadata, protectedResourceMetadata, protectedResourceMetadataUrl, } from './metadata.js';

package/node_modules/@noodle-borg/auth/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,KAAK,wBAAwB,EAC7B,sBAAsB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,KAAK,iBAAiB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC1E,OAAO,EACL,KAAK,yBAAyB,EAC9B,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,8BAA8B,EAC9B,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,GAC7B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,iBAAiB,EACjB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,KAAK,qBAAqB,EAC1B,oCAAoC,EACpC,8BAA8B,EAC9B,eAAe,EACf,gBAAgB,EAChB,+BAA+B,EAC/B,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,KAAK,wBAAwB,EAC7B,sBAAsB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,KAAK,iBAAiB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC1E,OAAO,EACL,KAAK,yBAAyB,EAC9B,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,8BAA8B,EAC9B,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,GAC7B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,iBAAiB,EACjB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC"}

package/node_modules/@noodle-borg/auth/dist/index.js

@@ -7,6 +7,7 @@
  * Express-typed `OAuthServerProvider` shell and Google-federation routes live in `packages/service` so this
  * package stays Express-free.
  */
+export { canonicalizeAuthorizationClaimValues, MAX_AUTHORIZATION_CLAIM_VALUES, MAX_ROLE_LENGTH, MAX_SCOPE_LENGTH, projectMappedAuthorizationClaim, projectNoodleRoles, projectStandardScopes, } from './claims.js';
 export { discoverIssuerMetadata, issuerMetadataCandidates, } from './discovery.js';
 export { mintAccessToken } from './jwt-issuer.js';
 export { protectedResourceMetadata, protectedResourceMetadataUrl, } from './metadata.js';

package/node_modules/@noodle-borg/auth/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAEL,sBAAsB,EAGtB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAA0B,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC1E,OAAO,EAEL,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,8BAA8B,GAI/B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,iBAAiB,GAIlB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAEL,oCAAoC,EACpC,8BAA8B,EAC9B,eAAe,EACf,gBAAgB,EAChB,+BAA+B,EAC/B,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EAEL,sBAAsB,EAGtB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAA0B,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC1E,OAAO,EAEL,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,8BAA8B,GAI/B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,iBAAiB,GAIlB,MAAM,aAAa,CAAC"}

package/node_modules/@noodle-borg/auth/dist/jwt-issuer.d.ts

@@ -14,6 +14,8 @@ export interface AccessTokenClaims {
     readonly timeZone?: string;
     /** Space-delimited scopes, when any. */
     readonly scope?: string;
+    /** Canonical customer roles verified by a configured bridge claim mapping. */
+    readonly roles?: readonly string[];
     /** Verified upstream authentication event time as a JWT NumericDate in integer seconds. */
     readonly authTime?: number;
     /** Boundary represented by the token. Absent means the normal Noodle platform identity boundary. */

package/node_modules/@noodle-borg/auth/dist/jwt-issuer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-issuer.d.ts","sourceRoot":"","sources":["../src/jwt-issuer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,WAAW,iBAAiB;IAChC,0FAA0F;IAC1F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qGAAqG;IACrG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sCAAsC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,wCAAwC;IACxC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,2FAA2F;IAC3F,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,oGAAoG;IACpG,QAAQ,CAAC,YAAY,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IAChD,mGAAmG;IACnG,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,gGAAgG;IAChG,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,mDAAmD;IACnD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,kBAAkB,EAC5B,MAAM,EAAE,iBAAiB,EACzB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAuBjB"}
+{"version":3,"file":"jwt-issuer.d.ts","sourceRoot":"","sources":["../src/jwt-issuer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,WAAW,iBAAiB;IAChC,0FAA0F;IAC1F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qGAAqG;IACrG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sCAAsC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,wCAAwC;IACxC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,2FAA2F;IAC3F,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,oGAAoG;IACpG,QAAQ,CAAC,YAAY,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IAChD,mGAAmG;IACnG,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,gGAAgG;IAChG,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,mDAAmD;IACnD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,kBAAkB,EAC5B,MAAM,EAAE,iBAAiB,EACzB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAwBjB"}

package/node_modules/@noodle-borg/auth/dist/jwt-issuer.js

@@ -13,6 +13,7 @@ export async function mintAccessToken(provider, claims, ttlSeconds) {
         ...(claims.locale !== undefined ? { locale: claims.locale } : {}),
         ...(claims.timeZone !== undefined ? { zoneinfo: claims.timeZone } : {}),
         ...(claims.scope !== undefined ? { scope: claims.scope } : {}),
+        ...(claims.roles !== undefined ? { noodle_roles: [...claims.roles] } : {}),
         ...(claims.authTime !== undefined ? { auth_time: claims.authTime } : {}),
         ...(claims.identityKind !== undefined ? { noodle_identity: claims.identityKind } : {}),
         ...(claims.identityProvider !== undefined

package/node_modules/@noodle-borg/auth/dist/jwt-issuer.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-issuer.js","sourceRoot":"","sources":["../src/jwt-issuer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AA8B/B;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAA4B,EAC5B,MAAyB,EACzB,UAAkB;IAElB,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC;QACtB,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS;YACvC,CAAC,CAAC,EAAE,wBAAwB,EAAE,MAAM,CAAC,gBAAgB,EAAE;YACvD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnF,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;SACjE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;SACxB,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;SAC1B,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC;SAC5B,WAAW,EAAE;SACb,MAAM,CAAC,UAAU,EAAE,CAAC;SACpB,iBAAiB,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AAClC,CAAC"}
+{"version":3,"file":"jwt-issuer.js","sourceRoot":"","sources":["../src/jwt-issuer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAgC/B;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAA4B,EAC5B,MAAyB,EACzB,UAAkB;IAElB,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC;QACtB,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS;YACvC,CAAC,CAAC,EAAE,wBAAwB,EAAE,MAAM,CAAC,gBAAgB,EAAE;YACvD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnF,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;SACjE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;SACxB,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;SAC1B,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC;SAC5B,WAAW,EAAE;SACb,MAAM,CAAC,UAAU,EAAE,CAAC;SACpB,iBAAiB,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AAClC,CAAC"}

package/node_modules/@noodle-borg/auth/dist/metadata.d.ts

@@ -11,11 +11,14 @@ export interface ProtectedResourceMetadata {
     readonly authorization_servers?: readonly string[];
     /** How the bearer token may be presented. Noodle accepts the `Authorization` header only. */
     readonly bearer_methods_supported?: readonly string[];
+    /** Deterministic union of OAuth scopes used by protected operations on this resource. */
+    readonly scopes_supported?: readonly string[];
 }
 /** Build the protected-resource-metadata document for one resource. */
 export declare function protectedResourceMetadata(input: {
     readonly resource: string;
     readonly authorizationServers?: readonly string[];
+    readonly scopesSupported?: readonly string[];
 }): ProtectedResourceMetadata;
 /**
  * Construct the RFC 9728 protected-resource-metadata URL for a resource URL: the well-known prefix is