@synap-core/cli 1.12.2 → 1.13.0

package/dist/lib/credential-class.d.ts

@@ -28,7 +28,7 @@
  * blocked), classification is deliberately three-valued and the guard is
  * belt-and-braces:
  *   • `agent`   — positive agent signal → refuse locally, before the network call.
- *   • `human`   — positive human signal (`user_pat`) → never blocked.
+ *   • `human`   — positive human signal (`user_pat` NOT owned by an agent user) → never blocked.
  *   • `unknown` — no signal → PROCEED, and translate the server's 403 after the
  *                 fact (`isAgentReviewRejection`). The server stays authoritative.
  *
@@ -58,9 +58,36 @@ export interface AuthStatus {
     isActive?: boolean;
     keyType?: string | null;
     workspaceId?: string | null;
+    /**
+     * What the key may touch — its grant (pod ≥ owner-app-connect-key; absent
+     * on older pods, null when the pod read no grant for the request).
+     */
+    access?: KeyAccess | null;
+}
+/** `/auth/status` `access`: the calling key's grant, ids and patterns only. */
+export interface KeyAccess {
+    isFullAccess: boolean;
+    /** "full access", or what limits it ("limited to 1 space (<id>)"). */
+    summary: string;
+    scopes: Array<{
+        permissions: string[];
+        workspaceIds: string[] | null;
+        projectIds: string[] | null;
+        entityIds: string[] | null;
+    }>;
+    clientId: string | null;
 }
 /** Introspect a key. `apiKey` overrides `cfg.apiKey` (used by `whoami` to probe both sides of a divergence). */
 export declare function fetchAuthStatus(cfg: HubConfig, apiKey?: string): Promise<AuthStatus>;
+/**
+ * WHO this key is — the agent principal, for recognising the agent's OWN
+ * posts (a room message carries it as `routedTeammateId`). Never the acting
+ * user sent to the pod: that is `resolveUserId` (/users/me), which for an
+ * agent key answers the linked HUMAN. The id recorded with the key
+ * (`cfg.agentUserId`) wins; else the pod's key-owner answer (/auth/status),
+ * cached per key. For a person's own key both questions answer the person.
+ */
+export declare function resolveAgentUserId(cfg: HubConfig): Promise<string>;
 /**
  * Shape of `GET /api/hub/users/me` (`hub-protocol/rest/users.ts:36-46`).
  *

package/dist/lib/credential-class.js

@@ -28,7 +28,7 @@
  * blocked), classification is deliberately three-valued and the guard is
  * belt-and-braces:
  *   • `agent`   — positive agent signal → refuse locally, before the network call.
- *   • `human`   — positive human signal (`user_pat`) → never blocked.
+ *   • `human`   — positive human signal (`user_pat` NOT owned by an agent user) → never blocked.
  *   • `unknown` — no signal → PROCEED, and translate the server's 403 after the
  *                 fact (`isAgentReviewRejection`). The server stays authoritative.
  *
@@ -47,6 +47,27 @@ import { hubGet, HubError } from "./hub-client.js";
 export async function fetchAuthStatus(cfg, apiKey) {
     return (await hubGet("/auth/status", {}, apiKey ? { ...cfg, apiKey } : cfg));
 }
+const agentUserIdCache = new Map();
+/**
+ * WHO this key is — the agent principal, for recognising the agent's OWN
+ * posts (a room message carries it as `routedTeammateId`). Never the acting
+ * user sent to the pod: that is `resolveUserId` (/users/me), which for an
+ * agent key answers the linked HUMAN. The id recorded with the key
+ * (`cfg.agentUserId`) wins; else the pod's key-owner answer (/auth/status),
+ * cached per key. For a person's own key both questions answer the person.
+ */
+export async function resolveAgentUserId(cfg) {
+    if (cfg.agentUserId)
+        return cfg.agentUserId;
+    const cached = agentUserIdCache.get(cfg.apiKey);
+    if (cached)
+        return cached;
+    const owner = (await fetchAuthStatus(cfg)).userId;
+    if (!owner)
+        throw new Error("The pod did not say who owns this key (GET /auth/status has no userId).");
+    agentUserIdCache.set(cfg.apiKey, owner);
+    return owner;
+}
 /** Resolve the effective identity. `apiKey` overrides `cfg.apiKey`, mirroring `fetchAuthStatus`. */
 export async function fetchEffectiveIdentity(cfg, apiKey) {
     return (await hubGet("/users/me", {}, apiKey ? { ...cfg, apiKey } : cfg));
@@ -56,14 +77,15 @@ const AGENT_EMAIL_DOMAIN = "@synap.agent";
 export function classifyReviewer(status) {
     if (!status)
         return "unknown";
-    // A personal access token is a HUMAN session by construction — it carries no
-    // linkedUserId, so `rejectAgentReviewer` never fires for it. Check this FIRST
-    // so a human key can never be caught by the email heuristic below.
-    if (status.keyType === "user_pat")
-        return "human";
+    // The agent domain FIRST: the server derives the agent from the key owner's
+    // `userType === 'agent'` (access/key-identity.ts), whatever the key type, and
+    // only agent users carry the synthetic domain. The device flow mints
+    // `user_pat` keys owned by a machine agent, so keyType alone is not human.
     const email = (status.userEmail ?? "").toLowerCase();
     if (email.endsWith(AGENT_EMAIL_DOMAIN))
         return "agent";
+    if (status.keyType === "user_pat")
+        return "human";
     return "unknown";
 }
 /** Best-effort classification. A pod that is down/older must not block the command — it degrades to `unknown`. */

package/dist/lib/credential-class.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-class.js","sourceRoot":"","sources":["../../src/lib/credential-class.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAkB,MAAM,iBAAiB,CAAC;AAsBnE,gHAAgH;AAChH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAc,EAAE,MAAe;IACnE,OAAO,CAAC,MAAM,MAAM,CAAC,cAAc,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAe,CAAC;AAC7F,CAAC;AAyBD,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAc,EACd,MAAe;IAEf,OAAO,CAAC,MAAM,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAsB,CAAC;AACjG,CAAC;AAWD,uEAAuE;AACvE,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAE1C,MAAM,UAAU,gBAAgB,CAAC,MAAqC;IACpE,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,6EAA6E;IAC7E,8EAA8E;IAC9E,mEAAmE;IACnE,IAAI,MAAM,CAAC,OAAO,KAAK,UAAU;QAAE,OAAO,OAAO,CAAC;IAClD,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAAE,OAAO,OAAO,CAAC;IACvD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,kHAAkH;AAClH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,GAAc;IAC3D,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,IAAI,CAAC,CAAC,GAAG,YAAY,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACnE,MAAM,QAAQ,GAAG,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/D,OAAO,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAChF,CAAC;AAED,0HAA0H;AAC1H,MAAM,UAAU,gBAAgB,CAAC,EAAU;IACzC,OAAO,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,oHAAoH;AACpH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,EAAU;IACxD,OAAO,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAU,EAAE,GAAc,EAAE,SAA+B,SAAS;IACrG,GAAG,CAAC,KAAK,CAAC,0BAA0B,MAAM,gBAAgB,MAAM,mBAAmB,CAAC,CAAC;IACrF,GAAG,CAAC,GAAG,CACL,mFAAmF;QACnF,iFAAiF,CAClF,CAAC;IACF,GAAG,CAAC,KAAK,EAAE,CAAC;IACZ,GAAG,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAC5C,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,WAAW,KAAK,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1F,GAAG,CAAC,GAAG,CAAC,OAAO,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAClD,GAAG,CAAC,KAAK,EAAE,CAAC;IACZ,GAAG,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"credential-class.js","sourceRoot":"","sources":["../../src/lib/credential-class.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAkB,MAAM,iBAAiB,CAAC;AAyCnE,gHAAgH;AAChH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAc,EAAE,MAAe;IACnE,OAAO,CAAC,MAAM,MAAM,CAAC,cAAc,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAe,CAAC;AAC7F,CAAC;AAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEnD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAc;IACrD,IAAI,GAAG,CAAC,WAAW;QAAE,OAAO,GAAG,CAAC,WAAW,CAAC;IAC5C,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,KAAK,GAAG,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;IAClD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IACvG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACxC,OAAO,KAAK,CAAC;AACf,CAAC;AAyBD,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAc,EACd,MAAe;IAEf,OAAO,CAAC,MAAM,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAsB,CAAC;AACjG,CAAC;AAWD,uEAAuE;AACvE,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAE1C,MAAM,UAAU,gBAAgB,CAAC,MAAqC;IACpE,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,4EAA4E;IAC5E,8EAA8E;IAC9E,qEAAqE;IACrE,2EAA2E;IAC3E,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAAE,OAAO,OAAO,CAAC;IACvD,IAAI,MAAM,CAAC,OAAO,KAAK,UAAU;QAAE,OAAO,OAAO,CAAC;IAClD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,kHAAkH;AAClH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,GAAc;IAC3D,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,IAAI,CAAC,CAAC,GAAG,YAAY,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACnE,MAAM,QAAQ,GAAG,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/D,OAAO,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAChF,CAAC;AAED,0HAA0H;AAC1H,MAAM,UAAU,gBAAgB,CAAC,EAAU;IACzC,OAAO,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,oHAAoH;AACpH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,EAAU;IACxD,OAAO,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAU,EAAE,GAAc,EAAE,SAA+B,SAAS;IACrG,GAAG,CAAC,KAAK,CAAC,0BAA0B,MAAM,gBAAgB,MAAM,mBAAmB,CAAC,CAAC;IACrF,GAAG,CAAC,GAAG,CACL,mFAAmF;QACnF,iFAAiF,CAClF,CAAC;IACF,GAAG,CAAC,KAAK,EAAE,CAAC;IACZ,GAAG,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAC5C,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,WAAW,KAAK,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1F,GAAG,CAAC,GAAG,CAAC,OAAO,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAClD,GAAG,CAAC,KAAK,EAAE,CAAC;IACZ,GAAG,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;AAC9D,CAAC"}

package/dist/lib/exporter-coverage.d.ts

@@ -15,7 +15,7 @@
  * Loops stay here deliberately: there is no durable loop row to reverse-
  * serialise (`createLoopFromDefinition` dissolves into playbooks + triggers).
  *
- * `TEMPLATE-DEV-GUIDE.md` used to assert, unqualified, that a
+ * The template guide used to assert, unqualified, that a
  * `PackageDefinition` "round-trips". It does not, in this direction, and the
  * consequence is the shape this repo keeps paying for: an author who built one
  * of the things below publishes their workspace, ships a thinner-than-expected

package/dist/lib/exporter-coverage.js

@@ -15,7 +15,7 @@
  * Loops stay here deliberately: there is no durable loop row to reverse-
  * serialise (`createLoopFromDefinition` dissolves into playbooks + triggers).
  *
- * `TEMPLATE-DEV-GUIDE.md` used to assert, unqualified, that a
+ * The template guide used to assert, unqualified, that a
  * `PackageDefinition` "round-trips". It does not, in this direction, and the
  * consequence is the shape this repo keeps paying for: an author who built one
  * of the things below publishes their workspace, ships a thinner-than-expected

package/dist/lib/goal-words.d.ts

@@ -0,0 +1,38 @@
+/**
+ * A GOAL's words as `synap track` prints them — status, verdict, kind of
+ * work, uncertainty, criterion marks, what it waits on, who is on it, the
+ * end state's label.
+ *
+ * `@synap-core/types/vocabulary` is the one door for these words, but this
+ * package cannot import it (the CLI links only `@synap-core/hub-rest-client`
+ * and `@synap-core/workspace-templates`). So each table here is a COPY of the
+ * vocabulary's own, held EQUAL — keys and words — by
+ * `test/goal-words-parity.test.ts`, which reads the vocabulary's source in
+ * the sibling `synap-backend`. Delete this file for a plain import once the
+ * CLI depends on a published `@synap-core/types` carrying them.
+ */
+/** `TRACK_STATUS_LABELS` */
+export declare const TRACK_STATUS_LABELS: Readonly<Record<string, string>>;
+/** `TRACK_VERDICT_LABELS` */
+export declare const TRACK_VERDICT_LABELS: Readonly<Record<string, string>>;
+/** `TRACK_WORK_KIND_LABELS` */
+export declare const TRACK_WORK_KIND_LABELS: Readonly<Record<string, string>>;
+/** `TRACK_UNCERTAINTY_LABELS` */
+export declare const TRACK_UNCERTAINTY_LABELS: Readonly<Record<string, string>>;
+/** `GOAL_CRITERION_MARK_LABELS` */
+export declare const GOAL_CRITERION_MARK_LABELS: Readonly<Record<string, string>>;
+/** `WAITING_ON_REASON_LABELS` */
+export declare const WAITING_ON_REASON_LABELS: Readonly<Record<string, string>>;
+/** `TRACK_PARTICIPANT_ROLE_LABELS` (vocabulary/track-participant-words.ts) */
+export declare const TRACK_PARTICIPANT_ROLE_LABELS: Readonly<Record<string, string>>;
+/** `TRACK_COMMITMENT_STATE_LABELS` (vocabulary/track-participant-words.ts) */
+export declare const TRACK_COMMITMENT_STATE_LABELS: Readonly<Record<string, string>>;
+/** `GOAL_FIELD_LABELS` — the goal's stored fields as a person reads them. */
+export declare const GOAL_FIELD_LABELS: Readonly<Record<string, string>>;
+/**
+ * The vocabulary's fallback (`humanizeToken`, minus its cased-words list): a
+ * value no table names reads as words, never as the raw token.
+ */
+export declare function humanizeToken(token: string): string;
+/** A token through its table, else humanized — `""` for none. */
+export declare function goalWord(table: Readonly<Record<string, string>>, token: string | null | undefined): string;

package/dist/lib/goal-words.js

@@ -0,0 +1,112 @@
+/**
+ * A GOAL's words as `synap track` prints them — status, verdict, kind of
+ * work, uncertainty, criterion marks, what it waits on, who is on it, the
+ * end state's label.
+ *
+ * `@synap-core/types/vocabulary` is the one door for these words, but this
+ * package cannot import it (the CLI links only `@synap-core/hub-rest-client`
+ * and `@synap-core/workspace-templates`). So each table here is a COPY of the
+ * vocabulary's own, held EQUAL — keys and words — by
+ * `test/goal-words-parity.test.ts`, which reads the vocabulary's source in
+ * the sibling `synap-backend`. Delete this file for a plain import once the
+ * CLI depends on a published `@synap-core/types` carrying them.
+ */
+/** `TRACK_STATUS_LABELS` */
+export const TRACK_STATUS_LABELS = {
+    proposed: "Proposed",
+    agreed: "Agreed",
+    ready: "Ready",
+    active: "Active",
+    paused: "Paused",
+    completed: "Closed",
+    archived: "Dropped",
+};
+/** `TRACK_VERDICT_LABELS` */
+export const TRACK_VERDICT_LABELS = {
+    met: "Met",
+    partly_met: "Partly met",
+    not_met: "Not met",
+    retired: "Retired",
+    no_longer_needed: "No longer needed",
+    impossible: "Impossible",
+    replaced: "Replaced",
+    mistake: "Created by mistake",
+};
+/** `TRACK_WORK_KIND_LABELS` */
+export const TRACK_WORK_KIND_LABELS = {
+    project: "Project",
+    flow: "Flow",
+    operation: "Operation",
+    investigation: "Investigation",
+    incident: "Incident",
+    commission: "Commission",
+    pathway: "Pathway",
+};
+/** `TRACK_UNCERTAINTY_LABELS` */
+export const TRACK_UNCERTAINTY_LABELS = {
+    clear: "Clear",
+    complicated: "Complicated",
+    complex: "Complex",
+    chaotic: "Chaotic",
+    unknown: "Unknown",
+};
+/** `GOAL_CRITERION_MARK_LABELS` */
+export const GOAL_CRITERION_MARK_LABELS = {
+    met: "Met",
+    claimed: "Claimed",
+    under_way: "Under way",
+    not_met: "Not met",
+    not_started: "Not started",
+};
+/** `WAITING_ON_REASON_LABELS` */
+export const WAITING_ON_REASON_LABELS = {
+    input: "Input",
+    approval: "Approval",
+    access: "Access",
+    another_work: "Other work",
+    outside_world: "Outside world",
+};
+/** `TRACK_PARTICIPANT_ROLE_LABELS` (vocabulary/track-participant-words.ts) */
+export const TRACK_PARTICIPANT_ROLE_LABELS = {
+    owner: "Owner",
+    judge: "Judge",
+    delegate: "Delegate",
+    integrator: "Integrator",
+};
+/** `TRACK_COMMITMENT_STATE_LABELS` (vocabulary/track-participant-words.ts) */
+export const TRACK_COMMITMENT_STATE_LABELS = {
+    proposed: "Asked",
+    accepted: "Accepted",
+    countered: "Countered",
+    declined: "Declined",
+    reported_impossible: "Reported impossible",
+    done: "Done",
+};
+/** `GOAL_FIELD_LABELS` — the goal's stored fields as a person reads them. */
+export const GOAL_FIELD_LABELS = {
+    endState: "What done looks like",
+    criteria: "Done when",
+    workKind: "Kind of work",
+    uncertainty: "How well the way is known",
+    dropConditions: "Drop it if",
+};
+/**
+ * The vocabulary's fallback (`humanizeToken`, minus its cased-words list): a
+ * value no table names reads as words, never as the raw token.
+ */
+export function humanizeToken(token) {
+    const tail = token.includes(".") ? token.slice(token.lastIndexOf(".") + 1) : token;
+    const words = tail
+        .replace(/[_-]+/g, " ")
+        .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
+        .trim()
+        .toLowerCase();
+    return words ? words.charAt(0).toUpperCase() + words.slice(1) : "";
+}
+/** A token through its table, else humanized — `""` for none. */
+export function goalWord(table, token) {
+    if (!token)
+        return "";
+    return Object.hasOwn(table, token) ? table[token] : humanizeToken(token);
+}
+//# sourceMappingURL=goal-words.js.map

package/dist/lib/goal-words.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"goal-words.js","sourceRoot":"","sources":["../../src/lib/goal-words.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,4BAA4B;AAC5B,MAAM,CAAC,MAAM,mBAAmB,GAAqC;IACnE,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,QAAQ;IACnB,QAAQ,EAAE,SAAS;CACpB,CAAC;AAEF,6BAA6B;AAC7B,MAAM,CAAC,MAAM,oBAAoB,GAAqC;IACpE,GAAG,EAAE,KAAK;IACV,UAAU,EAAE,YAAY;IACxB,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,gBAAgB,EAAE,kBAAkB;IACpC,UAAU,EAAE,YAAY;IACxB,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,oBAAoB;CAC9B,CAAC;AAEF,+BAA+B;AAC/B,MAAM,CAAC,MAAM,sBAAsB,GAAqC;IACtE,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,MAAM;IACZ,SAAS,EAAE,WAAW;IACtB,aAAa,EAAE,eAAe;IAC9B,QAAQ,EAAE,UAAU;IACpB,UAAU,EAAE,YAAY;IACxB,OAAO,EAAE,SAAS;CACnB,CAAC;AAEF,iCAAiC;AACjC,MAAM,CAAC,MAAM,wBAAwB,GAAqC;IACxE,KAAK,EAAE,OAAO;IACd,WAAW,EAAE,aAAa;IAC1B,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;CACnB,CAAC;AAEF,mCAAmC;AACnC,MAAM,CAAC,MAAM,0BAA0B,GAAqC;IAC1E,GAAG,EAAE,KAAK;IACV,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,WAAW;IACtB,OAAO,EAAE,SAAS;IAClB,WAAW,EAAE,aAAa;CAC3B,CAAC;AAEF,iCAAiC;AACjC,MAAM,CAAC,MAAM,wBAAwB,GAAqC;IACxE,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,QAAQ;IAChB,YAAY,EAAE,YAAY;IAC1B,aAAa,EAAE,eAAe;CAC/B,CAAC;AAEF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,6BAA6B,GAAqC;IAC7E,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,UAAU,EAAE,YAAY;CACzB,CAAC;AAEF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,6BAA6B,GAAqC;IAC7E,QAAQ,EAAE,OAAO;IACjB,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;IACpB,mBAAmB,EAAE,qBAAqB;IAC1C,IAAI,EAAE,MAAM;CACb,CAAC;AAEF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,iBAAiB,GAAqC;IACjE,QAAQ,EAAE,sBAAsB;IAChC,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,cAAc;IACxB,WAAW,EAAE,2BAA2B;IACxC,cAAc,EAAE,YAAY;CAC7B,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACnF,MAAM,KAAK,GAAG,IAAI;SACf,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,IAAI,EAAE;SACN,WAAW,EAAE,CAAC;IACjB,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,QAAQ,CACtB,KAAuC,EACvC,KAAgC;IAEhC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAE,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;AAC5E,CAAC"}

package/dist/lib/hub-client.d.ts

@@ -60,23 +60,44 @@ export declare class HubNetworkError extends Error {
     });
 }
 /**
- * Append a one-line "need help?" footer with a clickable Discord invite. Prints
- * to stderr (same stream as the error it follows, so `2>/dev/null` hides both)
- * and only once per process. The invite is an OSC-8 hyperlink on an interactive
- * terminal, a plain URL when the stream is redirected/piped.
+ * Where to send users who hit a wall. The support door is the ONE customer
+ * support entry point shared by every Synap surface (`from=cli` tells support
+ * which surface the person came from); Discord stays as the community option.
  */
-export declare function discordHelpLine(): void;
+export declare const SUPPORT_URL = "https://synap.live/support?from=cli";
+/**
+ * Append a one-line "need help?" footer naming the support door (open a ticket)
+ * and the Discord invite. Prints to stderr (same stream as the error it
+ * follows, so `2>/dev/null` hides both) and only once per process. Each URL is
+ * an OSC-8 hyperlink on an interactive terminal, a plain URL when the stream is
+ * redirected/piped.
+ */
+export declare function helpFooterLine(): void;
 /**
  * Print a failed Hub call: its humanized message plus a hint for the classes
  * where the cause is not obvious from the message alone. Lives here rather than
  * in utils/logger so the logger stays domain-agnostic and the taxonomy and its
- * presentation sit in one file. Always closes with the one-time Discord footer.
+ * presentation sit in one file. Always closes with the one-time help footer.
  */
 export declare function renderHubError(err: unknown): void;
 export interface HubConfig {
     podUrl: string;
     apiKey: string;
+    /**
+     * The ACTING identity sent to the pod (body/query/path `userId`). Only an
+     * explicit caller id (SYNAP_USER_ID) or the sentinel "cli"; read it through
+     * `resolveUserId`, which asks the pod (/users/me) for "cli". Never seed it
+     * with a recorded agent id: the pod acts an agent key as the human it is
+     * linked to and 403s the agent's own id ("userId does not match the
+     * authenticated identity", 2026-10-23). The agent's id is `agentUserId`.
+     */
     userId: string;
+    /**
+     * The agent principal recorded with this key, when one was — WHO the key
+     * is, not who the pod acts as. For recognising the agent's own posts
+     * (`resolveAgentUserId`), never sent as the acting user.
+     */
+    agentUserId?: string;
     /** Active workspace — from `synap use`, pod default, or env var. Undefined if none configured. */
     workspaceId?: string;
     /** Active project — from `synap project use`, pod default, or env var. Peer of workspaceId; independent. */
@@ -116,7 +137,7 @@ export declare function attachActiveSessionId(sessionId: string): SessionAttachT
  * which reads as the command failing.
  */
 export declare function detachActiveSessionId(podUrl?: string): string | undefined;
-export declare function hubGet(path: string, params: Record<string, string | number | undefined>, cfg: HubConfig): Promise<unknown>;
+export declare function hubGet(path: string, params: Record<string, string | number | undefined>, cfg: HubConfig, timeoutMs?: number): Promise<unknown>;
 export declare function hubPost(path: string, body: unknown, cfg: HubConfig, timeoutMs?: number): Promise<unknown>;
 /**
  * Multipart POST for Hub doors that accept file uploads (e.g. source-file).

package/dist/lib/hub-client.js

@@ -3,10 +3,11 @@ import { join } from "node:path";
 import { getActivePodConfig, getActiveWorkspaceId, getActiveWorkspaceIdForPod, findPodNameByUrl, getActiveProjectBinding, getActiveProjectId, listPodProfiles, getPodOverride, getSurfaceAgentKey, } from "./pod.js";
 import { resolveAgentOverride } from "./agents-config.js";
 import { resolveActiveLensForPod, getClaudeSessionId, writeLens, clearLensField, } from "./session-lens.js";
-import { conversationHeaders } from "./conversation-headers.js";
+import { clientHeader, conversationHeaders } from "./conversation-headers.js";
 import { effectiveDirectoryLens, resolveDirectoryLensForPod, writeDirectoryLens, clearDirectoryLensField, } from "./directory-lens.js";
 import { preferClaudeCodeSurfaceKey } from "./key-source.js";
 import { samePodOrigin } from "./project-ref.js";
+import { PodMovedError, podFetch } from "./pod-moved.js";
 import { HubRestClient } from "@synap-core/hub-rest-client";
 import { log } from "../utils/logger.js";
 import chalk from "chalk";
@@ -277,44 +278,48 @@ function hubError(method, path, status, rawBody, suffix, ctx) {
         workspaceId: ctx?.workspaceId,
     });
 }
-/** Where to send users who hit a wall. */
+/**
+ * Where to send users who hit a wall. The support door is the ONE customer
+ * support entry point shared by every Synap surface (`from=cli` tells support
+ * which surface the person came from); Discord stays as the community option.
+ */
+export const SUPPORT_URL = "https://synap.live/support?from=cli";
 const DISCORD_INVITE_URL = "https://discord.gg/xhRdQ7hG5h";
 /** Wrap a URL in an OSC-8 terminal hyperlink so `label` is clickable. */
 function osc8Link(url, label) {
     return `\x1b]8;;${url}\x1b\\${label}\x1b]8;;\x1b\\`;
 }
 /**
- * Once-per-process guard for the Discord help footer. A single CLI invocation
+ * Once-per-process guard for the help footer. A single CLI invocation
  * runs one command; printing the footer at most once keeps it a footer, not a
  * per-error/per-line spam.
  */
-let _discordHelpShown = false;
+let _helpShown = false;
 /**
- * Append a one-line "need help?" footer with a clickable Discord invite. Prints
- * to stderr (same stream as the error it follows, so `2>/dev/null` hides both)
- * and only once per process. The invite is an OSC-8 hyperlink on an interactive
- * terminal, a plain URL when the stream is redirected/piped.
+ * Append a one-line "need help?" footer naming the support door (open a ticket)
+ * and the Discord invite. Prints to stderr (same stream as the error it
+ * follows, so `2>/dev/null` hides both) and only once per process. Each URL is
+ * an OSC-8 hyperlink on an interactive terminal, a plain URL when the stream is
+ * redirected/piped.
  */
-export function discordHelpLine() {
-    if (_discordHelpShown)
+export function helpFooterLine() {
+    if (_helpShown)
         return;
-    _discordHelpShown = true;
-    const link = process.stderr.isTTY
-        ? osc8Link(DISCORD_INVITE_URL, DISCORD_INVITE_URL)
-        : DISCORD_INVITE_URL;
-    console.error(chalk.dim(`    Need help? Join our Discord: ${link}`));
+    _helpShown = true;
+    const link = (url) => (process.stderr.isTTY ? osc8Link(url, url) : url);
+    console.error(chalk.dim(`    Need help? Open a ticket: ${link(SUPPORT_URL)} (or join our Discord: ${link(DISCORD_INVITE_URL)})`));
 }
 /**
  * Print a failed Hub call: its humanized message plus a hint for the classes
  * where the cause is not obvious from the message alone. Lives here rather than
  * in utils/logger so the logger stays domain-agnostic and the taxonomy and its
- * presentation sit in one file. Always closes with the one-time Discord footer.
+ * presentation sit in one file. Always closes with the one-time help footer.
  */
 export function renderHubError(err) {
     renderHubErrorBody(err);
     // ONE central place every failed Hub command flows through — append the help
     // footer here so it prints once per failed command (guarded), not per line.
-    discordHelpLine();
+    helpFooterLine();
 }
 function renderHubErrorBody(err) {
     // Hints use log.hint (stderr), not log.dim (stdout): a hint belongs to the
@@ -325,6 +330,11 @@ function renderHubErrorBody(err) {
         log.hint(err.hint);
         return;
     }
+    if (err instanceof PodMovedError) {
+        // One line: what happened and what to run.
+        log.error(err.message);
+        return;
+    }
     if (!(err instanceof HubError)) {
         log.error(err instanceof Error ? err.message : String(err));
         return;
@@ -475,8 +485,9 @@ export async function resolveHubConfig(opts) {
         return {
             podUrl: podOverride.podUrl,
             apiKey: podOverride.hubApiKey,
-            // A profile's agentUserId may be empty; "cli" makes resolveUserId fetch /users/me.
-            userId: podOverride.agentUserId || "cli",
+            // "cli": resolveUserId asks the pod who this key acts as (see HubConfig.userId).
+            userId: "cli",
+            agentUserId: podOverride.agentUserId || undefined,
             workspaceId: safeWs,
             projectId: resolveProjectIdForPod(podOverride.podUrl, {}),
         };
@@ -499,10 +510,13 @@ export async function resolveHubConfig(opts) {
         return {
             podUrl,
             apiKey: agentOverride.apiKey,
-            // The AGENT's own id, recorded with its key. Never the pod profile name
-            // (it was, so `synap worker` never recognised its own room posts and
-            // resumed itself on them). Unrecorded → "cli": resolveUserId asks the pod.
-            userId: agentOverride.agentUserId || "cli",
+            // The acting user is asked of the pod ("cli" → /users/me): an agent key
+            // acts as its linked human, and the pod 403s the agent's own id.
+            userId: "cli",
+            // The AGENT's own id, recorded with its key — for `synap worker` to
+            // recognise its own room posts (resolveAgentUserId). Never the pod
+            // profile name (it once was, and the worker resumed itself on them).
+            agentUserId: agentOverride.agentUserId || undefined,
             scopes: envScopes ? envScopes.split(",") : undefined,
         };
     }
@@ -513,7 +527,13 @@ export async function resolveHubConfig(opts) {
     const envScopes = process.env.SYNAP_KEY_SCOPES;
     const envWorkspace = process.env.SYNAP_WORKSPACE_ID;
     const envProject = process.env.SYNAP_PROJECT_ID;
-    if (envPod && envKey && envUser) {
+    // Pod + key are enough. SYNAP_USER_ID used to be required too, so a shell
+    // with just the pair (`SYNAP_POD_URL=… SYNAP_HUB_API_KEY=… synap app
+    // connect`, the documented way to try another key) fell through to "No pod
+    // configured" (2026-10-20). Unset, userId is "cli" and resolveUserId asks
+    // the pod (/users/me) — the same fallback --pod and SYNAP_AGENT use. The
+    // claude-code surface-key preference below still applies.
+    if (envPod && envKey) {
         // Surface-bound resolution guard: if this pod has a `claude-code` surface
         // key pinned to it (via `synap connect --target=claude-code`) and the
         // ambient SYNAP_HUB_API_KEY doesn't match it, the session inherited a
@@ -534,6 +554,7 @@ export async function resolveHubConfig(opts) {
         }
         const apiKey = preferred.apiKey;
         const userId = preferred.userId;
+        const agentUserId = preferred.agentUserId;
         // Per-Claude-session lens wins over the global env var, so concurrent
         // sessions can each be scoped to a different workspace — but ONLY when the
         // lens belongs to THIS pod. A lens stamped with another pod is ignored so
@@ -550,6 +571,7 @@ export async function resolveHubConfig(opts) {
             podUrl: envPod,
             apiKey,
             userId,
+            agentUserId,
             // The global-config fallback is resolved AGAINST THIS POD (envPod) —
             // never send a workspace that belongs to a different pod.
             workspaceId: lens?.workspaceId ||
@@ -580,7 +602,10 @@ export async function resolveHubConfig(opts) {
     return {
         podUrl: config.podUrl,
         apiKey: config.hubApiKey,
-        userId: config.agentUserId,
+        // "cli": resolveUserId asks the pod. A profile's agentUserId is the key's
+        // principal (a computer or agent key), not who the pod acts as.
+        userId: "cli",
+        agentUserId: config.agentUserId || undefined,
         // session lens › directory lens › global config. (No env rung here: this
         // branch is only reached when SYNAP_POD_URL is unset.)
         workspaceId: activeLens?.workspaceId || activeDirLens?.workspaceId || getActiveWorkspaceId(),
@@ -696,13 +721,18 @@ export function detachActiveSessionId(podUrl) {
     return previous;
 }
 /**
- * Per-request headers: the focus session this terminal is attached to, and the
+ * Per-request headers: which client calls (`synap-cli/<version>`), the focus
+ * session this terminal is attached to, and the
  * Claude Code conversation the call comes from (`conversation-headers.ts`) — so
  * the work it lands can be traced back to, and reopened in, that conversation.
  */
 function sessionHeaders(cfg) {
     const id = resolveActiveSessionId(cfg?.podUrl);
-    return { ...conversationHeaders(getClaudeSessionId()), ...(id ? { "X-Session-Id": id } : {}) };
+    return {
+        ...clientHeader("synap-cli"),
+        ...conversationHeaders(getClaudeSessionId()),
+        ...(id ? { "X-Session-Id": id } : {}),
+    };
 }
 /** Max 429 retries for bulk import (each waits up to the rate-limit window). */
 const HUB_429_MAX_RETRIES = 12;
@@ -786,9 +816,11 @@ async function hubFetchWithRetry(url, init, label, timeoutMs) {
         await acquireHubSlot();
         let res;
         try {
-            res = await fetch(url, init);
+            res = await podFetch(url, init);
         }
         catch (err) {
+            if (err instanceof PodMovedError)
+                throw err;
             throw networkError(err, url, labelMethod, labelPath, timeoutMs);
         }
         if (res.status !== 429)
@@ -804,7 +836,10 @@ async function hubFetchWithRetry(url, init, label, timeoutMs) {
         await sleep(wait);
     }
 }
-export async function hubGet(path, params, cfg) {
+export async function hubGet(path, params, cfg, 
+// Default 15s suits reads. A long-poll door (`/answers/wait`) holds the
+// request open for its own `timeoutSeconds`; its caller passes more.
+timeoutMs = 15_000) {
     const url = new URL(`${cfg.podUrl}/api/hub${path}`);
     for (const [k, v] of Object.entries(params)) {
         if (v !== undefined)
@@ -812,8 +847,8 @@ export async function hubGet(path, params, cfg) {
     }
     const res = await hubFetchWithRetry(url.toString(), {
         headers: { Authorization: `Bearer ${cfg.apiKey}`, ...sessionHeaders(cfg) },
-        signal: AbortSignal.timeout(15_000),
-    }, `GET ${path}`, 15_000);
+        signal: AbortSignal.timeout(timeoutMs),
+    }, `GET ${path}`, timeoutMs);
     if (!res.ok) {
         const body = await res.text().catch(() => "");
         throw hubError("GET", path, res.status, body, undefined, cfg);
@@ -887,7 +922,7 @@ export async function hubPostMultipartRetryable(path, buildForm, cfg, timeoutMs
         const url = `${cfg.podUrl}/api/hub${path}`;
         let res;
         try {
-            res = await fetch(url, {
+            res = await podFetch(url, {
                 method: "POST",
                 headers: { Authorization: `Bearer ${cfg.apiKey}`, ...sessionHeaders(cfg) },
                 body: form,
@@ -895,6 +930,8 @@ export async function hubPostMultipartRetryable(path, buildForm, cfg, timeoutMs
             });
         }
         catch (err) {
+            if (err instanceof PodMovedError)
+                throw err;
             throw networkError(err, url, "POST multipart", path, timeoutMs);
         }
         if (res.status !== 429) {
@@ -919,7 +956,7 @@ export async function hubPatch(path, body, cfg) {
     const url = `${cfg.podUrl}/api/hub${path}`;
     let res;
     try {
-        res = await fetch(url, {
+        res = await podFetch(url, {
             method: "PATCH",
             headers: { Authorization: `Bearer ${cfg.apiKey}`, "Content-Type": "application/json", ...sessionHeaders(cfg) },
             body: JSON.stringify(body),
@@ -927,6 +964,8 @@ export async function hubPatch(path, body, cfg) {
         });
     }
     catch (err) {
+        if (err instanceof PodMovedError)
+            throw err;
         throw networkError(err, url, "PATCH", path, 15_000);
     }
     if (!res.ok) {
@@ -942,13 +981,15 @@ export async function hubDelete(path, cfg) {
     const url = `${cfg.podUrl}/api/hub${path}`;
     let res;
     try {
-        res = await fetch(url, {
+        res = await podFetch(url, {
             method: "DELETE",
             headers: { Authorization: `Bearer ${cfg.apiKey}`, ...sessionHeaders(cfg) },
             signal: AbortSignal.timeout(15_000),
         });
     }
     catch (err) {
+        if (err instanceof PodMovedError)
+            throw err;
         throw networkError(err, url, "DELETE", path, 15_000);
     }
     if (!res.ok) {