@noodleseed/one 0.94.0 → 0.95.1

package/node_modules/@noodle-borg/agent-kit/dist/curated/error-fixes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error-fixes.d.ts","sourceRoot":"","sources":["../../src/curated/error-fixes.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAmH9C,CAAC"}
+{"version":3,"file":"error-fixes.d.ts","sourceRoot":"","sources":["../../src/curated/error-fixes.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAqH9C,CAAC"}

package/node_modules/@noodle-borg/agent-kit/dist/curated/error-fixes.js

@@ -60,10 +60,11 @@ export const ERROR_FIXES = {
     customer_endpoint_mapping_required: 'Add the endpoint key at the cited auth routing path; every direct/federated issuer must map every customer endpoint used by the app.',
     customer_endpoint_unknown_mapping: 'Remove the unknown or unused auth routing key, or use that exact declared `customerEndpoint` key from a reachable connector operation.',
     customer_endpoint_bridge_unsupported: 'Replace the Firebase/Microsoft bridge with direct or federated OIDC before using auth-derived customer connector endpoints.',
-    customer_endpoint_action_unsupported: 'Use a read operation for this customer-routed call until route-bound action confirmation support is available.',
+    customer_endpoint_action_unsupported: 'Set exact `annotations.confirm: true` on the enclosing tool, or keep the customer-routed operation read-only; action hints alone do not enable confirmation.',
     customer_endpoint_surface_unsupported: 'Move the customer-routed call into a tool fulfilment; routed resources, prompts, and ambient providers are unsupported.',
     customer_endpoint_credential_source_unsupported: 'Remove the manifest connection binding; a customer-routed connector uses its declared delegated token exchange auth or no auth.',
     customer_endpoint_policy_conflict: 'Give every reachable declaration of this endpoint key one identical policy, or rename keys whose allowed origins differ.',
+    customer_endpoint_routing_inconsistent: 'Regenerate the connector catalog so every action route includes all of its ordinary customer endpoint dependencies.',
     unused_connector_alias: 'A declared connector alias is never called; remove the unused `use` entry or wire it into a tool.',
     arg_mismatch: 'A connector call is missing or adds arguments; match the operation signature under `expected`/`got`.',
 };

package/node_modules/@noodle-borg/agent-kit/dist/curated/error-fixes.js.map

@@ -1 +1 @@
-{"version":3,"file":"error-fixes.js","sourceRoot":"","sources":["../../src/curated/error-fixes.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,EAAE;AACF,uFAAuF;AACvF,yFAAyF;AACzF,0DAA0D;AAC1D,0FAA0F;AAC1F,6FAA6F;AAE7F,MAAM,CAAC,MAAM,WAAW,GAA2B;IACjD,gBAAgB,EACd,+HAA+H;IACjI,aAAa,EACX,8HAA8H;IAChI,YAAY,EACV,gHAAgH;IAClH,aAAa,EACX,4IAA4I;IAC9I,wBAAwB,EACtB,2GAA2G;IAC7G,cAAc,EAAE,iFAAiF;IACjG,4BAA4B,EAC1B,oGAAoG;IACtG,2BAA2B,EACzB,kOAAkO;IACpO,qBAAqB,EACnB,4GAA4G;IAC9G,YAAY,EACV,2HAA2H;IAC7H,kBAAkB,EAChB,mGAAmG;IACrG,kBAAkB,EAChB,kHAAkH;IACpH,mBAAmB,EACjB,6FAA6F;IAC/F,kBAAkB,EAAE,kEAAkE;IACtF,iBAAiB,EACf,0GAA0G;IAC5G,qBAAqB,EACnB,4GAA4G;IAC9G,yBAAyB,EACvB,kHAAkH;IACpH,mBAAmB,EACjB,+FAA+F;IACjG,gBAAgB,EACd,0FAA0F;IAC5F,gBAAgB,EACd,gGAAgG;IAClG,aAAa,EAAE,8DAA8D;IAC7E,iBAAiB,EACf,uHAAuH;IACzH,kBAAkB,EAChB,oLAAoL;IACtL,0BAA0B,EACxB,mLAAmL;IACrL,wBAAwB,EACtB,uIAAuI;IACzI,yBAAyB,EACvB,kJAAkJ;IACpJ,iBAAiB,EACf,4GAA4G;IAC9G,sBAAsB,EACpB,kJAAkJ;IACpJ,kBAAkB,EAAE,2EAA2E;IAC/F,gBAAgB,EAAE,qDAAqD;IACvE,sBAAsB,EAAE,uEAAuE;IAC/F,wBAAwB,EACtB,wEAAwE;IAC1E,gBAAgB,EACd,2FAA2F;IAC7F,mBAAmB,EACjB,8GAA8G;IAChH,0BAA0B,EACxB,8FAA8F;IAChG,qBAAqB,EACnB,6EAA6E;IAC/E,sBAAsB,EACpB,oGAAoG;IACtG,2BAA2B,EACzB,mIAAmI;IACrI,qBAAqB,EACnB,mKAAmK;IACrK,2BAA2B,EACzB,mJAAmJ;IACrJ,aAAa,EACX,yFAAyF;IAC3F,8BAA8B,EAC5B,8EAA8E;IAChF,kBAAkB,EAChB,oHAAoH;IACtH,uBAAuB,EACrB,iHAAiH;IACnH,wBAAwB,EACtB,qHAAqH;IACvH,iBAAiB,EACf,oHAAoH;IACtH,0BAA0B,EACxB,wIAAwI;IAC1I,8BAA8B,EAC5B,wJAAwJ;IAC1J,yBAAyB,EACvB,8IAA8I;IAChJ,4BAA4B,EAC1B,uIAAuI;IACzI,+BAA+B,EAC7B,iIAAiI;IACnI,kCAAkC,EAChC,sIAAsI;IACxI,iCAAiC,EAC/B,wIAAwI;IAC1I,oCAAoC,EAClC,6HAA6H;IAC/H,oCAAoC,EAClC,gHAAgH;IAClH,qCAAqC,EACnC,yHAAyH;IAC3H,+CAA+C,EAC7C,iIAAiI;IACnI,iCAAiC,EAC/B,0HAA0H;IAC5H,sBAAsB,EACpB,mGAAmG;IACrG,YAAY,EACV,sGAAsG;CACzG,CAAC"}
+{"version":3,"file":"error-fixes.js","sourceRoot":"","sources":["../../src/curated/error-fixes.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,EAAE;AACF,uFAAuF;AACvF,yFAAyF;AACzF,0DAA0D;AAC1D,0FAA0F;AAC1F,6FAA6F;AAE7F,MAAM,CAAC,MAAM,WAAW,GAA2B;IACjD,gBAAgB,EACd,+HAA+H;IACjI,aAAa,EACX,8HAA8H;IAChI,YAAY,EACV,gHAAgH;IAClH,aAAa,EACX,4IAA4I;IAC9I,wBAAwB,EACtB,2GAA2G;IAC7G,cAAc,EAAE,iFAAiF;IACjG,4BAA4B,EAC1B,oGAAoG;IACtG,2BAA2B,EACzB,kOAAkO;IACpO,qBAAqB,EACnB,4GAA4G;IAC9G,YAAY,EACV,2HAA2H;IAC7H,kBAAkB,EAChB,mGAAmG;IACrG,kBAAkB,EAChB,kHAAkH;IACpH,mBAAmB,EACjB,6FAA6F;IAC/F,kBAAkB,EAAE,kEAAkE;IACtF,iBAAiB,EACf,0GAA0G;IAC5G,qBAAqB,EACnB,4GAA4G;IAC9G,yBAAyB,EACvB,kHAAkH;IACpH,mBAAmB,EACjB,+FAA+F;IACjG,gBAAgB,EACd,0FAA0F;IAC5F,gBAAgB,EACd,gGAAgG;IAClG,aAAa,EAAE,8DAA8D;IAC7E,iBAAiB,EACf,uHAAuH;IACzH,kBAAkB,EAChB,oLAAoL;IACtL,0BAA0B,EACxB,mLAAmL;IACrL,wBAAwB,EACtB,uIAAuI;IACzI,yBAAyB,EACvB,kJAAkJ;IACpJ,iBAAiB,EACf,4GAA4G;IAC9G,sBAAsB,EACpB,kJAAkJ;IACpJ,kBAAkB,EAAE,2EAA2E;IAC/F,gBAAgB,EAAE,qDAAqD;IACvE,sBAAsB,EAAE,uEAAuE;IAC/F,wBAAwB,EACtB,wEAAwE;IAC1E,gBAAgB,EACd,2FAA2F;IAC7F,mBAAmB,EACjB,8GAA8G;IAChH,0BAA0B,EACxB,8FAA8F;IAChG,qBAAqB,EACnB,6EAA6E;IAC/E,sBAAsB,EACpB,oGAAoG;IACtG,2BAA2B,EACzB,mIAAmI;IACrI,qBAAqB,EACnB,mKAAmK;IACrK,2BAA2B,EACzB,mJAAmJ;IACrJ,aAAa,EACX,yFAAyF;IAC3F,8BAA8B,EAC5B,8EAA8E;IAChF,kBAAkB,EAChB,oHAAoH;IACtH,uBAAuB,EACrB,iHAAiH;IACnH,wBAAwB,EACtB,qHAAqH;IACvH,iBAAiB,EACf,oHAAoH;IACtH,0BAA0B,EACxB,wIAAwI;IAC1I,8BAA8B,EAC5B,wJAAwJ;IAC1J,yBAAyB,EACvB,8IAA8I;IAChJ,4BAA4B,EAC1B,uIAAuI;IACzI,+BAA+B,EAC7B,iIAAiI;IACnI,kCAAkC,EAChC,sIAAsI;IACxI,iCAAiC,EAC/B,wIAAwI;IAC1I,oCAAoC,EAClC,6HAA6H;IAC/H,oCAAoC,EAClC,8JAA8J;IAChK,qCAAqC,EACnC,yHAAyH;IAC3H,+CAA+C,EAC7C,iIAAiI;IACnI,iCAAiC,EAC/B,0HAA0H;IAC5H,sCAAsC,EACpC,qHAAqH;IACvH,sBAAsB,EACpB,mGAAmG;IACrG,YAAY,EACV,sGAAsG;CACzG,CAAC"}

package/node_modules/@noodle-borg/agent-kit/dist/generated/example-files.js

@@ -49,11 +49,11 @@ export const BUNDLED_EXAMPLE_FILES = [
     { relPath: "examples/acme-tasks/src/views/widget-style.css", content: ":root {\n  color-scheme: light dark;\n  font-family:\n    Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif;\n  --nw-bg: #ffffff;\n  --nw-surface: #f7f5ff;\n  --nw-text: #1c1830;\n  --nw-muted: #635d80;\n  --nw-border: #e2ddf5;\n  --nw-accent: #7c3aed;\n  --nw-accent-strong: #6d28d9;\n  --nw-accent-soft: #efe9ff;\n  --nw-high: #dc2626;\n  --nw-medium: #b45309;\n  --nw-low: #2563eb;\n  --nw-radius: 10px;\n  --nw-shadow: 0 18px 50px rgb(30 20 60 / 12%);\n}\n\n.dark,\n[data-theme=\"dark\"] {\n  --nw-bg: #161228;\n  --nw-surface: #1d1735;\n  --nw-text: #f2eeff;\n  --nw-muted: #a99fce;\n  --nw-border: #342a54;\n  --nw-accent: #a78bfa;\n  --nw-accent-strong: #8b5cf6;\n  --nw-accent-soft: #2a2148;\n  --nw-high: #f87171;\n  --nw-medium: #fbbf24;\n  --nw-low: #60a5fa;\n  --nw-shadow: 0 18px 50px rgb(0 0 0 / 32%);\n}\n\n* {\n  box-sizing: border-box;\n}\n\nbody {\n  margin: 0;\n  background: var(--nw-bg);\n  color: var(--nw-text);\n}\n\nbutton,\ninput,\nselect {\n  font: inherit;\n}\n\n.nw-shell {\n  min-height: 100vh;\n  padding: 14px;\n  background: var(--nw-bg);\n  color: var(--nw-text);\n}\n\n.nw-card {\n  max-width: 620px;\n  margin: 0 auto;\n  background: var(--nw-surface);\n  border: 1px solid var(--nw-border);\n  border-radius: var(--nw-radius);\n  box-shadow: var(--nw-shadow);\n  overflow: hidden;\n}\n\n.nw-header {\n  display: flex;\n  align-items: center;\n  gap: 12px;\n  padding: 16px;\n  border-bottom: 1px solid var(--nw-border);\n}\n\n.nw-icon svg {\n  width: 24px;\n  height: 24px;\n  fill: none;\n  stroke: var(--nw-accent);\n  stroke-width: 2;\n  stroke-linecap: round;\n  stroke-linejoin: round;\n}\n\n.nw-title-block {\n  flex: 1;\n  min-width: 0;\n}\n\n.nw-title {\n  margin: 0;\n  font-size: 17px;\n  font-weight: 700;\n}\n\n.nw-subtitle {\n  margin: 2px 0 0;\n  font-size: 13px;\n  color: var(--nw-muted);\n}\n\n.nw-chip {\n  padding: 4px 10px;\n  border-radius: 999px;\n  background: var(--nw-accent-soft);\n  color: var(--nw-accent-strong);\n  font-size: 12px;\n  font-weight: 600;\n}\n\n.nw-capture {\n  display: flex;\n  gap: 8px;\n  padding: 14px 16px 4px;\n}\n\n.nw-input {\n  flex: 1;\n  padding: 9px 12px;\n  border: 1px solid var(--nw-border);\n  border-radius: 10px;\n  background: var(--nw-bg);\n  color: var(--nw-text);\n}\n\n.nw-button {\n  display: inline-flex;\n  align-items: center;\n  gap: 6px;\n  padding: 9px 14px;\n  border: 1px solid var(--nw-border);\n  border-radius: 10px;\n  background: var(--nw-bg);\n  color: var(--nw-text);\n  cursor: pointer;\n}\n\n.nw-button-primary {\n  background: var(--nw-accent);\n  border-color: var(--nw-accent);\n  color: #ffffff;\n  font-weight: 600;\n}\n\n.nw-button-primary:disabled {\n  opacity: 0.6;\n  cursor: default;\n}\n\n.nw-list {\n  list-style: none;\n  margin: 0;\n  padding: 8px 16px 4px;\n  display: flex;\n  flex-direction: column;\n  gap: 8px;\n}\n\n.nw-task {\n  display: flex;\n  align-items: center;\n  gap: 10px;\n  padding: 10px 12px;\n  border: 1px solid var(--nw-border);\n  border-radius: 12px;\n  background: var(--nw-bg);\n}\n\n.nw-task-title {\n  flex: 1;\n  min-width: 0;\n}\n\n.nw-task-done {\n  opacity: 0.55;\n}\n\n.nw-task-done .nw-task-title {\n  text-decoration: line-through;\n}\n\n.nw-check {\n  width: 22px;\n  height: 22px;\n  border: 1.5px solid var(--nw-border);\n  border-radius: 999px;\n  background: transparent;\n  color: #ffffff;\n  cursor: pointer;\n  flex: none;\n}\n\n.nw-check-on {\n  background: var(--nw-accent);\n  border-color: var(--nw-accent);\n}\n\n.nw-priority {\n  padding: 5px 8px;\n  border: 1px solid var(--nw-border);\n  border-radius: 8px;\n  background: var(--nw-bg);\n  color: var(--nw-text);\n  font-size: 12px;\n  font-weight: 600;\n}\n\n.nw-priority-high {\n  color: var(--nw-high);\n}\n\n.nw-priority-medium {\n  color: var(--nw-medium);\n}\n\n.nw-priority-low {\n  color: var(--nw-low);\n}\n\n.nw-note {\n  margin: 0;\n  padding: 8px 16px 16px;\n  font-size: 12px;\n  color: var(--nw-muted);\n}\n" },
     { relPath: "examples/acme-tasks/test/server.test.ts", content: "import { describe, expect, it } from 'vitest';\nimport app from '../src/server.js';\n\ndescribe('acme-tasks example', () => {\n  it('exports a Noodle server definition', () => {\n    expect(typeof app.toManifest).toBe('function');\n  });\n\n  it('exposes a tool for each of the top-3 prioritized flows', async () => {\n    // Capture → add_task, Prioritize → list_today (+ set_priority helper), Complete → complete_task.\n    const text = JSON.stringify(await app.toManifest());\n    expect(text).toContain('add_task');\n    expect(text).toContain('list_today');\n    expect(text).toContain('complete_task');\n    expect(text).toContain('set_priority');\n  });\n\n  it('seeds today’s list highest-priority first', async () => {\n    const text = JSON.stringify(await app.toManifest());\n    expect(text).toMatch(/\"tasks\":\\[\\{\"id\":\"email_vendor\".*\"priority\":\"high\"/);\n  });\n\n  it('opts the conversational completion action into runtime confirmation', async () => {\n    const manifest = await app.toManifest();\n    const completeTask = manifest.tools.find((candidate) => candidate.name === 'complete_task');\n    const addTask = manifest.tools.find((candidate) => candidate.name === 'add_task');\n\n    expect(completeTask?.annotations?.confirm).toBe(true);\n    expect(addTask?.annotations).not.toHaveProperty('confirm');\n  });\n});\n" },
     { relPath: "examples/acme-tasks/vitest.config.ts", content: "import { defineConfig } from 'vitest/config';\n\n// Local config so `npm test` (vitest run) discovers this example's own tests instead of inheriting a\n// parent monorepo config's include globs.\nexport default defineConfig({\n  test: { include: ['test/**/*.test.ts'] },\n});\n" },
-    { relPath: "examples/customer-auth/README.md", content: "# Customer Auth - OIDC identity and customer-routed APIs\n\nThis curated example owns the customer/end-user authentication capability slot. It proves that a SaaS app\ncan protect an MCP endpoint with direct OIDC, retain role/scope-based tool authorization, and route ordinary\nread-only connector calls to the API origin selected by the verified customer's identity provider.\n\nIt also owns the customer-branded embedded-assistant presentation showcase. Embedded sessions lack\ndirect/federated MCP OIDC endpoint claims, so these routed tools fail with `connector_route_unavailable`;\nstatic connectors still support embedded delegated exchange. Exercise routed tools through the MCP endpoint.\n\nThe public developer entrypoint is [`src/server.ts`](src/server.ts). It exposes a deliberately small MCP\nsurface for organization discovery:\n\n- `list_my_organizations` lists the NoodleSeed.com organizations the signed-in customer belongs to (no\n  arguments — the org set comes from the verified customer session).\n- `list_org_apps` lists apps for one of those organizations through that tenant's API. It is visible and\n  callable only when the verified customer has the `org_apps:read` scope and either the `org_admin` or\n  `org_member` role.\n\nThe two tools chain: `list_my_organizations` surfaces the `org_id`s the customer can act on, and\n`list_org_apps` takes one of those `org_id`s. Tool code remains independent of the selected origin.\n\n## Declare the customer endpoint\n\n`customerEndpoint` names one private routing authority and bounds the origins an IdP may select:\n\n```ts\nconst customerApi = customerEndpoint('customer_api', {\n  allowedHttpsHostSuffixes: ['api.noodleseed.dev'],\n});\n```\n\nUse either non-empty `allowedHttpsHostSuffixes` or non-empty `allowedHttpsOrigins`, never both. Exact-origin\npolicies may include a non-default port. Suffix policies match only the exact hostname or dot-boundary\nsubdomains on port 443. A routed connector must not add `allowedOrigins`; its endpoint policy is the egress\nallowlist.\n\nThe connector uses that declaration as its normal base URL. Its token endpoint remains a fixed, independently\nvalidated HTTPS URL:\n\n```ts\nconst api = connector('noodleseed_app_api')\n  .version('1.0.0')\n  .http({\n    baseUrl: customerApi,\n    auth: {\n      kind: 'delegatedTokenExchange',\n      tokenUrl: 'https://id.noodleseed.dev/oauth/token',\n      clientId: variable('CUSTOMER_API_CLIENT_ID'),\n      clientSecret: secret('CUSTOMER_API_CLIENT_SECRET'),\n      scopes: ['organizations:read', 'org_apps:read'],\n      audience: 'noodleseed-customer-api',\n    },\n    operations: {\n      // read operations...\n    },\n  });\n```\n\n## Map the endpoint from verified OIDC\n\nThe IdP claim contains the complete base URL, including an optional base path. Routing is separate from the\npublic `${user}` expression scope:\n\n```ts\nauth: customerAuth.oidc({\n  issuer: 'https://id.noodleseed.dev',\n  audience: 'https://org.cloud.noodleseed.dev/app/mcp',\n  claims: {\n    id: 'sub',\n    email: 'email',\n    name: 'name',\n    orgs: 'permissions.orgs',\n    roles: 'permissions.roles',\n    scopes: 'permissions.scopes',\n  },\n  routing: {\n    endpoints: {\n      customer_api: { claim: 'tenant.api_base_url' },\n    },\n  },\n}),\n```\n\nFor federated OIDC, put the same endpoint map on every issuer. Claim paths may differ, but each issuer must\nmap every endpoint the app uses:\n\n```ts\nauth: customerAuth.federatedOidc({\n  issuers: [\n    {\n      issuer: 'https://id.customer-a.com',\n      audience: 'https://org.cloud.noodleseed.dev/app/mcp',\n      routing: {\n        endpoints: {\n          customer_api: { claim: 'tenant.api_base_url' },\n        },\n      },\n    },\n    {\n      issuer: 'https://login.customer-b.com',\n      audience: 'https://org.cloud.noodleseed.dev/app/mcp',\n      routing: {\n        endpoints: {\n          customer_api: { claim: 'organization.routes.customer_api' },\n        },\n      },\n    },\n  ],\n}),\n```\n\nAt runtime, Noodle Seed validates both the configured audience and exact MCP resource, projects the route\ninto private request state, applies its policy, and freezes it for the call. Missing, malformed, or\ndisallowed claims return `connector_route_unavailable` before credential lookup or connector egress.\nResolved URLs never enter artifacts, `${user}`, logs, model output, widgets, confirmation review, broker cache\nkeys, or delegated exchange assertions.\n\nThis release permits routed reads in tools, including declared nested calls. Routed actions fail with\n`customer_endpoint_action_unsupported`; routed resources, prompts, and ambient context fail with\n`customer_endpoint_surface_unsupported`.\n\nThe application developer owns the direct/federated authorization server. It must publish its path-inserted\nRFC 8414 document as direct HTTP 200 JSON with exact issuer and HTTPS authorization/token/registration/JWKS\nendpoints, authorization-code and refresh grants, PKCE S256, public-client auth method `none`, RFC 8707\nresource handling, and public signing keys. Access tokens must include the exact MCP resource audience; there\nis no audience fallback.\n\nRun `noodle auth doctor src/server.ts` before sharing. Its bounded, read-only probes never register a client.\nAdding the embedded assistant does not choose or rewrite MCP customer auth.\n\n## Per-tool authorization remains independent\n\nThe mapped `roles` and `scopes` paths are read only after OIDC verification. The restricted tool declares its\nrule beside the rest of its public contract:\n\n```ts\ntool('list_org_apps', {\n  authorization: {\n    requiredScopes: ['org_apps:read'],\n    allowedRoles: ['org_admin', 'org_member'],\n  },\n  // input, output, and fulfilment...\n});\n```\n\nEvery required scope must be present and at least one allowed role must match. When both lists are declared,\nboth conditions apply. Route availability never changes `tools/list`: discovery remains based only on\nroles/scopes. A restricted tool is omitted for an ineligible customer and a guessed direct call still fails\nclosed.\n\nTool code calls the connector normally:\n\n```ts\nfulfil({ input, connectors }) {\n  const apps = connectors.app_api.listOrgApps({\n    org_id: input.org_id,\n    skip: input.skip,\n    limit: input.limit,\n  });\n\n  return { result: apps.result };\n}\n```\n\nThe broker exchanges a short-lived, platform-signed assertion at the fixed token endpoint and caches the\nresult by caller, connector, scopes, and a route fingerprint. The assertion carries only the route key and\nfingerprint, never the URL. The MCP access token is never forwarded to the customer API. The exchange wire\ncontract lives in [docs/spec/connectors.md](../../docs/spec/connectors.md).\n\nFirebase and Microsoft remain supported managed adapters; their provider-specific contracts and tests live\nin [docs/spec/auth-and-policy.md](../../docs/spec/auth-and-policy.md) and the SharePoint flagship.\n\n## Validate\n\n```bash\nnoodle auth doctor examples/customer-auth/src/server.ts\nnoodle validate examples/customer-auth/src/server.ts\n```\n\nAgainst a deployed customer-protected environment, set a short-lived real customer token only in\n`NOODLE_CUSTOMER_TOKEN` and add `--live --org <org> --app <app> --env <env>`. The live doctor performs\ncredential exchanges without invoking either business tool.\n\n## Run locally\n\n```bash\nnoodle dev examples/customer-auth/src/server.ts --app noodleseed-customer-auth\n```\n\n## Configuration\n\nThe embedded assistant uses a customer-supplied OpenAI Chat Completions-compatible endpoint. Configure its\nmanaged values at the Noodle deployment environment; none of these values belongs in the customer web\napplication environment, and the API key never reaches the browser:\n\nThe assistant session carries a verified user, tenant, deployment, roles, and scopes, but not the IdP's\n`tenant.api_base_url` claim. These routed operations are MCP-only; do not copy the route into page context,\nsession claims, tool input, or model instructions.\n\n```bash\nnoodle variables set ASSISTANT_MODEL_BASE_URL https://model.example.com/v1 --scope env\nnoodle variables set ASSISTANT_MODEL your-model --scope env\nnoodle secrets set ASSISTANT_MODEL_API_KEY --scope env\nnoodle variables set CUSTOMER_API_CLIENT_ID your-broker-client-id --scope env\nnoodle secrets set CUSTOMER_API_CLIENT_SECRET --scope env\nnoodle check --target embedded-assistant src/server.ts\n```\n\nAssistant origins are exact. Production embedding origins must use HTTPS; plain HTTP is accepted only for\nloopback development origins such as `http://localhost:3000`, `http://127.0.0.1:3000`, or\n`http://[::1]:3000`. `noodle dev` serves the MCP project, not that separate embedding application.\n\nThe bounded `presentation` object configures the panel, launcher, header, composer, and messages. Its\nprimitives derive colors from shared server `branding`; raw HTML, CSS, inline SVG, renderer classes, and\ncallbacks are not accepted.\n\nCreate the backend credential after deployment. The CLI writes it to a mode-0600 file and never prints the\nsecret:\n\n```bash\nnoodle assistant clients create --name web --org noodleseed --app customer-auth --env prod\n```\n\nOnly the Noodle service URL, assistant client ID, and assistant client secret belong in the authenticated\ncustomer backend. The model URL, model name, and model API key remain managed by the Noodle deployment.\n\nThe customer's authenticated backend calls `createAssistantSession(...)` from\n`@noodleseed/assistant/server`, passing the already-verified user and browser origin. The browser then uses\nthe returned short-lived session through the managed Web Component/React renderer or a customer-owned UI:\n\n```bash\npnpm add @noodleseed/assistant\n```\n\n```tsx\nimport { NoodleAssistant } from '@noodleseed/assistant/react';\n\n<NoodleAssistant\n  sessionEndpoint=\"/api/noodle-assistant/session\"\n  theme={resolvedTheme}\n  onSessionExpired={() => console.info('Assistant session renewed')}\n/>;\n```\n\n`resolvedTheme` is the application's current `'light' | 'dark'` value. Use `theme=\"auto\"` only when the\nbrowser operating-system preference is intentionally authoritative.\n\nFor an entirely application-owned React renderer, use the renderer-free hook. It creates no custom element\nand returns the AI SDK transcript plus the canonical client commands:\n\n```tsx\n'use client';\n\nimport { useEffect, useState } from 'react';\nimport { NoodleAppView } from '@noodleseed/assistant/react';\nimport { useNoodleAssistant } from '@noodleseed/assistant/react/client';\n\nexport function CustomerAssistant({\n  principalKey,\n  resolvedTheme,\n}: {\n  principalKey: string;\n  resolvedTheme: 'light' | 'dark';\n}) {\n  const [draft, setDraft] = useState('');\n  const { client, messages, status, error } = useNoodleAssistant({\n    sessionEndpoint: '/api/noodle-assistant/session',\n    principalKey,\n  });\n  const busy = status === 'submitted' || status === 'streaming';\n  const settle = (operation: Promise<void>) => {\n    void operation.catch(() => {\n      // The hook exposes this same structured failure through `error`.\n    });\n  };\n\n  return (\n    <section aria-label=\"Assistant\" aria-busy={busy}>\n      {messages.map((message) => (\n        <article key={message.id} data-role={message.role}>\n          {message.parts.map((part, index) => {\n            if (part.type === 'text') return <p key={index}>{part.text}</p>;\n            if (part.type === 'data-confirmation') {\n              const review = part.data;\n              return (\n                <section key={review.id} aria-label=\"Review proposed action\">\n                  <h3>{review.title ?? 'Review proposed action'}</h3>\n                  {review.description ? <p>{review.description}</p> : null}\n                  <pre aria-label=\"Proposed action arguments\">\n                    {JSON.stringify(review.arguments ?? {}, null, 2)}\n                  </pre>\n                  <button\n                    disabled={busy || review.status !== 'pending'}\n                    onClick={() => settle(client.respond(review.id, { action: 'accept' }))}\n                  >\n                    Confirm\n                  </button>\n                  <button\n                    disabled={busy || review.status !== 'pending'}\n                    onClick={() => settle(client.respond(review.id, { action: 'decline' }))}\n                  >\n                    Don't proceed\n                  </button>\n                </section>\n              );\n            }\n            if (part.type === 'data-input-request') {\n              const request = part.data;\n              return (\n                <section key={request.id} aria-label=\"Assistant needs input\">\n                  <p>{request.message}</p>\n                  <p>This renderer has not implemented the requested form.</p>\n                  <button\n                    disabled={busy || request.status !== 'pending'}\n                    onClick={() => settle(client.respond(request.id, { action: 'decline' }))}\n                  >\n                    Cancel request\n                  </button>\n                </section>\n              );\n            }\n            if (part.type === 'data-tool-result') {\n              return (\n                <pre key={part.data.id} aria-label={`${part.data.tool} result`}>\n                  {JSON.stringify(part.data.result, null, 2)}\n                </pre>\n              );\n            }\n            if (part.type === 'data-view') {\n              return (\n                <NoodleAppView\n                  key={`${part.data.id}:${part.data.resourceUri}`}\n                  client={client}\n                  view={part.data}\n                  theme={resolvedTheme}\n                />\n              );\n            }\n            return <p key={index}>Unsupported assistant content.</p>;\n          })}\n        </article>\n      ))}\n      {error ? <p role=\"alert\">{error.message}</p> : null}\n      <form\n        onSubmit={(event) => {\n          event.preventDefault();\n          const message = draft.trim();\n          if (!message) return;\n          setDraft('');\n          settle(client.sendMessage(message));\n        }}\n      >\n        <input\n          aria-label=\"Message\"\n          value={draft}\n          onChange={(event) => setDraft(event.currentTarget.value)}\n        />\n        {busy ? (\n          <button type=\"button\" onClick={() => client.abort()}>\n            Stop\n          </button>\n        ) : (\n          <button type=\"submit\">Send</button>\n        )}\n      </form>\n    </section>\n  );\n}\n```\n\n`principalKey` stays in the browser. Change it whenever the authenticated user or tenant changes; the hook\nthen aborts and clears the prior session and transcript. The sample fails closed on input requests until its\nfallback is replaced with a form generated from `requestedSchema`. A production renderer must show the\ncomplete confirmation review and both decisions. For `data-view`, map `resourceUri` or `tool` and the\nbounded/redacted result to a component already trusted by this application only when intentionally replacing\nthe linked App with a native UI. Otherwise use `NoodleAppView`; JSON result data is not the App UI. Its\nsemantic lifecycle identity is the client plus `view.id` plus `view.resourceUri`, so parent payload/callback\nrerenders keep the iframe and only a different view or unmount tears down the bridge.\nNever inject `part.data.html`, assign it to `srcdoc`, fetch a `ui://` URI, or reproduce the bridge directly. Pages with a\nContent-Security-Policy must include the Noodle service origin in both `connect-src` and `frame-src`.\n\nBefore the production-equivalent host build, run the presence-only handoff check:\n\n```sh\nnoodle assistant embed --check --json\n```\n\nAdd application-owned delegated-exchange requirements with repeatable `--require-env NAME` flags. The JSON\nreports required and missing names, CSP status, and post-deploy probes without returning environment values\nor writing scaffold files. Map the names through the production secret manager, CI environment, and any\nsecret allowlist; regenerate existing framework-owned environment binding types before the build. Default\nDevtools/model exercises to synthetic data, and obtain approval before sending real connector data to an\nexternal model.\n\nAfter deployment, use the assistant doctor to verify the embed client, model, and static session boundary:\n\n```sh\nnoodle assistant doctor --user-id <real-test-user> --origin \"$PUBLIC_APP_ORIGIN\" --org <org> --app <app> --env <env>\n```\n\nThis does not add an OIDC customer route. Routed operations succeed only through a direct/federated\ncustomer-authenticated MCP request with an allowed endpoint claim.\n\nIf the application deliberately sends a first turn on mount, do not combine a persistent \"sent\" ref with a\nmount effect. React Strict Mode can abort that provisional request and then suppress the stable remount.\nSchedule the send after the provisional cleanup and settle its promise:\n\n```tsx\nuseEffect(() => {\n  let active = true;\n  queueMicrotask(() => {\n    if (active) settle(client.sendMessage(initialMessage));\n  });\n  return () => {\n    active = false;\n  };\n}, [client, initialMessage]);\n```\n\nFor a chat-first custom host, raw `tool_started` supplies the direct call `id` and technical tool name. Map\nknown tools to concise application copy and use a neutral fallback. Reserve a stable `role=\"status\"` region\nfor thinking, tool activity, and the view skeleton; switch to the ready `NoodleAppView` on `view_available`\nor to `role=\"alert\"` on error. Decorative skeleton shapes stay hidden from assistive technology, and shimmer\nor transition motion is disabled under `prefers-reduced-motion`.\n\nUse `${view.id}:${view.resourceUri}` as transport identity. Different call IDs are distinct invocations and\nmust not be deduplicated generically. If this application intentionally owns one current panel for a known\nresource, declare an application-owned slot for that resource and replace only that slot.\n\nOutside React, subscribe to the DOM-free client directly. It exposes the same conversation as headless AI\nSDK `UIMessage` state, including typed confirmation, input, tool-result, and linked-view parts:\n\n```ts\nimport { createAssistantClient } from '@noodleseed/assistant/client';\n\nconst assistant = createAssistantClient({\n  sessionEndpoint: '/api/noodle-assistant/session',\n});\n\nassistant.subscribeChat((state) => {\n  renderUIMessageState(state);\n  for (const message of state.messages) {\n    for (const part of message.parts) {\n      if (part.type === 'data-confirmation' && part.data.status === 'pending') {\n        renderConfirmation(part.data, (response) => assistant.respond(part.data.id, response));\n      }\n    }\n  }\n});\n```\n\n`theme=\"auto\"` follows the operating-system preference, not a SaaS-owned toggle. Pass the resolved\n`light`/`dark` theme to `NoodleAssistant` and `NoodleAppView`; updates reach mounted MCP Apps without a\nremount. CSS custom properties inherit through the host, and documented `--ns-assistant-*` variables remain\nthe final integration escape hatch. Server `branding` is shared by widgets and the assistant; there is no\nsecond branding declaration. Text streams progressively. Expired turns re-exchange and retry once;\nconfirmations never replay automatically.\n\nThe customer IdP must place the full tenant API base URL in `tenant.api_base_url`. For example, one verified\ncustomer may receive `https://customer-a.api.noodleseed.dev/v1` and another\n`https://customer-b.api.noodleseed.dev/v1`; both satisfy the declared suffix policy. Application code,\ndeployment variables, and connector arguments do not select the tenant route.\n\n`CUSTOMER_API_CLIENT_ID` and `CUSTOMER_API_CLIENT_SECRET` authenticate only the broker to the fixed exchange\nendpoint. They are not customer API bearer tokens. The exchange endpoint verifies the platform-signed\nsubject assertion and mints a short-lived token scoped to the signed-in user and route binding.\n\n## Deploy customer-protected to Noodle Seed Cloud\n\n```bash\nnoodle deploy examples/customer-auth/src/server.ts \\\n  --org noodleseed \\\n  --app customer-auth \\\n  --env prod \\\n  --access customers\n```\n\nEndpoint:\n\n```text\nhttps://cloud.noodleseed.dev/o/noodleseed/customer-auth/mcp\n```\n\n## MCP Primitives\n\n- Tool `list_my_organizations`: calls `GET /api/organizations` and returns the organizations the signed-in\n  customer is a member of. Takes no arguments; the org set is scoped by the verified customer session.\n- Tool `list_org_apps`: calls `GET /api/organizations/{org_id}/apps` for one organization `org_id`.\n\n## Auth boundary\n\nNoodle Seed verifies the configured OIDC issuer, audience, and exact MCP resource before reading identity or\nrouting claims. Public caller identity contains the user/role/scope projection; the customer route remains\nprivate request state.\n\nConnector-backed tools ask the broker for a route-bound delegated credential; only the endpoint key and\nfingerprint enter broker cache/single-flight state or the assertion. The route claim and inbound MCP bearer\ntoken never reach tools, connectors, widgets, model output, or downstream systems.\n" },
+    { relPath: "examples/customer-auth/README.md", content: "# Customer Auth - OIDC identity and customer-routed APIs\n\nThis curated example owns the customer/end-user authentication capability slot. It proves that a SaaS app\ncan protect an MCP endpoint with direct OIDC, retain role/scope-based tool authorization, and route ordinary\nreads and confirmed actions to the API origin selected by the verified customer's identity provider.\n\nIt also owns the customer-branded embedded-assistant presentation showcase. Embedded sessions lack\ndirect/federated MCP OIDC endpoint claims, so these routed tools fail with `connector_route_unavailable`;\nstatic connectors still support embedded delegated exchange. Exercise routed tools through the MCP endpoint.\n\nThe public developer entrypoint is [`src/server.ts`](src/server.ts). It exposes a deliberately small MCP\nsurface for organization discovery and app lifecycle operations:\n\n- `list_my_organizations` lists the NoodleSeed.com organizations the signed-in customer belongs to (no\n  arguments — the org set comes from the verified customer session).\n- `list_org_apps` lists apps for one of those organizations through that tenant's API. It is visible and\n  callable only when the verified customer has the `org_apps:read` scope and either the `org_admin` or\n  `org_member` role.\n- `archive_org_app` archives one app only after exact runtime confirmation. It requires the\n  `org_apps:write` scope and `org_admin` role.\n\nThe tools chain: `list_my_organizations` surfaces the `org_id`s the customer can act on,\n`list_org_apps` takes one of those ids, and `archive_org_app` accepts the selected app id. Tool code remains\nindependent of the selected origin.\n\n## Declare the customer endpoint\n\n`customerEndpoint` names one private routing authority and bounds the origins an IdP may select:\n\n```ts\nconst customerApi = customerEndpoint('customer_api', {\n  allowedHttpsHostSuffixes: ['api.noodleseed.dev'],\n});\n```\n\nUse either non-empty `allowedHttpsHostSuffixes` or non-empty `allowedHttpsOrigins`, never both. Exact-origin\npolicies may include a non-default port. Suffix policies match only the exact hostname or dot-boundary\nsubdomains on port 443. A routed connector must not add `allowedOrigins`; its endpoint policy is the egress\nallowlist.\n\nThe connector uses that declaration as its normal base URL. Its token endpoint remains a fixed, independently\nvalidated HTTPS URL:\n\n```ts\nconst api = connector('noodleseed_app_api')\n  .version('1.0.0')\n  .http({\n    baseUrl: customerApi,\n    auth: {\n      kind: 'delegatedTokenExchange',\n      tokenUrl: 'https://id.noodleseed.dev/oauth/token',\n      clientId: variable('CUSTOMER_API_CLIENT_ID'),\n      clientSecret: secret('CUSTOMER_API_CLIENT_SECRET'),\n      scopes: ['organizations:read', 'org_apps:read', 'org_apps:write'],\n      audience: 'noodleseed-customer-api',\n    },\n    operations: {\n      // read and action operations...\n    },\n  });\n```\n\n## Map the endpoint from verified OIDC\n\nThe IdP claim contains the complete base URL, including an optional base path. Routing is separate from the\npublic `${user}` expression scope:\n\n```ts\nauth: customerAuth.oidc({\n  issuer: 'https://id.noodleseed.dev',\n  audience: 'https://org.cloud.noodleseed.dev/app/mcp',\n  claims: {\n    id: 'sub',\n    email: 'email',\n    name: 'name',\n    orgs: 'permissions.orgs',\n    roles: 'permissions.roles',\n    scopes: 'permissions.scopes',\n  },\n  routing: {\n    endpoints: {\n      customer_api: { claim: 'tenant.api_base_url' },\n    },\n  },\n}),\n```\n\nFor federated OIDC, put the same endpoint map on every issuer. Claim paths may differ, but each issuer must\nmap every endpoint the app uses:\n\n```ts\nauth: customerAuth.federatedOidc({\n  issuers: [\n    {\n      issuer: 'https://id.customer-a.com',\n      audience: 'https://org.cloud.noodleseed.dev/app/mcp',\n      routing: {\n        endpoints: {\n          customer_api: { claim: 'tenant.api_base_url' },\n        },\n      },\n    },\n    {\n      issuer: 'https://login.customer-b.com',\n      audience: 'https://org.cloud.noodleseed.dev/app/mcp',\n      routing: {\n        endpoints: {\n          customer_api: { claim: 'organization.routes.customer_api' },\n        },\n      },\n    },\n  ],\n}),\n```\n\nAt runtime, Noodle Seed validates both the configured audience and exact MCP resource, projects the route\ninto private request state, applies its policy, and freezes it for the call. Missing, malformed, or\ndisallowed claims return `connector_route_unavailable` before credential lookup or connector egress.\nResolved URLs never enter artifacts, `${user}`, logs, model output, widgets, public confirmation review,\nbroker cache keys, or delegated exchange assertions.\n\nRouted reads work in tools, including declared nested calls. Routed actions require exact\n`annotations.confirm: true`; otherwise they fail with `customer_endpoint_action_unsupported`. Routed\nresources, prompts, and ambient context fail with `customer_endpoint_surface_unsupported`.\n\nThe flagship's routed action uses the normal TypeScript action helper:\n\n```ts\ntool('archive_org_app', {\n  authorization: {\n    requiredScopes: ['org_apps:write'],\n    allowedRoles: ['org_admin'],\n  },\n  annotations: annotations.openAction({ destructive: false, confirm: true }),\n  // input, output, and the normal connectors.app_api.archiveOrgApp(...) call...\n});\n```\n\nThe flagship also opts into the current stateless hosted MCP path:\n\n```ts\ninteractions: {\n  confirmationFallback: 'host',\n},\n```\n\nA bidirectional client that negotiated form elicitation can complete the standard confirmation exchange\ninstead. The explicit host fallback trusts the MCP host to have collected native write approval before the\ntool call reaches Noodle Seed; it is never inferred from client identity and does not replace auth, policy,\nor accurate action/destructive annotations. Omit the fallback when connected hosts are not trusted to\nprovide that approval. If neither standard confirmation nor the fallback is available, the action fails\nclosed with `interaction_unavailable`.\n\nPreparation stores only sorted route `{ key, fingerprint }` bindings in its private server-held\ncontinuation; the public review exposes none of them. Acceptance re-resolves the current request route and\nreturns `invalid_continuation` if it is missing or changed, before policy, credentials, or egress. A match\nreuses the current frozen snapshot for the action and all nested or later reads.\n\nThe application developer owns the direct/federated authorization server. It must publish its path-inserted\nRFC 8414 document as direct HTTP 200 JSON with exact issuer and HTTPS authorization/token/registration/JWKS\nendpoints, authorization-code and refresh grants, PKCE S256, public-client auth method `none`, RFC 8707\nresource handling, and public signing keys. Access tokens must include the exact MCP resource audience; there\nis no audience fallback.\n\nRun `noodle auth doctor src/server.ts` before sharing. Its bounded, read-only probes never register a client.\nAdding the embedded assistant does not choose or rewrite MCP customer auth.\n\n## Per-tool authorization remains independent\n\nThe mapped `roles` and `scopes` paths are read only after OIDC verification. The restricted tool declares its\nrule beside the rest of its public contract:\n\n```ts\ntool('list_org_apps', {\n  authorization: {\n    requiredScopes: ['org_apps:read'],\n    allowedRoles: ['org_admin', 'org_member'],\n  },\n  // input, output, and fulfilment...\n});\n```\n\nEvery required scope must be present and at least one allowed role must match. When both lists are declared,\nboth conditions apply. Route availability never changes `tools/list`: discovery remains based only on\nroles/scopes. A restricted tool is omitted for an ineligible customer and a guessed direct call still fails\nclosed.\n\nTool code calls the connector normally:\n\n```ts\nfulfil({ input, connectors }) {\n  const apps = connectors.app_api.listOrgApps({\n    org_id: input.org_id,\n    skip: input.skip,\n    limit: input.limit,\n  });\n\n  return { result: apps.result };\n}\n```\n\nThe broker exchanges a short-lived, platform-signed assertion at the fixed token endpoint and caches the\nresult by caller, connector, scopes, and a route fingerprint. The assertion carries only the route key and\nfingerprint, never the URL. The MCP access token is never forwarded to the customer API. The exchange wire\ncontract lives in [docs/spec/connectors.md](../../docs/spec/connectors.md).\n\nFirebase and Microsoft remain supported managed adapters; their provider-specific contracts and tests live\nin [docs/spec/auth-and-policy.md](../../docs/spec/auth-and-policy.md) and the SharePoint flagship.\n\n## Validate\n\n```bash\nnoodle auth doctor examples/customer-auth/src/server.ts\nnoodle validate examples/customer-auth/src/server.ts\n```\n\nAgainst a deployed customer-protected environment, set a short-lived real customer token only in\n`NOODLE_CUSTOMER_TOKEN` and add `--live --org <org> --app <app> --env <env>`. The live doctor performs\ncredential exchanges without invoking any business tool.\n\n## Run locally\n\n```bash\nnoodle dev examples/customer-auth/src/server.ts --app noodleseed-customer-auth\n```\n\n## Configuration\n\nThe embedded assistant uses a customer-supplied OpenAI Chat Completions-compatible endpoint. Configure its\nmanaged values at the Noodle deployment environment; none of these values belongs in the customer web\napplication environment, and the API key never reaches the browser:\n\nThe assistant session carries a verified user, tenant, deployment, roles, and scopes, but not the IdP's\n`tenant.api_base_url` claim. These routed operations are MCP-only; do not copy the route into page context,\nsession claims, tool input, or model instructions.\n\n```bash\nnoodle variables set ASSISTANT_MODEL_BASE_URL https://model.example.com/v1 --scope env\nnoodle variables set ASSISTANT_MODEL your-model --scope env\nnoodle secrets set ASSISTANT_MODEL_API_KEY --scope env\nnoodle variables set CUSTOMER_API_CLIENT_ID your-broker-client-id --scope env\nnoodle secrets set CUSTOMER_API_CLIENT_SECRET --scope env\nnoodle check --target embedded-assistant src/server.ts\n```\n\nAssistant origins are exact. Production embedding origins must use HTTPS; plain HTTP is accepted only for\nloopback development origins such as `http://localhost:3000`, `http://127.0.0.1:3000`, or\n`http://[::1]:3000`. `noodle dev` serves the MCP project, not that separate embedding application.\n\nThe bounded `presentation` object configures the panel, launcher, header, composer, and messages. Its\nprimitives derive colors from shared server `branding`; raw HTML, CSS, inline SVG, renderer classes, and\ncallbacks are not accepted.\n\nCreate the backend credential after deployment. The CLI writes it to a mode-0600 file and never prints the\nsecret:\n\n```bash\nnoodle assistant clients create --name web --org noodleseed --app customer-auth --env prod\n```\n\nOnly the Noodle service URL, assistant client ID, and assistant client secret belong in the authenticated\ncustomer backend. The model URL, model name, and model API key remain managed by the Noodle deployment.\n\nThe customer's authenticated backend calls `createAssistantSession(...)` from\n`@noodleseed/assistant/server`, passing the already-verified user and browser origin. The browser then uses\nthe returned short-lived session through the managed Web Component/React renderer or a customer-owned UI:\n\n```bash\npnpm add @noodleseed/assistant\n```\n\n```tsx\nimport { NoodleAssistant } from '@noodleseed/assistant/react';\n\n<NoodleAssistant\n  sessionEndpoint=\"/api/noodle-assistant/session\"\n  theme={resolvedTheme}\n  onSessionExpired={() => console.info('Assistant session renewed')}\n/>;\n```\n\n`resolvedTheme` is the application's current `'light' | 'dark'` value. Use `theme=\"auto\"` only when the\nbrowser operating-system preference is intentionally authoritative.\n\nFor an entirely application-owned React renderer, use the renderer-free hook. It creates no custom element\nand returns the AI SDK transcript plus the canonical client commands:\n\n```tsx\n'use client';\n\nimport { useEffect, useState } from 'react';\nimport { NoodleAppView } from '@noodleseed/assistant/react';\nimport { useNoodleAssistant } from '@noodleseed/assistant/react/client';\n\nexport function CustomerAssistant({\n  principalKey,\n  resolvedTheme,\n}: {\n  principalKey: string;\n  resolvedTheme: 'light' | 'dark';\n}) {\n  const [draft, setDraft] = useState('');\n  const { client, messages, status, error } = useNoodleAssistant({\n    sessionEndpoint: '/api/noodle-assistant/session',\n    principalKey,\n  });\n  const busy = status === 'submitted' || status === 'streaming';\n  const settle = (operation: Promise<void>) => {\n    void operation.catch(() => {\n      // The hook exposes this same structured failure through `error`.\n    });\n  };\n\n  return (\n    <section aria-label=\"Assistant\" aria-busy={busy}>\n      {messages.map((message) => (\n        <article key={message.id} data-role={message.role}>\n          {message.parts.map((part, index) => {\n            if (part.type === 'text') return <p key={index}>{part.text}</p>;\n            if (part.type === 'data-confirmation') {\n              const review = part.data;\n              return (\n                <section key={review.id} aria-label=\"Review proposed action\">\n                  <h3>{review.title ?? 'Review proposed action'}</h3>\n                  {review.description ? <p>{review.description}</p> : null}\n                  <pre aria-label=\"Proposed action arguments\">\n                    {JSON.stringify(review.arguments ?? {}, null, 2)}\n                  </pre>\n                  <button\n                    disabled={busy || review.status !== 'pending'}\n                    onClick={() => settle(client.respond(review.id, { action: 'accept' }))}\n                  >\n                    Confirm\n                  </button>\n                  <button\n                    disabled={busy || review.status !== 'pending'}\n                    onClick={() => settle(client.respond(review.id, { action: 'decline' }))}\n                  >\n                    Don't proceed\n                  </button>\n                </section>\n              );\n            }\n            if (part.type === 'data-input-request') {\n              const request = part.data;\n              return (\n                <section key={request.id} aria-label=\"Assistant needs input\">\n                  <p>{request.message}</p>\n                  <p>This renderer has not implemented the requested form.</p>\n                  <button\n                    disabled={busy || request.status !== 'pending'}\n                    onClick={() => settle(client.respond(request.id, { action: 'decline' }))}\n                  >\n                    Cancel request\n                  </button>\n                </section>\n              );\n            }\n            if (part.type === 'data-tool-result') {\n              return (\n                <pre key={part.data.id} aria-label={`${part.data.tool} result`}>\n                  {JSON.stringify(part.data.result, null, 2)}\n                </pre>\n              );\n            }\n            if (part.type === 'data-view') {\n              return (\n                <NoodleAppView\n                  key={`${part.data.id}:${part.data.resourceUri}`}\n                  client={client}\n                  view={part.data}\n                  theme={resolvedTheme}\n                />\n              );\n            }\n            return <p key={index}>Unsupported assistant content.</p>;\n          })}\n        </article>\n      ))}\n      {error ? <p role=\"alert\">{error.message}</p> : null}\n      <form\n        onSubmit={(event) => {\n          event.preventDefault();\n          const message = draft.trim();\n          if (!message) return;\n          setDraft('');\n          settle(client.sendMessage(message));\n        }}\n      >\n        <input\n          aria-label=\"Message\"\n          value={draft}\n          onChange={(event) => setDraft(event.currentTarget.value)}\n        />\n        {busy ? (\n          <button type=\"button\" onClick={() => client.abort()}>\n            Stop\n          </button>\n        ) : (\n          <button type=\"submit\">Send</button>\n        )}\n      </form>\n    </section>\n  );\n}\n```\n\n`principalKey` stays in the browser. Change it whenever the authenticated user or tenant changes; the hook\nthen aborts and clears the prior session and transcript. The sample fails closed on input requests until its\nfallback is replaced with a form generated from `requestedSchema`. A production renderer must show the\ncomplete confirmation review and both decisions. For `data-view`, map `resourceUri` or `tool` and the\nbounded/redacted result to a component already trusted by this application only when intentionally replacing\nthe linked App with a native UI. Otherwise use `NoodleAppView`; JSON result data is not the App UI. Its\nsemantic lifecycle identity is the client plus `view.id` plus `view.resourceUri`, so parent payload/callback\nrerenders keep the iframe and only a different view or unmount tears down the bridge.\nNever inject `part.data.html`, assign it to `srcdoc`, fetch a `ui://` URI, or reproduce the bridge directly. Pages with a\nContent-Security-Policy must include the Noodle service origin in both `connect-src` and `frame-src`.\n\nBefore the production-equivalent host build, run the presence-only handoff check:\n\n```sh\nnoodle assistant embed --check --json\n```\n\nAdd application-owned delegated-exchange requirements with repeatable `--require-env NAME` flags. The JSON\nreports required and missing names, CSP status, and post-deploy probes without returning environment values\nor writing scaffold files. Map the names through the production secret manager, CI environment, and any\nsecret allowlist; regenerate existing framework-owned environment binding types before the build. Default\nDevtools/model exercises to synthetic data, and obtain approval before sending real connector data to an\nexternal model.\n\nAfter deployment, use the assistant doctor to verify the embed client, model, and static session boundary:\n\n```sh\nnoodle assistant doctor --user-id <real-test-user> --origin \"$PUBLIC_APP_ORIGIN\" --org <org> --app <app> --env <env>\n```\n\nThis does not add an OIDC customer route. Routed operations succeed only through a direct/federated\ncustomer-authenticated MCP request with an allowed endpoint claim.\n\nIf the application deliberately sends a first turn on mount, do not combine a persistent \"sent\" ref with a\nmount effect. React Strict Mode can abort that provisional request and then suppress the stable remount.\nSchedule the send after the provisional cleanup and settle its promise:\n\n```tsx\nuseEffect(() => {\n  let active = true;\n  queueMicrotask(() => {\n    if (active) settle(client.sendMessage(initialMessage));\n  });\n  return () => {\n    active = false;\n  };\n}, [client, initialMessage]);\n```\n\nFor a chat-first custom host, raw `tool_started` supplies the direct call `id` and technical tool name. Map\nknown tools to concise application copy and use a neutral fallback. Reserve a stable `role=\"status\"` region\nfor thinking, tool activity, and the view skeleton; switch to the ready `NoodleAppView` on `view_available`\nor to `role=\"alert\"` on error. Decorative skeleton shapes stay hidden from assistive technology, and shimmer\nor transition motion is disabled under `prefers-reduced-motion`.\n\nUse `${view.id}:${view.resourceUri}` as transport identity. Different call IDs are distinct invocations and\nmust not be deduplicated generically. If this application intentionally owns one current panel for a known\nresource, declare an application-owned slot for that resource and replace only that slot.\n\nOutside React, subscribe to the DOM-free client directly. It exposes the same conversation as headless AI\nSDK `UIMessage` state, including typed confirmation, input, tool-result, and linked-view parts:\n\n```ts\nimport { createAssistantClient } from '@noodleseed/assistant/client';\n\nconst assistant = createAssistantClient({\n  sessionEndpoint: '/api/noodle-assistant/session',\n});\n\nassistant.subscribeChat((state) => {\n  renderUIMessageState(state);\n  for (const message of state.messages) {\n    for (const part of message.parts) {\n      if (part.type === 'data-confirmation' && part.data.status === 'pending') {\n        renderConfirmation(part.data, (response) => assistant.respond(part.data.id, response));\n      }\n    }\n  }\n});\n```\n\n`theme=\"auto\"` follows the operating-system preference, not a SaaS-owned toggle. Pass the resolved\n`light`/`dark` theme to `NoodleAssistant` and `NoodleAppView`; updates reach mounted MCP Apps without a\nremount. CSS custom properties inherit through the host, and documented `--ns-assistant-*` variables remain\nthe final integration escape hatch. Server `branding` is shared by widgets and the assistant; there is no\nsecond branding declaration. Text streams progressively. Expired turns re-exchange and retry once;\nconfirmations never replay automatically.\n\nThe customer IdP must place the full tenant API base URL in `tenant.api_base_url`. For example, one verified\ncustomer may receive `https://customer-a.api.noodleseed.dev/v1` and another\n`https://customer-b.api.noodleseed.dev/v1`; both satisfy the declared suffix policy. Application code,\ndeployment variables, and connector arguments do not select the tenant route.\n\n`CUSTOMER_API_CLIENT_ID` and `CUSTOMER_API_CLIENT_SECRET` authenticate only the broker to the fixed exchange\nendpoint. They are not customer API bearer tokens. The exchange endpoint verifies the platform-signed\nsubject assertion and mints a short-lived token scoped to the signed-in user and route binding.\n\n## Deploy customer-protected to Noodle Seed Cloud\n\n```bash\nnoodle deploy examples/customer-auth/src/server.ts \\\n  --org noodleseed \\\n  --app customer-auth \\\n  --env prod \\\n  --access customers\n```\n\nEndpoint:\n\n```text\nhttps://cloud.noodleseed.dev/o/noodleseed/customer-auth/mcp\n```\n\n## MCP Primitives\n\n- Tool `list_my_organizations`: calls `GET /api/organizations` and returns the organizations the signed-in\n  customer is a member of. Takes no arguments; the org set is scoped by the verified customer session.\n- Tool `list_org_apps`: calls `GET /api/organizations/{org_id}/apps` for one organization `org_id`.\n- Tool `archive_org_app`: after confirmation, calls\n  `POST /api/organizations/{org_id}/apps/{app_id}/archive`.\n\n## Auth boundary\n\nNoodle Seed verifies the configured OIDC issuer, audience, and exact MCP resource before reading identity or\nrouting claims. Public caller identity contains the user/role/scope projection; the customer route remains\nprivate request state.\n\nConnector-backed tools ask the broker for a route-bound delegated credential; only the endpoint key and\nfingerprint enter broker cache/single-flight state or the assertion. The route claim and inbound MCP bearer\ntoken never reach tools, connectors, widgets, model output, or downstream systems. Confirmed actions keep\nthe same URL-blind binding only in private continuation state and reject acceptance-time drift.\n" },
     { relPath: "examples/customer-auth/noodle.json", content: "{\n  \"entrypoint\": \"src/server.ts\",\n  \"name\": \"customer-auth\"\n}\n" },
     { relPath: "examples/customer-auth/package.json", content: "{\n  \"name\": \"customer-auth\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"scripts\": {\n    \"test\": \"vitest run\",\n    \"validate\": \"noodle validate\",\n    \"dev\": \"noodle dev\",\n    \"deploy\": \"noodle deploy\"\n  },\n  \"devDependencies\": {\n    \"@noodleseed/one\": \"latest\",\n    \"vitest\": \"latest\"\n  }\n}\n" },
-    { relPath: "examples/customer-auth/src/server.ts", content: "import {\n  annotations,\n  connector,\n  customerAuth,\n  customerEndpoint,\n  embeddedAssistant,\n  openAICompatible,\n  secret,\n  server,\n  tool,\n  variable,\n  z,\n} from '@noodleseed/one';\n\nconst customerApi = customerEndpoint('customer_api', {\n  allowedHttpsHostSuffixes: ['api.noodleseed.dev'],\n});\n\nconst noodleseedApi = connector('noodleseed_app_api')\n  .version('1.0.0')\n  .http({\n    baseUrl: customerApi,\n    auth: {\n      kind: 'delegatedTokenExchange',\n      tokenUrl: 'https://id.noodleseed.dev/oauth/token',\n      clientId: variable('CUSTOMER_API_CLIENT_ID'),\n      clientSecret: secret('CUSTOMER_API_CLIENT_SECRET'),\n      scopes: ['organizations:read', 'org_apps:read'],\n      audience: 'noodleseed-customer-api',\n    },\n    operations: {\n      list_org_apps: {\n        type: 'read',\n        method: 'GET',\n        path: '/api/organizations/${args.org_id}/apps',\n        query: ['skip', 'limit'],\n        input: z.object({\n          org_id: z.string(),\n          skip: z.number().optional(),\n          limit: z.number().optional(),\n        }),\n        output: z.object({ result: z.unknown().optional() }),\n        response: {\n          result: '${response}',\n        },\n      },\n      list_organizations: {\n        type: 'read',\n        method: 'GET',\n        path: '/api/organizations',\n        output: z.object({ organizations: z.array(z.unknown()).optional() }),\n        response: {\n          organizations: '${response.organizations}',\n        },\n      },\n    },\n  });\n\nexport default server(\n  'noodleseed_customer_auth',\n  {\n    title: 'NoodleSeed.com Customer Auth',\n    version: '1.0.0',\n    branding: {\n      name: 'Noodle Seed Assistant',\n      accent: '#E85D24',\n      surface: '#FFFFFF',\n      surfaceDark: '#171310',\n      colorScheme: 'auto',\n      theme: {\n        light: { accentText: '#FFFFFF', text: '#1C1714' },\n        dark: { accent: '#FF8A4C', accentText: '#1C100A', text: '#FFF8F2' },\n      },\n    },\n    use: { app_api: noodleseedApi },\n    auth: customerAuth.oidc({\n      issuer: 'https://id.noodleseed.dev',\n      audience: 'https://org.cloud.noodleseed.dev/app/mcp',\n      claims: {\n        id: 'sub',\n        email: 'email',\n        name: 'name',\n        orgs: 'permissions.orgs',\n        roles: 'permissions.roles',\n        scopes: 'permissions.scopes',\n      },\n      routing: {\n        endpoints: {\n          customer_api: { claim: 'tenant.api_base_url' },\n        },\n      },\n    }),\n    instructions:\n      'Direct/federated MCP OIDC demo. The customer IdP proves identity and privately selects the tenant API base URL for read-only MCP calls, while the broker supplies delegated credentials.',\n    assistant: embeddedAssistant({\n      model: openAICompatible({\n        baseUrl: variable('ASSISTANT_MODEL_BASE_URL'),\n        model: variable('ASSISTANT_MODEL'),\n        apiKey: secret('ASSISTANT_MODEL_API_KEY'),\n      }),\n      // Production origins are exact HTTPS; http://localhost:<port> is allowed for local development.\n      allowedOrigins: [\n        'https://app.noodleseed.com',\n        'https://dev.noodleseed.com',\n        'http://localhost:3000',\n      ],\n      layout: { mode: 'floating', position: 'bottom-right', panelWidth: 420 },\n      labels: {\n        welcomeHeading: 'How can I help with Noodle Seed?',\n        composerPlaceholder: 'Ask about your apps…',\n      },\n      presentation: {\n        panel: { surface: 'glass', elevation: 'soft', border: 'subtle' },\n        launcher: { icon: 'brand-mark', status: 'session', effect: 'pulse' },\n        header: {\n          mark: 'status',\n          badge: { text: 'Workspace online', tone: 'success', indicator: true },\n        },\n        composer: { leadingIcon: 'brand-mark', shape: 'pill' },\n      },\n      suggestedPrompts: ['Explain how to connect this customer-authenticated MCP server'],\n    }),\n  },\n  [\n    tool('list_org_apps', {\n      title: 'List organization apps',\n      description: 'List NoodleSeed.com apps for an organization from its customer API.',\n      authorization: {\n        requiredScopes: ['org_apps:read'],\n        allowedRoles: ['org_admin', 'org_member'],\n      },\n      input: z.object({\n        org_id: z.string().meta({ title: 'Organization' }),\n        skip: z.number().int().min(0).optional().meta({ title: 'Starting item' }),\n        limit: z.number().int().min(1).max(100).optional().meta({ title: 'Maximum results' }),\n      }),\n      output: z.object({\n        result: z.unknown(),\n      }),\n      annotations: annotations.readOnly(),\n      fulfil({ input, connectors }) {\n        const apps = connectors.app_api.listOrgApps({\n          org_id: input.org_id,\n          skip: input.skip,\n          limit: input.limit,\n        });\n        return {\n          result: apps.result,\n        };\n      },\n    }),\n    tool('list_my_organizations', {\n      title: 'List my organizations',\n      description: 'List the NoodleSeed.com organizations the signed-in customer belongs to.',\n      contextProvider: true,\n      input: z.object({}),\n      // The customer API returns every organization for the signed-in customer in one response, with no\n      // page parameter to pass through, so the bound is declared on the shape. A customer belongs to a\n      // handful of organizations; `noodle check` reports an unbounded list as\n      // `tool_design_output_bounds`.\n      output: z.object({\n        organizations: z.array(z.unknown()).max(100),\n      }),\n      annotations: annotations.readOnly(),\n      fulfil({ connectors }) {\n        const organizations = connectors.app_api.listOrganizations();\n        return {\n          organizations: organizations.organizations,\n        };\n      },\n    }),\n  ],\n);\n" },
-    { relPath: "examples/customer-auth/test/server.test.ts", content: "import { describe, expect, it } from 'vitest';\nimport app from '../src/server.js';\n\ndescribe('customer-auth example', () => {\n  it('exports a customer-authenticated, customer-branded embedded assistant', async () => {\n    expect(typeof app.toManifest).toBe('function');\n    const manifest = await app.toManifest();\n    expect(manifest.server.assistant).toMatchObject({\n      model: { kind: 'openai-compatible', apiKey: 'ASSISTANT_MODEL_API_KEY' },\n      layout: { mode: 'floating' },\n      presentation: {\n        panel: { surface: 'glass', elevation: 'soft', border: 'subtle' },\n        launcher: { icon: 'brand-mark', status: 'session', effect: 'pulse' },\n        header: { mark: 'status', badge: { text: 'Workspace online', tone: 'success' } },\n      },\n    });\n    expect(\n      manifest.server.assistant?.allowedOrigins.every(\n        (origin) => origin.startsWith('https://') || origin.startsWith('http://localhost:'),\n      ),\n    ).toBe(true);\n    expect(manifest.server.branding).toMatchObject({\n      name: 'Noodle Seed Assistant',\n      colorScheme: 'auto',\n    });\n    expect(manifest.server.auth).toEqual({\n      kind: 'oidc',\n      issuer: 'https://id.noodleseed.dev',\n      audience: 'https://org.cloud.noodleseed.dev/app/mcp',\n      claims: {\n        id: 'sub',\n        email: 'email',\n        name: 'name',\n        orgs: 'permissions.orgs',\n        roles: 'permissions.roles',\n        scopes: 'permissions.scopes',\n      },\n      routing: {\n        endpoints: {\n          customer_api: { claim: 'tenant.api_base_url' },\n        },\n      },\n    });\n    const catalog = app.toConnectorCatalog();\n    expect(catalog?.connectors).toHaveLength(1);\n    expect(catalog?.connectors[0]?.http).toMatchObject({\n      baseUrl: {\n        kind: 'customerEndpoint',\n        name: 'customer_api',\n        policy: { allowedHttpsHostSuffixes: ['api.noodleseed.dev'] },\n      },\n      auth: {\n        kind: 'delegatedTokenExchange',\n        tokenUrl: 'https://id.noodleseed.dev/oauth/token',\n        clientId: '${env.CUSTOMER_API_CLIENT_ID}',\n        clientSecret: 'CUSTOMER_API_CLIENT_SECRET',\n      },\n    });\n    expect(\n      Object.values(catalog?.connectors[0]?.http?.operations ?? {}).every(\n        (operation) => operation.type === 'read',\n      ),\n    ).toBe(true);\n    expect(catalog?.connectors[0]?.http).not.toHaveProperty('allowedOrigins');\n    expect(JSON.stringify({ manifest, catalog })).not.toContain('tenant-a.api.noodleseed.dev');\n    expect(manifest.tools.find((tool) => tool.name === 'list_org_apps')?.authorization).toEqual({\n      requiredScopes: ['org_apps:read'],\n      allowedRoles: ['org_admin', 'org_member'],\n    });\n    expect(\n      manifest.tools.find((tool) => tool.name === 'list_my_organizations')?.authorization,\n    ).toBeUndefined();\n  });\n});\n" },
+    { relPath: "examples/customer-auth/src/server.ts", content: "import {\n  annotations,\n  connector,\n  customerAuth,\n  customerEndpoint,\n  embeddedAssistant,\n  openAICompatible,\n  secret,\n  server,\n  tool,\n  variable,\n  z,\n} from '@noodleseed/one';\n\nconst customerApi = customerEndpoint('customer_api', {\n  allowedHttpsHostSuffixes: ['api.noodleseed.dev'],\n});\n\nconst noodleseedApi = connector('noodleseed_app_api')\n  .version('1.0.0')\n  .http({\n    baseUrl: customerApi,\n    auth: {\n      kind: 'delegatedTokenExchange',\n      tokenUrl: 'https://id.noodleseed.dev/oauth/token',\n      clientId: variable('CUSTOMER_API_CLIENT_ID'),\n      clientSecret: secret('CUSTOMER_API_CLIENT_SECRET'),\n      scopes: ['organizations:read', 'org_apps:read', 'org_apps:write'],\n      audience: 'noodleseed-customer-api',\n    },\n    operations: {\n      list_org_apps: {\n        type: 'read',\n        method: 'GET',\n        path: '/api/organizations/${args.org_id}/apps',\n        query: ['skip', 'limit'],\n        input: z.object({\n          org_id: z.string(),\n          skip: z.number().optional(),\n          limit: z.number().optional(),\n        }),\n        output: z.object({ result: z.unknown().optional() }),\n        response: {\n          result: '${response}',\n        },\n      },\n      list_organizations: {\n        type: 'read',\n        method: 'GET',\n        path: '/api/organizations',\n        output: z.object({ organizations: z.array(z.unknown()).optional() }),\n        response: {\n          organizations: '${response.organizations}',\n        },\n      },\n      archive_org_app: {\n        type: 'action',\n        method: 'POST',\n        path: '/api/organizations/${args.org_id}/apps/${args.app_id}/archive',\n        input: z.object({\n          org_id: z.string(),\n          app_id: z.string(),\n        }),\n        output: z.object({ archived: z.boolean() }),\n        response: {\n          archived: '${response.archived}',\n        },\n      },\n    },\n  });\n\nexport default server(\n  'noodleseed_customer_auth',\n  {\n    title: 'NoodleSeed.com Customer Auth',\n    version: '1.0.0',\n    branding: {\n      name: 'Noodle Seed Assistant',\n      accent: '#E85D24',\n      surface: '#FFFFFF',\n      surfaceDark: '#171310',\n      colorScheme: 'auto',\n      theme: {\n        light: { accentText: '#FFFFFF', text: '#1C1714' },\n        dark: { accent: '#FF8A4C', accentText: '#1C100A', text: '#FFF8F2' },\n      },\n    },\n    use: { app_api: noodleseedApi },\n    interactions: { confirmationFallback: 'host' },\n    auth: customerAuth.oidc({\n      issuer: 'https://id.noodleseed.dev',\n      audience: 'https://org.cloud.noodleseed.dev/app/mcp',\n      claims: {\n        id: 'sub',\n        email: 'email',\n        name: 'name',\n        orgs: 'permissions.orgs',\n        roles: 'permissions.roles',\n        scopes: 'permissions.scopes',\n      },\n      routing: {\n        endpoints: {\n          customer_api: { claim: 'tenant.api_base_url' },\n        },\n      },\n    }),\n    instructions:\n      'Direct/federated MCP OIDC demo. The customer IdP proves identity and privately selects the tenant API base URL, while the broker supplies delegated credentials and confirmed actions stay bound to the reviewed route.',\n    assistant: embeddedAssistant({\n      model: openAICompatible({\n        baseUrl: variable('ASSISTANT_MODEL_BASE_URL'),\n        model: variable('ASSISTANT_MODEL'),\n        apiKey: secret('ASSISTANT_MODEL_API_KEY'),\n      }),\n      // Production origins are exact HTTPS; http://localhost:<port> is allowed for local development.\n      allowedOrigins: [\n        'https://app.noodleseed.com',\n        'https://dev.noodleseed.com',\n        'http://localhost:3000',\n      ],\n      layout: { mode: 'floating', position: 'bottom-right', panelWidth: 420 },\n      labels: {\n        welcomeHeading: 'How can I help with Noodle Seed?',\n        composerPlaceholder: 'Ask about your apps…',\n      },\n      presentation: {\n        panel: { surface: 'glass', elevation: 'soft', border: 'subtle' },\n        launcher: { icon: 'brand-mark', status: 'session', effect: 'pulse' },\n        header: {\n          mark: 'status',\n          badge: { text: 'Workspace online', tone: 'success', indicator: true },\n        },\n        composer: { leadingIcon: 'brand-mark', shape: 'pill' },\n      },\n      suggestedPrompts: ['Explain how to connect this customer-authenticated MCP server'],\n    }),\n  },\n  [\n    tool('list_org_apps', {\n      title: 'List organization apps',\n      description: 'List NoodleSeed.com apps for an organization from its customer API.',\n      authorization: {\n        requiredScopes: ['org_apps:read'],\n        allowedRoles: ['org_admin', 'org_member'],\n      },\n      input: z.object({\n        org_id: z.string().meta({ title: 'Organization' }),\n        skip: z.number().int().min(0).optional().meta({ title: 'Starting item' }),\n        limit: z.number().int().min(1).max(100).optional().meta({ title: 'Maximum results' }),\n      }),\n      output: z.object({\n        result: z.unknown(),\n      }),\n      annotations: annotations.readOnly(),\n      fulfil({ input, connectors }) {\n        const apps = connectors.app_api.listOrgApps({\n          org_id: input.org_id,\n          skip: input.skip,\n          limit: input.limit,\n        });\n        return {\n          result: apps.result,\n        };\n      },\n    }),\n    tool('list_my_organizations', {\n      title: 'List my organizations',\n      description: 'List the NoodleSeed.com organizations the signed-in customer belongs to.',\n      contextProvider: true,\n      input: z.object({}),\n      // The customer API returns every organization for the signed-in customer in one response, with no\n      // page parameter to pass through, so the bound is declared on the shape. A customer belongs to a\n      // handful of organizations; `noodle check` reports an unbounded list as\n      // `tool_design_output_bounds`.\n      output: z.object({\n        organizations: z.array(z.unknown()).max(100),\n      }),\n      annotations: annotations.readOnly(),\n      fulfil({ connectors }) {\n        const organizations = connectors.app_api.listOrganizations();\n        return {\n          organizations: organizations.organizations,\n        };\n      },\n    }),\n    tool('archive_org_app', {\n      title: 'Archive organization app',\n      description: 'Archive one NoodleSeed.com app through its customer API after confirmation.',\n      authorization: {\n        requiredScopes: ['org_apps:write'],\n        allowedRoles: ['org_admin'],\n      },\n      input: z.object({\n        org_id: z.string().meta({ title: 'Organization' }),\n        app_id: z.string().meta({ title: 'App' }),\n      }),\n      output: z.object({\n        archived: z.boolean(),\n      }),\n      annotations: annotations.openAction({ destructive: false, confirm: true }),\n      fulfil({ input, connectors }) {\n        const result = connectors.app_api.archiveOrgApp({\n          org_id: input.org_id,\n          app_id: input.app_id,\n        });\n        return {\n          archived: result.archived,\n        };\n      },\n    }),\n  ],\n);\n" },
+    { relPath: "examples/customer-auth/test/server.test.ts", content: "import { describe, expect, it } from 'vitest';\nimport app from '../src/server.js';\n\ndescribe('customer-auth example', () => {\n  it('exports a customer-authenticated, customer-branded embedded assistant', async () => {\n    expect(typeof app.toManifest).toBe('function');\n    const manifest = await app.toManifest();\n    expect(manifest.server.assistant).toMatchObject({\n      model: { kind: 'openai-compatible', apiKey: 'ASSISTANT_MODEL_API_KEY' },\n      layout: { mode: 'floating' },\n      presentation: {\n        panel: { surface: 'glass', elevation: 'soft', border: 'subtle' },\n        launcher: { icon: 'brand-mark', status: 'session', effect: 'pulse' },\n        header: { mark: 'status', badge: { text: 'Workspace online', tone: 'success' } },\n      },\n    });\n    expect(\n      manifest.server.assistant?.allowedOrigins.every(\n        (origin) => origin.startsWith('https://') || origin.startsWith('http://localhost:'),\n      ),\n    ).toBe(true);\n    expect(manifest.server.branding).toMatchObject({\n      name: 'Noodle Seed Assistant',\n      colorScheme: 'auto',\n    });\n    expect(manifest.server.auth).toEqual({\n      kind: 'oidc',\n      issuer: 'https://id.noodleseed.dev',\n      audience: 'https://org.cloud.noodleseed.dev/app/mcp',\n      claims: {\n        id: 'sub',\n        email: 'email',\n        name: 'name',\n        orgs: 'permissions.orgs',\n        roles: 'permissions.roles',\n        scopes: 'permissions.scopes',\n      },\n      routing: {\n        endpoints: {\n          customer_api: { claim: 'tenant.api_base_url' },\n        },\n      },\n    });\n    expect(manifest.server.interactions).toEqual({ confirmationFallback: 'host' });\n    const catalog = app.toConnectorCatalog();\n    expect(catalog?.connectors).toHaveLength(1);\n    expect(catalog?.connectors[0]?.http).toMatchObject({\n      baseUrl: {\n        kind: 'customerEndpoint',\n        name: 'customer_api',\n        policy: { allowedHttpsHostSuffixes: ['api.noodleseed.dev'] },\n      },\n      auth: {\n        kind: 'delegatedTokenExchange',\n        tokenUrl: 'https://id.noodleseed.dev/oauth/token',\n        clientId: '${env.CUSTOMER_API_CLIENT_ID}',\n        clientSecret: 'CUSTOMER_API_CLIENT_SECRET',\n      },\n    });\n    expect(catalog?.connectors[0]?.operations).toMatchObject({\n      list_org_apps: { type: 'read' },\n      list_organizations: { type: 'read' },\n      archive_org_app: { type: 'action', method: 'POST' },\n    });\n    expect(catalog?.connectors[0]?.http).not.toHaveProperty('allowedOrigins');\n    expect(JSON.stringify({ manifest, catalog })).not.toContain('tenant-a.api.noodleseed.dev');\n    expect(manifest.tools.find((tool) => tool.name === 'list_org_apps')?.authorization).toEqual({\n      requiredScopes: ['org_apps:read'],\n      allowedRoles: ['org_admin', 'org_member'],\n    });\n    expect(\n      manifest.tools.find((tool) => tool.name === 'list_my_organizations')?.authorization,\n    ).toBeUndefined();\n    expect(manifest.tools.find((tool) => tool.name === 'archive_org_app')).toMatchObject({\n      authorization: {\n        requiredScopes: ['org_apps:write'],\n        allowedRoles: ['org_admin'],\n      },\n      annotations: {\n        readOnlyHint: false,\n        destructiveHint: false,\n        openWorldHint: true,\n        confirm: true,\n      },\n    });\n  });\n});\n" },
     { relPath: "examples/food-ordering/README.md", content: "# Food Ordering\n\n**Owns:** The flagship consumer ordering MCP App example: React view authoring, app-only helper tools,\ncaller-scoped cart state handles, invocation context, model-visible widget state/lifecycle, packaged image\nassets, portable structured elicitation, checkout handoff policy, host actions, CSP/permissions metadata,\nand widget preview coverage.\n\nFood Ordering is a generic, synthetic version of a live marketplace ordering app. It lets a user search\nstores, browse menus, customize an item, build a multi-line cart, review the order, and hand off checkout to\nan allowlisted example domain. It does not use real restaurant APIs, real checkout, customer credentials, or\nprivate customer data.\n\n## What It Shows\n\n| Capability | Example |\n| :--- | :--- |\n| Public entry tool | `open_ordering` returns structured fallback content and renders the React widget |\n| App-only helper tools | `search_stores`, `load_menu`, `load_item`, `read_cart`, `sync_cart`, `prepare_checkout`; mutating widget-owned helpers use `confirm: false` (equivalent to omission) and execute directly because action hints alone never gate |\n| Durable cart state | `server(..., { state: { handles: { cart } }, use: { state } })` with caller scope and revision checks |\n| React app runtime kit | `@noodleseed/one/react` supplies app flow, shell/nav/view, async state, form, quantity, choice, and handoff primitives |\n| Multi-step widget flow | One React shell navigates stores, menu, item customization, cart, review, and handoff views through `useAppFlow` |\n| Invocation context | `server.context` sets locale/time-zone defaults, derives an ambient service area/date, and makes the same snapshot available to tools and the reserved `noodle_context` MCP adapter |\n| Structured missing input | `plan_order` uses `ctx.elicit` to collect a fulfilment method and date through embedded/headless forms, standard bidirectional elicitation, a linked MCP App form, or an exact structured conversational retry on stateless hosts |\n| Model-visible widget state | `useUpdateModelContext` publishes one cohesive replacement snapshot when supported; `useWidgetLifecycle` auto-publishes mounted/cancelled/dismissed and reports author-owned submitted milestones for future context (not host-presentation proof), while the user-triggered submit pairs `useSendFollowUpMessage` for an immediate reply |\n| Handoff | `handoff.allowedDomains` allows only `https://orders.example.com` checkout URLs |\n| Progressive enhancement | Non-Apps hosts still receive stores, featured items, and a readable fallback summary |\n| Fail-closed hydration | The React view treats only the unhydrated, pre-result `{}` envelope as pending; a hydrated empty success remains distinct. It surfaces `isError`, validates required records and identifiers, and withholds ordering actions from malformed results |\n\nThe example is intentionally richer than the generated starter, but each inline view still follows the\nsame default: one immediate purpose, one primary action, at most one subordinate action, and progressive\ndisclosure for the rest. Preview it at 280px before adding navigation or local CSS; loading, empty, stale,\nerror/retry, and success states must remain readable without nested vertical scrolling.\n\nLike the comprehensive default `noodle init my-app` scaffold, this flagship keeps the server feature-rich\nwhile making each individual widget view focused; server capability breadth and screen density are separate.\nThe compiled initial widget should normally remain under the 1 MiB performance recommendation; Noodle Seed's\nhard ceilings are 10 MiB per compiled widget and 20 MiB across one deployment. Run `noodle check` to see raw\nand gzip-estimated sizes. Deploy requests are gzip-compressed as one stream so repeated self-contained React\nruntime bytes deduplicate on the wire without a cross-tenant CDN. Keep menu images or large live datasets in assets/resources and app-only tools\nrather than embedding them into the initial HTML bundle.\n\n## Local Author Loop\n\n```sh\nnoodle validate\nnoodle test\nnoodle dev\n```\n\nIn another terminal:\n\n```sh\nnoodle tools list\nnoodle tools call open_ordering --args '{\"customer\":\"Asha\",\"query\":\"noodles\"}'\nnoodle tools call summarize_ordering_options --args '{}'\n```\n\nWhen a developer finalizes visual feedback in the local Design experience, a coding agent can inspect the\nlatest project-local brief without a path or session id:\n\n```sh\nnoodle design inspect --latest --json\n```\n\nThe agent should locate the captured elements in this example's authored React source, preserve the listed\nbehavior and accessibility constraints, and verify every acceptance check before changing unrelated UI.\n\nFor Apps metadata conformance, start `noodle dev`, copy the loopback MCP endpoint, then run:\n\n```sh\nnpx @mcpjam/cli@latest apps conformance --url http://127.0.0.1:<port>/o/demo/food-ordering/mcp --quiet --format json\n```\n\n## Client Setup\n\nUse the CLI to print the exact setup flow for your MCP client:\n\n```sh\nnoodle connect claude\nnoodle connect chatgpt\nnoodle connect inspector\n```\n\n## Deploy\n\n```sh\nnoodle deploy --org demo --app food-ordering --env prod --access owner-only\nnoodle open\n```\n\nThat one deploy command preflights the complete target, creates a missing app/environment, and verifies\nhosted readiness. If it is interrupted, rerun the same command to resume the unfinished operation without a\nduplicate deployment. Use `--access org-members` for an org-wide internal demo. This example has no\nconnector secrets and does not include tokens, caller-key mechanisms, or `.env.noodle` values.\n\n## Demo Assets\n\nThe packaged demo images live under `assets/` and are public web assets when deployed. The current app uses\n`assets/noodle-bowl.jpg` as the server branding image.\n\nImage sources:\n\n- `assets/noodle-bowl.jpg` — Unsplash photo\n  [`IRv8V9Hb8gI`](https://unsplash.com/photos/IRv8V9Hb8gI), downloaded from Unsplash.\n- `assets/lentil-soup.jpg` — Unsplash image\n  [`photo-1510431198580-7727c9fa1e3a`](https://images.unsplash.com/photo-1510431198580-7727c9fa1e3a), downloaded from Unsplash.\n- `assets/mint-lemonade.jpg` — Unsplash photo\n  [`X7Nx327NtuA`](https://unsplash.com/photos/X7Nx327NtuA) by Imad 786.\n\nUnsplash photos are free to use under the [Unsplash License](https://unsplash.com/license); attribution is\nnot required, but source notes are kept here for provenance.\n" },
     { relPath: "examples/food-ordering/noodle.json", content: "{\n  \"entrypoint\": \"src/server.ts\",\n  \"name\": \"food-ordering\",\n  \"template\": \"widget\"\n}\n" },
     { relPath: "examples/food-ordering/package.json", content: "{\n  \"name\": \"food-ordering\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"scripts\": {\n    \"test\": \"vitest run test\",\n    \"validate\": \"noodle validate\",\n    \"dev\": \"noodle dev\",\n    \"deploy\": \"noodle deploy\"\n  },\n  \"devDependencies\": {\n    \"@vitejs/plugin-react\": \"latest\",\n    \"@noodleseed/one\": \"latest\",\n    \"@types/react\": \"latest\",\n    \"@types/react-dom\": \"latest\",\n    \"react\": \"latest\",\n    \"react-dom\": \"latest\",\n    \"vite\": \"latest\",\n    \"vitest\": \"latest\"\n  }\n}\n" },

package/node_modules/@noodle-borg/agent-kit/dist/generated/example-files.js.map

@@ -1 +1 @@
-{"version":3,"file":"example-files.js","sourceRoot":"","sources":["../../src/generated/example-files.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,kFAAkF;AAClF,iGAAiG;AAQjG,uGAAuG;AACvG,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,OAAO;IACP,SAAS;IACT,eAAe;IACf,gBAAgB;IAChB,YAAY;IACZ,aAAa;IACb,eAAe;IACf,qBAAqB;IACrB,iBAAiB;CAClB,CAAC;AAEF,yGAAyG;AACzG,MAAM,CAAC,MAAM,qBAAqB,GAAkC;IAClE,EAAE,OAAO,EAAE,gCAAgC,EAAE,OAAO,EAAE,4oEAA4oE,EAAE;IACpsE,EAAE,OAAO,EAAE,4CAA4C,EAAE,OAAO,EAAE,u/wBAAu/wB,EAAE;IAC3jxB,EAAE,OAAO,EAAE,6CAA6C,EAAE,OAAO,EAAE,kkQAAkkQ,EAAE;IACvoQ,EAAE,OAAO,EAAE,4CAA4C,EAAE,OAAO,EAAE,klqDAAklqD,EAAE;IACtpqD,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,wGAAwG,EAAE;IAClK,EAAE,OAAO,EAAE,mCAAmC,EAAE,OAAO,EAAE,mfAAmf,EAAE;IAC9iB,EAAE,OAAO,EAAE,qCAAqC,EAAE,OAAO,EAAE,sSAAsS,EAAE;IACnW,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,ivMAAivM,EAAE;IAC7yM,EAAE,OAAO,EAAE,8CAA8C,EAAE,OAAO,EAAE,g/LAAg/L,EAAE;IACtjM,EAAE,OAAO,EAAE,iDAAiD,EAAE,OAAO,EAAE,+5HAA+5H,EAAE;IACx+H,EAAE,OAAO,EAAE,0CAA0C,EAAE,OAAO,EAAE,wyBAAwyB,EAAE;IAC12B,EAAE,OAAO,EAAE,uCAAuC,EAAE,OAAO,EAAE,uRAAuR,EAAE;IACtV,EAAE,OAAO,EAAE,mCAAmC,EAAE,OAAO,EAAE,2tIAA2tI,EAAE;IACtxI,EAAE,OAAO,EAAE,+CAA+C,EAAE,OAAO,EAAE,mrhCAAmrhC,EAAE;IAC1vhC,EAAE,OAAO,EAAE,+CAA+C,EAAE,OAAO,EAAE,g4sDAAg4sD,EAAE;IACv8sD,EAAE,OAAO,EAAE,qCAAqC,EAAE,OAAO,EAAE,2GAA2G,EAAE;IACxK,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,sfAAsf,EAAE;IACpjB,EAAE,OAAO,EAAE,wCAAwC,EAAE,OAAO,EAAE,yRAAyR,EAAE;IACzV,EAAE,OAAO,EAAE,uCAAuC,EAAE,OAAO,EAAE,g9OAAg9O,EAAE;IAC/gP,EAAE,OAAO,EAAE,0DAA0D,EAAE,OAAO,EAAE,4jLAA4jL,EAAE;IAC9oL,EAAE,OAAO,EAAE,oDAAoD,EAAE,OAAO,EAAE,ijHAAijH,EAAE;IAC7nH,EAAE,OAAO,EAAE,6CAA6C,EAAE,OAAO,EAAE,8/BAA8/B,EAAE;IACnkC,EAAE,OAAO,EAAE,0CAA0C,EAAE,OAAO,EAAE,uRAAuR,EAAE;IACzV,EAAE,OAAO,EAAE,+BAA+B,EAAE,OAAO,EAAE,w9LAAw9L,EAAE;IAC/gM,EAAE,OAAO,EAAE,2CAA2C,EAAE,OAAO,EAAE,o8nBAAo8nB,EAAE;IACvgoB,EAAE,OAAO,EAAE,2CAA2C,EAAE,OAAO,EAAE,k1nDAAk1nD,EAAE;IACr5nD,EAAE,OAAO,EAAE,iCAAiC,EAAE,OAAO,EAAE,uGAAuG,EAAE;IAChK,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,kfAAkf,EAAE;IAC5iB,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,qQAAqQ,EAAE;IACjU,EAAE,OAAO,EAAE,mCAAmC,EAAE,OAAO,EAAE,k+LAAk+L,EAAE;IAC7hM,EAAE,OAAO,EAAE,6CAA6C,EAAE,OAAO,EAAE,yrNAAyrN,EAAE;IAC9vN,EAAE,OAAO,EAAE,gDAAgD,EAAE,OAAO,EAAE,o6HAAo6H,EAAE;IAC5+H,EAAE,OAAO,EAAE,yCAAyC,EAAE,OAAO,EAAE,y0CAAy0C,EAAE;IAC14C,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,uRAAuR,EAAE;IACrV,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,i9pBAAi9pB,EAAE;IAC3gqB,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,6EAA6E,EAAE;IACzI,EAAE,OAAO,EAAE,qCAAqC,EAAE,OAAO,EAAE,mXAAmX,EAAE;IAChb,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,urLAAurL,EAAE;IACrvL,EAAE,OAAO,EAAE,4CAA4C,EAAE,OAAO,EAAE,yyFAAyyF,EAAE;IAC72F,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,y1MAAy1M,EAAE;IACn5M,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,0GAA0G,EAAE;IACtK,EAAE,OAAO,EAAE,qCAAqC,EAAE,OAAO,EAAE,okBAAokB,EAAE;IACjoB,EAAE,OAAO,EAAE,uCAAuC,EAAE,OAAO,EAAE,6qBAA6qB,EAAE;IAC5uB,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,uheAAuhe,EAAE;IACrle,EAAE,OAAO,EAAE,wDAAwD,EAAE,OAAO,EAAE,yzJAAyzJ,EAAE;IACz4J,EAAE,OAAO,EAAE,oDAAoD,EAAE,OAAO,EAAE,+9tBAA+9tB,EAAE;IAC3iuB,EAAE,OAAO,EAAE,qDAAqD,EAAE,OAAO,EAAE,mmFAAmmF,EAAE;IAChrF,EAAE,OAAO,EAAE,mDAAmD,EAAE,OAAO,EAAE,ynYAAynY,EAAE;IACpsY,EAAE,OAAO,EAAE,mDAAmD,EAAE,OAAO,EAAE,6rMAA6rM,EAAE;IACxwM,EAAE,OAAO,EAAE,4CAA4C,EAAE,OAAO,EAAE,osHAAosH,EAAE;IACxwH,EAAE,OAAO,EAAE,yCAAyC,EAAE,OAAO,EAAE,6iCAA6iC,EAAE;IAC9mC,EAAE,OAAO,EAAE,wCAAwC,EAAE,OAAO,EAAE,4sFAA4sF,EAAE;IAC5wF,EAAE,OAAO,EAAE,0CAA0C,EAAE,OAAO,EAAE,mFAAmF,EAAE;IACrJ,EAAE,OAAO,EAAE,2CAA2C,EAAE,OAAO,EAAE,yXAAyX,EAAE;IAC5b,EAAE,OAAO,EAAE,4CAA4C,EAAE,OAAO,EAAE,0zmBAA0zmB,EAAE;IAC93mB,EAAE,OAAO,EAAE,kDAAkD,EAAE,OAAO,EAAE,sgVAAsgV,EAAE;IAChlV,EAAE,OAAO,EAAE,+CAA+C,EAAE,OAAO,EAAE,oiCAAoiC,EAAE;IAC3mC,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,65IAA65I,EAAE;IACz9I,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,+EAA+E,EAAE;IAC7I,EAAE,OAAO,EAAE,uCAAuC,EAAE,OAAO,EAAE,qXAAqX,EAAE;IACpb,EAAE,OAAO,EAAE,wCAAwC,EAAE,OAAO,EAAE,w1GAAw1G,EAAE;IACx5G,EAAE,OAAO,EAAE,8CAA8C,EAAE,OAAO,EAAE,68CAA68C,EAAE;IACnhD,EAAE,OAAO,EAAE,2CAA2C,EAAE,OAAO,EAAE,2qBAA2qB,EAAE;IAC9uB,EAAE,OAAO,EAAE,0BAA0B,EAAE,OAAO,EAAE,iwEAAiwE,EAAE;IACnzE,EAAE,OAAO,EAAE,4BAA4B,EAAE,OAAO,EAAE,iGAAiG,EAAE;IACrJ,EAAE,OAAO,EAAE,6BAA6B,EAAE,OAAO,EAAE,2WAA2W,EAAE;IACha,EAAE,OAAO,EAAE,8BAA8B,EAAE,OAAO,EAAE,oiCAAoiC,EAAE;IAC1lC,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,msBAAmsB,EAAE;IAC/vB,EAAE,OAAO,EAAE,4BAA4B,EAAE,OAAO,EAAE,q3JAAq3J,EAAE;IACz6J,EAAE,OAAO,EAAE,8BAA8B,EAAE,OAAO,EAAE,uEAAuE,EAAE;IAC7H,EAAE,OAAO,EAAE,+BAA+B,EAAE,OAAO,EAAE,6WAA6W,EAAE;IACpa,EAAE,OAAO,EAAE,gCAAgC,EAAE,OAAO,EAAE,uiUAAuiU,EAAE;IAC/lU,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,gzCAAgzC,EAAE;CAC/2C,CAAC"}
+{"version":3,"file":"example-files.js","sourceRoot":"","sources":["../../src/generated/example-files.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,kFAAkF;AAClF,iGAAiG;AAQjG,uGAAuG;AACvG,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,OAAO;IACP,SAAS;IACT,eAAe;IACf,gBAAgB;IAChB,YAAY;IACZ,aAAa;IACb,eAAe;IACf,qBAAqB;IACrB,iBAAiB;CAClB,CAAC;AAEF,yGAAyG;AACzG,MAAM,CAAC,MAAM,qBAAqB,GAAkC;IAClE,EAAE,OAAO,EAAE,gCAAgC,EAAE,OAAO,EAAE,4oEAA4oE,EAAE;IACpsE,EAAE,OAAO,EAAE,4CAA4C,EAAE,OAAO,EAAE,u/wBAAu/wB,EAAE;IAC3jxB,EAAE,OAAO,EAAE,6CAA6C,EAAE,OAAO,EAAE,kkQAAkkQ,EAAE;IACvoQ,EAAE,OAAO,EAAE,4CAA4C,EAAE,OAAO,EAAE,klqDAAklqD,EAAE;IACtpqD,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,wGAAwG,EAAE;IAClK,EAAE,OAAO,EAAE,mCAAmC,EAAE,OAAO,EAAE,mfAAmf,EAAE;IAC9iB,EAAE,OAAO,EAAE,qCAAqC,EAAE,OAAO,EAAE,sSAAsS,EAAE;IACnW,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,ivMAAivM,EAAE;IAC7yM,EAAE,OAAO,EAAE,8CAA8C,EAAE,OAAO,EAAE,g/LAAg/L,EAAE;IACtjM,EAAE,OAAO,EAAE,iDAAiD,EAAE,OAAO,EAAE,+5HAA+5H,EAAE;IACx+H,EAAE,OAAO,EAAE,0CAA0C,EAAE,OAAO,EAAE,wyBAAwyB,EAAE;IAC12B,EAAE,OAAO,EAAE,uCAAuC,EAAE,OAAO,EAAE,uRAAuR,EAAE;IACtV,EAAE,OAAO,EAAE,mCAAmC,EAAE,OAAO,EAAE,2tIAA2tI,EAAE;IACtxI,EAAE,OAAO,EAAE,+CAA+C,EAAE,OAAO,EAAE,mrhCAAmrhC,EAAE;IAC1vhC,EAAE,OAAO,EAAE,+CAA+C,EAAE,OAAO,EAAE,g4sDAAg4sD,EAAE;IACv8sD,EAAE,OAAO,EAAE,qCAAqC,EAAE,OAAO,EAAE,2GAA2G,EAAE;IACxK,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,sfAAsf,EAAE;IACpjB,EAAE,OAAO,EAAE,wCAAwC,EAAE,OAAO,EAAE,yRAAyR,EAAE;IACzV,EAAE,OAAO,EAAE,uCAAuC,EAAE,OAAO,EAAE,g9OAAg9O,EAAE;IAC/gP,EAAE,OAAO,EAAE,0DAA0D,EAAE,OAAO,EAAE,4jLAA4jL,EAAE;IAC9oL,EAAE,OAAO,EAAE,oDAAoD,EAAE,OAAO,EAAE,ijHAAijH,EAAE;IAC7nH,EAAE,OAAO,EAAE,6CAA6C,EAAE,OAAO,EAAE,8/BAA8/B,EAAE;IACnkC,EAAE,OAAO,EAAE,0CAA0C,EAAE,OAAO,EAAE,uRAAuR,EAAE;IACzV,EAAE,OAAO,EAAE,+BAA+B,EAAE,OAAO,EAAE,w9LAAw9L,EAAE;IAC/gM,EAAE,OAAO,EAAE,2CAA2C,EAAE,OAAO,EAAE,o8nBAAo8nB,EAAE;IACvgoB,EAAE,OAAO,EAAE,2CAA2C,EAAE,OAAO,EAAE,k1nDAAk1nD,EAAE;IACr5nD,EAAE,OAAO,EAAE,iCAAiC,EAAE,OAAO,EAAE,uGAAuG,EAAE;IAChK,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,kfAAkf,EAAE;IAC5iB,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,qQAAqQ,EAAE;IACjU,EAAE,OAAO,EAAE,mCAAmC,EAAE,OAAO,EAAE,k+LAAk+L,EAAE;IAC7hM,EAAE,OAAO,EAAE,6CAA6C,EAAE,OAAO,EAAE,yrNAAyrN,EAAE;IAC9vN,EAAE,OAAO,EAAE,gDAAgD,EAAE,OAAO,EAAE,o6HAAo6H,EAAE;IAC5+H,EAAE,OAAO,EAAE,yCAAyC,EAAE,OAAO,EAAE,y0CAAy0C,EAAE;IAC14C,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,uRAAuR,EAAE;IACrV,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,y6tBAAy6tB,EAAE;IACn+tB,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,6EAA6E,EAAE;IACzI,EAAE,OAAO,EAAE,qCAAqC,EAAE,OAAO,EAAE,mXAAmX,EAAE;IAChb,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,mgOAAmgO,EAAE;IACjkO,EAAE,OAAO,EAAE,4CAA4C,EAAE,OAAO,EAAE,8xGAA8xG,EAAE;IACl2G,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,y1MAAy1M,EAAE;IACn5M,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,0GAA0G,EAAE;IACtK,EAAE,OAAO,EAAE,qCAAqC,EAAE,OAAO,EAAE,okBAAokB,EAAE;IACjoB,EAAE,OAAO,EAAE,uCAAuC,EAAE,OAAO,EAAE,6qBAA6qB,EAAE;IAC5uB,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,uheAAuhe,EAAE;IACrle,EAAE,OAAO,EAAE,wDAAwD,EAAE,OAAO,EAAE,yzJAAyzJ,EAAE;IACz4J,EAAE,OAAO,EAAE,oDAAoD,EAAE,OAAO,EAAE,+9tBAA+9tB,EAAE;IAC3iuB,EAAE,OAAO,EAAE,qDAAqD,EAAE,OAAO,EAAE,mmFAAmmF,EAAE;IAChrF,EAAE,OAAO,EAAE,mDAAmD,EAAE,OAAO,EAAE,ynYAAynY,EAAE;IACpsY,EAAE,OAAO,EAAE,mDAAmD,EAAE,OAAO,EAAE,6rMAA6rM,EAAE;IACxwM,EAAE,OAAO,EAAE,4CAA4C,EAAE,OAAO,EAAE,osHAAosH,EAAE;IACxwH,EAAE,OAAO,EAAE,yCAAyC,EAAE,OAAO,EAAE,6iCAA6iC,EAAE;IAC9mC,EAAE,OAAO,EAAE,wCAAwC,EAAE,OAAO,EAAE,4sFAA4sF,EAAE;IAC5wF,EAAE,OAAO,EAAE,0CAA0C,EAAE,OAAO,EAAE,mFAAmF,EAAE;IACrJ,EAAE,OAAO,EAAE,2CAA2C,EAAE,OAAO,EAAE,yXAAyX,EAAE;IAC5b,EAAE,OAAO,EAAE,4CAA4C,EAAE,OAAO,EAAE,0zmBAA0zmB,EAAE;IAC93mB,EAAE,OAAO,EAAE,kDAAkD,EAAE,OAAO,EAAE,sgVAAsgV,EAAE;IAChlV,EAAE,OAAO,EAAE,+CAA+C,EAAE,OAAO,EAAE,oiCAAoiC,EAAE;IAC3mC,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,65IAA65I,EAAE;IACz9I,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,+EAA+E,EAAE;IAC7I,EAAE,OAAO,EAAE,uCAAuC,EAAE,OAAO,EAAE,qXAAqX,EAAE;IACpb,EAAE,OAAO,EAAE,wCAAwC,EAAE,OAAO,EAAE,w1GAAw1G,EAAE;IACx5G,EAAE,OAAO,EAAE,8CAA8C,EAAE,OAAO,EAAE,68CAA68C,EAAE;IACnhD,EAAE,OAAO,EAAE,2CAA2C,EAAE,OAAO,EAAE,2qBAA2qB,EAAE;IAC9uB,EAAE,OAAO,EAAE,0BAA0B,EAAE,OAAO,EAAE,iwEAAiwE,EAAE;IACnzE,EAAE,OAAO,EAAE,4BAA4B,EAAE,OAAO,EAAE,iGAAiG,EAAE;IACrJ,EAAE,OAAO,EAAE,6BAA6B,EAAE,OAAO,EAAE,2WAA2W,EAAE;IACha,EAAE,OAAO,EAAE,8BAA8B,EAAE,OAAO,EAAE,oiCAAoiC,EAAE;IAC1lC,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,msBAAmsB,EAAE;IAC/vB,EAAE,OAAO,EAAE,4BAA4B,EAAE,OAAO,EAAE,q3JAAq3J,EAAE;IACz6J,EAAE,OAAO,EAAE,8BAA8B,EAAE,OAAO,EAAE,uEAAuE,EAAE;IAC7H,EAAE,OAAO,EAAE,+BAA+B,EAAE,OAAO,EAAE,6WAA6W,EAAE;IACpa,EAAE,OAAO,EAAE,gCAAgC,EAAE,OAAO,EAAE,uiUAAuiU,EAAE;IAC/lU,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,gzCAAgzC,EAAE;CAC/2C,CAAC"}

package/node_modules/@noodle-borg/agent-kit/dist/generated/surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"surface.d.ts","sourceRoot":"","sources":["../../src/generated/surface.ts"],"names":[],"mappings":"AAIA,qGAAqG;AACrG,eAAO,MAAM,YAAY,EAAE,SAAS,MAAM,EA4DzC,CAAC;AAEF,8FAA8F;AAC9F,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAwBxC,CAAC;AAEF,iGAAiG;AACjG,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EA6DhD,CAAC;AAEF,oGAAoG;AACpG,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAaxC,CAAC"}
+{"version":3,"file":"surface.d.ts","sourceRoot":"","sources":["../../src/generated/surface.ts"],"names":[],"mappings":"AAIA,qGAAqG;AACrG,eAAO,MAAM,YAAY,EAAE,SAAS,MAAM,EA4DzC,CAAC;AAEF,8FAA8F;AAC9F,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAwBxC,CAAC;AAEF,iGAAiG;AACjG,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EA8DhD,CAAC;AAEF,oGAAoG;AACpG,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAaxC,CAAC"}

package/node_modules/@noodle-borg/agent-kit/dist/generated/surface.js

@@ -149,6 +149,7 @@ export const COMPILE_ERROR_CODES = [
     'customer_endpoint_surface_unsupported',
     'customer_endpoint_credential_source_unsupported',
     'customer_endpoint_policy_conflict',
+    'customer_endpoint_routing_inconsistent',
     'unused_connector_alias',
     'arg_mismatch',
 ];

package/node_modules/@noodle-borg/agent-kit/dist/generated/surface.js.map

@@ -1 +1 @@
-{"version":3,"file":"surface.js","sourceRoot":"","sources":["../../src/generated/surface.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,6EAA6E;AAC7E,iGAAiG;AAEjG,qGAAqG;AACrG,MAAM,CAAC,MAAM,YAAY,GAAsB;IAC7C,MAAM;IACN,SAAS;IACT,UAAU;IACV,UAAU;IACV,OAAO;IACP,QAAQ;IACR,MAAM;IACN,OAAO;IACP,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,MAAM;IACN,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,OAAO;IACP,MAAM;IACN,OAAO;IACP,WAAW;IACX,SAAS;IACT,KAAK;IACL,UAAU;IACV,QAAQ;IACR,OAAO;IACP,SAAS;IACT,MAAM;IACN,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,QAAQ;IACR,eAAe;IACf,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,SAAS;IACT,OAAO;IACP,UAAU;IACV,SAAS;IACT,SAAS;IACT,QAAQ;IACR,MAAM;IACN,MAAM;IACN,aAAa;IACb,SAAS;IACT,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,MAAM;IACN,MAAM;IACN,SAAS;IACT,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,SAAS;IACT,WAAW;CACZ,CAAC;AAEF,8FAA8F;AAC9F,MAAM,CAAC,MAAM,WAAW,GAAsB;IAC5C,aAAa;IACb,OAAO;IACP,MAAM;IACN,mBAAmB;IACnB,YAAY;IACZ,WAAW;IACX,cAAc;IACd,kBAAkB;IAClB,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;IAChB,wBAAwB;IACxB,gBAAgB;IAChB,eAAe;IACf,kBAAkB;IAClB,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,UAAU;IACV,MAAM;IACN,GAAG;CACJ,CAAC;AAEF,iGAAiG;AACjG,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACpD,0BAA0B;IAC1B,kBAAkB;IAClB,eAAe;IACf,cAAc;IACd,gBAAgB;IAChB,eAAe;IACf,8BAA8B;IAC9B,6BAA6B;IAC7B,uBAAuB;IACvB,cAAc;IACd,oBAAoB;IACpB,oBAAoB;IACpB,qBAAqB;IACrB,oBAAoB;IACpB,mBAAmB;IACnB,uBAAuB;IACvB,2BAA2B;IAC3B,qBAAqB;IACrB,kBAAkB;IAClB,kBAAkB;IAClB,eAAe;IACf,mBAAmB;IACnB,oBAAoB;IACpB,4BAA4B;IAC5B,0BAA0B;IAC1B,2BAA2B;IAC3B,mBAAmB;IACnB,wBAAwB;IACxB,oBAAoB;IACpB,kBAAkB;IAClB,wBAAwB;IACxB,0BAA0B;IAC1B,kBAAkB;IAClB,qBAAqB;IACrB,4BAA4B;IAC5B,uBAAuB;IACvB,wBAAwB;IACxB,6BAA6B;IAC7B,uBAAuB;IACvB,6BAA6B;IAC7B,eAAe;IACf,gCAAgC;IAChC,oBAAoB;IACpB,yBAAyB;IACzB,0BAA0B;IAC1B,mBAAmB;IACnB,4BAA4B;IAC5B,gCAAgC;IAChC,2BAA2B;IAC3B,8BAA8B;IAC9B,iCAAiC;IACjC,oCAAoC;IACpC,mCAAmC;IACnC,sCAAsC;IACtC,sCAAsC;IACtC,uCAAuC;IACvC,iDAAiD;IACjD,mCAAmC;IACnC,wBAAwB;IACxB,cAAc;CACf,CAAC;AAEF,oGAAoG;AACpG,MAAM,CAAC,MAAM,WAAW,GAAsB;IAC5C,aAAa;IACb,aAAa;IACb,cAAc;IACd,WAAW;IACX,aAAa;IACb,uBAAuB;IACvB,iBAAiB;IACjB,wBAAwB;IACxB,uBAAuB;IACvB,oBAAoB;IACpB,YAAY;IACZ,YAAY;CACb,CAAC"}
+{"version":3,"file":"surface.js","sourceRoot":"","sources":["../../src/generated/surface.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,6EAA6E;AAC7E,iGAAiG;AAEjG,qGAAqG;AACrG,MAAM,CAAC,MAAM,YAAY,GAAsB;IAC7C,MAAM;IACN,SAAS;IACT,UAAU;IACV,UAAU;IACV,OAAO;IACP,QAAQ;IACR,MAAM;IACN,OAAO;IACP,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,MAAM;IACN,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,OAAO;IACP,MAAM;IACN,OAAO;IACP,WAAW;IACX,SAAS;IACT,KAAK;IACL,UAAU;IACV,QAAQ;IACR,OAAO;IACP,SAAS;IACT,MAAM;IACN,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,QAAQ;IACR,eAAe;IACf,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,SAAS;IACT,OAAO;IACP,UAAU;IACV,SAAS;IACT,SAAS;IACT,QAAQ;IACR,MAAM;IACN,MAAM;IACN,aAAa;IACb,SAAS;IACT,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,MAAM;IACN,MAAM;IACN,SAAS;IACT,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,SAAS;IACT,WAAW;CACZ,CAAC;AAEF,8FAA8F;AAC9F,MAAM,CAAC,MAAM,WAAW,GAAsB;IAC5C,aAAa;IACb,OAAO;IACP,MAAM;IACN,mBAAmB;IACnB,YAAY;IACZ,WAAW;IACX,cAAc;IACd,kBAAkB;IAClB,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;IAChB,wBAAwB;IACxB,gBAAgB;IAChB,eAAe;IACf,kBAAkB;IAClB,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,UAAU;IACV,MAAM;IACN,GAAG;CACJ,CAAC;AAEF,iGAAiG;AACjG,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACpD,0BAA0B;IAC1B,kBAAkB;IAClB,eAAe;IACf,cAAc;IACd,gBAAgB;IAChB,eAAe;IACf,8BAA8B;IAC9B,6BAA6B;IAC7B,uBAAuB;IACvB,cAAc;IACd,oBAAoB;IACpB,oBAAoB;IACpB,qBAAqB;IACrB,oBAAoB;IACpB,mBAAmB;IACnB,uBAAuB;IACvB,2BAA2B;IAC3B,qBAAqB;IACrB,kBAAkB;IAClB,kBAAkB;IAClB,eAAe;IACf,mBAAmB;IACnB,oBAAoB;IACpB,4BAA4B;IAC5B,0BAA0B;IAC1B,2BAA2B;IAC3B,mBAAmB;IACnB,wBAAwB;IACxB,oBAAoB;IACpB,kBAAkB;IAClB,wBAAwB;IACxB,0BAA0B;IAC1B,kBAAkB;IAClB,qBAAqB;IACrB,4BAA4B;IAC5B,uBAAuB;IACvB,wBAAwB;IACxB,6BAA6B;IAC7B,uBAAuB;IACvB,6BAA6B;IAC7B,eAAe;IACf,gCAAgC;IAChC,oBAAoB;IACpB,yBAAyB;IACzB,0BAA0B;IAC1B,mBAAmB;IACnB,4BAA4B;IAC5B,gCAAgC;IAChC,2BAA2B;IAC3B,8BAA8B;IAC9B,iCAAiC;IACjC,oCAAoC;IACpC,mCAAmC;IACnC,sCAAsC;IACtC,sCAAsC;IACtC,uCAAuC;IACvC,iDAAiD;IACjD,mCAAmC;IACnC,wCAAwC;IACxC,wBAAwB;IACxB,cAAc;CACf,CAAC;AAEF,oGAAoG;AACpG,MAAM,CAAC,MAAM,WAAW,GAAsB;IAC5C,aAAa;IACb,aAAa;IACb,cAAc;IACd,WAAW;IACX,aAAa;IACb,uBAAuB;IACvB,iBAAiB;IACjB,wBAAwB;IACxB,uBAAuB;IACvB,oBAAoB;IACpB,YAAY;IACZ,YAAY;CACb,CAAC"}

package/node_modules/@noodle-borg/agent-kit/dist/skill-authoring-auth-ref.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-authoring-auth-ref.d.ts","sourceRoot":"","sources":["../src/skill-authoring-auth-ref.ts"],"names":[],"mappings":"AAEA,wBAAgB,mCAAmC,IAAI,SAAS,MAAM,EAAE,CAwKvE"}
+{"version":3,"file":"skill-authoring-auth-ref.d.ts","sourceRoot":"","sources":["../src/skill-authoring-auth-ref.ts"],"names":[],"mappings":"AAEA,wBAAgB,mCAAmC,IAAI,SAAS,MAAM,EAAE,CA4LvE"}

package/node_modules/@noodle-borg/agent-kit/dist/skill-authoring-auth-ref.js

@@ -12,7 +12,7 @@ export function renderCustomerAuthAuthoringSections() {
         'Use a customer endpoint when the verified IdP selects a different API base URL for each SaaS customer. The claim contains the complete base URL; tool input and `${user}` do not select it. Declare one named policy, use that reference as the connector `baseUrl`, and map its claim path in direct OIDC or on every federated issuer:',
         '',
         '```ts',
-        "import { connector, customerAuth, customerEndpoint, secret, server, tool, variable, z } from '@noodleseed/one';",
+        "import { annotations, connector, customerAuth, customerEndpoint, secret, server, tool, variable, z } from '@noodleseed/one';",
         '',
         "const customerApi = customerEndpoint('customer_api', {",
         "  allowedHttpsHostSuffixes: ['api.noodleseed.dev'],",
@@ -34,6 +34,13 @@ export function renderCustomerAuthAuthoringSections() {
         '      input: z.object({}),',
         '      output: z.object({ records: z.array(z.unknown()).max(100) }),',
         '    },',
+        '    archive_record: {',
+        "      type: 'action',",
+        "      method: 'POST',",
+        "      path: '/records/${args.record_id}/archive',",
+        '      input: z.object({ record_id: z.string() }),',
+        '      output: z.object({ archived: z.boolean() }),',
+        '    },',
         '  },',
         '});',
         '',
@@ -43,6 +50,7 @@ export function renderCustomerAuthAuthoringSections() {
         "    title: 'Customer records',",
         "    version: '1.0.0',",
         '    use: { api },',
+        "    interactions: { confirmationFallback: 'host' },",
         '    auth: customerAuth.oidc({',
         "      issuer: 'https://id.noodleseed.dev',",
         "      audience: 'https://org.cloud.noodleseed.dev/app/mcp',",
@@ -63,17 +71,29 @@ export function renderCustomerAuthAuthoringSections() {
         '        return { records: result.records };',
         '      },',
         '    }),',
+        "    tool('archive_record', {",
+        "      description: 'Archive one record for the signed-in customer.',",
+        '      input: z.object({ record_id: z.string() }),',
+        '      output: z.object({ archived: z.boolean() }),',
+        '      annotations: annotations.openAction({ destructive: false, confirm: true }),',
+        '      fulfil({ input, connectors }) {',
+        '        const result = connectors.api.archiveRecord({ record_id: input.record_id });',
+        '        return { archived: result.archived };',
+        '      },',
+        '    }),',
         '  ],',
         ');',
         '```',
         '',
         '`customerEndpoint` accepts exactly one non-empty policy arm: exact HTTPS origins, or HTTPS hostname suffixes. Exact policies may authorize an explicit non-default port; suffix policies allow port 443 and match only the exact host or dot-boundary subdomains. Do not add connector `allowedOrigins` to a customer-routed connector. Its fixed credential/token endpoints are validated independently and cannot come from caller claims.',
         '',
+        "On a bidirectional MCP transport whose client negotiated form elicitation, Noodle sends the standard confirmation form. The current stateless hosted MCP transport cannot initiate that exchange, so the example explicitly declares `server.interactions.confirmationFallback: 'host'`. That fallback trusts the MCP host to have collected native write approval before the tool call reaches Noodle; it is never inferred from client identity and does not replace authentication, authorization, policy, or accurate action/destructive annotations. Omit it when connected hosts are not trusted to provide that approval; confirmation then fails closed with `interaction_unavailable` when the standard exchange is unavailable.",
+        '',
         'Every federated issuer must repeat every endpoint key used by the app, although each issuer may choose a different claim path. Endpoint names use lowercase letters, numbers, and underscores. Resolved claims must be exact absolute HTTPS URLs of at most 2,048 UTF-8 bytes with no userinfo, query, fragment, IP literal, special-use host, or unsafe whitespace/control characters. The runtime preserves a canonical optional base path.',
         '',
-        'Resolved customer URLs are private routing authority: they never enter the manifest/artifact, `${user}`, logs, model output, widgets, confirmation review, cache keys, or delegated-token-exchange assertions. Routed read operations may be used by tools, including their declared nested connector calls. Customer-routed action operations fail compilation with `customer_endpoint_action_unsupported`; routed resources, prompts, and ambient context fail with `customer_endpoint_surface_unsupported` in this release.',
+        'Resolved customer URLs are private routing authority: they never enter the manifest/artifact, `${user}`, logs, model output, widgets, public confirmation review, cache keys, or delegated-token-exchange assertions. Routed reads may be used by tools, including declared nested calls. A routed action—including one reached through a connector wrapper—requires exact `annotations.confirm: true`; omitted or `false` fails with `customer_endpoint_action_unsupported`. Routed resources, prompts, and ambient context fail with `customer_endpoint_surface_unsupported`.',
         '',
-        'At runtime, a missing, malformed, or disallowed claim returns the same safe `connector_route_unavailable` tool error before credential lookup or connector egress. `tools/list` remains based only on roles and scopes, so route availability neither reveals tenant topology nor changes the existing authorization filter.',
+        'At runtime, an initially missing, malformed, or disallowed claim returns the same safe `connector_route_unavailable` tool error before credential lookup or connector egress. Preparation stores only sorted route `{ key, fingerprint }` bindings in the private server-held continuation. Acceptance re-resolves the current request routes; a missing or changed binding returns `invalid_continuation` before policy, credentials, or egress, then the matching frozen snapshot is reused for the action and nested/later calls. `tools/list` remains based only on roles and scopes, so route availability neither reveals tenant topology nor changes the existing authorization filter.',
         '',
         '## Per-tool authorization',
         '',

package/node_modules/@noodle-borg/agent-kit/dist/skill-authoring-auth-ref.js.map

@@ -1 +1 @@
-{"version":3,"file":"skill-authoring-auth-ref.js","sourceRoot":"","sources":["../src/skill-authoring-auth-ref.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAE1F,MAAM,UAAU,mCAAmC;IACjD,OAAO;QACL,0CAA0C;QAC1C,EAAE;QACF,6dAA6d;QAC7d,EAAE;QACF,2uBAA2uB;QAC3uB,EAAE;QACF,wCAAwC;QACxC,EAAE;QACF,0UAA0U;QAC1U,EAAE;QACF,OAAO;QACP,iHAAiH;QACjH,EAAE;QACF,wDAAwD;QACxD,qDAAqD;QACrD,KAAK;QACL,EAAE;QACF,yEAAyE;QACzE,yBAAyB;QACzB,WAAW;QACX,qCAAqC;QACrC,wDAAwD;QACxD,mDAAmD;QACnD,yDAAyD;QACzD,MAAM;QACN,iBAAiB;QACjB,qBAAqB;QACrB,qBAAqB;QACrB,sBAAsB;QACtB,yBAAyB;QACzB,4BAA4B;QAC5B,qEAAqE;QACrE,QAAQ;QACR,MAAM;QACN,KAAK;QACL,EAAE;QACF,wBAAwB;QACxB,uBAAuB;QACvB,KAAK;QACL,gCAAgC;QAChC,uBAAuB;QACvB,mBAAmB;QACnB,+BAA+B;QAC/B,4CAA4C;QAC5C,6DAA6D;QAC7D,kBAAkB;QAClB,sBAAsB;QACtB,2DAA2D;QAC3D,YAAY;QACZ,UAAU;QACV,SAAS;QACT,MAAM;QACN,KAAK;QACL,4BAA4B;QAC5B,gEAAgE;QAChE,4BAA4B;QAC5B,qEAAqE;QACrE,qCAAqC;QACrC,sDAAsD;QACtD,6CAA6C;QAC7C,UAAU;QACV,SAAS;QACT,MAAM;QACN,IAAI;QACJ,KAAK;QACL,EAAE;QACF,8aAA8a;QAC9a,EAAE;QACF,+aAA+a;QAC/a,EAAE;QACF,ggBAAggB;QAChgB,EAAE;QACF,8TAA8T;QAC9T,EAAE;QACF,2BAA2B;QAC3B,EAAE;QACF,4dAA4d;QAC5d,EAAE;QACF,OAAO;QACP,2BAA2B;QAC3B,qCAAqC;QACrC,4CAA4C;QAC5C,yEAAyE;QACzE,KAAK;QACL,EAAE;QACF,yBAAyB;QACzB,oBAAoB;QACpB,wCAAwC;QACxC,gDAAgD;QAChD,MAAM;QACN,uCAAuC;QACvC,IAAI;QACJ,KAAK;QACL,EAAE;QACF,0tBAA0tB;QAC1tB,EAAE;QACF,oEAAoE;QACpE,EAAE;QACF,+NAA+N;QAC/N,EAAE;QACF,8iBAA8iB;QAC9iB,wQAAwQ;QACxQ,sGAAsG;QACtG,EAAE;QACF,sCAAsC;QACtC,EAAE;QACF,OAAO;QACP,SAAS;QACT,mCAAmC;QACnC,8HAA8H;QAC9H,kDAAkD;QAClD,wDAAwD;QACxD,+CAA+C;QAC/C,mGAAmG;QACnG,+EAA+E;QAC/E,GAAG;QACH,KAAK;QACL,EAAE;QACF,2PAA2P;QAC3P,EAAE;QACF,iDAAiD;QACjD,EAAE;QACF,qMAAqM;QACrM,EAAE;QACF,KAAK;QACL,4DAA4D;QAC5D,kDAAkD;QAClD,yDAAyD;QACzD,2DAA2D;QAC3D,6CAA6C;QAC7C,KAAK;QACL,EAAE;QACF,qqBAAqqB;QACrqB,EAAE;QACF,kDAAkD;QAClD,EAAE;QACF,OAAO;QACP,8DAA8D;QAC9D,uDAAuD;QACvD,EAAE;QACF,mGAAmG;QACnG,uFAAuF;QACvF,EAAE;QACF,wEAAwE;QACxE,0EAA0E;QAC1E,yDAAyD;QACzD,mFAAmF;QACnF,2FAA2F;QAC3F,sFAAsF;QACtF,uDAAuD;QACvD,gFAAgF;QAChF,8BAA8B;QAC9B,4GAA4G;QAC5G,OAAO;QACP,0FAA0F;QAC1F,0FAA0F;QAC1F,KAAK;QACL,gGAAgG;QAChG,uGAAuG;QACvG,+FAA+F;QAC/F,GAAG;QACH,KAAK;QACL,EAAE;QACF,2gBAA2gB;QAC3gB,EAAE;KACH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"skill-authoring-auth-ref.js","sourceRoot":"","sources":["../src/skill-authoring-auth-ref.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAE1F,MAAM,UAAU,mCAAmC;IACjD,OAAO;QACL,0CAA0C;QAC1C,EAAE;QACF,6dAA6d;QAC7d,EAAE;QACF,2uBAA2uB;QAC3uB,EAAE;QACF,wCAAwC;QACxC,EAAE;QACF,0UAA0U;QAC1U,EAAE;QACF,OAAO;QACP,8HAA8H;QAC9H,EAAE;QACF,wDAAwD;QACxD,qDAAqD;QACrD,KAAK;QACL,EAAE;QACF,yEAAyE;QACzE,yBAAyB;QACzB,WAAW;QACX,qCAAqC;QACrC,wDAAwD;QACxD,mDAAmD;QACnD,yDAAyD;QACzD,MAAM;QACN,iBAAiB;QACjB,qBAAqB;QACrB,qBAAqB;QACrB,sBAAsB;QACtB,yBAAyB;QACzB,4BAA4B;QAC5B,qEAAqE;QACrE,QAAQ;QACR,uBAAuB;QACvB,uBAAuB;QACvB,uBAAuB;QACvB,mDAAmD;QACnD,mDAAmD;QACnD,oDAAoD;QACpD,QAAQ;QACR,MAAM;QACN,KAAK;QACL,EAAE;QACF,wBAAwB;QACxB,uBAAuB;QACvB,KAAK;QACL,gCAAgC;QAChC,uBAAuB;QACvB,mBAAmB;QACnB,qDAAqD;QACrD,+BAA+B;QAC/B,4CAA4C;QAC5C,6DAA6D;QAC7D,kBAAkB;QAClB,sBAAsB;QACtB,2DAA2D;QAC3D,YAAY;QACZ,UAAU;QACV,SAAS;QACT,MAAM;QACN,KAAK;QACL,4BAA4B;QAC5B,gEAAgE;QAChE,4BAA4B;QAC5B,qEAAqE;QACrE,qCAAqC;QACrC,sDAAsD;QACtD,6CAA6C;QAC7C,UAAU;QACV,SAAS;QACT,8BAA8B;QAC9B,sEAAsE;QACtE,mDAAmD;QACnD,oDAAoD;QACpD,mFAAmF;QACnF,uCAAuC;QACvC,sFAAsF;QACtF,+CAA+C;QAC/C,UAAU;QACV,SAAS;QACT,MAAM;QACN,IAAI;QACJ,KAAK;QACL,EAAE;QACF,8aAA8a;QAC9a,EAAE;QACF,2sBAA2sB;QAC3sB,EAAE;QACF,+aAA+a;QAC/a,EAAE;QACF,ijBAAijB;QACjjB,EAAE;QACF,gqBAAgqB;QAChqB,EAAE;QACF,2BAA2B;QAC3B,EAAE;QACF,4dAA4d;QAC5d,EAAE;QACF,OAAO;QACP,2BAA2B;QAC3B,qCAAqC;QACrC,4CAA4C;QAC5C,yEAAyE;QACzE,KAAK;QACL,EAAE;QACF,yBAAyB;QACzB,oBAAoB;QACpB,wCAAwC;QACxC,gDAAgD;QAChD,MAAM;QACN,uCAAuC;QACvC,IAAI;QACJ,KAAK;QACL,EAAE;QACF,0tBAA0tB;QAC1tB,EAAE;QACF,oEAAoE;QACpE,EAAE;QACF,+NAA+N;QAC/N,EAAE;QACF,8iBAA8iB;QAC9iB,wQAAwQ;QACxQ,sGAAsG;QACtG,EAAE;QACF,sCAAsC;QACtC,EAAE;QACF,OAAO;QACP,SAAS;QACT,mCAAmC;QACnC,8HAA8H;QAC9H,kDAAkD;QAClD,wDAAwD;QACxD,+CAA+C;QAC/C,mGAAmG;QACnG,+EAA+E;QAC/E,GAAG;QACH,KAAK;QACL,EAAE;QACF,2PAA2P;QAC3P,EAAE;QACF,iDAAiD;QACjD,EAAE;QACF,qMAAqM;QACrM,EAAE;QACF,KAAK;QACL,4DAA4D;QAC5D,kDAAkD;QAClD,yDAAyD;QACzD,2DAA2D;QAC3D,6CAA6C;QAC7C,KAAK;QACL,EAAE;QACF,qqBAAqqB;QACrqB,EAAE;QACF,kDAAkD;QAClD,EAAE;QACF,OAAO;QACP,8DAA8D;QAC9D,uDAAuD;QACvD,EAAE;QACF,mGAAmG;QACnG,uFAAuF;QACvF,EAAE;QACF,wEAAwE;QACxE,0EAA0E;QAC1E,yDAAyD;QACzD,mFAAmF;QACnF,2FAA2F;QAC3F,sFAAsF;QACtF,uDAAuD;QACvD,gFAAgF;QAChF,8BAA8B;QAC9B,4GAA4G;QAC5G,OAAO;QACP,0FAA0F;QAC1F,0FAA0F;QAC1F,KAAK;QACL,gGAAgG;QAChG,uGAAuG;QACvG,+FAA+F;QAC/F,GAAG;QACH,KAAK;QACL,EAAE;QACF,2gBAA2gB;QAC3gB,EAAE;KACH,CAAC;AACJ,CAAC"}

package/node_modules/@noodle-borg/agent-kit/dist/skill-authoring-refs.js

@@ -519,7 +519,7 @@ const FLAGSHIP_EXAMPLES = [
     ],
     [
         'customer-auth',
-        'End-user (customer) auth via OIDC/Firebase bridge with delegated credentials.',
+        'End-user OIDC, private customer API routing, route-bound confirmed actions, roles/scopes, and delegated credentials.',
     ],
     ['stateful-draft', 'Durable, caller-scoped widget state handles with optimistic revisions.'],
     ['perplexity', 'A real SaaS API with bearer auth and a managed `secret`.'],

package/node_modules/@noodle-borg/agent-kit/dist/skill-authoring-refs.js.map

@@ -1 +1 @@
-{"version":3,"file":"skill-authoring-refs.js","sourceRoot":"","sources":["../src/skill-authoring-refs.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,8FAA8F;AAC9F,4FAA4F;AAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,mCAAmC,EAAE,MAAM,+BAA+B,CAAC;AAEpF,+EAA+E;AAC/E,6CAA6C;AAC7C,EAAE;AACF,iGAAiG;AACjG,qGAAqG;AACrG,gGAAgG;AAChG,+EAA+E;AAE/E,MAAM,UAAU,gCAAgC;IAC9C,OAAO;QACL,sBAAsB;QACtB,EAAE;QACF,aAAa;QACb,EAAE;QACF,eAAe;QACf,aAAa;QACb,eAAe;QACf,cAAc;QACd,wCAAwC;QACxC,yCAAyC;QACzC,uCAAuC;QACvC,0BAA0B;QAC1B,mEAAmE;QACnE,sBAAsB;QACtB,6BAA6B;QAC7B,SAAS;QACT,yBAAyB;QACzB,sBAAsB;QACtB,cAAc;QACd,EAAE;QACF,gBAAgB;QAChB,EAAE;QACF,oUAAoU;QACpU,oJAAoJ;QACpJ,+TAA+T;QAC/T,EAAE;QACF,cAAc;QACd,EAAE;QACF,gVAAgV;QAChV,EAAE;QACF,gBAAgB;QAChB,EAAE;QACF,gLAAgL;QAChL,EAAE;QACF,eAAe;QACf,EAAE;QACF,kDAAkD;QAClD,EAAE;QACF,uMAAuM;QACvM,+NAA+N;QAC/N,EAAE;QACF,mKAAmK;QACnK,EAAE;QACF,kbAAkb;QAClb,EAAE;QACF,w4DAAw4D;QACx4D,EAAE;QACF,yCAAyC;QACzC,EAAE;QACF,yaAAya;QACza,EAAE;QACF,OAAO;QACP,iFAAiF;QACjF,EAAE;QACF,sDAAsD;QACtD,sCAAsC;QACtC,gDAAgD;QAChD,0DAA0D;QAC1D,iBAAiB;QACjB,sBAAsB;QACtB,qBAAqB;QACrB,sBAAsB;QACtB,2BAA2B;QAC3B,yBAAyB;QACzB,+CAA+C;QAC/C,0EAA0E;QAC1E,qFAAqF;QACrF,QAAQ;QACR,sBAAsB;QACtB,uBAAuB;QACvB,uBAAuB;QACvB,yBAAyB;QACzB,uEAAuE;QACvE,oDAAoD;QACpD,8EAA8E;QAC9E,kDAAkD;QAClD,QAAQ;QACR,MAAM;QACN,KAAK;QACL,EAAE;QACF,0FAA0F;QAC1F,2BAA2B;QAC3B,uDAAuD;QACvD,6CAA6C;QAC7C,wEAAwE;QACxE,0CAA0C;QAC1C,8EAA8E;QAC9E,wDAAwD;QACxD,QAAQ;QACR,OAAO;QACP,yBAAyB;QACzB,2DAA2D;QAC3D,qEAAqE;QACrE,kDAAkD;QAClD,0CAA0C;QAC1C,0GAA0G;QAC1G,+CAA+C;QAC/C,QAAQ;QACR,OAAO;QACP,KAAK;QACL,KAAK;QACL,EAAE;QACF,koBAAkoB;QACloB,EAAE;QACF,+vBAA+vB;QAC/vB,EAAE;QACF,GAAG,mCAAmC,EAAE;QACxC,+BAA+B;QAC/B,EAAE;QACF,+NAA+N;QAC/N,EAAE;QACF,uBAAuB;QACvB,EAAE;QACF,wcAAwc;QACxc,EAAE;QACF,OAAO;QACP,YAAY;QACZ,6DAA6D;QAC7D,cAAc;QACd,qFAAqF;QACrF,kDAAkD;QAClD,wDAAwD;QACxD,gCAAgC;QAChC,yCAAyC;QACzC,WAAW;QACX,wFAAwF;QACxF,QAAQ;QACR,MAAM;QACN,IAAI;QACJ,KAAK;QACL,EAAE;QACF,miBAAmiB;QACniB,EAAE;QACF,qCAAqC;QACrC,EAAE;QACF,2MAA2M;QAC3M,EAAE;QACF,OAAO;QACP,4BAA4B;QAC5B,0EAA0E;QAC1E,4DAA4D;QAC5D,iFAAiF;QACjF,oCAAoC;QACpC,6BAA6B;QAC7B,0BAA0B;QAC1B,2DAA2D;QAC3D,iEAAiE;QACjE,SAAS;QACT,2EAA2E;QAC3E,MAAM;QACN,KAAK;QACL,KAAK;QACL,EAAE;QACF,iwEAAiwE;QACjwE,EAAE;QACF,8BAA8B;QAC9B,EAAE;QACF,OAAO;QACP,8EAA8E;QAC9E,4EAA4E;QAC5E,4CAA4C;QAC5C,kDAAkD;QAClD,iDAAiD;QACjD,mCAAmC;QACnC,iGAAiG;QACjG,4EAA4E;QAC5E,MAAM;QACN,KAAK;QACL,KAAK;QACL,EAAE;QACF,uUAAuU;QACvU,EAAE;QACF,UAAU;QACV,EAAE;QACF,uPAAuP;QACvP,EAAE;QACF,OAAO;QACP,gDAAgD;QAChD,qCAAqC;QACrC,EAAE;QACF,4BAA4B;QAC5B,oDAAoD;QACpD,iDAAiD;QACjD,OAAO;QACP,KAAK;QACL,KAAK;QACL,EAAE;QACF,yIAAyI;QACzI,EAAE;QACF,0BAA0B;QAC1B,EAAE;QACF,8NAA8N;QAC9N,EAAE;QACF,uBAAuB;QACvB,EAAE;QACF,wWAAwW;QACxW,EAAE;QACF,eAAe;QACf,EAAE;QACF,uTAAuT;KACxT,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,kGAAkG;AAClG,EAAE;AACF,+FAA+F;AAC/F,oGAAoG;AACpG,oGAAoG;AACpG,2EAA2E;AAC3E,+EAA+E;AAE/E,MAAM,UAAU,6BAA6B;IAC3C,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IACrF,OAAO;QACL,wBAAwB;QACxB,EAAE;QACF,aAAa;QACb,EAAE;QACF,mBAAmB;QACnB,sBAAsB;QACtB,wBAAwB;QACxB,wCAAwC;QACxC,0CAA0C;QAC1C,+BAA+B;QAC/B,4BAA4B;QAC5B,EAAE;QACF,oBAAoB;QACpB,EAAE;QACF,uVAAuV;QACvV,EAAE;QACF,0BAA0B;QAC1B,EAAE;QACF,uRAAuR;QACvR,EAAE;QACF,uWAAuW;QACvW,EAAE;QACF,kgBAAkgB;QAClgB,EAAE;QACF,kZAAkZ;QAClZ,EAAE;QACF,wcAAwc;QACxc,EAAE;QACF,4bAA4b;QAC5b,EAAE;QACF,uBAAuB;QACvB,EAAE;QACF,sIAAsI;QACtI,EAAE;QACF,OAAO,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC;QACtC,EAAE;QACF,m1DAAm1D;QACn1D,EAAE;QACF,yBAAyB;QACzB,EAAE;QACF,mOAAmO;QACnO,EAAE;QACF,2BAA2B;QAC3B,EAAE;QACF,gZAAgZ;QAChZ,EAAE;QACF,QAAQ;QACR,oCAAoC;QACpC,0DAA0D;QAC1D,0IAA0I;QAC1I,EAAE;QACF,qFAAqF;QACrF,mJAAmJ;QACnJ,wCAAwC;QACxC,EAAE;QACF,sBAAsB;QACtB,8BAA8B;QAC9B,0BAA0B;QAC1B,2BAA2B;QAC3B,iCAAiC;QACjC,IAAI;QACJ,EAAE;QACF,gEAAgE;QAChE,kEAAkE;QAClE,iDAAiD;QACjD,YAAY;QACZ,0EAA0E;QAC1E,kEAAkE;QAClE,0EAA0E;QAC1E,yFAAyF;QACzF,MAAM;QACN,GAAG;QACH,EAAE;QACF,yCAAyC;QACzC,+CAA+C;QAC/C,yDAAyD;QACzD,qGAAqG;QACrG,uFAAuF;QACvF,qCAAqC;QACrC,2CAA2C;QAC3C,yDAAyD;QACzD,uDAAuD;QACvD,gEAAgE;QAChE,sGAAsG;QACtG,qGAAqG;QACrG,oCAAoC;QACpC,iDAAiD;QACjD,EAAE;QACF,qBAAqB;QACrB,oDAAoD;QACpD,+BAA+B;QAC/B,mFAAmF;QACnF,6GAA6G;QAC7G,SAAS;QACT,yEAAyE;QACzE,EAAE;QACF,kCAAkC;QAClC,yBAAyB;QACzB,oEAAoE;QACpE,mCAAmC;QACnC,oGAAoG;QACpG,OAAO;QACP,sCAAsC;QACtC,iHAAiH;QACjH,OAAO;QACP,KAAK;QACL,EAAE;QACF,mFAAmF;QACnF,+FAA+F;QAC/F,4FAA4F;QAC5F,EAAE;QACF,YAAY;QACZ,kGAAkG;QAClG,8HAA8H;QAC9H,8BAA8B;QAC9B,oGAAoG;QACpG,wEAAwE;QACxE,4BAA4B;QAC5B,kGAAkG;QAClG,6DAA6D;QAC7D,2DAA2D;QAC3D,+DAA+D;QAC/D,eAAe;QACf,gBAAgB;QAChB,iBAAiB;QACjB,6FAA6F;QAC7F,mBAAmB;QACnB,wFAAwF;QACxF,+BAA+B;QAC/B,SAAS;QACT,qBAAqB;QACrB,iBAAiB;QACjB,0DAA0D;QAC1D,2BAA2B;QAC3B,iBAAiB;QACjB,oBAAoB;QACpB,wBAAwB;QACxB,eAAe;QACf,cAAc;QACd,MAAM;QACN,GAAG;QACH,KAAK;QACL,EAAE;QACF,6BAA6B;QAC7B,EAAE;QACF,2bAA2b;QAC3b,EAAE;QACF,OAAO;QACP,iEAAiE;QACjE,EAAE;QACF,gGAAgG;QAChG,2CAA2C;QAC3C,6DAA6D;QAC7D,EAAE;QACF,wBAAwB;QACxB,aAAa;QACb,KAAK;QACL,sBAAsB;QACtB,uBAAuB;QACvB,yGAAyG;QACzG,kEAAkE;QAClE,MAAM;QACN,KAAK;QACL,0BAA0B;QAC1B,6EAA6E;QAC7E,8FAA8F;QAC9F,4CAA4C;QAC5C,mEAAmE;QACnE,0BAA0B;QAC1B,+BAA+B;QAC/B,2BAA2B;QAC3B,4BAA4B;QAC5B,kCAAkC;QAClC,WAAW;QACX,iCAAiC;QACjC,mCAAmC;QACnC,+BAA+B;QAC/B,oBAAoB;QACpB,mDAAmD;QACnD,WAAW;QACX,kCAAkC;QAClC,kEAAkE;QAClE,6EAA6E;QAC7E,6CAA6C;QAC7C,+EAA+E;QAC/E,cAAc;QACd,yDAAyD;QACzD,mDAAmD;QACnD,gGAAgG;QAChG,yFAAyF;QACzF,UAAU;QACV,SAAS;QACT,kGAAkG;QAClG,2BAA2B;QAC3B,4BAA4B;QAC5B,6DAA6D;QAC7D,gGAAgG;QAChG,4DAA4D;QAC5D,yEAAyE;QACzE,4FAA4F;QAC5F,iCAAiC;QACjC,wDAAwD;QACxD,2BAA2B;QAC3B,mDAAmD;QACnD,WAAW;QACX,SAAS;QACT,MAAM;QACN,IAAI;QACJ,KAAK;QACL,EAAE;QACF,yCAAyC;QACzC,EAAE;QACF,2KAA2K;QAC3K,EAAE;QACF,yHAAyH;QACzH,4TAA4T;QAC5T,0FAA0F;QAC1F,EAAE;QACF,qXAAqX;QACrX,EAAE;QACF,sbAAsb;QACtb,EAAE;QACF,odAAod;QACpd,EAAE;QACF,oDAAoD;QACpD,EAAE;QACF,2PAA2P;QAC3P,EAAE;QACF,OAAO;QACP,iEAAiE;QACjE,EAAE;QACF,8EAA8E;QAC9E,oBAAoB;QACpB,wEAAwE;QACxE,0CAA0C;QAC1C,6CAA6C;QAC7C,wBAAwB;QACxB,2FAA2F;QAC3F,SAAS;QACT,gIAAgI;QAChI,OAAO;QACP,mBAAmB;QACnB,4DAA4D;QAC5D,0CAA0C;QAC1C,0CAA0C;QAC1C,iGAAiG;QACjG,6HAA6H;QAC7H,OAAO;QACP,KAAK;QACL,KAAK;QACL,EAAE;QACF,oKAAoK;QACpK,EAAE;QACF,gCAAgC;QAChC,EAAE;QACF,mSAAmS;QACnS,EAAE;QACF,6BAA6B;QAC7B,EAAE;QACF,wKAAwK;QACxK,EAAE;QACF,4OAA4O;KAC7O,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,mEAAmE;AACnE,+EAA+E;AAE/E,MAAM,iBAAiB,GAA6C;IAClE,CAAC,OAAO,EAAE,uEAAuE,CAAC;IAClF;QACE,SAAS;QACT,+IAA+I;KAChJ;IACD;QACE,eAAe;QACf,iGAAiG;KAClG;IACD;QACE,gBAAgB;QAChB,8HAA8H;KAC/H;IACD;QACE,YAAY;QACZ,kJAAkJ;KACnJ;IACD;QACE,aAAa;QACb,+IAA+I;KAChJ;IACD;QACE,eAAe;QACf,+EAA+E;KAChF;IACD,CAAC,gBAAgB,EAAE,wEAAwE,CAAC;IAC5F,CAAC,YAAY,EAAE,0DAA0D,CAAC;IAC1E,CAAC,SAAS,EAAE,wEAAwE,CAAC;IACrF;QACE,qBAAqB;QACrB,mKAAmK;KACpK;IACD;QACE,iBAAiB;QACjB,4JAA4J;KAC7J;IACD,CAAC,YAAY,EAAE,sEAAsE,CAAC;IACtF;QACE,mBAAmB;QACnB,+EAA+E;KAChF;IACD,CAAC,gBAAgB,EAAE,2EAA2E,CAAC;CAChG,CAAC;AAEF,MAAM,UAAU,uBAAuB;IACrC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC/C,gGAAgG;IAChG,oGAAoG;IACpG,MAAM,YAAY,GAAG,qBAAqB,CAAC,MAAM,CAC/C,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,SAAS,KAAK,IAAI,CAAC,CACvE,CAAC;IACF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,+EAA+E,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzG,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,IAAY,EAAW,EAAE,CAC1C,qBAAqB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,IAAI,UAAU,CAAC,CAAC,CAAC;IAE5F,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAC7E,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QACnB,KAAK,IAAI,IAAI;QACb,OAAO;QACP,cAAc,IAAI,mBAAmB,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE;KAC7E,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAC3E,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,EAAE,OAAO,CAAC,CAC9C,CAAC;IAEF,OAAO;QACL,YAAY;QACZ,EAAE;QACF,0YAA0Y;QAC1Y,EAAE;QACF,yCAAyC;QACzC,EAAE;QACF,+OAA+O;QAC/O,EAAE;QACF,OAAO,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,CAAC;QACrD,EAAE;QACF,0DAA0D;QAC1D,EAAE;QACF,OAAO,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC;QAC1C,EAAE;QACF,wBAAwB;QACxB,EAAE;QACF,yEAAyE;QACzE,EAAE;QACF,OAAO;QACP,oDAAoD;QACpD,EAAE;QACF,wEAAwE;QACxE,mBAAmB;QACnB,4CAA4C;QAC5C,4CAA4C;QAC5C,iDAAiD;QACjD,qEAAqE;QACrE,OAAO;QACP,KAAK;QACL,KAAK;KACN,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}
+{"version":3,"file":"skill-authoring-refs.js","sourceRoot":"","sources":["../src/skill-authoring-refs.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,8FAA8F;AAC9F,4FAA4F;AAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,mCAAmC,EAAE,MAAM,+BAA+B,CAAC;AAEpF,+EAA+E;AAC/E,6CAA6C;AAC7C,EAAE;AACF,iGAAiG;AACjG,qGAAqG;AACrG,gGAAgG;AAChG,+EAA+E;AAE/E,MAAM,UAAU,gCAAgC;IAC9C,OAAO;QACL,sBAAsB;QACtB,EAAE;QACF,aAAa;QACb,EAAE;QACF,eAAe;QACf,aAAa;QACb,eAAe;QACf,cAAc;QACd,wCAAwC;QACxC,yCAAyC;QACzC,uCAAuC;QACvC,0BAA0B;QAC1B,mEAAmE;QACnE,sBAAsB;QACtB,6BAA6B;QAC7B,SAAS;QACT,yBAAyB;QACzB,sBAAsB;QACtB,cAAc;QACd,EAAE;QACF,gBAAgB;QAChB,EAAE;QACF,oUAAoU;QACpU,oJAAoJ;QACpJ,+TAA+T;QAC/T,EAAE;QACF,cAAc;QACd,EAAE;QACF,gVAAgV;QAChV,EAAE;QACF,gBAAgB;QAChB,EAAE;QACF,gLAAgL;QAChL,EAAE;QACF,eAAe;QACf,EAAE;QACF,kDAAkD;QAClD,EAAE;QACF,uMAAuM;QACvM,+NAA+N;QAC/N,EAAE;QACF,mKAAmK;QACnK,EAAE;QACF,kbAAkb;QAClb,EAAE;QACF,w4DAAw4D;QACx4D,EAAE;QACF,yCAAyC;QACzC,EAAE;QACF,yaAAya;QACza,EAAE;QACF,OAAO;QACP,iFAAiF;QACjF,EAAE;QACF,sDAAsD;QACtD,sCAAsC;QACtC,gDAAgD;QAChD,0DAA0D;QAC1D,iBAAiB;QACjB,sBAAsB;QACtB,qBAAqB;QACrB,sBAAsB;QACtB,2BAA2B;QAC3B,yBAAyB;QACzB,+CAA+C;QAC/C,0EAA0E;QAC1E,qFAAqF;QACrF,QAAQ;QACR,sBAAsB;QACtB,uBAAuB;QACvB,uBAAuB;QACvB,yBAAyB;QACzB,uEAAuE;QACvE,oDAAoD;QACpD,8EAA8E;QAC9E,kDAAkD;QAClD,QAAQ;QACR,MAAM;QACN,KAAK;QACL,EAAE;QACF,0FAA0F;QAC1F,2BAA2B;QAC3B,uDAAuD;QACvD,6CAA6C;QAC7C,wEAAwE;QACxE,0CAA0C;QAC1C,8EAA8E;QAC9E,wDAAwD;QACxD,QAAQ;QACR,OAAO;QACP,yBAAyB;QACzB,2DAA2D;QAC3D,qEAAqE;QACrE,kDAAkD;QAClD,0CAA0C;QAC1C,0GAA0G;QAC1G,+CAA+C;QAC/C,QAAQ;QACR,OAAO;QACP,KAAK;QACL,KAAK;QACL,EAAE;QACF,koBAAkoB;QACloB,EAAE;QACF,+vBAA+vB;QAC/vB,EAAE;QACF,GAAG,mCAAmC,EAAE;QACxC,+BAA+B;QAC/B,EAAE;QACF,+NAA+N;QAC/N,EAAE;QACF,uBAAuB;QACvB,EAAE;QACF,wcAAwc;QACxc,EAAE;QACF,OAAO;QACP,YAAY;QACZ,6DAA6D;QAC7D,cAAc;QACd,qFAAqF;QACrF,kDAAkD;QAClD,wDAAwD;QACxD,gCAAgC;QAChC,yCAAyC;QACzC,WAAW;QACX,wFAAwF;QACxF,QAAQ;QACR,MAAM;QACN,IAAI;QACJ,KAAK;QACL,EAAE;QACF,miBAAmiB;QACniB,EAAE;QACF,qCAAqC;QACrC,EAAE;QACF,2MAA2M;QAC3M,EAAE;QACF,OAAO;QACP,4BAA4B;QAC5B,0EAA0E;QAC1E,4DAA4D;QAC5D,iFAAiF;QACjF,oCAAoC;QACpC,6BAA6B;QAC7B,0BAA0B;QAC1B,2DAA2D;QAC3D,iEAAiE;QACjE,SAAS;QACT,2EAA2E;QAC3E,MAAM;QACN,KAAK;QACL,KAAK;QACL,EAAE;QACF,iwEAAiwE;QACjwE,EAAE;QACF,8BAA8B;QAC9B,EAAE;QACF,OAAO;QACP,8EAA8E;QAC9E,4EAA4E;QAC5E,4CAA4C;QAC5C,kDAAkD;QAClD,iDAAiD;QACjD,mCAAmC;QACnC,iGAAiG;QACjG,4EAA4E;QAC5E,MAAM;QACN,KAAK;QACL,KAAK;QACL,EAAE;QACF,uUAAuU;QACvU,EAAE;QACF,UAAU;QACV,EAAE;QACF,uPAAuP;QACvP,EAAE;QACF,OAAO;QACP,gDAAgD;QAChD,qCAAqC;QACrC,EAAE;QACF,4BAA4B;QAC5B,oDAAoD;QACpD,iDAAiD;QACjD,OAAO;QACP,KAAK;QACL,KAAK;QACL,EAAE;QACF,yIAAyI;QACzI,EAAE;QACF,0BAA0B;QAC1B,EAAE;QACF,8NAA8N;QAC9N,EAAE;QACF,uBAAuB;QACvB,EAAE;QACF,wWAAwW;QACxW,EAAE;QACF,eAAe;QACf,EAAE;QACF,uTAAuT;KACxT,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,kGAAkG;AAClG,EAAE;AACF,+FAA+F;AAC/F,oGAAoG;AACpG,oGAAoG;AACpG,2EAA2E;AAC3E,+EAA+E;AAE/E,MAAM,UAAU,6BAA6B;IAC3C,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IACrF,OAAO;QACL,wBAAwB;QACxB,EAAE;QACF,aAAa;QACb,EAAE;QACF,mBAAmB;QACnB,sBAAsB;QACtB,wBAAwB;QACxB,wCAAwC;QACxC,0CAA0C;QAC1C,+BAA+B;QAC/B,4BAA4B;QAC5B,EAAE;QACF,oBAAoB;QACpB,EAAE;QACF,uVAAuV;QACvV,EAAE;QACF,0BAA0B;QAC1B,EAAE;QACF,uRAAuR;QACvR,EAAE;QACF,uWAAuW;QACvW,EAAE;QACF,kgBAAkgB;QAClgB,EAAE;QACF,kZAAkZ;QAClZ,EAAE;QACF,wcAAwc;QACxc,EAAE;QACF,4bAA4b;QAC5b,EAAE;QACF,uBAAuB;QACvB,EAAE;QACF,sIAAsI;QACtI,EAAE;QACF,OAAO,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC;QACtC,EAAE;QACF,m1DAAm1D;QACn1D,EAAE;QACF,yBAAyB;QACzB,EAAE;QACF,mOAAmO;QACnO,EAAE;QACF,2BAA2B;QAC3B,EAAE;QACF,gZAAgZ;QAChZ,EAAE;QACF,QAAQ;QACR,oCAAoC;QACpC,0DAA0D;QAC1D,0IAA0I;QAC1I,EAAE;QACF,qFAAqF;QACrF,mJAAmJ;QACnJ,wCAAwC;QACxC,EAAE;QACF,sBAAsB;QACtB,8BAA8B;QAC9B,0BAA0B;QAC1B,2BAA2B;QAC3B,iCAAiC;QACjC,IAAI;QACJ,EAAE;QACF,gEAAgE;QAChE,kEAAkE;QAClE,iDAAiD;QACjD,YAAY;QACZ,0EAA0E;QAC1E,kEAAkE;QAClE,0EAA0E;QAC1E,yFAAyF;QACzF,MAAM;QACN,GAAG;QACH,EAAE;QACF,yCAAyC;QACzC,+CAA+C;QAC/C,yDAAyD;QACzD,qGAAqG;QACrG,uFAAuF;QACvF,qCAAqC;QACrC,2CAA2C;QAC3C,yDAAyD;QACzD,uDAAuD;QACvD,gEAAgE;QAChE,sGAAsG;QACtG,qGAAqG;QACrG,oCAAoC;QACpC,iDAAiD;QACjD,EAAE;QACF,qBAAqB;QACrB,oDAAoD;QACpD,+BAA+B;QAC/B,mFAAmF;QACnF,6GAA6G;QAC7G,SAAS;QACT,yEAAyE;QACzE,EAAE;QACF,kCAAkC;QAClC,yBAAyB;QACzB,oEAAoE;QACpE,mCAAmC;QACnC,oGAAoG;QACpG,OAAO;QACP,sCAAsC;QACtC,iHAAiH;QACjH,OAAO;QACP,KAAK;QACL,EAAE;QACF,mFAAmF;QACnF,+FAA+F;QAC/F,4FAA4F;QAC5F,EAAE;QACF,YAAY;QACZ,kGAAkG;QAClG,8HAA8H;QAC9H,8BAA8B;QAC9B,oGAAoG;QACpG,wEAAwE;QACxE,4BAA4B;QAC5B,kGAAkG;QAClG,6DAA6D;QAC7D,2DAA2D;QAC3D,+DAA+D;QAC/D,eAAe;QACf,gBAAgB;QAChB,iBAAiB;QACjB,6FAA6F;QAC7F,mBAAmB;QACnB,wFAAwF;QACxF,+BAA+B;QAC/B,SAAS;QACT,qBAAqB;QACrB,iBAAiB;QACjB,0DAA0D;QAC1D,2BAA2B;QAC3B,iBAAiB;QACjB,oBAAoB;QACpB,wBAAwB;QACxB,eAAe;QACf,cAAc;QACd,MAAM;QACN,GAAG;QACH,KAAK;QACL,EAAE;QACF,6BAA6B;QAC7B,EAAE;QACF,2bAA2b;QAC3b,EAAE;QACF,OAAO;QACP,iEAAiE;QACjE,EAAE;QACF,gGAAgG;QAChG,2CAA2C;QAC3C,6DAA6D;QAC7D,EAAE;QACF,wBAAwB;QACxB,aAAa;QACb,KAAK;QACL,sBAAsB;QACtB,uBAAuB;QACvB,yGAAyG;QACzG,kEAAkE;QAClE,MAAM;QACN,KAAK;QACL,0BAA0B;QAC1B,6EAA6E;QAC7E,8FAA8F;QAC9F,4CAA4C;QAC5C,mEAAmE;QACnE,0BAA0B;QAC1B,+BAA+B;QAC/B,2BAA2B;QAC3B,4BAA4B;QAC5B,kCAAkC;QAClC,WAAW;QACX,iCAAiC;QACjC,mCAAmC;QACnC,+BAA+B;QAC/B,oBAAoB;QACpB,mDAAmD;QACnD,WAAW;QACX,kCAAkC;QAClC,kEAAkE;QAClE,6EAA6E;QAC7E,6CAA6C;QAC7C,+EAA+E;QAC/E,cAAc;QACd,yDAAyD;QACzD,mDAAmD;QACnD,gGAAgG;QAChG,yFAAyF;QACzF,UAAU;QACV,SAAS;QACT,kGAAkG;QAClG,2BAA2B;QAC3B,4BAA4B;QAC5B,6DAA6D;QAC7D,gGAAgG;QAChG,4DAA4D;QAC5D,yEAAyE;QACzE,4FAA4F;QAC5F,iCAAiC;QACjC,wDAAwD;QACxD,2BAA2B;QAC3B,mDAAmD;QACnD,WAAW;QACX,SAAS;QACT,MAAM;QACN,IAAI;QACJ,KAAK;QACL,EAAE;QACF,yCAAyC;QACzC,EAAE;QACF,2KAA2K;QAC3K,EAAE;QACF,yHAAyH;QACzH,4TAA4T;QAC5T,0FAA0F;QAC1F,EAAE;QACF,qXAAqX;QACrX,EAAE;QACF,sbAAsb;QACtb,EAAE;QACF,odAAod;QACpd,EAAE;QACF,oDAAoD;QACpD,EAAE;QACF,2PAA2P;QAC3P,EAAE;QACF,OAAO;QACP,iEAAiE;QACjE,EAAE;QACF,8EAA8E;QAC9E,oBAAoB;QACpB,wEAAwE;QACxE,0CAA0C;QAC1C,6CAA6C;QAC7C,wBAAwB;QACxB,2FAA2F;QAC3F,SAAS;QACT,gIAAgI;QAChI,OAAO;QACP,mBAAmB;QACnB,4DAA4D;QAC5D,0CAA0C;QAC1C,0CAA0C;QAC1C,iGAAiG;QACjG,6HAA6H;QAC7H,OAAO;QACP,KAAK;QACL,KAAK;QACL,EAAE;QACF,oKAAoK;QACpK,EAAE;QACF,gCAAgC;QAChC,EAAE;QACF,mSAAmS;QACnS,EAAE;QACF,6BAA6B;QAC7B,EAAE;QACF,wKAAwK;QACxK,EAAE;QACF,4OAA4O;KAC7O,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,mEAAmE;AACnE,+EAA+E;AAE/E,MAAM,iBAAiB,GAA6C;IAClE,CAAC,OAAO,EAAE,uEAAuE,CAAC;IAClF;QACE,SAAS;QACT,+IAA+I;KAChJ;IACD;QACE,eAAe;QACf,iGAAiG;KAClG;IACD;QACE,gBAAgB;QAChB,8HAA8H;KAC/H;IACD;QACE,YAAY;QACZ,kJAAkJ;KACnJ;IACD;QACE,aAAa;QACb,+IAA+I;KAChJ;IACD;QACE,eAAe;QACf,sHAAsH;KACvH;IACD,CAAC,gBAAgB,EAAE,wEAAwE,CAAC;IAC5F,CAAC,YAAY,EAAE,0DAA0D,CAAC;IAC1E,CAAC,SAAS,EAAE,wEAAwE,CAAC;IACrF;QACE,qBAAqB;QACrB,mKAAmK;KACpK;IACD;QACE,iBAAiB;QACjB,4JAA4J;KAC7J;IACD,CAAC,YAAY,EAAE,sEAAsE,CAAC;IACtF;QACE,mBAAmB;QACnB,+EAA+E;KAChF;IACD,CAAC,gBAAgB,EAAE,2EAA2E,CAAC;CAChG,CAAC;AAEF,MAAM,UAAU,uBAAuB;IACrC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC/C,gGAAgG;IAChG,oGAAoG;IACpG,MAAM,YAAY,GAAG,qBAAqB,CAAC,MAAM,CAC/C,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,SAAS,KAAK,IAAI,CAAC,CACvE,CAAC;IACF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,+EAA+E,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzG,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,IAAY,EAAW,EAAE,CAC1C,qBAAqB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,IAAI,UAAU,CAAC,CAAC,CAAC;IAE5F,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAC7E,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QACnB,KAAK,IAAI,IAAI;QACb,OAAO;QACP,cAAc,IAAI,mBAAmB,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE;KAC7E,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAC3E,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,EAAE,OAAO,CAAC,CAC9C,CAAC;IAEF,OAAO;QACL,YAAY;QACZ,EAAE;QACF,0YAA0Y;QAC1Y,EAAE;QACF,yCAAyC;QACzC,EAAE;QACF,+OAA+O;QAC/O,EAAE;QACF,OAAO,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,CAAC;QACrD,EAAE;QACF,0DAA0D;QAC1D,EAAE;QACF,OAAO,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC;QAC1C,EAAE;QACF,wBAAwB;QACxB,EAAE;QACF,yEAAyE;QACzE,EAAE;QACF,OAAO;QACP,oDAAoD;QACpD,EAAE;QACF,wEAAwE;QACxE,mBAAmB;QACnB,4CAA4C;QAC5C,4CAA4C;QAC5C,iDAAiD;QACjD,qEAAqE;QACrE,OAAO;QACP,KAAK;QACL,KAAK;KACN,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/node_modules/@noodle-borg/agent-kit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodle-borg/agent-kit",
-  "version": "0.54.0",
+  "version": "0.56.0",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

package/node_modules/@noodle-borg/compiler/dist/artifact/catalog-emission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog-emission.d.ts","sourceRoot":"","sources":["../../src/artifact/catalog-emission.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAsB,KAAK,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAE1F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,KAAK,oBAAoB,EAA+B,MAAM,uBAAuB,CAAC;AAC/F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,KAAK,EACV,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,eAAe,EAEhB,MAAM,YAAY,CAAC;AAEpB,mGAAmG;AACnG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED,yGAAyG;AACzG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9D,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED,kFAAkF;AAClF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1D,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED,UAAU,4BAA4B;IACpC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,wBAAwB,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACxE,QAAQ,CAAC,eAAe,EAAE,SAAS,cAAc,EAAE,CAAC;IACpD,QAAQ,CAAC,mBAAmB,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC5D,QAAQ,CAAC,iBAAiB,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACxD,QAAQ,CAAC,gBAAgB,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC7D,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC;CACjC;AAED,UAAU,6BAA6B;IACrC,QAAQ,CAAC,sBAAsB,EAC3B,WAAW,CAAC,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GACzE,SAAS,CAAC;IACd,QAAQ,CAAC,aAAa,EAAE,SAAS,YAAY,EAAE,CAAC;IAChD,QAAQ,CAAC,iBAAiB,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACxD,QAAQ,CAAC,eAAe,EAAE,SAAS,cAAc,EAAE,CAAC;IACpD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACxD,QAAQ,CAAC,iBAAiB,EAAE,eAAe,CAAC,mBAAmB,CAAC,CAAC;CAClE;AAED,iFAAiF;AACjF,wBAAgB,2BAA2B,CAAC,EAC1C,QAAQ,EACR,OAAO,EACP,wBAAwB,EACxB,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAChB,MAAM,GACP,EAAE,4BAA4B,GAAG,6BAA6B,CA6H9D;AAMD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvD"}
+{"version":3,"file":"catalog-emission.d.ts","sourceRoot":"","sources":["../../src/artifact/catalog-emission.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAsB,KAAK,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAE1F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,KAAK,oBAAoB,EAA+B,MAAM,uBAAuB,CAAC;AAC/F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEtD,OAAO,KAAK,EACV,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,eAAe,EAEhB,MAAM,YAAY,CAAC;AAEpB,mGAAmG;AACnG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED,yGAAyG;AACzG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9D,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED,kFAAkF;AAClF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1D,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED,UAAU,4BAA4B;IACpC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,wBAAwB,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACxE,QAAQ,CAAC,eAAe,EAAE,SAAS,cAAc,EAAE,CAAC;IACpD,QAAQ,CAAC,mBAAmB,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC5D,QAAQ,CAAC,iBAAiB,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACxD,QAAQ,CAAC,gBAAgB,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC7D,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC;CACjC;AAED,UAAU,6BAA6B;IACrC,QAAQ,CAAC,sBAAsB,EAC3B,WAAW,CAAC,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GACzE,SAAS,CAAC;IACd,QAAQ,CAAC,aAAa,EAAE,SAAS,YAAY,EAAE,CAAC;IAChD,QAAQ,CAAC,iBAAiB,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACxD,QAAQ,CAAC,eAAe,EAAE,SAAS,cAAc,EAAE,CAAC;IACpD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACxD,QAAQ,CAAC,iBAAiB,EAAE,eAAe,CAAC,mBAAmB,CAAC,CAAC;CAClE;AAED,iFAAiF;AACjF,wBAAgB,2BAA2B,CAAC,EAC1C,QAAQ,EACR,OAAO,EACP,wBAAwB,EACxB,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAChB,MAAM,GACP,EAAE,4BAA4B,GAAG,6BAA6B,CA8H9D;AAMD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvD"}

package/node_modules/@noodle-borg/compiler/dist/artifact/catalog-emission.js

@@ -1,6 +1,7 @@
 import { emitAmbientContext } from '../context-compile.js';
 import { CustomerRoutingCollector } from '../customer-routing.js';
 import { emitFulfilment, withDialect } from '../fulfilment-emit.js';
+import { requiresToolConfirmation } from './consent.js';
 /** Resolve connector references and emit catalog-dependent artifact surfaces. */
 export function emitCatalogArtifactSurfaces({ manifest, catalog, structuralAmbientContext, structuralTools, structuralResources, structuralPrompts, toolUiMetaByName, errors, }) {
     const declared = manifest.connectors ?? {};
@@ -11,6 +12,7 @@ export function emitCatalogArtifactSurfaces({ manifest, catalog, structuralAmbie
         const fulfilment = emitFulfilment(s.fulfilment, catalog, declared, usedAliases, errors, {
             ...(customerRouting === undefined ? {} : { customerRouting }),
             surface: 'tool',
+            confirmationRequired: requiresToolConfirmation(s.tool.annotations),
         });
         const inputSchema = withDialect(s.inputSchema);
         // A tool's `_meta.ui` merges the widget link (`resourceUri`, when a widget targets this tool) with

package/node_modules/@noodle-borg/compiler/dist/artifact/catalog-emission.js.map

@@ -1 +1 @@
-{"version":3,"file":"catalog-emission.js","sourceRoot":"","sources":["../../src/artifact/catalog-emission.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAiC,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAElE,OAAO,EAA6B,cAAc,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AA0D/F,iFAAiF;AACjF,MAAM,UAAU,2BAA2B,CAAC,EAC1C,QAAQ,EACR,OAAO,EACP,wBAAwB,EACxB,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAChB,MAAM,GACuB;IAC7B,MAAM,QAAQ,GAAyC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC;IACjF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,MAAM,eAAe,GACnB,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,wBAAwB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACjG,MAAM,sBAAsB,GAAG,kBAAkB,CAC/C,wBAAwB,EACxB,OAAO,EACP,QAAQ,EACR,WAAW,EACX,MAAM,EACN,eAAe,CAChB,CAAC;IACF,MAAM,aAAa,GAAmB,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9D,MAAM,UAAU,GAAG,cAAc,CAAC,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE;YACtF,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;YAC7D,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAC/C,mGAAmG;QACnG,kGAAkG;QAClG,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,UAAU,EAAE,EAAE,CAAC;QAChC,MAAM,EAAE,GAAiB;YACvB,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;YACnB,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;QACF,MAAM,IAAI,GACR,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;YACpD,CAAC,CAAC,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YAC1E,CAAC,CAAC,SAAS,CAAC;QAChB,OAAO;YACL,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI;YACjB,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW;YAC/B,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa;gBACtB,CAAC,CAAC;oBACE,aAAa,EAAE;wBACb,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc;4BACrC,CAAC,CAAC;gCACE,cAAc,EAAE,+BAA+B,CAC7C,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc,CACpC;6BACF;4BACH,CAAC,CAAC,EAAE,CAAC;wBACP,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,YAAY;4BACnC,CAAC,CAAC;gCACE,YAAY,EAAE,+BAA+B,CAC3C,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,YAAY,CAClC;6BACF;4BACH,CAAC,CAAC,EAAE,CAAC;qBACR;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,WAAW;YACX,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,UAAU;YACV,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,kGAAkG;IAClG,yEAAyE;IACzE,MAAM,iBAAiB,GAAuB,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1E,MAAM,UAAU,GAAG,cAAc,CAAC,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE;YACtF,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;YAC7D,OAAO,EAAE,UAAU;SACpB,CAAC,CAAC;QACH,OAAO;YACL,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI;YACrB,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG;YACnB,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,UAAU;SACX,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,eAAe,GAAqB,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACpE,MAAM,UAAU,GAAG,cAAc,CAAC,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE;YACtF,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;YAC7D,OAAO,EAAE,QAAQ;SAClB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3C,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC,CAAC;QACJ,OAAO;YACL,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI;YACnB,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,UAAU;SACX,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,2FAA2F;IAC3F,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,wBAAwB;oBAC9B,IAAI,EAAE,cAAc,KAAK,EAAE;oBAC3B,OAAO,EAAE,oBAAoB,KAAK,8BAA8B;iBACjE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,iBAAiB,GAAG,eAAe,EAAE,QAAQ,EAAE,CAAC;IAEtD,OAAO;QACL,sBAAsB;QACtB,aAAa;QACb,iBAAiB;QACjB,eAAe;QACf,QAAQ;QACR,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAED,SAAS,+BAA+B,CAAC,MAAyB;IAChE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,iBAAiB,IAAI,IAAI,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC;AACpE,CAAC"}
+{"version":3,"file":"catalog-emission.js","sourceRoot":"","sources":["../../src/artifact/catalog-emission.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAiC,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAElE,OAAO,EAA6B,cAAc,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAG/F,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAwDxD,iFAAiF;AACjF,MAAM,UAAU,2BAA2B,CAAC,EAC1C,QAAQ,EACR,OAAO,EACP,wBAAwB,EACxB,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAChB,MAAM,GACuB;IAC7B,MAAM,QAAQ,GAAyC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC;IACjF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,MAAM,eAAe,GACnB,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,wBAAwB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACjG,MAAM,sBAAsB,GAAG,kBAAkB,CAC/C,wBAAwB,EACxB,OAAO,EACP,QAAQ,EACR,WAAW,EACX,MAAM,EACN,eAAe,CAChB,CAAC;IACF,MAAM,aAAa,GAAmB,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9D,MAAM,UAAU,GAAG,cAAc,CAAC,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE;YACtF,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;YAC7D,OAAO,EAAE,MAAM;YACf,oBAAoB,EAAE,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;SACnE,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAC/C,mGAAmG;QACnG,kGAAkG;QAClG,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,UAAU,EAAE,EAAE,CAAC;QAChC,MAAM,EAAE,GAAiB;YACvB,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;YACnB,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;QACF,MAAM,IAAI,GACR,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;YACpD,CAAC,CAAC,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YAC1E,CAAC,CAAC,SAAS,CAAC;QAChB,OAAO;YACL,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI;YACjB,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW;YAC/B,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa;gBACtB,CAAC,CAAC;oBACE,aAAa,EAAE;wBACb,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc;4BACrC,CAAC,CAAC;gCACE,cAAc,EAAE,+BAA+B,CAC7C,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc,CACpC;6BACF;4BACH,CAAC,CAAC,EAAE,CAAC;wBACP,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,YAAY;4BACnC,CAAC,CAAC;gCACE,YAAY,EAAE,+BAA+B,CAC3C,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,YAAY,CAClC;6BACF;4BACH,CAAC,CAAC,EAAE,CAAC;qBACR;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,WAAW;YACX,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,UAAU;YACV,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,kGAAkG;IAClG,yEAAyE;IACzE,MAAM,iBAAiB,GAAuB,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1E,MAAM,UAAU,GAAG,cAAc,CAAC,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE;YACtF,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;YAC7D,OAAO,EAAE,UAAU;SACpB,CAAC,CAAC;QACH,OAAO;YACL,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI;YACrB,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG;YACnB,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,UAAU;SACX,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,eAAe,GAAqB,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACpE,MAAM,UAAU,GAAG,cAAc,CAAC,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE;YACtF,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;YAC7D,OAAO,EAAE,QAAQ;SAClB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3C,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC,CAAC;QACJ,OAAO;YACL,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI;YACnB,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,UAAU;SACX,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,2FAA2F;IAC3F,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,wBAAwB;oBAC9B,IAAI,EAAE,cAAc,KAAK,EAAE;oBAC3B,OAAO,EAAE,oBAAoB,KAAK,8BAA8B;iBACjE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,iBAAiB,GAAG,eAAe,EAAE,QAAQ,EAAE,CAAC;IAEtD,OAAO;QACL,sBAAsB;QACtB,aAAa;QACb,iBAAiB;QACjB,eAAe;QACf,QAAQ;QACR,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAED,SAAS,+BAA+B,CAAC,MAAyB;IAChE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,iBAAiB,IAAI,IAAI,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC;AACpE,CAAC"}

package/node_modules/@noodle-borg/compiler/dist/artifact/operation-ref.d.ts

@@ -0,0 +1,62 @@
+import type { CredentialProfile } from '../catalog/types.js';
+/**
+ * Reference to a connector operation before catalog resolution.
+ *
+ * Emitted by the `shape-only` compile path (no catalog supplied): the operation reference string
+ * `<connector>.<operation>` is parsed, but the alias is NOT resolved against a connector catalog,
+ * so the connector id, connector version, and operation signature hash required by docs/SPEC.md
+ * "Runtime Invariants" are absent.
+ */
+export interface UnresolvedOperationRef {
+    readonly resolved: false;
+    /** The connector alias as written in the operation reference (e.g. `acme`). */
+    readonly connector: string;
+    readonly operation: string;
+}
+/**
+ * Reference to a connector operation after catalog resolution.
+ *
+ * Carries every field docs/SPEC.md "Runtime Invariants" requires: the connector id, the pinned
+ * connector version, the operation name, and the operation signature hash. Produced when a
+ * connector catalog is supplied to `compile`.
+ */
+export interface ResolvedOperationRef {
+    readonly resolved: true;
+    /** The connector alias declared in the manifest `connectors` block (e.g. `acme`). */
+    readonly alias: string;
+    /** The catalog connector id the alias points to (e.g. `acme_orders`). */
+    readonly connectorId: string;
+    /** The connector version pinned by the manifest. */
+    readonly connectorVersion: string;
+    readonly operation: string;
+    /** Stable hash of the operation signature: `sha256:<hex>`. See catalog/signature.ts. */
+    readonly signatureHash: string;
+    /** Core-v2 credential selection resolved from the stable alias; absent on legacy artifacts. */
+    readonly credentialBinding?: ResolvedCredentialBinding;
+    /** Customer-derived base-URL key for a directly routed HTTP operation; never the resolved URL. */
+    readonly customerEndpoint?: string;
+    /**
+     * Customer endpoint keys reachable from this operation, including connector-declared nested calls.
+     * Names only: claim values and resolved URLs never enter the artifact.
+     */
+    readonly customerEndpointDependencies?: readonly string[];
+    /**
+     * Customer endpoint keys reachable through action operations, including connector-declared
+     * nested calls. Confirmation uses these names to bind private route fingerprints without
+     * persisting resolved URLs.
+     */
+    readonly customerActionEndpointDependencies?: readonly string[];
+}
+export interface ResolvedCredentialBinding {
+    readonly bindingId: string;
+    readonly connectionId: string;
+    /** Digest of non-secret logical connection configuration, not live secret material. */
+    readonly connectionConfigRevision: string;
+    readonly profile: string;
+    /** Catalog-selected, non-secret presentation rule for the broker-minted credential. */
+    readonly presentation: CredentialProfile;
+    readonly requiredScopes: readonly string[];
+    readonly requiredAudience?: string;
+}
+export type OperationRef = UnresolvedOperationRef | ResolvedOperationRef;
+//# sourceMappingURL=operation-ref.d.ts.map

package/node_modules/@noodle-borg/compiler/dist/artifact/operation-ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-ref.d.ts","sourceRoot":"","sources":["../../src/artifact/operation-ref.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,+EAA+E;IAC/E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,qFAAqF;IACrF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,oDAAoD;IACpD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,wFAAwF;IACxF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,+FAA+F;IAC/F,QAAQ,CAAC,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IACvD,kGAAkG;IAClG,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,4BAA4B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1D;;;;OAIG;IACH,QAAQ,CAAC,kCAAkC,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACjE;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,uFAAuF;IACvF,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,uFAAuF;IACvF,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,MAAM,YAAY,GAAG,sBAAsB,GAAG,oBAAoB,CAAC"}

package/node_modules/@noodle-borg/compiler/dist/artifact/operation-ref.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=operation-ref.js.map

package/node_modules/@noodle-borg/compiler/dist/artifact/operation-ref.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-ref.js","sourceRoot":"","sources":["../../src/artifact/operation-ref.ts"],"names":[],"mappings":""}