summer-engine 3.6.0 → 3.7.0

package/registry/generated/plugin.claude.json

@@ -2,8 +2,8 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "_generated": "GENERATED from integrations/claude — do not edit; npm run generate:registry",
   "name": "summer",
-  "version": "3.6.0",
-  "description": "Agent tooling for Summer Engine: game-dev skills, lifecycle hooks, and a 107-tool MCP bridge to the local desktop app.",
+  "version": "3.7.0",
+  "description": "Agent tooling for Summer Engine: game-dev skills, lifecycle hooks, and a 104-tool MCP bridge to the local desktop app.",
   "author": {
     "name": "Summer Engine",
     "email": "founders@summerengine.com",

package/registry/generated/plugin.codex.json

@@ -1,8 +1,8 @@
 {
   "_generated": "GENERATED from integrations/codex — do not edit; npm run generate:registry",
   "name": "summer",
-  "version": "3.6.0",
-  "description": "Agent tooling for Summer Engine: game-dev skills, lifecycle hooks, and a 107-tool MCP bridge. Build games by talking.",
+  "version": "3.7.0",
+  "description": "Agent tooling for Summer Engine: game-dev skills, lifecycle hooks, and a 104-tool MCP bridge. Build games by talking.",
   "author": {
     "name": "Summer Engine",
     "email": "founders@summerengine.com",
@@ -151,7 +151,7 @@
   "interface": {
     "displayName": "Summer",
     "shortDescription": "Superpowers for AI game dev. Build games by talking.",
-    "longDescription": "Summer turns Codex into a game-dev studio for Summer Engine. Users make Summer games with the Summer SDK and GDScript. The plugin adds game-dev skills, lifecycle hooks, and a 107-tool MCP bridge for guarded project files, scene editing, asset import, play mode, diagnostics, generation, and creator workflows. Git, shell, and grep stay with the host agent. Summer follows its upstream technical base continuously; version-sensitive work uses the bundled compatibility reference instead of a fixed onboarding version. Session-start orients the session. Pre-commit doctor (opt-in) blocks bad commits.",
+    "longDescription": "Summer turns Codex into a game-dev studio for Summer Engine. Users make Summer games with the Summer SDK and GDScript. The plugin adds game-dev skills, lifecycle hooks, and a 104-tool MCP bridge for guarded project files, scene editing, asset import, play mode, diagnostics, generation, and creator workflows. Git, shell, and grep stay with the host agent. Summer follows its upstream technical base continuously; version-sensitive work uses the bundled compatibility reference instead of a fixed onboarding version. Session-start orients the session. Pre-commit doctor (opt-in) blocks bad commits.",
     "developerName": "Summer Engine",
     "category": "Coding",
     "capabilities": [

package/registry/generated/plugin.cursor.json

@@ -3,8 +3,8 @@
   "_generated": "GENERATED from integrations/cursor — do not edit; npm run generate:registry",
   "name": "summer",
   "displayName": "Summer",
-  "version": "3.6.0",
-  "description": "Agent tooling for Summer Engine: game-dev skills, lifecycle hooks, and a 107-tool MCP bridge to the local desktop app.",
+  "version": "3.7.0",
+  "description": "Agent tooling for Summer Engine: game-dev skills, lifecycle hooks, and a 104-tool MCP bridge to the local desktop app.",
   "author": {
     "name": "Summer Engine",
     "email": "founders@summerengine.com"

package/registry/generated/plugin.factory.json

@@ -1,8 +1,8 @@
 {
   "_generated": "GENERATED from integrations/factory — do not edit; npm run generate:registry",
   "name": "summer",
-  "description": "Agent tooling for Summer Engine: game-dev skills, lifecycle hooks, and a 107-tool MCP bridge to the local desktop app.",
-  "version": "3.6.0",
+  "description": "Agent tooling for Summer Engine: game-dev skills, lifecycle hooks, and a 104-tool MCP bridge to the local desktop app.",
+  "version": "3.7.0",
   "author": {
     "name": "Summer Engine",
     "email": "founders@summerengine.com",

package/dist/cli/commands/publish.d.ts

@@ -1,2 +0,0 @@
-import { Command } from "commander";
-export declare const publishCommand: Command;

package/dist/cli/commands/publish.js

@@ -1,21 +0,0 @@
-import { Command } from "commander";
-import { publishCreator } from "../../core/capabilities/creator.js";
-export const publishCommand = new Command("publish")
-    .description("Deprecated: publish a .pck to the legacy creator API (use `summer tool export-game`, then `summer tool publish-build`)")
-    .argument("[project]", "Project root. Defaults to the current directory.")
-    .requiredOption("--artifact <path>", "Exact exported Summer .pck artifact")
-    .requiredOption("--version <value>", "Immutable release version")
-    .option("--manifest <path>", "Optional JSON release manifest")
-    .option("--project-id <id>", "Creator project ID")
-    .option("--channel <name>", "Release channel")
-    .option("--notes <text>", "Release notes")
-    .option("--confirm", "Confirm the exact project and channel after reviewing them")
-    .action(async (project, opts) => {
-    console.error("summer publish is deprecated: run `summer tool export-game`, then `summer tool publish-build`, to upload the summer.games .zip to your game.");
-    const result = await publishCreator({
-        project,
-        ...opts,
-        face: "cli",
-    });
-    console.log(JSON.stringify(result, null, 2));
-});

package/dist/cli/commands/releases.d.ts

@@ -1,2 +0,0 @@
-import { Command } from "commander";
-export declare const releasesCommand: Command;

package/dist/cli/commands/releases.js

@@ -1,20 +0,0 @@
-import { Command } from "commander";
-import { listCreatorReleases } from "../../core/capabilities/creator.js";
-export const releasesCommand = new Command("releases")
-    .description("List creator releases for a project")
-    .option("--project-id <id>", "Creator project ID")
-    .option("--limit <count>", "Maximum releases to return", "20")
-    .option("--cursor <value>", "Opaque cursor returned by the previous page")
-    .action(async (opts) => {
-    const limit = Number.parseInt(opts.limit, 10);
-    if (!Number.isInteger(limit) || limit < 1 || limit > 100) {
-        throw new Error("--limit must be between 1 and 100. Recovery: pass a whole number in that range.");
-    }
-    const result = await listCreatorReleases({
-        projectId: opts.projectId,
-        limit,
-        cursor: opts.cursor,
-        face: "cli",
-    });
-    console.log(JSON.stringify(result, null, 2));
-});

package/dist/core/capabilities/creator.d.ts

@@ -1,65 +0,0 @@
-export type CreatorOperation = "publish" | "releases";
-export type CreatorFace = "cli" | "mcp";
-export declare const CREATOR_API_CONTRACT: "summer.creator.v1";
-export declare class CreatorOperationError extends Error {
-    readonly code: string;
-    readonly operation: CreatorOperation;
-    readonly recovery: string;
-    readonly status?: number | undefined;
-    constructor(code: string, operation: CreatorOperation, message: string, recovery: string, status?: number | undefined);
-}
-export interface CreatorClientDependencies {
-    fetch: typeof fetch;
-    now: () => Date;
-}
-export interface PublishCreatorInput {
-    project?: string;
-    artifact?: string;
-    manifest?: string;
-    version?: string;
-    projectId?: string;
-    channel?: string;
-    notes?: string;
-    confirm?: boolean;
-    face: CreatorFace;
-}
-export interface CreatorPublishResult {
-    ok: true;
-    contract: typeof CREATOR_API_CONTRACT;
-    operation: "publish";
-    projectId: string;
-    releaseId: string;
-    version: string;
-    sha256: string;
-    sizeBytes: number;
-    status: string;
-    detail: string | null;
-}
-export declare function publishCreator(input: PublishCreatorInput, overrides?: Partial<CreatorClientDependencies>): Promise<CreatorPublishResult>;
-export interface ListCreatorReleasesInput {
-    projectId?: string;
-    limit?: number;
-    cursor?: string;
-    face: CreatorFace;
-}
-export interface CreatorRelease {
-    releaseId: string;
-    gameId: string;
-    version: string;
-    state: "published" | "pending_review" | "retired";
-    gameStatus: string;
-    sha256: string | null;
-    sizeBytes: number | null;
-    changelog: string | null;
-    submittedAt: string;
-    artifactPlane: "r2" | "legacy";
-}
-export interface CreatorReleasesResult {
-    ok: true;
-    contract: typeof CREATOR_API_CONTRACT;
-    operation: "releases";
-    projectId: string;
-    releases: CreatorRelease[];
-    nextCursor: string | null;
-}
-export declare function listCreatorReleases(input: ListCreatorReleasesInput, overrides?: Partial<CreatorClientDependencies>): Promise<CreatorReleasesResult>;

package/dist/core/capabilities/creator.js

@@ -1,374 +0,0 @@
-import { createHash } from "node:crypto";
-import { createReadStream } from "node:fs";
-import { lstat, readFile } from "node:fs/promises";
-import { resolve } from "node:path";
-import { getCredentialMetadata, getCreatorToken, } from "../auth.js";
-import { getCreatorApiUrl, readSummerConfig, } from "../config.js";
-import { appendStoreJsonLine } from "../store.js";
-import { readJsonResponse } from "../util/http.js";
-export const CREATOR_API_CONTRACT = "summer.creator.v1";
-const CREATOR_PUBLISH_PATH = "/api/creator/v1/publish";
-const CREATOR_RELEASES_PATH = "/api/creator/v1/releases";
-const REQUIRED_SCOPE = "publish";
-const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-const VERSION = /^[A-Za-z0-9][A-Za-z0-9._-]{0,31}$/;
-export class CreatorOperationError extends Error {
-    code;
-    operation;
-    recovery;
-    status;
-    constructor(code, operation, message, recovery, status) {
-        super(`${message} ${recovery}`);
-        this.code = code;
-        this.operation = operation;
-        this.recovery = recovery;
-        this.status = status;
-        this.name = "CreatorOperationError";
-    }
-}
-const defaultDependencies = {
-    fetch: (input, init) => globalThis.fetch(input, init),
-    now: () => new Date(),
-};
-async function resolveProjectId(explicit) {
-    const projectId = explicit?.trim() || (await readSummerConfig()).creator?.projectId;
-    if (!projectId) {
-        throw new Error('No creator project is selected. Recovery: pass --project-id <uuid>, or run "summer config set creator.projectId <uuid>".');
-    }
-    if (!UUID.test(projectId)) {
-        throw new Error(`Creator project ID "${projectId}" is not a UUID. Recovery: copy the Summer game ID from the creator dashboard and configure it again.`);
-    }
-    return projectId;
-}
-async function requireCreatorCredential(operation) {
-    const token = await getCreatorToken();
-    if (!token) {
-        throw new CreatorOperationError("creator_token_required", operation, "Creator publishing needs a separate Summer Platform creator API token.", 'Recovery: run "summer login --creator", mint a token with the exact "publish" scope in the opened browser page, and paste its one-time sc_ value. Your core Summer login will not be changed.');
-    }
-    const metadata = await getCredentialMetadata();
-    if (!metadata.creator?.scopes.includes(REQUIRED_SCOPE)) {
-        throw new CreatorOperationError("creator_scope_missing", operation, `The locally recorded creator credential does not declare the exact "${REQUIRED_SCOPE}" scope.`, 'Recovery: run "summer login --creator --force", mint a new publish-scoped token, and retry. The server will still independently verify the scope.');
-    }
-    return token;
-}
-function recoveryForStatus(operation, status) {
-    if (status === 401 || status === 403) {
-        return 'Recovery: run "summer login --creator --force", mint a non-revoked token with the exact "publish" scope, and retry.';
-    }
-    if (status === 404) {
-        return 'Recovery: check creator.projectId against the Summer creator dashboard and make sure that game belongs to the token owner.';
-    }
-    if (status === 409 && operation === "publish") {
-        return "Recovery: read the server detail, bump an immutable version when required, then repeat the unconfirmed command to review the new exact target.";
-    }
-    return `Recovery: retry once; if it repeats, check creator.apiUrl and the Summer Platform creator API health.`;
-}
-async function readCreatorResponse(response, operation) {
-    const { json, parsed } = await readJsonResponse(response);
-    const payload = json;
-    if (!parsed) {
-        throw new CreatorOperationError("creator_invalid_response", operation, `The creator API returned a non-JSON response (${response.status}).`, recoveryForStatus(operation, response.status), response.status);
-    }
-    if (!response.ok) {
-        const code = typeof payload.error === "string" ? payload.error : "creator_request_failed";
-        const detail = typeof payload.detail === "string"
-            ? payload.detail
-            : `The creator API refused the request (${response.status}).`;
-        const recovery = typeof payload.recovery === "string"
-            ? payload.recovery
-            : recoveryForStatus(operation, response.status);
-        throw new CreatorOperationError(code, operation, detail, recovery, response.status);
-    }
-    if (payload.contract !== CREATOR_API_CONTRACT) {
-        throw new CreatorOperationError("creator_contract_mismatch", operation, `The creator API did not return contract ${CREATOR_API_CONTRACT}.`, "Recovery: upgrade the Summer CLI and retry; if it repeats, the configured creator API is incompatible.", response.status);
-    }
-    return payload;
-}
-async function creatorRequest(operation, path, token, deps, init = {}) {
-    let response;
-    try {
-        response = await deps.fetch(`${await getCreatorApiUrl()}${path}`, {
-            ...init,
-            headers: {
-                accept: "application/json",
-                authorization: `Bearer ${token}`,
-                ...(init.body ? { "content-type": "application/json" } : {}),
-                ...init.headers,
-            },
-            signal: AbortSignal.timeout(operation === "publish" ? 300_000 : 30_000),
-        });
-    }
-    catch (error) {
-        throw new CreatorOperationError("creator_network_failed", operation, `The creator API request failed: ${error instanceof Error ? error.message : String(error)}.`, "Recovery: check your network and creator.apiUrl, then retry. No successful release is being claimed.");
-    }
-    return readCreatorResponse(response, operation);
-}
-async function inspectArtifact(path) {
-    const artifactPath = resolve(path);
-    const info = await lstat(artifactPath).catch(() => null);
-    if (!info || !info.isFile() || info.isSymbolicLink()) {
-        throw new Error(`Release artifact ${artifactPath} must be a real regular file, not a missing path, directory, or symlink.`);
-    }
-    if (!artifactPath.toLowerCase().endsWith(".pck")) {
-        throw new Error(`Release artifact ${artifactPath} is not a .pck. Recovery: export a Summer PCK and pass its exact path with --artifact.`);
-    }
-    if (info.size <= 0) {
-        throw new Error(`Release artifact ${artifactPath} is empty. Recovery: export the Summer PCK again and verify it locally before publishing.`);
-    }
-    const hash = createHash("sha256");
-    for await (const chunk of createReadStream(artifactPath))
-        hash.update(chunk);
-    return {
-        path: artifactPath,
-        sizeBytes: info.size,
-        sha256: hash.digest("hex"),
-    };
-}
-async function readManifest(path) {
-    if (!path)
-        return undefined;
-    const manifestPath = resolve(path);
-    try {
-        return JSON.parse(await readFile(manifestPath, "utf8"));
-    }
-    catch (error) {
-        throw new Error(`Cannot read release manifest ${manifestPath}: ${error instanceof Error ? error.message : String(error)}. Recovery: pass a valid JSON manifest or omit --manifest.`);
-    }
-}
-function assertUploadUrl(value) {
-    if (typeof value !== "string") {
-        throw new CreatorOperationError("creator_invalid_response", "publish", "The prepare response did not contain an uploadUrl.", "Recovery: retry once; if it repeats, report the Summer Platform creator API as unhealthy.");
-    }
-    let url;
-    try {
-        url = new URL(value);
-    }
-    catch {
-        throw new CreatorOperationError("creator_unsafe_upload_url", "publish", "The creator API returned a malformed upload URL.", "Recovery: do not upload the artifact; report the creator API response as a security issue.");
-    }
-    const local = url.hostname === "localhost" ||
-        url.hostname === "127.0.0.1" ||
-        url.hostname === "[::1]";
-    if (url.username ||
-        url.password ||
-        (url.protocol !== "https:" && !(local && url.protocol === "http:"))) {
-        throw new CreatorOperationError("creator_unsafe_upload_url", "publish", "The creator API returned an unsafe upload URL.", "Recovery: do not upload the artifact; report the creator API response as a security issue.");
-    }
-    return url.toString();
-}
-function assertUploadHeaders(value) {
-    if (!value || typeof value !== "object" || Array.isArray(value)) {
-        throw new CreatorOperationError("creator_invalid_response", "publish", "The prepare response did not contain signed upload headers.", "Recovery: retry once; if it repeats, report the Summer Platform creator API as unhealthy.");
-    }
-    const headers = Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string"));
-    if (headers["content-type"] !== "application/octet-stream" ||
-        headers["if-none-match"] !== "*") {
-        throw new CreatorOperationError("creator_unsafe_upload_headers", "publish", "The prepare response did not bind the expected content type and write-once header.", "Recovery: do not upload the artifact; report the creator API response as a security issue.");
-    }
-    return headers;
-}
-async function uploadArtifact(uploadUrl, headers, artifactPath, deps) {
-    let response;
-    try {
-        response = await deps.fetch(uploadUrl, {
-            method: "PUT",
-            headers,
-            body: createReadStream(artifactPath),
-            // Node fetch requires this for a streaming request body. It is a Node
-            // extension and therefore absent from the DOM RequestInit declaration.
-            duplex: "half",
-            signal: AbortSignal.timeout(600_000),
-        });
-    }
-    catch (error) {
-        throw new CreatorOperationError("creator_upload_failed", "publish", `The artifact upload failed: ${error instanceof Error ? error.message : String(error)}.`, "Recovery: rerun the unconfirmed publish command to recompute and review the exact artifact, then retry.");
-    }
-    if (!response.ok) {
-        throw new CreatorOperationError("creator_upload_refused", "publish", `The immutable artifact upload was refused (${response.status}).`, response.status === 412
-            ? "Recovery: the content-addressed key is already occupied. Do not overwrite it; verify the project/version and retry with a new immutable version."
-            : "Recovery: repeat prepare and reproduce every returned signed header exactly, then retry.", response.status);
-    }
-}
-export async function publishCreator(input, overrides = {}) {
-    const deps = { ...defaultDependencies, ...overrides };
-    const project = resolve(input.project ?? process.cwd());
-    const projectId = await resolveProjectId(input.projectId);
-    const channel = input.channel?.trim() ||
-        (await readSummerConfig()).creator?.channel ||
-        "production";
-    if (channel !== "production") {
-        throw new CreatorOperationError("creator_channel_unsupported", "publish", `The Summer Platform creator API has no "${channel}" release channel.`, 'Recovery: use --channel production or run "summer config set creator.channel production". No release was created.');
-    }
-    const version = input.version?.trim();
-    if (!version || !VERSION.test(version)) {
-        throw new Error("A release version is required and must be 1–32 characters of letters, numbers, dots, underscores, or hyphens. Recovery: pass --version <value>.");
-    }
-    if (!input.artifact) {
-        throw new Error("A release artifact is required. Recovery: export a Summer .pck and pass --artifact <path>; the CLI never guesses an export layout.");
-    }
-    const artifact = await inspectArtifact(input.artifact);
-    const manifest = await readManifest(input.manifest);
-    const auditBase = {
-        at: deps.now().toISOString(),
-        operation: "publish",
-        face: input.face,
-        project,
-        projectId,
-        channel,
-        artifact: artifact.path,
-        version,
-        sha256: artifact.sha256,
-        sizeBytes: artifact.sizeBytes,
-        notes: input.notes?.trim() || null,
-    };
-    if (!input.confirm) {
-        await appendStoreJsonLine("creator-audit.jsonl", {
-            ...auditBase,
-            outcome: "confirmation_required",
-        });
-        throw new CreatorOperationError("publish_confirmation_required", "publish", `Publishing changes project ${projectId}: version ${version}, sha256 ${artifact.sha256}, ${artifact.sizeBytes} bytes from ${artifact.path}.`, "Recovery: show this exact project, version, digest, size, and artifact path to the user. Only after approval, rerun with --confirm (or confirm=true). No release was created.");
-    }
-    let token;
-    try {
-        token = await requireCreatorCredential("publish");
-        await appendStoreJsonLine("creator-audit.jsonl", {
-            ...auditBase,
-            outcome: "started",
-            tokenAudience: "summercraft-creator",
-            advisoryTokenScopes: [REQUIRED_SCOPE],
-        });
-        const confirmation = {
-            gameId: projectId,
-            version,
-            sha256: artifact.sha256,
-        };
-        const prepareBody = {
-            contract: CREATOR_API_CONTRACT,
-            operation: "prepare",
-            ...confirmation,
-            sizeBytes: artifact.sizeBytes,
-            contentType: "application/octet-stream",
-            ...(input.notes?.trim() ? { changelog: input.notes.trim() } : {}),
-            ...(manifest !== undefined ? { manifest } : {}),
-            confirmation,
-        };
-        const prepared = await creatorRequest("publish", CREATOR_PUBLISH_PATH, token, deps, {
-            method: "POST",
-            body: JSON.stringify(prepareBody),
-        });
-        if (prepared.operation !== "prepare") {
-            throw new CreatorOperationError("creator_invalid_response", "publish", "The prepare response named the wrong operation.", "Recovery: do not upload the artifact; upgrade the Summer CLI or report the creator API as incompatible.");
-        }
-        if (prepared.method !== "PUT" ||
-            prepared.finalizeUrl !== CREATOR_PUBLISH_PATH) {
-            throw new CreatorOperationError("creator_invalid_response", "publish", "The prepare response did not bind the expected PUT and versioned finalize route.", "Recovery: do not upload the artifact; upgrade the Summer CLI or report the creator API as incompatible.");
-        }
-        await uploadArtifact(assertUploadUrl(prepared.uploadUrl), assertUploadHeaders(prepared.headers), artifact.path, deps);
-        const finalized = await creatorRequest("publish", CREATOR_PUBLISH_PATH, token, deps, {
-            method: "POST",
-            body: JSON.stringify({
-                ...prepareBody,
-                operation: "finalize",
-            }),
-        });
-        if (finalized.operation !== "finalize" ||
-            typeof finalized.releaseId !== "string" ||
-            !UUID.test(finalized.releaseId) ||
-            finalized.status !== "pending_review" ||
-            finalized.gameId !== projectId ||
-            finalized.version !== version ||
-            finalized.sha256 !== artifact.sha256 ||
-            finalized.sizeBytes !== artifact.sizeBytes) {
-            throw new CreatorOperationError("creator_invalid_response", "publish", "The finalize response did not echo the exact project, version, digest, size, release ID, and status.", "Recovery: query summer releases before retrying; the server may have recorded the release even though its response was incomplete.");
-        }
-        const result = {
-            ok: true,
-            contract: CREATOR_API_CONTRACT,
-            operation: "publish",
-            projectId,
-            releaseId: finalized.releaseId,
-            version,
-            sha256: artifact.sha256,
-            sizeBytes: artifact.sizeBytes,
-            status: finalized.status,
-            detail: typeof finalized.detail === "string" ? finalized.detail : null,
-        };
-        await appendStoreJsonLine("creator-audit.jsonl", {
-            ...auditBase,
-            outcome: "succeeded",
-            releaseId: result.releaseId,
-            releaseStatus: result.status,
-        });
-        return result;
-    }
-    catch (error) {
-        await appendStoreJsonLine("creator-audit.jsonl", {
-            ...auditBase,
-            outcome: "failed",
-            code: error instanceof CreatorOperationError
-                ? error.code
-                : "creator_request_invalid",
-            status: error instanceof CreatorOperationError ? error.status ?? null : null,
-        });
-        throw error;
-    }
-}
-function readReleases(value, projectId) {
-    if (!Array.isArray(value)) {
-        throw new CreatorOperationError("creator_invalid_response", "releases", "The creator API response did not contain a releases array.", "Recovery: upgrade the Summer CLI and retry; if it repeats, report the creator API as incompatible.");
-    }
-    const releases = [];
-    for (const item of value) {
-        const row = item;
-        if (!row ||
-            typeof row !== "object" ||
-            typeof row.releaseId !== "string" ||
-            !UUID.test(row.releaseId) ||
-            row.gameId !== projectId ||
-            typeof row.version !== "string" ||
-            !["published", "pending_review", "retired"].includes(String(row.state)) ||
-            typeof row.gameStatus !== "string" ||
-            (row.sha256 !== null &&
-                (typeof row.sha256 !== "string" ||
-                    !/^[0-9a-f]{64}$/.test(row.sha256))) ||
-            (row.sizeBytes !== null &&
-                (typeof row.sizeBytes !== "number" ||
-                    !Number.isSafeInteger(row.sizeBytes) ||
-                    row.sizeBytes < 0)) ||
-            (row.changelog !== null && typeof row.changelog !== "string") ||
-            typeof row.submittedAt !== "string" ||
-            !Number.isFinite(Date.parse(row.submittedAt)) ||
-            (row.artifactPlane !== "r2" && row.artifactPlane !== "legacy")) {
-            throw new CreatorOperationError("creator_invalid_response", "releases", "The creator API returned a malformed or cross-project release item.", "Recovery: do not trust this release list; upgrade the Summer CLI or report the creator API as incompatible.");
-        }
-        releases.push(row);
-    }
-    return releases;
-}
-export async function listCreatorReleases(input, overrides = {}) {
-    const deps = { ...defaultDependencies, ...overrides };
-    const projectId = await resolveProjectId(input.projectId);
-    const token = await requireCreatorCredential("releases");
-    const params = new URLSearchParams({
-        gameId: projectId,
-        limit: String(input.limit ?? 20),
-    });
-    if (input.cursor)
-        params.set("cursor", input.cursor);
-    const payload = await creatorRequest("releases", `${CREATOR_RELEASES_PATH}?${params}`, token, deps);
-    if (payload.gameId !== projectId) {
-        throw new CreatorOperationError("creator_invalid_response", "releases", "The creator API returned release history for a different project.", "Recovery: do not trust this release list; check creator.apiUrl and report the response as a security issue.");
-    }
-    if (payload.nextCursor !== null &&
-        typeof payload.nextCursor !== "string") {
-        throw new CreatorOperationError("creator_invalid_response", "releases", "The creator API returned a malformed release cursor.", "Recovery: omit the cursor and retry from the newest release; report the response if it repeats.");
-    }
-    return {
-        ok: true,
-        contract: CREATOR_API_CONTRACT,
-        operation: "releases",
-        projectId,
-        releases: readReleases(payload.releases, projectId),
-        nextCursor: payload.nextCursor,
-    };
-}

package/library/tools/creator-config/resource.yaml

@@ -1,63 +0,0 @@
-id: tool/creator-config
-kind: tool
-version: 1.0.2
-summary: Read or update the shared non-secret Summer configuration; mutations require confirm, and tokens are never returned or accepted.
-use_when:
-  - inspecting or changing shared CLI and MCP configuration values
-  - '"which creator project id / channel is this CLI pointed at?"'
-  - switching the default publish channel
-do_not_use_when:
-  - reading or setting auth tokens — they never pass through this tool; use summer login / logout
-facets:
-  lifecycle:
-    - launch
-  domains:
-    - creator
-    - deployment
-compatibility:
-  engine: ">=4.6"
-source: official
-license: MIT
-status: stable
-aliases:
-  - summer_creator_config
-implementation:
-  module: src/mcp/tools/creator-tools.ts
-  export: registerCreatorTools
-surfaces:
-  mcp:
-    tool_name: summer_creator_config
-    remote: false
-  cli:
-    command: summer config
-input_schema:
-  type: object
-  properties:
-    action:
-      type: string
-      enum:
-        - list
-        - get
-        - set
-        - unset
-    key:
-      type: string
-      enum:
-        - gateway.url
-        - creator.apiUrl
-        - creator.projectId
-        - creator.channel
-    value:
-      type: string
-    confirm:
-      type: boolean
-      default: false
-  required:
-    - action
-  additionalProperties: false
-authority:
-  filesystem: true
-  editor_mutation: false
-  network: false
-  credentials: false
-  publish: false