@certscore/mcp 0.2.12 → 0.2.16

package/dist/tools.js

@@ -4,7 +4,55 @@ export const MAX_EVIDENCE_PACKET_CHARS = 250_000;
 const EVIDENCE_STRING_CHARS = 4_000;
 const EVIDENCE_ARRAY_ITEMS = 40;
 const EVIDENCE_OBJECT_KEYS = 80;
-export function toToolResult(payload) {
+const MAX_TOOL_TEXT_CHARS = 8_000;
+const LEGAL_REVIEW_DISCLAIMER = "CertScore results are automated public-web observations for human and agentic review, not legal advice, certification, or a compliance determination.";
+const SCAN_PROVENANCE_GROUNDING = "retrievalMode describes how the current tool response obtained the scan; creationDecision describes whether the original scan request created or reused a scan only when that decision is retained. Never infer an unknown creationDecision from scan_id_lookup. For a reused or retrieved existing scan, use only persisted scanFrom and timestamps. Never infer its original scan region from the current request, the user's location, or a default execution region. If persisted region or timestamps are unavailable, report them as unavailable.";
+const INTERPRETATION_STATEMENT = "The CertScore score covers observable public-web scan signals only. Do not infer technologies that are not listed in the returned evidence or any legal compliance status.";
+const SCAN_BUNDLE_RESPONSE_CONTRACT = `Response contract: Report only observed CertScore evidence and CertScore classifications. criticality, priority, and confidence are CertScore metadata; regulatory review lenses are non-determinative CertScore review context—not legal severity, legal exposure, or a compliance determination. Absence of captured consent-action evidence does not establish what happens after Accept, Reject, or Decline. A confirmed post-refusal observation with termination.kind=evidence_satisfied means the observer intentionally stopped after retaining qualifying evidence; do not treat that termination as uncertainty about the returned observation. Keep any separately returned coverage limitation scoped to what was not measured. Do not extrapolate an observed embed, vendor, or request into unobserved cookies, fingerprinting, tracking, or processing, and do not infer violations or compliance beyond what CertScore observed. ${SCAN_PROVENANCE_GROUNDING}`;
+const SCAN_BUNDLE_INTERPRETATION_STATEMENT = "Report only observed CertScore evidence and persisted CertScore classifications. Without corresponding captured post-action evidence, do not infer what Accept, Reject, Decline, or another consent action would do; say the scan does not establish what happens after that action. When postRefusalObservation is confirmed and termination.kind is evidence_satisfied, state the returned post-refusal observation directly and explain that observation stopped intentionally after qualifying evidence was retained. Do not characterize that termination as uncertainty about the observation; mention unmeasured longer-term persistence only when relevant. Do not speculate that an observed embed, vendor, or request may cause additional cookies, fingerprinting, tracking, or processing unless CertScore observed that behavior. Treat returned priority or severity as a CertScore classification, not regulatory criticality or legal exposure; prefer ‘observed privacy risk signal’ or ‘CertScore finding’. Do not infer unobserved technologies, legal compliance, or a legal violation from scores or findings.";
+const COMPACT_SCAN_BUNDLE_INTERPRETATION_STATEMENT = "Use only returned CertScore observations and classifications. Do not infer unobserved technologies, post-consent behavior, legal compliance, or violations. Treat priority and severity as CertScore metadata.";
+const OBSERVATION_ONLY_DISCLAIMER = `${LEGAL_REVIEW_DISCLAIMER} No-go, not-observed, and limited-coverage results are not proof of compliance.`;
+const COMPACT_OBSERVATION_ONLY_DISCLAIMER = "Automated public-web observation, not legal advice or a compliance determination; missing or limited evidence is not proof of compliance.";
+function interpretationGuidance(statement = INTERPRETATION_STATEMENT) {
+    return {
+        scoreLabel: "CertScore score",
+        observableSignalsOnly: true,
+        doNotInferUnobservedTechnologies: true,
+        doNotInferLegalComplianceStatus: true,
+        statement
+    };
+}
+function toolResultSummary(payload) {
+    if (payload === null || typeof payload !== "object" || Array.isArray(payload)) {
+        return "CertScore tool call completed. Read structuredContent for the result.";
+    }
+    const record = payload;
+    const type = typeof record.type === "string" ? record.type : "result";
+    const status = typeof record.status === "string" ? `; status=${record.status}` : "";
+    const scanId = typeof record.scanId === "string" ? `; scanId=${record.scanId}` : "";
+    const score = typeof record.score === "number" ? `; CertScore score=${record.score}` : "";
+    const recordLinks = record.links && typeof record.links === "object" && !Array.isArray(record.links)
+        ? record.links
+        : null;
+    const reportUrl = typeof record.reportUrl === "string" && record.reportUrl.trim()
+        ? record.reportUrl.trim()
+        : typeof recordLinks?.report === "string" && recordLinks.report.trim()
+            ? recordLinks.report.trim()
+            : null;
+    const report = reportUrl ? `; full report=${reportUrl}` : "";
+    const provenanceRecord = record.provenance && typeof record.provenance === "object" && !Array.isArray(record.provenance)
+        ? record.provenance
+        : null;
+    const retrieval = typeof provenanceRecord?.retrievalMode === "string" ? `; retrieval=${provenanceRecord.retrievalMode}` : "";
+    const creation = typeof provenanceRecord?.creationDecision === "string" ? `; creation=${provenanceRecord.creationDecision}` : "";
+    const provenance = retrieval || creation
+        ? `${retrieval}${creation}`
+        : typeof provenanceRecord?.mode === "string"
+            ? `; provenance=${provenanceRecord.mode}`
+            : "";
+    return `CertScore ${type}${status}${scanId}${score}${provenance}${report}. Full result is in structuredContent.`;
+}
+export function toToolResult(payload, text) {
     const structuredContent = payload !== null && typeof payload === "object" && !Array.isArray(payload)
         ? payload
         : { value: payload };
@@ -13,37 +61,258 @@ export function toToolResult(payload) {
         content: [
             {
                 type: "text",
-                text: JSON.stringify(payload)
+                text: text ?? toolResultSummary(payload)
             }
         ]
     };
 }
 export function toToolError(error) {
-    const payload = error instanceof CertScoreError
-        ? {
-            error: {
+    const responseRecord = error instanceof CertScoreError && error.responseBody && typeof error.responseBody === "object" && !Array.isArray(error.responseBody)
+        ? error.responseBody
+        : null;
+    const terminalError = responseRecord?.error && typeof responseRecord.error === "object" && !Array.isArray(responseRecord.error)
+        ? responseRecord.error
+        : null;
+    const status = error instanceof CertScoreError ? error.status : undefined;
+    const retryable = typeof terminalError?.retryable === "boolean"
+        ? terminalError.retryable
+        : status === 429 || (typeof status === "number" && status >= 500);
+    const retryAfterSeconds = typeof terminalError?.retryAfterSeconds === "number"
+        ? terminalError.retryAfterSeconds
+        : error instanceof CertScoreError && "retryAfterSeconds" in error && typeof error.retryAfterSeconds === "number"
+            ? error.retryAfterSeconds
+            : retryable
+                ? 30
+                : null;
+    const code = error instanceof CertScoreError ? error.code : "internal_error";
+    const message = error instanceof Error ? error.message : "Unknown CertScore MCP error.";
+    const creationRateLimit = terminalError?.creationRateLimit && typeof terminalError.creationRateLimit === "object" && !Array.isArray(terminalError.creationRateLimit)
+        ? terminalError.creationRateLimit
+        : null;
+    const recommendedNextAction = typeof terminalError?.recommendedNextAction === "string"
+        ? terminalError.recommendedNextAction
+        : creationRateLimit
+            ? `No scan was created. Wait ${retryAfterSeconds ?? 30} seconds, then retry the same request. If the limit continues after that delay, contact support@certscore.ai.`
+            : retryable
+                ? `Wait ${retryAfterSeconds ?? 30} seconds, then retry the same request. Stop and contact support@certscore.ai if the error repeats.`
+                : "Correct the request using the error details, then retry only if the requested operation is still appropriate.";
+    const payload = {
+        error: {
+            code,
+            message,
+            retryable,
+            retryAfterSeconds,
+            recommendedNextAction,
+            ...(creationRateLimit
+                ? { creationRateLimit }
+                : {}),
+            ...(error instanceof CertScoreError ? {
                 name: error.name,
-                message: error.message,
                 status: error.status,
-                code: error.code,
-                retryAfterSeconds: "retryAfterSeconds" in error ? error.retryAfterSeconds : undefined,
                 responseBody: truncateErrorResponseBody(error.responseBody)
-            }
+            } : {})
         }
-        : {
-            error: {
-                name: error instanceof Error ? error.name : "Error",
-                message: error instanceof Error ? error.message : "Unknown CertScore MCP error."
-            }
-        };
-    // MCP validates structuredContent against the tool's success output schema,
-    // including for isError results. Keep errors in text content so a bounded
-    // error envelope cannot be rejected as an invalid success resource.
+    };
     return {
         content: [{ type: "text", text: JSON.stringify(payload) }],
         isError: true
     };
 }
+export function toInvalidArgumentsToolError(errorMessage) {
+    const tool = errorMessage.match(/tool ([a-z_]+)/i)?.[1] ?? null;
+    const field = errorMessage.match(/\bat ([a-zA-Z0-9_.-]+)/)?.[1]
+        ?? (errorMessage.includes("url") ? "url" : errorMessage.includes("scanId") ? "scanId" : null);
+    const missing = /required|expected string, received undefined/i.test(errorMessage);
+    const message = field
+        ? missing
+            ? `The ${field} field is required.`
+            : `The ${field} field is invalid.`
+        : `The arguments for ${tool ?? "this tool"} are invalid.`;
+    const recommendedNextAction = field === "url"
+        ? "Provide a public URL or domain."
+        : field === "scanId"
+            ? "Provide the stable scanId returned by certscore_scan_site."
+            : "Correct the named fields using the tool input schema, then retry.";
+    const error = {
+        code: "invalid_arguments",
+        message,
+        ...(field ? { field } : {}),
+        retryable: false,
+        retryAfterSeconds: null,
+        recommendedNextAction,
+        mcpCode: -32602
+    };
+    const payload = tool === "certscore_scan_site"
+        ? {
+            type: "certscore_tool_error",
+            status: "invalid_arguments",
+            error,
+            scoreLabel: "CertScore score",
+            provenance: scanProvenance({}, "unknown"),
+            interpretationGuidance: interpretationGuidance(),
+            recommendedNextTool: null,
+            recommendedNextAction,
+            observationOnlyDisclaimer: OBSERVATION_ONLY_DISCLAIMER
+        }
+        : { error };
+    return {
+        content: [{ type: "text", text: JSON.stringify(payload) }],
+        ...(tool === "certscore_scan_site" ? { structuredContent: payload } : {}),
+        isError: true
+    };
+}
+export function toInvalidScanIdToolError() {
+    const error = {
+        code: "invalid_scan_id",
+        field: "scanId",
+        message: "The scanId must be the canonical UUID returned by certscore_scan_site.",
+        retryable: false,
+        retryAfterSeconds: null,
+        recommendedNextAction: "Use the unchanged scanId returned by certscore_scan_site. Do not use placeholders, report URLs, domains, or job IDs.",
+        mcpCode: -32602
+    };
+    return {
+        content: [{ type: "text", text: JSON.stringify({ error }) }],
+        isError: true
+    };
+}
+function terminalErrorForResult(value) {
+    const existing = value.error && typeof value.error === "object" && !Array.isArray(value.error)
+        ? value.error
+        : null;
+    if (existing) {
+        const retryable = existing.retryable === true;
+        return {
+            code: typeof existing.code === "string" ? existing.code : String(value.status ?? "scan_failed"),
+            message: typeof existing.message === "string" ? existing.message : "The scan did not produce a canonical result.",
+            retryable,
+            retryAfterSeconds: typeof existing.retryAfterSeconds === "number" ? existing.retryAfterSeconds : retryable ? 30 : null,
+            recommendedNextAction: typeof existing.recommendedNextAction === "string"
+                ? existing.recommendedNextAction
+                : retryable
+                    ? "Wait for the recommended delay, then retry certscore_scan_site with freshness=refresh."
+                    : "Stop and review the scan limitations before deciding whether to change the URL."
+        };
+    }
+    if (value.status === "completed_limited" && value.noGo) {
+        const retryable = value.noGo.retryLikelyToHelp === true;
+        return {
+            code: typeof value.noGo.reasonCode === "string" ? value.noGo.reasonCode : "completed_limited",
+            message: typeof value.noGo.explanation === "string" ? value.noGo.explanation : "The scan completed with a no-go limitation.",
+            retryable,
+            retryAfterSeconds: retryable ? 30 : null,
+            recommendedNextAction: typeof value.noGo.recommendedNextAction === "string"
+                ? value.noGo.recommendedNextAction
+                : "Review the retained limitation and change the URL or site state before retrying."
+        };
+    }
+    const fallback = {
+        failed: {
+            code: "scanner_runtime_failure",
+            message: "The scan ended before a canonical result could be produced.",
+            retryable: true,
+            retryAfterSeconds: 30,
+            recommendedNextAction: "Wait 30 seconds, then retry certscore_scan_site with freshness=refresh. Stop if the failure repeats."
+        },
+        expired: {
+            code: "scan_expired",
+            message: "The scan expired before a canonical result was available.",
+            retryable: true,
+            retryAfterSeconds: 30,
+            recommendedNextAction: "Wait 30 seconds, then retry certscore_scan_site with freshness=refresh."
+        },
+        rate_limited: {
+            code: "rate_limited",
+            message: "The scan is rate limited.",
+            retryable: true,
+            retryAfterSeconds: typeof value.retryAfterSeconds === "number" ? value.retryAfterSeconds : 30,
+            recommendedNextAction: "Wait for the recommended delay, then retry the same certscore_scan_site request."
+        }
+    };
+    return fallback[String(value.status)] ?? null;
+}
+function scanProvenance(value, fallbackMode) {
+    const executionMode = value.executionMode === "new_scan" || value.executionMode === "reused_scan"
+        ? value.executionMode
+        : null;
+    const reused = typeof value.reused === "boolean" ? value.reused : executionMode === "reused_scan" ? true : executionMode === "new_scan" ? false : null;
+    const mode = executionMode === "new_scan"
+        ? "new_scan_started"
+        : executionMode === "reused_scan" || reused === true
+            ? "existing_completed_scan_reused"
+            : fallbackMode;
+    const retrievalMode = fallbackMode === "existing_scan_retrieved"
+        ? "scan_id_lookup"
+        : executionMode !== null || reused !== null
+            ? "creation_response"
+            : "unknown";
+    const creationDecision = executionMode === "new_scan" || reused === false
+        ? "new_scan"
+        : executionMode === "reused_scan" || reused === true
+            ? "reused_scan"
+            : "unknown";
+    const retainedAgeSeconds = typeof value.reusedScanAgeSeconds === "number" && Number.isFinite(value.reusedScanAgeSeconds) && value.reusedScanAgeSeconds >= 0
+        ? Math.floor(value.reusedScanAgeSeconds)
+        : null;
+    const completedAtMs = typeof value.completedAt === "string" ? Date.parse(value.completedAt) : Number.NaN;
+    const completedAgeSeconds = Number.isFinite(completedAtMs)
+        ? Math.max(0, Math.floor((Date.now() - completedAtMs) / 1_000))
+        : null;
+    const scanAgeSeconds = retrievalMode === "creation_response"
+        ? retainedAgeSeconds ?? completedAgeSeconds
+        : completedAgeSeconds;
+    return {
+        mode,
+        retrievalMode,
+        creationDecision,
+        scanAgeSeconds,
+        executionMode,
+        reused,
+        freshnessDecision: typeof value.freshnessDecision === "string" ? value.freshnessDecision : null
+    };
+}
+export function withMcpAgentGuidance(value, fallbackProvenanceMode = "unknown") {
+    const status = String(value.status ?? "");
+    const active = status === "queued" || status === "running" || status === "finalizing";
+    const usable = status === "completed" || status === "completed_limited";
+    const error = terminalErrorForResult(value);
+    const stableScanId = typeof value.scanId === "string" && value.scanId.trim()
+        ? value.scanId.trim()
+        : typeof value.scan_id === "string" && value.scan_id.trim()
+            ? value.scan_id.trim()
+            : null;
+    const reportUrl = usable
+        ? typeof value.reportUrl === "string" && value.reportUrl.trim()
+            ? value.reportUrl.trim()
+            : typeof value.links?.report === "string" && value.links.report.trim()
+                ? value.links.report.trim()
+                : stableScanId
+                    ? `https://certscore.ai/scan/${encodeURIComponent(stableScanId)}`
+                    : null
+        : null;
+    return {
+        ...value,
+        error,
+        reportUrl,
+        scoreLabel: "CertScore score",
+        provenance: scanProvenance(value, fallbackProvenanceMode),
+        interpretationGuidance: interpretationGuidance(),
+        recommendedNextTool: active ? "certscore_get_scan_status" : usable ? "certscore_get_scan_bundle" : null,
+        recommendedNextAction: error?.recommendedNextAction ?? value.recommendedNextAction ?? (active
+            ? `Poll certscore_get_scan_status with scanId ${value.scanId ?? value.jobId} after the recommended delay.`
+            : usable
+                ? `Call certscore_get_scan_bundle with scanId ${value.scanId ?? value.jobId} for the canonical findings and limitations.`
+                : "Review the result and retained limitations."),
+        observationOnlyDisclaimer: OBSERVATION_ONLY_DISCLAIMER
+    };
+}
+export function withMcpScanProvenanceGuidance(value, fallbackProvenanceMode) {
+    const guided = withMcpAgentGuidance(value, fallbackProvenanceMode);
+    return {
+        ...guided,
+        interpretationGuidance: interpretationGuidance(`${INTERPRETATION_STATEMENT} ${SCAN_PROVENANCE_GROUNDING}`)
+    };
+}
 export function boundEvidencePacket(payload, maxSerializedChars = MAX_EVIDENCE_PACKET_CHARS) {
     const originalSerializedChars = measureSerializedChars(payload);
     if (originalSerializedChars <= maxSerializedChars) {
@@ -87,6 +356,225 @@ export function boundEvidencePacket(payload, maxSerializedChars = MAX_EVIDENCE_P
 function measureSerializedChars(value) {
     return JSON.stringify(value)?.length ?? 0;
 }
+function measureSerializedBytes(value) {
+    return new TextEncoder().encode(JSON.stringify(value)).byteLength;
+}
+function updateBundleActualBytes(bundle) {
+    bundle.mcpMetadata.actualBytes = 0;
+    for (let attempt = 0; attempt < 3; attempt += 1) {
+        const measured = measureSerializedBytes(bundle);
+        if (bundle.mcpMetadata.actualBytes === measured) {
+            break;
+        }
+        bundle.mcpMetadata.actualBytes = measured;
+    }
+    return bundle.mcpMetadata.actualBytes;
+}
+function boundedText(value, maxChars) {
+    if (typeof value !== "string") {
+        return value;
+    }
+    if (value.length <= maxChars) {
+        return value;
+    }
+    const marker = "…[truncated]";
+    const contentLimit = Math.max(1, maxChars - marker.length);
+    const candidate = value.slice(0, contentLimit);
+    const boundary = candidate.search(/\s+\S*$/);
+    const bounded = boundary >= Math.floor(contentLimit * 0.6)
+        ? candidate.slice(0, boundary)
+        : candidate;
+    return `${bounded.trimEnd()}${marker}`;
+}
+function compactFindingLink(finding) {
+    const self = typeof finding.links?.self === "string" && finding.links.self.trim()
+        ? finding.links.self.trim()
+        : typeof finding.evidence?.excerpt?.evidenceUrl === "string" && finding.evidence.excerpt.evidenceUrl.trim()
+            ? finding.evidence.excerpt.evidenceUrl.trim()
+            : null;
+    return self ? { self: self.slice(0, 2_048) } : undefined;
+}
+function withoutFindingDisclaimer(finding) {
+    const { disclaimer: _disclaimer, ...rest } = finding;
+    return rest;
+}
+function compactBundleFinding(finding, tier = "standard") {
+    const evidence = finding.evidence && typeof finding.evidence === "object" && !Array.isArray(finding.evidence)
+        ? finding.evidence
+        : {};
+    const core = tier === "core";
+    const links = compactFindingLink(finding);
+    if (core) {
+        const compactNextStep = typeof finding.nextStep === "string" && finding.nextStep.trim().length <= 64
+            ? finding.nextStep.trim()
+            : null;
+        return {
+            type: finding.type,
+            id: finding.id,
+            label: boundedText(finding.label, 140),
+            criticality: finding.criticality,
+            confidence: finding.confidence,
+            plainEnglish: boundedText(finding.plainEnglish, 180),
+            ...(compactNextStep ? { nextStep: compactNextStep } : {}),
+            evidenceUrl: links?.self ?? null
+        };
+    }
+    return {
+        type: finding.type,
+        id: finding.id,
+        scanId: finding.scanId,
+        label: boundedText(finding.label, 140),
+        criticality: finding.criticality,
+        confidence: finding.confidence,
+        plainEnglish: boundedText(finding.plainEnglish, 280),
+        ...(finding.resultDisposition ? { resultDisposition: finding.resultDisposition } : {}),
+        ...(finding.noGo ? { noGo: finding.noGo } : {}),
+        reviewLenses: Array.isArray(finding.reviewLenses) ? finding.reviewLenses.slice(0, 2) : [],
+        evidence: {
+            basis: evidence.basis,
+            summary: boundedText(evidence.summary, 220),
+            ...(evidence.phase !== undefined ? { phase: evidence.phase } : {}),
+            exampleCount: evidence.exampleCount,
+            examplesShown: evidence.examplesShown,
+            ...(evidence.hasTimingAnchor !== undefined ? { hasTimingAnchor: evidence.hasTimingAnchor } : {}),
+            ...(evidence.hasVendorAnchor !== undefined ? { hasVendorAnchor: evidence.hasVendorAnchor } : {}),
+            ...(evidence.hasConsentContext !== undefined ? { hasConsentContext: evidence.hasConsentContext } : {}),
+            ...(evidence.hasPolicyAnchor !== undefined ? { hasPolicyAnchor: evidence.hasPolicyAnchor } : {})
+        },
+        ...(finding.nextStep !== undefined ? { nextStep: boundedText(finding.nextStep, 180) } : {}),
+        ...(links ? { links } : {})
+    };
+}
+function deduplicatedFullReport(input) {
+    const report = input.report;
+    const residual = { ...report };
+    const deduplicatedSections = [];
+    const returnedFindings = new Map(input.findings.flatMap((finding) => typeof finding.id === "string" ? [[finding.id, finding]] : []));
+    for (const key of ["findings", "topFindings"]) {
+        const section = residual[key];
+        const sectionFindingIds = Array.isArray(section)
+            ? section.flatMap((finding) => finding && typeof finding === "object" && typeof finding.id === "string"
+                ? [finding.id]
+                : [])
+            : [];
+        const coveredByCanonicalProjection = sectionFindingIds.every((id) => {
+            const finding = returnedFindings.get(id);
+            return finding
+                && typeof finding.plainEnglish === "string"
+                && typeof finding.evidence?.summary === "string"
+                && compactFindingLink(finding) !== undefined;
+        });
+        if (Array.isArray(section) && sectionFindingIds.length === section.length && coveredByCanonicalProjection) {
+            delete residual[key];
+            deduplicatedSections.push(`fullReport.${key}`);
+        }
+    }
+    if ("transportSecurity" in residual && JSON.stringify(residual.transportSecurity) === JSON.stringify(input.transportSecurity)) {
+        delete residual.transportSecurity;
+        deduplicatedSections.push("fullReport.transportSecurity");
+    }
+    return { deduplicatedSections, residual };
+}
+function distinctSummaryFindings(findings) {
+    const labels = new Set();
+    return findings.filter((finding) => {
+        const key = typeof finding.label === "string" && finding.label.trim().length > 0
+            ? finding.label.trim().toLocaleLowerCase()
+            : typeof finding.id === "string"
+                ? finding.id
+                : JSON.stringify(finding);
+        if (labels.has(key))
+            return false;
+        labels.add(key);
+        return true;
+    });
+}
+const POST_REFUSAL_FINDING_IDS = new Set([
+    "post_refusal_non_essential_activity",
+    "pre_consent_storage_not_cleared",
+    "refusal_signal_contradicts_action",
+]);
+function postRefusalTruncationPriority(finding) {
+    const id = typeof finding.id === "string" ? finding.id : "";
+    if (POST_REFUSAL_FINDING_IDS.has(id))
+        return 0;
+    if (/^pre_consent_|preconsent/i.test(id))
+        return 2;
+    return 1;
+}
+function prioritizeFindingsForBoundedBundle(findings) {
+    return findings
+        .map((finding, index) => ({ finding, index }))
+        .sort((left, right) => postRefusalTruncationPriority(left.finding) - postRefusalTruncationPriority(right.finding) ||
+        left.index - right.index)
+        .map(({ finding }) => finding);
+}
+function compactPriorityEvidenceSummary(summary) {
+    const firstDigest = Array.isArray(summary.digests) ? summary.digests[0] : null;
+    const firstReference = summary.references && typeof summary.references === "object" && !Array.isArray(summary.references)
+        ? Object.entries(summary.references).find(([, value]) => typeof value === "string")
+        : null;
+    return {
+        digests: firstDigest ? [{
+                findingId: firstDigest.findingId,
+                basis: firstDigest.basis ?? null,
+                summary: boundedText(firstDigest.summary, 180) ?? null,
+                phase: firstDigest.phase ?? null,
+                evidenceUrl: firstDigest.evidenceUrl ?? firstReference?.[1] ?? null
+            }] : [],
+        evidenceAvailable: summary.evidenceAvailable === true,
+        evidenceSafetyNotes: [],
+        references: firstDigest ? {} : firstReference ? { [firstReference[0]]: firstReference[1] } : {}
+    };
+}
+function bundleEvidenceSummary(evidence, findings, links, includeDiagnostics) {
+    const digests = findings.slice(0, 3).map((finding) => {
+        const findingEvidence = finding.evidence && typeof finding.evidence === "object" && !Array.isArray(finding.evidence)
+            ? finding.evidence
+            : {};
+        return {
+            findingId: finding.id,
+            basis: findingEvidence.basis ?? null,
+            summary: boundedText(findingEvidence.summary, 500) ?? null,
+            phase: findingEvidence.phase ?? null,
+            evidenceUrl: findingEvidence.excerpt && typeof findingEvidence.excerpt === "object" && !Array.isArray(findingEvidence.excerpt)
+                ? findingEvidence.excerpt.evidenceUrl ?? null
+                : typeof links.findings === "string"
+                    ? links.findings
+                    : typeof links.report === "string"
+                        ? links.report
+                        : null
+        };
+    });
+    return {
+        digests,
+        evidenceAvailable: digests.length > 0 || Object.keys(evidence).length > 0,
+        evidenceSafetyNotes: Array.isArray(evidence.evidenceSafetyNotes)
+            ? evidence.evidenceSafetyNotes.slice(0, 3).map((note) => boundedText(note, 300))
+            : [],
+        references: Object.fromEntries(Object.entries(links).filter(([key, value]) => ["findings", "pulse", "report", "preConsentCookiesTrackers"].includes(key) && typeof value === "string")),
+        ...(includeDiagnostics ? {
+            projectionDiagnostics: compactEvidenceValue(evidence.projectionDiagnostics ?? null, {
+                arrayItems: 12,
+                depth: 4,
+                objectKeys: 24,
+                stringChars: 600
+            }),
+            coverageDiagnostics: compactEvidenceValue(evidence.coverageDiagnostics ?? null, {
+                arrayItems: 12,
+                depth: 4,
+                objectKeys: 24,
+                stringChars: 600
+            }),
+            policySurfaceCoverage: compactEvidenceValue(evidence.policySurfaceCoverage ?? null, {
+                arrayItems: 12,
+                depth: 4,
+                objectKeys: 24,
+                stringChars: 600
+            })
+        } : {})
+    };
+}
 function compactEvidenceValue(value, options) {
     if (value === null || value === undefined) {
         return value;
@@ -285,11 +773,21 @@ export function limitPreConsentRows(payload, options = {}) {
         return payload;
     }
     const maxRows = Math.min(200, Math.max(1, options.maxRows ?? 200));
-    const total = rows.length;
-    const truncated = total > maxRows;
+    const reportedTotal = payload.summary && typeof payload.summary === "object" && !Array.isArray(payload.summary)
+        && Number.isInteger(payload.summary.rowCount)
+        ? Number(payload.summary.rowCount)
+        : 0;
+    const total = Math.max(rows.length, reportedTotal);
+    const returnedRows = rows.slice(0, maxRows);
+    const truncated = total > returnedRows.length;
     return {
         ...payload,
-        rows: rows.slice(0, maxRows),
+        rows: returnedRows,
+        evidenceMetadata: {
+            total,
+            returned: returnedRows.length,
+            truncated
+        },
         summary: {
             ...(payload.summary && typeof payload.summary === "object" && !Array.isArray(payload.summary) ? payload.summary : {}),
             totalRowCount: total,
@@ -297,72 +795,812 @@ export function limitPreConsentRows(payload, options = {}) {
         }
     };
 }
+function uniqueBoundedStrings(values, maxItems, maxChars) {
+    return [...new Set(values.filter((value) => typeof value === "string" && value.length > 0).map((value) => value.slice(0, maxChars)))].slice(0, maxItems);
+}
+function compactPreConsentRow(row) {
+    const cookieDetails = Array.isArray(row.cookieDetails) ? row.cookieDetails : [];
+    const domains = uniqueBoundedStrings([
+        ...(Array.isArray(row.domains) ? row.domains : []),
+        row.host,
+        row.registrableDomain
+    ], 12, 253);
+    const purposes = Array.isArray(row.purposes) ? row.purposes : [];
+    return {
+        id: String(row.id ?? `${row.kind ?? "unknown"}:${row.name ?? row.vendor ?? row.host ?? "observed-item"}`).slice(0, 512),
+        kind: ["cookie", "tracker", "request", "storage"].includes(row.kind) ? row.kind : "unknown",
+        name: String(row.name ?? row.vendor ?? row.host ?? "Observed item").slice(0, 256),
+        cookieNames: uniqueBoundedStrings(cookieDetails.map((cookie) => cookie && typeof cookie === "object" ? cookie.name : null), 24, 256),
+        vendor: typeof row.vendor === "string" ? row.vendor.slice(0, 160) : null,
+        purpose: typeof row.purpose === "string" ? row.purpose.slice(0, 160) : typeof purposes[0] === "string" ? purposes[0].slice(0, 160) : null,
+        category: typeof row.category === "string" ? row.category.slice(0, 160) : null,
+        confidence: ["high", "medium", "low"].includes(row.confidence) ? row.confidence : "unknown",
+        firstObservedAtMs: Number.isInteger(row.firstObservedAtMs) && row.firstObservedAtMs >= 0 ? row.firstObservedAtMs : null,
+        domains,
+        requestCount: Number.isInteger(row.requestCount) && row.requestCount >= 0 ? row.requestCount : null,
+        evidenceClassification: {
+            basis: "public_report_projection",
+            phase: "pre_consent",
+            observedBeforeConsent: row.observedBeforeConsent !== false,
+            party: ["first_party", "third_party", "mixed"].includes(row.party) ? row.party : "unknown",
+            priority: ["high", "medium", "review_needed", "contextual"].includes(row.priority) ? row.priority : "unknown"
+        }
+    };
+}
+function preConsentBundleSection(payload, maxRows) {
+    const sourceRows = Array.isArray(payload.rows) ? payload.rows : [];
+    const total = Math.max(sourceRows.length, Number.isInteger(payload.summary?.rowCount) ? payload.summary.rowCount : 0);
+    const rows = sourceRows.slice(0, maxRows).map((row) => compactPreConsentRow(row));
+    return {
+        summary: {
+            rowCount: total,
+            trackerCount: Number.isInteger(payload.summary?.trackerCount) ? payload.summary.trackerCount : 0,
+            cookieCount: Number.isInteger(payload.summary?.cookieCount) ? payload.summary.cookieCount : 0,
+            requestCount: Number.isInteger(payload.summary?.requestCount) ? payload.summary.requestCount : 0,
+            vendorCount: Number.isInteger(payload.summary?.vendorCount) ? payload.summary.vendorCount : 0,
+            domainCount: Number.isInteger(payload.summary?.domainCount) ? payload.summary.domainCount : 0
+        },
+        rows,
+        total,
+        returned: rows.length,
+        truncated: total > rows.length
+    };
+}
+function neutralExecutiveSummary(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    const summary = value;
+    const score = typeof summary.score === "number" ? summary.score : null;
+    const scoreMetadata = summary.scoreMetadata && typeof summary.scoreMetadata === "object" && !Array.isArray(summary.scoreMetadata)
+        ? { ...summary.scoreMetadata, metricLabel: "CertScore score" }
+        : summary.scoreMetadata;
+    const trackerFootprint = summary.trackerFootprint && typeof summary.trackerFootprint === "object" && !Array.isArray(summary.trackerFootprint)
+        ? Object.fromEntries(Object.entries(summary.trackerFootprint).filter(([, entry]) => typeof entry === "number" || entry === null))
+        : undefined;
+    const policySurfaces = Array.isArray(summary.policySurfaces)
+        ? summary.policySurfaces.slice(0, 5).flatMap((surface) => {
+            if (!surface || typeof surface !== "object" || Array.isArray(surface))
+                return [];
+            const row = surface;
+            return [{
+                    type: boundedText(row.type, 80),
+                    title: boundedText(row.title, 160),
+                    url: boundedText(row.url, 2_048)
+                }];
+        })
+        : undefined;
+    return {
+        completionSummary: boundedText(summary.completionSummary, 280),
+        domain: boundedText(summary.domain, 253),
+        score,
+        scoreLabel: score === null ? "CertScore score" : `CertScore score: ${score}/100`,
+        ...(scoreMetadata ? { scoreMetadata } : {}),
+        riskLevel: summary.riskLevel,
+        actionLabel: summary.actionLabel,
+        issuesToReview: summary.issuesToReview,
+        thirdPartyRequests: summary.thirdPartyRequests,
+        trackingClassifiedThirdPartyRequests: summary.trackingClassifiedThirdPartyRequests,
+        cookiesPreConsent: summary.cookiesPreConsent,
+        nonEssentialPreConsentStorage: summary.nonEssentialPreConsentStorage,
+        unclassifiedPreConsentStorageCount: summary.unclassifiedPreConsentStorageCount,
+        storageMetricLabel: boundedText(summary.storageMetricLabel, 120),
+        storageMetricScope: boundedText(summary.storageMetricScope, 120),
+        storageMetricStatus: boundedText(summary.storageMetricStatus, 120),
+        storageMetricExplanation: boundedText(summary.storageMetricExplanation, 280),
+        consentPlatform: boundedText(summary.consentPlatform, 160),
+        ...(trackerFootprint ? { trackerFootprint } : {}),
+        ...(policySurfaces ? { policySurfaces } : {}),
+        scanTimeSeconds: summary.scanTimeSeconds
+    };
+}
+function findingText(finding, priorityLabel = "criticality") {
+    const evidence = finding.evidence && typeof finding.evidence === "object" && !Array.isArray(finding.evidence)
+        ? finding.evidence
+        : {};
+    const lenses = Array.isArray(finding.reviewLenses) && finding.reviewLenses.length > 0
+        ? finding.reviewLenses.slice(0, 2).join(", ")
+        : "not classified";
+    const nextStep = typeof finding.nextStep === "string" && finding.nextStep.trim()
+        ? `; canonical next step=${boundedText(finding.nextStep.trim(), 180)}`
+        : "";
+    return `- ${finding.label ?? finding.id ?? "Projected finding"}; ${priorityLabel}=${finding.criticality ?? "unknown"}; confidence=${finding.confidence ?? "unknown"}; observation=${finding.plainEnglish ?? evidence.summary ?? "No compact description available"}; evidence=${evidence.basis ?? "unknown"}/${evidence.phase ?? "phase unknown"}: ${evidence.summary ?? "No compact evidence summary available"}; review lenses=${lenses}${nextStep}.`;
+}
+function executiveOverviewText(summary) {
+    if (!summary)
+        return null;
+    const tracker = summary.trackerFootprint && typeof summary.trackerFootprint === "object" && !Array.isArray(summary.trackerFootprint)
+        ? summary.trackerFootprint
+        : {};
+    const policies = Array.isArray(summary.policySurfaces)
+        ? summary.policySurfaces.flatMap((surface) => {
+            if (!surface || typeof surface !== "object" || Array.isArray(surface))
+                return [];
+            const row = surface;
+            return typeof row.title === "string" ? [row.title] : typeof row.type === "string" ? [row.type] : [];
+        }).slice(0, 5)
+        : [];
+    const values = [
+        `CMP/consent platform=${summary.consentPlatform ?? "not returned"}`,
+        `third-party requests=${summary.thirdPartyRequests ?? "unknown"}`,
+        `non-essential pre-consent storage=${summary.nonEssentialPreConsentStorage ?? summary.cookiesPreConsent ?? "unknown"}`,
+        `tracker vendors=${tracker.vendors ?? "unknown"}`,
+        `tracker domains=${tracker.domains ?? "unknown"}`,
+        `policy surfaces=${policies.length > 0 ? policies.join(", ") : "none returned"}`
+    ];
+    return `Canonical report overview: ${values.join("; ")}.`;
+}
+function preConsentRowText(row, priorityLabel = "priority") {
+    const cookieNames = Array.isArray(row.cookieNames) && row.cookieNames.length > 0
+        ? `; cookies=${row.cookieNames.slice(0, 8).join(", ")}${row.cookieNames.length > 8 ? ", …" : ""}`
+        : "";
+    const domains = Array.isArray(row.domains) && row.domains.length > 0
+        ? `; domains=${row.domains.slice(0, 4).join(", ")}${row.domains.length > 4 ? ", …" : ""}`
+        : "";
+    const timing = typeof row.firstObservedAtMs === "number" ? `${(row.firstObservedAtMs / 1_000).toFixed(3)}s` : "unknown";
+    const classification = row.evidenceClassification && typeof row.evidenceClassification === "object"
+        ? row.evidenceClassification
+        : {};
+    return `- ${row.kind}: ${row.name}${cookieNames}; vendor=${row.vendor ?? "unknown"}; purpose=${row.purpose ?? "unknown"}; category=${row.category ?? "unknown"}; first observed=${timing}${domains}; evidence=${classification.basis ?? "unknown"}/${classification.phase ?? "unknown"}/${classification.party ?? "unknown"}; observedBeforeConsent=${classification.observedBeforeConsent ?? "unknown"}; ${priorityLabel}=${classification.priority ?? "unknown"}; confidence=${row.confidence ?? "unknown"}.`;
+}
+function reportUrlFor(value) {
+    const scanId = extractScanId(value);
+    return typeof value.reportUrl === "string" && value.reportUrl.trim()
+        ? value.reportUrl.trim()
+        : typeof value.links?.report === "string" && value.links.report.trim()
+            ? value.links.report.trim()
+            : scanId
+                ? `https://certscore.ai/scan/${encodeURIComponent(scanId)}`
+                : null;
+}
+function canonicalScanProvenanceText(value) {
+    const present = (field) => typeof field === "string" && field.trim() ? field.trim() : "unavailable";
+    const numeric = (field) => typeof field === "number" && Number.isFinite(field) ? String(field) : "unavailable";
+    return `Canonical scan provenance: scanId=${present(extractScanId(value))}; scanFrom/execution region=${present(value.scanFrom)}; completedAt=${present(value.completedAt)}; startedAt=${present(value.startedAt)}; createdAt=${present(value.createdAt)}; retrieval mode=${present(value.provenance?.retrievalMode)}; original creation decision=${present(value.provenance?.creationDecision)}; scan age seconds=${numeric(value.provenance?.scanAgeSeconds)}; compatibility provenance mode=${present(value.provenance?.mode)}.`;
+}
+export function scanStatusText(value) {
+    const reportUrl = reportUrlFor(value);
+    return [
+        `CertScore scan status: status=${value.status ?? "unknown"}.`,
+        canonicalScanProvenanceText(value),
+        `Full report: ${reportUrl ?? "not available"}.`,
+        OBSERVATION_ONLY_DISCLAIMER,
+        INTERPRETATION_STATEMENT,
+        SCAN_PROVENANCE_GROUNDING
+    ].join("\n");
+}
+function boundedResultText(header, bodyLines, value) {
+    const footer = [OBSERVATION_ONLY_DISCLAIMER, INTERPRETATION_STATEMENT];
+    const reportUrl = reportUrlFor(value);
+    const lines = [
+        header,
+        `Provenance: retrieval=${value.provenance?.retrievalMode ?? "unknown"}; original creation=${value.provenance?.creationDecision ?? "unknown"}; scan age seconds=${value.provenance?.scanAgeSeconds ?? "unavailable"}.`,
+        `Full report: ${reportUrl ?? "not available"}.`
+    ];
+    let rendered = 0;
+    for (const line of bodyLines) {
+        if ([...lines, line, ...footer].join("\n").length > MAX_TOOL_TEXT_CHARS)
+            break;
+        lines.push(line);
+        rendered += 1;
+    }
+    if (rendered < bodyLines.length) {
+        const omitted = `${bodyLines.length - rendered} additional returned row${bodyLines.length - rendered === 1 ? " was" : "s were"} omitted from TextContent to preserve the size limit; use structuredContent or the report URL.`;
+        if ([...lines, omitted, ...footer].join("\n").length <= MAX_TOOL_TEXT_CHARS)
+            lines.push(omitted);
+    }
+    lines.push(...footer);
+    return lines.join("\n");
+}
+export function findingListText(value, label = "Canonical projected findings") {
+    const findings = Array.isArray(value.findings) ? value.findings : [];
+    const pagination = value.pagination && typeof value.pagination === "object" && !Array.isArray(value.pagination)
+        ? value.pagination
+        : {};
+    const total = typeof pagination.total === "number" ? pagination.total : findings.length;
+    const returned = typeof pagination.returned === "number" ? pagination.returned : findings.length;
+    const truncated = pagination.truncated === true;
+    const scanId = extractScanId(value) ?? "unknown";
+    return boundedResultText(`${label} for scanId=${scanId}: ${returned} of ${total} returned${truncated ? " (truncated)" : ""}. These are canonical projected review signals, not MCP-derived findings.`, findings.map((finding) => findingText(finding)), value);
+}
+export function preConsentInventoryText(value) {
+    const rows = Array.isArray(value.rows) ? value.rows : [];
+    const metadata = value.evidenceMetadata && typeof value.evidenceMetadata === "object" && !Array.isArray(value.evidenceMetadata)
+        ? value.evidenceMetadata
+        : {};
+    const total = typeof metadata.total === "number"
+        ? metadata.total
+        : typeof value.summary?.totalRowCount === "number"
+            ? value.summary.totalRowCount
+            : typeof value.summary?.rowCount === "number"
+                ? value.summary.rowCount
+                : rows.length;
+    const returned = typeof metadata.returned === "number" ? metadata.returned : rows.length;
+    const truncated = metadata.truncated === true || value.summary?.truncated === true;
+    const scanId = extractScanId(value) ?? "unknown";
+    const domain = typeof value.domain === "string" ? value.domain : "unknown domain";
+    return boundedResultText(`Pre-consent cookie/tracker evidence for ${domain}; scanId=${scanId}; ${returned} of ${total} rows returned${truncated ? " (truncated)" : ""}. Enumerate only these observed rows.`, rows.map((row) => preConsentRowText(compactPreConsentRow(row))), value);
+}
+export function pulseReportText(value, label = "CertScore report") {
+    const scanId = extractScanId(value) ?? "unknown";
+    const domain = typeof value.domain === "string" ? value.domain : "unknown domain";
+    const score = typeof value.summary?.score === "number"
+        ? value.summary.score
+        : typeof value.score === "number"
+            ? value.score
+            : null;
+    const findings = findingsFromReport(value);
+    const overview = executiveOverviewText(value.executiveSummary ?? value.summary?.executiveSummary);
+    const body = [
+        ...(overview ? [overview] : []),
+        `Canonical projected findings returned in this ${label.toLocaleLowerCase()}: ${findings.length}.`,
+        ...findings.map((finding) => findingText(finding))
+    ];
+    return boundedResultText(`${label} for ${domain}; scanId=${scanId}${score === null ? "" : `; CertScore score=${score}`}.`, body, value);
+}
+export function markdownReportText(value) {
+    const markdown = typeof value.value === "string" ? value.value : "";
+    const excerptLimit = Math.max(0, MAX_TOOL_TEXT_CHARS - 1_500);
+    const excerpt = markdown.length > excerptLimit ? `${markdown.slice(0, excerptLimit)}\n…[markdown truncated for MCP TextContent]` : markdown;
+    return boundedResultText(`CertScore report for scanId=${extractScanId(value) ?? "unknown"}. The following is a bounded canonical report excerpt.`, excerpt ? [excerpt] : ["No Markdown report body was returned."], value);
+}
+export function scanBundleText(bundle) {
+    const score = typeof bundle.score === "number" ? `; CertScore score=${bundle.score}` : "";
+    const footer = [OBSERVATION_ONLY_DISCLAIMER, SCAN_BUNDLE_INTERPRETATION_STATEMENT];
+    const lines = [
+        SCAN_BUNDLE_RESPONSE_CONTRACT,
+        `CertScore scan bundle for ${bundle.domain ?? "unknown domain"}; status=${bundle.status ?? "unknown"}${score}; scanId=${bundle.scanId ?? "unknown"}.`,
+        canonicalScanProvenanceText(bundle),
+        `Full report: ${bundle.reportUrl ?? (bundle.scanId ? `https://certscore.ai/scan/${encodeURIComponent(String(bundle.scanId))}` : "not available")}.`
+    ];
+    const canAppend = (line) => [...lines, line, ...footer].join("\n").length <= MAX_TOOL_TEXT_CHARS;
+    const append = (line) => {
+        if (!canAppend(line))
+            return false;
+        lines.push(line);
+        return true;
+    };
+    const coverage = bundle.coverage && typeof bundle.coverage === "object" && !Array.isArray(bundle.coverage)
+        ? bundle.coverage
+        : null;
+    if (coverage) {
+        append(`Coverage: status=${coverage.status ?? "unknown"}; ${coverage.summary ?? "Review limitations before interpreting absence."}`);
+    }
+    const postRefusal = bundle.postRefusalObservation && typeof bundle.postRefusalObservation === "object" && !Array.isArray(bundle.postRefusalObservation)
+        ? bundle.postRefusalObservation
+        : null;
+    if (postRefusal && typeof postRefusal.interpretation === "string") {
+        const termination = postRefusal.termination && typeof postRefusal.termination === "object" && !Array.isArray(postRefusal.termination)
+            ? postRefusal.termination
+            : null;
+        const intentionalEvidenceStop = termination?.kind === "evidence_satisfied" && termination.intentional === true
+            ? " The observation then stopped intentionally because qualifying evidence had been captured."
+            : "";
+        append(`Reject Path: ${postRefusal.interpretation}${intentionalEvidenceStop}`);
+        for (const limitation of Array.isArray(postRefusal.coverageLimitations)
+            ? postRefusal.coverageLimitations.slice(0, 3)
+            : []) {
+            append(`Reject Path coverage limitation: ${limitation}`);
+        }
+    }
+    const overview = executiveOverviewText(bundle.summary?.executiveSummary);
+    if (overview)
+        append(overview);
+    const transportSecurity = bundle.transportSecurity && typeof bundle.transportSecurity === "object" && !Array.isArray(bundle.transportSecurity)
+        ? bundle.transportSecurity
+        : null;
+    if (transportSecurity) {
+        const counts = transportSecurity.observationCounts && typeof transportSecurity.observationCounts === "object"
+            ? transportSecurity.observationCounts
+            : {};
+        append(`Transport security: status=${transportSecurity.status ?? "unavailable"}; retained evidence=${transportSecurity.evidenceRetained === true ? "yes" : "no"}; canonical observations=${counts.total ?? 0}; concerns/review=${counts.concernOrReview ?? 0}; unavailable=${counts.unavailable ?? 0}.`);
+        for (const observation of Array.isArray(transportSecurity.observations) ? transportSecurity.observations : []) {
+            append(`Transport observation: ${observation.label ?? observation.id ?? "unknown"}; status=${observation.status ?? "unknown"}; ${observation.summary ?? "Review the structured transport evidence."}`);
+        }
+        for (const limitation of Array.isArray(transportSecurity.limitations) ? transportSecurity.limitations.slice(0, 3) : []) {
+            append(`Transport limitation: ${limitation}`);
+        }
+    }
+    const findings = Array.isArray(bundle.findings) ? bundle.findings : [];
+    const findingTotal = bundle.findingsMetadata?.total ?? findings.length;
+    const findingReturned = bundle.findingsMetadata?.returned ?? bundle.findingsMetadata?.shown ?? findings.length;
+    append(`Canonical projected findings: ${findingReturned} of ${findingTotal} returned${bundle.findingsMetadata?.truncated ? " (truncated)" : ""}. These are already-projected review signals, not inferred technologies or legal conclusions.`);
+    let findingsRendered = 0;
+    for (const [index, finding] of findings.entries()) {
+        const next = findingText(finding, "CertScore priority/classification");
+        const remaining = findings.length - index - 1;
+        const reserve = remaining > 0
+            ? `${remaining} additional returned finding${remaining === 1 ? " was" : "s were"} omitted from TextContent to preserve the size limit; see structuredContent or the report URL.`
+            : null;
+        if ([...lines, next, ...(reserve ? [reserve] : []), ...footer].join("\n").length > MAX_TOOL_TEXT_CHARS)
+            break;
+        lines.push(next);
+        findingsRendered += 1;
+    }
+    if (findingsRendered < findings.length) {
+        append(`${findings.length - findingsRendered} additional returned finding${findings.length - findingsRendered === 1 ? " was" : "s were"} omitted from TextContent to preserve the size limit; see structuredContent or the report URL.`);
+    }
+    const inventory = bundle.preConsentCookiesTrackers;
+    if (inventory && typeof inventory === "object") {
+        append(`Pre-consent cookie/tracker evidence: ${inventory.returned ?? 0} of ${inventory.total ?? 0} rows returned${inventory.truncated ? " (truncated)" : ""}.`);
+        const rows = Array.isArray(inventory.rows) ? inventory.rows : [];
+        let rowsRendered = 0;
+        for (const [index, row] of rows.entries()) {
+            const next = preConsentRowText(row, "CertScore priority");
+            const remaining = rows.length - index - 1;
+            const reserve = remaining > 0
+                ? `${remaining} additional returned pre-consent row${remaining === 1 ? " was" : "s were"} omitted from TextContent to preserve the size limit; see structuredContent or the report URL.`
+                : null;
+            if ([...lines, next, ...(reserve ? [reserve] : []), ...footer].join("\n").length > MAX_TOOL_TEXT_CHARS)
+                break;
+            lines.push(next);
+            rowsRendered += 1;
+        }
+        if (rowsRendered < rows.length) {
+            append(`${rows.length - rowsRendered} additional returned pre-consent row${rows.length - rowsRendered === 1 ? " was" : "s were"} omitted from TextContent to preserve the size limit; see structuredContent or the report URL.`);
+        }
+    }
+    else {
+        append("No row-level pre-consent inventory was available for this result; review coverage and limitations before interpreting absence.");
+    }
+    lines.push(...footer);
+    return lines.join("\n");
+}
+function scanBundleTransportSecurity(report, detail) {
+    const source = report.transportSecurity && typeof report.transportSecurity === "object" && !Array.isArray(report.transportSecurity)
+        ? report.transportSecurity
+        : null;
+    if (!source) {
+        return {
+            status: "unavailable",
+            evidenceRetained: false,
+            observationCounts: {
+                total: 0,
+                observedPositive: 0,
+                concernOrReview: 0,
+                notObserved: 0,
+                unavailable: 0
+            },
+            observations: [],
+            limitations: [
+                "No canonical transport-security projection was available in this scan response. Do not infer a positive transport result."
+            ]
+        };
+    }
+    const observations = Array.isArray(source.observations) ? source.observations : [];
+    const compactObservations = observations.slice(0, 8).map((observation) => {
+        const row = observation && typeof observation === "object" && !Array.isArray(observation)
+            ? observation
+            : {};
+        return {
+            id: row.id,
+            label: boundedText(row.label, 140),
+            status: row.status,
+            assessmentStatus: row.assessmentStatus,
+            evidenceState: row.evidenceState,
+            summary: boundedText(row.summary, 180),
+            evidenceRefs: []
+        };
+    });
+    return {
+        status: source.status === "available" || source.status === "limited" ? source.status : "unavailable",
+        evidenceRetained: source.evidenceRetained === true,
+        observationCounts: source.observationCounts && typeof source.observationCounts === "object" && !Array.isArray(source.observationCounts)
+            ? source.observationCounts
+            : {
+                total: observations.length,
+                observedPositive: 0,
+                concernOrReview: 0,
+                notObserved: 0,
+                unavailable: observations.length
+            },
+        observations: detail === "summary" || detail === "findings"
+            ? compactObservations
+            : observations.map((observation) => compactEvidenceValue(observation, {
+                arrayItems: 6,
+                depth: 4,
+                objectKeys: 12,
+                stringChars: 1_200
+            })),
+        limitations: Array.isArray(source.limitations)
+            ? source.limitations.filter((value) => typeof value === "string").slice(0, 8)
+            : [],
+        ...(detail === "full" && source.retainedSummary && typeof source.retainedSummary === "object" && !Array.isArray(source.retainedSummary)
+            ? {
+                retainedSummary: compactEvidenceValue(source.retainedSummary, {
+                    arrayItems: 20,
+                    depth: 4,
+                    objectKeys: 24,
+                    stringChars: 1_200
+                })
+            }
+            : {})
+    };
+}
 export function buildScanBundle(input) {
-    const maxFindings = Math.min(50, Math.max(1, input.maxFindings ?? 20));
+    const detail = input.detail ?? "summary";
+    const maxFindings = Math.min(50, Math.max(1, input.maxFindings ?? (detail === "summary" ? 5 : 20)));
     const maxPreConsentRows = Math.min(50, Math.max(1, input.maxPreConsentRows ?? 20));
-    const evidence = input.evidence;
-    const report = input.report;
-    const findings = Array.isArray(input.findings.findings) ? input.findings.findings.slice(0, maxFindings) : [];
-    const preConsentRows = Array.isArray(input.preConsentCookiesTrackers.rows)
-        ? input.preConsentCookiesTrackers.rows.slice(0, maxPreConsentRows)
-        : [];
+    const evidence = (input.evidence ?? {});
+    const report = (input.report ?? {});
+    const transportSecurity = scanBundleTransportSecurity(report, detail);
+    const allFindings = prioritizeFindingsForBoundedBundle(Array.isArray(input.findings.findings) ? input.findings.findings : []);
+    const selectedFindings = detail === "summary" ? distinctSummaryFindings(allFindings) : allFindings;
+    const selectedFindingRows = selectedFindings.slice(0, maxFindings);
+    const findingDisclaimersDeduplicated = detail === "full"
+        && selectedFindingRows.some((finding) => typeof finding.disclaimer === "string");
+    const findings = selectedFindingRows
+        .map((finding) => detail === "full" ? withoutFindingDisclaimer(finding) : compactBundleFinding(finding));
+    const deduplicatedReport = deduplicatedFullReport({ findings, report, transportSecurity });
+    const preConsentCookiesTrackers = input.preConsentCookiesTrackers
+        ? preConsentBundleSection(input.preConsentCookiesTrackers, maxPreConsentRows)
+        : null;
     const links = {
         ...(input.scan.links ?? {}),
         ...(report.links && typeof report.links === "object" && !Array.isArray(report.links) ? report.links : {})
     };
-    return {
+    const requestedMaxBytes = Math.min(200_000, Math.max(5_000, input.requestedMaxBytes ?? input.maxBytes ?? 50_000));
+    const responseCeilingBytes = Math.min(200_000, Math.max(5_000, input.responseCeilingBytes ?? 200_000));
+    const maxBytes = Math.min(requestedMaxBytes, responseCeilingBytes);
+    const contentUrls = Object.fromEntries(Object.entries({
+        report: input.scan.links?.report ?? links.report,
+        findings: links.findings,
+        evidence: links.pulse,
+        preConsentCookiesTrackers: links.preConsentCookiesTrackers
+    }).filter(([, value]) => typeof value === "string"));
+    const intentionallyOmitted = new Set();
+    if (allFindings.length > findings.length)
+        intentionallyOmitted.add("additionalFindings");
+    if ((detail === "summary" || detail === "findings") && (Object.keys(evidence).length > 0 || allFindings.length > 0))
+        intentionallyOmitted.add("evidence");
+    if (detail !== "full" && Object.keys(report).length > 0)
+        intentionallyOmitted.add("fullReport");
+    const guidedScan = withMcpAgentGuidance(input.scan);
+    const bundle = {
         type: "certscore_scan_bundle",
+        detail,
         scanId: input.scan.scanId,
+        domain: input.scan.domain,
+        url: input.scan.url ?? null,
+        scanFrom: input.scan.scanFrom ?? null,
         status: input.scan.status,
+        score: input.scan.score ?? null,
+        scoreLabel: "CertScore score",
+        scoreStatus: input.scan.scoreStatus ?? "final",
+        scoreVersion: input.scan.scoreVersion ?? null,
+        scoreUpdatedAt: input.scan.scoreUpdatedAt ?? null,
+        riskLevel: input.scan.riskLevel ?? null,
+        postRefusalObservation: input.scan.postRefusalObservation ?? null,
+        provenance: scanProvenance(input.scan, "existing_scan_retrieved"),
+        interpretationGuidance: interpretationGuidance(SCAN_BUNDLE_INTERPRETATION_STATEMENT),
         resultDisposition: input.scan.resultDisposition ?? null,
         noGo: input.scan.noGo ?? null,
-        scan: input.scan,
+        coverage: input.scan.coverage ?? null,
+        createdAt: input.scan.createdAt ?? null,
+        startedAt: input.scan.startedAt ?? null,
+        completedAt: input.scan.completedAt ?? null,
+        scanTimeSeconds: input.scan.scanTimeSeconds ?? null,
+        timing: {
+            createdAt: input.scan.createdAt ?? null,
+            startedAt: input.scan.startedAt ?? null,
+            completedAt: input.scan.completedAt ?? null,
+            scanTimeSeconds: input.scan.scanTimeSeconds ?? null
+        },
         summary: {
-            summary: report.summary ?? null,
-            executiveSummary: report.executiveSummary ?? null,
+            headline: report.summary && typeof report.summary === "object" && !Array.isArray(report.summary)
+                ? report.summary.headline ?? null
+                : null,
+            executiveSummary: neutralExecutiveSummary(report.executiveSummary),
             counts: report.counts ?? null,
-            coverage: report.coverage ?? input.scan.coverage ?? null,
             agentInterpretation: report.agentInterpretation ?? null
         },
         findings,
         findingsMetadata: {
             shown: findings.length,
-            total: Array.isArray(input.findings.findings) ? input.findings.findings.length : 0,
-            truncated: Array.isArray(input.findings.findings) && input.findings.findings.length > findings.length
+            returned: findings.length,
+            total: allFindings.length,
+            truncated: allFindings.length > findings.length
         },
-        evidenceSummary: {
-            evidenceSafetyNotes: evidence.evidenceSafetyNotes ?? null,
-            projectionDiagnostics: evidence.projectionDiagnostics ?? null,
-            projectedFindings: compactEvidenceValue(evidence.projectedFindings ?? [], {
-                arrayItems: maxFindings,
-                depth: 5,
-                objectKeys: 40,
-                stringChars: 1_000
-            }),
-            coverageDiagnostics: compactEvidenceValue(evidence.coverageDiagnostics ?? null, {
-                arrayItems: 20,
-                depth: 5,
-                objectKeys: 40,
-                stringChars: 1_000
-            }),
-            policySurfaceCoverage: compactEvidenceValue(evidence.policySurfaceCoverage ?? null, {
-                arrayItems: 20,
-                depth: 5,
-                objectKeys: 40,
-                stringChars: 1_000
+        transportSecurity,
+        ...(detail === "evidence" || detail === "full"
+            ? { evidenceSummary: bundleEvidenceSummary(evidence, allFindings, links, detail === "full") }
+            : {}),
+        ...(detail === "full" ? {
+            fullReport: compactEvidenceValue(deduplicatedReport.residual, {
+                arrayItems: 50,
+                depth: 8,
+                objectKeys: 100,
+                stringChars: 4_000
             })
-        },
-        preConsentCookiesTrackers: {
-            summary: input.preConsentCookiesTrackers.summary,
-            rows: preConsentRows,
-            shown: preConsentRows.length,
-            total: Array.isArray(input.preConsentCookiesTrackers.rows) ? input.preConsentCookiesTrackers.rows.length : 0,
-            truncated: Array.isArray(input.preConsentCookiesTrackers.rows) && input.preConsentCookiesTrackers.rows.length > preConsentRows.length
-        },
+        } : {}),
+        ...(preConsentCookiesTrackers ? { preConsentCookiesTrackers } : {}),
         links,
-        recommendedNextTool: findings.length > 0 ? "explain_finding" : null,
-        disclaimer: input.scan.disclaimer ?? input.report.disclaimer ?? null
+        reportUrl: input.scan.links?.report ?? (typeof links.report === "string" ? links.report : `https://certscore.ai/scan/${encodeURIComponent(input.scan.scanId)}`),
+        recommendedNextTool: null,
+        recommendedNextAction: guidedScan.error?.recommendedNextAction ?? (detail === "summary" && allFindings.length > findings.length
+            ? "Review the returned overview and findings, then request detail=findings or a larger maxFindings value for more projected findings."
+            : findings.length > 0
+                ? "Review the returned findings and follow their evidence references. Use detail=evidence only when deeper retained context is needed."
+                : "Review coverage and limitations before interpreting the absence of findings."),
+        error: guidedScan.error,
+        mcpMetadata: {
+            detail,
+            heavyEvidenceIncluded: detail === "evidence" || detail === "full",
+            findingsTruncated: allFindings.length > findings.length,
+            requestedMaxBytes,
+            effectiveMaxBytes: maxBytes,
+            responseCeilingBytes,
+            responseBudgetClamped: requestedMaxBytes > maxBytes,
+            actualBytes: 0,
+            fullPayloadBytes: 0,
+            truncated: false,
+            canonicalFindingsComplete: allFindings.length === findings.length,
+            truncationReason: null,
+            omittedSections: [...intentionallyOmitted],
+            deduplicatedSections: detail === "full"
+                ? [
+                    ...deduplicatedReport.deduplicatedSections,
+                    ...(findingDisclaimersDeduplicated ? ["findings[].disclaimer"] : [])
+                ]
+                : [],
+            nextRecommendedMaxBytes: null,
+            omittedContentAvailableViaUrl: intentionallyOmitted.size > 0 && Object.keys(contentUrls).length > 0,
+            contentUrls
+        },
+        observationOnlyDisclaimer: OBSERVATION_ONLY_DISCLAIMER,
+        disclaimer: LEGAL_REVIEW_DISCLAIMER
     };
+    const markBudgetOmitted = (section, reason) => {
+        bundle.mcpMetadata.truncated = true;
+        bundle.mcpMetadata.truncationReason ??= reason;
+        if (!bundle.mcpMetadata.omittedSections.includes(section)) {
+            bundle.mcpMetadata.omittedSections.push(section);
+        }
+        bundle.mcpMetadata.omittedContentAvailableViaUrl = Object.keys(contentUrls).length > 0;
+    };
+    const refresh = () => updateBundleActualBytes(bundle);
+    const captureFullPayloadBytes = () => {
+        for (let attempt = 0; attempt < 3; attempt += 1) {
+            refresh();
+            const measured = bundle.mcpMetadata.actualBytes;
+            if (bundle.mcpMetadata.fullPayloadBytes === measured)
+                break;
+            bundle.mcpMetadata.fullPayloadBytes = measured;
+        }
+        refresh();
+    };
+    const refreshTruncationGuidance = () => {
+        const completeBytes = bundle.mcpMetadata.fullPayloadBytes;
+        const canonicalFindingsComplete = bundle.findingsMetadata.returned === bundle.findingsMetadata.total &&
+            bundle.findingsMetadata.truncated === false;
+        bundle.mcpMetadata.canonicalFindingsComplete = canonicalFindingsComplete;
+        bundle.mcpMetadata.nextRecommendedMaxBytes = completeBytes <= responseCeilingBytes
+            ? Math.max(5_000, Math.ceil(completeBytes / 1_000) * 1_000)
+            : null;
+        bundle.recommendedNextAction = canonicalFindingsComplete
+            ? "Canonical findings complete; retry only for omitted envelope detail."
+            : bundle.mcpMetadata.nextRecommendedMaxBytes
+                ? `Retry with maxBytes=${bundle.mcpMetadata.nextRecommendedMaxBytes} to retrieve the complete requested tier, or open ${bundle.reportUrl ? "the report URL" : "an available content URL"}.`
+                : `The complete requested tier exceeds the MCP byte ceiling; open ${bundle.reportUrl ? "the report URL" : "an available content URL"}.`;
+        refresh();
+    };
+    captureFullPayloadBytes();
+    if (bundle.mcpMetadata.actualBytes > maxBytes && bundle.fullReport) {
+        markBudgetOmitted("fullReport", "full_report_omitted_to_byte_limit");
+        delete bundle.fullReport;
+        refresh();
+    }
+    if (bundle.mcpMetadata.actualBytes > maxBytes && detail === "full" && bundle.evidenceSummary) {
+        const compactSummary = bundleEvidenceSummary(evidence, allFindings, links, false);
+        markBudgetOmitted("evidenceDiagnostics", "evidence_diagnostics_omitted_to_byte_limit");
+        bundle.evidenceSummary = compactSummary;
+        refresh();
+    }
+    if (bundle.mcpMetadata.actualBytes > maxBytes &&
+        (bundle.transportSecurity?.observations?.length > 0 || bundle.transportSecurity?.retainedSummary)) {
+        markBudgetOmitted("transportSecurityDetail", "transport_security_detail_omitted_to_byte_limit");
+        bundle.transportSecurity = {
+            status: bundle.transportSecurity.status,
+            evidenceRetained: bundle.transportSecurity.evidenceRetained,
+            observationCounts: bundle.transportSecurity.observationCounts,
+            observations: [],
+            limitations: bundle.transportSecurity.limitations
+        };
+        refresh();
+    }
+    if (bundle.mcpMetadata.actualBytes > maxBytes && bundle.findings.length > 0) {
+        markBudgetOmitted("findingDetail", "findings_compacted_to_preserve_core_rows");
+        bundle.findings = bundle.findings.map((finding) => compactBundleFinding(finding, "core"));
+        refresh();
+    }
+    if (bundle.mcpMetadata.actualBytes > maxBytes) {
+        markBudgetOmitted("summaryDetail", "summary_compacted_to_byte_limit");
+        bundle.summary = {
+            headline: boundedText(bundle.summary?.headline, 240) ?? null,
+            executiveSummary: null,
+            counts: bundle.summary?.counts ? { totalAutomatedFindingCount: bundle.findingsMetadata.total } : null,
+            agentInterpretation: null
+        };
+        refresh();
+    }
+    if (bundle.mcpMetadata.actualBytes > maxBytes) {
+        markBudgetOmitted("coverageDetail", "coverage_compacted_to_byte_limit");
+        bundle.coverage = compactEvidenceValue(bundle.coverage, {
+            arrayItems: 3,
+            depth: 3,
+            objectKeys: 8,
+            stringChars: 240
+        });
+        refresh();
+    }
+    if (bundle.mcpMetadata.actualBytes > maxBytes && bundle.links) {
+        markBudgetOmitted("additionalLinks", "links_compacted_to_byte_limit");
+        bundle.links = Object.fromEntries(Object.entries(bundle.links).filter(([key]) => ["self", "report"].includes(key)));
+        refresh();
+    }
+    if (bundle.mcpMetadata.actualBytes > maxBytes) {
+        markBudgetOmitted("duplicateGuidance", "guidance_compacted_to_preserve_priority_content");
+        bundle.interpretationGuidance = interpretationGuidance(COMPACT_SCAN_BUNDLE_INTERPRETATION_STATEMENT);
+        bundle.observationOnlyDisclaimer = COMPACT_OBSERVATION_ONLY_DISCLAIMER;
+        bundle.disclaimer = null;
+        refresh();
+    }
+    if (bundle.mcpMetadata.actualBytes > maxBytes && bundle.evidenceSummary) {
+        markBudgetOmitted("evidenceDetail", "evidence_compacted_to_preserve_priority_content");
+        bundle.evidenceSummary = compactPriorityEvidenceSummary(bundle.evidenceSummary);
+        refresh();
+    }
+    const inventoryRows = bundle.preConsentCookiesTrackers?.rows;
+    while (bundle.mcpMetadata.actualBytes > maxBytes && Array.isArray(inventoryRows) && inventoryRows.length > 0) {
+        markBudgetOmitted("additionalPreConsentRows", "evidence_inventory_reduced_to_preserve_findings");
+        inventoryRows.pop();
+        bundle.preConsentCookiesTrackers.returned = inventoryRows.length;
+        bundle.preConsentCookiesTrackers.truncated = true;
+        refresh();
+    }
+    if (bundle.mcpMetadata.actualBytes > maxBytes &&
+        bundle.findings.length > 1 &&
+        typeof contentUrls.findings === "string") {
+        markBudgetOmitted("findingEvidenceUrls", "finding_evidence_urls_replaced_by_template");
+        bundle.evidenceUrlTemplate = "{contentUrls.findings}/{findingId}";
+        bundle.findings = bundle.findings.map((finding) => {
+            const { evidenceUrl: _evidenceUrl, ...rest } = finding;
+            return rest;
+        });
+        refresh();
+    }
+    if (bundle.mcpMetadata.actualBytes > maxBytes && bundle.preConsentCookiesTrackers) {
+        markBudgetOmitted("preConsentCookiesTrackers", "pre_consent_summary_omitted_to_preserve_findings");
+        delete bundle.preConsentCookiesTrackers;
+        refresh();
+    }
+    if (bundle.mcpMetadata.actualBytes > maxBytes && bundle.links) {
+        markBudgetOmitted("links", "duplicate_links_omitted_to_preserve_findings");
+        delete bundle.links;
+        refresh();
+    }
+    if (bundle.mcpMetadata.actualBytes > maxBytes && bundle.timing) {
+        markBudgetOmitted("timing", "duplicate_timing_envelope_omitted_to_preserve_findings");
+        delete bundle.timing;
+        refresh();
+    }
+    if (bundle.mcpMetadata.actualBytes > maxBytes && bundle.summary) {
+        markBudgetOmitted("summary", "duplicate_summary_envelope_omitted_to_preserve_findings");
+        delete bundle.summary;
+        refresh();
+    }
+    if (bundle.mcpMetadata.actualBytes > maxBytes && bundle.mcpMetadata.truncated) {
+        refreshTruncationGuidance();
+    }
+    if (bundle.mcpMetadata.actualBytes > maxBytes && bundle.evidenceSummary) {
+        markBudgetOmitted("evidence", "evidence_digest_omitted_to_byte_limit");
+        delete bundle.evidenceSummary;
+        bundle.mcpMetadata.heavyEvidenceIncluded = false;
+        refresh();
+    }
+    while (bundle.mcpMetadata.actualBytes > maxBytes && bundle.findings.length > 1) {
+        markBudgetOmitted("additionalFindings", "findings_reduced_to_byte_limit");
+        bundle.findings.pop();
+        bundle.findingsMetadata.shown = bundle.findings.length;
+        bundle.findingsMetadata.returned = bundle.findings.length;
+        bundle.findingsMetadata.truncated = true;
+        bundle.mcpMetadata.findingsTruncated = true;
+        refresh();
+    }
+    if (bundle.mcpMetadata.truncated) {
+        refreshTruncationGuidance();
+    }
+    if (bundle.mcpMetadata.actualBytes > maxBytes) {
+        const minimal = {
+            type: bundle.type,
+            detail: bundle.detail,
+            scanId: bundle.scanId,
+            domain: bundle.domain,
+            url: bundle.url,
+            status: bundle.status,
+            score: bundle.score,
+            scoreLabel: bundle.scoreLabel,
+            scoreStatus: bundle.scoreStatus,
+            scoreVersion: bundle.scoreVersion,
+            scoreUpdatedAt: bundle.scoreUpdatedAt,
+            riskLevel: bundle.riskLevel,
+            postRefusalObservation: bundle.postRefusalObservation,
+            provenance: bundle.provenance,
+            interpretationGuidance: bundle.interpretationGuidance,
+            resultDisposition: bundle.resultDisposition,
+            noGo: bundle.noGo,
+            coverage: null,
+            createdAt: bundle.createdAt,
+            startedAt: bundle.startedAt,
+            completedAt: bundle.completedAt,
+            scanTimeSeconds: bundle.scanTimeSeconds,
+            timing: bundle.timing,
+            summary: {
+                headline: bundle.summary?.headline ?? null,
+                executiveSummary: null,
+                counts: bundle.summary?.counts ?? null,
+                agentInterpretation: null
+            },
+            findings: bundle.findings.slice(0, 1),
+            findingsMetadata: {
+                shown: Math.min(1, bundle.findings.length),
+                returned: Math.min(1, bundle.findings.length),
+                total: bundle.findingsMetadata.total,
+                truncated: bundle.findingsMetadata.total > Math.min(1, bundle.findings.length)
+            },
+            transportSecurity: {
+                status: bundle.transportSecurity.status,
+                evidenceRetained: bundle.transportSecurity.evidenceRetained,
+                observationCounts: bundle.transportSecurity.observationCounts,
+                observations: [],
+                limitations: bundle.transportSecurity.limitations.slice(0, 2)
+            },
+            ...(bundle.preConsentCookiesTrackers ? {
+                preConsentCookiesTrackers: {
+                    summary: bundle.preConsentCookiesTrackers.summary,
+                    rows: [],
+                    total: bundle.preConsentCookiesTrackers.total,
+                    returned: 0,
+                    truncated: bundle.preConsentCookiesTrackers.total > 0
+                }
+            } : {}),
+            links: Object.fromEntries(Object.entries(bundle.links ?? {}).filter(([key]) => ["docs", "report", "self"].includes(key))),
+            reportUrl: bundle.reportUrl,
+            recommendedNextTool: null,
+            recommendedNextAction: bundle.recommendedNextAction,
+            error: bundle.error,
+            mcpMetadata: {
+                detail,
+                heavyEvidenceIncluded: false,
+                findingsTruncated: bundle.findingsMetadata.total > Math.min(1, bundle.findings.length),
+                requestedMaxBytes,
+                effectiveMaxBytes: maxBytes,
+                responseCeilingBytes,
+                responseBudgetClamped: requestedMaxBytes > maxBytes,
+                actualBytes: 0,
+                fullPayloadBytes: bundle.mcpMetadata.fullPayloadBytes,
+                truncated: true,
+                canonicalFindingsComplete: bundle.findingsMetadata.total === Math.min(1, bundle.findings.length),
+                truncationReason: "minimal_canonical_result_returned_to_byte_limit",
+                omittedSections: [...new Set([
+                        ...bundle.mcpMetadata.omittedSections,
+                        "summaryDetail",
+                        "evidence",
+                        ...(bundle.findingsMetadata.total > Math.min(1, bundle.findings.length) ? ["additionalFindings"] : []),
+                        ...(bundle.preConsentCookiesTrackers?.total > 0 ? ["additionalPreConsentRows"] : [])
+                    ])],
+                deduplicatedSections: bundle.mcpMetadata.deduplicatedSections,
+                nextRecommendedMaxBytes: bundle.mcpMetadata.nextRecommendedMaxBytes,
+                omittedContentAvailableViaUrl: Object.keys(contentUrls).length > 0,
+                contentUrls
+            },
+            observationOnlyDisclaimer: bundle.observationOnlyDisclaimer,
+            disclaimer: bundle.disclaimer
+        };
+        updateBundleActualBytes(minimal);
+        return minimal;
+    }
+    return bundle;
 }
 export function explainFinding(report, findingId) {
     const finding = findingsFromReport(report).find((candidate) => candidate.id === findingId);