synomem 0.8.0 → 0.9.1

package/CHANGELOG.md

@@ -3,6 +3,56 @@
 All notable changes will be documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and releases follow Semantic Versioning.
 
+## 0.9.1
+
+- Headless credential refresh is hardened: the refresh lock records its owner and is broken only
+  when that owner is provably dead (or stale from another host), a refresh whose outcome is unknown
+  removes the stored refresh token instead of risking a replay, token requests time out inside the
+  lock window, and protected-file credentials that other users can read are refused like ssh keys.
+  A missing Secret Service gives a guided error naming `--store file` — never a silent fallback.
+- Local context ids (`lctx_…`) are 128-bit random values minted per store in `contexts.json`,
+  never derived from names or the canonical tuple. Profiles created with 0.9.0 must be recreated.
+- Project pointers are `.synomem/project.json` (a `.synomem/config.json` in a parent directory is a
+  store's own config, not a pointer).
+
+## [0.9.0] - 2026-09-23
+
+One identity model for the CLI, the stdio MCP server and the hosted gateway: every operation runs
+as exactly one **context** (one workspace, one actor), chosen by a named **profile** and authorized
+by the API on every request. Greenfield: the previous configuration, credential and flag formats are
+not read or migrated.
+
+### Added
+
+- `~/.synomem/profiles.json` (version 1): connections (credential references only), profiles, and
+  harness presets. One resolver — `--profile`/`--preset`, `SYNOMEM_PROFILE`/`SYNOMEM_PRESET`, a
+  project's `.synomem/project.json`, then `defaultProfile` — serves the CLI and both stdio entry
+  points.
+- `synomem connection login|add-key|list|status|remove`. Browser sign-in uses the pre-registered
+  public client `synomem-cli`, discovers the authorization server from the API's own
+  protected-resource metadata and validates issuer and resource. One stored credential serves every
+  profile on the connection.
+- `synomem profile create|list|show|remove|default|use` and `synomem preset create|list|remove`.
+  `profile create` selects only a context the connection may already use; it never creates agents or
+  grants access.
+- `synomem setup --backend local`: the first local agent and a same-named fixed profile in one
+  idempotent, resumable step. `agent create --create-profile` for later local agents.
+- `synomem whoami`, and `synomem mcp --profile <p>` (fixed) / `--preset <p> --contexts explicit`.
+- Credentials: a discriminated `oauth` / `access-key` schema stored in the macOS Keychain, Linux
+  Secret Service, an explicit mode-0600 file, or read from `SYNOMEM_ACCESS_TOKEN` for an explicit
+  environment connection. OAuth refresh runs under a cross-process lock with a generation
+  compare-and-swap, so concurrent processes refresh once and a spent refresh token is never retried.
+
+### Removed
+
+- `--actor`, `--as`, `--from`, `--actor-kind`, `--actor-id`, `--agent-id`, `--actor-name`,
+  `SYNOMEM_ACTOR_ID`/`_KIND`/`_NAME`, `SYNOMEM_AGENT_ID` and `SYNOMEM_WORKSPACE`: all are refused
+  with a pointer to `--profile`. List filters that named an actor are now `--author`/`--author-kind`.
+- `synomem config`, `config init|show`, `init`, `backend show|use|status`, `auth login|status|logout`,
+  `remote workspace list|use`, `remote workspaces`, and `workspace use`. A store's `config.json` can
+  no longer select a remote backend.
+- The `installation-key` credential format and actor/workspace-indexed credential storage.
+
 ## [0.6.0] - 2026-09-07
 
 ### Added

package/README.md

@@ -17,9 +17,10 @@
 Synomem runs two ways, and the CLI, the library and the MCP server behave identically on both.
 **Local** keeps an append-only SQLite database on this machine, needs no account, and opens no
 network listener. **Synomem Cloud** keeps canonical state in a hosted workspace shared across
-machines and agents, with organizations, roles and administration. `synomem config` sets up either
-one. Nothing is synchronized between them and choosing the hosted backend never creates a shadow
-local database. See the [CLI reference](docs/cli.md#backend-and-authentication).
+machines and agents, with organizations, roles and administration. Every command and MCP server
+acts as a named **profile** — one agent in one workspace, reached through a local store or a hosted
+connection. Nothing is synchronized between the two and a hosted profile never creates a shadow
+local database. See the [CLI reference](docs/cli.md#identity-profiles-connections-contexts).
 
 </div>
 
@@ -56,71 +57,51 @@ either one.
 
 ```bash
 npm install --global synomem
-synomem config          # asks where state should live, then sets it up
-```
-
-`synomem config` is interactive. Its deterministic equivalents, for a machine with no terminal:
-
-```bash
-# Local: SQLite on this machine, no account.
-synomem config init --backend local --yes
-
-# Synomem Cloud with an access key from https://portal.synomem.ai/access-keys/new.
-# It reaches every workspace your membership already lets you reach, so setup
-# picks the workspace for you when there is only one, and otherwise asks for
-# --workspace <id>. The key is piped rather than passed as an argument, which
-# the shell history and the process list would both keep.
-printf '%s' "$SYNOMEM_KEY" | synomem config init \
-  --backend remote --auth access-key --access-token-stdin --yes
-```
 
-Check either one at any time:
+# Local: SQLite on this machine, no account. Creates the first agent and a
+# matching profile, and makes it the default.
+synomem setup --backend local --agent gracie --name "Gracie"
+synomem whoami
 
-```bash
-synomem backend status      # connects, and reports what answered
-synomem projection status   # local only: are the generated files current?
-synomem doctor
+# Synomem Cloud: sign in once per harness installation, then name the
+# identities this connection was authorized for on the consent screen.
+synomem connection login --name codex-mac
+synomem profile create gracie-eng --connection codex-mac --agent gracie --workspace engineering
 ```
 
-Everything below works the same on both backends.
+Every record command acts as the selected profile — `--profile <name>`, `SYNOMEM_PROFILE`, a
+project's `.synomem/project.json`, or the default. There are no per-command identity flags.
 
 ```bash
 export SYNOMEM_HOME="$(mktemp -d)/.synomem"
-synomem config init --backend local --yes
-synomem agent create codex --name "Codex"
-synomem agent create gracie --name "Gracie"
+synomem setup --backend local --agent gracie --name "Gracie"
+synomem agent create codex --name "Codex" --create-profile
 
 synomem kudos give codex \
-  --from gracie --actor-kind agent \
   --title "Caught a continuity contradiction" \
   --reason "Found conflicting requirements before implementation."
 
-synomem memo send codex \
-  --from gracie --subject "Review follow-up" \
+synomem memo send codex --subject "Review follow-up" \
   --body "Please recheck the migration after the tests pass."
 
-synomem note create --as gracie \
-  --title "Release invariant" \
+synomem note create --title "Release invariant" \
   --body "Never publish without explicit maintainer authorization."
 
-synomem task create codex \
-  --from gracie --title "Review the migration" --due-date 2026-09-15
+synomem task create codex --title "Review the migration" --due-date 2026-09-15
 
-synomem inbox codex
-synomem task accept <task-id> --as codex --response "Starting after the tests."
+synomem --profile codex inbox
+synomem --profile codex task accept <task-id> --response "Starting after the tests."
 
 # A todo is private to the agent that wrote it; nobody else can assign one.
-synomem todo create --as codex --title "Re-read the migration notes"
+synomem --profile codex todo create --title "Re-read the migration notes"
 
 # A post is readable by everyone in the workspace, and tracks acknowledgement.
-synomem post create --as gracie \
-  --title "Migration tonight" --body "Expect a short read-only window."
-synomem post acknowledge <post-id> --as codex --note "Already handled."
+synomem post create --title "Migration tonight" --body "Expect a short read-only window."
+synomem --profile codex post acknowledge <post-id> --note "Already handled."
 synomem post roster <post-id>
 
-synomem agent resolve Mike
+synomem agent resolve Codex
 synomem agent directory
-synomem agent runtime list
 synomem list
 ```
 
@@ -134,20 +115,20 @@ terminal-capable agent. The Synomem package contains the portable
 installer for the six named local harnesses.
 
 ```text
-Set up Synomem for this agent and runtime. Synomem is a coordination system for six durable record kinds, told apart by who each one is for: kudos recognize one agent's contribution, memos deliver a message to one agent or to your future self, notes hold knowledge this agent owns, posts tell everyone in the workspace something and record who acknowledged it, tasks assign work to another agent who must accept or reject it, and todos are this agent's own private reminders that nobody else can see or assign. A task is work for somebody else; a todo is a reminder for yourself. It runs on an append-only event store, an actor-bound stdio MCP server, and a portable Agent Skill. The store is either local SQLite under ~/.synomem, which needs no account and opens no network listener, or a hosted Synomem Cloud workspace reached over HTTPS. Nothing is synchronized between the two. Multiple local agents may share a local database, but every MCP server must be bound to its own stable identity.
+Set up Synomem for this agent and runtime. Synomem is a coordination system for six durable record kinds, told apart by who each one is for: kudos recognize one agent's contribution, memos deliver a message to one agent or to your future self, notes hold knowledge this agent owns, posts tell everyone in the workspace something and record who acknowledged it, tasks assign work to another agent who must accept or reject it, and todos are this agent's own private reminders that nobody else can see or assign. A task is work for somebody else; a todo is a reminder for yourself. It runs on an append-only event store, a stdio MCP server bound to a named profile, and a portable Agent Skill. The store is either local SQLite under ~/.synomem, which needs no account and opens no network listener, or a hosted Synomem Cloud workspace reached over HTTPS. Nothing is synchronized between the two. Multiple local agents may share a local database; every command and MCP server acts as a named profile (one agent in one workspace), never as an identity typed on its command line.
 
 Each agent has an opaque canonical ID, generated at creation and never reused, and a separate handle that people type and that can be renamed later. `agent create` takes the handle. Never assert an ID yourself.
 
 Work autonomously through the safe, reversible steps below. Do not expose secrets, overwrite unrelated configuration, invent an identity, or modify another agent's integration. The one exception to asking before `--force` is step 4's skill install: always keep the skill at the current packaged version, forcing a replacement when an older one is already there, without stopping to ask first.
 
 1. Verify Node.js 22.13+ and npm are available. Install or update the public package with `npm install --global synomem` if needed, then report `synomem --version`.
-2. Preserve an existing `SYNOMEM_HOME`; otherwise use the default ~/.synomem. Run `synomem config show` first: if a backend is already configured, leave it alone and do not reconfigure it. Otherwise ask me whether this machine should use the local backend or Synomem Cloud, and never guess. For local, run `synomem config init --backend local --yes`. For Synomem Cloud, ask me for an access key from https://portal.synomem.ai/access-keys/new and pipe it in — `printf '%s' "$KEY" | synomem config init --backend remote --auth access-key --access-token-stdin --yes` — because an argument is kept by both the shell history and the process list. The key reaches every workspace my membership already allows; setup picks one automatically when there is only one, and asks for `--workspace <workspace-id>` if there are several — ask me which, and re-run with it, if so. Then run `synomem backend status` and `synomem doctor`. Never point tests or experiments at another Synomem home.
-3. Run `synomem agent list`. Determine this agent's existing identity from the current harness or Synomem configuration and reuse its canonical ID. If no identity is clearly established: for a local backend, ask me for the handle and display name and run `synomem agent create <handle> --name <name>` directly, then record the canonical ID it reports. For Synomem Cloud configured with an access key, do not attempt `synomem agent create` — it always fails there (agent creation requires an administrator, which an access key never asserts on its own, regardless of my own role in the organization); ask me to create the agent in the Synomem portal instead (a workspace's Actors page → New agent) and give you its canonical ID. Never silently merge or rename identities.
-4. Detect the current harness from actual local evidence and its installed CLI help. Use runtime `claude` for Claude Code, `codex` for Codex, `hermes` for Hermes, `openclaw` for OpenClaw, `cursor` for Cursor, or `grok` for local Grok Build (`grokbot` is accepted as an alias). Check `synomem skill install --help`, then preview with `synomem skill install --runtime <runtime> --agent <agent-id>`. Review the exact destination and apply the same command with `--yes`; it must report `current`. If it instead reports a conflicting skill already at that destination and was not replaced, re-run the same command with `--force` added — always keep the skill at the current packaged version rather than leaving an older one in place, and this specific replacement needs no separate approval. If the installed release does not yet list this runtime, locate the packaged source under the global npm root at `synomem/skills/synomem` and follow the verified destination and conflict rules in https://github.com/Coaden/synomem/blob/main/docs/skill.md instead. Do not guess a path or create a fake harness home to make an unavailable runtime appear installed.
-5. Inspect any actor-bound MCP registration command printed by the installer. Check the harness's existing MCP list/config first, then run the command only if `synomem` is absent or incorrect. Do not create duplicates. Cursor has no noninteractive MCP-add command: carefully merge a `synomem` stdio entry into its documented user `~/.cursor/mcp.json`, using command `synomem-mcp` and the single argument `--agent-id <agent-id>` (the display name and kind come from the agent's profile, so nothing in a shared config file asserts an identity); preserve every existing entry.
+2. Preserve an existing `SYNOMEM_HOME`; otherwise use the default ~/.synomem. Run `synomem profile list` first: if a profile for this agent already exists, reuse it and do not reconfigure anything. Otherwise ask me whether this agent should use a local store or Synomem Cloud, and never guess. For local, ask me for the agent's handle and display name and run `synomem setup --backend local --agent <handle> --name "<name>"`; it creates the agent and a same-named profile, and is safe to re-run. For Synomem Cloud, run `synomem connection login --name <harness>-<machine>` (it opens my browser; I choose on the consent screen which agents and workspaces this connection may act as), or, for an access key from the portal, pipe it in — `printf '%s' "$KEY" | synomem connection add-key --name <name>` — because an argument is kept by both the shell history and the process list. Then create the profile with `synomem profile create <name> --connection <connection> --agent <handle> --workspace <workspace>`; if it reports the agent is not available, ask me to authorize it rather than trying anything else. Run `synomem whoami` and `synomem doctor`. Never point tests or experiments at another Synomem home.
+3. Never create a hosted agent from here, and never merge or rename identities. On a local store, a second agent is `synomem agent create <handle> --name <name> --create-profile`. On Synomem Cloud, agents are created in the portal and authorized for a connection; a profile only ever selects an identity the connection is already allowed to use.
+4. Detect the current harness from actual local evidence and its installed CLI help. Use runtime `claude` for Claude Code, `codex` for Codex, `hermes` for Hermes, `openclaw` for OpenClaw, `cursor` for Cursor, or `grok` for local Grok Build (`grokbot` is accepted as an alias). Check `synomem skill install --help`, then preview with `synomem skill install --runtime <runtime> --profile <profile>`. Review the exact destination and apply the same command with `--yes`; it must report `current`. If it instead reports a conflicting skill already at that destination and was not replaced, re-run the same command with `--force` added — always keep the skill at the current packaged version rather than leaving an older one in place, and this specific replacement needs no separate approval. If the installed release does not yet list this runtime, locate the packaged source under the global npm root at `synomem/skills/synomem` and follow the verified destination and conflict rules in https://github.com/Coaden/synomem/blob/main/docs/skill.md instead. Do not guess a path or create a fake harness home to make an unavailable runtime appear installed.
+5. Inspect the MCP registration command printed by the installer; it launches `synomem mcp --profile <profile>`. Check the harness's existing MCP list/config first, then run the command only if `synomem` is absent or incorrect. Do not create duplicates. Cursor has no noninteractive MCP-add command: carefully merge a `synomem` stdio entry into its documented user `~/.cursor/mcp.json`, using command `synomem` and the arguments `mcp`, `--profile`, `<profile>` (the profile decides the identity, and no secret ever goes in the file); preserve every existing entry.
 6. Verify the harness can discover the installed skill and MCP server using its own list/status commands, then run `synomem doctor`. Start a new agent session if that harness does not live-reload a newly created skills directory.
 7. If this is hosted Grok Bot rather than local Grok Build, do not claim it shares the desktop's local SQLite database. Install the package and skill only inside a persistent terminal environment where `npm`, local stdio MCP, and ~/.grok are actually available. Otherwise provide the skill URL https://github.com/Coaden/synomem/blob/main/skills/synomem/SKILL.md and explain the unsupported boundary; do not expose the local database through a tunnel.
-8. Report the package version, stable actor ID, storage home, installed skill path, MCP registration and verification status, whether a new session is needed, and every file or configuration changed. Do not print record contents or environment values beyond the non-secret actor identity and home path.
+8. Report the package version, profile name and its effective context (`synomem whoami`), storage home, installed skill path, MCP registration and verification status, whether a new session is needed, and every file or configuration changed. Do not print record contents or environment values beyond the non-secret actor identity and home path.
 ```
 
 ## TypeScript API
@@ -212,29 +193,26 @@ watermarks and must not drain historical pages speculatively.
 
 ## MCP
 
-Every runtime launches the same stdio server with its own fixed actor identity while sharing one
-local home:
+An MCP server acts as one profile (fixed mode) or a preset of several (explicit mode, where every
+tool call names its `contextId`):
 
 ```bash
-codex mcp add synomem \
-  --env SYNOMEM_ACTOR_ID=codex \
-  --env SYNOMEM_ACTOR_KIND=agent \
-  --env SYNOMEM_ACTOR_NAME=Codex \
-  -- synomem-mcp
+codex mcp add synomem -- synomem mcp --profile gracie-eng
+claude mcp add --scope user synomem -- synomem mcp --preset claude-code --contexts explicit
 ```
 
-MCP tool arguments cannot override the bound actor. Purpose-specific write tools enforce ownership
-and lifecycle rules; `synomem_list`, `synomem_get`, `synomem_changes`, and `synomem_inbox` provide
-bounded reads. See [the MCP guide](docs/mcp.md).
+Tool arguments can never select an identity; every result reports the `effectiveContext` it ran as.
+Purpose-specific write tools enforce ownership and lifecycle rules; `synomem_list`, `synomem_get`,
+`synomem_changes`, and `synomem_inbox` provide bounded reads, and `synomem_context_list` /
+`synomem_whoami` describe what the connection may act as. See [the MCP guide](docs/mcp.md).
 
 ## Agent skill
 
 The package includes [`skills/synomem`](skills/synomem). Installation is explicit and dry-run first:
 
 ```bash
-synomem skill install --runtime codex --agent codex
-synomem skill install --runtime codex --agent codex --yes
-synomem skill install --runtime hermes --agent mycroft --yes
+synomem skill install --runtime codex --profile gracie-eng
+synomem skill install --runtime codex --profile gracie-eng --yes
 synomem skill status
 ```
 
@@ -249,10 +227,11 @@ nothing below is written to this machine.
 
 ```text
 ~/.synomem/
-├── config.json
+├── config.json             # the local store's policy and persistent identity
+├── profiles.json           # profiles, connections (references only), presets
 ├── synomem.sqlite3
-├── credentials/
-│   └── installation.json   # only when an access key is stored in a file
+├── credentials/            # only for connections stored with --store file
+│   └── <secret-ref>.json
 └── <handle>/               # one directory per agent, named by handle
     ├── profile.json
     ├── WINS.md
@@ -287,8 +266,8 @@ the live database with Git, Dropbox, a network share, or a file-copy tool.
 ## Trust and privacy
 
 Synomem is audit-friendly, not tamper-proof. The local filesystem owner ultimately controls the
-database and configuration. Actor binding protects ordinary MCP use but does not cryptographically
-prove who launched a process.
+database and configuration. A profile protects ordinary MCP use but does not cryptographically
+prove who launched a process; hosted access is authorized by the API on every request.
 
 Do not store credentials, cookies, tokens, authentication headers, environment values, private keys,
 raw sensitive tool output, or unnecessary private content. `public` means eligible for public export;

package/dist/backend.d.ts

@@ -1,9 +1,21 @@
 import { SynomemClient } from './client.js';
-import { RemoteSynomemService } from './remote.js';
-import type { SynomemServiceFactory } from './service.js';
-import type { SynomemBackendConfig, SynomemClientOptions, SynomemConfig } from './types.js';
+import type { ActorIdentity, SynomemConfig } from './types.js';
+/**
+ * The person at the keyboard of a local store. The filesystem owner is the
+ * ultimate authority over a local store, so administrative commands (creating
+ * agents, rebuilding, exporting) run as this actor rather than as an agent.
+ */
+export declare const LOCAL_OPERATOR: ActorIdentity;
+/** A store's config, or undefined when the home has no store yet. */
 export declare function readSynomemConfig(explicitHome?: string, env?: NodeJS.ProcessEnv): SynomemConfig | undefined;
-export declare function writeSynomemBackend(backend: SynomemBackendConfig, explicitHome?: string): SynomemConfig;
-export declare function createConfiguredService(options?: SynomemClientOptions, env?: NodeJS.ProcessEnv): SynomemClient | RemoteSynomemService;
-export declare const configuredServiceFactory: SynomemServiceFactory;
+/**
+ * Creates the store's config (with a fresh persistent workspace identity) if it
+ * does not exist, and returns it. Idempotent: an existing store keeps its
+ * identity, which local context ids are derived from.
+ */
+export declare function ensureLocalStore(explicitHome?: string): SynomemConfig;
+/** The store's persistent workspace identity, creating the store if needed. */
+export declare function localStoreWorkspaceId(explicitHome?: string): string;
+/** Opens (and initializes) a local store as one actor. The caller closes it. */
+export declare function openLocalService(home: string | undefined, actor: ActorIdentity): Promise<SynomemClient>;
 //# sourceMappingURL=backend.d.ts.map

package/dist/backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../src/backend.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAS5C,OAAO,EAAiC,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAGlF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,KAAK,EAEV,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACd,MAAM,YAAY,CAAC;AAkBpB,wBAAgB,iBAAiB,CAC/B,YAAY,CAAC,EAAE,MAAM,EACrB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,aAAa,GAAG,SAAS,CAQ3B;AAED,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,oBAAoB,EAC7B,YAAY,CAAC,EAAE,MAAM,GACpB,aAAa,CAef;AAED,wBAAgB,uBAAuB,CACrC,OAAO,GAAE,oBAAyB,EAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,wCAsBrC;AAED,eAAO,MAAM,wBAAwB,EAAE,qBACL,CAAC"}
+{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../src/backend.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAS5C,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE/D;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,aAI5B,CAAC;AAOF,qEAAqE;AACrE,wBAAgB,iBAAiB,CAC/B,YAAY,CAAC,EAAE,MAAM,EACrB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,aAAa,GAAG,SAAS,CAe3B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,aAAa,CAiBrE;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,gFAAgF;AAChF,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,aAAa,CAAC,CAKxB"}

package/dist/backend.js

@@ -1,3 +1,15 @@
+/**
+ * Local store helpers.
+ *
+ * A local store is one SQLite home: `<home>/config.json` (its policy and its
+ * persistent workspace identity) plus the database beside it. Which store and
+ * which actor a command uses is decided by a profile (`profiles.ts`); this
+ * module only opens and initializes stores.
+ *
+ * Remote access no longer passes through here at all. There is no
+ * "configured backend" in a store's config any more: a store is always local,
+ * and hosted access is a connection plus a context in `profiles.json`.
+ */
 import { chmodSync, existsSync, lstatSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { ulid } from 'ulid';
@@ -5,63 +17,65 @@ import { SynomemClient } from './client.js';
 import { defaultConfig, mergeConfig, resolveHome } from './config.js';
 import { SynomemError } from './errors.js';
 import { assertNoSymlinkEscape, atomicWriteFile, ensureDirectory, readJsonFile, } from './fs-utils.js';
-import { environmentCredentialProvider, RemoteSynomemService } from './remote.js';
-import { credentialReference, OsCredentialStore } from './credentials.js';
-import { StoredCredentialProvider } from './oauth.js';
-function configLocation(explicitHome) {
-    /*
-     * The home IS the storage directory. It used to be `<home>/synomem`, which
-     * made sense while the default home was `~/.agents` and Synomem was one
-     * tenant inside it. Now that the home is `~/.synomem`, that nesting produces
-     * `~/.synomem/synomem` — a path the layout explicitly rules out, and one that
-     * makes every documented path wrong by a level.
-     */
+/**
+ * The person at the keyboard of a local store. The filesystem owner is the
+ * ultimate authority over a local store, so administrative commands (creating
+ * agents, rebuilding, exporting) run as this actor rather than as an agent.
+ */
+export const LOCAL_OPERATOR = {
+    kind: 'human',
+    id: 'local-cli',
+    displayName: 'Local operator',
+};
+function storeLocation(explicitHome) {
     const home = resolveHome(explicitHome);
-    return { home, storageDirectory: home, configPath: join(home, 'config.json') };
+    return { home, configPath: join(home, 'config.json') };
 }
+/** A store's config, or undefined when the home has no store yet. */
 export function readSynomemConfig(explicitHome, env = process.env) {
-    const { home, storageDirectory, configPath } = configLocation(explicitHome);
+    const { home, configPath } = storeLocation(explicitHome);
     if (!existsSync(configPath))
         return undefined;
     if (!existsSync(home) || lstatSync(home).isSymbolicLink()) {
         throw new SynomemError('UNSAFE_PATH', 'The configured Synomem home is unsafe.');
     }
-    assertNoSymlinkEscape(home, storageDirectory);
-    return mergeConfig(readJsonFile(configPath), undefined, env);
+    assertNoSymlinkEscape(home, home);
+    const config = mergeConfig(readJsonFile(configPath), undefined, env);
+    if (config.backend.kind !== 'local') {
+        throw new SynomemError('CONFIG_INVALID', `${configPath} selects a remote backend, which is no longer supported. Hosted access is a connection now: run \`synomem connection login\` and \`synomem profile create\`, or \`synomem setup --backend local\` for a local store.`);
+    }
+    return config;
 }
-export function writeSynomemBackend(backend, explicitHome) {
-    const { home, storageDirectory, configPath } = configLocation(explicitHome);
+/**
+ * Creates the store's config (with a fresh persistent workspace identity) if it
+ * does not exist, and returns it. Idempotent: an existing store keeps its
+ * identity, which local context ids are derived from.
+ */
+export function ensureLocalStore(explicitHome) {
+    const { home, configPath } = storeLocation(explicitHome);
     if (!existsSync(home))
         mkdirSync(home, { recursive: true, mode: 0o700 });
     if (lstatSync(home).isSymbolicLink()) {
         throw new SynomemError('UNSAFE_PATH', 'The configured Synomem home cannot be a symbolic link.');
     }
-    ensureDirectory(storageDirectory);
-    assertNoSymlinkEscape(home, storageDirectory);
-    chmodSync(storageDirectory, 0o700);
-    const existing = existsSync(configPath)
-        ? mergeConfig(readJsonFile(configPath), undefined, {})
-        : { ...defaultConfig, workspaceId: ulid() };
-    const config = mergeConfig({ ...existing, backend }, undefined, {});
+    ensureDirectory(home);
+    chmodSync(home, 0o700);
+    const existing = readSynomemConfig(explicitHome, {});
+    if (existing)
+        return existing;
+    const config = mergeConfig({ ...defaultConfig, backend: { kind: 'local' }, workspaceId: ulid() }, undefined, {});
     atomicWriteFile(configPath, `${JSON.stringify(config, null, 2)}\n`);
     return config;
 }
-export function createConfiguredService(options = {}, env = process.env) {
-    const persisted = readSynomemConfig(options.home, env);
-    const backend = options.config?.backend ?? persisted?.backend ?? defaultConfig.backend;
-    if (backend.kind === 'local')
-        return new SynomemClient(options);
-    const expectedActor = options.actor ?? { kind: 'system', id: 'workspace' };
-    return new RemoteSynomemService({
-        baseUrl: backend.baseUrl,
-        workspaceId: backend.workspaceId,
-        expectedActor,
-        credentialProvider: env.SYNOMEM_ACCESS_TOKEN
-            ? environmentCredentialProvider(env)
-            : new StoredCredentialProvider(credentialReference(backend.baseUrl, backend.workspaceId, expectedActor), new OsCredentialStore(), env, fetch, resolveHome(options.home)),
-        ...(options.signal ? { signal: options.signal } : {}),
-        ...(options.assertActor !== undefined ? { assertActor: options.assertActor } : {}),
-    });
+/** The store's persistent workspace identity, creating the store if needed. */
+export function localStoreWorkspaceId(explicitHome) {
+    return ensureLocalStore(explicitHome).workspaceId;
+}
+/** Opens (and initializes) a local store as one actor. The caller closes it. */
+export async function openLocalService(home, actor) {
+    ensureLocalStore(home);
+    const client = new SynomemClient({ ...(home ? { home } : {}), actor });
+    await client.init();
+    return client;
 }
-export const configuredServiceFactory = (options) => createConfiguredService(options);
 //# sourceMappingURL=backend.js.map

package/dist/backend.js.map

@@ -1 +1 @@
-{"version":3,"file":"backend.js","sourceRoot":"","sources":["../src/backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,6BAA6B,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAStD,SAAS,cAAc,CAAC,YAAqB;IAK3C;;;;;;OAMG;IACH,MAAM,IAAI,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;IACvC,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,YAAqB,EACrB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;IAC5E,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;QAC1D,MAAM,IAAI,YAAY,CAAC,aAAa,EAAE,wCAAwC,CAAC,CAAC;IAClF,CAAC;IACD,qBAAqB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC9C,OAAO,WAAW,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,OAA6B,EAC7B,YAAqB;IAErB,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;IAC5E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,YAAY,CAAC,aAAa,EAAE,wDAAwD,CAAC,CAAC;IAClG,CAAC;IACD,eAAe,CAAC,gBAAgB,CAAC,CAAC;IAClC,qBAAqB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC9C,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC;QACrC,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC;QACtD,CAAC,CAAC,EAAE,GAAG,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IACpE,eAAe,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,UAAgC,EAAE,EAClC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,SAAS,EAAE,OAAO,IAAI,aAAa,CAAC,OAAO,CAAC;IACvF,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,aAAa,GAAkB,OAAO,CAAC,KAAK,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC;IAC1F,OAAO,IAAI,oBAAoB,CAAC;QAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,aAAa;QACb,kBAAkB,EAAE,GAAG,CAAC,oBAAoB;YAC1C,CAAC,CAAC,6BAA6B,CAAC,GAAG,CAAC;YACpC,CAAC,CAAC,IAAI,wBAAwB,CAC1B,mBAAmB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,EACxE,IAAI,iBAAiB,EAAE,EACvB,GAAG,EACH,KAAK,EACL,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAC1B;QACL,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAA0B,CAAC,OAAO,EAAE,EAAE,CACzE,uBAAuB,CAAC,OAAO,CAAC,CAAC"}
+{"version":3,"file":"backend.js","sourceRoot":"","sources":["../src/backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,YAAY,GACb,MAAM,eAAe,CAAC;AAGvB;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAkB;IAC3C,IAAI,EAAE,OAAO;IACb,EAAE,EAAE,WAAW;IACf,WAAW,EAAE,gBAAgB;CAC9B,CAAC;AAEF,SAAS,aAAa,CAAC,YAAqB;IAC1C,MAAM,IAAI,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;IACvC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,iBAAiB,CAC/B,YAAqB,EACrB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;QAC1D,MAAM,IAAI,YAAY,CAAC,aAAa,EAAE,wCAAwC,CAAC,CAAC;IAClF,CAAC;IACD,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACpC,MAAM,IAAI,YAAY,CACpB,gBAAgB,EAChB,GAAG,UAAU,sNAAsN,CACpO,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAqB;IACpD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,YAAY,CAAC,aAAa,EAAE,wDAAwD,CAAC,CAAC;IAClG,CAAC;IACD,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACrD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,MAAM,GAAG,WAAW,CACxB,EAAE,GAAG,aAAa,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EACrE,SAAS,EACT,EAAE,CACH,CAAC;IACF,eAAe,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,qBAAqB,CAAC,YAAqB;IACzD,OAAO,gBAAgB,CAAC,YAAY,CAAC,CAAC,WAAW,CAAC;AACpD,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAwB,EACxB,KAAoB;IAEpB,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvB,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACpB,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/cli.d.ts

@@ -1,53 +1,40 @@
 #!/usr/bin/env node
 import { Command } from 'commander';
-import { type DiscoveredWorkspace, type WorkspaceMembership } from './discover.js';
-import { type PromptIo } from './prompt.js';
-import { type CredentialStore } from './credentials.js';
-import { type OAuthLoginOptions } from './oauth.js';
+import { type CredentialStores, type StoredOAuthCredential } from './credentials.js';
 import { type ImportBundle, type ImportPreview, type ImportResult } from './import.js';
-import type { ActorIdentity } from './types.js';
-import type { SynomemServiceFactory } from './service.js';
+import { type OAuthLoginOptions } from './oauth.js';
+import { ProfileStore } from './profiles.js';
+import { type PromptIo } from './prompt.js';
+import { type ContextResolver } from './resolvers.js';
+import type { createLocalResolver, createRemoteResolver } from './resolvers.js';
 export interface CliIo {
     stdout: (text: string) => void;
     stderr: (text: string) => void;
 }
 export interface CliDependencies {
-    /** Injected so the wizard can be driven by a test without a terminal. */
+    /** Injected so interactive steps can be driven by a test without a terminal. */
     promptIo?: PromptIo;
-    credentialStore?: CredentialStore;
-    oauthLogin?: (options: OAuthLoginOptions) => Promise<void>;
     env?: NodeJS.ProcessEnv;
-    verifyRemoteCredential?: (options: {
-        baseUrl: string;
-        workspaceId: string;
-        actor: ActorIdentity;
-        reference: string;
-        credentialStore: CredentialStore;
+    cwd?: string;
+    platform?: NodeJS.Platform;
+    fetch?: typeof fetch;
+    credentialStores?: (home: string) => CredentialStores;
+    profileStore?: (home: string) => ProfileStore;
+    oauthLogin?: (options: OAuthLoginOptions) => Promise<StoredOAuthCredential>;
+    createRemoteResolver?: typeof createRemoteResolver;
+    createLocalResolver?: typeof createLocalResolver;
+    startMcpServer?: (options: {
+        resolver: ContextResolver;
     }) => Promise<void>;
-    discoverAccessKeyWorkspaces?: (options: {
-        baseUrl: string;
-        accessToken: string;
-    }) => Promise<{
-        organizationId: string;
-        workspaces: DiscoveredWorkspace[];
-    }>;
-    /** Injected so `remote workspace list` can be tested without a network. */
-    discoverIdentity?: (options: {
-        baseUrl: string;
-        accessToken: string;
-    }) => Promise<{
-        workspaceId: string;
-        workspaces: WorkspaceMembership[];
-    }>;
     createImportBundle?: (home: string) => Promise<ImportBundle>;
     remoteImport?: (options: {
         baseUrl: string;
         workspaceId: string;
-        actor: ActorIdentity;
+        contextId: string;
         bundle: ImportBundle;
         planId?: string;
     }) => Promise<ImportPreview | ImportResult>;
 }
-export declare function createCli(io?: CliIo, serviceFactory?: SynomemServiceFactory, dependencies?: CliDependencies, argv?: string[]): Command;
-export declare function runCli(argv?: string[], io?: CliIo, serviceFactory?: SynomemServiceFactory, dependencies?: CliDependencies): Promise<number>;
+export declare function createCli(io?: CliIo, dependencies?: CliDependencies): Command;
+export declare function runCli(argv?: string[], io?: CliIo, dependencies?: CliDependencies): Promise<number>;
 //# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAKA,OAAO,EAAE,OAAO,EAA0B,MAAM,WAAW,CAAC;AAkB5D,OAAO,EAGL,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACzB,MAAM,eAAe,CAAC;AAOvB,OAAO,EAA2B,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAA0C,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAIhG,OAAO,EAA4C,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE9F,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,YAAY,EAClB,MAAM,aAAa,CAAC;AASrB,OAAO,KAAK,EACV,aAAa,EASd,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAkB,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE1E,MAAM,WAAW,KAAK;IACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE;QACjC,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,aAAa,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,eAAe,CAAC;KAClC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAKpB,2BAA2B,CAAC,EAAE,CAAC,OAAO,EAAE;QACtC,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;KACrB,KAAK,OAAO,CAAC;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,mBAAmB,EAAE,CAAA;KAAE,CAAC,CAAC;IAC7E,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;KACrB,KAAK,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,mBAAmB,EAAE,CAAA;KAAE,CAAC,CAAC;IAC1E,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7D,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,aAAa,CAAC;QACrB,MAAM,EAAE,YAAY,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,KAAK,OAAO,CAAC,aAAa,GAAG,YAAY,CAAC,CAAC;CAC7C;AAuRD,wBAAgB,SAAS,CACvB,EAAE,GAAE,KAAiB,EACrB,cAAc,GAAE,qBAAgD,EAChE,YAAY,GAAE,eAAoB,EAClC,IAAI,GAAE,MAAM,EAAiB,GAC5B,OAAO,CA81FT;AAED,wBAAsB,MAAM,CAC1B,IAAI,WAAe,EACnB,EAAE,GAAE,KAAiB,EACrB,cAAc,GAAE,qBAAgD,EAChE,YAAY,GAAE,eAAoB,GACjC,OAAO,CAAC,MAAM,CAAC,CAqBjB"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAKA,OAAO,EAAE,OAAO,EAA0B,MAAM,WAAW,CAAC;AAU5D,OAAO,EAGL,KAAK,gBAAgB,EAErB,KAAK,qBAAqB,EAC3B,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,YAAY,EAClB,MAAM,aAAa,CAAC;AAErB,OAAO,EAA6B,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/E,OAAO,EASL,YAAY,EAQb,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAgC,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAkB,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,KAAK,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AA0BhF,MAAM,WAAW,KAAK;IACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,gFAAgF;IAChF,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,gBAAgB,CAAC;IACtD,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,YAAY,CAAC;IAC9C,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC5E,oBAAoB,CAAC,EAAE,OAAO,oBAAoB,CAAC;IACnD,mBAAmB,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACjD,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,QAAQ,EAAE,eAAe,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7D,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,YAAY,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,KAAK,OAAO,CAAC,aAAa,GAAG,YAAY,CAAC,CAAC;CAC7C;AAkOD,wBAAgB,SAAS,CAAC,EAAE,GAAE,KAAiB,EAAE,YAAY,GAAE,eAAoB,GAAG,OAAO,CAyxF5F;AA0BD,wBAAsB,MAAM,CAC1B,IAAI,WAAe,EACnB,EAAE,GAAE,KAAiB,EACrB,YAAY,GAAE,eAAoB,GACjC,OAAO,CAAC,MAAM,CAAC,CAgCjB"}