@synapsor/runner 0.1.9 → 0.1.11

package/CHANGELOG.md

@@ -2,6 +2,38 @@
 
 ## Unreleased
 
+### Cloud Adoption Loop
+
+- Stages `@synapsor/spec@0.1.4`, `@synapsor/dsl@0.1.4`, and
+  `@synapsor/runner@0.1.11` without publishing them.
+- Adds a seven-file MCP client bundle for Claude Desktop, Cursor, OpenAI Agents
+  SDK, and generic stdio/Streamable HTTP clients, including OpenAI-safe tool
+  aliases.
+- Productizes local and Cloud-generated Runner bundles with placeholder env
+  wiring, validation/run instructions, and no embedded credentials or rows.
+- Adds a network-free adoption quickstart verifier and a real local
+  Runner-to-Cloud-to-ZIP-to-Runner verification path around the flagship
+  `support-plan-credit` contract.
+- Documents the Cloud registry/version/bundle loop and avoids implying managed
+  runner fleets, SAML/SCIM, hosted policy enforcement, or enterprise SLA.
+- Adds `SYNAPSOR_CLOUD_WORKSPACE` support and explicit Cloud push failure tests
+  for authorization, validation, conflict, server, and network outcomes.
+- Corrects `cloud push --help` so it describes the implemented authenticated
+  upload path and the network-free dry-run instead of the removed pre-registry
+  limitation.
+
+## 0.1.10
+
+### Policy Auto-Approval
+
+- Stages `@synapsor/spec@0.1.3`, `@synapsor/dsl@0.1.3`, and
+  `@synapsor/runner@0.1.10` for policy-based local approval.
+- Adds portable proposal approval `policy` references and typed approval policy
+  rules to the canonical contract.
+- Adds DSL `AUTO APPROVE WHEN field <= integer` clauses that compile to
+  reviewed approval policies.
+- Adds a conformance fixture for policy auto-approval thresholds.
+
 ## 0.1.9
 
 ### CLI Hygiene

package/README.md

@@ -6,10 +6,11 @@
 
 Stop giving AI agents `execute_sql()`. Give them reviewed business actions.
 
-Synapsor Runner is an Open-source MCP safety layer for Postgres and MySQL. It
-sits between Claude, Cursor, OpenAI Agents SDK, or another MCP client and your
-database so the model can inspect scoped data and propose changes without
-receiving raw SQL, write credentials, approval tools, or commit authority.
+Synapsor Runner is an open-source, local-first MCP server that exposes reviewed semantic
+capabilities over Postgres and MySQL, stages risky writes as proposals, and
+keeps evidence and replay for agent actions. It sits between Claude, Cursor,
+OpenAI Agents SDK, or another MCP client and your database so the model does
+not receive raw SQL, write credentials, approval tools, or commit authority.
 
 ```text
 Without Synapsor:
@@ -25,9 +26,12 @@ With Synapsor Runner:
 Try the no-database quick demo:
 
 ```bash
-npx @synapsor/runner demo --quick
+npx -y @synapsor/runner demo --quick
 ```
 
+You will see semantic tools instead of raw SQL, an exact proposal rather than
+an immediate write, approval/apply outside MCP, and a receipt/replay record.
+
 ## The Five-Line Model
 
 Your agent talks to Synapsor Runner, not directly to your database.
@@ -70,7 +74,7 @@ Run the guided quick demo first. It does not require Docker, a database, a
 config file, an MCP client, or a Synapsor Cloud account.
 
 ```bash
-npx @synapsor/runner demo --quick
+npx -y @synapsor/runner demo --quick
 ```
 
 In a terminal, it walks through the safety model step by step. In CI, piped
@@ -82,7 +86,7 @@ It does not prove database connectivity. It shows the proposal, evidence, and
 replay flow without giving the runner a database URL.
 
 ```bash
-npx @synapsor/runner demo inspect
+npx -y @synapsor/runner demo inspect
 ```
 
 Then choose one path:
@@ -92,6 +96,11 @@ Full disposable proof -> npx -y -p @synapsor/runner synapsor-runner demo
 Inspect MCP risk       -> npx -y -p @synapsor/runner synapsor-runner audit --example dangerous-db-mcp
 ```
 
+Flagship example: [`examples/support-plan-credit`](examples/support-plan-credit)
+shows the contract policy path end to end: `$25` auto-approved by policy,
+`$100` held for local review, and `$1000` rejected by the reviewed bound before
+any proposal row exists.
+
 ## Why Not Just Build This Yourself?
 
 You can build the outline in an afternoon:
@@ -124,6 +133,13 @@ are a good start. Use Runner when you need the agent-facing boundary around
 those reads, or when database-backed actions must become proposals before any
 durable write happens.
 
+## More Than A Tool Proxy
+
+Synapsor is intentionally more than an MCP wrapper. The public packages include
+a versioned contract, DSL compiler, schema validation, conformance fixtures,
+Runner enforcement, proposal/evidence/replay artifacts, Cloud registry push,
+and C++/Cloud round-trip verification.
+
 ## Connect Your Postgres Or MySQL
 
 Use a staging or disposable database first:
@@ -305,6 +321,16 @@ See [`docs/dsl-json-parity.md`](docs/dsl-json-parity.md) for the current
 field-by-field support matrix across JSON spec, DSL, runner enforcement,
 C++/Cloud compatibility, and Cloud push.
 
+After a real push, open **Contract registry** in Synapsor Cloud to inspect the
+immutable version, semantic capabilities, workflows, visible and kept-out
+fields, policy references, warnings, and registry audit events. Downloading a
+runner bundle returns the same normalized contract with placeholder local
+wiring and ready-to-copy MCP configs.
+
+- [Cloud push](docs/cloud-push.md)
+- [Runner bundles](docs/runner-bundles.md)
+- [MCP client configs](docs/mcp-clients.md)
+
 Your `synapsor.runner.json` supplies local wiring: database env var names,
 SQLite store path, MCP transport settings, and local debug options. The
 contract supplies the portable meaning: contexts, capabilities, evidence,
@@ -425,16 +451,18 @@ npx -y -p @synapsor/runner synapsor-runner demo
 ```
 
 For contributor/release verification from a checkout, the live apply smoke uses
-disposable Postgres/MySQL containers and the official MCP stdio client transport:
+four disposable Postgres/MySQL scenarios and the official MCP stdio client
+transport:
 
 ```bash
 corepack pnpm test:live-apply
 ```
 
 It verifies semantic tool listing, proposal diffs, source rows unchanged before
-approval, guarded writeback, idempotent retry, stale-row conflict, receipts, and
-replay. See [`docs/local-mode.md`](docs/local-mode.md#local-mcp-smoke) for
-prerequisites and expected output.
+approval, guarded writeback, idempotent retry, stale-row conflict, receipts,
+replay, and the support-plan-credit policy tiers. See
+[`docs/local-mode.md`](docs/local-mode.md#local-mcp-smoke) for prerequisites and
+expected output.
 
 After the demo prints its generated config and store path, run the happy path it
 prints. The shape is:
@@ -946,8 +974,9 @@ per lifecycle event; it is not a hosted central ledger.
 
 This is local indexed search for local/dev/staging usage. It is not a hosted
 central ledger, not RBAC/SSO, not cross-runner search, and not compliance
-retention. Synapsor Cloud is the upgrade path for central searchable audit,
-team governance, retention, and production operations.
+retention. Synapsor Cloud adds a shared contract registry and enabled hosted
+activity/evidence surfaces; confirm retention and production operations for
+the specific design-partner deployment.
 
 ## Connect Claude, Cursor, Or Another MCP Client
 
@@ -1210,24 +1239,25 @@ internals.
 
 | Need | Synapsor Runner | Synapsor Cloud |
 | --- | --- | --- |
-| Local MCP server | Yes | Managed |
-| Local trusted context bindings | Yes | Org/session integrated |
+| Local MCP server | Yes | Contracts export back to Runner; a managed fleet is not claimed |
+| Local trusted context bindings | Yes | Contract bindings are registered; hosted session behavior is pilot-specific |
 | Local semantic capabilities | Yes | Hosted registry + versioning |
 | Local evidence/proposal/replay | Yes | Central searchable ledger |
-| Local approval | CLI/UI | Multi-user approvals |
-| Writeback | Guarded single-row `UPDATE` | Managed production orchestration |
+| Local approval | CLI/UI | Existing team approval surfaces where enabled for a pilot |
+| Writeback | Guarded single-row `UPDATE` | Cloud-linked jobs exist; managed production orchestration is not claimed |
 | MCP risk audit | Static/local | Continuous/org-wide |
-| RBAC/SSO | No | Yes |
-| Policy packs | No/basic | Yes |
-| Workflow builder | No | Yes |
+| RBAC/SSO | No | RBAC where configured; SAML/SCIM are not in this beta |
+| Policy packs | Local reviewed subset | Registry preserves policies; hosted enforcement is not implied |
+| Workflow builder | No | Existing Cloud authoring surfaces; full public DAG parity is not claimed |
 | Native branches/time travel | No | Yes |
 | Settlement policies | No | Yes |
-| Compliance exports | No | Yes |
-| Production support/SLA | No | Yes |
+| Compliance exports | No | Audit/retention primitives exist; legal hold/certification are not claimed |
+| Production support/SLA | No | Design-partner support; no enterprise SLA is claimed |
 
-The runner is useful by itself for local/staging safety. Synapsor Cloud is for
-teams, production governance, central audit, managed runners, enterprise
-controls, and proprietary Synapsor platform features.
+The runner is useful by itself for local/staging safety. Synapsor Cloud adds a
+shared contract registry, immutable versions, downloadable Runner bundles, and
+existing team activity/evidence/approval surfaces where enabled. Managed
+runners, SAML/SCIM, legal hold, and an enterprise SLA remain future work.
 
 Portable contracts can be checked locally before Cloud import:
 
@@ -1244,7 +1274,7 @@ synapsor-runner cloud push ./synapsor.contract.json \
 
 ## Current Limitations
 
-Supported in the current alpha:
+Supported in the current `0.1.x` line:
 
 - stdio MCP server;
 - authenticated HTTP MCP server for app/server deployments;
@@ -1320,9 +1350,10 @@ Synapsor name, logo, hosted cloud service, or proprietary Synapsor platform
 features. See [docs/licensing.md](docs/licensing.md) and
 [TRADEMARKS.md](TRADEMARKS.md).
 
-Synapsor Cloud, hosted governance, managed runners, advanced policy/workflow
-engines, enterprise controls, and native Synapsor DBMS/C++ internals remain
-proprietary.
+Synapsor Cloud, hosted governance, advanced policy/workflow engines, enterprise
+controls, and native Synapsor DBMS/C++ internals are outside this Apache-2.0
+repository. Managed runners and other hosted features, where offered, are
+proprietary and are not implied by the OSS package.
 
 ## Developer And Contributor Commands
 

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAYA,OAAO,EAAoN,KAAK,WAAW,EAA2F,MAAM,6BAA6B,CAAC;AAoB1W,OAAO,EAA6G,KAAK,YAAY,EAAwB,MAAM,2BAA2B,CAAC;AAE/L,OAAO,EAOL,KAAK,gBAAgB,EAEtB,MAAM,mCAAmC,CAAC;AA6U3C,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAyD1D;AA+DD,KAAK,SAAS,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAE9E,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CACvC,GACL,OAAO,CAAC,MAAM,CAAC,CA2TjB;AAmsED,wBAAsB,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAS/H"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAYA,OAAO,EAAoP,KAAK,WAAW,EAA2F,MAAM,6BAA6B,CAAC;AAoB1Y,OAAO,EAA6G,KAAK,YAAY,EAAwB,MAAM,2BAA2B,CAAC;AAE/L,OAAO,EAOL,KAAK,gBAAgB,EAEtB,MAAM,mCAAmC,CAAC;AAgV3C,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAyD1D;AA+DD,KAAK,SAAS,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAE9E,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CACvC,GACL,OAAO,CAAC,MAAM,CAAC,CA2TjB;AAowED,wBAAsB,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAS/H"}