@synap-core/cli 1.13.0 → 1.13.1-next.20261102.3a66eb1

package/skills/synap/hand-off.md

@@ -2,6 +2,10 @@
 
 The person says "start this on my devbox", "have my Mac's Claude Code do it", "give this session to Codex". You find the agent, hand it the work through a session, follow the session's room, and report back. You never run their machine yourself: an agent they connected there (`synap worker`, Claude Code, Codex) picks the work up.
 
+**Words.** A _runner_ is the process on a computer that works the sessions handed to one agent (`synap worker`). It is not a pod _worker_ (`synap_list_workers`, `synap_enable_worker`): that is a playbook's trigger turned on for a goal, which starts runs and runs nothing itself (`concepts`). Say "the agent on your Mac", never just "the worker".
+
+**Where work runs.** Each computer takes the work it is for. A pod may hold its own skill naming which of the person's computers takes which work (load it when it exists); follow it over any guess. A runner started with `--protocols work-folder` takes playbook runs only: a code session handed to it is never launched, and it says so in the session's room.
+
 **1. Find it — `synap_list_agents`.** One read: `computers[]` (the person's own) and `agents[]`, each with `computer`, `canTakeYourWork` (else `whyNot`), `live`, `paused`, `lastSeenAt`, and `handOff`: what YOUR hand-off would do right now (`direct`, `asks_you`, `blocked` + `handOffReason`). Ready agents come first.
 
 - **Match the person's words against computer names first** ("my devbox" → the computer named `devbox`, any case), **then agent names and types** ("Codex", "claude-code"). Take the agents on that computer that can take the work.
@@ -9,6 +13,8 @@ The person says "start this on my devbox", "have my Mac's Claude Code do it", "g
 - **None fits → say so.** "I see no agent on a computer called devbox" plus what you do see. Never hand it to a different machine silently.
 - **`paused: true` → say it is paused** and that a person must resume it (Settings › Agents). Do not hand it off.
 - **`live: false` → say when it was last seen** (`lastSeenAt`) and that it picks the work up the next time it checks in. Hand off only if the person still wants it.
+- **Is a runner serving it? Read `servedAt` and `nobodyRuns`.** `nobodyRuns: false` (a recent `servedAt`): a runner serves it now. `nobodyRuns: true`: nothing on that computer runs it now; say so ("the agent on your Mac has not run since <servedAt>") and hand off only if the person wants the run to wait. `nobodyRuns: null`: the pod cannot tell (no runner ever stamped, or an old CLI); say "I cannot tell whether anything runs it; last seen <lastSeenAt>". `live` says only that its key was used.
+- **No runner online → recommend waiting, never a second path.** The session shows who holds it (nobody, or the agent stopped) until a runner picks it up. Do not do the same job another way; if the computer must be awake, that is the person's step.
 - **`canTakeYourWork: false`** — `whyNot` says why: `not_owned` (another person's agent: it would never see this work), `wrong_reach` (the pod's own agent: it answers in rooms, it never picks work up), `paused`.
 
 **2. Hand it — through a session.** The session's roster is how work reaches an agent.
@@ -19,13 +25,11 @@ The person says "start this on my devbox", "have my Mac's Claude Code do it", "g
 - **`asks_you` / `proposed`: the person approves the hand-off first.** Tell them plainly: "approve the hand-off on your phone", with the `reviewUrl` from the reply. It is success, do not retry. Then wait: `synap_get_session` until the agent is on its roster (or `synap_wait_for_answer` if you also asked them something), and go on to step 3.
 - **`blocked` / `denied`: say why, in the reason's words.** Never retry it as is. One case the list cannot predict: your own proposal limit ("Agent proposal limit reached") — the reply carries a link to raise it; pass that to the person.
 
-**3. Follow the room.** Everything the agent says lands in the session's room (`session.channelId`). Read it with `synap_get_thread_context { threadId: channelId }`; read the session's outcomes with `synap_get_session`. A `synap worker` on that computer follows this protocol:
+**3. Follow the room.** Everything the agent says lands in the session's room (`session.channelId`). Read it with `synap_get_thread_context { threadId: channelId }`; read the session's outcomes with `synap_get_session`. A `synap worker` on that computer checks for handed sessions about every 30 seconds (never one its own identity started), starts ONE run of Claude Code per session, and **claims** it in the room in one line. Which protocol the run follows depends on the session:
 
-- It checks for handed sessions about every 30 seconds and starts ONE run of Claude Code per session, in its working folder.
-- It **claims** the session in the room in one line: picked up, and what it will do first.
-- It works on a branch (`devbox/<session>-<slug>`, in a git worktree). It never pushes to main and never deploys.
-- It **asks** with a room message starting `QUESTION:`. Kind `update` = you, the orchestrating AI, can answer; kind `question` = a decision only the person can make (the person is notified). It waits up to 30 minutes, reading the room every minute, and takes the FIRST reply posted after its question. No reply: it states its assumption and continues, or stops and says what is blocked.
-- It **reports** in the room (what changed, branch, commit, files) and records deliverables against the session's outcomes. It does not close the session; the owner does.
+- **Code** — a session that runs no playbook, or one with a `repo`/`repos`/`branch` param or a `pull_request`/`branch`/`code` deliverable. It works on a branch (`devbox/<session>-<slug>`, in a git worktree), never pushes to main, never deploys, and may open a DRAFT pull request. It **asks** with a room message starting `QUESTION:`: kind `update` = you, the orchestrating AI, can answer; kind `question` = a decision only the person can make (the person is notified). It waits up to 30 minutes and takes the FIRST reply posted after its question; no reply: it states its assumption and continues, or stops and says what is blocked.
+- **Work-folder** — a playbook run over pod data (a video edit, a CRM list, an interview). It works in a folder of its own (`<work root>/<session id>`), with no git; files every deliverable to the pod and records it on the session's outcomes. It **asks** through a human-owned slot with an ask (what the person sees in Needs you), never a `QUESTION:` line, and waits up to 30 minutes for the answer.
+- Either way it **reports** in the room (what it made and where, the first thing to check) and records deliverables against the session's outcomes. It does not close the session; the owner does.
 - **Any room message posted after its run ended, by anyone but the agent, wakes it again** in the same conversation (up to 20 times). That is how an answer reaches it after it stopped. So post in the room only what you want it to act on.
 
 Answer a `QUESTION:` of kind `update` yourself with `synap_post_message` to the room. Leave kind `question` to the person, or ask them and relay their answer.

package/skills/synap/reflexes.md

@@ -4,13 +4,13 @@
 
 The user's Synap pod: source of truth. Tool names below are stems; your door may prefix them (`pod__ask`).
 
-1. **Recall first.** Before answering or creating, `ask`.
-2. **Capture after.** A durable fact, decision, person, task: `capture`; about the user: `remember_fact`. No private scratchpad.
-3. **Orient once.** `orient`: pending review (raise first), open sessions.
+1. **Recall first.** `get_*` a known id, else `ask`.
+2. **Capture as you go.** A decision, learning, pain (`finding`), win (`proof-point`), fact or task: `capture` it when it happens; about the user: `remember_fact`.
+3. **Orient once.** `orient`: pending review, open sessions.
 4. **Work in a session.** `start_session` or resume (playbook `templateId`); goal (TRACK): `list_tracks`, else `start_track`; work in it = `start_session` + `trackId`; 2-5 `criteria`; status moves carry `expectedStatus`; person-only: `owner:'human'` slot + `blockedReason` + `ask` (confirm/choose with 1 `recommended`/form/act/provide), then `wait_for_answer` if listed; post progress, questions and results in its room (`post_message` to `session.channelId`); your own chat may repeat them (`Q-<id8>`); chat answer → `relay_answer`, words verbatim; PR = outcome `pr-<repo>-<n>` (`ref.url`); `evaluate_session`, close open asks, `complete_session`.
 5. **Never guess a project**: pin only what the user names (`set_*_focus`).
 6. **`proposed` is success**: keep going, never retry.
-7. **Discover before inventing**: `list_profiles` / `list_capabilities`; **extend** (facet, overlay, parent), never a twin.
+7. **Discover before inventing**: `list_profiles` / `list_capabilities`; **extend**, never a twin.
 8. **One space per domain**; projects filter it (`file_into_project`, `project_use_workspace`).
 
 Depth: `load_skill` `system/synap/concepts`, `work-model`, `focus-sessions`, `from-intent`, `escalation-ladder`, `writes`.

package/skills/synap/work-model.md

@@ -53,7 +53,7 @@ A worker is a playbook **activator**, declared on the method and owned by the li
 
 ### Goals (tracks)
 
-A goal is a _track_ in every tool and field name (`start_track`, `trackId`) — say "goal" to the person; a session's one-line `goal` is its **Aim**. A goal holds an owner, a direction, instructions, the workers it turns on, and what done means (criteria, or a number measured as transitions into `done`). It has no stages. A goal can stay open as long as it matters, or finish: a person closes it with a verdict once its criteria are met (`set_track_status` `completed` + `verdict`; dropped = `archived`, with a `verdict` saying why). Your close is a proposal; a closed goal comes back only as a new version. Pause it while nobody should work on it. Work in it = `start_session` + `trackId`. A thing may count for two goals. Solo users may never need one: workers can run space-wide. Legacy: `start_stage_session` and `add_track_stage` serve old goals started from a method; never `advance_track` without the user.
+A goal is a _track_ in every tool and field name (`start_track`, `trackId`) — say "goal" to the person; a session's one-line `goal` is its **Aim**. A goal holds an owner, a direction, instructions, the workers it turns on, and what done means (criteria, or a number measured as transitions into `done`). It has no stages. A goal can stay open as long as it matters, or finish: a person closes it with a verdict once its criteria are met (`set_track_status` `completed` + `verdict`; dropped = `archived`, with a `verdict` saying why; every move sends `expectedStatus`, the status you read). Your close is a proposal; a closed goal comes back only as a new version. Pause it while nobody should work on it. Work in it = `start_session` + `trackId`. A thing may count for two goals. Solo users may never need one: workers can run space-wide. Legacy: `start_stage_session` and `add_track_stage` serve old goals started from a method; never `advance_track` without the user.
 
 **Keep the pod current (every agent, every session)** — three rules, so the next agent picks your step up from the pod alone:
 

package/skills/synap/writing-titles.md

@@ -61,3 +61,10 @@ claim cut off. Everything else goes elsewhere:
 
 When unsure, ask: "will this still help someone in three months, and is it a
 fact, a pitfall or a rule?" If not, it is not knowledge.
+
+### Descriptions of projects, spaces and goals
+
+A description says what the thing **is** and who it is for. A decision is
+**linked, never restated**: a restated decision goes stale the day the decision
+changes (the Synap project description repeated the 5 Oct branding split, which
+a 13 Oct decision replaced). Link the `decision` entity; let it carry the rule.

package/skills/synap-app/SKILL.md

@@ -65,8 +65,8 @@ Pin `@^1.0.0` on `sdk`/`react` so you never resolve an old, abandoned `0.x`.
   needed, fetches the release bundle, checks it against the release manifest's
   sha256 and runs `synap install`); see the backend's `deploy/README.md`. It
   also checks the manifest's signature: by default
-  (`SYNAP_RELEASE_VERIFY=warn`) it only warns and carries on when the signature
-  is missing or does not verify; `SYNAP_RELEASE_VERIFY=enforce` refuses.
+  (`SYNAP_RELEASE_VERIFY=enforce`) it refuses a release whose signature is
+  missing or does not verify; `SYNAP_RELEASE_VERIFY=warn` only warns.
 - **Managed (paid):** sign up at synap.live and provision a pod.
 
 You can develop the base app with **no pod at all** using its mock mode

package/skills/synap-app/overview.md

@@ -42,8 +42,8 @@ Pin `@^1.0.0` on `sdk`/`react` so you never resolve an old, abandoned `0.x`.
   needed, fetches the release bundle, checks it against the release manifest's
   sha256 and runs `synap install`); see the backend's `deploy/README.md`. It
   also checks the manifest's signature: by default
-  (`SYNAP_RELEASE_VERIFY=warn`) it only warns and carries on when the signature
-  is missing or does not verify; `SYNAP_RELEASE_VERIFY=enforce` refuses.
+  (`SYNAP_RELEASE_VERIFY=enforce`) it refuses a release whose signature is
+  missing or does not verify; `SYNAP_RELEASE_VERIFY=warn` only warns.
 - **Managed (paid):** sign up at synap.live and provision a pod.
 
 You can develop the base app with **no pod at all** using its mock mode

package/skills/synap-market/SKILL.md

@@ -622,4 +622,4 @@ wired at every install site). The browser UI is **display-only**: it threads
 `requiredTier` through to a "requires <tier>" badge but does NOT hard-block, and
 its lock/upgrade CTA only engages once a host wires a billing destination — so
 don't add a UI-side gate expecting it to enforce anything, and don't rebuild the
-badge thread (it exists). Full current-state: repo `TEMPLATE-DEV-GUIDE.md`.
+badge thread (it exists). Full current-state: the catalog README (`synap-app/packages/workspace-templates/README.md`).

package/skills/synap-market/governance-and-catalog.md

@@ -60,4 +60,4 @@ wired at every install site). The browser UI is **display-only**: it threads
 `requiredTier` through to a "requires <tier>" badge but does NOT hard-block, and
 its lock/upgrade CTA only engages once a host wires a billing destination — so
 don't add a UI-side gate expecting it to enforce anything, and don't rebuild the
-badge thread (it exists). Full current-state: repo `TEMPLATE-DEV-GUIDE.md`.
+badge thread (it exists). Full current-state: the catalog README (`synap-app/packages/workspace-templates/README.md`).

package/skills/synap-schema/SKILL.md

@@ -404,7 +404,10 @@ a package that consumes nothing would go stale in the one direction that is invi
    consumers typecheck against the built `dist/`, so a skipped rebuild makes your gate lie.
    Post-seed rows today: `publish_post` (0284, write), `delegate_agent_task`
    (0314, act — every verb of an external-agent binding, `tools.config.agentBinding`:
-   start / send / status / cancel) and `read_webpage` (0329).
+   start / send / status / cancel), `read_webpage` (0329, read), `search_web`
+   (0360, read) and `edit_video` (0370, act — sends the person's video to an
+   outside service; its one input, `{ video }`, is seeded on `input_schema` in
+   the same file).
 3. **Add it to mirror 2** — the same two lists in the control plane's
    `capability-intent-vocabulary.ts`.
 4. **Update the arity floors** — `SEED_SLUG_ARITY` / `EXTRA_SLUG_ARITY` in

package/skills/synap-schema/intent-vocabulary-ssot.md

@@ -87,7 +87,10 @@ a package that consumes nothing would go stale in the one direction that is invi
    consumers typecheck against the built `dist/`, so a skipped rebuild makes your gate lie.
    Post-seed rows today: `publish_post` (0284, write), `delegate_agent_task`
    (0314, act — every verb of an external-agent binding, `tools.config.agentBinding`:
-   start / send / status / cancel) and `read_webpage` (0329).
+   start / send / status / cancel), `read_webpage` (0329, read), `search_web`
+   (0360, read) and `edit_video` (0370, act — sends the person's video to an
+   outside service; its one input, `{ video }`, is seeded on `input_schema` in
+   the same file).
 3. **Add it to mirror 2** — the same two lists in the control plane's
    `capability-intent-vocabulary.ts`.
 4. **Update the arity floors** — `SEED_SLUG_ARITY` / `EXTRA_SLUG_ARITY` in

package/dist/commands/template.d.ts

@@ -1,42 +0,0 @@
-/**
- * `synap template` — the "one request" template surface (TEMPLATE-ONE-PATH-PLAN §3-4).
- * =====================================================================================
- *
- * The plan names ONE governed write door for adding/updating a workspace template:
- * `synap template publish <file>` → CP `POST /api/packages` (validated server-side).
- * No npm publish, no lockfile-bump, no redeploy. This file is that named surface.
- *
- *   synap template publish <file>   — validate + upsert to the CP (private by default; --public to share)
- *   synap template publish --from-workspace <id>  — serialize a LIVE workspace, then publish
- *   synap template list             — the caller-visible catalog (own private + public), slug/name/vis/version
- *   synap template get <slug>       — one template's metadata + definition shape
- *
- * REUSE, no reinvention: publish delegates to the existing `marketPublish` (same
- * validator, same CP transport). list/get read through `lib/cp-packages` — the ONE
- * authed CP `/api/packages` client (Bearer from `lib/auth`'s stored login token).
- * No `fetch` is hand-rolled here.
- *
- * NOTE (for the orchestrator): this overlaps `synap market publish/validate/
- * unpublish`, which already ship the same authoring loop. `synap template` is the
- * plan-canonical name; picking one and retiring/aliasing the other is a §4 Wave 2
- * cleanup decision, not made here.
- */
-/**
- * `synap template publish <file>` — the plan's "one request". A thin alias over
- * the existing `marketPublish` so there is exactly ONE publish implementation
- * (same validator, same CP write door, same `--public`/`--from-workspace`/`--json`).
- */
-export declare function templatePublish(file: string | undefined, opts: {
-    public?: boolean;
-    private?: boolean;
-    fromWorkspace?: string;
-    json?: boolean;
-    podUrl?: string;
-    apiKey?: string;
-}): Promise<void>;
-export declare function templateList(opts: {
-    json?: boolean;
-}): Promise<void>;
-export declare function templateGet(slug: string, opts: {
-    json?: boolean;
-}): Promise<void>;

package/dist/commands/template.js

@@ -1,191 +0,0 @@
-/**
- * `synap template` — the "one request" template surface (TEMPLATE-ONE-PATH-PLAN §3-4).
- * =====================================================================================
- *
- * The plan names ONE governed write door for adding/updating a workspace template:
- * `synap template publish <file>` → CP `POST /api/packages` (validated server-side).
- * No npm publish, no lockfile-bump, no redeploy. This file is that named surface.
- *
- *   synap template publish <file>   — validate + upsert to the CP (private by default; --public to share)
- *   synap template publish --from-workspace <id>  — serialize a LIVE workspace, then publish
- *   synap template list             — the caller-visible catalog (own private + public), slug/name/vis/version
- *   synap template get <slug>       — one template's metadata + definition shape
- *
- * REUSE, no reinvention: publish delegates to the existing `marketPublish` (same
- * validator, same CP transport). list/get read through `lib/cp-packages` — the ONE
- * authed CP `/api/packages` client (Bearer from `lib/auth`'s stored login token).
- * No `fetch` is hand-rolled here.
- *
- * NOTE (for the orchestrator): this overlaps `synap market publish/validate/
- * unpublish`, which already ship the same authoring loop. `synap template` is the
- * plan-canonical name; picking one and retiring/aliasing the other is a §4 Wave 2
- * cleanup decision, not made here.
- */
-import chalk from "chalk";
-import { log } from "../utils/logger.js";
-import { getStoredToken, isTokenLocallyExpired } from "../lib/auth.js";
-import { fetchMyRows, fetchPublicBrowseRows, fetchPackageDefinition, } from "../lib/cp-packages.js";
-// ─── publish ─────────────────────────────────────────────────────────────────
-/**
- * `synap template publish <file>` — the plan's "one request". A thin alias over
- * the existing `marketPublish` so there is exactly ONE publish implementation
- * (same validator, same CP write door, same `--public`/`--from-workspace`/`--json`).
- */
-export async function templatePublish(file, opts) {
-    const { marketPublish } = await import("./market-authoring.js");
-    await marketPublish(file, opts);
-}
-/** private/public/unknown → a short colored label. */
-function visLabel(isPublic) {
-    if (isPublic === false)
-        return chalk.yellow("private");
-    if (isPublic === true)
-        return chalk.green("public");
-    return chalk.dim("public");
-}
-/**
- * Fetch the caller-visible catalog: the caller's own rows (incl. private) when
- * logged in, merged with the public browse rows. `/mine` wins a slug tie so the
- * real `isPublic` flag and owned marker survive.
- */
-async function fetchCatalog() {
-    const creds = getStoredToken();
-    const loggedIn = !!creds && !isTokenLocallyExpired(creds);
-    const filters = { category: "workspace" };
-    // Public browse is best-effort — a private catalog that resolves is still useful.
-    const publicRows = await fetchPublicBrowseRows(filters).catch(() => []);
-    const bySlug = new Map();
-    for (const r of publicRows) {
-        bySlug.set(r.slug, {
-            slug: r.slug,
-            displayName: r.displayName,
-            description: r.description,
-            version: r.version,
-            isPublic: true,
-            owned: false,
-        });
-    }
-    if (loggedIn) {
-        const mineRows = await fetchMyRows(creds.token, filters);
-        for (const r of mineRows) {
-            bySlug.set(r.slug, {
-                slug: r.slug,
-                displayName: r.displayName,
-                description: r.description,
-                version: r.version,
-                isPublic: r.isPublic,
-                owned: true,
-            });
-        }
-    }
-    const rows = [...bySlug.values()].sort((a, b) => a.slug.localeCompare(b.slug));
-    return { rows, loggedIn };
-}
-export async function templateList(opts) {
-    let catalog;
-    try {
-        catalog = await fetchCatalog();
-    }
-    catch (e) {
-        if (opts.json) {
-            console.log(JSON.stringify({ ok: false, error: e.message }, null, 2));
-        }
-        else {
-            log.error(`Could not list templates: ${e.message}`);
-            log.hint("Log in for your private templates: synap login");
-        }
-        process.exit(1);
-    }
-    if (opts.json) {
-        console.log(JSON.stringify({ ok: true, loggedIn: catalog.loggedIn, templates: catalog.rows }, null, 2));
-        return;
-    }
-    if (catalog.rows.length === 0) {
-        log.info("No templates visible.");
-        if (!catalog.loggedIn)
-            log.hint("Your private templates are hidden until you log in: synap login");
-        return;
-    }
-    log.heading(`Templates (${catalog.rows.length})`);
-    if (!catalog.loggedIn)
-        log.dim("Logged out — showing public templates only. `synap login` to see your private ones.");
-    log.blank();
-    for (const r of catalog.rows) {
-        const ver = r.version ? chalk.dim(` ${r.version}`) : "";
-        const owned = r.owned ? chalk.dim(" (yours)") : "";
-        console.log(`  ${chalk.bold(r.slug)}${ver}  ${visLabel(r.isPublic)}${owned}`);
-        console.log(`    ${chalk.cyan(r.displayName)}${r.description ? chalk.dim(`  ${r.description}`) : ""}`);
-    }
-    log.blank();
-    log.dim("Publish a template:  synap template publish <file>");
-    log.dim("Inspect one:         synap template get <slug>");
-}
-// ─── get ─────────────────────────────────────────────────────────────────────
-export async function templateGet(slug, opts) {
-    const creds = getStoredToken();
-    const token = creds && !isTokenLocallyExpired(creds) ? creds.token : undefined;
-    // Metadata: prefer the caller's own row (carries isPublic + version), else the
-    // public browse row for this slug.
-    let meta;
-    try {
-        if (token) {
-            const mine = await fetchMyRows(token, { category: "workspace", search: slug });
-            const own = mine.find((r) => r.slug === slug);
-            if (own) {
-                meta = { slug: own.slug, displayName: own.displayName, description: own.description, version: own.version, isPublic: own.isPublic, owned: true };
-            }
-        }
-        if (!meta) {
-            const pub = await fetchPublicBrowseRows({ category: "workspace", search: slug });
-            const row = pub.find((r) => r.slug === slug);
-            if (row) {
-                meta = { slug: row.slug, displayName: row.displayName, description: row.description, version: row.version, isPublic: true, owned: false };
-            }
-        }
-    }
-    catch (e) {
-        if (opts.json) {
-            console.log(JSON.stringify({ ok: false, slug, error: e.message }, null, 2));
-        }
-        else {
-            log.error(`Could not fetch "${slug}": ${e.message}`);
-        }
-        process.exit(1);
-    }
-    // Full definition (the install payload) — authed so a private template resolves.
-    const definition = await fetchPackageDefinition(slug, token).catch(() => null);
-    if (!meta && !definition) {
-        if (opts.json) {
-            console.log(JSON.stringify({ ok: false, slug, error: "not found" }, null, 2));
-        }
-        else {
-            log.error(`Template "${slug}" not found or not visible.`);
-            if (!token)
-                log.hint("If it is private, log in first: synap login");
-        }
-        process.exit(1);
-    }
-    if (opts.json) {
-        console.log(JSON.stringify({ ok: true, slug, ...meta, definition }, null, 2));
-        return;
-    }
-    const displayName = meta?.displayName ?? slug;
-    log.heading(`${displayName}  ${chalk.dim(`(${slug})`)}`);
-    log.blank();
-    if (meta?.description) {
-        console.log(`  ${meta.description}`);
-        log.blank();
-    }
-    if (meta?.version)
-        console.log(`  ${chalk.dim("version:")}    ${meta.version}`);
-    console.log(`  ${chalk.dim("visibility:")} ${visLabel(meta?.isPublic)}${meta?.owned ? chalk.dim(" (yours)") : ""}`);
-    const def = definition;
-    if (def) {
-        const count = (v) => (Array.isArray(v) ? v.length : 0);
-        console.log(`  ${chalk.dim("profiles:")}   ${count(def.profiles)}`);
-        console.log(`  ${chalk.dim("views:")}      ${count(def.views)}`);
-    }
-    log.blank();
-    log.dim(`Install it:  synap market install ${slug}`);
-}
-//# sourceMappingURL=template.js.map

package/dist/commands/template.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"template.js","sourceRoot":"","sources":["../../src/commands/template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,sBAAsB,GAGvB,MAAM,uBAAuB,CAAC;AAE/B,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAwB,EACxB,IAOC;IAED,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAChE,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAClC,CAAC;AAgBD,sDAAsD;AACtD,SAAS,QAAQ,CAAC,QAA6B;IAC7C,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACvD,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY;IACzB,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;IAE1C,kFAAkF;IAClF,MAAM,UAAU,GAAkB,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC,KAAK,CAC1E,GAAG,EAAE,CAAC,EAAmB,CAC1B,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE;YACjB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,QAAQ,GAAgB,MAAM,WAAW,CAAC,KAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACvE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE;gBACjB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,KAAK,EAAE,IAAI;aACZ,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAwB;IACzD,IAAI,OAAkD,CAAC;IACvD,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,YAAY,EAAE,CAAC;IACjC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACnF,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,CAAC,6BAA8B,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/D,GAAG,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACxG,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;QACnG,OAAO;IACT,CAAC;IAED,GAAG,CAAC,OAAO,CAAC,cAAc,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO,CAAC,QAAQ;QAAE,GAAG,CAAC,GAAG,CAAC,qFAAqF,CAAC,CAAC;IACtH,GAAG,CAAC,KAAK,EAAE,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;QAC9E,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,GAAG,CAAC,KAAK,EAAE,CAAC;IACZ,GAAG,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAC9D,GAAG,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;AAC5D,CAAC;AAED,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,IAAwB;IACtE,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,KAAK,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAE/E,+EAA+E;IAC/E,mCAAmC;IACnC,IAAI,IAA4B,CAAC;IACjC,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YAC9C,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACnJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACjF,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YAC7C,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;YAC5I,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACzF,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,CAAC,oBAAoB,IAAI,MAAO,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,iFAAiF;IACjF,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAE/E,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAChF,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,CAAC,aAAa,IAAI,6BAA6B,CAAC,CAAC;YAC1D,IAAI,CAAC,KAAK;gBAAE,GAAG,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9E,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,EAAE,WAAW,IAAI,IAAI,CAAC;IAC9C,GAAG,CAAC,OAAO,CAAC,GAAG,WAAW,KAAK,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;IACzD,GAAG,CAAC,KAAK,EAAE,CAAC;IACZ,IAAI,IAAI,EAAE,WAAW,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACrC,GAAG,CAAC,KAAK,EAAE,CAAC;IACd,CAAC;IACD,IAAI,IAAI,EAAE,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACpH,MAAM,GAAG,GAAG,UAA4C,CAAC;IACzD,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,KAAK,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,GAAG,CAAC,KAAK,EAAE,CAAC;IACZ,GAAG,CAAC,GAAG,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;AACvD,CAAC"}

package/dist/lib/browser-auth.d.ts

@@ -1,35 +0,0 @@
-/**
- * Browser-based connect flow — the recommended provisioning path.
- *
- * 1. Start a local HTTP server on an ephemeral port.
- * 2. Build `{podUrl}/admin/connect?integration=cli&redirect_uri=http://127.0.0.1:<port>/callback`.
- * 3. Open the user's default browser at that URL.
- * 4. Admin UI authenticates the user (Kratos session), mints a scoped Hub
- *    Protocol API key via `trpc.apiKeys.connectIntegration`, and redirects
- *    to `http://127.0.0.1:<port>/callback?context={apiKey,podUrl,workspaceId}`.
- * 5. Local server receives the callback, extracts credentials, shuts down.
- *
- * This is the same flow Raycast uses (via a `raycast://` deeplink) — for CLI
- * we just swap the deeplink for a loopback HTTP URL. The admin UI's redirect
- * whitelist accepts both.
- *
- * Security notes:
- *   - Loopback only (127.0.0.1) — no external network can intercept.
- *   - One-shot: server only handles the first /callback, then exits.
- *   - 5-minute timeout.
- *   - No CSRF token: single-use, host-local, bound to the process.
- */
-export interface BrowserAuthResult {
-    apiKey: string;
-    podUrl: string;
-    workspaceId?: string;
-}
-export interface BrowserAuthOptions {
-    podUrl: string;
-    integration: "cli" | "raycast" | "openclaw" | "custom";
-    /** Milliseconds to wait for the callback. Default 5min. */
-    timeoutMs?: number;
-    /** Hook invoked with the admin-panel URL right before opening the browser. */
-    onUrlReady?: (url: string) => void;
-}
-export declare function runBrowserAuth(opts: BrowserAuthOptions): Promise<BrowserAuthResult>;

package/dist/lib/browser-auth.js

@@ -1,170 +0,0 @@
-/**
- * Browser-based connect flow — the recommended provisioning path.
- *
- * 1. Start a local HTTP server on an ephemeral port.
- * 2. Build `{podUrl}/admin/connect?integration=cli&redirect_uri=http://127.0.0.1:<port>/callback`.
- * 3. Open the user's default browser at that URL.
- * 4. Admin UI authenticates the user (Kratos session), mints a scoped Hub
- *    Protocol API key via `trpc.apiKeys.connectIntegration`, and redirects
- *    to `http://127.0.0.1:<port>/callback?context={apiKey,podUrl,workspaceId}`.
- * 5. Local server receives the callback, extracts credentials, shuts down.
- *
- * This is the same flow Raycast uses (via a `raycast://` deeplink) — for CLI
- * we just swap the deeplink for a loopback HTTP URL. The admin UI's redirect
- * whitelist accepts both.
- *
- * Security notes:
- *   - Loopback only (127.0.0.1) — no external network can intercept.
- *   - One-shot: server only handles the first /callback, then exits.
- *   - 5-minute timeout.
- *   - No CSRF token: single-use, host-local, bound to the process.
- */
-import http from "node:http";
-import { URL } from "node:url";
-import { spawn } from "node:child_process";
-export async function runBrowserAuth(opts) {
-    const podUrl = opts.podUrl.replace(/\/$/, "");
-    const timeoutMs = opts.timeoutMs ?? 5 * 60_000;
-    return new Promise((resolve, reject) => {
-        const server = http.createServer();
-        let settled = false;
-        const settle = (fn) => {
-            if (settled)
-                return;
-            settled = true;
-            fn();
-            server.close();
-            clearTimeout(timeout);
-        };
-        const timeout = setTimeout(() => {
-            settle(() => reject(new Error("Timed out waiting for browser approval. Run again, or use --manual-key.")));
-        }, timeoutMs);
-        server.on("request", (req, res) => {
-            // Only accept GET /callback — reject anything else.
-            const reqUrl = new URL(req.url ?? "/", `http://127.0.0.1`);
-            if (reqUrl.pathname !== "/callback") {
-                res.writeHead(404).end("Not found");
-                return;
-            }
-            const raw = reqUrl.searchParams.get("context");
-            if (!raw) {
-                res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
-                res.end(errorHtml("No context received — try again."));
-                settle(() => reject(new Error("Callback missing `context` parameter")));
-                return;
-            }
-            try {
-                const parsed = JSON.parse(raw);
-                if (!parsed.apiKey || !parsed.podUrl) {
-                    throw new Error("Callback missing apiKey or podUrl");
-                }
-                res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-                res.end(successHtml(opts.integration));
-                settle(() => resolve({
-                    apiKey: parsed.apiKey,
-                    podUrl: parsed.podUrl,
-                    workspaceId: parsed.workspaceId ?? undefined,
-                }));
-            }
-            catch (err) {
-                res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
-                res.end(errorHtml("Invalid callback payload."));
-                settle(() => reject(err instanceof Error ? err : new Error(String(err))));
-            }
-        });
-        server.on("error", (err) => {
-            settle(() => reject(err));
-        });
-        server.listen(0, "127.0.0.1", () => {
-            const port = server.address().port;
-            const redirectUri = `http://127.0.0.1:${port}/callback`;
-            const adminUrl = new URL(`${podUrl}/admin/connect`);
-            adminUrl.searchParams.set("integration", opts.integration);
-            adminUrl.searchParams.set("redirect_uri", redirectUri);
-            const fullUrl = adminUrl.toString();
-            opts.onUrlReady?.(fullUrl);
-            openBrowser(fullUrl).catch(() => {
-                // Browser open failure is non-fatal — user can paste the URL themselves.
-            });
-        });
-    });
-}
-/**
- * Cross-platform browser open. Returns when the launcher has been kicked off,
- * not when the user has actually seen the page.
- */
-async function openBrowser(url) {
-    const platform = process.platform;
-    const [command, args] = platform === "darwin"
-        ? ["open", [url]]
-        : platform === "win32"
-            ? ["cmd", ["/c", "start", "", url]]
-            : ["xdg-open", [url]];
-    return new Promise((resolve, reject) => {
-        const child = spawn(command, args, {
-            stdio: "ignore",
-            detached: true,
-        });
-        child.once("error", reject);
-        child.once("spawn", () => {
-            child.unref();
-            resolve();
-        });
-    });
-}
-// ─── Page HTML ──────────────────────────────────────────────────────────────
-// Short, no external deps, CLI-tool vibe. Shown once per connect.
-function successHtml(integration) {
-    const label = integration.charAt(0).toUpperCase() + integration.slice(1);
-    return `<!doctype html>
-<html lang="en">
-  <head><meta charset="utf-8"><title>Synap connected</title>
-    <meta name="viewport" content="width=device-width, initial-scale=1">
-    <style>
-      :root { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif; }
-      body { margin: 0; background: #0A0A0A; color: #FAFAFA; display: grid; place-items: center; min-height: 100vh; }
-      .card { max-width: 420px; padding: 32px; text-align: center; }
-      .check { width: 48px; height: 48px; margin: 0 auto 16px; border-radius: 9999px; background: rgba(16, 185, 129, 0.12); display: grid; place-items: center; color: #10B981; }
-      h1 { font-size: 20px; margin: 0 0 8px; font-weight: 600; letter-spacing: -0.01em; }
-      p { margin: 0; color: rgba(250, 250, 250, 0.6); font-size: 14px; line-height: 1.5; }
-      code { background: rgba(250, 250, 250, 0.08); padding: 2px 6px; border-radius: 4px; font-size: 12px; }
-    </style>
-  </head>
-  <body>
-    <div class="card">
-      <div class="check">
-        <svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="20 6 9 17 4 12"></polyline></svg>
-      </div>
-      <h1>${label} connected</h1>
-      <p>You can close this tab and return to your terminal.</p>
-    </div>
-    <script>setTimeout(() => window.close(), 3000);</script>
-  </body>
-</html>`;
-}
-function errorHtml(reason) {
-    return `<!doctype html>
-<html lang="en">
-  <head><meta charset="utf-8"><title>Synap connect failed</title>
-    <meta name="viewport" content="width=device-width, initial-scale=1">
-    <style>
-      :root { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif; }
-      body { margin: 0; background: #0A0A0A; color: #FAFAFA; display: grid; place-items: center; min-height: 100vh; }
-      .card { max-width: 420px; padding: 32px; text-align: center; }
-      .x { width: 48px; height: 48px; margin: 0 auto 16px; border-radius: 9999px; background: rgba(239, 68, 68, 0.12); display: grid; place-items: center; color: #EF4444; }
-      h1 { font-size: 20px; margin: 0 0 8px; font-weight: 600; }
-      p { margin: 0; color: rgba(250, 250, 250, 0.6); font-size: 14px; line-height: 1.5; }
-    </style>
-  </head>
-  <body>
-    <div class="card">
-      <div class="x">
-        <svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"></line><line x1="6" y1="6" x2="18" y2="18"></line></svg>
-      </div>
-      <h1>Connect failed</h1>
-      <p>${reason}</p>
-    </div>
-  </body>
-</html>`;
-}
-//# sourceMappingURL=browser-auth.js.map

package/dist/lib/browser-auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"browser-auth.js","sourceRoot":"","sources":["../../src/lib/browser-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAkB3C,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAwB;IAExB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,MAAM,CAAC;IAE/C,OAAO,IAAI,OAAO,CAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,EAAc,EAAE,EAAE;YAChC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,EAAE,EAAE,CAAC;YACL,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,MAAM,CAAC,GAAG,EAAE,CACV,MAAM,CACJ,IAAI,KAAK,CACP,yEAAyE,CAC1E,CACF,CACF,CAAC;QACJ,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAChC,oDAAoD;YACpD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAC3D,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACpC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACpC,OAAO;YACT,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC/C,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;gBACnE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC,CAAC;gBACvD,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC,CAAC,CAAC;gBACxE,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAI5B,CAAC;gBACF,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;oBACrC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;gBACvD,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;gBACnE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;gBACvC,MAAM,CAAC,GAAG,EAAE,CACV,OAAO,CAAC;oBACN,MAAM,EAAE,MAAM,CAAC,MAAO;oBACtB,MAAM,EAAE,MAAM,CAAC,MAAO;oBACtB,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,SAAS;iBAC7C,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;gBACnE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC,CAAC;gBAChD,MAAM,CAAC,GAAG,EAAE,CACV,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAC5D,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAC;YACpD,MAAM,WAAW,GAAG,oBAAoB,IAAI,WAAW,CAAC;YACxD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,gBAAgB,CAAC,CAAC;YACpD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YAC3D,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YACvD,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,CAAC;YAC3B,WAAW,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC9B,yEAAyE;YAC3E,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,WAAW,CAAC,GAAW;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,GACnB,QAAQ,KAAK,QAAQ;QACnB,CAAC,CAAE,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAW;QAC5B,CAAC,CAAC,QAAQ,KAAK,OAAO;YACpB,CAAC,CAAE,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAW;YAC9C,CAAC,CAAE,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAW,CAAC;IAEvC,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;YACjC,KAAK,EAAE,QAAQ;YACf,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,kEAAkE;AAElE,SAAS,WAAW,CAAC,WAAmB;IACtC,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO;;;;;;;;;;;;;;;;;;;YAmBG,KAAK;;;;;QAKT,CAAC;AACT,CAAC;AAED,SAAS,SAAS,CAAC,MAAc;IAC/B,OAAO;;;;;;;;;;;;;;;;;;;WAmBE,MAAM;;;QAGT,CAAC;AACT,CAAC"}