@penpair/web 0.4.1 → 0.5.0

package/README.md

@@ -56,6 +56,36 @@ Then choose a scratch page and agree on a small design task. The workflow is: in
 
 The installed skills cover **setup → design → recipes → handoff → verification**, with `design-judgment` for visual hierarchy. Ask the assistant to name the skill it uses. For frontend work, `penpair-handoff` carries design evidence into implementation; `penpair-verify` guides browser comparison, image review, fixes and recapture. [Check skill discovery and behavior](https://github.com/niklas-westman/penpair/blob/main/docs/skill-validation.md).
 
+## Where the command and tools live
+
+Install one command package in your application project. Both expose the same
+`penpair` command; the core library is installed as a dependency.
+
+| Surface | Where it comes from | How you discover it |
+| --- | --- | --- |
+| Hosted/team Penpot CLI | `@penpair/web` | `pnpm exec penpair --help` |
+| CLI with local Penpot containers | `@penpair/docker` | The same command, plus instance lifecycle commands |
+| Engine and shipped agent skills | `@penpair/core` | Library exports and `penpair skills`; core has no executable |
+| Penpair MCP tools | Your installed command, started as a stdio server | Register the executable with `mcp --root /absolute/path/to/project` in your assistant |
+| Your assistant's browser/computer controls | The assistant host, separately from Penpair | Host configuration; installing Penpair does not add these controls |
+
+For example, register `/absolute/path/to/project/node_modules/.bin/penpair` with
+arguments `["mcp", "--root", "/absolute/path/to/project"]`. That exposes typed
+inspection, status, doctor, spec and export tools for the pinned project. It does
+not expose every CLI command or arbitrary browser control. See the
+[tool inventory and client configuration](https://github.com/niklas-westman/penpair/blob/main/docs/mcp.md).
+
+Explicit `--allow-writes` additionally exposes registered operations and the
+experimental `design_release_copy` tool. Both preview by default; applying a
+native copy also requires a loopback browser debugging port and existing browser
+clipboard read/write capability. Penpair does not grant those permissions. The equivalent CLI
+starts with `penpair design-release copy --source-page PAGE --frame BOARD_ID
+--release 1.2.0`. Copying creates native boards and transfer evidence; it does not
+approve a full design release. Read the
+[native copy guide](https://github.com/niklas-westman/penpair/blob/main/docs/copy-between-pages.md)
+before applying it. `penpair wake` remains CLI-only.
+For Claude and other hosts, read the [CLI/MCP prerequisites and current qualification](https://github.com/niklas-westman/penpair/blob/main/docs/copy-between-pages.md#using-from-claude-or-other-hosts); the native-UI test driver is not shipped as a fallback.
+
 ## Add your companions
 
 | Package | Add it when | What it contributes |

package/docs/copy-between-pages.md

@@ -1,54 +1,204 @@
-# Copy boards between pages
+# Copy native boards between pages
 
-Penpair currently cannot copy or move an existing board between pages through
-the Penpot plugin API. There is no `copy-boards` command. Use native copy/paste
-in the Penpot editor, leaving the originals in place, then independently inspect
-the destination and compare stable exports. Keep component references, token
-bindings, sizes and child counts intact. See [design release assembly](design-releases.md)
-for its additional fidelity requirements.
+`penpair design-release copy` is an experimental native-editor transfer within
+the project's pinned Penpot file. It copies selected boards to
+`release/<version>`, leaves their originals in place and independently captures
+source and destination evidence. It uses the browser's native clipboard rather
+than trying to move a plugin shape proxy between pages.
 
-## Tested API boundary
+This is a page-copy operation, not a complete design-release assembly or owner
+approval. It produces a private transfer receipt, not a fabricated
+`release.json`. The stricter [design release verification](design-releases.md)
+requirements still apply before a full release can be finalized.
 
-A disposable two-page probe on local Penpot 2.18.3 on 2026-10-25 tested a board
-with one rectangle child. Each `clone()` stayed on the source page. Appending or
-inserting the clone into a board on the other page failed with:
+## Prerequisites and preview
+
+Use the reviewed project installation, with a valid configuration, an
+owner-confirmed file pin and a connected responsive Penpot plugin. Choose one
+source page and 1–100 distinct board IDs from that page. IDs must identify boards,
+not arbitrary shapes; selecting a board together with its descendant board is
+refused. Boards nested in sections can be selected by their IDs.
+The PoC bounds each observed page to 20,000 nodes and the native clipboard
+payload to 16 MiB; exceeding either limit stops the transfer.
+
+```sh
+# Replace these board IDs and page name with observed source identities.
+penpair design-release copy --source-page "Screens" \
+  --frame SOURCE_BOARD_ID --frame ANOTHER_BOARD_ID --release 1.2.0
+```
+
+Preview resolves the source and destination, inventories existing content and
+reports the planned selection. It does not create a page, alter selection or
+use the clipboard. The destination is always `release/1.2.0` in the same pinned
+file; this command does not copy between files or deployments.
+
+A unique existing destination can be reused without replacing its content.
+Missing destinations are created on apply. Ambiguous page names, finalized
+release ownership and conflicting ownership markers are refused. New copies
+are arranged separately from existing destination content; existing frames are
+not moved or normalized.
+
+## Apply through the native editor
+
+Review the preview and authorize the actual transfer before applying:
+
+```sh
+penpair design-release copy --source-page "Screens" \
+  --frame SOURCE_BOARD_ID --frame ANOTHER_BOARD_ID --release 1.2.0 \
+  --debug-port 9222 --apply
+```
+
+The browser must already expose a loopback debugging port. See
+[browser setup and recovery](browser-sessions.md) for an isolated-profile example.
+Clipboard APIs also require a secure browser context, normally HTTPS or local
+loopback HTTP. See the browser vendor's [clipboard access guidance](https://web.dev/articles/async-clipboard).
+Penpair adds no browser dependency or browser download and does not start a
+managed session. It verifies the browser origin and pinned file; configured local
+instances may use the equivalent `localhost`/`127.0.0.1` HTTP origin on the same
+port. Hosted deployments require the exact configured origin.
+
+The bundled transport also requires the browser's existing clipboard read/write
+capability for that editor. Penpair does not grant clipboard permissions. If the
+capability is unavailable, denied or waiting for a browser prompt, the operation
+fails closed before paste. Complete any intended browser permission decision
+separately; a debugging connection alone does not establish clipboard access.
+
+Applying changes page and board selection, foregrounds the editor and dispatches
+native Copy/Paste. The Penpot canvas must have focus, with no text field,
+content-editable region, plugin iframe or dialog focused. Penpair refuses unsafe
+focus instead of sending shortcuts into another control. This replaces the
+system clipboard contents; previous clipboard contents are not automatically
+restored. Avoid using the clipboard or changing editor focus during the transfer.
+A local clipboard lease excludes cooperating Penpair sessions, not unrelated
+applications or manual actions.
+
+Before dispatching Copy, the transport clears the clipboard to a unique sentinel.
+It then waits for an actual native Penpot JSON/verbose-Transit payload matching
+the pinned file and selected board UUIDs. Validation and SHA-256 calculation run
+inside the browser; the bundled transport does not return, log or persist raw
+clipboard contents. Immediately before Paste it revalidates the payload digest.
+Missing, stale, unrelated or changed clipboard data prevents paste rather than
+reusing whatever was previously on the clipboard. Clearing the clipboard can
+therefore replace its contents even when the transfer subsequently stops.
+
+The command captures source inspections and stable exports, prepares the
+same-file destination, fences one native paste attempt, identifies the new
+boards and arranges only those copies. Independent readback checks the copied
+boards and the unchanged originals. It records structural findings and decoded
+pixel comparisons. Review the saved source/target exports visually as part of
+acceptance; a technical result does not supply human approval.
+
+## Results and recovery
+
+The result includes a `runId`, source/target board pairs, `nativeVerified`,
+`pixelsMatch`, problems and a receipt path:
 
 ```text
-Cannot modify a page that is not currently active
+.penpair/native-copy/<run-id>/receipt.json
 ```
 
-Both `appendChild(clone)` and `insertChild(0, clone)` failed with either the
-source page or the destination page active. Independent readback found both
-clones on the source page, no destination children, and the original board and
-child unchanged. Two destination exports were inspected and showed the empty
-board. Both disposable pages were removed; a separate read confirmed their
-absence and the original pages' names and top-level shape IDs were preserved.
-This establishes a local API limitation, not hosted-version or component/token
-copy fidelity.
+The receipt and its referenced inspections/exports are private operation evidence.
+A successful fully verified transfer reports `status: "copied"`; missing native
+proof or a pixel mismatch can leave `status: "incomplete"` and exit 3 even when
+boards already exist in the destination. Read the findings before doing anything
+else. Existing verification limits remain strict: component overrides, masks,
+paths, mixed text styles and other unobserved native fields cannot be accepted
+merely because exported pixels match.
+
+Do not rerun a fresh apply to recover a lost response. Inspect the journal and
+destination independently, then use the original inputs and run ID:
+
+```sh
+penpair runs RUN_ID
+penpair design-release copy --source-page "Screens" \
+  --frame SOURCE_BOARD_ID --frame ANOTHER_BOARD_ID --release 1.2.0 \
+  --debug-port 9222 --resume RUN_ID --apply
+```
+
+Resume reconciles the observed destination against the original transfer. A
+paste-attempt fence prevents blind replay after an uncertain paste. Changed
+inputs, changed originals or an ambiguous destination require explicit
+reconciliation; neither resume nor browser activation promises rollback.
+
+The transfer receipt is not the receipt-list schema consumed by
+`design-release verify --receipts`. Do not rename it to `release.json` or pass it
+as an approved release. Full release plans, maps, source evidence, native-copy
+mapping and exact owner reviews remain separate requirements. Compatibility
+between copy-created page ownership and the full assembly workflow must be
+validated before treating a copied page as an assembled release.
+
+## MCP discovery
+
+The typed `design_release_copy` tool appears only when the project's Penpair
+stdio server starts with `--allow-writes`. Its inputs are `sourcePage`,
+`frameIds`, `releaseVersion`, optional `debugPort`, `apply` and `resume`. Preview
+is the default; apply requires `debugPort`, and resume requires apply. The tool
+returns the same operation result and keeps the same target/recovery safeguards.
+It does not expose raw page code. See [MCP tools](mcp.md).
+
+## Using from Claude or other hosts
+
+The standard copy route is host-neutral: an assistant can invoke the installed
+CLI or call the typed Penpair MCP tool. It requires the configured project,
+owner-confirmed file pin and responsive plugin connection described above. Apply
+also requires a debugging-enabled browser on the same computer as the Penpair
+process, the explicit debugging port and existing clipboard read/write access.
+These are the same prerequisites in Claude, Codex and other CLI/MCP-capable hosts.
+
+Claude does not need an additional computer-control integration for the standard
+CDP route. Register the reviewed Penpair executable with `--allow-writes` to expose
+`design_release_copy`, or use the CLI directly. Preview first; tool visibility
+alone neither applies the copy nor grants browser permissions. See the
+[Claude registration example](mcp.md#client-registration).
+
+The native-UI keyboard driver used in the trial below was an injected test
+driver, not a public CLI/MCP fallback supplied to Claude or other hosts. That
+trial establishes the core-service proof described below; qualification of the
+bundled CDP clipboard path against Penpot remains pending. Installing Penpair or
+adding host computer controls does not turn that pending qualification into a
+passing result.
+
+## Evidence and API boundary
+
+The hardened bundled CDP transport has not passed end-to-end browser
+qualification. In a disposable unauthenticated Brave fixture, it stopped while
+awaiting clipboard read access and dispatched no paste. Earlier shortcut-only
+fixture results do not establish that the current payload-validation path works
+end to end. A separate native-UI experiment also does not qualify the bundled
+CDP transport or provide a public CLI fallback.
+
+An owner-authorized hosted Penpot trial on 25 October 2026 copied two synthetic
+240 × 160 boards with simple rectangle/ellipse children into a disposable release
+page. It used an injected native-UI keyboard driver through the same core copy
+service because that existing browser profile had no debugging port. The actual
+JSON/verbose-Transit clipboard payload was checked locally against the pinned
+file, selected board identities and digest before one paste; arranging the new
+copies was a separate idempotent step. Independent inspection/native-fidelity
+comparison and decoded RGBA pixel hashes passed for both boards, with four mapped
+nodes. Source and copied stable PNG exports were visually inspected.
+
+The original trial run then completed explicit resume with `status: "copied"`,
+`nativeVerified: true`, `pixelsMatch: true` and no problems. The copies were
+arranged, the original source hashes remained unchanged, the receipt was saved
+and the journal reached `verified`. Revision drift had safely interrupted the
+first final capture; bounded read-only recapture and reconciliation completed
+verification without another Copy or Paste dispatch.
+
+This establishes the limited native-UI/core-service proof of concept. End-to-end
+Penpot qualification of the bundled CDP clipboard transport remains pending;
+the native-UI result does not establish that qualification or record owner
+approval. Unsupported content remains incomplete. Full release assembly adoption
+is not implemented by this transfer proof of concept.
+
+The direct plugin API limitation remains: a disposable two-page trial on local
+Penpot 2.18.3 tested a board with one rectangle child. `clone()` remained on the
+source page, and cross-page `appendChild`/`insertChild` attempts failed with
+`Cannot modify a page that is not currently active`. Independent readback found
+the originals unchanged and no destination children. The native clipboard route
+avoids that unsupported operation; it does not make cross-page reparenting safe.
 
 The [upstream shape implementation](https://github.com/penpot/penpot/blob/develop/frontend/src/app/plugins/shape.cljs)
-checks that both parent and child pages are active before either structural
-operation. The [Board API](https://doc.plugins.penpot.app/interfaces/Board)
-provides cloning and reparenting, but no cross-page transfer operation. The
-[File API](https://doc.plugins.penpot.app/interfaces/File) exposes export,
-validation and history, without a file-change submission method.
-
-## File-change route
-
-Penpair's connection calls the editor's MCP tools; it has no authenticated
-Penpot backend file-change client or supported plugin method for submitting raw
-file changes. Internal `$page` metadata does not provide that capability.
-Changing a proxy's internals, reconstructing a board from its visible properties,
-or patching backend file objects would not establish preserved component
-overrides, token bindings, references, undo behavior or revision coordination.
-
-There is therefore no safe file-change route in the current implementation.
-Automatic cross-page copying stops at this boundary. A future supported transfer
-API or separately validated native editor integration would need exact source
-selection, a dry run, journaled recovery, independent fidelity readback and stable
-exports before shipping a copy command. Moving must remain explicit.
-
-For large pages, scope a writer's layout observation with repeatable
-`--layout-root <shape-id>` and, when needed, `--layout-max-nodes <n>`; see
-[layout settling](layout-settling.md). Reducing the observation scope does not
-add a cross-page copy capability.
+checks active-page ownership. The [Board API](https://doc.plugins.penpot.app/interfaces/Board)
+provides cloning and reparenting, but no cross-page transfer operation. Penpair
+does not patch proxy internals, reconstruct the design from screenshots or
+submit unauthenticated raw backend file changes as a fallback.

package/docs/design-releases.md

@@ -7,6 +7,27 @@ design cases and immutable evidence so a later implementation agent can identify
 what was reviewed. This is a design release, separate from publishing Penpair's
 npm packages or accepting a frontend implementation.
 
+## Copy boards to a release page
+
+For an experimental same-file page transfer, preview the observed source boards:
+
+```sh
+penpair design-release copy --source-page "Screens" \
+  --frame SOURCE_BOARD_ID --release 1.2.0
+# After reviewing and authorizing the transfer:
+penpair design-release copy --source-page "Screens" \
+  --frame SOURCE_BOARD_ID --release 1.2.0 --debug-port 9222 --apply
+```
+
+This uses native editor copy/paste into `release/1.2.0`, preserving originals and
+existing destination content, and writes private evidence under
+`.penpair/native-copy/<run-id>/`. It can report incomplete native fidelity after
+copying; read the findings and inspect the exports. The transfer receipt is not
+a release manifest, the `verify --receipts` input schema or owner approval.
+Copy-created page ownership does not by itself establish compatibility with the
+full assembly flow below. See [native copy and recovery](copy-between-pages.md)
+for prerequisites, clipboard effects, explicit resume and current proof limits.
+
 ## Local commands
 
 Create the plan from actual source inspection, using your own product SemVer.
@@ -60,10 +81,12 @@ is not approval of the child graph. See [linked detail maps](integration-maps.md
 Keep the release page in the same pinned Penpot file, named `release/<version>`.
 Assembly creates the owned overview/map sections and reports `awaiting-copy`.
 Copy source design frames natively using a reviewed, guided copy/paste operation
-by a person or an authorized AI using existing browser tools. Assembly does not
-perform an unsupported cross-page clone.
-The [cross-page API assessment](copy-between-pages.md) records the tested
-boundary and why there is no automatic file-change fallback.
+by a person or an authorized AI using existing browser tools. The experimental
+`design-release copy` path separately automates native clipboard transfer; its
+receipt is not automatically a full release's mapping or approval. Assembly
+does not perform an unsupported cross-page clone. The
+[native copy guide](copy-between-pages.md) records both that API boundary and the
+new transport's verification limits.
 Preserve visual fidelity, native components, token bindings, text and layout;
 do not recreate frames from screenshots or normalize their dimensions. A source
 using auto height must retain it. Floating-point geometry noise is not a reason

package/docs/mcp.md

@@ -6,9 +6,48 @@ penpair mcp --root /absolute/path/to/project
 
 Use the project's reviewed local executable. Startup requires an absolute root, valid project config and owner-confirmed file pin. The server keeps that target for its lifetime and refuses a changed target until restart/review. Each call gets request-scoped root state; it never calls `process.chdir`. Even basic reads use strict same-execution file guards. Environment/project `.env.local` endpoint resolution remains available; unrelated global Codex/Claude endpoint fallback is disabled. Keep credentials in the private connection flow, outside client configuration examples.
 
-Default tools: pages, bounded tree/audit/inspection, bounded token dump, offline baseline coverage, doctor, derived spec, and stable export to a path inside the project. Export creates/replaces a local file and has a write annotation. There is no raw-code tool or unrestricted command forwarding. Each typed input is validated independently of the client schema. No Penpot write tool is advertised by default.
+Default tool names are `pages`, `tree`, `audit`, `inspect`, `tokens_dump`, `run_status`, `baselines_status`, `project_status`, `doctor`, `design_spec` and `export`. These cover bounded live inspection, offline run/baseline evidence, diagnostics, derived specs and stable export to a path inside the project. Export creates/replaces a local file and has a write annotation. There is no raw-code tool or unrestricted command forwarding. Each typed input is validated independently of the client schema. No Penpot write tool is advertised by default.
 
-Explicit `--allow-writes` additionally advertises `run_registered`. It accepts a registered operation name and scalar parameters, defaults to inspection, and requires explicit `apply:true` for design writes. Explicit `resume` requires apply and the original journal; file/instance guards, local/shared advisory lease, same-execution preconditions, checkpoints supported by the underlying command, and independent readback remain in the same services. Registered modules execute trusted project code, including imports; they must keep stdout for MCP and log through the command context. This is not an execution sandbox. Adapter-specific commands remain available through the CLI; the neutral server does not guess library-specific tool schemas.
+Explicit `--allow-writes` additionally advertises `run_registered` and `design_release_copy`. The first runs registered operations; the second provides the typed native-copy workflow described below. `run_registered` accepts a registered operation name and scalar parameters, defaults to inspection, and requires explicit `apply:true` for design writes. Explicit `resume` requires apply and the original journal; file/instance guards, local/shared advisory lease, same-execution preconditions, checkpoints supported by the underlying command, and independent readback remain in the same services. Registered modules execute trusted project code, including imports; they must keep stdout for MCP and log through the command context. This is not an execution sandbox. Adapter-specific commands remain available through the CLI; the neutral server does not guess library-specific tool schemas.
+
+## Native release-page copy
+
+Start the reviewed project executable with write tools enabled only when those
+operations are authorized:
+
+```sh
+penpair mcp --root /absolute/path/to/project --allow-writes
+```
+
+The `design_release_copy` tool previews by default. Example input, with observed
+source board IDs substituted:
+
+```json
+{
+  "sourcePage": "Screens",
+  "frameIds": ["SOURCE_BOARD_ID", "ANOTHER_BOARD_ID"],
+  "releaseVersion": "1.2.0",
+  "apply": false
+}
+```
+
+Explicit `apply: true` also requires `debugPort` (1–65535) for an already enabled
+loopback browser debugging endpoint and existing clipboard read/write capability.
+Penpair does not grant browser permissions; denied or unavailable access stops
+before paste. `resume` requires apply and the original run ID/inputs. Copy uses the pinned file, preserves originals, and creates or appends
+to `release/1.2.0`; it changes browser focus and selection and replaces the system
+clipboard. The bundled transport clears stale data before Copy, validates the
+native payload against the pinned file and selected boards inside the browser,
+and rechecks its digest before Paste. Raw clipboard data is not returned, logged
+or persisted by that transport. An uncertain paste is reconciled rather than
+automatically replayed.
+An incomplete native/pixel result is not a completed transfer or release
+approval. See [native copy, evidence and recovery](copy-between-pages.md).
+
+This tool is absent from the default server. There is no MCP `wake` tool: explicit
+browser activation remains the CLI `penpair wake` command. Native browser/computer
+controls supplied by an assistant host are separate tools and are not installed
+or exposed by Penpair's server.
 
 Requests return the version-1 CLI envelope as text plus structured content. Default cooperative deadline: 60 seconds; SDK cancellation propagates into the service. Arbitrary trusted code can ignore cancellation. A 256 KiB response cap returns an explicit incomplete envelope rather than apparently successful truncated data; uncertain writes retain their uncertain outcome/run ID. Use narrower inspection or CLI artifact output for larger evidence. Stdio has no HTTP listener or background polling.
 
@@ -22,8 +61,9 @@ Every advertised tool explicitly declares boolean `readOnlyHint`, `destructiveHi
 | `pages`, `tree`, `audit`, `inspect`, `tokens_dump`, `project_status`, `doctor`, `design_spec` (may contact Penpot or its deployment) | true | false | true | true |
 | `export` (creates or replaces a local image from live Penpot) | false | true | false | true |
 | `run_registered` (opt-in trusted code, potentially mutating) | false | true | false | true |
+| `design_release_copy` (opt-in native clipboard transfer) | false | false | false | true |
 
-`export` can overwrite an existing artifact, so its destructive hint is true. It captures the current design, so callers must not assume repeated calls preserve the earlier image. `run_registered` retains conservative hints even when a particular invocation only previews: its metadata must cover the registered code's possible effects. `archive` is an internal registered operation invoked through `run_registered`, not a separately advertised MCP tool.
+`export` can overwrite an existing artifact, so its destructive hint is true. It captures the current design, so callers must not assume repeated calls preserve the earlier image. `run_registered` retains conservative hints even when a particular invocation only previews: its metadata must cover the registered code's possible effects. `design_release_copy` preserves source boards and existing destination content, but is still mutating and non-idempotent: it can create native copies, change selection/focus and replace the clipboard. Its preview does not change that tool-wide annotation. `archive` is an internal registered operation invoked through `run_registered`, not a separately advertised MCP tool.
 
 ## Code execution boundaries
 
@@ -46,6 +86,24 @@ Claude Code supports project `.mcp.json` entries under `mcpServers`; see [offici
 }
 ```
 
+For authorized native-copy work, change that Claude entry's `args` to:
+
+```json
+["mcp", "--root", "/absolute/path/to/project", "--allow-writes"]
+```
+
+Restart or reconnect the server to discover `design_release_copy`. This enables
+tool visibility; it does not apply a copy or grant browser permissions. The tool
+must be present in the installed Penpair version's tool list. Registering only
+Penpot's upstream MCP server does not expose Penpair's project tools.
+The tool
+still previews by default. Apply requires `apply: true`, `debugPort`, the pinned
+project/plugin connection and existing clipboard read/write access in the
+browser on the Penpair process's computer. The standard CDP route needs no
+additional Claude computer-control integration. The injected native-UI driver
+used in the core-service trial is not a public fallback; bundled CDP/Penpot
+qualification remains pending. See [host prerequisites and qualification](copy-between-pages.md#using-from-claude-or-other-hosts).
+
 Codex uses project `.codex/config.toml` for trusted projects, with a server table; see [official Codex MCP configuration](https://learn.chatgpt.com/docs/extend/mcp?surface=cli).
 
 ```toml

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@penpair/web",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "The penpair command for Penpot on the web (design.penpot.app or your team's own): guided setup, a safe write protocol, skills for AI agents. Includes everything in @penpair/core.",
   "license": "MIT",
   "repository": {
@@ -48,7 +48,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@penpair/core": "0.4.1"
+    "@penpair/core": "0.5.0"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",