summer-engine 3.6.0 → 3.8.0

package/.claude-plugin/marketplace.json

@@ -11,8 +11,8 @@
     {
       "name": "summer",
       "source": "./",
-      "version": "3.6.0",
-      "description": "Agent tooling for Summer Engine: game-dev skills, lifecycle hooks, and a 107-tool MCP bridge to the local desktop app.",
+      "version": "3.8.0",
+      "description": "Agent tooling for Summer Engine: game-dev skills, lifecycle hooks, and a 119-tool MCP bridge to the local desktop app.",
       "author": {
         "name": "Summer Engine",
         "email": "founders@summerengine.com"

package/.claude-plugin/plugin.json

@@ -2,8 +2,8 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "_generated": "GENERATED from integrations/claude — do not edit; npm run generate:registry",
   "name": "summer",
-  "version": "3.6.0",
-  "description": "Agent tooling for Summer Engine: game-dev skills, lifecycle hooks, and a 107-tool MCP bridge to the local desktop app.",
+  "version": "3.8.0",
+  "description": "Agent tooling for Summer Engine: game-dev skills, lifecycle hooks, and a 119-tool MCP bridge to the local desktop app.",
   "author": {
     "name": "Summer Engine",
     "email": "founders@summerengine.com",
@@ -116,6 +116,8 @@
     "./library/skills/store-art/",
     "./library/skills/store-listing/",
     "./library/skills/summer-analytics/",
+    "./library/skills/summer-apps/",
+    "./library/skills/summer-apps-design/",
     "./library/skills/summer-friends/",
     "./library/skills/summer-leaderboards/",
     "./library/skills/summer-match-results/",

package/.codex-plugin/plugin.json

@@ -1,8 +1,8 @@
 {
   "_generated": "GENERATED from integrations/codex — do not edit; npm run generate:registry",
   "name": "summer",
-  "version": "3.6.0",
-  "description": "Agent tooling for Summer Engine: game-dev skills, lifecycle hooks, and a 107-tool MCP bridge. Build games by talking.",
+  "version": "3.8.0",
+  "description": "Agent tooling for Summer Engine: game-dev skills, lifecycle hooks, and a 119-tool MCP bridge. Build games by talking.",
   "author": {
     "name": "Summer Engine",
     "email": "founders@summerengine.com",
@@ -111,6 +111,8 @@
     "./library/skills/store-art/",
     "./library/skills/store-listing/",
     "./library/skills/summer-analytics/",
+    "./library/skills/summer-apps/",
+    "./library/skills/summer-apps-design/",
     "./library/skills/summer-friends/",
     "./library/skills/summer-leaderboards/",
     "./library/skills/summer-match-results/",
@@ -151,7 +153,7 @@
   "interface": {
     "displayName": "Summer",
     "shortDescription": "Superpowers for AI game dev. Build games by talking.",
-    "longDescription": "Summer turns Codex into a game-dev studio for Summer Engine. Users make Summer games with the Summer SDK and GDScript. The plugin adds game-dev skills, lifecycle hooks, and a 107-tool MCP bridge for guarded project files, scene editing, asset import, play mode, diagnostics, generation, and creator workflows. Git, shell, and grep stay with the host agent. Summer follows its upstream technical base continuously; version-sensitive work uses the bundled compatibility reference instead of a fixed onboarding version. Session-start orients the session. Pre-commit doctor (opt-in) blocks bad commits.",
+    "longDescription": "Summer turns Codex into a game-dev studio for Summer Engine. Users make Summer games with the Summer SDK and GDScript. The plugin adds game-dev skills, lifecycle hooks, and a 119-tool MCP bridge for guarded project files, scene editing, asset import, play mode, diagnostics, generation, and creator workflows. Git, shell, and grep stay with the host agent. Summer follows its upstream technical base continuously; version-sensitive work uses the bundled compatibility reference instead of a fixed onboarding version. Session-start orients the session. Pre-commit doctor (opt-in) blocks bad commits.",
     "developerName": "Summer Engine",
     "category": "Coding",
     "capabilities": [

package/.cursor-plugin/plugin.json

@@ -3,8 +3,8 @@
   "_generated": "GENERATED from integrations/cursor — do not edit; npm run generate:registry",
   "name": "summer",
   "displayName": "Summer",
-  "version": "3.6.0",
-  "description": "Agent tooling for Summer Engine: game-dev skills, lifecycle hooks, and a 107-tool MCP bridge to the local desktop app.",
+  "version": "3.8.0",
+  "description": "Agent tooling for Summer Engine: game-dev skills, lifecycle hooks, and a 119-tool MCP bridge to the local desktop app.",
   "author": {
     "name": "Summer Engine",
     "email": "founders@summerengine.com"
@@ -123,6 +123,8 @@
     "./library/skills/store-art/",
     "./library/skills/store-listing/",
     "./library/skills/summer-analytics/",
+    "./library/skills/summer-apps/",
+    "./library/skills/summer-apps-design/",
     "./library/skills/summer-friends/",
     "./library/skills/summer-leaderboards/",
     "./library/skills/summer-match-results/",

package/.factory-plugin/plugin.json

@@ -1,8 +1,8 @@
 {
   "_generated": "GENERATED from integrations/factory — do not edit; npm run generate:registry",
   "name": "summer",
-  "description": "Agent tooling for Summer Engine: game-dev skills, lifecycle hooks, and a 107-tool MCP bridge to the local desktop app.",
-  "version": "3.6.0",
+  "description": "Agent tooling for Summer Engine: game-dev skills, lifecycle hooks, and a 119-tool MCP bridge to the local desktop app.",
+  "version": "3.8.0",
   "author": {
     "name": "Summer Engine",
     "email": "founders@summerengine.com",
@@ -108,6 +108,8 @@
     "./library/skills/store-art/",
     "./library/skills/store-listing/",
     "./library/skills/summer-analytics/",
+    "./library/skills/summer-apps/",
+    "./library/skills/summer-apps-design/",
     "./library/skills/summer-friends/",
     "./library/skills/summer-leaderboards/",
     "./library/skills/summer-match-results/",

package/CHANGELOG.md

@@ -2,6 +2,30 @@
 
 All notable changes to summer-engine will be documented here. Following [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and [Semantic Versioning](https://semver.org/).
 
+## [3.8.0] - 2026-10-13
+
+Agents build Summer Apps, team tools inside Summer Studio, and asset-only requests skip the engine.
+
+- **Summer Apps tools.** A Summer App is a tool your team uses inside Summer Studio: a balance table, a quest editor, an asset tracker, a pick-one grid. Your agent builds it and it works on the team's data. New tools: `summer_app_guide` (the build guide), `summer_app_list`, `summer_app_create`, `summer_app_publish` (from a local folder, files or a layout), `summer_app_get`, `summer_app_events` (what the app sends to agents), `summer_app_page` (fill the app's fields and press its buttons), `summer_app_data` (read and write the app's shared data; `as: "seed"` for starter data), `summer_app_tools` and `summer_app_call` (the agent tools an app declares), `summer_app_dock` (dock an app as a panel in the editor) and `summer_app_report_gap` (tell Summer what the app needed and did not have). All but `summer_app_dock` work without the engine; they need `summer login`. If Summer Apps is not open for your account yet, they answer `not_found`.
+- **Two new skills: `summer-apps` and `summer-apps-design`.** `summer-apps` is the build loop, Layout or code, the manifest, the SDK, data and agent tools, with a complete working app. `summer-apps-design` is how an app should look: page layout, the Summer UI kit components, tables, charts, states, and a check before you publish.
+- **`summer_app_screenshot`: see your Summer App without opening Studio.** Summer renders the app's published version with your data and returns the picture plus what to fix: console lines, uncaught errors, calls it refused, whether the SDK connected, and the fields and buttons the app declared. It is read-only: writes, sends and paid calls are refused, so nothing changes. `width: 390` shows the phone layout, `theme: "dark"` the dark theme, `fullPage` the whole scroll; `out` also saves the PNG (`summer tool app-screenshot` saves it to `./summer-app-screenshot.png`). The `summer-apps` skill now looks at every publish this way.
+- `summer_app_create` without `workspaceId` puts the app in the person's team: the one their Studio tab is on, else their latest team, else their personal workspace. The result says which.
+- `summer_app_events` waits up to `timeoutSeconds`, the same argument name as the hosted tool.
+- `summer_app_guide` has section `types`: the SDK's exact TypeScript types. Keep that file one folder above the app; a `dir` publish also skips `.d.ts` files.
+- **`summer_app_update`** renames a Summer App or sets it kept, archived or back to scratch, so agents archive the throwaway apps they made.
+- **`summer_enable_plugin` enables an editor plugin (`res://addons/<name>/`) and reports what really happened.** On engines that wait for the plugin, it answers `enabled` with the plugin's autoloads, or the failure code with a hint. Older engines only queue the enable; the tool then answers `queued: true` and `enabled: null` with a note, and does not claim success.
+- Hosted tools such as `summer_studio_page` no longer fail with "Tool not found" when an agent calls them right after it connects, before it lists the tools. The call now waits for the hosted tools to finish loading, then runs.
+- **Assets only: no engine, no brainstorm, one sign-in.** If you only want assets (a sound, an image, a model), the README has a prompt to paste that skips the engine download and the starter project, and runs setup with `--no-games` so you sign in once. `/summer` sends an asset request such as "make me a sword clash sound" straight to its asset skill instead of a game brainstorm, and `sound-effect` stops after you approve the clips when there is no project to import into.
+- Out of credits, a generation tool now gives one link: the Add credits step in Summer Studio (`https://summerengine.com/studio/credits`). Pick an amount and pay once; no plan needed.
+
+## [3.7.0] - 2026-10-13
+
+Sound-effect choices open in your Studio tab right away, agents act on Summer's review feedback, and the legacy creator path is gone.
+
+- `summer_generate_sfx_choices` no longer waits 20 s and then reports `studio_tab_timeout` before it opens the page. Summer now sends the choices page to your open Summer Studio tab as it makes the versions, and the tool reads that answer: when your tab took it, no browser opens; when no tab is open, it opens your browser as before. Signing in to the store is no longer needed for the tab to open.
+- **Removed the legacy Summercraft creator path.** The deprecated `summer_creator_publish`, `summer_creator_releases` and `summer_creator_config` MCP tools (and their `summer tool` slugs and library entries), the `summer publish` and `summer releases` commands, `summer login --creator` and the `creator.apiUrl`, `creator.projectId` and `creator.channel` config keys are gone. Publish to summer.games with `summer_export_game`, then `summer_publish_build`, then the hosted `summer_store_submit` and `summer_store_review`. `gateway.url` stays settable with `summer config`; `summer logout` still removes a `~/.summer/creator-token` an older CLI left behind.
+- **Agents read Summer's review feedback and resubmit.** When Summer staff ask for changes to a submitted game, or do not approve it, they can now write feedback for the creator. The hosted `summer_store_review` tool returns the decision, that feedback and the next step; `publish-your-game` and the MCP instructions tell the agent to fix what the feedback names and call `summer_store_submit` again, and never to call the game live before Summer approves it.
+
 ## [3.6.0] - 2026-10-12
 
 Pick your sound effects by ear, and hosted games: agents check that players can actually join before a release.

package/README.md

@@ -61,12 +61,22 @@ In most agents (Claude Code, Codex, Cursor, GitHub Copilot (VS Code, CLI, JetBra
 
 Then ask the agent to build something.
 
+### Only want assets?
+
+Sound effects, music, voices, images, 3D models and video are made on Summer's servers, so you do not need the Summer Engine app for them. Paste this instead:
+
+> Connect Summer to this agent so I can make game assets. Read github.com/summerengine/summer, connect yourself to Summer and log me in. Skip the Summer Engine app and the starter project, I only want assets.
+
+The agent installs the skills and the MCP config and signs you in. It does not download the engine. Each asset lands in your Summer library, so a game project (in Summer Engine or anywhere else) can use it later.
+
 ---
 
 ## AGENTS READING THIS: install playbook
 
 You are an AI coding agent. The user told you to install Summer Engine. **Run this playbook via your shell**: Bash on macOS/Linux or PowerShell on Windows. Detection first, then only install what's missing. (Once installed, your working guide is [`AGENTS.md`](AGENTS.md).)
 
+**Assets only.** If the user only wants assets (sound effects, music, voices, images, 3D models, video), not a game built in Summer Engine, or tells you to skip the engine: run Step -1, Step 0, Step 1 with `--no-games` added (Summer Games is for playing with friends, and leaving it out saves a second sign-in), and Step 3, then stop installing. Skip Step 2 (the engine download), Step 5 and Step 6. On this path the doctor warnings for `engine-install` and `local-api` are expected; leave them. The asset tools (`summer_generate_audio`, `summer_generate_sfx_choices`, `summer_generate_image`, `summer_generate_3d`, `summer_generate_video`, `summer_search_assets`) run on Summer's servers and need only the login. Most agents load a new MCP server only after a restart. Until then, call the same tool from the shell: `npx -y summer-engine@latest tool <slug> --args '<json>'` (`summer tool --list` prints the slugs). For example, three versions of one sound for the user to pick from: `npx -y summer-engine@latest tool generate-sfx-choices --args '{"text":"sword clash"}'`. Each asset lands in the user's Summer library.
+
 **Windows PowerShell: type `npx.cmd` wherever this playbook says `npx`.** Plain `npx` in PowerShell runs `npx.ps1`, which Windows blocks by default ("running scripts is disabled on this system"). `npx.cmd` is the same command without that block. Never change the execution policy or turn off Windows Defender to work around it. Bash (including Git Bash on Windows) can use plain `npx`.
 
 ### Step -1: Verify Node.js is on PATH
@@ -207,7 +217,7 @@ Only skip brainstorm if the user explicitly said "skip brainstorm" or "just buil
 - **Don't run `npm install -g summer-engine`.** Use `npx -y summer-engine@latest ...` instead. `-g` requires `sudo` on most Mac/Linux setups, so the user will get permission errors and you'll get stuck. `npx` works without root and the MCP config we ship already points at `npx summer-engine mcp`.
 - **Don't install Node.js without asking, and don't use anything but winget for it.** On Windows, Step -1 installs Node LTS with winget after the user says yes. On macOS/Linux, point them at https://nodejs.org and stop.
 - **Don't run plain `npx` in Windows PowerShell, and don't change the execution policy or Defender to make it work.** Use `npx.cmd`.
-- **Don't ask the user "do you want the engine too?" or "do you also want the CLI?"** This playbook installs all of it.
+- **Don't ask the user "do you want the engine too?" or "do you also want the CLI?"** This playbook installs all of it. The one exception is an assets-only request (see **Assets only** at the top of this playbook).
 - **Don't double-download.** Always run `npx -y summer-engine@latest doctor --json` first and skip the engine download and the browser login when their checks are `status: "ok"`. Step 1 (`setup`) is the exception: run it every time — it is idempotent, and doctor's top-level `ok` cannot tell you whether skills or the MCP config are installed.
 - **Don't run `summer install` or `summer login` in the background.** They print user-facing output (engine download progress, browser-opening notice). Run them in the foreground so the user sees what's happening.
 - **Don't skip the `--json` flag on `summer doctor`.** Text output is fragile to parse and changes per version.
@@ -322,7 +332,6 @@ We tell you before we touch your disk.
 | `summer-engine` npm package (CLI + MCP + library) | ~2 MB download, ~6 MB unpacked | first `npx -y summer-engine@latest ...` call | [npmjs.com/package/summer-engine](https://www.npmjs.com/package/summer-engine) |
 | Summer Engine app | ~1 GB (engine + bundled Git/runtime tools) | `npx -y summer-engine@latest install` | Summer's signed releases |
 | Auth token | ~1 KB | `npx -y summer-engine@latest login` | Browser to `~/.summer/auth-token` |
-| Creator token | ~50 bytes | only when you run `summer login --creator` and mint one | One-time browser value to `~/.summer/creator-token`; never replaces the auth token |
 | Store sign-in | ~2 KB | only when you run `summer login --store` | Browser OAuth (PKCE, loopback port 47615-47617) to `~/.summer/oauth-token` with its refresh token, plus this machine's public client id in `~/.summer/oauth-client`; never replaces the auth token |
 | Skill files | small, bundled | in the npm package | no extra network call |
 | Generated assets (3D / image / audio / video) | varies | only on explicit `summer_generate_*` calls when that provider route is enabled for the account | Summer Engine Studio |
@@ -352,11 +361,8 @@ matchmaking are not promised by this package.
 | `summer install [--yes]` | Download Summer Engine. Prints URL and size first; never replaces an installed engine without confirmation. |
 | `summer login` | Browser-based core Summer sign-in. |
 | `summer login --store` | Browser sign-in to the Summer store so agents can upload builds (`summer_publish_build`). |
-| `summer login --creator` | Deprecated: connect a creator token for the legacy `summer publish`. |
 | `summer logout` | Clear auth tokens. |
 | `summer config [get\|set\|unset]` | Read or update the shared non-secret `~/.summer/config.json`. |
-| `summer publish [project] --artifact <game.pck> --version <value> [--confirm]` | Deprecated: use `summer tool export-game`, then `summer tool publish-build`. |
-| `summer releases [--cursor <value>]` | List your creator release history. |
 | `summer status` | Engine state, port, auth. |
 | `summer doctor` | Diagnose Node, login, engine, project memory, MCP. |
 | `summer plan <goal>` | Route a game-building goal into skills, MCP tools, gates, and verification. |

package/commands/summer.md

@@ -25,7 +25,7 @@ You speak game-dev shorthand (PCs, NPCs, juice, hit-stop, root motion, blendspac
 ## What to do
 
 1. Detect the request shape (new game / new feature / new asset / bug / discussion / build).
-2. Confirm Summer Engine context. Call `summer_get_project_context` if available. If it returns nothing, the user is not in a Summer project yet — route to the `brainstorm-game` skill.
+2. Confirm Summer Engine context. Call `summer_get_project_context` if available. If it returns nothing and the user wants a game, they are not in a Summer project yet — route to the `brainstorm-game` skill. An asset-only request (a sound, music, a voice line, an image, a model) needs no project, no engine and no brainstorm: go straight to its asset skill. The asset tools run on Summer's servers.
 3. Invoke the right Summer skill with the `Skill` tool. Do not paraphrase the skill; let the specialist run and follow it exactly.
 4. Before any generation call, say what you will generate and roughly how long it takes, and wait for an OK.
 
@@ -40,6 +40,7 @@ Skills are invoked by their bare slug, such as `brainstorm-game`. There is no `s
 | make me a game from scratch | `make-game` |
 | add a [character / enemy / NPC / prop / vehicle] | `asset-strategy` |
 | add a sound for [event] | `sound-effect` |
+| make me a [sound / track / voice line / image / model], no game yet | `sound-effect`, `music-track`, `voice-line`, `concept-art`, `prop-model` (no project needed) |
 | add ambient music | `music-track` |
 | make me fire / smoke / lightning / muzzle flash / magic glow / hit spark / dissolve / water ripple | `vfx-fire`, `vfx-smoke`, `vfx-lightning`, `vfx-muzzle-flash`, `vfx-magic-glow`, `vfx-hit-spark`, `vfx-dissolve`, `vfx-water-ripple` |
 | build the FPS controller | `fps-controller` |

package/dist/cli/commands/login.d.ts

@@ -1,15 +1,5 @@
 import { Command } from "commander";
 export declare const loginCommand: Command;
-export interface CreatorLoginDependencies {
-    openUrl: (url: string) => Promise<unknown>;
-    readSecret: (prompt: string) => Promise<string>;
-    log: (message: string) => void;
-}
-/**
- * The browser session mints the token; the token is pasted once into a hidden
- * prompt. This deliberately does not replace the core Summer login JWT.
- */
-export declare function runCreatorLogin(overrides?: Partial<CreatorLoginDependencies>): Promise<void>;
 export interface LoginDependencies {
     fetch: typeof fetch;
     openUrl: (url: string) => Promise<unknown>;

package/dist/cli/commands/login.js

@@ -1,8 +1,8 @@
 import { Command } from "commander";
 import { randomUUID } from "crypto";
 import open from "open";
-import { getAuthToken, getCreatorToken, saveCreatorToken, saveLoginSession, } from "../../core/auth.js";
-import { getCreatorApiUrl, resolveGatewayUrl } from "../../core/config.js";
+import { getAuthToken, saveLoginSession, } from "../../core/auth.js";
+import { resolveGatewayUrl } from "../../core/config.js";
 import { readStoredOAuthToken, runStoreLogin } from "../../core/oauth.js";
 const POLL_INTERVAL_MS = 2000;
 // One generous window on ONE session id. First-time users may need to create an
@@ -14,7 +14,6 @@ const POLL_TIMEOUT_MS = 900000;
 const HEARTBEAT_MS = 30000;
 export const loginCommand = new Command("login")
     .description("Sign in to Summer Engine via your browser")
-    .option("--creator", "Connect a separately scoped Summercraft creator token for publishing")
     .option("--store", "Sign in to the Summer store so agents can upload builds (summer_publish_build)")
     .option("--force", "Force re-authentication even if already logged in")
     .action(async (opts) => {
@@ -28,15 +27,6 @@ export const loginCommand = new Command("login")
         console.log("Signed in to the Summer store. Your core Summer login was not changed.");
         return;
     }
-    if (opts.creator) {
-        const existingCreator = await getCreatorToken();
-        if (existingCreator && !opts.force) {
-            console.log("A creator token is already connected. Use --creator --force to replace it.");
-            return;
-        }
-        await runCreatorLogin();
-        return;
-    }
     const existing = await getAuthToken();
     if (existing && !opts.force) {
         console.log("Already logged in. Use --force to re-authenticate.");
@@ -44,76 +34,6 @@ export const loginCommand = new Command("login")
     }
     await runLogin();
 });
-async function readHiddenLine(prompt) {
-    if (!process.stdin.isTTY || !process.stdout.isTTY) {
-        process.stdout.write(prompt);
-        let value = "";
-        for await (const chunk of process.stdin)
-            value += String(chunk);
-        return value.trim();
-    }
-    process.stdout.write(prompt);
-    const input = process.stdin;
-    const wasRaw = input.isRaw;
-    input.setRawMode(true);
-    input.resume();
-    return new Promise((resolve, reject) => {
-        let value = "";
-        const finish = (error) => {
-            input.off("data", onData);
-            input.setRawMode(Boolean(wasRaw));
-            input.pause();
-            process.stdout.write("\n");
-            if (error)
-                reject(error);
-            else
-                resolve(value.trim());
-        };
-        const onData = (chunk) => {
-            for (const char of String(chunk)) {
-                if (char === "\u0003") {
-                    finish(new Error("Creator token entry cancelled."));
-                    return;
-                }
-                if (char === "\r" || char === "\n" || char === "\u0004") {
-                    finish();
-                    return;
-                }
-                if (char === "\u007f" || char === "\b") {
-                    value = value.slice(0, -1);
-                }
-                else if (char >= " ") {
-                    value += char;
-                }
-            }
-        };
-        input.on("data", onData);
-    });
-}
-const defaultCreatorLoginDependencies = {
-    openUrl: open,
-    readSecret: readHiddenLine,
-    log: console.log,
-};
-/**
- * The browser session mints the token; the token is pasted once into a hidden
- * prompt. This deliberately does not replace the core Summer login JWT.
- */
-export async function runCreatorLogin(overrides = {}) {
-    const deps = { ...defaultCreatorLoginDependencies, ...overrides };
-    const settingsUrl = `${await getCreatorApiUrl()}/creator/settings/tokens`;
-    deps.log(`Opening creator token settings: ${settingsUrl}`);
-    deps.log('Mint a token with the exact "publish" scope, copy its one-time sc_ value, then return here.');
-    try {
-        await deps.openUrl(settingsUrl);
-    }
-    catch {
-        deps.log("Could not open the browser. Copy the URL above and open it manually.");
-    }
-    const token = await deps.readSecret("Creator token (input hidden): ");
-    await saveCreatorToken(token);
-    deps.log("Creator publishing connected. Your core Summer login token was not changed.");
-}
 /** The gateway answered with a terminal 4xx — retrying the same URL cannot help. */
 class LoginRejectedError extends Error {
 }

package/dist/cli/index.js

@@ -14,8 +14,6 @@ import { doctorCommand } from "./commands/doctor.js";
 import { planCommand } from "./commands/plan.js";
 import { debugCommand } from "./commands/debug.js";
 import { configCommand } from "./commands/config.js";
-import { publishCommand } from "./commands/publish.js";
-import { releasesCommand } from "./commands/releases.js";
 import { eventsCommand } from "./commands/events.js";
 import { toolCommand } from "./commands/tool.js";
 import { getBanner } from "./banner.js";
@@ -51,8 +49,6 @@ export function runCli(mcpCommand) {
     program.addCommand(debugCommand);
     program.addCommand(planCommand);
     program.addCommand(configCommand);
-    program.addCommand(publishCommand);
-    program.addCommand(releasesCommand);
     program.addCommand(eventsCommand);
     program.addCommand(toolCommand);
     program.parseAsync().catch((err) => {

package/dist/core/auth.d.ts

@@ -14,7 +14,6 @@ export interface CredentialMetadata {
 interface CredentialMetadataDocument {
     schemaVersion: 1;
     auth?: CredentialMetadata;
-    creator?: CredentialMetadata;
 }
 export interface LoginSession {
     token: string;
@@ -37,13 +36,6 @@ export declare function getAuthToken(): Promise<string | null>;
  */
 export declare function hasEnvAuthToken(): boolean;
 export declare function saveAuthToken(token: string, scopes?: string[]): Promise<void>;
-/**
- * Summercraft creator tokens are a separate credential audience from the
- * core-compatible Summer CLI JWT. Never store an sc_ token in auth-token:
- * the engine reads that file and expects the summer-cli JWT contract.
- */
-export declare function getCreatorToken(): Promise<string | null>;
-export declare function saveCreatorToken(token: string): Promise<void>;
 export declare function getUserInfo(): Promise<SummerUserInfo | null>;
 export declare function saveUserInfo(info: SummerUserInfo): Promise<void>;
 export declare function saveLoginSession(session: LoginSession): Promise<void>;

package/dist/core/auth.js

@@ -3,7 +3,8 @@ export { getSummerDir } from "./store.js";
 const AUTH_TOKEN_FILE = "auth-token";
 /** Written by v2 `summer login` for the removed Summer Cloud sync. Only ever removed now (logout). */
 const LEGACY_CLOUD_TOKEN_FILE = "cloud-token";
-const CREATOR_TOKEN_FILE = "creator-token";
+/** Written by the removed `summer login --creator` (Summercraft). Only ever removed now (logout). */
+const LEGACY_CREATOR_TOKEN_FILE = "creator-token";
 const USER_FILE = "user.json";
 const METADATA_FILE = "credential-metadata.json";
 /** The Summer store OAuth token (core/oauth.ts OAUTH_TOKEN_FILE). */
@@ -78,8 +79,8 @@ async function updateMetadata(kind, value, current) {
     };
     if (!next.auth)
         delete next.auth;
-    if (!next.creator)
-        delete next.creator;
+    // Drop the removed Summercraft creator entry left by older CLIs.
+    delete next.creator;
     await writeStoreJson(METADATA_FILE, next);
 }
 /**
@@ -115,27 +116,6 @@ export async function saveAuthToken(token, scopes = []) {
     await writeStoreText(AUTH_TOKEN_FILE, `${clean}\n`);
     await updateMetadata("auth", decodeJwtMetadata(clean, scopes), metadata);
 }
-/**
- * Summercraft creator tokens are a separate credential audience from the
- * core-compatible Summer CLI JWT. Never store an sc_ token in auth-token:
- * the engine reads that file and expects the summer-cli JWT contract.
- */
-export async function getCreatorToken() {
-    const token = await readStoreText(CREATOR_TOKEN_FILE);
-    return token?.trim() || null;
-}
-export async function saveCreatorToken(token) {
-    const clean = token.trim();
-    if (!/^sc_[A-Za-z0-9_-]{32,}$/.test(clean)) {
-        throw new Error('That is not a Summercraft creator API token. Recovery: open /creator/settings/tokens, mint a token with the "publish" scope, and paste the complete one-time sc_ value.');
-    }
-    await writeStoreText(CREATOR_TOKEN_FILE, `${clean}\n`);
-    await updateMetadata("creator", {
-        audience: ["summercraft-creator"],
-        scopes: ["publish"],
-        tokenType: "api",
-    });
-}
 export async function getUserInfo() {
     return readStoreJson(USER_FILE);
 }
@@ -173,21 +153,11 @@ export async function saveLoginSession(session) {
 export async function getCredentialMetadata() {
     const metadata = await readMetadata();
     const token = await getAuthToken();
-    const creatorToken = await getCreatorToken();
     return {
         schemaVersion: 1,
         ...(token
             ? { auth: metadata.auth ?? decodeJwtMetadata(token) }
             : {}),
-        ...(creatorToken
-            ? {
-                creator: metadata.creator ?? {
-                    audience: ["summercraft-creator"],
-                    scopes: [],
-                    tokenType: "api",
-                },
-            }
-            : {}),
     };
 }
 export async function clearAuthCredentials() {
@@ -195,7 +165,7 @@ export async function clearAuthCredentials() {
     for (const file of [
         AUTH_TOKEN_FILE,
         LEGACY_CLOUD_TOKEN_FILE,
-        CREATOR_TOKEN_FILE,
+        LEGACY_CREATOR_TOKEN_FILE,
         STORE_OAUTH_TOKEN_FILE,
         USER_FILE,
         METADATA_FILE,