@decionis/mcp 0.1.0 → 0.1.2

package/dist/ManagedAgentHookCli.js

@@ -36770,7 +36770,7 @@ var MCP_PROTOCOL_VERSIONS = [
   "2025-03-26",
   "2024-11-05"
 ];
-var MCP_DEFAULT_PROTOCOL_VERSION = "2025-06-18";
+var MCP_DEFAULT_PROTOCOL_VERSION = "2025-11-25";
 var DEFAULT_PUBLIC_BASE_URL = "https://protocol.decionis.com";
 var MCP_HTTP_PATHS = ["/mcp", "/v1/protocol/mcp"];
 
@@ -36974,7 +36974,7 @@ var McpAuthGuard = class {
     return auth?.kind === "org_api_key";
   }
   static findTargetOrgIdForTool(name, args) {
-    if (name === "decionis.evaluate_decision" || name === "evaluate_decision" || name === "decionis.agentic_checkout_authorize" || name === "agentic_checkout_authorize" || name === "decionis.evaluate_webex_agent_intent" || name === "evaluate_webex_agent_intent" || name === "decionis.get_decision_dossier" || name === "get_decision_dossier" || name === "decionis.list_enforcement_rollouts" || name === "list_enforcement_rollouts" || name === "decionis.upsert_enforcement_rollout" || name === "upsert_enforcement_rollout" || name === "decionis.resolve_vertical_pack" || name === "resolve_vertical_pack" || name === "decionis.run_shadow_decisioning" || name === "run_shadow_decisioning") {
+    if (name === "decionis.evaluate_decision" || name === "evaluate_decision" || name === "decionis.agentic_checkout_authorize" || name === "agentic_checkout_authorize" || name === "decionis.evaluate_webex_agent_intent" || name === "evaluate_webex_agent_intent" || name === "decionis.get_decision_dossier" || name === "get_decision_dossier" || name === "decionis.get_decision_chain" || name === "get_decision_chain" || name === "decionis.list_enforcement_rollouts" || name === "list_enforcement_rollouts" || name === "decionis.upsert_enforcement_rollout" || name === "upsert_enforcement_rollout" || name === "decionis.resolve_vertical_pack" || name === "resolve_vertical_pack" || name === "decionis.run_shadow_decisioning" || name === "run_shadow_decisioning") {
       return asString(args.org_id);
     }
     return null;
@@ -36983,7 +36983,7 @@ var McpAuthGuard = class {
     if (name === "decionis.evaluate_decision" || name === "evaluate_decision" || name === "decionis.agentic_checkout_authorize" || name === "agentic_checkout_authorize" || name === "decionis.evaluate_webex_agent_intent" || name === "evaluate_webex_agent_intent" || name === "decionis.run_shadow_decisioning" || name === "run_shadow_decisioning") {
       return ["decision:run", "decision:*", "org:*"];
     }
-    if (name === "decionis.get_decision_dossier" || name === "get_decision_dossier" || name === "decionis.list_enforcement_rollouts" || name === "list_enforcement_rollouts" || name === "decionis.resolve_vertical_pack" || name === "resolve_vertical_pack") {
+    if (name === "decionis.get_decision_dossier" || name === "get_decision_dossier" || name === "decionis.get_decision_chain" || name === "get_decision_chain" || name === "decionis.list_enforcement_rollouts" || name === "list_enforcement_rollouts" || name === "decionis.resolve_vertical_pack" || name === "resolve_vertical_pack") {
       return ["decision:read", "org:read", "decision:*", "org:*"];
     }
     if (name === "decionis.upsert_enforcement_rollout" || name === "upsert_enforcement_rollout") {
@@ -37080,6 +37080,539 @@ function authorizeResourceRead(auth, uri) {
 // ../protocol/src/mcp/McpRoutes.ts
 import { randomUUID as randomUUID2 } from "crypto";
 
+// ../../packages/shared/src/Connectors/ConnectorRegistry.ts
+var SITE = "https://decionis.com";
+var connectors = [
+  // ── Commerce ──────────────────────────────────────────────────────────
+  {
+    // Live Shopify App Store listing (sweep 2026-08-10, also pinned by
+    // apps/web ShopifyAppStore.listingUrl + the distributionSameAs sweep).
+    // Copy scoped to the published listing description.
+    slug: "shopify",
+    name: "Decionis for Shopify",
+    vendor: "Shopify",
+    category: "commerce",
+    status: "production",
+    summary: "Deterministic policy enforcement on refunds, discounts, oversells, and risky orders at Shopify checkout \u2014 every governed action becomes a signed Decision Dossier with a public verification link.",
+    capabilities: [
+      "margin-floor-enforcement",
+      "checkout-policy-enforcement",
+      "signed-decision-dossier"
+    ],
+    decisionsSupported: ["refund", "discount", "oversell", "risky-order"],
+    installation: [
+      {
+        kind: "marketplace",
+        url: "https://apps.shopify.com/decionis-checkout-gate",
+        label: "Shopify App Store"
+      }
+    ],
+    // Shopify predates the marketplace-target program (it is the original
+    // commerce wedge with its own app workspace), so it deliberately has no
+    // `marketplaceTarget` join — /commerce is its owning page.
+    documentation: `${SITE}/commerce`,
+    distribution: { download: false, guidedInstall: true, remoteInstall: false },
+    activation: { method: "marketplace_install", requiresWorkspace: true },
+    presenceSupport: "planned",
+    marketplaceListingId: "shopify-app",
+    providerId: "SHOPIFY"
+  },
+  {
+    // Published in the WordPress.org plugin directory (slug `decionis`,
+    // 1.0.0) — sweep 2026-08-10 via the distributionSameAs verification.
+    // Copy reuses the shared readiness provenance: verified end to end on a
+    // staging store before the listing went live; shadow first,
+    // enforcement opt-in.
+    slug: "woo",
+    name: "Decionis for WooCommerce",
+    vendor: "WooCommerce",
+    category: "commerce",
+    status: "production",
+    version: "1.0.0",
+    summary: "Margin floors enforced at WooCommerce checkout \u2014 Block and classic, using core COGS, with a signed Decision Dossier per evaluation. New stores start in shadow mode; enforcement is opt-in.",
+    capabilities: [
+      "margin-floor-enforcement",
+      "checkout-policy-enforcement",
+      "shadow-mode",
+      "signed-decision-dossier"
+    ],
+    decisionsSupported: ["checkout-order"],
+    installation: [
+      {
+        kind: "marketplace",
+        url: "https://wordpress.org/plugins/decionis/",
+        label: "WordPress.org Plugin Directory"
+      }
+    ],
+    documentation: `${SITE}/marketplace/woo`,
+    distribution: { download: false, guidedInstall: true, remoteInstall: false },
+    activation: { method: "api_key", requiresWorkspace: true },
+    presenceSupport: "planned",
+    marketplaceTarget: "woo",
+    marketplaceListingId: "woo-plugin",
+    providerId: "WOO"
+  },
+  {
+    // eBay approved the app for production and the connector is deployed and
+    // marketplace-account-deletion compliant; the first read-only Fulfillment
+    // probe passed against a live seller account (docs/marketplace/ebay/
+    // evidence/latest.json). No public eBay listing directory exists, so the
+    // channel is the guided OAuth connect — and enforcement stays honest:
+    // shadow dossiers today, write-scope approval pending.
+    slug: "ebay",
+    name: "Decionis for eBay",
+    vendor: "eBay",
+    category: "commerce",
+    status: "installable",
+    summary: "Margin and promo-hygiene guardrails for eBay Sell-API listings, orders, and promotions \u2014 eBay OAuth connect, production-approved, shadow-mode dossiers with enforcement pending write-scope approval.",
+    capabilities: ["margin-guardrails", "promo-hygiene", "shadow-mode", "signed-decision-dossier"],
+    decisionsSupported: ["listing-change", "order-fulfillment", "promotion"],
+    installation: [
+      {
+        kind: "guided",
+        url: `${SITE}/marketplace/ebay`,
+        label: "eBay OAuth connect (guided)"
+      }
+    ],
+    documentation: `${SITE}/marketplace/ebay`,
+    verification: {
+      validatedBy: "eBay production approval + Decionis live verification",
+      evidence: "eBay approved the app for production; read-only Fulfillment probe verified against a live seller account (docs/marketplace/ebay/evidence/latest.json, deployment 2026-07-14).",
+      lastValidated: "2026-07-14"
+    },
+    distribution: { download: false, guidedInstall: true, remoteInstall: false },
+    activation: { method: "oauth", requiresWorkspace: true },
+    presenceSupport: "planned",
+    marketplaceTarget: "ebay",
+    providerId: "EBAY"
+  },
+  {
+    // Passed ALL Adobe Commerce Marketplace technical review phases (SID
+    // qv4l7d2ak6): automated EQP 2026-07-08, full technical-review
+    // confirmation received 2026-08-10 (tested by Adobe on Magento 2.4.9
+    // EE + CE, PHP 8.5.5). Marketplace release awaits the remaining
+    // marketing review, and the gate has not been validated against a live
+    // merchant store — so no channels yet; the customer-deployable kit
+    // ships next (docs/claims DECIONIS-CLM-022).
+    slug: "adobe-commerce",
+    name: "Decionis Connector for Adobe Commerce",
+    vendor: "Adobe",
+    category: "commerce",
+    status: "validated",
+    version: "1.0.0",
+    summary: "Synchronous checkout-webhook enforcement for Adobe Commerce / Magento \u2014 halts a margin-breaching order (op:exception) or lets it through, failing open on any engine error, with promo-hygiene checks and federated signed Decision Dossiers.",
+    capabilities: [
+      "margin-floor-enforcement",
+      "checkout-policy-enforcement",
+      "promo-hygiene",
+      "fail-open-checkout-gate",
+      "signed-decision-dossier"
+    ],
+    decisionsSupported: ["checkout-order", "pricing-change", "promotion"],
+    installation: [
+      {
+        // The kit page hosts the reviewed composer module + checksum,
+        // manifest, and SBOM — shipped in the same change that makes the URL
+        // resolve (rule 1.1 by construction).
+        kind: "hosted_download",
+        url: `${SITE}/marketplace/adobe-commerce/connector-kit`,
+        label: "Connector kit (guided deployment)"
+      }
+    ],
+    package: {
+      artifact: "/marketplace/adobe-commerce/connector-kit/decionis-module-checkout-guardrail-1.0.0.zip",
+      sha256Path: "/marketplace/adobe-commerce/connector-kit/decionis-module-checkout-guardrail-1.0.0.sha256.txt",
+      manifestPath: "/marketplace/adobe-commerce/connector-kit/manifest.json",
+      sbomPath: "/marketplace/adobe-commerce/connector-kit/SBOM.json",
+      format: "magento2-module"
+    },
+    documentation: `${SITE}/marketplace/adobe-commerce`,
+    verification: {
+      validatedBy: "Adobe Commerce Marketplace technical review (EQP)",
+      evidence: "Passed all technical review phases (SID qv4l7d2ak6): automated EQP pass 2026-07-08, full technical-review confirmation 2026-08-10, tested by Adobe on Magento 2.4.9 Enterprise + Community Edition (PHP 8.5.5). Not yet validated against a live merchant store.",
+      lastValidated: "2026-08-10"
+    },
+    distribution: { download: true, guidedInstall: false, remoteInstall: false },
+    activation: { method: "enrollment_token", requiresWorkspace: true },
+    presenceSupport: "planned",
+    marketplaceTarget: "adobe-commerce",
+    providerId: "ADOBE_COMMERCE"
+  },
+  {
+    // SP-API connector built and unit-tested; shadow-mode first while live
+    // seller validation completes (homepage Beta tile is the owning copy).
+    slug: "amazon",
+    name: "Decionis for Amazon",
+    vendor: "Amazon",
+    category: "commerce",
+    status: "validated",
+    summary: "Margin and pricing guardrails for Amazon SP-API listings and orders \u2014 Login with Amazon connect, shadow-mode first while live seller validation completes.",
+    capabilities: ["margin-guardrails", "shadow-mode", "signed-decision-dossier"],
+    decisionsSupported: ["listing-change", "order"],
+    installation: [],
+    documentation: `${SITE}/marketplace/amazon`,
+    distribution: { download: false, guidedInstall: false, remoteInstall: false },
+    activation: { method: "oauth", requiresWorkspace: true },
+    presenceSupport: "planned",
+    marketplaceTarget: "amazon",
+    providerId: "AMAZON"
+  },
+  {
+    // Post-purchase fulfillment circuit breaker — OAuth + refresh, signed
+    // Open API, webhook intake/verification, margin gate, Ship-Package
+    // release built and unit-tested; TikTok App Store review not submitted
+    // (shared readiness provenance).
+    slug: "tiktok",
+    name: "Decionis for TikTok Shop",
+    vendor: "TikTok Shop",
+    category: "commerce",
+    status: "validated",
+    summary: "Post-purchase fulfillment circuit breaker for TikTok Shop \u2014 orders clear a margin gate before Ship-Package release, with signed Decision Dossiers per governed order.",
+    capabilities: ["fulfillment-circuit-breaker", "margin-guardrails", "signed-decision-dossier"],
+    decisionsSupported: ["order-fulfillment"],
+    installation: [],
+    documentation: `${SITE}/marketplace/tiktok`,
+    distribution: { download: false, guidedInstall: false, remoteInstall: false },
+    activation: { method: "oauth", requiresWorkspace: true },
+    presenceSupport: "planned",
+    marketplaceTarget: "tiktok",
+    providerId: "TIKTOK_SHOP"
+  },
+  {
+    // Solution Provider OAuth, PO-created webhook intake with HMAC
+    // verification, margin gate, Acknowledge-Order release/hold — built and
+    // unit-tested; Solution Provider approval and live seller verification
+    // remain (shared readiness provenance).
+    slug: "walmart",
+    name: "Decionis for Walmart Marketplace",
+    vendor: "Walmart",
+    category: "commerce",
+    status: "validated",
+    summary: "Post-purchase fulfillment circuit breaker for Walmart Marketplace \u2014 purchase orders clear a margin gate (COGS + referral fee + shipping) before Acknowledge-Order release.",
+    capabilities: ["fulfillment-circuit-breaker", "margin-guardrails", "signed-decision-dossier"],
+    decisionsSupported: ["order-acknowledgement"],
+    installation: [],
+    documentation: `${SITE}/marketplace/walmart`,
+    distribution: { download: false, guidedInstall: false, remoteInstall: false },
+    activation: { method: "oauth", requiresWorkspace: true },
+    presenceSupport: "planned",
+    marketplaceTarget: "walmart",
+    providerId: "WALMART_MARKETPLACE"
+  },
+  {
+    // Vendor Center GOP integration — centralized Mastershop OAuth, durable
+    // order polling, multi-market margin/COD/SLA evaluation, guarded
+    // fulfillment; live Vendor Center verification still required before
+    // enforcement (shared readiness provenance).
+    slug: "jumia",
+    name: "Decionis for Jumia",
+    vendor: "Jumia",
+    category: "commerce",
+    status: "validated",
+    summary: "Guarded fulfillment for Jumia Vendor Center \u2014 multi-market margin, COD, and SLA evaluation before order release, with signed Decision Dossiers per governed order.",
+    capabilities: ["fulfillment-circuit-breaker", "margin-guardrails", "signed-decision-dossier"],
+    decisionsSupported: ["order-fulfillment"],
+    installation: [],
+    documentation: `${SITE}/marketplace/jumia`,
+    distribution: { download: false, guidedInstall: false, remoteInstall: false },
+    activation: { method: "oauth", requiresWorkspace: true },
+    presenceSupport: "planned",
+    marketplaceTarget: "jumia",
+    providerId: "JUMIA"
+  },
+  {
+    // Headless / Open Checkout gate built and unit-tested; not live-store
+    // validated (rotated off the homepage tiles in favour of WooCommerce).
+    slug: "bigcommerce",
+    name: "Decionis for BigCommerce",
+    vendor: "BigCommerce",
+    category: "commerce",
+    status: "validated",
+    summary: "Checkout margin gate for BigCommerce headless and Open Checkout storefronts \u2014 built and unit-tested, pending validation against a live store.",
+    capabilities: ["margin-floor-enforcement", "checkout-policy-enforcement"],
+    decisionsSupported: ["checkout-order"],
+    installation: [],
+    documentation: `${SITE}/marketplace/bigcommerce`,
+    distribution: { download: false, guidedInstall: false, remoteInstall: false },
+    activation: { method: "api_key", requiresWorkspace: true },
+    presenceSupport: "planned",
+    marketplaceTarget: "bigcommerce"
+  },
+  {
+    // Shopware 6 App System handshake, shop-signed webhooks, fail-open
+    // synchronous checkout gate — built and unit-tested, not yet validated
+    // against a live Shopware store (docs/claims DECIONIS-CLM-023).
+    slug: "shopware",
+    name: "Decionis for Shopware",
+    vendor: "Shopware",
+    category: "commerce",
+    status: "validated",
+    summary: "Fail-open synchronous checkout gate for Shopware 6 \u2014 App System registration handshake, shop-signed webhooks, and promo-hygiene checks, pending validation against a live store.",
+    capabilities: [
+      "margin-floor-enforcement",
+      "checkout-policy-enforcement",
+      "promo-hygiene",
+      "fail-open-checkout-gate"
+    ],
+    decisionsSupported: ["checkout-order", "promotion"],
+    installation: [],
+    documentation: `${SITE}/marketplace/shopware`,
+    distribution: { download: false, guidedInstall: false, remoteInstall: false },
+    activation: { method: "api_key", requiresWorkspace: true },
+    presenceSupport: "planned",
+    marketplaceTarget: "shopware"
+  },
+  // ── Enterprise ────────────────────────────────────────────────────────
+  {
+    // SAP PartnerEdge Solution Review approved 2026-06-22 (solution id
+    // 2004368, docs/marketplace/sap/solution-hub-listing.md). The PartnerEdge
+    // solution URL is partner-gated (anonymous fetch 404s — sweep
+    // 2026-08-10), so it is deliberately NOT an install channel here; the
+    // customer-deployable BTP deployment kit ships next. Dual-gate wording
+    // from the owning listing copy.
+    slug: "sap",
+    name: "Decionis Governed Execution Gate for SAP",
+    vendor: "SAP",
+    category: "enterprise",
+    status: "validated",
+    version: "0.1.0",
+    summary: "Dual-gate governed execution for SAP S/4HANA, BTP, and CAP-side workflows \u2014 vendor payment release, procurement approval, and finance controls checked before they execute, with a signed Decision Dossier written back to the governed document.",
+    capabilities: [
+      "dual-gate-execution",
+      "segregation-of-duties",
+      "three-way-match",
+      "s4hana-write-back",
+      "signed-decision-dossier"
+    ],
+    decisionsSupported: [
+      "vendor-payment-release",
+      "procurement-approval",
+      "finance-control-change"
+    ],
+    installation: [
+      {
+        // Customer-deployed BTP kit (curated CAP source, mbt build →
+        // cf deploy) — shipped in the same change that makes the URL resolve
+        // (rule 1.1 by construction).
+        kind: "hosted_download",
+        url: `${SITE}/marketplace/sap/deployment-kit`,
+        label: "SAP BTP deployment kit (customer-deployed)"
+      }
+    ],
+    package: {
+      artifact: "/marketplace/sap/deployment-kit/decionis-sap-deployment-kit-0.1.0.zip",
+      sha256Path: "/marketplace/sap/deployment-kit/decionis-sap-deployment-kit-0.1.0.sha256.txt",
+      manifestPath: "/marketplace/sap/deployment-kit/manifest.json",
+      sbomPath: "/marketplace/sap/deployment-kit/SBOM.json",
+      format: "sap-mta-deployment-kit"
+    },
+    documentation: `${SITE}/marketplace/sap`,
+    verification: {
+      validatedBy: "SAP PartnerEdge Solution Review",
+      evidence: "Solution Review completed and approved 2026-06-22 (SAP PartnerEdge solution id 2004368); SAP Store content listing is the next, contract-gated step.",
+      lastValidated: "2026-06-22"
+    },
+    distribution: { download: true, guidedInstall: false, remoteInstall: false },
+    activation: { method: "enrollment_token", requiresWorkspace: true },
+    presenceSupport: "planned",
+    providerId: "SAP"
+  },
+  {
+    // Scoped app x_dec_decionis (tables, script includes, Flow Designer
+    // verify-intent action, shadow observers, workspace dossier panel,
+    // scoped REST API). Self-attested platform evidence — tenant mapping,
+    // ACLs, live policy-check execution, workflow trigger routing — is
+    // recorded in the packaged evidence exports (docs/marketplace/servicenow
+    // submission checklist, evidence refreshed as of the 2026-08-10 sweep).
+    // Store publication deliberately deferred. The customer-deploy kit
+    // CONTENT exists (full-app update-set XML + coverage manifest + INSTALL
+    // under docs/marketplace/servicenow/connector-kit), but the public
+    // download channel + `installable` flip are gated on a real
+    // dev-instance import validation — a user-owned step; never claim the
+    // install before it passes (rule 1.1 on the install claim itself).
+    slug: "servicenow",
+    name: "Decionis Connector for ServiceNow",
+    vendor: "ServiceNow",
+    category: "enterprise",
+    status: "validated",
+    summary: "Scoped ServiceNow app (x_dec_decionis) that wires Decision Dossiers and Decision Drift evidence into incident, change, and risk-case workflows \u2014 a Flow Designer verify-intent action with shadow-mode observers.",
+    capabilities: [
+      "flow-designer-verify-intent",
+      "shadow-mode",
+      "decision-drift-evidence",
+      "signed-decision-dossier"
+    ],
+    decisionsSupported: ["itsm-change", "incident-action", "risk-case-action"],
+    installation: [],
+    documentation: `${SITE}/marketplace/servicenow`,
+    verification: {
+      validatedBy: "Decionis platform evidence (self-attested)",
+      evidence: "Live vendor-instance evidence exports: tenant mapping, ACLs and ACL-role links, live policy-check execution against the authenticated Decionis API, and workflow trigger routing (docs/marketplace/servicenow, evidence current as of 2026-08-10).",
+      lastValidated: "2026-08-10"
+    },
+    distribution: { download: false, guidedInstall: false, remoteInstall: false },
+    activation: { method: "enrollment_token", requiresWorkspace: true },
+    presenceSupport: "planned",
+    marketplaceTarget: "servicenow",
+    providerId: "SERVICENOW"
+  },
+  {
+    // Customer-deployed starter package (Apex Action Gate, LWC, platform
+    // event, permission set) served as committed zips with checksums;
+    // AppExchange Security Review in progress, so no marketplace channel is
+    // claimed (homepage Beta tile is the owning copy).
+    slug: "salesforce",
+    name: "Decionis Action Gate for Salesforce",
+    vendor: "Salesforce",
+    category: "enterprise",
+    status: "installable",
+    summary: "Pre-execution Action Gate for Salesforce \u2014 Flow, Apex, and Agentforce actions checked before they run (allow / hold / escalate) with signed Decision Dossiers on the record. Customer-deployed starter package, shadow-first rollout.",
+    capabilities: [
+      "pre-execution-action-gate",
+      "shadow-mode",
+      "agentforce-governance",
+      "signed-decision-dossier"
+    ],
+    decisionsSupported: ["flow-action", "apex-action", "agentforce-action"],
+    installation: [
+      {
+        kind: "hosted_download",
+        url: `${SITE}/marketplace/salesforce/starter-package`,
+        label: "Salesforce starter package (customer-deployed)"
+      }
+    ],
+    package: {
+      artifact: "/marketplace/salesforce/starter-package/decionis-salesforce-starter-package.zip",
+      sha256Path: "/marketplace/salesforce/starter-package/decionis-salesforce-starter-package.sha256.txt",
+      format: "salesforce-metadata-source"
+    },
+    documentation: `${SITE}/marketplace/salesforce`,
+    distribution: { download: true, guidedInstall: false, remoteInstall: false },
+    activation: { method: "api_key", requiresWorkspace: true },
+    presenceSupport: "planned",
+    marketplaceTarget: "salesforce",
+    marketplaceListingId: "salesforce-app",
+    providerId: "SALESFORCE"
+  },
+  // ── Automation ────────────────────────────────────────────────────────
+  {
+    // Live Zapier app-directory listing (sweep 2026-08-10: page resolves and
+    // shows the Decionis app with the Create Decision Dossier action).
+    slug: "zapier",
+    name: "Decionis for Zapier",
+    vendor: "Zapier",
+    category: "automation",
+    status: "production",
+    summary: "Create a governed decision and signed Decision Dossier inside any Zap \u2014 OAuth connection, Shadow Mode by default, and idempotent replay for temporary service failures.",
+    capabilities: ["automation-step-governance", "shadow-mode", "signed-decision-dossier"],
+    decisionsSupported: ["automation-step"],
+    installation: [
+      {
+        kind: "marketplace",
+        url: "https://zapier.com/apps/decionis/integrations",
+        label: "Zapier app directory"
+      }
+    ],
+    documentation: `${SITE}/docs/zapier`,
+    distribution: { download: false, guidedInstall: true, remoteInstall: false },
+    activation: { method: "oauth", requiresWorkspace: true },
+    presenceSupport: "planned",
+    marketplaceListingId: "zapier"
+  },
+  {
+    // The native Make app is built with its OAuth on-ramp live, but the Make
+    // listing is private in review — so the installable path today is the
+    // documented HTTP recipe (AutomationConnectors owning copy, status
+    // `preview`).
+    slug: "make",
+    name: "Decionis for Make",
+    vendor: "Make",
+    category: "automation",
+    status: "installable",
+    summary: "Evaluate an Action before the protected module runs \u2014 the native Decionis app is in Make listing review, and the documented HTTP recipe calls the same gate and returns the same signed Decision Dossier today.",
+    capabilities: ["automation-step-governance", "signed-decision-dossier"],
+    decisionsSupported: ["automation-step"],
+    installation: [
+      {
+        kind: "docs",
+        url: `${SITE}/docs/automation-connectors#make`,
+        label: "HTTP recipe (native app listing in review)"
+      }
+    ],
+    documentation: `${SITE}/docs/automation-connectors#make`,
+    distribution: { download: false, guidedInstall: false, remoteInstall: false },
+    activation: { method: "oauth", requiresWorkspace: true },
+    presenceSupport: "planned"
+  },
+  {
+    // Community node published on npm (registry sweep 2026-08-10:
+    // n8n-nodes-decionis@0.1.0).
+    slug: "n8n",
+    name: "Decionis for n8n",
+    vendor: "n8n",
+    category: "automation",
+    status: "production",
+    version: "0.1.0",
+    summary: "Every automation step asks permission before it executes \u2014 install the n8n community node from npm, or start from the HTTP Request recipe and four importable example workflows.",
+    capabilities: ["automation-step-governance", "signed-decision-dossier"],
+    decisionsSupported: ["automation-step"],
+    installation: [
+      {
+        kind: "npm",
+        url: "https://www.npmjs.com/package/n8n-nodes-decionis",
+        label: "n8n community node on npm"
+      }
+    ],
+    documentation: `${SITE}/docs/automation-connectors#n8n`,
+    distribution: { download: false, guidedInstall: false, remoteInstall: false },
+    activation: { method: "api_key", requiresWorkspace: true },
+    presenceSupport: "planned"
+  },
+  // ── Platform ──────────────────────────────────────────────────────────
+  {
+    // The standard webhook path into the protocol — the same Gate 1
+    // admission check, any backend (owning copy: ERP & Webhooks tile +
+    // /docs/webhooks).
+    // `installable`, not `production`: the webhook path is live product
+    // capability, but there is no public marketplace/registry listing to
+    // install it from — you wire it from the documented recipe.
+    slug: "webhooks",
+    name: "ERP & Webhooks",
+    vendor: "Any system of record",
+    category: "platform",
+    status: "installable",
+    summary: "Cross-verify cost basis and inventory against your system of record via standard webhooks \u2014 the same Gate 1 admission check, any backend.",
+    capabilities: ["erp-cross-verification", "webhook-intake"],
+    decisionsSupported: ["cost-basis-verification", "inventory-verification"],
+    installation: [
+      { kind: "docs", url: `${SITE}/docs/webhooks`, label: "Webhook integration guide" }
+    ],
+    documentation: `${SITE}/docs/webhooks`,
+    distribution: { download: false, guidedInstall: false, remoteInstall: false },
+    activation: { method: "api_key", requiresWorkspace: true },
+    presenceSupport: "planned",
+    providerId: "WEBHOOK"
+  }
+];
+var ConnectorRegistry = class {
+  static connectors = connectors;
+  static bySlug(slug) {
+    return connectors.find((connector) => connector.slug === slug);
+  }
+  static byCategory(category) {
+    return connectors.filter((connector) => connector.category === category);
+  }
+  static byStatus(status) {
+    return connectors.filter((connector) => connector.status === status);
+  }
+  static slugs() {
+    return connectors.map((connector) => connector.slug);
+  }
+};
+var CONNECTOR_REGISTRY = ConnectorRegistry.connectors;
+var getConnector = ConnectorRegistry.bySlug;
+var CONNECTOR_SLUGS = ConnectorRegistry.slugs();
+
 // ../protocol/src/mcp/McpResources.ts
 var McpResources = class {
   static buildStaticResources(publicBaseUrl, serviceName, serviceVersion) {
@@ -37119,6 +37652,13 @@ var McpResources = class {
         description: "Available vertical packs and workflow overlays exposed by Decionis Protocol.",
         mimeType: "application/json"
       },
+      {
+        uri: "decionis://connectors/registry",
+        name: "connector_registry",
+        title: "Decionis Connector Registry",
+        description: "Every Decionis connector with availability status, install channels, governed actions, and verification evidence \u2014 the same registry that generates decionis.com/integrations.",
+        mimeType: "application/json"
+      },
       {
         uri: "decionis://protocol/webex-mcp-registration",
         name: "webex_mcp_registration",
@@ -37341,7 +37881,8 @@ var McpResources = class {
             "resources/read -> decionis://protocol/webex-agent-intent-contract",
             "resources/read -> decionis://protocol/webex-reviewer-scenarios",
             "tools/call -> decionis.evaluate_webex_agent_intent",
-            "tools/call -> decionis.get_decision_dossier"
+            "tools/call -> decionis.get_decision_dossier",
+            "tools/call -> decionis.get_decision_chain"
           ]
         }
       };
@@ -37367,10 +37908,34 @@ var McpResources = class {
       });
       return { mimeType: "application/json", value: response.body };
     }
+    if (uri === "decionis://connectors/registry") {
+      return {
+        mimeType: "application/json",
+        value: {
+          registry: "decionis-connectors",
+          statuses: {
+            production: "generally available today through a live public channel",
+            installable: "customer-deployable today outside public marketplaces",
+            validated: "built and verified (see each connector's verification); downloadable when a package is listed",
+            planned: "roadmap; never carries install channels"
+          },
+          connectors: CONNECTOR_REGISTRY,
+          human_catalogue: "https://decionis.com/integrations"
+        }
+      };
+    }
     const parsed = new URL(uri);
     if (parsed.protocol !== "decionis:") {
       throw new Error(`Unsupported resource URI '${uri}'`);
     }
+    if (parsed.hostname === "connectors") {
+      const slug = decodeURIComponent(parsed.pathname.replace(/^\//, ""));
+      const connector = getConnector(slug);
+      if (!connector) {
+        throw new Error(`Unknown connector '${slug}'`);
+      }
+      return { mimeType: "application/json", value: connector };
+    }
     if (parsed.hostname === "marketplaces" && parsed.pathname.startsWith("/targets/")) {
       const target = decodeURIComponent(parsed.pathname.replace("/targets/", ""));
       const response = await invokeProtocolRoute(app, {
@@ -37640,7 +38205,7 @@ var McpTools = class {
     return cart && typeof cart.amount === "number" ? cart.amount : void 0;
   }
   static buildTools(app) {
-    return [
+    const tools = [
       {
         name: "decionis.evaluate_decision",
         aliases: ["evaluate_decision"],
@@ -37896,6 +38461,37 @@ var McpTools = class {
           return response.body;
         }
       },
+      {
+        name: "decionis.get_decision_chain",
+        aliases: ["get_decision_chain"],
+        title: "Get Decision Chain",
+        description: "Read the workflow lineage for linked Decionis decisions: the chain summary of evaluations, their outcomes, and the dossiers each sealed. The read-only status view for a multi-step workflow an agent is participating in.",
+        inputSchema: {
+          type: "object",
+          required: ["org_id", "chain_id"],
+          additionalProperties: false,
+          properties: {
+            org_id: { type: "string", description: "Org UUID." },
+            chain_id: { type: "string", description: "Decision chain UUID." }
+          }
+        },
+        outputSchema: { type: "object", additionalProperties: true },
+        async handler(args) {
+          const orgId = asString(args.org_id);
+          const chainId = asString(args.chain_id);
+          if (!orgId || !chainId) {
+            throw new Error("org_id and chain_id are required");
+          }
+          const response = await invokeProtocolRoute(app, {
+            method: "GET",
+            url: `/v1/protocol/decision-chains/${encodeURIComponent(chainId)}?org_id=${encodeURIComponent(orgId)}`
+          });
+          if (!response.ok) {
+            throw new Error(`Decision chain lookup failed (${response.statusCode})`);
+          }
+          return response.body;
+        }
+      },
       {
         name: "decionis.list_enforcement_rollouts",
         aliases: ["list_enforcement_rollouts"],
@@ -38114,6 +38710,29 @@ var McpTools = class {
         }
       }
     ];
+    const readOnlyTools = /* @__PURE__ */ new Set([
+      "decionis.get_decision_dossier",
+      "decionis.get_decision_chain",
+      "decionis.list_enforcement_rollouts",
+      "decionis.list_marketplace_targets",
+      "decionis.get_marketplace_target",
+      "decionis.list_marketplace_readiness",
+      "decionis.list_vertical_packs",
+      "decionis.resolve_vertical_pack"
+    ]);
+    const idempotentWriteTools = /* @__PURE__ */ new Set(["decionis.upsert_enforcement_rollout"]);
+    return tools.map((tool) => {
+      const readOnly = readOnlyTools.has(tool.name);
+      return {
+        ...tool,
+        annotations: {
+          readOnlyHint: readOnly,
+          destructiveHint: false,
+          idempotentHint: readOnly || idempotentWriteTools.has(tool.name),
+          openWorldHint: false
+        }
+      };
+    });
   }
   static buildTextToolResult(value, options) {
     const text = toPrettyText(value);
@@ -38167,6 +38786,37 @@ function findTool(tools, name) {
 }
 
 // ../protocol/src/mcp/McpRoutes.ts
+async function recordTelemetry(app, sink, event) {
+  if (!sink) return;
+  try {
+    await sink.record(event);
+  } catch (err) {
+    app.log.warn({ err, event: event.event }, "MCP telemetry write failed");
+  }
+}
+function canonicalAuthorizationOutcome(value) {
+  const record = asRecord(value);
+  const raw = asString(record?.outcome) ?? asString(record?.decision) ?? asString(record?.verdict);
+  if (!raw) return null;
+  switch (raw.trim().toUpperCase()) {
+    case "ALLOW":
+    case "APPROVE":
+    case "AUTO_APPROVE":
+      return "ALLOW";
+    case "BLOCK":
+    case "REJECT":
+    case "AUTO_REJECT":
+      return "BLOCK";
+    case "ESCALATE":
+      return "ESCALATE";
+    case "REVIEW":
+    case "RESTRAIN":
+    case "REQUIRE_REVIEW":
+      return "REVIEW";
+    default:
+      return null;
+  }
+}
 function buildInitializeResult(serviceName, serviceVersion) {
   return {
     protocolVersion: MCP_DEFAULT_PROTOCOL_VERSION,
@@ -38180,7 +38830,7 @@ function buildInitializeResult(serviceName, serviceVersion) {
       title: "Decionis Protocol MCP",
       version: serviceVersion
     },
-    instructions: "Use Decionis Protocol as the deterministic execution-governance MCP server. Encode policy with evaluate_decision, stage enforcement with upsert_enforcement_rollout, and verify evidence through Decision Dossiers and audit-linked resources."
+    instructions: "Use Decionis Protocol to evaluate a proposed action before execution and inspect its signed governance evidence. Evaluation tools record Decionis decisions but never perform the downstream mutation. Use read-only dossier, chain, marketplace, and vertical tools for inspection."
   };
 }
 async function handleJsonRpcRequest(app, requestBody, options) {
@@ -38218,6 +38868,16 @@ async function handleJsonRpcRequest(app, requestBody, options) {
     }
     const requestedVersion = asString(params.protocolVersion);
     const negotiatedVersion = requestedVersion && MCP_PROTOCOL_VERSIONS.includes(requestedVersion) ? requestedVersion : MCP_DEFAULT_PROTOCOL_VERSION;
+    const clientInfo = asRecord(params.clientInfo);
+    await recordTelemetry(app, options.telemetry, {
+      event: "connection_succeeded",
+      connectionId: options.connectionId,
+      clientName: asString(clientInfo?.name),
+      clientVersion: asString(clientInfo?.version),
+      protocolVersion: negotiatedVersion,
+      authMode: options.auth?.kind ?? "none",
+      statusCode: 200
+    });
     return {
       statusCode: 200,
       payload: jsonRpcSuccess(id, {
@@ -38233,6 +38893,12 @@ async function handleJsonRpcRequest(app, requestBody, options) {
     case "ping":
       return { statusCode: 200, payload: jsonRpcSuccess(id, {}) };
     case "tools/list":
+      await recordTelemetry(app, options.telemetry, {
+        event: "tools_listed",
+        connectionId: options.connectionId,
+        authMode: options.auth?.kind ?? "none",
+        statusCode: 200
+      });
       return {
         statusCode: 200,
         payload: jsonRpcSuccess(id, {
@@ -38241,7 +38907,8 @@ async function handleJsonRpcRequest(app, requestBody, options) {
             title: tool.title,
             description: tool.description,
             inputSchema: tool.inputSchema,
-            ...tool.outputSchema ? { outputSchema: tool.outputSchema } : {}
+            ...tool.outputSchema ? { outputSchema: tool.outputSchema } : {},
+            annotations: tool.annotations
           }))
         })
       };
@@ -38260,15 +38927,61 @@ async function handleJsonRpcRequest(app, requestBody, options) {
           payload: jsonRpcError(id, -32601, `Unknown tool '${name}'`)
         };
       }
+      const toolStartedAt = process.hrtime.bigint();
+      await recordTelemetry(app, options.telemetry, {
+        event: "tool_called",
+        connectionId: options.connectionId,
+        toolName: tool.name,
+        authMode: options.auth?.kind ?? "none"
+      });
       const args = asRecord(params.arguments) ?? {};
       const authError = authorizeToolInvocation(options.auth, name, args);
       if (authError) {
+        await recordTelemetry(app, options.telemetry, {
+          event: "authorization_outcome",
+          connectionId: options.connectionId,
+          toolName: tool.name,
+          outcome: "DENIED",
+          authMode: options.auth?.kind ?? "none",
+          statusCode: 403,
+          durationMs: durationMs(toolStartedAt)
+        });
+        await recordTelemetry(app, options.telemetry, {
+          event: "tool_failed",
+          connectionId: options.connectionId,
+          toolName: tool.name,
+          outcome: "DENIED",
+          authMode: options.auth?.kind ?? "none",
+          statusCode: 403,
+          durationMs: durationMs(toolStartedAt)
+        });
         return {
           statusCode: 403,
           payload: jsonRpcError(id, authError.code, authError.message)
         };
       }
       const result = await handleToolCall(tool, args);
+      const outcome = canonicalAuthorizationOutcome(result.structuredContent);
+      await recordTelemetry(app, options.telemetry, {
+        event: result.isError ? "tool_failed" : "tool_succeeded",
+        connectionId: options.connectionId,
+        toolName: tool.name,
+        outcome,
+        authMode: options.auth?.kind ?? "none",
+        statusCode: 200,
+        durationMs: durationMs(toolStartedAt)
+      });
+      if (outcome) {
+        await recordTelemetry(app, options.telemetry, {
+          event: "authorization_outcome",
+          connectionId: options.connectionId,
+          toolName: tool.name,
+          outcome,
+          authMode: options.auth?.kind ?? "none",
+          statusCode: 200,
+          durationMs: durationMs(toolStartedAt)
+        });
+      }
       return {
         statusCode: 200,
         payload: jsonRpcSuccess(id, result)
@@ -38284,6 +38997,13 @@ async function handleJsonRpcRequest(app, requestBody, options) {
         statusCode: 200,
         payload: jsonRpcSuccess(id, {
           resourceTemplates: [
+            {
+              uriTemplate: "decionis://connectors/{slug}",
+              name: "connector_detail",
+              title: "Connector Detail",
+              description: "Read one Connector Registry row: status, install channels, governed actions, verification.",
+              mimeType: "application/json"
+            },
             {
               uriTemplate: "decionis://marketplaces/targets/{target}",
               name: "marketplace_target_detail",
@@ -38445,6 +39165,11 @@ async function handleMcpHttpRequest(app, req, reply, options) {
   const auth = await authenticateMcpRequest(req, authLookup);
   const authDurationMs = durationMs(authStartedAt);
   if (!auth && isAuthenticationRequired(authLookup)) {
+    await recordTelemetry(app, options.telemetry ?? null, {
+      event: "authentication_failed",
+      statusCode: 401,
+      durationMs: authDurationMs
+    });
     const maybeId = asRecord(req.body)?.id;
     const id = typeof maybeId === "string" || typeof maybeId === "number" ? maybeId : null;
     reply.header(
@@ -38454,6 +39179,10 @@ async function handleMcpHttpRequest(app, req, reply, options) {
         stages: { auth_ms: authDurationMs }
       })
     );
+    reply.header(
+      "www-authenticate",
+      `Bearer resource_metadata="${options.publicBaseUrl}/.well-known/oauth-protected-resource", error="invalid_token"`
+    );
     return reply.code(401).send(jsonRpcError(id, -32001, "Unauthorized MCP request"));
   }
   if (Array.isArray(req.body)) {
@@ -38468,7 +39197,35 @@ async function handleMcpHttpRequest(app, req, reply, options) {
   }
   if (isLegacyToolCall(req.body)) {
     const rpcStartedAt2 = process.hrtime.bigint();
+    const connectionId2 = asString(req.headers["mcp-session-id"]);
+    await recordTelemetry(app, options.telemetry ?? null, {
+      event: "tool_called",
+      connectionId: connectionId2,
+      toolName: req.body.tool_name,
+      authMode: auth?.kind ?? "none"
+    });
     const payload = await handleLegacyToolCall(app, auth, req.body);
+    const outcome = canonicalAuthorizationOutcome(payload.output);
+    await recordTelemetry(app, options.telemetry ?? null, {
+      event: payload.is_error || payload.error ? "tool_failed" : "tool_succeeded",
+      connectionId: connectionId2,
+      toolName: req.body.tool_name,
+      outcome,
+      authMode: auth?.kind ?? "none",
+      statusCode: 200,
+      durationMs: durationMs(rpcStartedAt2)
+    });
+    if (outcome) {
+      await recordTelemetry(app, options.telemetry ?? null, {
+        event: "authorization_outcome",
+        connectionId: connectionId2,
+        toolName: req.body.tool_name,
+        outcome,
+        authMode: auth?.kind ?? "none",
+        statusCode: 200,
+        durationMs: durationMs(rpcStartedAt2)
+      });
+    }
     reply.header(
       "server-timing",
       buildServerTimingHeader({
@@ -38493,13 +39250,21 @@ async function handleMcpHttpRequest(app, req, reply, options) {
     return reply.code(400).send(jsonRpcError(null, -32600, "JSON-RPC request body required"));
   }
   const rpcStartedAt = process.hrtime.bigint();
+  const requestedMethod = asString(requestBody.method);
+  const incomingSession = asString(req.headers["mcp-session-id"]);
+  const connectionId = requestedMethod === "initialize" ? randomUUID2() : incomingSession;
   const result = await handleJsonRpcRequest(app, requestBody, {
     publicBaseUrl: options.publicBaseUrl,
     serviceName: options.serviceName,
     serviceVersion: options.serviceVersion,
     auth,
-    authLookup
+    authLookup,
+    telemetry: options.telemetry ?? null,
+    connectionId
   });
+  if (requestedMethod === "initialize" && result.statusCode === 200) {
+    reply.header("mcp-session-id", connectionId);
+  }
   reply.header(
     "server-timing",
     buildServerTimingHeader({
@@ -38529,8 +39294,21 @@ function registerProtocolMcpRoutes(app, options) {
     endpoint: `${publicBaseUrl}/v1/protocol/mcp`,
     endpoint_aliases: MCP_HTTP_PATHS,
     supported_protocol_versions: [...MCP_PROTOCOL_VERSIONS],
-    auth
+    auth,
+    oauth: {
+      protected_resource_metadata: `${publicBaseUrl}/.well-known/oauth-protected-resource`,
+      authorization_server_metadata: "https://api.decionis.com/.well-known/oauth-authorization-server"
+    }
   };
+  const oauthProtectedResource = {
+    resource: `${publicBaseUrl}/mcp`,
+    authorization_servers: ["https://api.decionis.com"],
+    bearer_methods_supported: ["header"],
+    scopes_supported: ["decision:read", "decision:run", "decision:write"],
+    resource_documentation: "https://decionis.com/docs/protocol-mcp"
+  };
+  app.get("/.well-known/oauth-protected-resource", async () => oauthProtectedResource);
+  app.get("/.well-known/oauth-protected-resource/mcp", async () => oauthProtectedResource);
   for (const path2 of MCP_HTTP_PATHS) {
     app.get(path2, async () => metadata);
     app.delete(path2, async (_req, reply) => reply.code(204).send());
@@ -38540,7 +39318,8 @@ function registerProtocolMcpRoutes(app, options) {
         publicBaseUrl,
         serviceName: options.serviceName,
         serviceVersion: options.serviceVersion,
-        authLookup
+        authLookup,
+        telemetry: options.telemetry ?? null
       })
     );
   }
@@ -46731,7 +47510,8 @@ function buildDecisionDossierPersistedProofBundle(input) {
 }
 
 // ../protocol/src/support/PanDetection.ts
-var PanDetection = class {
+var PanDetection = class _PanDetection {
+  static UUID_SHAPE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
   static toDigits(value) {
     if (typeof value !== "string" && typeof value !== "number") return null;
     const digits = String(value).replace(/\D/g, "");
@@ -46753,12 +47533,32 @@ var PanDetection = class {
     }
     return sum % 10 === 0;
   }
+  /**
+   * Candidate card numbers inside a value: runs of digits separated only by the
+   * characters a card number is actually written with (spaces and dashes).
+   *
+   * Splitting on everything else is the whole point. Stripping every non-digit
+   * from the value instead — which this used to do — welds unrelated digits
+   * together across letters and punctuation, and a UUID is the case that bites:
+   * discard its letters and roughly 4% of them are a 13-to-19-digit string that
+   * satisfies Luhn. Since we put UUIDs into decision context ourselves (the
+   * duplicate-payment fact carries the prior dossier id), that turned a
+   * legitimate duplicate-payment decision into "raw PAN-like value detected"
+   * about one time in twenty-five.
+   */
+  static panCandidates(value) {
+    if (typeof value === "number") return [String(value).replace(/[^\d]/g, "")];
+    if (typeof value !== "string") return [];
+    if (_PanDetection.UUID_SHAPE.test(value.trim())) return [];
+    const runs = value.match(/(?<![0-9A-Za-z])\d[\d \-]*\d(?![0-9A-Za-z])/g) ?? [];
+    return runs.map((run) => run.replace(/[^\d]/g, "")).filter((digits) => digits.length > 0);
+  }
   static looksLikeRawPan(value) {
-    const digits = toDigits(value);
-    if (!digits) return false;
-    if (digits.length < 13 || digits.length > 19) return false;
-    if (/^(\d)\1+$/.test(digits)) return false;
-    return isLuhnValid(digits);
+    return _PanDetection.panCandidates(value).some((digits) => {
+      if (digits.length < 13 || digits.length > 19) return false;
+      if (/^(\d)\1+$/.test(digits)) return false;
+      return isLuhnValid(digits);
+    });
   }
   static findRawPanPath(value, path2, visited = /* @__PURE__ */ new Set()) {
     if (looksLikeRawPan(value)) return path2;
@@ -46779,9 +47579,6 @@ var PanDetection = class {
     return null;
   }
 };
-function toDigits(value) {
-  return PanDetection.toDigits(value);
-}
 function isLuhnValid(digits) {
   return PanDetection.isLuhnValid(digits);
 }
@@ -52057,10 +52854,15 @@ var readiness = {
   "adobe-commerce": {
     target: "adobe-commerce",
     protocol_capture: "CAPTURED",
+    // adapter_state stays BUILDING deliberately: Adobe's Marketplace
+    // technical review passed in full (all phases, SID qv4l7d2ak6 — automated
+    // EQP 2026-07-08, final confirmation 2026-08-10, tested on Magento 2.4.9
+    // EE + CE / PHP 8.5.5), but the gate has not yet run against a live
+    // merchant store, and that is the bar LIVE means here.
     adapter_state: "BUILDING",
-    docs_state: "PLANNED",
+    docs_state: "BUILDING",
     launch_state: "PLANNED",
-    next_milestone: "Shadow\u2192enforce control shipped; onboard a live Adobe Commerce store in shadow, verify the checkout gate, then promote it to enforcement"
+    next_milestone: "All Adobe Marketplace technical review phases passed (SID qv4l7d2ak6); ship the customer-deployable connector kit, onboard a live Adobe Commerce store in shadow, verify the checkout gate, then promote it to enforcement"
   },
   shopware: {
     target: "shopware",
@@ -52081,10 +52883,16 @@ var readiness = {
   woo: {
     target: "woo",
     protocol_capture: "CAPTURED",
-    adapter_state: "BUILDING",
-    docs_state: "PLANNED",
-    launch_state: "PLANNED",
-    next_milestone: "Verify native authorization plus Block and classic checkout parity against a live WooCommerce store before enabling enforcement"
+    // Truth-up 2026-08-10: the plugin is published in the WordPress.org
+    // directory (slug `decionis`, 1.0.0) and Block + classic checkout,
+    // core COGS, HPOS order CRUD, and the signed dossier were verified end
+    // to end on a staging store — including an admin-enabled ENFORCEMENT
+    // block — before the listing went live (shared readiness provenance).
+    // The previous PLANNED states predated the public listing.
+    adapter_state: "LIVE",
+    docs_state: "LIVE",
+    launch_state: "BUILDING",
+    next_milestone: "WordPress.org listing is live and self-serve; grow installs and collect the first live-store enforcement evidence for the listing's proof section"
   },
   jumia: {
     target: "jumia",
@@ -52786,7 +53594,8 @@ function buildProtocolApp(options) {
   registerProtocolMcpRoutes(app, {
     serviceName: PROTOCOL_SERVICE,
     serviceVersion: PROTOCOL_VERSION,
-    authLookup: options?.mcpAuthLookup ?? null
+    authLookup: options?.mcpAuthLookup ?? null,
+    telemetry: options?.mcpTelemetry ?? null
   });
   const executionAuthority = createExecutionGatingService(options?.executionGating);
   registerExecutionGatingRoutes(app, {