@synapsor/runner 0.1.10 → 0.1.12

package/docs/cloud-push.md

@@ -0,0 +1,54 @@
+# Push A Contract To Synapsor Cloud
+
+Cloud push registers the same canonical contract that you validate and run
+locally. Cloud stores a normalized immutable version, computes its digest,
+records the actor, and makes the safety boundary visible in the workspace
+registry.
+
+## Preview Without A Network Call
+
+```bash
+synapsor-runner cloud push ./synapsor.contract.json --dry-run
+synapsor-runner cloud push ./synapsor.contract.json --dry-run --json
+```
+
+Dry-run validates and normalizes locally. It performs no network request.
+
+## Push
+
+```bash
+export SYNAPSOR_CLOUD_BASE_URL="https://api.synapsor.ai"
+export SYNAPSOR_CLOUD_TOKEN="<workspace-scoped-token>"
+export SYNAPSOR_WORKSPACE_ID="<workspace-id>"
+
+synapsor-runner cloud push ./synapsor.contract.json \
+  --name support-plan-credit
+```
+
+The response includes the contract id, immutable version id, server-computed
+digest, summary counts, status, and registry path. Identical normalized content
+is idempotent; changed content creates the next version.
+
+Tokens are sent in the authorization header and are never part of the contract.
+Database URLs, passwords, private keys, and model-controlled tenant bindings
+are rejected by server-side validation.
+
+`SYNAPSOR_CLOUD_WORKSPACE` is accepted as an alias for
+`SYNAPSOR_WORKSPACE_ID`. Explicit `--workspace` wins over environment values.
+
+Cloud push fails before upload when local validation fails. HTTP failures are
+reported distinctly for invalid/expired tokens (`401`), insufficient workspace
+permission (`403`), missing workspace/API paths (`404`), registry conflicts
+(`409`), server validation (`422`), and Cloud/network failures. Error output
+does not echo the bearer token.
+
+## Cloud To Local
+
+Open **Contract registry** in the workspace, choose a version, and download its
+runner bundle. The ZIP contains the normalized contract, local runner wiring,
+placeholder environment file, README, and MCP client examples. It contains no
+live credentials or table rows.
+
+Cloud currently preserves approval policy definitions in the contract and
+bundle. Hosted approval-policy enforcement remains a separate Cloud feature;
+do not infer it from registry storage alone.

package/docs/current-scope.md

@@ -2,7 +2,7 @@
 
 The canonical scope page is [Current Limitations](limitations.md).
 
-Current alpha scope:
+Current `0.1.x` scope:
 
 - local semantic MCP tools for Postgres/MySQL-backed business actions;
 - schema inspection and guided config generation;

package/docs/mcp-clients.md

@@ -0,0 +1,123 @@
+# MCP Client Configs
+
+Synapsor Runner exposes reviewed semantic tools over standard MCP. The model
+receives inspect/propose capabilities; it does not receive raw SQL, database
+credentials, approval commands, or apply commands.
+
+The complete copy-paste templates live in:
+
+- [`examples/support-plan-credit/mcp-client-examples/`](../examples/support-plan-credit/mcp-client-examples/)
+- every local `synapsor-runner contract bundle` output;
+- every downloadable Synapsor Cloud runner bundle.
+
+Before connecting a client, validate the local boundary:
+
+```bash
+synapsor-runner config validate --config ./synapsor.runner.json
+synapsor-runner tools preview --config ./synapsor.runner.json --store ./.synapsor/local.db
+```
+
+Set database and trusted-context values in the environment that launches the
+MCP process. Keep real URLs and tokens in your shell or secret manager, not in
+the checked-in client JSON.
+
+## Stdio
+
+Use stdio for Claude Desktop, Cursor, and other local MCP clients:
+
+```json
+{
+  "command": "npx",
+  "args": [
+    "-y", "-p", "@synapsor/runner", "synapsor-runner",
+    "mcp", "serve", "--config", "./synapsor.runner.json",
+    "--store", "./.synapsor/local.db"
+  ]
+}
+```
+
+Relative paths are resolved from the MCP client's working directory. Use the
+project template when the client starts in your repository; replace the marked
+bundle path in the global template when it does not.
+
+### Claude Desktop
+
+1. Open Claude Desktop settings and choose the developer option to edit its MCP
+   configuration.
+2. Merge `claude-desktop.json` into the existing `mcpServers` object.
+3. Replace the marked working directory or use absolute paths when Claude does
+   not start in the bundle directory.
+4. Restart Claude Desktop completely, then confirm the two semantic tools are
+   listed.
+
+Claude Desktop launched from a graphical session may not inherit your terminal
+environment. Supply the required env values through the OS process environment
+or a local secret-manager wrapper; do not paste production credentials into a
+repository file.
+
+### Cursor
+
+For one repository, place the project template at `.cursor/mcp.json`. For a
+global setup, merge `cursor-global.mcp.json` through Cursor's MCP settings and
+replace every `<absolute-path-to-bundle>` marker. Restart the MCP server from
+Cursor settings after editing.
+
+The model-facing list should contain only the contract's inspect/propose tools.
+If Cursor reports a missing config or store, use absolute paths and rerun
+`tools preview` from the same working directory.
+
+### OpenAI Agents SDK
+
+Install the SDK in your agent project and run either TypeScript template:
+
+```bash
+npm install @openai/agents
+```
+
+OpenAI function names cannot contain dots. The stdio template therefore starts
+Runner with `--alias-mode openai`; model-visible names use `__`, while result
+metadata preserves the canonical dotted Synapsor capability name.
+
+## Streamable HTTP
+
+```bash
+synapsor-runner mcp serve \
+  --transport streamable-http \
+  --alias-mode openai \
+  --host 127.0.0.1 \
+  --port 8766 \
+  --config ./synapsor.runner.json \
+  --store ./.synapsor/local.db
+```
+
+Connect a standard Streamable HTTP MCP client to
+`http://127.0.0.1:8766/mcp`. Keep it on loopback for local development. For a
+network deployment, terminate TLS, require authentication, restrict network
+access, and follow the [production guide](production.md).
+
+Use `--alias-mode openai` for the OpenAI Agents SDK. Omit it for clients that
+accept canonical dotted names, or use `--alias-mode both` only during a planned
+migration where duplicate canonical/alias tools are acceptable.
+
+## Verify The Boundary
+
+```bash
+synapsor-runner tools preview --config ./synapsor.runner.json --store ./.synapsor/local.db
+synapsor-runner smoke call --config ./synapsor.runner.json --store ./.synapsor/local.db
+```
+
+The preview must list semantic capabilities and must not list `execute_sql`,
+approval/apply tools, database URLs, write credentials, or model-controlled
+tenant authority.
+
+## Troubleshooting
+
+- `ENOENT` or missing config: use absolute config/store paths.
+- empty tool list: run `contract validate`, then `tools preview` against the
+  exact config used by the client.
+- database connection failure: verify the client process received the read URL
+  and trusted tenant/principal env values.
+- OpenAI rejects a dotted name: start Runner with `--alias-mode openai`.
+- HTTP `initialize` failure: use `mcp serve --transport streamable-http`, not
+  the legacy `serve-http` JSON-RPC bridge.
+- no ready message: inspect client stderr; Runner keeps stdout protocol-clean.

package/docs/release-notes.md

@@ -12,6 +12,47 @@ for the Synapsor Cloud CLI.
 
 ## Unreleased
 
+Prepared package version: `@synapsor/runner@0.1.12`. The already-published
+`@synapsor/spec@0.1.4` and `@synapsor/dsl@0.1.4` do not change and must not be
+republished for this release.
+
+### Runner Version Invocation
+
+- Keeps `synapsor-runner --version`, `synapsor-runner -v`, and
+  `synapsor-runner version` stable if an npm/npx wrapper forwards a duplicated
+  executable token.
+- Uses Runner's bundled package metadata instead of the invoking project's
+  `npm_package_version` environment value.
+- Adds source-wrapper and installed-tarball verification for all three forms.
+
+## 0.1.11
+
+### Cloud Adoption Loop
+
+- Adds complete Claude, Cursor, OpenAI Agents SDK, and generic MCP templates to
+  local and Cloud-generated Runner bundles.
+- Adds a flagship adoption verifier and a real local Cloud registry/version/ZIP
+  bundle round trip.
+- Expands the `support-plan-credit` walkthrough from no-database validation to
+  Docker-backed policy tiers, MCP setup, Cloud push, bundle download, replay,
+  cleanup, and troubleshooting.
+- Supports `SYNAPSOR_CLOUD_WORKSPACE` and verifies distinct 401/403/404/409/422,
+  server, and network errors without exposing tokens.
+- Clarifies that Cloud registry/versioning is beta-ready while managed runners,
+  SAML/SCIM, hosted policy enforcement, legal hold, and enterprise SLA are not
+  part of this release.
+- Corrects `cloud push --help` to describe the real authenticated registry
+  upload and network-free dry-run behavior.
+
+## 0.1.10
+
+### Policy Auto-Approval
+
+- Adds portable approval-policy references and threshold rules.
+- Adds DSL `AUTO APPROVE WHEN field <= integer` and the three-tier
+  `support-plan-credit` example: policy approval, operator review, and bound
+  rejection.
+
 ## 0.1.9
 
 ### CLI Hygiene

package/docs/runner-bundles.md

@@ -0,0 +1,59 @@
+# Runner Bundles
+
+A runner bundle is the portable Cloud-to-local side of the canonical loop:
+
+```text
+local DSL/spec -> cloud push -> immutable registry version -> runner bundle -> local Runner
+```
+
+Every bundle contains:
+
+```text
+synapsor.contract.json
+synapsor.runner.json
+.env.example
+README.md
+mcp-client-examples/
+  claude-desktop.json
+  cursor-project.mcp.json
+  cursor-global.mcp.json
+  openai-agents-stdio.ts
+  openai-agents-streamable-http.ts
+  generic-stdio.json
+  generic-streamable-http.json
+```
+
+It never contains database passwords, write credentials, live API tokens,
+private keys, customer rows, or machine-specific local paths.
+
+## Create Locally
+
+```bash
+synapsor-runner contract bundle ./synapsor.contract.json \
+  --out ./synapsor-runner-bundle
+```
+
+## Run A Downloaded Bundle
+
+```bash
+cd ./synapsor-runner-bundle
+cp .env.example .env
+set -a && . ./.env && set +a
+
+npx -y -p @synapsor/runner synapsor-runner contract validate ./synapsor.contract.json
+npx -y -p @synapsor/runner synapsor-runner config validate --config ./synapsor.runner.json
+npx -y -p @synapsor/runner synapsor-runner tools preview --config ./synapsor.runner.json --store ./.synapsor/local.db
+npx -y -p @synapsor/runner synapsor-runner mcp serve --config ./synapsor.runner.json --store ./.synapsor/local.db
+```
+
+For the OpenAI Agents SDK, use the included TypeScript examples. Their stdio
+command enables `--alias-mode openai`; the Streamable HTTP example includes the
+matching server command. Claude, Cursor, and generic templates use canonical
+dotted capability names.
+
+Approval and writeback remain outside the model-facing MCP tool surface. Use
+`proposals`, `apply`, `receipts`, and `replay` from a trusted operator shell.
+
+The bundle's `.env.example` contains names and placeholders only. Fill it for a
+local or staging source, source it into the shell or process that launches your
+MCP client, and keep the resulting `.env` out of source control.

package/examples/support-plan-credit/.env.example

@@ -0,0 +1,10 @@
+# Disposable Docker example credentials only. Do not reuse in staging or production.
+PLAN_CREDIT_POSTGRES_READ_URL=postgresql://synapsor_reader:synapsor_reader_password@127.0.0.1:55438/synapsor_runner_plan_credit
+PLAN_CREDIT_POSTGRES_WRITE_URL=postgresql://synapsor_writer:synapsor_writer_password@127.0.0.1:55438/synapsor_runner_plan_credit
+SYNAPSOR_TENANT_ID=acme
+SYNAPSOR_PRINCIPAL=local_support_agent
+
+# Optional Cloud registry upload. Keep real values outside git.
+SYNAPSOR_CLOUD_BASE_URL=
+SYNAPSOR_CLOUD_TOKEN=
+SYNAPSOR_WORKSPACE_ID=

package/examples/support-plan-credit/README.md

@@ -12,15 +12,46 @@ This example shows three enforcement tiers on one support action:
 - Node 22.5+
 - Port `55438` available
 
+Install the stable CLI once for the commands below:
+
+```bash
+npm install --global @synapsor/runner
+synapsor-runner --version
+```
+
+When working from this source checkout, use `corepack pnpm runner` in place of
+`synapsor-runner`.
+
+## No-Database Check
+
+Validate the authored boundary before starting Docker:
+
+```bash
+synapsor-runner dsl compile examples/support-plan-credit/contract.synapsor \
+  --out /tmp/support-plan-credit.contract.json \
+  --strict
+synapsor-runner contract validate /tmp/support-plan-credit.contract.json
+synapsor-runner config validate \
+  --config examples/support-plan-credit/synapsor.runner.json
+synapsor-runner cloud push /tmp/support-plan-credit.contract.json \
+  --dry-run \
+  --workspace local-preview \
+  --name support-plan-credit
+```
+
+This compiles, validates, and previews the Cloud payload without opening a
+network connection or connecting to a database. From a source checkout,
+`corepack pnpm verify:adoption` runs this boundary check plus the no-database
+quick demo and MCP config validation.
+
 ## Quick Start
 
 ```bash
 docker compose -f examples/support-plan-credit/docker-compose.yml up -d
 
-export PLAN_CREDIT_POSTGRES_READ_URL="postgresql://synapsor_reader:synapsor_reader_password@localhost:55438/synapsor_runner_plan_credit"
-export PLAN_CREDIT_POSTGRES_WRITE_URL="postgresql://synapsor_writer:synapsor_writer_password@localhost:55438/synapsor_runner_plan_credit"
-export SYNAPSOR_TENANT_ID="acme"
-export SYNAPSOR_PRINCIPAL="local_support_agent"
+set -a
+. examples/support-plan-credit/.env.example
+set +a
 
 synapsor-runner tools preview \
   --config examples/support-plan-credit/synapsor.runner.json \
@@ -32,6 +63,9 @@ synapsor-runner mcp serve \
   --store ./tmp/support-plan-credit/local.db
 ```
 
+The checked-in `.env.example` contains disposable localhost Docker credentials
+only. Never reuse them for staging or production.
+
 ## Walkthrough
 
 Inspect the customer first:
@@ -98,6 +132,13 @@ synapsor-runner apply latest --config examples/support-plan-credit/synapsor.runn
 The live smoke test mutates `updated_at` before apply and proves stale proposals
 return `VERSION_CONFLICT` without changing the source row.
 
+Run the complete Docker-backed scenario, including all three policy tiers and
+the stale-row conflict:
+
+```bash
+corepack pnpm test:live-apply
+```
+
 ## What The Agent Never Sees
 
 The contract keeps these fields out:
@@ -118,6 +159,37 @@ auto-approval: enabled
 No raw SQL, approval tools, commit tools, write credentials, or model-controlled
 tenant authority are exposed to MCP.
 
+Representative outputs are checked in under [`expected-output/`](expected-output/)
+so you can compare the tool boundary, proposal, receipt, replay, and Cloud push
+shape without guessing which state should change.
+
+## Connect An MCP Client
+
+Copy the matching template from [`mcp-client-examples/`](mcp-client-examples/):
+
+- Claude Desktop: `claude-desktop.json`
+- Cursor project/global: `cursor-project.mcp.json`, `cursor-global.mcp.json`
+- OpenAI Agents SDK: stdio and Streamable HTTP TypeScript examples
+- generic MCP: stdio and Streamable HTTP JSON examples
+
+For Streamable HTTP, run:
+
+```bash
+synapsor-runner mcp serve \
+  --transport streamable-http \
+  --alias-mode openai \
+  --host 127.0.0.1 \
+  --port 8766 \
+  --config examples/support-plan-credit/synapsor.runner.json \
+  --store ./tmp/support-plan-credit/local.db
+```
+
+The OpenAI client receives `support__inspect_customer` and
+`support__propose_plan_credit`; Runner preserves the dotted canonical names in
+tool metadata and results. For Claude, Cursor, or generic MCP clients, omit
+`--alias-mode openai` to expose `support.inspect_customer` and
+`support.propose_plan_credit`. Approval and apply remain outside MCP.
+
 ## How The Policy Is Governed
 
 The auto-approval policy lives in `contract.synapsor`:
@@ -153,11 +225,11 @@ synapsor-runner cloud push examples/support-plan-credit/synapsor.contract.json -
 Real push uses your Cloud env vars:
 
 ```bash
-export SYNAPSOR_CONTROL_PLANE_URL="https://api.synapsor.ai"
-export SYNAPSOR_RUNNER_TOKEN="syn_wbr_..."
+export SYNAPSOR_CLOUD_BASE_URL="https://api.synapsor.ai"
+export SYNAPSOR_CLOUD_TOKEN="<workspace-scoped-token>"
+export SYNAPSOR_WORKSPACE_ID="<workspace_id>"
 
 synapsor-runner cloud push examples/support-plan-credit/synapsor.contract.json \
-  --workspace <workspace_id> \
   --name support-plan-credit
 ```
 
@@ -166,11 +238,36 @@ placeholder env names:
 
 ```bash
 curl -H "Authorization: Bearer $SYNAPSOR_CLOUD_TOKEN" \
-  "$SYNAPSOR_CONTROL_PLANE_URL/v1/control/projects/<workspace_id>/agent-contracts/support-plan-credit/versions/latest"
+  "$SYNAPSOR_CLOUD_BASE_URL/v1/control/projects/$SYNAPSOR_WORKSPACE_ID/agent-contracts/<contract_id>/versions/<version_id>"
 
 curl -H "Authorization: Bearer $SYNAPSOR_CLOUD_TOKEN" \
-  "$SYNAPSOR_CONTROL_PLANE_URL/v1/control/projects/<workspace_id>/agent-contracts/support-plan-credit/runner-bundle" \
-  -o support-plan-credit-runner-bundle.json
+  "$SYNAPSOR_CLOUD_BASE_URL/v1/control/projects/$SYNAPSOR_WORKSPACE_ID/agent-contracts/<contract_id>/versions/<version_id>/runner-bundle?download=1" \
+  -o support-plan-credit-runner-bundle.zip
 ```
 
+The push response supplies `<contract_id>` and `<version_id>`. The Cloud
+workspace also exposes the same download from **Contract registry**.
+
 No Cloud account is needed to run this local example.
+
+## Clean Up
+
+```bash
+docker compose -f examples/support-plan-credit/docker-compose.yml down -v
+rm -rf ./tmp/support-plan-credit
+```
+
+## Troubleshooting
+
+- `synapsor-runner: command not found`: install `@synapsor/runner` globally or
+  use `corepack pnpm runner` from this repository.
+- port `55438` is busy: stop the previous example container or change the
+  published port and both URLs in `.env.example` together.
+- missing table/connection: wait for the Docker health check, then rerun the
+  command from the repository root with the `.env.example` values exported.
+- OpenAI rejects dotted tool names: start the MCP server with
+  `--alias-mode openai` and use the OpenAI template.
+- proposal stays pending: `$100` intentionally requires
+  `proposals approve`; only the `$25` tier is policy-approved.
+- apply reports a conflict: the row changed after the proposal read. Inspect
+  the new row, create a fresh proposal, and do not bypass the version guard.

package/examples/support-plan-credit/expected-output/cloud-push-response.json

@@ -0,0 +1,9 @@
+{
+  "ok": true,
+  "contract_id": "act_support_plan_credit_example",
+  "contract_version_id": "act_support_plan_credit_example_v1",
+  "version_number": 1,
+  "status": "draft",
+  "digest": "sha256:<server-computed-digest>",
+  "registry_url": "/workspace/contracts?contract=<contract_id>"
+}

package/examples/support-plan-credit/expected-output/proposal-created.json

@@ -0,0 +1,23 @@
+{
+  "proposal_id": "wrp_example_low_risk_credit",
+  "capability": "support.propose_plan_credit",
+  "status": "approved",
+  "approval_actor": "policy:support_propose_plan_credit_auto_approval",
+  "target": {
+    "table": "customers",
+    "id": "CUS-3001",
+    "tenant_id": "acme"
+  },
+  "change_set": {
+    "plan_credit_cents": {
+      "before": 0,
+      "after": 2500
+    },
+    "credit_reason": {
+      "before": null,
+      "after": "SLA outage ticket SUP-481"
+    }
+  },
+  "source_database_changed": false,
+  "evidence_handle": "evidence://local/example-plan-credit"
+}

package/examples/support-plan-credit/expected-output/receipt.json

@@ -0,0 +1,13 @@
+{
+  "receipt_id": "rct_example_plan_credit",
+  "proposal_id": "wrp_example_low_risk_credit",
+  "status": "applied",
+  "rows_affected": 1,
+  "guards": {
+    "tenant": "passed",
+    "primary_key": "passed",
+    "allowed_columns": "passed",
+    "expected_version": "passed",
+    "idempotency": "passed"
+  }
+}

package/examples/support-plan-credit/expected-output/replay-summary.json

@@ -0,0 +1,13 @@
+{
+  "proposal_id": "wrp_example_low_risk_credit",
+  "events": [
+    "scoped_read",
+    "evidence_saved",
+    "proposal_created",
+    "policy_approved",
+    "guarded_writeback_applied",
+    "receipt_recorded"
+  ],
+  "source_database_changed_before_approval": false,
+  "final_status": "applied"
+}

package/examples/support-plan-credit/expected-output/tools-preview.txt

@@ -0,0 +1,15 @@
+Synapsor tools preview: ok
+
+Exposed to MCP:
+  - support.inspect_customer
+  - support.propose_plan_credit
+
+Not exposed to MCP:
+  - execute_sql / raw query tools
+  - approval tools
+  - commit/apply tools
+  - database URLs
+  - write credentials
+  - model-controlled tenant authority
+
+auto-approval: enabled

package/examples/support-plan-credit/mcp-client-examples/claude-desktop.json

@@ -0,0 +1,20 @@
+{
+  "mcpServers": {
+    "synapsor-runner": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "-p",
+        "@synapsor/runner",
+        "synapsor-runner",
+        "mcp",
+        "serve",
+        "--config",
+        "examples/support-plan-credit/synapsor.runner.json",
+        "--store",
+        "./tmp/support-plan-credit/local.db"
+      ],
+      "cwd": "<absolute-path-to-Synapsor-Runner>"
+    }
+  }
+}

package/examples/support-plan-credit/mcp-client-examples/cursor-global.mcp.json

@@ -0,0 +1,20 @@
+{
+  "mcpServers": {
+    "synapsor-runner": {
+      "type": "stdio",
+      "command": "npx",
+      "args": [
+        "-y",
+        "-p",
+        "@synapsor/runner",
+        "synapsor-runner",
+        "mcp",
+        "serve",
+        "--config",
+        "<absolute-path-to-Synapsor-Runner>/examples/support-plan-credit/synapsor.runner.json",
+        "--store",
+        "<absolute-path-to-Synapsor-Runner>/tmp/support-plan-credit/local.db"
+      ]
+    }
+  }
+}

package/examples/support-plan-credit/mcp-client-examples/cursor-project.mcp.json

@@ -0,0 +1,20 @@
+{
+  "mcpServers": {
+    "synapsor-runner": {
+      "type": "stdio",
+      "command": "npx",
+      "args": [
+        "-y",
+        "-p",
+        "@synapsor/runner",
+        "synapsor-runner",
+        "mcp",
+        "serve",
+        "--config",
+        "examples/support-plan-credit/synapsor.runner.json",
+        "--store",
+        "./tmp/support-plan-credit/local.db"
+      ]
+    }
+  }
+}

package/examples/support-plan-credit/mcp-client-examples/generic-stdio.json

@@ -0,0 +1,17 @@
+{
+  "name": "synapsor-runner",
+  "transport": "stdio",
+  "command": "npx",
+  "args": [
+    "-y",
+    "-p",
+    "@synapsor/runner",
+    "synapsor-runner",
+    "mcp",
+    "serve",
+    "--config",
+    "examples/support-plan-credit/synapsor.runner.json",
+    "--store",
+    "./tmp/support-plan-credit/local.db"
+  ]
+}

package/examples/support-plan-credit/mcp-client-examples/generic-streamable-http.json

@@ -0,0 +1,5 @@
+{
+  "name": "synapsor-runner",
+  "transport": "streamable-http",
+  "url": "http://127.0.0.1:8766/mcp"
+}

package/examples/support-plan-credit/mcp-client-examples/openai-agents-stdio.ts

@@ -0,0 +1,19 @@
+import { Agent, MCPServerStdio, run } from "@openai/agents";
+
+const synapsor = new MCPServerStdio({
+  name: "Synapsor Runner",
+  fullCommand: "npx -y -p @synapsor/runner synapsor-runner mcp serve --config examples/support-plan-credit/synapsor.runner.json --store ./tmp/support-plan-credit/local.db --alias-mode openai",
+});
+
+await synapsor.connect();
+try {
+  const agent = new Agent({
+    name: "Support operations agent",
+    instructions: "Use only Synapsor business tools. Inspect evidence before proposing a plan credit.",
+    mcpServers: [synapsor],
+  });
+  const result = await run(agent, "Inspect customer CUS-3001 and propose a $25 plan credit for SLA outage ticket SUP-481.");
+  console.log(result.finalOutput);
+} finally {
+  await synapsor.close();
+}