@everfur/cli 0.1.0 → 0.2.1

package/dist/chunk-KQZ6ZXL7.js

@@ -1,3994 +0,0 @@
-#!/usr/bin/env node
-import { statSync, readFileSync } from 'fs';
-import { isAbsolute, resolve, join } from 'path';
-import { parse } from 'yaml';
-import Ajv2020 from 'ajv/dist/2020.js';
-import addFormats from 'ajv-formats';
-import { createHash } from 'crypto';
-
-var nodeFileSystem = Object.freeze({
-  readFile(path) {
-    try {
-      const stat = statSync(path);
-      if (!stat.isFile()) return null;
-      return readFileSync(path, "utf8");
-    } catch {
-      return null;
-    }
-  },
-  exists(path) {
-    try {
-      statSync(path);
-      return true;
-    } catch {
-      return false;
-    }
-  },
-  isDirectory(path) {
-    try {
-      return statSync(path).isDirectory();
-    } catch {
-      return false;
-    }
-  }
-});
-
-// src/http/transport.ts
-var IDEMPOTENT_METHODS = Object.freeze(["GET", "DELETE"]);
-var TransportError = class extends Error {
-  kind;
-  constructor(kind, message) {
-    super(message);
-    this.name = "TransportError";
-    this.kind = kind;
-  }
-};
-function isIdempotent(method) {
-  return IDEMPOTENT_METHODS.includes(method);
-}
-
-// src/http/fetch-transport.ts
-var fetchTransport = Object.freeze({
-  async send(request) {
-    let response;
-    try {
-      response = await fetch(request.url, {
-        method: request.method,
-        headers: { ...request.headers },
-        body: request.body,
-        redirect: "error",
-        signal: AbortSignal.timeout(request.timeoutMs)
-      });
-    } catch (cause) {
-      const name = cause instanceof Error ? cause.name : "";
-      if (name === "TimeoutError" || name === "AbortError") {
-        throw new TransportError("timeout", `no response within ${request.timeoutMs}ms`);
-      }
-      throw new TransportError("network", cause instanceof Error ? cause.message : String(cause));
-    }
-    let body;
-    try {
-      body = await response.text();
-    } catch (cause) {
-      throw new TransportError("network", cause instanceof Error ? cause.message : String(cause));
-    }
-    const headers = {};
-    response.headers.forEach((value, key) => {
-      headers[key.toLowerCase()] = value;
-    });
-    return Object.freeze({ status: response.status, headers: Object.freeze(headers), body });
-  }
-});
-
-// src/time/clock.ts
-var systemClock = Object.freeze({
-  sleep(milliseconds) {
-    return new Promise((resolve2) => {
-      setTimeout(resolve2, milliseconds);
-    });
-  }
-});
-function createRecordingClock() {
-  const waits = [];
-  return {
-    waits,
-    sleep(milliseconds) {
-      waits.push(milliseconds);
-      return Promise.resolve();
-    }
-  };
-}
-
-// src/config/endpoint.ts
-var BASE_URL_ENV_VAR = "EVERFUR_API_BASE_URL";
-var API_PREFIX = "/api/v1";
-function stripTrailingSlashes(value) {
-  let end = value.length;
-  while (end > 0 && value[end - 1] === "/") end -= 1;
-  return value.slice(0, end);
-}
-function resolveEndpoint(flagValue, env) {
-  const fromEnv = (env[BASE_URL_ENV_VAR] ?? "").trim();
-  const raw = flagValue !== null ? flagValue.trim() : fromEnv;
-  const source = flagValue !== null ? "flag" : "env";
-  if (raw.length === 0) {
-    return {
-      ok: false,
-      errors: [
-        "no API base URL was configured",
-        `pass --base-url <url> or export ${BASE_URL_ENV_VAR}`
-      ]
-    };
-  }
-  let parsed;
-  try {
-    parsed = new URL(raw);
-  } catch {
-    return { ok: false, errors: [`--base-url is not a URL: ${raw}`] };
-  }
-  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
-    return { ok: false, errors: [`--base-url must be http or https, not ${parsed.protocol}`] };
-  }
-  const normalised = stripTrailingSlashes(`${parsed.origin}${parsed.pathname}`);
-  return {
-    ok: true,
-    endpoint: Object.freeze({
-      baseUrl: normalised,
-      prefixIncluded: normalised.endsWith(API_PREFIX),
-      source
-    })
-  };
-}
-function apiUrl(endpoint, path) {
-  const suffix = path.startsWith("/") ? path : `/${path}`;
-  return endpoint.prefixIncluded ? `${endpoint.baseUrl}${suffix}` : `${endpoint.baseUrl}${API_PREFIX}${suffix}`;
-}
-
-// src/config/credentials.ts
-var REDACTED = "[redacted]";
-var PARTNER_KEY = Object.freeze({
-  envVar: "EVERFUR_PARTNER_KEY",
-  prefix: "pk_live_",
-  // Both prefixes are 8 characters, so one expected length still covers either.
-  alsoAccepts: Object.freeze(["pk_test_"]),
-  length: "pk_live_".length + 64,
-  summary: "Publishable partner key (pk_live_... on production, pk_test_... on a sandbox). Identifies the tenant on every widget call."
-});
-var PARTNER_SECRET_KEY = Object.freeze({
-  envVar: "EVERFUR_PARTNER_SECRET_KEY",
-  prefix: "sk_partner_",
-  length: "sk_partner_".length + 64,
-  summary: "Partner secret key (sk_partner_...). Presented only to the session mint route."
-});
-var SESSION_TOKEN = Object.freeze({
-  envVar: "EVERFUR_SESSION_TOKEN",
-  prefix: null,
-  length: null,
-  summary: "An existing widget session bearer. Optional; without it diagnose uses the key path."
-});
-var ADMIN_TOKEN = Object.freeze({
-  envVar: "EVERFUR_ADMIN_TOKEN",
-  prefix: null,
-  length: null,
-  summary: "Admin bearer token for the /admin routes. Required by `sandbox create`."
-});
-var CREDENTIAL_SPECS = Object.freeze([
-  PARTNER_KEY,
-  PARTNER_SECRET_KEY,
-  SESSION_TOKEN,
-  ADMIN_TOKEN
-]);
-function wrap(spec, value) {
-  return Object.freeze({
-    envVar: spec.envVar,
-    toString: () => REDACTED,
-    toJSON: () => REDACTED,
-    reveal: () => value
-  });
-}
-function ephemeralCredential(origin, value) {
-  return Object.freeze({
-    envVar: origin,
-    toString: () => REDACTED,
-    toJSON: () => REDACTED,
-    reveal: () => value
-  });
-}
-function withPrefix(credential, prefix) {
-  return Object.freeze({
-    envVar: credential.envVar,
-    toString: () => REDACTED,
-    toJSON: () => REDACTED,
-    reveal: () => `${prefix}${credential.reveal()}`
-  });
-}
-function resolveCredential(env, spec) {
-  const raw = (env[spec.envVar] ?? "").trim();
-  if (raw.length === 0) {
-    return Object.freeze({
-      spec,
-      status: "absent",
-      credential: null,
-      reason: `${spec.envVar} is not set`
-    });
-  }
-  const accepted = spec.prefix === null ? [] : [spec.prefix, ...spec.alsoAccepts ?? []];
-  if (accepted.length > 0 && !accepted.some((p) => raw.startsWith(p))) {
-    return Object.freeze({
-      spec,
-      status: "malformed",
-      credential: null,
-      reason: accepted.length === 1 ? `${spec.envVar} does not start with "${spec.prefix}"` : `${spec.envVar} does not start with any of ${accepted.map((p) => `"${p}"`).join(" or ")}`
-    });
-  }
-  if (spec.length !== null && raw.length !== spec.length) {
-    return Object.freeze({
-      spec,
-      status: "malformed",
-      credential: null,
-      reason: `${spec.envVar} is ${raw.length} characters; a ${spec.prefix ?? ""} key is ${spec.length}`
-    });
-  }
-  return Object.freeze({
-    spec,
-    status: "present",
-    credential: wrap(spec, raw),
-    reason: null
-  });
-}
-
-// src/cli/json.ts
-function isJsonObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function canonicalJson(value) {
-  if (value === null || typeof value === "boolean" || typeof value === "number") {
-    return JSON.stringify(value);
-  }
-  if (typeof value === "string") {
-    return JSON.stringify(value);
-  }
-  if (Array.isArray(value)) {
-    return `[${value.map(canonicalJson).join(",")}]`;
-  }
-  const entries = Object.entries(value);
-  entries.sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
-  const body = entries.map(([key, entry]) => `${JSON.stringify(key)}:${canonicalJson(entry)}`).join(",");
-  return `{${body}}`;
-}
-
-// src/detect/manifest.ts
-function stringMap(value) {
-  if (!isJsonObject(value)) return Object.freeze({});
-  const out = {};
-  for (const [key, entry] of Object.entries(value)) {
-    if (typeof entry === "string") out[key] = entry;
-  }
-  return Object.freeze(out);
-}
-function readPackageJson(fs, root) {
-  const contents = fs.readFile(join(root, "package.json"));
-  if (contents === null) return null;
-  let parsed;
-  try {
-    parsed = JSON.parse(contents);
-  } catch {
-    return null;
-  }
-  if (!isJsonObject(parsed)) return null;
-  const packageManagerField = typeof parsed["packageManager"] === "string" ? parsed["packageManager"] : null;
-  return Object.freeze({
-    raw: parsed,
-    dependencies: stringMap(parsed["dependencies"]),
-    devDependencies: stringMap(parsed["devDependencies"]),
-    peerDependencies: stringMap(parsed["peerDependencies"]),
-    packageManagerField
-  });
-}
-function pubspecDependencyValue(value) {
-  if (typeof value === "string") return value;
-  if (typeof value === "number") return String(value);
-  if (isJsonObject(value)) {
-    const keys = Object.keys(value).sort();
-    if (keys.length === 0) return null;
-    return keys.map((key) => `${key}:${String(value[key])}`).join(" ");
-  }
-  return null;
-}
-function readPubspec(fs, root) {
-  const contents = fs.readFile(join(root, "pubspec.yaml"));
-  if (contents === null) return null;
-  let parsed;
-  try {
-    parsed = parse(contents);
-  } catch {
-    return null;
-  }
-  if (!isJsonObject(parsed)) return null;
-  const environment = isJsonObject(parsed["environment"]) ? parsed["environment"] : {};
-  const dependencies = {};
-  if (isJsonObject(parsed["dependencies"])) {
-    for (const [key, entry] of Object.entries(parsed["dependencies"])) {
-      const flattened = pubspecDependencyValue(entry);
-      if (flattened !== null) dependencies[key] = flattened;
-    }
-  }
-  return Object.freeze({
-    name: typeof parsed["name"] === "string" ? parsed["name"] : null,
-    dartSdk: typeof environment["sdk"] === "string" ? environment["sdk"] : null,
-    flutterSdk: typeof environment["flutter"] === "string" ? environment["flutter"] : null,
-    dependencies: Object.freeze(dependencies)
-  });
-}
-function readInstalledVersion(fs, root, name) {
-  const contents = fs.readFile(join(root, "node_modules", ...name.split("/"), "package.json"));
-  if (contents === null) return null;
-  try {
-    const parsed = JSON.parse(contents);
-    if (!isJsonObject(parsed)) return null;
-    return typeof parsed["version"] === "string" ? parsed["version"] : null;
-  } catch {
-    return null;
-  }
-}
-var LOCKFILES = Object.freeze([
-  { file: "package-lock.json", manager: "npm" },
-  { file: "npm-shrinkwrap.json", manager: "npm" },
-  { file: "pnpm-lock.yaml", manager: "pnpm" },
-  { file: "yarn.lock", manager: "yarn" },
-  { file: "bun.lockb", manager: "bun" },
-  { file: "bun.lock", manager: "bun" }
-]);
-var NAMED_MANAGERS = Object.freeze(["npm", "pnpm", "yarn", "bun"]);
-function detectPackageManager(fs, root, manifest) {
-  const field = manifest?.packageManagerField ?? null;
-  if (field !== null) {
-    const name = field.split("@")[0] ?? "";
-    const matched = NAMED_MANAGERS.find((candidate) => candidate === name);
-    if (matched !== void 0) {
-      return Object.freeze({
-        packageManager: matched,
-        evidence: Object.freeze([`package.json "packageManager" field is "${field}"`])
-      });
-    }
-    return Object.freeze({
-      packageManager: "undetermined",
-      evidence: Object.freeze([`package.json "packageManager" field "${field}" names no supported manager`])
-    });
-  }
-  const found = LOCKFILES.filter((probe) => fs.exists(join(root, probe.file)));
-  const distinct = new Set(found.map((probe) => probe.manager));
-  if (distinct.size === 1) {
-    const [only] = [...distinct];
-    if (only !== void 0) {
-      return Object.freeze({
-        packageManager: only,
-        evidence: Object.freeze(found.map((probe) => `${probe.file} present`))
-      });
-    }
-  }
-  if (distinct.size > 1) {
-    return Object.freeze({
-      packageManager: "undetermined",
-      evidence: Object.freeze([
-        `competing lockfiles present: ${found.map((probe) => probe.file).join(", ")}`
-      ])
-    });
-  }
-  return Object.freeze({
-    packageManager: "undetermined",
-    evidence: Object.freeze(['no lockfile and no package.json "packageManager" field'])
-  });
-}
-var WEB_FRAMEWORK_DEPENDENCIES = Object.freeze([
-  "next",
-  "vite",
-  "@remix-run/react",
-  "@remix-run/node",
-  "astro",
-  "svelte",
-  "vue",
-  "@angular/core",
-  "react-scripts",
-  "@shopify/remix-oxygen"
-]);
-function allNodeDependencies(manifest) {
-  return { ...manifest.devDependencies, ...manifest.peerDependencies, ...manifest.dependencies };
-}
-function flutterCandidate(pubspec) {
-  if (pubspec === null) return null;
-  const evidence = ["pubspec.yaml present"];
-  if (pubspec.dependencies["flutter"] !== void 0) {
-    evidence.push("pubspec.yaml declares the flutter dependency");
-  }
-  if (pubspec.flutterSdk !== null) {
-    evidence.push(`pubspec.yaml environment.flutter is "${pubspec.flutterSdk}"`);
-  }
-  return { type: "flutter", evidence: Object.freeze(evidence) };
-}
-function reactNativeCandidate(fs, root, manifest) {
-  if (manifest === null) return null;
-  const dependencies = allNodeDependencies(manifest);
-  const hasExpo = dependencies["expo"] !== void 0;
-  const hasReactNative = dependencies["react-native"] !== void 0;
-  if (!hasExpo && !hasReactNative) return null;
-  const iosDirectory = fs.isDirectory(join(root, "ios"));
-  const androidDirectory = fs.isDirectory(join(root, "android"));
-  const nativeDirectories = [
-    ...iosDirectory ? ["ios/"] : [],
-    ...androidDirectory ? ["android/"] : []
-  ];
-  const evidence = [];
-  if (hasExpo) evidence.push(`package.json declares expo "${dependencies["expo"] ?? ""}"`);
-  if (hasReactNative) evidence.push(`package.json declares react-native "${dependencies["react-native"] ?? ""}"`);
-  if (nativeDirectories.length > 0) {
-    evidence.push(`checked-in native project directories: ${nativeDirectories.join(", ")}`);
-    return { type: "bare-react-native", evidence: Object.freeze(evidence) };
-  }
-  if (hasExpo) {
-    evidence.push("no checked-in ios/ or android/ directory, so the managed workflow is intact");
-    for (const configFile of ["app.json", "app.config.js", "app.config.ts"]) {
-      if (fs.exists(join(root, configFile))) evidence.push(`${configFile} present`);
-    }
-    return { type: "expo-managed", evidence: Object.freeze(evidence) };
-  }
-  evidence.push("no checked-in ios/ or android/ directory");
-  return { type: "bare-react-native", evidence: Object.freeze(evidence) };
-}
-function webCandidate(fs, root, manifest) {
-  if (manifest === null) return null;
-  const dependencies = allNodeDependencies(manifest);
-  if (dependencies["react-native"] !== void 0 || dependencies["expo"] !== void 0) return null;
-  const evidence = [];
-  for (const name of WEB_FRAMEWORK_DEPENDENCIES) {
-    const declared = dependencies[name];
-    if (declared !== void 0) evidence.push(`package.json declares ${name} "${declared}"`);
-  }
-  for (const htmlFile of ["index.html", join("public", "index.html")]) {
-    if (fs.exists(join(root, htmlFile))) evidence.push(`${htmlFile.replace(/\\/g, "/")} present`);
-  }
-  if (evidence.length === 0) return null;
-  return { type: "web", evidence: Object.freeze(evidence) };
-}
-function detectProjectType(fs, root, manifest, pubspec) {
-  const candidates = [
-    flutterCandidate(pubspec),
-    reactNativeCandidate(fs, root, manifest),
-    webCandidate(fs, root, manifest)
-  ].filter((candidate) => candidate !== null);
-  if (candidates.length === 1) {
-    const only = candidates[0];
-    if (only !== void 0) {
-      return Object.freeze({ projectType: only.type, evidence: only.evidence });
-    }
-  }
-  if (candidates.length > 1) {
-    return Object.freeze({
-      projectType: "unknown",
-      evidence: Object.freeze([
-        `competing project shapes detected: ${candidates.map((candidate) => candidate.type).join(", ")}`,
-        ...candidates.flatMap((candidate) => candidate.evidence)
-      ])
-    });
-  }
-  const evidence = [];
-  if (manifest === null && pubspec === null) {
-    evidence.push("no package.json and no pubspec.yaml at the project root");
-  } else if (manifest !== null) {
-    evidence.push("package.json present but declares no expo, react-native, or web framework dependency");
-  }
-  return Object.freeze({ projectType: "unknown", evidence: Object.freeze(evidence) });
-}
-
-// src/detect/detect.ts
-var RELEVANT_NODE_DEPENDENCIES = Object.freeze([
-  "expo",
-  "expo-router",
-  "react",
-  "react-dom",
-  "react-native",
-  "next",
-  "@everfur/sdk"
-]);
-var RELEVANT_DART_DEPENDENCIES = Object.freeze(["everfur_sdk"]);
-function detectProject(fs, root) {
-  const manifest = readPackageJson(fs, root);
-  const pubspec = readPubspec(fs, root);
-  const projectType = detectProjectType(fs, root, manifest, pubspec);
-  const dependencies = [];
-  if (manifest !== null) {
-    for (const name of RELEVANT_NODE_DEPENDENCIES) {
-      const scopes = [
-        { scope: "dependencies", table: manifest.dependencies },
-        { scope: "devDependencies", table: manifest.devDependencies },
-        { scope: "peerDependencies", table: manifest.peerDependencies }
-      ];
-      for (const { scope, table } of scopes) {
-        const declared = table[name];
-        if (declared === void 0) continue;
-        dependencies.push({
-          name,
-          declared,
-          installed: readInstalledVersion(fs, root, name),
-          source: "package.json",
-          scope
-        });
-      }
-    }
-  }
-  if (pubspec !== null) {
-    if (pubspec.dartSdk !== null) {
-      dependencies.push({
-        name: "dart",
-        declared: pubspec.dartSdk,
-        installed: null,
-        source: "pubspec.yaml",
-        scope: "sdk"
-      });
-    }
-    if (pubspec.flutterSdk !== null) {
-      dependencies.push({
-        name: "flutter",
-        declared: pubspec.flutterSdk,
-        installed: null,
-        source: "pubspec.yaml",
-        scope: "sdk"
-      });
-    }
-    for (const name of RELEVANT_DART_DEPENDENCIES) {
-      const declared = pubspec.dependencies[name];
-      if (declared === void 0) continue;
-      dependencies.push({
-        name,
-        declared,
-        installed: null,
-        source: "pubspec.yaml",
-        scope: "dependencies"
-      });
-    }
-  }
-  const packageManager = projectType.projectType === "flutter" && manifest === null ? Object.freeze({
-    packageManager: "not-applicable",
-    evidence: Object.freeze(["flutter project with no package.json, so no node package manager applies"])
-  }) : detectPackageManager(fs, root, manifest);
-  return Object.freeze({
-    root,
-    projectType: projectType.projectType,
-    projectTypeEvidence: projectType.evidence,
-    packageManager: packageManager.packageManager,
-    packageManagerEvidence: packageManager.evidence,
-    dependencies: Object.freeze(dependencies)
-  });
-}
-
-// schema/plan.v1.schema.json
-var plan_v1_schema_default = {
-  $schema: "https://json-schema.org/draft/2020-12/schema",
-  $id: "https://everfur.com/contracts/cli-plan/v1",
-  title: "Everfur CLI plan document",
-  description: "The committed output contract of `everfur plan --json`. Mirrors the TypeScript type in src/commands/plan/types.ts; tests/contract validates real emitted output against this file on every run so the two cannot drift. Compatibility rule for schemaVersion 1: fields and enum members may be ADDED; nothing is removed, renamed, retyped, or given a new meaning. Any of those is schemaVersion 2 and a new schema file. `additionalProperties` is left open on objects for exactly that reason: a consumer pinned to v1 must not break when v1.x gains a field. When the planner decision trees landed, this file gained the `blocked`, `principles` and `decisionSpace` fields, two `missingFacts[].fact` members and one `status` member, all additive; and `Capability` and `IdentityMode` stopped being enums, because the set of capabilities is published by the platform contract rather than by this CLI, and an enum here would reject a capability the platform had already shipped. That relaxation accepts every document v1 accepted and rejects nothing it used to, which is the test that keeps it inside v1.",
-  type: "object",
-  required: [
-    "schemaVersion",
-    "kind",
-    "generatedBy",
-    "status",
-    "detected",
-    "supplied",
-    "missingFacts",
-    "steps",
-    "blocked",
-    "principles",
-    "warnings",
-    "decisionSpace"
-  ],
-  properties: {
-    schemaVersion: { const: 1 },
-    kind: { const: "everfur.plan" },
-    generatedBy: {
-      type: "object",
-      required: ["name", "version"],
-      properties: {
-        name: { type: "string", minLength: 1 },
-        version: { type: "string", minLength: 1 }
-      }
-    },
-    status: { enum: ["ready", "underspecified", "blocked"] },
-    detected: { $ref: "#/$defs/Detection" },
-    supplied: {
-      type: "object",
-      required: ["capabilities", "identityMode"],
-      properties: {
-        capabilities: {
-          description: "null means the flag was absent. An empty array is never emitted.",
-          oneOf: [
-            { type: "null" },
-            { type: "array", minItems: 1, items: { $ref: "#/$defs/Capability" }, uniqueItems: true }
-          ]
-        },
-        identityMode: {
-          oneOf: [{ type: "null" }, { $ref: "#/$defs/IdentityMode" }]
-        },
-        sessionMintLanguage: {
-          description: "The backend language that mints sessions. Non-null only when the identity mode requires a server-side mint.",
-          oneOf: [{ type: "null" }, { $ref: "#/$defs/OptionId" }]
-        }
-      }
-    },
-    missingFacts: {
-      type: "array",
-      items: { $ref: "#/$defs/MissingFact" }
-    },
-    steps: {
-      type: "array",
-      items: { $ref: "#/$defs/PlanStep" }
-    },
-    blocked: {
-      description: "Capabilities the caller asked for that the contract refuses, with the reason and where to ask. Present in every status; non-empty means no step below covers those capabilities.",
-      type: "array",
-      items: { $ref: "#/$defs/BlockedCapability" }
-    },
-    principles: {
-      description: "Guidance that holds regardless of what was answered, carried in the document so it survives the loss of the context that produced the plan.",
-      type: "array",
-      items: { $ref: "#/$defs/PlanPrinciple" }
-    },
-    warnings: {
-      type: "array",
-      items: { $ref: "#/$defs/PlanWarning" }
-    },
-    decisionSpace: {
-      description: "Which contract projection produced this plan. Null only on the refusal that says none was found.",
-      oneOf: [{ type: "null" }, { $ref: "#/$defs/DecisionSpaceProvenance" }]
-    }
-  },
-  allOf: [
-    {
-      description: "status and missingFacts are two views of one fact and can never disagree.",
-      if: { properties: { status: { const: "underspecified" } }, required: ["status"] },
-      then: {
-        properties: {
-          missingFacts: { minItems: 1 },
-          steps: { maxItems: 0 }
-        }
-      }
-    },
-    {
-      description: "A ready plan has no missing facts and at least one step.",
-      if: { properties: { status: { const: "ready" } }, required: ["status"] },
-      then: {
-        properties: {
-          missingFacts: { maxItems: 0 },
-          steps: { minItems: 1 }
-        },
-        required: ["supplied", "decisionSpace"],
-        $comment: "A ready plan always carries the supplied facts and the decision space they were judged against."
-      }
-    },
-    {
-      description: "A blocked plan produced no steps and says which capabilities are blocked. An install plan for a surface that answers 404 is not a smaller plan, it is a wrong one.",
-      if: { properties: { status: { const: "blocked" } }, required: ["status"] },
-      then: {
-        properties: {
-          missingFacts: { maxItems: 0 },
-          steps: { maxItems: 0 },
-          blocked: { minItems: 1 }
-        }
-      }
-    }
-  ],
-  $defs: {
-    OptionId: {
-      description: "One option id of one decision-tree question. Kebab-case, published by the contract.",
-      type: "string",
-      pattern: "^[a-z0-9]+(-[a-z0-9]+)*$"
-    },
-    Capability: {
-      description: "A capability id: one option of the capabilities tree. NOT enumerated here; the set is the platform contract's, and this CLI reads it from the projection.",
-      $ref: "#/$defs/OptionId"
-    },
-    IdentityMode: {
-      description: "An identity mode id: one option of the identity-mode tree.",
-      $ref: "#/$defs/OptionId"
-    },
-    ProjectType: {
-      enum: ["expo-managed", "bare-react-native", "flutter", "web", "unknown"]
-    },
-    PackageManager: {
-      enum: ["npm", "pnpm", "yarn", "bun", "not-applicable", "undetermined"]
-    },
-    Detection: {
-      type: "object",
-      required: [
-        "root",
-        "projectType",
-        "projectTypeEvidence",
-        "packageManager",
-        "packageManagerEvidence",
-        "dependencies"
-      ],
-      properties: {
-        root: { type: "string", minLength: 1 },
-        projectType: { $ref: "#/$defs/ProjectType" },
-        projectTypeEvidence: { type: "array", items: { type: "string" } },
-        packageManager: { $ref: "#/$defs/PackageManager" },
-        packageManagerEvidence: { type: "array", items: { type: "string" } },
-        dependencies: { type: "array", items: { $ref: "#/$defs/Dependency" } }
-      }
-    },
-    Dependency: {
-      type: "object",
-      required: ["name", "declared", "installed", "source", "scope"],
-      properties: {
-        name: { type: "string", minLength: 1 },
-        declared: { oneOf: [{ type: "null" }, { type: "string" }] },
-        installed: { oneOf: [{ type: "null" }, { type: "string" }] },
-        source: { enum: ["package.json", "pubspec.yaml"] },
-        scope: { enum: ["dependencies", "devDependencies", "peerDependencies", "sdk"] }
-      }
-    },
-    BlockedCapability: {
-      type: "object",
-      required: ["capability", "reason", "unblockOwner", "requestPath", "capabilityKeys"],
-      properties: {
-        capability: { $ref: "#/$defs/Capability" },
-        reason: { type: "string", minLength: 1 },
-        unblockOwner: { type: "string", minLength: 1 },
-        requestPath: {
-          description: "Site-relative path on the partner documentation site. Resolved against the generated site when the contract is compiled, so it cannot point at a page that does not exist.",
-          type: "string",
-          pattern: "^/"
-        },
-        capabilityKeys: {
-          description: "The capability pack keys this block derives from.",
-          type: "array",
-          items: { type: "string", minLength: 1 }
-        }
-      }
-    },
-    PlanPrinciple: {
-      type: "object",
-      required: ["treeId", "id", "title", "statement", "docPath"],
-      properties: {
-        treeId: { $ref: "#/$defs/OptionId" },
-        id: { $ref: "#/$defs/OptionId" },
-        title: { type: "string", minLength: 1 },
-        statement: { type: "string", minLength: 1 },
-        docPath: { oneOf: [{ type: "null" }, { type: "string", pattern: "^/" }] }
-      }
-    },
-    DecisionSpaceProvenance: {
-      type: "object",
-      required: ["source", "digest", "trees"],
-      properties: {
-        source: { type: "string", minLength: 1 },
-        digest: { type: "string", pattern: "^[0-9a-f]{64}$" },
-        trees: { type: "array", items: { $ref: "#/$defs/OptionId" } }
-      }
-    },
-    MissingFact: {
-      type: "object",
-      required: ["fact", "reason", "supplyWith"],
-      properties: {
-        fact: {
-          enum: [
-            "decisionTrees",
-            "projectType",
-            "packageManager",
-            "capabilities",
-            "identityMode",
-            "sessionMintLanguage"
-          ]
-        },
-        reason: { type: "string", minLength: 1 },
-        supplyWith: { type: "string", minLength: 1 }
-      }
-    },
-    PlanStep: {
-      type: "object",
-      required: ["id", "phase", "title", "detail", "commands", "files"],
-      properties: {
-        id: { type: "string", pattern: "^[a-z0-9]+(-[a-z0-9]+)*$" },
-        phase: { enum: ["install", "native", "configure", "code", "verify"] },
-        title: { type: "string", minLength: 1 },
-        detail: { type: "string", minLength: 1 },
-        commands: { type: "array", items: { type: "string", minLength: 1 } },
-        files: { type: "array", items: { type: "string", minLength: 1 } }
-      }
-    },
-    PlanWarning: {
-      type: "object",
-      required: ["code", "message"],
-      properties: {
-        code: { type: "string", pattern: "^[a-z0-9]+(_[a-z0-9]+)*$" },
-        message: { type: "string", minLength: 1 }
-      }
-    }
-  }
-};
-
-// schema/contract-public.v1.schema.json
-var contract_public_v1_schema_default = {
-  $schema: "https://json-schema.org/draft/2020-12/schema",
-  $id: "https://everfur.com/contracts/contract-public/v1",
-  title: "Everfur contract-public projection envelope",
-  description: "The ENVELOPE around a contract-public projection. This CLI owns the envelope and the digest rule; it deliberately does NOT own the shape of `projection`, which is produced by the contract lane. Validating the payload here would fork the definition and guarantee the two drift. `projection` is therefore required to be an object and is otherwise opaque, and the digest is what proves it arrived intact. When the contract lane publishes its own payload schema, add it as a $ref under projection and bump to v2 only if that tightening rejects a document v1 accepted.",
-  type: "object",
-  required: ["schemaVersion", "kind", "generatedAt", "digest", "projection"],
-  properties: {
-    schemaVersion: { const: 1 },
-    kind: { const: "everfur.contract-public" },
-    generatedAt: {
-      type: "string",
-      format: "date-time",
-      description: "RFC 3339 timestamp. Outside the digest input, so re-stamping a projection does not invalidate it."
-    },
-    digest: {
-      type: "object",
-      required: ["algorithm", "value"],
-      properties: {
-        algorithm: {
-          const: "sha256",
-          description: "Only sha256 is defined for v1. A new algorithm is an added enum member, which v1 permits."
-        },
-        value: {
-          type: "string",
-          pattern: "^[0-9a-f]{64}$",
-          description: "Lowercase hex sha256 over the RFC 8785 style canonical JSON of `projection` alone."
-        }
-      }
-    },
-    projection: {
-      type: "object",
-      description: "Opaque to this CLI. Owned by the contract lane."
-    }
-  }
-};
-
-// schema/diagnosis.v1.schema.json
-var diagnosis_v1_schema_default = {
-  $schema: "https://json-schema.org/draft/2020-12/schema",
-  $id: "https://everfur.com/contracts/cli-diagnosis/v1",
-  title: "Everfur CLI diagnosis document",
-  description: "The committed output contract of `everfur diagnose --json`. Mirrors src/commands/diagnose/document.ts; tests/contract validates real emitted output against this file on every run so the two cannot drift. Compatibility rule for schemaVersion 1: fields and enum members may be ADDED; nothing is removed, renamed, retyped, or given a new meaning. reasonCode is deliberately NOT an enum: the platform's DiagnosticsReasonCode grows when a new decision point is added, and a CLI that rejected an unrecognised cause would fail exactly when something new broke. additionalProperties is left open for the same reason.",
-  type: "object",
-  required: [
-    "schemaVersion",
-    "kind",
-    "generatedBy",
-    "endpoint",
-    "requestId",
-    "evaluatedAt",
-    "client",
-    "auth",
-    "scope",
-    "summary",
-    "capabilities"
-  ],
-  properties: {
-    schemaVersion: { const: 1 },
-    kind: { const: "everfur.diagnosis" },
-    generatedBy: { $ref: "#/$defs/GeneratedBy" },
-    endpoint: {
-      type: "object",
-      required: ["baseUrl", "path"],
-      properties: {
-        baseUrl: { type: "string", minLength: 1 },
-        path: { type: "string", minLength: 1 }
-      }
-    },
-    requestId: {
-      description: "The X-Request-ID of the diagnosing call. Null only when the response carried none.",
-      oneOf: [{ type: "null" }, { type: "string", minLength: 1 }]
-    },
-    evaluatedAt: { type: "string" },
-    client: {
-      type: "object",
-      required: ["id", "slug"],
-      properties: {
-        id: { type: "string" },
-        slug: { type: "string" }
-      }
-    },
-    auth: {
-      type: "object",
-      required: [
-        "mode",
-        "anonymous",
-        "userRefPrefix",
-        "userRole",
-        "roleSource",
-        "sessionId",
-        "partnerKeyScopeResolved"
-      ],
-      properties: {
-        mode: { type: "string" },
-        anonymous: { type: "boolean" },
-        userRefPrefix: {
-          description: "At most the first 8 characters of the resolved user ref. Never a credential.",
-          type: "string",
-          maxLength: 8
-        },
-        userRole: { type: "string" },
-        roleSource: { type: "string" },
-        sessionId: { type: "string" },
-        partnerKeyScopeResolved: { type: "boolean" }
-      }
-    },
-    scope: {
-      type: "object",
-      required: ["provisioned", "resolverStatus", "revision", "region", "levels"],
-      properties: {
-        provisioned: { type: "boolean" },
-        resolverStatus: { type: "string" },
-        revision: { type: "integer", minimum: 0 },
-        region: { type: "string" },
-        levels: {
-          type: "array",
-          items: {
-            type: "object",
-            required: ["level", "kind", "present"],
-            properties: {
-              level: { type: "integer", minimum: 1, maximum: 5 },
-              kind: { type: "string" },
-              present: { type: "boolean" }
-            }
-          }
-        }
-      }
-    },
-    summary: {
-      type: "object",
-      required: ["total", "available", "unavailable", "byReasonCode"],
-      properties: {
-        total: { type: "integer", minimum: 0 },
-        available: { type: "integer", minimum: 0 },
-        unavailable: { type: "integer", minimum: 0 },
-        byReasonCode: {
-          description: "Cause code to how many capabilities carry it. The field that turns eight symptoms into one ticket.",
-          type: "object",
-          additionalProperties: { type: "integer", minimum: 1 }
-        }
-      }
-    },
-    capabilities: {
-      type: "array",
-      items: { $ref: "#/$defs/CapabilityDiagnosis" }
-    }
-  },
-  $defs: {
-    GeneratedBy: {
-      type: "object",
-      required: ["name", "version"],
-      properties: {
-        name: { type: "string", minLength: 1 },
-        version: { type: "string", minLength: 1 }
-      }
-    },
-    CapabilityDiagnosis: {
-      type: "object",
-      required: [
-        "key",
-        "available",
-        "reasonCode",
-        "reason",
-        "entitlementReasonCode",
-        "decidedAtLevel",
-        "decidedAtKind",
-        "surface",
-        "nextAction"
-      ],
-      properties: {
-        key: { type: "string", minLength: 1 },
-        available: { type: "boolean" },
-        reasonCode: {
-          description: "The EFFECTIVE cause: the fence that blocks this key, so it names what has to be fixed first.",
-          type: "string",
-          minLength: 1
-        },
-        reason: {
-          description: "The server's own static copy for the code. Never operator or upstream text.",
-          type: "string"
-        },
-        entitlementReasonCode: {
-          description: "What the entitlement lattice alone decided, ignoring runtime gates. Differs from reasonCode only when a gate masks a lattice outcome.",
-          type: "string",
-          minLength: 1
-        },
-        decidedAtLevel: {
-          oneOf: [{ type: "null" }, { type: "integer", minimum: 1, maximum: 5 }]
-        },
-        decidedAtKind: { oneOf: [{ type: "null" }, { type: "string" }] },
-        surface: {
-          description: "The runtime-gated surface name, disclosed only to a caller the lattice grants. Null otherwise.",
-          oneOf: [{ type: "null" }, { type: "string" }]
-        },
-        nextAction: {
-          description: "CLI-authored. What the partner should do about this cause, which the server cannot know.",
-          type: "string",
-          minLength: 1
-        }
-      }
-    }
-  }
-};
-
-// schema/sandbox-create.v1.schema.json
-var sandbox_create_v1_schema_default = {
-  $schema: "https://json-schema.org/draft/2020-12/schema",
-  $id: "https://everfur.com/contracts/cli-sandbox-create/v1",
-  title: "Everfur CLI sandbox create document",
-  description: "The committed output contract of `everfur sandbox create --json`. The load-bearing clause is `secretDisclosed: {const: false}`: this document may never carry a raw credential, and a machine reading it can assert that rather than trusting prose. Any change that made the field true would fail tests/contract before it shipped. `status: claim_unavailable` is a complete, valid document, not an error: the key WAS provisioned and there is simply no way to claim its secret, which exits 8.",
-  type: "object",
-  required: [
-    "schemaVersion",
-    "kind",
-    "generatedBy",
-    "status",
-    "requestId",
-    "clientId",
-    "keyId",
-    "label",
-    "createdAt",
-    "claimUrl",
-    "claimExpiresAt",
-    "secretDisclosed",
-    "secretDiscarded",
-    "orphanedKey",
-    "nextActions"
-  ],
-  properties: {
-    schemaVersion: { const: 1 },
-    kind: { const: "everfur.sandbox-create" },
-    generatedBy: {
-      type: "object",
-      required: ["name", "version"],
-      properties: {
-        name: { type: "string", minLength: 1 },
-        version: { type: "string", minLength: 1 }
-      }
-    },
-    status: { enum: ["claim_issued", "claim_unavailable"] },
-    requestId: { oneOf: [{ type: "null" }, { type: "string", minLength: 1 }] },
-    clientId: { type: "string" },
-    keyId: { type: "string", minLength: 1 },
-    label: { oneOf: [{ type: "null" }, { type: "string" }] },
-    createdAt: { oneOf: [{ type: "null" }, { type: "string" }] },
-    claimUrl: {
-      description: "Where a human claims the secret in a browser. Null exactly when status is claim_unavailable.",
-      oneOf: [{ type: "null" }, { type: "string", minLength: 1 }]
-    },
-    claimExpiresAt: { oneOf: [{ type: "null" }, { type: "string" }] },
-    secretDisclosed: {
-      description: "Always false. The CLI does not print, log, or return a raw secret in any mode.",
-      const: false
-    },
-    secretDiscarded: {
-      description: "True when the server returned a raw secret inline and the CLI discarded it unread, which leaves a live credential nobody holds.",
-      type: "boolean"
-    },
-    orphanedKey: {
-      description: "What became of an unclaimable key. `not_needed` means a claim URL was issued and the key is wanted. `revoked` means the CLI minted an unclaimable key and revoked it again immediately, leaving nothing live behind. `revoke_failed` is the ONLY value that means a live credential nobody holds still exists.",
-      enum: ["not_needed", "revoked", "revoke_failed"]
-    },
-    nextActions: {
-      type: "array",
-      minItems: 1,
-      items: { type: "string", minLength: 1 }
-    }
-  },
-  allOf: [
-    {
-      if: { properties: { status: { const: "claim_unavailable" } }, required: ["status"] },
-      then: { properties: { claimUrl: { type: "null" } } }
-    },
-    {
-      if: { properties: { status: { const: "claim_issued" } }, required: ["status"] },
-      then: { properties: { claimUrl: { type: "string", minLength: 1 } } }
-    }
-  ]
-};
-
-// schema/verification.v1.schema.json
-var verification_v1_schema_default = {
-  $schema: "https://json-schema.org/draft/2020-12/schema",
-  $id: "https://everfur.com/contracts/cli-verification/v1",
-  title: "Everfur CLI verification document",
-  description: "The committed output contract of `everfur verify --json`. Every step carries a result AND a reason, including a passing one: this command never reports a bare exit code as its result, and `reason` having minLength 1 on every step is that rule expressed where a machine can check it. `requestId` is null only for a step that made no call, which is what makes a SKIP legible in a support ticket.",
-  type: "object",
-  required: ["schemaVersion", "kind", "generatedBy", "status", "baseUrl", "summary", "steps"],
-  properties: {
-    schemaVersion: { const: 1 },
-    kind: { const: "everfur.verification" },
-    generatedBy: {
-      type: "object",
-      required: ["name", "version"],
-      properties: {
-        name: { type: "string", minLength: 1 },
-        version: { type: "string", minLength: 1 }
-      }
-    },
-    status: {
-      description: "passed = every step PASSed. failed = at least one FAILed (exit 7). incomplete = nothing failed but a step was skipped (exit 3).",
-      enum: ["passed", "failed", "incomplete"]
-    },
-    baseUrl: { type: "string", minLength: 1 },
-    summary: {
-      type: "object",
-      required: ["passed", "failed", "skipped"],
-      properties: {
-        passed: { type: "integer", minimum: 0 },
-        failed: { type: "integer", minimum: 0 },
-        skipped: { type: "integer", minimum: 0 }
-      }
-    },
-    steps: {
-      type: "array",
-      minItems: 1,
-      items: {
-        type: "object",
-        required: ["id", "title", "result", "reason", "requestId", "details"],
-        properties: {
-          id: { type: "string", minLength: 1 },
-          title: { type: "string", minLength: 1 },
-          result: { enum: ["PASS", "FAIL", "SKIP"] },
-          reason: {
-            description: "Always populated, for every result. A bare PASS is not a report.",
-            type: "string",
-            minLength: 1
-          },
-          requestId: { oneOf: [{ type: "null" }, { type: "string", minLength: 1 }] },
-          details: { type: "array", items: { type: "string" } }
-        }
-      }
-    }
-  }
-};
-
-// schema/error-explanation.v1.schema.json
-var error_explanation_v1_schema_default = {
-  $schema: "https://json-schema.org/draft/2020-12/schema",
-  $id: "https://everfur.com/contracts/cli-error-explanation/v1",
-  title: "Everfur CLI error explanation document",
-  description: "The committed output contract of `everfur explain-error <code> --json`. Every field except `nextAction` is read from the contract-public projection named in `source`, and `source.digest` is the sha256 that projection was verified against, so a reader can prove which registry an explanation came from. `nextAction` is CLI-authored and derived from retryable plus httpStatus, which is why a code added to the registry tomorrow already gets a correct action today.",
-  type: "object",
-  required: [
-    "schemaVersion",
-    "kind",
-    "generatedBy",
-    "code",
-    "source",
-    "envelope",
-    "httpStatus",
-    "namingFamily",
-    "retryable",
-    "confirmedOnWire",
-    "surfaces",
-    "cause",
-    "display",
-    "docUrl",
-    "nextAction"
-  ],
-  properties: {
-    schemaVersion: { const: 1 },
-    kind: { const: "everfur.error-explanation" },
-    generatedBy: {
-      type: "object",
-      required: ["name", "version"],
-      properties: {
-        name: { type: "string", minLength: 1 },
-        version: { type: "string", minLength: 1 }
-      }
-    },
-    code: {
-      description: "Exactly the string the wire carries. Not normalised: three naming families are live at once and a client branches on the literal.",
-      type: "string",
-      minLength: 1
-    },
-    source: {
-      type: "object",
-      required: ["path", "digest"],
-      properties: {
-        path: { type: "string", minLength: 1 },
-        digest: { type: "string", pattern: "^[0-9a-f]{64}$" }
-      }
-    },
-    envelope: { type: "string", minLength: 1 },
-    httpStatus: { type: "integer", minimum: 0 },
-    namingFamily: { type: "string", minLength: 1 },
-    retryable: { type: "boolean" },
-    confirmedOnWire: {
-      description: "False means the code exists in source but no live route was traced emitting it. Documentation, not a contract to branch on.",
-      type: "boolean"
-    },
-    surfaces: { type: "array", items: { type: "string" } },
-    cause: { type: "string" },
-    display: {
-      description: "Safe copy a client may show a person as-is, authored by the contract lane.",
-      type: "string"
-    },
-    docUrl: { type: "string" },
-    nextAction: { type: "string", minLength: 1 }
-  }
-};
-
-// src/schema/validate.ts
-var ajv = new Ajv2020({ allErrors: true, strict: false, allowUnionTypes: true });
-addFormats(ajv);
-var compiled = /* @__PURE__ */ new Map();
-function compile(key, schema) {
-  const existing = compiled.get(key);
-  if (existing !== void 0) return existing;
-  const validator = ajv.compile(schema);
-  compiled.set(key, validator);
-  return validator;
-}
-function toViolations(errors) {
-  if (errors === null || errors === void 0) return [];
-  return errors.map((error) => ({
-    path: error.instancePath === "" ? "/" : error.instancePath,
-    message: error.message ?? "failed validation"
-  }));
-}
-function run(key, schema, document) {
-  const validator = compile(key, schema);
-  const valid = validator(document);
-  return Object.freeze({
-    valid: valid === true,
-    violations: valid === true ? Object.freeze([]) : toViolations(validator.errors)
-  });
-}
-function validatePlanDocument(document) {
-  return run("plan.v1", plan_v1_schema_default, document);
-}
-function validateContractPublicEnvelope(document) {
-  return run("contract-public.v1", contract_public_v1_schema_default, document);
-}
-function validateDiagnosisDocument(document) {
-  return run("diagnosis.v1", diagnosis_v1_schema_default, document);
-}
-function validateSandboxCreateDocument(document) {
-  return run("sandbox-create.v1", sandbox_create_v1_schema_default, document);
-}
-function validateVerificationDocument(document) {
-  return run("verification.v1", verification_v1_schema_default, document);
-}
-function validateErrorExplanationDocument(document) {
-  return run("error-explanation.v1", error_explanation_v1_schema_default, document);
-}
-var SCHEMAS = Object.freeze({
-  plan: plan_v1_schema_default,
-  contractPublic: contract_public_v1_schema_default,
-  diagnosis: diagnosis_v1_schema_default,
-  sandboxCreate: sandbox_create_v1_schema_default,
-  verification: verification_v1_schema_default,
-  errorExplanation: error_explanation_v1_schema_default
-});
-function digestOfProjection(projection) {
-  return createHash("sha256").update(canonicalJson(projection), "utf8").digest("hex");
-}
-function digestsEqual(left, right) {
-  if (left.length !== right.length) return false;
-  let difference = 0;
-  for (let index = 0; index < left.length; index += 1) {
-    difference |= left.charCodeAt(index) ^ right.charCodeAt(index);
-  }
-  return difference === 0;
-}
-function verifyDigest(projection, declared) {
-  const actual = digestOfProjection(projection);
-  return Object.freeze({
-    matches: digestsEqual(declared.toLowerCase(), actual),
-    expected: declared.toLowerCase(),
-    actual
-  });
-}
-function resolveContractPath(cwd, path) {
-  return isAbsolute(path) ? path : resolve(cwd, path);
-}
-function validateContractFile(fs, path) {
-  const contents = fs.readFile(path);
-  if (contents === null) {
-    return { kind: "file_not_found", path };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(contents);
-  } catch (cause) {
-    return {
-      kind: "invalid_json",
-      path,
-      detail: cause instanceof Error ? cause.message : "could not be parsed as JSON"
-    };
-  }
-  const schema = validateContractPublicEnvelope(parsed);
-  if (!schema.valid) {
-    return { kind: "invalid_contract", path, violations: schema.violations };
-  }
-  if (!isJsonObject(parsed)) {
-    return { kind: "invalid_contract", path, violations: [{ path: "/", message: "expected an object" }] };
-  }
-  const projection = parsed["projection"];
-  const digestField = parsed["digest"];
-  if (!isJsonObject(projection) || !isJsonObject(digestField)) {
-    return { kind: "invalid_contract", path, violations: [{ path: "/projection", message: "expected an object" }] };
-  }
-  const declared = digestField["value"];
-  if (typeof declared !== "string") {
-    return { kind: "invalid_contract", path, violations: [{ path: "/digest/value", message: "expected a string" }] };
-  }
-  const digest = verifyDigest(projection, declared);
-  if (!digest.matches) {
-    return { kind: "digest_mismatch", path, digest };
-  }
-  const generatedAt = typeof parsed["generatedAt"] === "string" ? parsed["generatedAt"] : "";
-  return {
-    kind: "valid",
-    path,
-    digest,
-    generatedAt,
-    projectionKeys: Object.freeze(Object.keys(projection).sort()),
-    /* Same narrowing the digest above relies on: past the schema gate this is JSON. */
-    projection
-  };
-}
-
-// src/registry/errors.ts
-function buildRegistry(entries) {
-  const byCode = new Map(entries.map((entry) => [entry.code, entry]));
-  return Object.freeze({
-    lookup: (code) => byCode.get(code) ?? null,
-    codes: Object.freeze([...byCode.keys()].sort())
-  });
-}
-var EMPTY_REGISTRY = buildRegistry([]);
-var ERRORS_DOCUMENT_KEY = "errors.yaml";
-function readString(record, key) {
-  const value = record[key];
-  return typeof value === "string" ? value : null;
-}
-function readStringList(record, key) {
-  const value = record[key];
-  if (!Array.isArray(value)) return [];
-  return Object.freeze(value.filter((item) => typeof item === "string"));
-}
-function entryFromRow(row) {
-  if (!isJsonObject(row)) return null;
-  const code = readString(row, "code");
-  if (code === null || code.length === 0) return null;
-  const status = row["http_status"];
-  return Object.freeze({
-    code,
-    envelope: readString(row, "envelope") ?? "unknown",
-    httpStatus: typeof status === "number" ? status : 0,
-    namingFamily: readString(row, "naming_family") ?? "unknown",
-    retryable: row["retryable"] === true,
-    confirmedOnWire: row["confirmed_on_wire"] === true,
-    surfaces: readStringList(row, "surfaces"),
-    display: readString(row, "display") ?? "",
-    docUrl: readString(row, "doc_url") ?? "",
-    note: readString(row, "note") ?? ""
-  });
-}
-function loadErrorRegistry(fs, path) {
-  const outcome = validateContractFile(fs, path);
-  if (outcome.kind !== "valid") return { kind: "contract_rejected", outcome };
-  const document = outcome.projection[ERRORS_DOCUMENT_KEY];
-  if (!isJsonObject(document)) return { kind: "no_registry", path };
-  const rows = document["errors"];
-  if (!Array.isArray(rows)) return { kind: "no_registry", path };
-  const entries = rows.map(entryFromRow).filter((entry) => entry !== null);
-  if (entries.length === 0) return { kind: "no_registry", path };
-  return {
-    kind: "loaded",
-    registry: buildRegistry(entries),
-    path,
-    digest: outcome.digest.actual
-  };
-}
-
-// src/http/client.ts
-var CORRELATABLE_REQUEST_ID = /^(?:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|[0-9a-f]{32})$/i;
-var DEFAULT_TIMEOUT_MS = 1e4;
-var MIN_TIMEOUT_MS = 250;
-var MAX_TIMEOUT_MS = 12e4;
-var RETRYABLE_STATUSES = Object.freeze([429, 502, 503, 504]);
-function clampTimeout(value) {
-  if (!Number.isFinite(value)) return DEFAULT_TIMEOUT_MS;
-  return Math.min(MAX_TIMEOUT_MS, Math.max(MIN_TIMEOUT_MS, Math.trunc(value)));
-}
-function isCorrelatableRequestId(value) {
-  return CORRELATABLE_REQUEST_ID.test(value);
-}
-function requestIdOf(headers, body) {
-  const header = headers["x-request-id"];
-  if (typeof header === "string" && header.length > 0) return header;
-  if (isJsonObject(body)) {
-    const inBody = body["request_id"];
-    if (typeof inBody === "string" && inBody.length > 0) return inBody;
-  }
-  return null;
-}
-function errorCodeOf(body) {
-  if (!isJsonObject(body)) return { code: null, wireMessage: "" };
-  const direct = body["code"];
-  const aliased = body["error"];
-  const message = body["message"];
-  if (typeof direct === "string") {
-    return { code: direct, wireMessage: typeof message === "string" ? message : "" };
-  }
-  if (typeof aliased === "string") {
-    return { code: aliased, wireMessage: typeof message === "string" ? message : "" };
-  }
-  const detail = body["detail"];
-  if (isJsonObject(detail)) {
-    const nested = detail["error"] ?? detail["code"];
-    const nestedMessage = detail["message"];
-    if (typeof nested === "string") {
-      return { code: nested, wireMessage: typeof nestedMessage === "string" ? nestedMessage : "" };
-    }
-  }
-  if (typeof detail === "string") return { code: null, wireMessage: detail };
-  return { code: null, wireMessage: typeof message === "string" ? message : "" };
-}
-function httpFailure(base, wireMessage) {
-  const failure = { ...base };
-  Object.defineProperty(failure, "wireMessage", {
-    value: wireMessage,
-    enumerable: false,
-    writable: false,
-    configurable: false
-  });
-  return Object.freeze(failure);
-}
-function createApiClient(options) {
-  const registry = options.registry ?? EMPTY_REGISTRY;
-  const timeoutMs = clampTimeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
-  const retryDelayMs = options.retryDelayMs ?? 400;
-  const idempotentAttempts = Math.max(1, options.maxAttempts ?? 2);
-  const correlationId = typeof options.requestId === "string" && isCorrelatableRequestId(options.requestId) ? options.requestId : null;
-  function buildRequest(spec) {
-    const headers = {
-      accept: "application/json",
-      ...spec.headers ?? {}
-    };
-    if (spec.body !== void 0) headers["content-type"] = "application/json";
-    if (correlationId !== null) headers["x-request-id"] = correlationId;
-    for (const [name, credential] of Object.entries(spec.credentials ?? {})) {
-      headers[name] = credential.reveal();
-    }
-    return Object.freeze({
-      method: spec.method,
-      url: apiUrl(options.endpoint, spec.path),
-      headers: Object.freeze(headers),
-      body: spec.body === void 0 ? null : JSON.stringify(spec.body),
-      timeoutMs
-    });
-  }
-  async function request(spec) {
-    const allowed = isIdempotent(spec.method) ? idempotentAttempts : 1;
-    let attempt = 0;
-    let last = null;
-    while (attempt < allowed) {
-      attempt += 1;
-      const outcome = await attemptOnce(spec, attempt);
-      if (outcome.ok) return outcome;
-      last = outcome;
-      const mayRetry = attempt < allowed && (outcome.kind === "network" || outcome.kind === "timeout" || outcome.kind === "http" && outcome.retryable);
-      if (!mayRetry) return outcome;
-      await options.clock.sleep(retryDelayMs);
-    }
-    return last ?? failure(spec, 1, "exhausted");
-  }
-  function failure(spec, attempts, detail) {
-    return { ok: false, kind: "network", method: spec.method, path: spec.path, detail, attempts, requestId: null };
-  }
-  async function attemptOnce(spec, attempt) {
-    let response;
-    try {
-      response = await options.transport.send(buildRequest(spec));
-    } catch (cause) {
-      if (cause instanceof TransportError && cause.kind === "timeout") {
-        return {
-          ok: false,
-          kind: "timeout",
-          method: spec.method,
-          path: spec.path,
-          timeoutMs,
-          attempts: attempt,
-          requestId: null
-        };
-      }
-      return failure(spec, attempt, cause instanceof Error ? cause.message : String(cause));
-    }
-    let parsed;
-    let parseDetail = null;
-    if (response.body.trim().length === 0) {
-      parsed = null;
-    } else {
-      try {
-        parsed = JSON.parse(response.body);
-      } catch (cause) {
-        parseDetail = cause instanceof Error ? cause.message : "response body is not JSON";
-      }
-    }
-    const requestId = requestIdOf(response.headers, parsed);
-    const accepted = response.status >= 200 && response.status < 300 || (spec.acceptStatuses ?? []).includes(response.status);
-    if (accepted) {
-      if (parseDetail !== null) {
-        return {
-          ok: false,
-          kind: "malformed",
-          method: spec.method,
-          path: spec.path,
-          status: response.status,
-          detail: parseDetail,
-          requestId,
-          attempts: attempt
-        };
-      }
-      return {
-        ok: true,
-        value: parsed ?? null,
-        status: response.status,
-        requestId,
-        attempts: attempt
-      };
-    }
-    const { code, wireMessage } = errorCodeOf(parsed);
-    const entry = code === null ? null : registry.lookup(code);
-    return httpFailure(
-      {
-        ok: false,
-        kind: "http",
-        method: spec.method,
-        path: spec.path,
-        status: response.status,
-        code,
-        entry,
-        retryable: entry?.retryable === true || RETRYABLE_STATUSES.includes(response.status),
-        requestId,
-        attempts: attempt
-      },
-      wireMessage
-    );
-  }
-  return Object.freeze({ request, baseUrl: options.endpoint.baseUrl });
-}
-function describeFailure(failure) {
-  const where = `${failure.method} ${failure.path}`;
-  switch (failure.kind) {
-    case "network":
-      return `${where} could not be reached: ${failure.detail}`;
-    case "timeout":
-      return `${where} did not answer within ${failure.timeoutMs}ms`;
-    case "malformed":
-      return `${where} answered ${failure.status} with a body that is not JSON: ${failure.detail}`;
-    case "http": {
-      const summary = `${where} answered ${failure.status} ${failure.code ?? "(no code)"}`;
-      return failure.entry === null ? summary : `${summary}: ${failure.entry.display}`;
-    }
-  }
-}
-function failureDetails(failure) {
-  const lines = [];
-  if (failure.requestId !== null) lines.push(`request id: ${failure.requestId}`);
-  if (failure.attempts > 1) lines.push(`attempts:   ${failure.attempts}`);
-  if (failure.kind === "http") {
-    lines.push(`retryable:  ${failure.retryable ? "yes" : "no"}`);
-    if (failure.entry !== null) {
-      lines.push(`cause:      ${failure.entry.note}`);
-      lines.push(`docs:       ${failure.entry.docUrl}`);
-    } else if (failure.code !== null) {
-      lines.push(`This code is not in the error registry this run loaded.`);
-      lines.push(`Run \`everfur explain-error ${failure.code}\` against a contract-public projection.`);
-    }
-  }
-  return Object.freeze(lines);
-}
-
-// contract/contract-public.json
-var contract_public_default = {
-  digest: {
-    },
-  generatedAt: "2026-08-30T07:05:23Z",
-  projection: {
-    "action-classes.yaml": {
-      action_classes: [
-        {
-          default_exposure: "agent_allowed",
-          description: "Reads only material that is the same for every caller: the contract itself, an error registry, a capability list. No tenant data is touched and no state changes.",
-          id: "A0",
-          reaches_tenant_data: false,
-          reversible: true,
-          title: "Inert read"
-        },
-        {
-          default_exposure: "agent_with_confirmation",
-          description: "Creates or updates tenant state that the owner can inspect and undo: a pet profile, a consent row, a records request, a message turn. The write is visible to the owner and has a defined reversal.",
-          id: "A3",
-          reaches_tenant_data: true,
-          reversible: true,
-          title: "Reversible write"
-        },
-        {
-          default_exposure: "agent_with_confirmation",
-          description: "Reads tenant-scoped material that is not health content: a pet profile, a request status, a list of conversation titles. Wrong-caller risk is a metadata disclosure, not a health disclosure.",
-          id: "A1",
-          reaches_tenant_data: true,
-          reversible: true,
-          title: "Scoped read"
-        },
-        {
-          default_exposure: "never_agent",
-          description: "Changes the machinery that decides who may do any of the above: minting or revoking a credential, granting or denying a capability, flipping a runtime gate. A wrong invocation here is not one bad request, it is a changed posture for every subsequent request.",
-          id: "A5",
-          reaches_tenant_data: true,
-          reversible: false,
-          title: "Control-plane change"
-        },
-        {
-          default_exposure: "never_agent",
-          description: "Produces an effect that cannot be taken back: content handed to a third party, an export written to a downloadable artifact, a share link, an outbound send. Reversal changes future access only, never the copy the recipient already holds.",
-          id: "A4",
-          reaches_tenant_data: true,
-          reversible: false,
-          title: "Unrecallable effect"
-        },
-        {
-          default_exposure: "never_agent",
-          description: "Reads restricted content: a medical record projection, a conversation transcript, a classification derived from either. A read cannot be undone once it has been served, so this class carries the never_agent default even though nothing is written.",
-          id: "A2",
-          reaches_tenant_data: true,
-          reversible: true,
-          title: "Restricted-content read"
-        }
-      ],
-      exposures: [
-        {
-          description: "An agent may invoke this without a human in the loop. Reserved for calls that read nothing tenant-scoped and change nothing.",
-          id: "agent_allowed",
-          rank: 0
-        },
-        {
-          description: "An agent may prepare the call, but a human must approve the specific invocation before it is sent. The confirmation must name the concrete effect, not the capability in the abstract.",
-          id: "agent_with_confirmation",
-          rank: 1
-        },
-        {
-          description: "No agent path exists. The call is reachable only from a first-party surface driven by the person the data belongs to. A never_agent action publishes its id, its exposure, and its class, and nothing else.",
-          id: "never_agent",
-          rank: 2
-        }
-      ],
-      schema_version: 1
-    },
-    "capabilities.yaml": {
-      packs: [
-        {
-          actions: [
-            {
-              action_class: "A1",
-              detail: "Polls the status of an asynchronous analysis job. Returns job state; the result payload it eventually carries is the analysis output, not the source media.",
-              exposure: "agent_with_confirmation",
-              id: "poll_analysis_job",
-              route: "GET /api/v1/analysis/jobs/{job_id}"
-            },
-            {
-              action_class: "A3",
-              exposure: "never_agent",
-              id: "submit_gait_analysis"
-            }
-          ],
-          data_class: "confidential",
-          entitlement: {
-            key: "video.gait.execute",
-            risk_tier: "standard"
-          },
-          id: "video.gait.execute",
-          idempotent_operations: [],
-          required_disclaimer: {
-            confirmed_on_wire: false,
-            id: "none",
-            note: "No disclaimer copy is attached to the analysis surface in code. The analysis response carries interpretation text but no separate product-owned disclaimer field.",
-            text: null
-          },
-          runtime_gate: {
-            fail_closed: true,
-            kind: "ddb_flag"
-          },
-          support: "support@everfur.com",
-          surface: [
-            "consumer_app"
-          ],
-          title: "Run gait and mobility analysis on an uploaded video",
-          version: "1.0.0"
-        },
-        {
-          actions: [
-            {
-              action_class: "A1",
-              detail: "Returns conversation containers with titles and cursors for the resolved user_ref. Titles are user-authored and may carry content, so this is scoped metadata rather than an inert read.",
-              exposure: "agent_with_confirmation",
-              id: "list_conversations",
-              route: "GET /api/v1/widget/v1/conversations"
-            },
-            {
-              action_class: "A2",
-              exposure: "never_agent",
-              id: "get_messages"
-            }
-          ],
-          data_class: "restricted",
-          entitlement: {
-            key: "chat.conversation.read",
-            risk_tier: "standard"
-          },
-          id: "chat.conversation.read",
-          idempotent_operations: [],
-          required_disclaimer: {
-            confirmed_on_wire: false,
-            id: "entitlement_verdict_disclaimer",
-            note: "No chat-surface disclaimer copy exists in code. See chat.message.create.",
-            text: null
-          },
-          runtime_gate: {
-            fail_closed: true,
-            key: "chat_enabled",
-            kind: "client_feature"
-          },
-          support: "support@everfur.com",
-          surface: [
-            "partner_widget"
-          ],
-          title: "Read widget conversations and their transcripts",
-          version: "1.0.0"
-        },
-        {
-          actions: [
-            {
-              action_class: "A1",
-              detail: "Returns one request's status. A request whose pet is not one of this caller's widget pets is reported as not found.",
-              exposure: "agent_with_confirmation",
-              id: "get_request",
-              route: "GET /api/v1/widget/v1/records/requests/{request_id}"
-            },
-            {
-              action_class: "A1",
-              detail: "Returns request status rows for the caller's own widget pets. Status and timestamps only; never document content.",
-              exposure: "agent_with_confirmation",
-              id: "list_requests",
-              route: "GET /api/v1/widget/v1/records/requests"
-            },
-            {
-              action_class: "A1",
-              detail: "Returns whether consent is granted, at which copy version, and when. Consent metadata, not record content.",
-              exposure: "agent_with_confirmation",
-              id: "get_consent_state",
-              route: "GET /api/v1/widget/v1/records/pets/{pet_ref}/consent"
-            },
-            {
-              action_class: "A2",
-              exposure: "never_agent",
-              id: "get_record"
-            }
-          ],
-          data_class: "restricted",
-          entitlement: {
-            key: "records.record.read",
-            risk_tier: "standard"
-          },
-          id: "records.record.read",
-          idempotent_operations: [],
-          required_disclaimer: {
-            confirmed_on_wire: true,
-            id: "records_informational",
-            note: "Emitted on both the granted and the withheld projection, so the disclaimer is present even when the content is not.",
-            text: "Everfur summarizes what your vet recorded. It is informational, not diagnostic."
-          },
-          runtime_gate: {
-            fail_closed: true,
-            kind: "ddb_flag"
-          },
-          support: "support@everfur.com",
-          surface: [
-            "partner_widget"
-          ],
-          title: "Read the redacted records projection for a pet",
-          version: "1.0.0"
-        },
-        {
-          actions: [
-            {
-              action_class: "A1",
-              detail: "Returns the reduced presentation state for the pet, including which breed art clip to play. Derived presentation data keyed to a pet the caller owns; it carries no health findings.",
-              exposure: "agent_with_confirmation",
-              id: "get_pet_state",
-              route: "GET /api/v1/me/pets/{pet_id}/state"
-            }
-          ],
-          data_class: "internal",
-          entitlement: {
-            key: "animations.state.read",
-            risk_tier: "standard"
-          },
-          id: "animations.state.read",
-          idempotent_operations: [],
-          required_disclaimer: {
-            confirmed_on_wire: false,
-            id: "none",
-            note: "A presentation surface with no health claim, so no disclaimer applies.",
-            text: null
-          },
-          runtime_gate: {
-            fail_closed: true,
-            kind: "ddb_flag"
-          },
-          support: "support@everfur.com",
-          surface: [
-            "consumer_app"
-          ],
-          title: "Read the animated pet-state for a pet",
-          version: "1.0.0"
-        },
-        {
-          actions: [
-            {
-              action_class: "A1",
-              detail: "Scores an image for usability before analysis. Returns a quality verdict, not a health finding.",
-              exposure: "agent_with_confirmation",
-              id: "precheck_image",
-              route: "POST /api/v1/analysis/image/precheck"
-            },
-            {
-              action_class: "A3",
-              exposure: "never_agent",
-              id: "analyze_image"
-            },
-            {
-              action_class: "A3",
-              exposure: "never_agent",
-              id: "analyze_image_from_s3"
-            }
-          ],
-          data_class: "confidential",
-          entitlement: {
-            key: "photo.checkup.execute",
-            risk_tier: "standard"
-          },
-          id: "photo.checkup.execute",
-          idempotent_operations: [
-            {
-              key: "Idempotency-Key header",
-              operation: "analyze_image",
-              semantics: "Explicit claim, run, complete. A replay of a completed key returns the recorded response; an in-flight key returns 409 IDEMPOTENCY_KEY_IN_FLIGHT; the same key with a different request body returns 409 IDEMPOTENCY_KEY_REUSED_DIFFERENT_REQUEST."
-            }
-          ],
-          required_disclaimer: {
-            confirmed_on_wire: false,
-            id: "none",
-            note: "As with video.gait.execute, no product-owned disclaimer field is attached to the analysis response.",
-            text: null
-          },
-          runtime_gate: {
-            fail_closed: false,
-            key: null,
-            kind: "none"
-          },
-          support: "support@everfur.com",
-          surface: [
-            "consumer_app",
-            "partner_widget"
-          ],
-          title: "Run a photo checkup on a pet image",
-          version: "1.0.0"
-        },
-        {
-          actions: [
-            {
-              action_class: "A2",
-              exposure: "never_agent",
-              id: "classify_urgency"
-            },
-            {
-              action_class: "A3",
-              detail: "Opens an empty conversation container bound to the resolved (client_id, user_ref). Carries no content of its own.",
-              exposure: "agent_with_confirmation",
-              id: "create_conversation",
-              route: "POST /api/v1/widget/v1/conversations"
-            },
-            {
-              action_class: "A3",
-              exposure: "never_agent",
-              id: "analyze_in_chat"
-            },
-            {
-              action_class: "A3",
-              exposure: "never_agent",
-              id: "send_message"
-            }
-          ],
-          data_class: "restricted",
-          entitlement: {
-            key: "chat.message.create",
-            risk_tier: "standard"
-          },
-          id: "chat.message.create",
-          idempotent_operations: [],
-          required_disclaimer: {
-            confirmed_on_wire: false,
-            id: "entitlement_verdict_disclaimer",
-            note: "The entitlement verdict carries a product-owned disclaimer block, but its text and version both default to the empty string and no code path sets them. No chat-surface copy exists to quote.",
-            text: null
-          },
-          runtime_gate: {
-            fail_closed: true,
-            key: "chat_enabled",
-            kind: "client_feature"
-          },
-          support: "support@everfur.com",
-          surface: [
-            "partner_widget"
-          ],
-          title: "Send a message to the AI vet chat",
-          version: "1.0.0"
-        },
-        {
-          actions: [
-            {
-              action_class: "A3",
-              detail: "Creates an owner-provided records request against a widget pet and materializes the consumer_pets shadow row the records FK needs. Carries no document content yet.",
-              exposure: "agent_with_confirmation",
-              id: "create_records_request",
-              route: "POST /api/v1/widget/v1/records/requests"
-            },
-            {
-              action_class: "A3",
-              exposure: "never_agent",
-              id: "complete_upload"
-            },
-            {
-              action_class: "A3",
-              exposure: "never_agent",
-              id: "grant_consent"
-            },
-            {
-              action_class: "A3",
-              exposure: "never_agent",
-              id: "initiate_upload"
-            },
-            {
-              action_class: "A3",
-              exposure: "never_agent",
-              id: "revoke_consent"
-            }
-          ],
-          data_class: "restricted",
-          entitlement: {
-            key: "records.upload.create",
-            risk_tier: "standard"
-          },
-          id: "records.upload.create",
-          idempotent_operations: [
-            {
-              key: "body.idempotency_key, scoped to the resolved user_id",
-              operation: "create_records_request",
-              semantics: "Partial unique index on (user_id, idempotency_key). A replay returns the existing row instead of inserting a second empty request."
-            },
-            {
-              key: "row grain (pet_id), not the supplied idempotency_key",
-              operation: "grant_consent",
-              semantics: "The consent write is a row-grain UPSERT and is therefore idempotent by construction. The body's idempotency_key is accepted and ignored; do not rely on it as the dedup token."
-            }
-          ],
-          required_disclaimer: {
-            confirmed_on_wire: true,
-            id: "records_informational",
-            note: "Sourced from the EverfurRecord field default so the partner surface can never drift from the owner-facing copy.",
-            text: "Everfur summarizes what your vet recorded. It is informational, not diagnostic."
-          },
-          runtime_gate: {
-            fail_closed: true,
-            kind: "ddb_flag"
-          },
-          support: "support@everfur.com",
-          surface: [
-            "partner_widget"
-          ],
-          title: "Create a records request and upload source documents onto it",
-          version: "1.0.0"
-        },
-        {
-          actions: [
-            {
-              action_class: "A4",
-              exposure: "never_agent",
-              id: "export_record"
-            }
-          ],
-          data_class: "restricted",
-          entitlement: {
-            key: "records.record.export",
-            risk_tier: "high"
-          },
-          id: "records.record.export",
-          idempotent_operations: [],
-          required_disclaimer: {
-            confirmed_on_wire: false,
-            id: "records_informational",
-            note: "The copy is the records disclaimer, but nothing emits it on this capability today because the capability has no route.",
-            text: "Everfur summarizes what your vet recorded. It is informational, not diagnostic."
-          },
-          runtime_gate: {
-            fail_closed: true,
-            key: null,
-            kind: "none"
-          },
-          support: "support@everfur.com",
-          surface: [
-            "unrouted"
-          ],
-          title: "Export a pet's records as a downloadable artifact",
-          version: "0.1.0"
-        },
-        {
-          actions: [
-            {
-              action_class: "A4",
-              exposure: "never_agent",
-              id: "share_record"
-            }
-          ],
-          data_class: "restricted",
-          entitlement: {
-            key: "records.record.share",
-            risk_tier: "high"
-          },
-          id: "records.record.share",
-          idempotent_operations: [],
-          required_disclaimer: {
-            confirmed_on_wire: false,
-            id: "records_informational",
-            note: "No route, so nothing emits it. See records.record.export.",
-            text: "Everfur summarizes what your vet recorded. It is informational, not diagnostic."
-          },
-          runtime_gate: {
-            fail_closed: true,
-            key: null,
-            kind: "none"
-          },
-          support: "support@everfur.com",
-          surface: [
-            "unrouted"
-          ],
-          title: "Share a pet's records with a third party",
-          version: "0.1.0"
-        }
-      ],
-      registry_kind: "authoritative",
-      registry_version: "2026.08.22",
-      schema_version: 1
-    },
-    "credentials.yaml": {
-      credentials: [
-        {
-          body_charset: "hex",
-          body_length: 64,
-          description: "The publishable tenant key. Shipped inside partner apps and web pages, so it is public by construction and identifies the tenant rather than authorising a person. It resolves to a client_id and nothing else. It still carries a redaction pattern, because a key in a log is a key someone can enumerate tenants with; see the header for what does and does not consume that pattern today.",
-          hashed_at_rest: false,
-          holder: "partner_client",
-          id: "partner_publishable_key",
-          prefix: "pk_live_",
-          redaction_regex: "pk_live_[A-Za-z0-9]{8,}",
-          rotatable: true,
-          secret: false,
-          total_length: 72
-        },
-        {
-          body_charset: "hex",
-          body_length: null,
-          description: "RESERVED. A test-mode publishable prefix, registered so that a redactor would scrub it and the validator rejects it in a production credential slot before any such key is ever minted.",
-          hashed_at_rest: false,
-          holder: "partner_client",
-          id: "partner_publishable_key_test",
-          prefix: "pk_test_",
-          redaction_regex: "pk_test_[A-Za-z0-9]{8,}",
-          rotatable: true,
-          secret: false,
-          total_length: null
-        },
-        {
-          body_charset: "jwt",
-          body_length: null,
-          description: "The short-lived HS256 bearer a device carries after the mint. It has no literal prefix, so the redaction pattern matches the JWS compact serialisation instead. Not stored server-side at all, which is why it cannot be revoked directly; revocation works by deactivating the signing key_id it carries, which is re-checked live on every request. Publishable as a concept because every integrating partner must know it exists, but the token value itself is a secret.",
-          hashed_at_rest: false,
-          holder: "partner_device",
-          id: "partner_session_bearer",
-          prefix: null,
-          redaction_regex: "eyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}(\\.[A-Za-z0-9_-]+)?",
-          rotatable: false,
-          secret: true,
-          total_length: null
-        }
-      ],
-      schema_version: 1
-    },
-    "decision-trees.yaml": {
-      schema_version: 1,
-      trees: [
-        {
-          decides: "The host project's shape, and the verb that installs a package into it.",
-          entry_question_id: "project-shape",
-          principles: [
-            {
-              doc_path: null,
-              id: "duplicate-react-native-is-silent",
-              statement: "Two copies of react-native in one dependency tree do not raise. The app builds, the bundle serves, and the screen comes up empty, because the renderer that mounted the component is not the renderer that owns the host view registry. Nothing in the stack reports it. If a surface that should show a component shows nothing at all, check for a second react-native before you debug the component, and hoist to a single copy rather than deduping by hand at the bundler.",
-              title: "A duplicate react-native renders a blank screen, not an error"
-            },
-            {
-              doc_path: null,
-              id: "expo-go-cannot-load-native",
-              statement: "The optional peer dependencies some capabilities bind ship native code. Expo Go carries a fixed native runtime, so a managed project that mounts one of those capabilities needs a development build before the capability can run at all. Installing the peer and reloading Expo Go is the failure that looks like an SDK bug.",
-              title: "Expo Go cannot load a native module, whatever the plan says"
-            }
-          ],
-          questions: [
-            {
-              detectable: true,
-              id: "node-package-manager",
-              options: [
-                {
-                  id: "bun",
-                  label: "Bun",
-                  outcome: {
-                    attributes: {
-                      install_verb: "bun add",
-                      package_manager_applies: true
-                    },
-                    doc_paths: [],
-                    kind: "terminal"
-                  },
-                  when: "bun.lockb is the only lockfile, or package.json names bun in packageManager."
-                },
-                {
-                  id: "npm",
-                  label: "npm",
-                  outcome: {
-                    attributes: {
-                      install_verb: "npm install",
-                      package_manager_applies: true
-                    },
-                    doc_paths: [],
-                    kind: "terminal"
-                  },
-                  when: "package-lock.json is the only lockfile, or package.json names npm in packageManager."
-                },
-                {
-                  id: "pnpm",
-                  label: "pnpm",
-                  outcome: {
-                    attributes: {
-                      install_verb: "pnpm add",
-                      package_manager_applies: true
-                    },
-                    doc_paths: [],
-                    kind: "terminal"
-                  },
-                  when: "pnpm-lock.yaml is the only lockfile, or package.json names pnpm in packageManager."
-                },
-                {
-                  id: "yarn",
-                  label: "Yarn",
-                  outcome: {
-                    attributes: {
-                      install_verb: "yarn add",
-                      package_manager_applies: true
-                    },
-                    doc_paths: [],
-                    kind: "terminal"
-                  },
-                  when: "yarn.lock is the only lockfile, or package.json names yarn in packageManager."
-                }
-              ],
-              prompt: "Which package manager installs into this project?",
-              supply_with: 'add a "packageManager" field to package.json, or leave exactly one lockfile in the project root',
-              why_it_is_asked: "the package manager could not be identified, and the wrong install verb writes the wrong lockfile, so the next person to install gets a dependency tree nobody chose"
-            },
-            {
-              detectable: true,
-              id: "project-shape",
-              options: [
-                {
-                  id: "bare-react-native",
-                  label: "Bare React Native app",
-                  outcome: {
-                    kind: "branch",
-                    next_question_id: "node-package-manager"
-                  },
-                  when: "package.json declares react-native and the native projects are committed."
-                },
-                {
-                  id: "expo-managed",
-                  label: "Expo managed React Native app",
-                  outcome: {
-                    kind: "branch",
-                    next_question_id: "node-package-manager"
-                  },
-                  when: "package.json declares expo and the project has no committed ios/ or android/ directory."
-                },
-                {
-                  id: "flutter",
-                  label: "Flutter application",
-                  outcome: {
-                    attributes: {
-                      import_target: "package:everfur_sdk/everfur_sdk.dart",
-                      install_commands: [
-                        "flutter pub add everfur_sdk",
-                        "flutter pub get"
-                      ],
-                      install_style: "pub",
-                      manifest: "pubspec.yaml",
-                      package: "everfur_sdk",
-                      package_manager_applies: false
-                    },
-                    doc_paths: [],
-                    kind: "terminal"
-                  },
-                  when: "pubspec.yaml is present at the project root."
-                },
-                {
-                  id: "web",
-                  label: "Web application",
-                  outcome: {
-                    kind: "branch",
-                    next_question_id: "node-package-manager"
-                  },
-                  when: "package.json declares no react-native and no expo."
-                }
-              ],
-              prompt: "What shape is the host project?",
-              supply_with: "run from the application root, or pass --cwd <path> pointing at it",
-              why_it_is_asked: "the shape of the host project could not be identified, and the install verb, the native linking step and the import target all follow from it"
-            }
-          ],
-          schema_version: 1,
-          supply_with: "detected from the project; pass --cwd <path> to point at the application root",
-          title: "Which platform this integration is built on",
-          tree_id: "platform"
-        },
-        {
-          decides: "The set of SDK capability surfaces to mount, and for each one the import target and the optional native peers it binds.",
-          entry_question_id: "which-capability",
-          principles: [
-            {
-              doc_path: "/.well-known/skills/everfur-integration.md#bundle-attach-narrows",
-              id: "entitlement-lattice-subtracts",
-              statement: "The entitlement lattice is born-full and SUBTRACTIVE. The granted set is the top-level grant universe intersected with every ceiling on the path, minus every live deny. Nothing below the top adds anything. Attaching a bundle materialises a ceiling whose allow list is exactly that bundle's contents, so reaching for a bundle to hand a tenant a capability is reaching for the one mechanism that can only restrict. To widen a tenant, widen or reset the ceiling that excludes the key, or lift the deny that matched it.",
-              title: "Attaching a bundle to grant a capability takes capabilities away"
-            },
-            {
-              doc_path: "/.well-known/skills/everfur-integration.md#empty-capability-verdict",
-              id: "empty-verdict-is-a-symptom",
-              statement: "A 200 with an empty capability map is not a denial. The same response covers a tenant with no entitlement scope provisioned, a live deny, a ceiling that excludes the key, a key absent from the grant universe, a runtime gate that is off, and a resolve that could not complete and degraded to the fail-closed empty verdict, which means UNKNOWN rather than denied. They are byte-identical on the wire by design, because a denial reason is not something a device should branch on. Run `everfur diagnose` against the same credential: it returns one machine-readable reason per capability, and that is the thing that separates the causes. A gate cause is an operator action no entitlement change will fix; a not-provisioned cause is a support request; a resolver-unavailable cause means retry; a denied cause is configuration somebody chose.",
-              title: "An empty capability verdict is a symptom, not a diagnosis"
-            },
-            {
-              doc_path: "/.well-known/skills/everfur-integration.md#wire-message-is-not-copy",
-              id: "wire-message-is-never-rendered",
-              statement: "Every capability surface renders errors, and the tempting field is the wrong one. The upstream text on an error is untrusted, unlocalised, health-adjacent and sanitised by nothing: it can carry provider internals or a URL into somebody's record. The SDK's only protection is structural, the field is non-enumerable so serialisers drop it, and reading it deliberately is what defeats that. Render the display copy the error registry publishes for the code, and never forward the upstream text to a third-party telemetry or crash sink. When a person needs something to quote, quote the request id from the response header.",
-              title: "The wire message is diagnostic text, never something a person sees"
-            },
-            {
-              doc_path: "/reference/capabilities.md",
-              id: "verdict-is-server-authoritative",
-              statement: "The capability list handed back at session mint is advisory and is stated to be advisory; the authoritative verdict comes from the entitlements route and the SDK renders it as received. Do not cache it across users, do not intersect it with a local list of what you think the tenant bought, and do not treat its absence as a denial. Two independent checks have to pass for a surface to work: the entitlement resolves granted, and the runtime gate is on. They fail differently and only one of them is visible in the verdict.",
-              title: "The verdict is resolved server side and never re-folded on the client"
-            }
-          ],
-          questions: [
-            {
-              detectable: false,
-              id: "which-capability",
-              options: [
-                {
-                  id: "animations",
-                  label: "Animated pet state",
-                  outcome: {
-                    capability_refs: [
-                      "animations.state.read"
-                    ],
-                    kind: "blocked",
-                    reason: "The animated pet state is surfaced to the Everfur consumer app rather than to the partner widget surface, and its runtime gate is a control-plane switch that is off by default and fails closed. A partner integration has no route to it today.",
-                    request_path: "/reference/capabilities.md#capability-animations.state.read",
-                    unblock_owner: "support@everfur.com"
-                  },
-                  when: "The surface shows the animated pet avatar."
-                },
-                {
-                  id: "chat",
-                  label: "AI vet chat",
-                  outcome: {
-                    attributes: {
-                      dart_library: "package:everfur_sdk/everfur_sdk.dart",
-                      native_peers: [],
-                      node_subpath: "@everfur/sdk/chat",
-                      summary: "Streaming chat surface."
-                    },
-                    capability_refs: [
-                      "chat.conversation.read",
-                      "chat.message.create"
-                    ],
-                    doc_paths: [
-                      "/reference/capabilities.md#capability-chat.conversation.read",
-                      "/reference/capabilities.md#capability-chat.message.create"
-                    ],
-                    kind: "terminal"
-                  },
-                  when: "The surface shows a conversation with the Everfur assistant."
-                },
-                {
-                  id: "entitlements",
-                  label: "Entitlement gating for capability surfaces",
-                  outcome: {
-                    attributes: {
-                      dart_library: "package:everfur_sdk/everfur_sdk.dart",
-                      native_peers: [],
-                      node_subpath: "@everfur/sdk/core",
-                      summary: "Entitlement gating for capability surfaces."
-                    },
-                    capability_refs: [],
-                    doc_paths: [
-                      "/reference/capabilities.md"
-                    ],
-                    kind: "terminal"
-                  },
-                  when: "The integration hides or shows its own UI based on what the tenant is entitled to."
-                },
-                {
-                  id: "photo",
-                  label: "Photo checkup",
-                  outcome: {
-                    attributes: {
-                      dart_library: "package:everfur_sdk/everfur_sdk.dart",
-                      native_peers: [
-                        "expo-file-system",
-                        "expo-image-manipulator",
-                        "react-native-vision-camera"
-                      ],
-                      node_subpath: "@everfur/sdk/photo",
-                      summary: "Photo capture, resize, and upload."
-                    },
-                    capability_refs: [
-                      "photo.checkup.execute"
-                    ],
-                    doc_paths: [
-                      "/reference/capabilities.md#capability-photo.checkup.execute"
-                    ],
-                    kind: "terminal"
-                  },
-                  when: "The surface captures a skin or eye photo and shows an analysis."
-                },
-                {
-                  id: "records",
-                  label: "Health record upload and timeline",
-                  outcome: {
-                    capability_refs: [
-                      "records.record.export",
-                      "records.record.read",
-                      "records.record.share",
-                      "records.upload.create"
-                    ],
-                    kind: "blocked",
-                    reason: "The partner records surface is mounted behind a control-plane switch that is off by default and read strictly, so every route under it answers 404 rather than 403 until Everfur enables it for your client. A 404 is indistinguishable from a wrong URL, so an integration built against a dark surface reads to a partner as a broken SDK. The two record-movement packs are separately out of reach: export and share are not routed to the partner widget surface at all, and every action in both is never_agent, so no agent path to them exists even for an entitled tenant.",
-                    request_path: "/reference/capabilities.md#capability-records.upload.create",
-                    unblock_owner: "support@everfur.com"
-                  },
-                  when: "The surface uploads vet documents or shows a pet's record history."
-                },
-                {
-                  id: "video",
-                  label: "Gait and mobility video analysis",
-                  outcome: {
-                    capability_refs: [
-                      "video.gait.execute"
-                    ],
-                    kind: "blocked",
-                    reason: "Gait analysis is surfaced to the Everfur consumer app and is not routed to the partner widget surface, and its runtime gate is a control-plane switch that is off by default and fails closed. Both have to change before a partner integration can reach it, and neither is a setting a partner can turn on.",
-                    request_path: "/reference/capabilities.md#capability-video.gait.execute",
-                    unblock_owner: "support@everfur.com"
-                  },
-                  when: "The surface captures a walking video and shows a mobility result."
-                }
-              ],
-              prompt: "Which Everfur capability does this surface mount?",
-              supply_with: "--capabilities chat,entitlements,photo (name every surface you mount)",
-              why_it_is_asked: "which Everfur capabilities this integration uses cannot be read from the project; nothing on disk says which product surface somebody intends to build, and the import target, the optional native peers, and whether the surface is reachable at all differ per capability"
-            }
-          ],
-          schema_version: 1,
-          supply_with: "--capabilities chat,entitlements,photo (name every surface you mount)",
-          title: "Which capability surfaces this integration mounts",
-          tree_id: "capabilities"
-        },
-        {
-          decides: "Whether the integration asserts a partner-owned user reference, and therefore whether per-user data is reachable.",
-          entry_question_id: "how-users-are-named",
-          principles: [
-            {
-              doc_path: "/.well-known/skills/everfur-integration.md#user-ref-case",
-              id: "user-ref-is-case-sensitive",
-              statement: "A user reference is an opaque, case-sensitive identifier resolved by exact match, and the session is keyed on the (client, user reference) pair with the case preserved. Lowercasing it anywhere on the path collapses two case-distinct references onto one internal user, which is a cross-user data bleed on read and a cross-user erasure on delete. This is not hypothetical: it happened, and the fix was to remove the case fold. Send the reference exactly as your system stores it, including in your own cache keys. If your identifiers are genuinely case-insensitive upstream, normalise them ONCE where they are minted, before they ever become a user reference.",
-              title: "user_ref is case sensitive, and folding it merges two people"
-            },
-            {
-              doc_path: "/reference/capabilities.md",
-              id: "ownership-fence-is-the-composite",
-              statement: "Every per-user read is fenced on the composite of the resolved user and the pet, not on the tenant alone. With no user reference asserted nothing owned by a specific end user is reachable, by construction rather than by policy. That is what makes the anonymous mode safe and what makes a guessable user reference dangerous: the reference IS the tenancy claim for everything below it, so it must be stable per person and must not be enumerable.",
-              title: "The ownership fence is the (user, pet) composite"
-            }
-          ],
-          questions: [
-            {
-              detectable: false,
-              id: "how-users-are-named",
-              options: [
-                {
-                  id: "anonymous",
-                  label: "No end user is asserted",
-                  outcome: {
-                    attributes: {
-                      reaches_per_user_data: false,
-                      session_mint: "Not applicable. A mint requires a non-empty user reference, so there is nothing to mint for a surface that asserts none.",
-                      user_ref_header: null
-                    },
-                    doc_paths: [
-                      "/reference/capabilities.md"
-                    ],
-                    kind: "terminal"
-                  },
-                  when: "The surface shows nothing owned by a specific person: a marketing page, a demo, or a logged-out state."
-                },
-                {
-                  id: "partner-user-ref",
-                  label: "The partner asserts its own stable user reference",
-                  outcome: {
-                    attributes: {
-                      reaches_per_user_data: true,
-                      session_mint: "A minted session is how the tenancy claim is made from your backend instead of from the device, and it is mandatory for a client configured to require partner sessions. Answer the session-mint-language tree next.",
-                      user_ref_case_sensitive: true,
-                      user_ref_forbidden_characters: "@",
-                      user_ref_header: "x-everfur-user-ref",
-                      user_ref_max_length: 128,
-                      user_role_header: "x-everfur-user-role"
-                    },
-                    doc_paths: [
-                      "/.well-known/skills/everfur-integration.md#user-ref-case"
-                    ],
-                    kind: "terminal",
-                    then_ask_tree_id: "session-mint-language"
-                  },
-                  when: "The integration already has a signed-in person and a stable identifier for them, and the surface shows that person's pets, conversations or records."
-                }
-              ],
-              prompt: "How does this integration identify the person using it?",
-              supply_with: "--identity partner-user-ref | anonymous",
-              why_it_is_asked: "how this integration identifies end users cannot be read from the project, and the two answers reach different data; guessing wrong in one direction builds a surface that shows nothing, and in the other builds one that asserts an identity the partner never intended to assert"
-            }
-          ],
-          schema_version: 1,
-          supply_with: "--identity partner-user-ref | anonymous",
-          title: "How end users are named on the wire",
-          tree_id: "identity-mode"
-        },
-        {
-          decides: "Whether the integration mints sessions through the first-party server package or by calling the mint route directly.",
-          entry_question_id: "backend-language",
-          principles: [
-            {
-              doc_path: "/.well-known/skills/everfur-integration.md#server-only-minter",
-              id: "minter-is-server-only",
-              statement: "The mint is the one request on the whole surface that legitimately carries both credentials at once, and a device must never hold the secret half. The `/server` subpath is what enforces that structurally: it declares no react-native export condition, so a mobile bundler cannot resolve it. Import the same function from the package root or a client subpath and the protection is gone, because the fence was the subpath, not the function. If a bundler ever resolves the server subpath into a device build, treat it as a leaked secret and rotate rather than shipping the build.",
-              title: "The session minter is imported only from the server subpath"
-            },
-            {
-              doc_path: "/.well-known/skills/everfur-integration.md#user-ref-case",
-              id: "mint-carries-the-identity",
-              statement: "The reference travels in the mint body, and the same validation rule applies there as on the per-request header: stripped, non-empty, at most 128 characters, printable, no `@`. The one difference is the empty case, which is a 400 at the mint because a session cannot be minted for nobody, while an empty header on the per-request path falls back to an anonymous identity. Do not build a mint call that sends an empty reference and expects anonymity: it is a rejection, not a fallback.",
-              title: "The mint body carries the user reference, and the rules are the same on both paths"
-            },
-            {
-              doc_path: "/reference/errors.md",
-              id: "mint-failures-are-one-opaque-401",
-              statement: "Wrong secret, wrong publishable key, a mismatched pair from two different tenants, an inactive client, a lookup timeout: all of them return the same 401 with no detail, on purpose, so the route is not an oracle. Do not build retry logic that branches on why the mint failed, because the wire does not tell you. Correlate with the request id and read the diagnostics route instead.",
-              title: "Every credential failure at the mint is one indistinguishable 401"
-            }
-          ],
-          questions: [
-            {
-              detectable: false,
-              id: "backend-language",
-              options: [
-                {
-                  id: "go",
-                  label: "Go",
-                  outcome: {
-                    kind: "branch",
-                    next_question_id: "direct-mint-call"
-                  },
-                  when: "The backend is a Go service."
-                },
-                {
-                  id: "node",
-                  label: "Node or TypeScript",
-                  outcome: {
-                    attributes: {
-                      import_from_root_is_a_defect: true,
-                      import_subpath: "@everfur/sdk/server",
-                      package: "@everfur/sdk",
-                      secret_source: "an environment variable or secret manager on the server, never a bundled constant"
-                    },
-                    doc_paths: [
-                      "/.well-known/skills/everfur-integration.md#server-only-minter"
-                    ],
-                    kind: "terminal"
-                  },
-                  when: "The backend runs on Node and can install from the npm registry."
-                },
-                {
-                  id: "other-language",
-                  label: "Anything else",
-                  outcome: {
-                    kind: "branch",
-                    next_question_id: "direct-mint-call"
-                  },
-                  when: "The backend is any other language, or the mint lives in an edge function."
-                },
-                {
-                  id: "python",
-                  label: "Python",
-                  outcome: {
-                    kind: "branch",
-                    next_question_id: "direct-mint-call"
-                  },
-                  when: "The backend is a Python service."
-                }
-              ],
-              prompt: "What is the backend that will hold the secret and mint sessions written in?",
-              supply_with: "--backend node | python | go | other-language",
-              why_it_is_asked: "this integration asserts its own user reference, so a session has to be minted server side, and only one language has a first-party minter; the rest is the same HTTP call, and saying so is more useful than pretending a package exists"
-            },
-            {
-              detectable: false,
-              id: "direct-mint-call",
-              options: [
-                {
-                  id: "call-the-mint-route",
-                  label: "Call the mint route from the backend",
-                  outcome: {
-                    attributes: {
-                      body_fields: [
-                        "ttl_seconds",
-                        "user_ref"
-                      ],
-                      failure_mode: "one opaque 401 for every credential failure",
-                      publishable_header: "x-everfur-partner-key",
-                      route: "POST /api/v1/widget/v1/sessions",
-                      secret_header: "x-everfur-partner-secret-key",
-                      secret_source: "an environment variable or secret manager on the server, never a bundled constant",
-                      ttl_behaviour: "ttl_seconds is clamped server side to the configured range; an absent value takes the default"
-                    },
-                    doc_paths: [
-                      "/.well-known/skills/everfur-integration.md#server-only-minter",
-                      "/reference/errors.md"
-                    ],
-                    kind: "terminal"
-                  },
-                  when: "Always, for a language with no first-party minter."
-                }
-              ],
-              prompt: "There is no first-party minter for this language. Confirm the direct call.",
-              supply_with: null,
-              why_it_is_asked: "three languages converge here because the answer is identical for all of them, and stating it once is what keeps the three from drifting apart"
-            }
-          ],
-          schema_version: 1,
-          supply_with: "--backend node | python | go | other-language",
-          title: "Which language mints sessions on the partner backend",
-          tree_id: "session-mint-language"
-        }
-      ]
-    },
-    "errors.yaml": {
-      errors: [
-        {
-          code: "AccessDeniedException",
-          confirmed_on_wire: true,
-          display: "You do not have access to that.",
-          doc_url: "/errors#AccessDeniedException",
-          envelope: "http_envelope",
-          http_status: 403,
-          naming_family: "pascal_exception",
-          note: "Emitted by the report-page tier gate with extra fields current_tier, required_tier, page_id and upgrade_url, and as the status-map default for any other 403 raised with a string detail.",
-          retryable: false,
-          surfaces: [
-            "consumer_app"
-          ]
-        },
-        {
-          code: "AuthorizationException",
-          confirmed_on_wire: true,
-          display: "Your session is not valid. Sign in again to continue.",
-          doc_url: "/errors#AuthorizationException",
-          envelope: "http_envelope",
-          http_status: 401,
-          naming_family: "pascal_exception",
-          note: "The generic 401. The widget partner-key path emits this with a string detail; the bearer path emits authExpired instead.",
-          retryable: false,
-          surfaces: [
-            "consumer_app",
-            "partner_widget"
-          ]
-        },
-        {
-          code: "ConflictException",
-          confirmed_on_wire: true,
-          display: "That is already running. Wait for it to finish, then try again.",
-          doc_url: "/errors#ConflictException",
-          envelope: "http_envelope",
-          http_status: 409,
-          naming_family: "pascal_exception",
-          note: "On the widget streaming routes this is the single-flight fence: register_stream does an atomic check-and-set and rejects a second concurrent stream for the same conversation. Retryable once the first stream ends, not immediately.",
-          retryable: true,
-          surfaces: [
-            "partner_widget"
-          ]
-        },
-        {
-          code: "DAILY_QUOTA_EXCEEDED",
-          confirmed_on_wire: true,
-          display: "You have used today's allowance for this. It resets tomorrow.",
-          doc_url: "/errors#DAILY_QUOTA_EXCEEDED",
-          envelope: "http_envelope",
-          http_status: 429,
-          naming_family: "screaming_snake",
-          note: "The per-endpoint guardrail, a different counter from the tier-wide daily quota. Its envelope is the leaner {detail, code, endpoint, daily_limit}; note it uses `detail`, not `message`, and carries no request_id.",
-          retryable: true,
-          surfaces: [
-            "consumer_app"
-          ]
-        },
-        {
-          code: "IDEMPOTENCY_KEY_IN_FLIGHT",
-          confirmed_on_wire: true,
-          display: "That is still processing. Give it a moment.",
-          doc_url: "/errors#IDEMPOTENCY_KEY_IN_FLIGHT",
-          envelope: "http_envelope",
-          http_status: 409,
-          naming_family: "screaming_snake",
-          note: "The same Idempotency-Key is already claimed and running. Retry the SAME key after a short backoff to pick up the recorded response; do not mint a new key, which would duplicate the write. No widget router opts into the idempotent route class today, so this is not reachable on the partner surface.",
-          retryable: true,
-          surfaces: [
-            "consumer_app"
-          ]
-        },
-        {
-          code: "IDEMPOTENCY_KEY_REUSED_DIFFERENT_REQUEST",
-          confirmed_on_wire: true,
-          display: "That request could not be repeated safely. Start it again.",
-          doc_url: "/errors#IDEMPOTENCY_KEY_REUSED_DIFFERENT_REQUEST",
-          envelope: "http_envelope",
-          http_status: 409,
-          naming_family: "screaming_snake",
-          note: "The key was reused with a different request body. This is a client bug, not a transient fault. Mint a fresh key for the new body.",
-          retryable: false,
-          surfaces: [
-            "consumer_app"
-          ]
-        },
-        {
-          code: "InternalFailureException",
-          confirmed_on_wire: true,
-          display: "Something went wrong on our side. Try again in a moment.",
-          doc_url: "/errors#InternalFailureException",
-          envelope: "http_envelope",
-          http_status: 500,
-          naming_family: "pascal_exception",
-          note: "Also the fallback for any status with no entry in the map, so a 502 arrives under this code. The message is masked to a fixed string for every 5xx except 501, so it never carries diagnostic detail. Quote request_id when reporting.",
-          retryable: true,
-          surfaces: [
-            "consumer_app",
-            "partner_widget"
-          ]
-        },
-        {
-          code: "NotImplementedException",
-          confirmed_on_wire: true,
-          display: "That is not available yet.",
-          doc_url: "/errors#NotImplementedException",
-          envelope: "http_envelope",
-          http_status: 501,
-          naming_family: "pascal_exception",
-          note: "The one 5xx whose message is passed through unmasked, because it describes product state rather than a fault.",
-          retryable: false,
-          surfaces: [
-            "consumer_app"
-          ]
-        },
-        {
-          code: "PaymentRequiredException",
-          confirmed_on_wire: false,
-          display: "This needs a plan upgrade.",
-          doc_url: "/errors#PaymentRequiredException",
-          envelope: "http_envelope",
-          http_status: 402,
-          naming_family: "pascal_exception",
-          note: "Present in the status map, but every 402 traced in this pass is emitted by the typed entitlement handler as TIER_UPGRADE_REQUIRED, not as this generic code.",
-          retryable: false,
-          surfaces: [
-            "consumer_app"
-          ]
-        },
-        {
-          code: "ResourceNotFoundException",
-          confirmed_on_wire: true,
-          display: "We could not find that.",
-          doc_url: "/errors#ResourceNotFoundException",
-          envelope: "http_envelope",
-          http_status: 404,
-          naming_family: "pascal_exception",
-          note: "Load-bearing ambiguity, by design. A dark runtime gate answers 404 so a disabled surface is indistinguishable from a missing resource, and an ownership miss answers 404 so another tenant's resource is invisible rather than merely forbidden. A client must not infer existence from a 404.",
-          retryable: false,
-          surfaces: [
-            "consumer_app",
-            "partner_widget"
-          ]
-        },
-        {
-          code: "ServiceUnavailableException",
-          confirmed_on_wire: true,
-          display: "That service is briefly unavailable. Try again shortly.",
-          doc_url: "/errors#ServiceUnavailableException",
-          envelope: "http_envelope",
-          http_status: 503,
-          naming_family: "pascal_exception",
-          note: "The status-map default for 503. The widget dependencies raise the dict-detail code `unavailable` instead, so a widget client sees that one.",
-          retryable: true,
-          surfaces: [
-            "consumer_app"
-          ]
-        },
-        {
-          code: "TIER_UPGRADE_REQUIRED",
-          confirmed_on_wire: true,
-          display: "This is part of a paid plan.",
-          doc_url: "/errors#TIER_UPGRADE_REQUIRED",
-          envelope: "http_envelope",
-          http_status: 402,
-          naming_family: "screaming_snake",
-          note: "The store paywall gate. Extends the envelope with capability, current_tier, limit, used, paywall_cta and upgrade_url. Distinct from the 403 AccessDeniedException tier gate on report pages.",
-          retryable: false,
-          surfaces: [
-            "consumer_app"
-          ]
-        },
-        {
-          code: "ThrottlingException",
-          confirmed_on_wire: true,
-          display: "You have reached the limit for now. Try again later.",
-          doc_url: "/errors#ThrottlingException",
-          envelope: "http_envelope",
-          http_status: 429,
-          naming_family: "pascal_exception",
-          note: "The quota handler extends the envelope with daily_limit, used and resets_at, and adds tier when the exception carries one. resets_at is the only reliable retry signal; there is no Retry-After on this path.",
-          retryable: true,
-          surfaces: [
-            "consumer_app",
-            "partner_widget"
-          ]
-        },
-        {
-          code: "ValidationException",
-          confirmed_on_wire: true,
-          display: "Something in that request was not right. Check the details and try again.",
-          doc_url: "/errors#ValidationException",
-          envelope: "http_envelope",
-          http_status: 400,
-          naming_family: "pascal_exception",
-          note: "The default code for 400, 413, 415 and 422 alike, so payload-too-large and unsupported-media-type are indistinguishable from a field error by code. Branch on http_status as well as code.",
-          retryable: false,
-          surfaces: [
-            "consumer_app",
-            "partner_widget"
-          ]
-        },
-        {
-          code: "accessDenied",
-          confirmed_on_wire: true,
-          display: "That request could not be authorised.",
-          doc_url: "/errors#accessDenied",
-          envelope: "http_envelope",
-          http_status: 403,
-          naming_family: "camel",
-          note: "The caller presented BOTH a session bearer and a publishable partner key. Exactly one is correct per request. Retrying with both set will fail identically.",
-          retryable: false,
-          surfaces: [
-            "partner_widget"
-          ]
-        },
-        {
-          code: "authExpired",
-          confirmed_on_wire: true,
-          display: "Your session expired. Reconnecting.",
-          doc_url: "/errors#authExpired",
-          envelope: "http_envelope",
-          http_status: 401,
-          naming_family: "camel",
-          note: "The one 401 a client should respond to by minting a fresh session token and replaying the request exactly once. Emitted for a bad signature, an expired token, a wrong typ or issuer, a token missing a required claim, and for a bearer whose signing key has since been revoked. Do not loop: a second authExpired on the replay is terminal.",
-          retryable: true,
-          surfaces: [
-            "partner_widget"
-          ]
-        },
-        {
-          code: "internal_error",
-          confirmed_on_wire: true,
-          display: "Something went wrong on our side.",
-          doc_url: "/errors#sse-internal_error",
-          envelope: "sse_frame",
-          http_status: 200,
-          naming_family: "snake",
-          note: "Emitted with retryable false. The frame carries no request_id, so there is nothing for a client to quote in a support report; correlate by timestamp and conversation id instead. Everfur is tracking the gap.",
-          retryable: false,
-          surfaces: [
-            "partner_widget"
-          ]
-        },
-        {
-          code: "invalidRequest",
-          confirmed_on_wire: true,
-          display: "This app needs to be updated to keep using Everfur.",
-          doc_url: "/errors#invalidRequest",
-          envelope: "http_envelope",
-          http_status: 400,
-          naming_family: "camel",
-          note: "The SDK min-version and wire-contract gate. Deliberately 400 rather than 401, 403 or 426, so it neither trips refresh machinery nor lands as an unmapped status. The response carries a `reason` alongside the message so the client can say what specifically is out of date. Inert while the gate flag is off.",
-          retryable: false,
-          surfaces: [
-            "partner_widget"
-          ]
-        },
-        {
-          code: "not_found",
-          confirmed_on_wire: true,
-          display: "We could not find that conversation.",
-          doc_url: "/errors#sse-not_found",
-          envelope: "sse_frame",
-          http_status: 200,
-          naming_family: "snake",
-          note: "The stream had already returned 200 and its headers when the failure was discovered, so the HTTP status cannot express it. A client parsing only status codes will read this as success. Parse every data frame for an `error` key.",
-          retryable: false,
-          surfaces: [
-            "partner_widget"
-          ]
-        },
-        {
-          code: "session_required",
-          confirmed_on_wire: true,
-          display: "This app needs to be updated to keep using Everfur.",
-          doc_url: "/errors#session_required",
-          envelope: "http_envelope",
-          http_status: 403,
-          naming_family: "snake",
-          note: "An unsigned caller claimed an identity on a tenant that now requires signed sessions. Not retryable as sent: the integration must mint a session token through POST /widget/v1/sessions and carry the bearer instead.",
-          retryable: false,
-          surfaces: [
-            "partner_widget"
-          ]
-        },
-        {
-          code: "timeout",
-          confirmed_on_wire: true,
-          display: "That took too long. Try again.",
-          doc_url: "/errors#sse-timeout",
-          envelope: "sse_frame",
-          http_status: 200,
-          naming_family: "snake",
-          note: "Emitted with retryable true when the stream times out or is cancelled. A partial assistant turn may already have been persisted, so a retry can produce a visible duplicate; reconcile against the transcript rather than assuming nothing was written.",
-          retryable: true,
-          surfaces: [
-            "partner_widget"
-          ]
-        },
-        {
-          code: "unavailable",
-          confirmed_on_wire: true,
-          display: "We are having trouble reaching that right now. Try again shortly.",
-          doc_url: "/errors#unavailable",
-          envelope: "http_envelope",
-          http_status: 503,
-          naming_family: "snake",
-          note: "Deliberately a 503 and not a 401. It means the server could not decide, because the signing secret was unresolvable or the key-revocation check timed out. Answering 401 here would spin the client's refresh loop against a server fault, so a client must NOT refresh on this code; back off and retry the same request.",
-          retryable: true,
-          surfaces: [
-            "partner_widget"
-          ]
-        }
-      ],
-      schema_version: 1
-    }
-  }};
-
-// src/contract/bundled.ts
-var BUNDLED_CONTRACT = contract_public_default;
-function bundledContractGeneratedAt() {
-  const doc = contract_public_default;
-  return typeof doc.generatedAt === "string" ? doc.generatedAt : "unknown";
-}
-function bundledContractDigest() {
-  const doc = contract_public_default;
-  const value = doc.digest?.actual ?? doc.digest?.expected;
-  return typeof value === "string" ? value : "unknown";
-}
-
-// src/commands/plan/trees.ts
-var DECISION_TREES_DOCUMENT_KEY = "decision-trees.yaml";
-var PLATFORM_TREE = "platform";
-var CAPABILITIES_TREE = "capabilities";
-var IDENTITY_TREE = "identity-mode";
-var SESSION_MINT_TREE = "session-mint-language";
-var PROJECT_SHAPE_QUESTION = "project-shape";
-var PACKAGE_MANAGER_QUESTION = "node-package-manager";
-var CAPABILITY_QUESTION = "which-capability";
-var IDENTITY_QUESTION = "how-users-are-named";
-var BACKEND_LANGUAGE_QUESTION = "backend-language";
-function readString2(record, key) {
-  const value = record[key];
-  return typeof value === "string" && value.length > 0 ? value : null;
-}
-function readStringList2(record, key) {
-  const value = record[key];
-  if (!Array.isArray(value)) return Object.freeze([]);
-  return Object.freeze(value.filter((item) => typeof item === "string"));
-}
-function readAttributes(value) {
-  if (!isJsonObject(value)) return Object.freeze({});
-  const attributes = {};
-  for (const [key, item] of Object.entries(value)) {
-    if (item === null || typeof item === "string" || typeof item === "number" || typeof item === "boolean") {
-      attributes[key] = item;
-      continue;
-    }
-    if (Array.isArray(item) && item.every((entry) => typeof entry === "string")) {
-      attributes[key] = Object.freeze([...item]);
-    }
-  }
-  return Object.freeze(attributes);
-}
-function outcomeFromRow(row) {
-  if (!isJsonObject(row)) return null;
-  const kind = readString2(row, "kind");
-  if (kind === "branch") {
-    const nextQuestionId = readString2(row, "next_question_id");
-    return nextQuestionId === null ? null : { kind, nextQuestionId };
-  }
-  if (kind === "terminal") {
-    return Object.freeze({
-      kind,
-      attributes: readAttributes(row["attributes"]),
-      docPaths: readStringList2(row, "doc_paths"),
-      capabilityRefs: readStringList2(row, "capability_refs"),
-      thenAskTreeId: readString2(row, "then_ask_tree_id")
-    });
-  }
-  if (kind === "blocked") {
-    const reason = readString2(row, "reason");
-    const unblockOwner = readString2(row, "unblock_owner");
-    const requestPath = readString2(row, "request_path");
-    if (reason === null || unblockOwner === null || requestPath === null) return null;
-    return Object.freeze({
-      kind,
-      reason,
-      unblockOwner,
-      requestPath,
-      capabilityRefs: readStringList2(row, "capability_refs")
-    });
-  }
-  return null;
-}
-function optionFromRow(row) {
-  if (!isJsonObject(row)) return null;
-  const id = readString2(row, "id");
-  if (id === null) return null;
-  const outcome = outcomeFromRow(row["outcome"]);
-  if (outcome === null) return null;
-  return Object.freeze({
-    id,
-    label: readString2(row, "label") ?? id,
-    when: readString2(row, "when") ?? "",
-    outcome
-  });
-}
-function questionFromRow(row) {
-  if (!isJsonObject(row)) return null;
-  const id = readString2(row, "id");
-  if (id === null) return null;
-  const rawOptions = Array.isArray(row["options"]) ? row["options"] : [];
-  const options = rawOptions.map(optionFromRow).filter((option) => option !== null).sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
-  if (options.length === 0) return null;
-  return Object.freeze({
-    id,
-    prompt: readString2(row, "prompt") ?? "",
-    whyItIsAsked: readString2(row, "why_it_is_asked") ?? "",
-    supplyWith: readString2(row, "supply_with"),
-    detectable: row["detectable"] === true,
-    options: Object.freeze(options)
-  });
-}
-function principleFromRow(row) {
-  if (!isJsonObject(row)) return null;
-  const id = readString2(row, "id");
-  const statement = readString2(row, "statement");
-  if (id === null || statement === null) return null;
-  return Object.freeze({
-    id,
-    title: readString2(row, "title") ?? id,
-    statement,
-    docPath: readString2(row, "doc_path")
-  });
-}
-function treeFromRow(row) {
-  if (!isJsonObject(row)) return null;
-  const treeId = readString2(row, "tree_id");
-  const entryQuestionId = readString2(row, "entry_question_id");
-  if (treeId === null || entryQuestionId === null) return null;
-  const rawQuestions = Array.isArray(row["questions"]) ? row["questions"] : [];
-  const questions = rawQuestions.map(questionFromRow).filter((question) => question !== null);
-  if (!questions.some((question) => question.id === entryQuestionId)) return null;
-  const rawPrinciples = Array.isArray(row["principles"]) ? row["principles"] : [];
-  return Object.freeze({
-    treeId,
-    title: readString2(row, "title") ?? treeId,
-    decides: readString2(row, "decides") ?? "",
-    supplyWith: readString2(row, "supply_with") ?? "",
-    entryQuestionId,
-    principles: Object.freeze(
-      rawPrinciples.map(principleFromRow).filter((p) => p !== null)
-    ),
-    questions: Object.freeze(questions)
-  });
-}
-function buildDecisionSpace(trees, source, digest) {
-  const byId = new Map(trees.map((tree) => [tree.treeId, tree]));
-  const space = {
-    trees: Object.freeze([...trees].sort((a, b) => a.treeId < b.treeId ? -1 : 1)),
-    source,
-    digest,
-    tree: (treeId) => byId.get(treeId) ?? null,
-    question(treeId, questionId) {
-      return byId.get(treeId)?.questions.find((q) => q.id === questionId) ?? null;
-    },
-    choices(treeId, questionId) {
-      const question = space.question(treeId, questionId);
-      return question === null ? Object.freeze([]) : question.options.map((option) => option.id);
-    }
-  };
-  return Object.freeze(space);
-}
-function loadDecisionSpace(fs, path) {
-  const outcome = validateContractFile(fs, path);
-  if (outcome.kind !== "valid") return { kind: "contract_rejected", outcome };
-  const document = outcome.projection[DECISION_TREES_DOCUMENT_KEY];
-  if (!isJsonObject(document)) return { kind: "no_trees", path };
-  const rows = document["trees"];
-  if (!Array.isArray(rows)) return { kind: "no_trees", path };
-  const trees = rows.map(treeFromRow).filter((tree) => tree !== null);
-  if (trees.length === 0) return { kind: "no_trees", path };
-  return { kind: "loaded", space: buildDecisionSpace(trees, outcome.path, outcome.digest.actual) };
-}
-function walkTree(tree, answerFor) {
-  const path = [];
-  const visited = /* @__PURE__ */ new Set();
-  let questionId = tree.entryQuestionId;
-  for (; ; ) {
-    if (visited.has(questionId)) {
-      return { kind: "unwalkable", detail: `the ${tree.treeId} tree loops at question "${questionId}"` };
-    }
-    visited.add(questionId);
-    const question = tree.questions.find((candidate) => candidate.id === questionId);
-    if (question === void 0) {
-      return {
-        kind: "unwalkable",
-        detail: `the ${tree.treeId} tree points at a question "${questionId}" it does not carry`
-      };
-    }
-    const implied = question.options.length === 1;
-    const answer = implied ? question.options[0]?.id ?? null : answerFor(question.id);
-    if (answer === null) return { kind: "unanswered", question };
-    const option = question.options.find((candidate) => candidate.id === answer);
-    if (option === void 0) return { kind: "unknown_option", question, given: answer };
-    path.push({ questionId: question.id, optionId: option.id, implied });
-    if (option.outcome.kind === "terminal") {
-      return { kind: "terminal", outcome: option.outcome, path: Object.freeze(path) };
-    }
-    if (option.outcome.kind === "blocked") {
-      return { kind: "blocked", outcome: option.outcome, path: Object.freeze(path) };
-    }
-    questionId = option.outcome.nextQuestionId;
-  }
-}
-function walkSingle(tree, answer) {
-  return walkTree(tree, (questionId) => questionId === tree.entryQuestionId ? answer : null);
-}
-function stringAttribute(outcome, key) {
-  const value = outcome.attributes[key];
-  return typeof value === "string" ? value : null;
-}
-function listAttribute(outcome, key) {
-  const value = outcome.attributes[key];
-  return Array.isArray(value) ? value : Object.freeze([]);
-}
-function loadBundledDecisionSpace() {
-  const doc = BUNDLED_CONTRACT;
-  const trees = doc.projection?.[DECISION_TREES_DOCUMENT_KEY];
-  const rows = Array.isArray(trees?.trees) ? trees.trees : [];
-  const parsed = rows.map(treeFromRow).filter((t) => t !== null);
-  if (parsed.length === 0) return { kind: "no_trees", path: "(bundled)" };
-  return {
-    kind: "loaded",
-    // The digest travels inside the bundled document, so it is reported rather than recomputed.
-    space: buildDecisionSpace(
-      parsed,
-      `(bundled with the Everfur CLI, generated ${bundledContractGeneratedAt()})`,
-      bundledContractDigest()
-    )
-  };
-}
-
-// src/commands/plan/types.ts
-var PLAN_SCHEMA_VERSION = 1;
-var PLAN_DOCUMENT_KIND = "everfur.plan";
-var MISSING_FACT_NAMES = Object.freeze([
-  "decisionTrees",
-  "projectType",
-  "packageManager",
-  "capabilities",
-  "identityMode",
-  "sessionMintLanguage"
-]);
-
-// src/commands/plan/capabilities.ts
-var NODE_SUBPATH_ATTRIBUTE = "node_subpath";
-var DART_LIBRARY_ATTRIBUTE = "dart_library";
-var NATIVE_PEERS_ATTRIBUTE = "native_peers";
-var SUMMARY_ATTRIBUTE = "summary";
-function resolveCapabilities(space, capabilities) {
-  const tree = space.tree(CAPABILITIES_TREE);
-  if (tree === null) {
-    return Object.freeze({ mounted: [], blocked: [], unresolved: Object.freeze([...capabilities]) });
-  }
-  const mounted = [];
-  const blocked = [];
-  const unresolved = [];
-  for (const capability of capabilities) {
-    const result = walkSingle(tree, capability);
-    if (result.kind === "terminal") {
-      mounted.push({ capability, outcome: result.outcome });
-      continue;
-    }
-    if (result.kind === "blocked") {
-      blocked.push({
-        capability,
-        reason: result.outcome.reason,
-        unblockOwner: result.outcome.unblockOwner,
-        requestPath: result.outcome.requestPath,
-        capabilityKeys: result.outcome.capabilityRefs
-      });
-      continue;
-    }
-    unresolved.push(capability);
-  }
-  return Object.freeze({
-    mounted: Object.freeze(mounted),
-    blocked: Object.freeze(blocked),
-    unresolved: Object.freeze(unresolved)
-  });
-}
-function nativePeersFor(mounted) {
-  const peers = /* @__PURE__ */ new Set();
-  for (const entry of mounted) {
-    for (const peer of listAttribute(entry.outcome, NATIVE_PEERS_ATTRIBUTE)) peers.add(peer);
-  }
-  return Object.freeze([...peers].sort());
-}
-function importTargetFor(entry, isDart) {
-  return stringAttribute(entry.outcome, isDart ? DART_LIBRARY_ATTRIBUTE : NODE_SUBPATH_ATTRIBUTE);
-}
-function summaryFor(entry) {
-  return stringAttribute(entry.outcome, SUMMARY_ATTRIBUTE) ?? "";
-}
-
-// src/commands/plan/sdk-package.ts
-var SDK_PACKAGE = "@everfur/sdk";
-function sdkInstallSpec() {
-  return SDK_PACKAGE ;
-}
-
-// src/commands/plan/codegen.ts
-var COMPONENT_SURFACES = Object.freeze({
-  chat: "EverfurChat",
-  animations: "PetStateView"
-});
-var HOOK_SURFACES = Object.freeze({
-  records: "useEverfurRecords",
-  photo: "usePhotoCheckup",
-  video: "useEverfurVideo"
-});
-var HOOK_CALL_ARGS = Object.freeze({
-  records: "{ petRef }",
-  photo: "{ petRef }",
-  video: ""
-});
-function subpathFor(capability) {
-  return capability === "chat" ? SDK_PACKAGE : `${SDK_PACKAGE}/${capability}`;
-}
-function isComponentSurface(capability) {
-  return capability in COMPONENT_SURFACES;
-}
-function hookFor(capability) {
-  return HOOK_SURFACES[capability] ?? null;
-}
-function integrationFile(input) {
-  const components = input.capabilities.filter(isComponentSurface);
-  const hooks = input.capabilities.filter((c) => hookFor(c) !== null);
-  if (components.length === 0 && hooks.length === 0) return null;
-  const personalized = input.identityMode !== null && input.identityMode !== "anonymous";
-  const rootNames = ["EverfurProvider", ...components.includes("chat") ? ["EverfurChat"] : []];
-  if (personalized) rootNames.push("userRef");
-  const imports = [`import { ${rootNames.join(", ")} } from '${SDK_PACKAGE}';`];
-  for (const capability of components) {
-    if (capability === "chat") continue;
-    imports.push(`import { ${COMPONENT_SURFACES[capability]} } from '${subpathFor(capability)}';`);
-  }
-  for (const capability of hooks) {
-    imports.push(`import { ${hookFor(capability)} } from '${subpathFor(capability)}';`);
-  }
-  const rendered = components.map((c) => `      <${COMPONENT_SURFACES[c]} />`).join("\n");
-  const userProp = personalized ? `
-      user={{
-        userRef: userRef(YOUR_USER_ID),
-        // Called whenever a session is needed. Must return a bearer minted by YOUR backend from the
-        // secret key, which never ships in this app. Use an absolute URL: a relative path does not
-        // resolve in a React Native bundle.
-        getToken: () =>
-          fetch('https://your-backend.example.com/everfur-session').then((r) => r.text()),
-      }}` : "";
-  const hookNote = hooks.length === 0 ? "" : `
-// ${hooks.map((c) => `${hookFor(c)}(${HOOK_CALL_ARGS[c] ?? ""}) drives the ${c} surface`).join(", ")}. These publish state, not a prebuilt screen, so the UI is yours: each returns
-// a status of loading, empty, error or populated. Render all four.
-`;
-  const envNote = input.isExpo ? "In Expo, an EXPO_PUBLIC_ prefixed env var is inlined at build time and is a reasonable home for these." : "Read these from your own config. The publishable key is designed to ship in the bundle; the secret key is not.";
-  const contents = `${imports.join("\n")}
-${hookNote}
-// Replace both. The publishable key is provisioned by Everfur and is safe to ship inside the app.
-// ${envNote}
-const EVERFUR_PUBLISHABLE_KEY = 'pk_live_replace_me';
-const EVERFUR_API_BASE_URL = 'https://api.everfur.com/api/v1';
-${personalized ? "const YOUR_USER_ID = 'replace-with-your-stable-user-id';\n" : ""}
-export default function App() {
-  return (
-    <EverfurProvider
-      config={{
-        publishableKey: EVERFUR_PUBLISHABLE_KEY,
-        apiBaseUrl: EVERFUR_API_BASE_URL,
-      }}${userProp}
-    >
-${rendered}
-    </EverfurProvider>
-  );
-}
-`;
-  return Object.freeze({ path: "App.tsx", language: "tsx", contents });
-}
-
-// src/commands/plan/planner.ts
-var PARTNER_SECRET_ENV_VAR = "EVERFUR_PARTNER_SECRET_KEY";
-function walkPlatform(space, detection) {
-  const tree = space.tree(PLATFORM_TREE);
-  if (tree === null) return null;
-  return walkTree(tree, (questionId) => {
-    if (questionId === PROJECT_SHAPE_QUESTION) {
-      return detection.projectType === "unknown" ? null : detection.projectType;
-    }
-    if (questionId === PACKAGE_MANAGER_QUESTION) {
-      return detection.packageManager === "undetermined" || detection.packageManager === "not-applicable" ? null : detection.packageManager;
-    }
-    return null;
-  });
-}
-function walkIdentity(space, identityMode) {
-  const tree = space.tree(IDENTITY_TREE);
-  if (tree === null || identityMode === null) return null;
-  return walkSingle(tree, identityMode);
-}
-function walkSessionMint(space, language) {
-  const tree = space.tree(SESSION_MINT_TREE);
-  if (tree === null || language === null) return null;
-  return walkTree(
-    tree,
-    (questionId) => questionId === BACKEND_LANGUAGE_QUESTION ? language : null
-  );
-}
-function requiresSessionMint(walk) {
-  return walk?.kind === "terminal" && walk.outcome.thenAskTreeId === SESSION_MINT_TREE;
-}
-function terminalOf(walk) {
-  return walk?.kind === "terminal" ? walk.outcome : null;
-}
-function supplyWithFor(space, treeId, questionId, fallback) {
-  const question = space.question(treeId, questionId);
-  if (question !== null && question.supplyWith !== null) return question.supplyWith;
-  const tree = space.tree(treeId);
-  if (tree !== null && tree.supplyWith.length > 0) return tree.supplyWith;
-  return fallback;
-}
-function reasonFor(space, treeId, questionId, fallback) {
-  const question = space.question(treeId, questionId);
-  return question !== null && question.whyItIsAsked.length > 0 ? question.whyItIsAsked : fallback;
-}
-function detectionReason(detection, kind) {
-  if (kind === "projectType") {
-    return detection.projectTypeEvidence.length > 0 ? `could not identify the project shape at ${detection.root}: ${detection.projectTypeEvidence.join("; ")}` : `could not identify the project shape at ${detection.root}`;
-  }
-  return detection.packageManagerEvidence.length > 0 ? `could not identify the package manager at ${detection.root}: ${detection.packageManagerEvidence.join("; ")}` : `could not identify the package manager at ${detection.root}`;
-}
-function missingFactsFor(input) {
-  const missing = [];
-  const detection = input.detection;
-  const space = input.space ?? null;
-  if (space === null) {
-    missing.push({
-      fact: "decisionTrees",
-      reason: "no contract-public projection was found, so the decision space this plan is built from is unavailable; the CLI does not carry a copy of it",
-      supplyWith: "pass --contract <file>, or export EVERFUR_CONTRACT_PUBLIC"
-    });
-    if (detection.projectType === "unknown") {
-      missing.push({
-        fact: "projectType",
-        reason: detectionReason(detection, "projectType"),
-        supplyWith: "run from the application root, or pass --cwd <path> pointing at it"
-      });
-    }
-    if (detection.packageManager === "undetermined") {
-      missing.push({
-        fact: "packageManager",
-        reason: detectionReason(detection, "packageManager"),
-        supplyWith: 'add a "packageManager" field to package.json, or leave exactly one lockfile in the project root'
-      });
-    }
-    if (input.capabilities === null || input.capabilities.length === 0) {
-      missing.push({
-        fact: "capabilities",
-        reason: "which Everfur capabilities this integration uses cannot be read from the project",
-        supplyWith: "--capabilities <list>; the valid ids are published in the contract"
-      });
-    }
-    if (input.identityMode === null) {
-      missing.push({
-        fact: "identityMode",
-        reason: "how this integration identifies end users cannot be read from the project",
-        supplyWith: "--identity <mode>; the valid modes are published in the contract"
-      });
-    }
-    return Object.freeze(missing);
-  }
-  const platform = walkPlatform(space, detection);
-  const drift = platform !== null && platform.kind === "unknown_option" ? platform : null;
-  if (detection.projectType === "unknown" || drift?.question.id === PROJECT_SHAPE_QUESTION) {
-    missing.push({
-      fact: "projectType",
-      reason: drift?.question.id === PROJECT_SHAPE_QUESTION ? `this project reads as "${drift.given}", which the platform decision tree at ${space.source} does not carry` : detectionReason(detection, "projectType"),
-      supplyWith: supplyWithFor(
-        space,
-        PLATFORM_TREE,
-        PROJECT_SHAPE_QUESTION,
-        "run from the application root, or pass --cwd <path> pointing at it"
-      )
-    });
-  }
-  if (detection.packageManager === "undetermined" || drift?.question.id === PACKAGE_MANAGER_QUESTION) {
-    missing.push({
-      fact: "packageManager",
-      reason: drift?.question.id === PACKAGE_MANAGER_QUESTION ? `this project installs with "${drift.given}", which the platform decision tree at ${space.source} does not carry` : detectionReason(detection, "packageManager"),
-      supplyWith: supplyWithFor(
-        space,
-        PLATFORM_TREE,
-        PACKAGE_MANAGER_QUESTION,
-        'add a "packageManager" field to package.json, or leave exactly one lockfile in the project root'
-      )
-    });
-  }
-  if (input.capabilities === null || input.capabilities.length === 0) {
-    missing.push({
-      fact: "capabilities",
-      reason: reasonFor(
-        space,
-        CAPABILITIES_TREE,
-        CAPABILITY_QUESTION,
-        "which Everfur capabilities this integration uses cannot be read from the project"
-      ),
-      supplyWith: supplyWithFor(space, CAPABILITIES_TREE, CAPABILITY_QUESTION, "--capabilities <list>")
-    });
-  } else {
-    const resolution = resolveCapabilities(space, input.capabilities);
-    if (resolution.unresolved.length > 0) {
-      missing.push({
-        fact: "capabilities",
-        reason: `the decision space at ${space.source} carries no outcome for ${resolution.unresolved.join(", ")}`,
-        supplyWith: supplyWithFor(space, CAPABILITIES_TREE, CAPABILITY_QUESTION, "--capabilities <list>")
-      });
-    }
-  }
-  if (input.identityMode === null) {
-    missing.push({
-      fact: "identityMode",
-      reason: reasonFor(
-        space,
-        IDENTITY_TREE,
-        IDENTITY_QUESTION,
-        "how this integration identifies end users cannot be read from the project"
-      ),
-      supplyWith: supplyWithFor(space, IDENTITY_TREE, IDENTITY_QUESTION, "--identity <mode>")
-    });
-  }
-  const identity = space === null ? null : walkIdentity(space, input.identityMode);
-  if (requiresSessionMint(identity) && input.sessionMintLanguage === null) {
-    missing.push({
-      fact: "sessionMintLanguage",
-      reason: reasonFor(
-        space,
-        SESSION_MINT_TREE,
-        BACKEND_LANGUAGE_QUESTION,
-        "this identity mode mints sessions on your backend, and the language cannot be read from this project"
-      ),
-      supplyWith: supplyWithFor(space, SESSION_MINT_TREE, BACKEND_LANGUAGE_QUESTION, "--backend <language>")
-    });
-  }
-  return Object.freeze(missing);
-}
-function toPlanDetection(detection) {
-  return {
-    root: detection.root,
-    projectType: detection.projectType,
-    projectTypeEvidence: detection.projectTypeEvidence,
-    packageManager: detection.packageManager,
-    packageManagerEvidence: detection.packageManagerEvidence,
-    dependencies: detection.dependencies.map((dependency) => ({
-      name: dependency.name,
-      declared: dependency.declared,
-      installed: dependency.installed,
-      source: dependency.source,
-      scope: dependency.scope
-    }))
-  };
-}
-function principlesFor(space, consulted) {
-  if (space === null) return Object.freeze([]);
-  const principles = [];
-  for (const treeId of [...consulted].sort()) {
-    const tree = space.tree(treeId);
-    if (tree === null) continue;
-    for (const principle of tree.principles) {
-      principles.push({
-        treeId,
-        id: principle.id,
-        title: principle.title,
-        statement: principle.statement,
-        docPath: principle.docPath
-      });
-    }
-  }
-  return Object.freeze(principles);
-}
-function warningsFor(input, mounted, blocked) {
-  const warnings = [];
-  const { detection } = input;
-  if (blocked.length > 0 && mounted.length > 0) {
-    warnings.push({
-      code: "capabilities_blocked",
-      message: `This plan covers ${mounted.length} of the ${mounted.length + blocked.length} capabilities you named. The rest cannot be built today; see the blocked section for the reason and where to ask.`
-    });
-  }
-  const peers = nativePeersFor(mounted);
-  if (detection.projectType === "expo-managed" && peers.length > 0) {
-    warnings.push({
-      code: "expo_go_incompatible",
-      message: `The selected capabilities need native modules (${peers.join(", ")}), which Expo Go cannot load. This project needs a development build.`
-    });
-  }
-  const nodeProject = detection.projectType === "expo-managed" || detection.projectType === "bare-react-native" || detection.projectType === "web";
-  if (nodeProject && detection.dependencies.length > 0) {
-    const anyInstalled = detection.dependencies.some((dependency) => dependency.installed !== null);
-    if (!anyInstalled) {
-      warnings.push({
-        code: "dependencies_not_installed",
-        message: "No resolved versions were found under node_modules, so every reported version is the declared range from package.json rather than what is actually installed."
-      });
-    }
-  }
-  const hasSdk = detection.dependencies.some(
-    (dependency) => dependency.name === SDK_PACKAGE || dependency.name === "everfur_sdk"
-  );
-  if (!hasSdk) {
-    warnings.push({
-      code: "sdk_not_present",
-      message: "The Everfur SDK is not declared in this project yet, so this integration starts from installing it."
-    });
-  }
-  return Object.freeze(warnings);
-}
-function installSteps(detection, platform, mounted) {
-  const steps = [];
-  const commands = listAttribute(platform, "install_commands");
-  const verb = stringAttribute(platform, "install_verb");
-  const manifest = stringAttribute(platform, "manifest") ?? "package.json";
-  steps.push({
-    id: "install-sdk",
-    phase: "install",
-    title: "Add the Everfur SDK",
-    detail: "Installs the package that carries every capability surface used below.",
-    // Only the SPEC changes while the package is unpublished. The verb the platform tree
-    // published still decides the command, and a platform naming its own install_commands still
-    // wins outright, so nothing here overrides a more specific answer.
-    commands: commands.length > 0 ? Object.freeze([...commands]) : verb === null ? Object.freeze([]) : Object.freeze([`${verb} ${sdkInstallSpec()}`]),
-    files: [manifest]
-  });
-  const peers = nativePeersFor(mounted);
-  if (peers.length === 0) return Object.freeze(steps);
-  const peerInstall = detection.projectType === "expo-managed" ? `npx expo install ${peers.join(" ")}` : verb === null ? null : `${verb} ${peers.join(" ")}`;
-  steps.push({
-    id: "install-native-peers",
-    phase: "install",
-    title: "Add the optional native peer dependencies",
-    detail: `The selected capabilities bind these modules at composition time: ${peers.join(", ")}. They are declared optional by ${SDK_PACKAGE}, so nothing installs them for you.`,
-    commands: peerInstall === null ? Object.freeze([]) : Object.freeze([peerInstall]),
-    files: [manifest]
-  });
-  return Object.freeze(steps);
-}
-function nativeSteps(detection, mounted) {
-  if (nativePeersFor(mounted).length === 0) return Object.freeze([]);
-  if (detection.projectType === "expo-managed") {
-    return Object.freeze([
-      {
-        id: "native-development-build",
-        phase: "native",
-        title: "Create a development build",
-        detail: "The peer modules above ship native code, which Expo Go cannot load. Generate the native projects and install a development build on the device or simulator you test on.",
-        commands: ["npx expo prebuild", "npx expo run:ios", "npx expo run:android"],
-        files: ["app.json"]
-      }
-    ]);
-  }
-  if (detection.projectType === "bare-react-native") {
-    return Object.freeze([
-      {
-        id: "native-pod-install",
-        phase: "native",
-        title: "Link the native modules on iOS",
-        detail: "Autolinking picks up the new pods once the Podfile is resolved again.",
-        commands: ["cd ios && pod install"],
-        files: ["ios/Podfile.lock"]
-      }
-    ]);
-  }
-  return Object.freeze([]);
-}
-function identityStep(detection, identityMode, outcome) {
-  const userRefHeader = stringAttribute(outcome, "user_ref_header");
-  const roleHeader = stringAttribute(outcome, "user_role_header");
-  if (userRefHeader === null) {
-    return {
-      id: "configure-identity-anonymous",
-      phase: "configure",
-      title: "Run without an end user reference",
-      detail: [
-        "Send no end user reference header.",
-        "The API fences ownership on the (user, pet) composite, so with no user reference asserted, nothing owned by a specific end user is reachable.",
-        "Choose this only for a surface that shows no per-user data."
-      ].join(" "),
-      commands: [],
-      files: []
-    };
-  }
-  return {
-    id: `configure-identity-${identityMode}`,
-    phase: "configure",
-    title: "Assert the end user on every request",
-    detail: [
-      `Assert the end user on each request with the ${userRefHeader} header${roleHeader === null ? "" : `, and their role with ${roleHeader} when your integration distinguishes roles`}.`,
-      "The API fences ownership on the (user, pet) composite, so the user reference is what makes the pets of one tenant invisible to another. Send a stable, non-guessable value per end user.",
-      "It is case sensitive and it is compared exactly: normalise your identifiers once where they are minted, never on this path."
-    ].join(" "),
-    commands: [],
-    files: detection.projectType === "flutter" ? ["lib/everfur_client.dart"] : ["app/everfur-provider.ts"]
-  };
-}
-function sessionMintStep(detection, outcome) {
-  const subpath = stringAttribute(outcome, "import_subpath");
-  const route = stringAttribute(outcome, "route");
-  const secretHeader = stringAttribute(outcome, "secret_header");
-  const publishableHeader = stringAttribute(outcome, "publishable_header");
-  const bodyFields = listAttribute(outcome, "body_fields");
-  const detail = [
-    `Read the partner secret key from the ${PARTNER_SECRET_ENV_VAR} environment variable on your server and exchange it for a session there.`
-  ];
-  if (subpath !== null) {
-    detail.push(
-      `Import the minter from ${subpath} and from nowhere else: that subpath declares no react-native condition, so a mobile bundler cannot resolve it, and the subpath is the fence rather than the function.`
-    );
-  }
-  if (route !== null) {
-    detail.push(
-      `There is no first-party minter for this language, so call ${route} from your backend directly${secretHeader === null || publishableHeader === null ? "" : `, sending the ${secretHeader} and ${publishableHeader} headers`}${bodyFields.length === 0 ? "" : ` and a body carrying ${bodyFields.join(" and ")}`}.`
-    );
-  }
-  detail.push(
-    "The secret key must never reach a client bundle, a mobile binary, or a browser: anything shipped to a device is readable by the person holding it.",
-    "This CLI does not mint, read, or print that key. Obtain it through the partner console."
-  );
-  return {
-    id: "configure-session-mint",
-    phase: "configure",
-    title: "Mint sessions on your backend",
-    detail: detail.join(" "),
-    commands: [],
-    files: detection.projectType === "flutter" ? ["lib/everfur_session.dart"] : ["server/everfur-session.ts"]
-  };
-}
-function codeSteps(detection, mounted) {
-  const isDart = detection.projectType === "flutter";
-  return Object.freeze(
-    mounted.map((entry) => {
-      const importTarget = importTargetFor(entry, isDart);
-      const summary = summaryFor(entry);
-      const hook = hookFor(entry.capability);
-      return {
-        id: `mount-${entry.capability}`,
-        phase: "code",
-        title: `Mount the ${entry.capability} capability`,
-        detail: importTarget === null ? `${summary} The contract publishes no import target for this project shape.` : hook !== null ? `${summary} Import ${hook} from ${importTarget}. This surface publishes state, not a prebuilt screen, so the UI is yours: it reports loading, empty, error and populated, and all four need rendering.` : `${summary} Import from ${importTarget} and mount it inside the Everfur provider you configured above.`,
-        commands: [],
-        files: []
-      };
-    })
-  );
-}
-function verifyStep() {
-  return {
-    id: "verify-request-id",
-    phase: "verify",
-    title: "Confirm the request id round trip",
-    detail: "Send one request through your integration and record the X-Request-ID value. The API echoes a caller-supplied id and generates one otherwise; that id is what support correlates against. Capture it in your logs before you need it.",
-    commands: [],
-    files: []
-  };
-}
-function consultedTrees(space, mintRequired) {
-  if (space === null) return Object.freeze([]);
-  const ids = [PLATFORM_TREE, CAPABILITIES_TREE, IDENTITY_TREE];
-  if (mintRequired) ids.push(SESSION_MINT_TREE);
-  return Object.freeze(ids.filter((id) => space.tree(id) !== null));
-}
-function provenanceFor(space) {
-  return space === null ? null : {
-    source: space.source,
-    digest: space.digest,
-    trees: Object.freeze(space.trees.map((tree) => tree.treeId))
-  };
-}
-function resolutionFor(space, capabilities) {
-  if (space === null || capabilities === null || capabilities.length === 0) {
-    return { mounted: Object.freeze([]), blocked: Object.freeze([]), unresolved: Object.freeze([]) };
-  }
-  return resolveCapabilities(space, capabilities);
-}
-function planIntegration(input) {
-  const space = input.space ?? null;
-  const missingFacts = missingFactsFor(input);
-  const detected = toPlanDetection(input.detection);
-  const generatedBy = { name: "@everfur/cli", version: input.cliVersion };
-  const identity = space === null ? null : walkIdentity(space, input.identityMode);
-  const mintRequired = requiresSessionMint(identity);
-  const resolution = resolutionFor(space, input.capabilities);
-  const principles = principlesFor(space, consultedTrees(space, mintRequired));
-  const decisionSpace = provenanceFor(space);
-  const supplied = {
-    capabilities: input.capabilities,
-    identityMode: input.identityMode,
-    sessionMintLanguage: input.sessionMintLanguage
-  };
-  if (missingFacts.length > 0) {
-    return Object.freeze({
-      schemaVersion: PLAN_SCHEMA_VERSION,
-      kind: PLAN_DOCUMENT_KIND,
-      generatedBy,
-      status: "underspecified",
-      detected,
-      supplied,
-      missingFacts,
-      steps: Object.freeze([]),
-      blocked: resolution.blocked,
-      principles,
-      warnings: warningsFor(input, resolution.mounted, resolution.blocked),
-      decisionSpace
-    });
-  }
-  const warnings = warningsFor(input, resolution.mounted, resolution.blocked);
-  if (resolution.mounted.length === 0) {
-    return Object.freeze({
-      schemaVersion: PLAN_SCHEMA_VERSION,
-      kind: PLAN_DOCUMENT_KIND,
-      generatedBy,
-      status: "blocked",
-      detected,
-      supplied,
-      missingFacts: Object.freeze([]),
-      steps: Object.freeze([]),
-      blocked: resolution.blocked,
-      principles,
-      warnings,
-      decisionSpace
-    });
-  }
-  const platformTerminal = space === null ? null : terminalOf(walkPlatform(space, input.detection));
-  const identityTerminal = terminalOf(identity);
-  const mintTerminal = mintRequired && space !== null ? terminalOf(walkSessionMint(space, input.sessionMintLanguage)) : null;
-  const steps = [];
-  if (platformTerminal !== null) {
-    steps.push(...installSteps(input.detection, platformTerminal, resolution.mounted));
-  }
-  steps.push(...nativeSteps(input.detection, resolution.mounted));
-  if (identityTerminal !== null && input.identityMode !== null) {
-    steps.push(identityStep(input.detection, input.identityMode, identityTerminal));
-  }
-  if (mintTerminal !== null) {
-    steps.push(sessionMintStep(input.detection, mintTerminal));
-  }
-  steps.push(...codeSteps(input.detection, resolution.mounted));
-  const file = integrationFile({
-    capabilities: resolution.mounted.map((entry) => entry.capability),
-    identityMode: input.identityMode,
-    isExpo: input.detection.projectType === "expo-managed"
-  });
-  if (file !== null) {
-    steps.push({
-      id: "write-integration",
-      phase: "code",
-      title: `Write ${file.path}`,
-      detail: "The complete provider file for the capabilities and identity mode you chose. Write it, then replace the two constants at the top with the publishable key and base URL you were given.",
-      commands: [],
-      files: [file.path],
-      code: [file]
-    });
-  }
-  steps.push(verifyStep());
-  return Object.freeze({
-    schemaVersion: PLAN_SCHEMA_VERSION,
-    kind: PLAN_DOCUMENT_KIND,
-    generatedBy,
-    status: "ready",
-    detected,
-    // Echoes what was ASKED FOR, not what survived. A caller who named a blocked
-    // capability has to see it here and in `blocked`, or the document reads as
-    // though they never asked.
-    supplied,
-    missingFacts: Object.freeze([]),
-    steps: Object.freeze(steps),
-    blocked: resolution.blocked,
-    principles,
-    warnings,
-    decisionSpace
-  });
-}
-
-// src/commands/verify/steps.ts
-var SESSIONS_PATH = "/widget/v1/sessions";
-var ENTITLEMENTS_PATH = "/widget/v1/entitlements";
-function step(id, title, result, reason, requestId = null, details = []) {
-  return Object.freeze({ id, title, result, reason, requestId, details: Object.freeze([...details]) });
-}
-async function mintSession(options) {
-  const title = `mint a session for ${options.userRef}`;
-  const secret = resolveCredential(options.env, PARTNER_SECRET_KEY);
-  const publishable = resolveCredential(options.env, PARTNER_KEY);
-  const absent = [secret, publishable].filter((entry) => entry.status === "absent");
-  if (absent.length > 0) {
-    return {
-      bearer: null,
-      step: step(
-        "mint-session",
-        title,
-        "SKIP",
-        `the mint needs both keys and ${absent.map((entry) => entry.spec.envVar).join(" and ")} ${absent.length === 1 ? "is" : "are"} not set`,
-        null,
-        absent.map((entry) => `export ${entry.spec.envVar}`)
-      )
-    };
-  }
-  const malformed = [secret, publishable].filter((entry) => entry.status === "malformed");
-  if (malformed.length > 0 || secret.credential === null || publishable.credential === null) {
-    return {
-      bearer: null,
-      step: step(
-        "mint-session",
-        title,
-        "FAIL",
-        "a configured key has the wrong shape, so the mint was not attempted",
-        null,
-        malformed.map((entry) => entry.reason ?? `${entry.spec.envVar} is malformed`)
-      )
-    };
-  }
-  const result = await options.client.request({
-    method: "POST",
-    path: SESSIONS_PATH,
-    credentials: {
-      "x-everfur-partner-secret-key": secret.credential,
-      "x-everfur-partner-key": publishable.credential
-    },
-    body: { user_ref: options.userRef }
-  });
-  if (!result.ok) {
-    const hint = result.kind === "http" && result.status === 401 ? "the mint returns one opaque 401 for every credential failure: wrong key, wrong tenant, inactive client, or chat disabled" : "the session mint is the first thing a partner backend does; nothing downstream can work until it succeeds";
-    return {
-      bearer: null,
-      step: step("mint-session", title, "FAIL", describeFailure(result), result.requestId, [hint])
-    };
-  }
-  const body = result.value;
-  const token = isJsonObject(body) ? body["session_token"] : void 0;
-  if (typeof token !== "string" || token.length === 0) {
-    return {
-      bearer: null,
-      step: step(
-        "mint-session",
-        title,
-        "FAIL",
-        `the mint answered ${result.status} without a session_token`,
-        result.requestId,
-        ["check that --base-url points at the Everfur API"]
-      )
-    };
-  }
-  const expiresAt = isJsonObject(body) && typeof body["expires_at"] === "string" ? body["expires_at"] : "unreported";
-  const advisory = isJsonObject(body) && Array.isArray(body["capabilities"]) ? body["capabilities"].filter((entry) => typeof entry === "string") : [];
-  return {
-    bearer: withPrefix(ephemeralCredential("minted session token", token), "Bearer "),
-    step: step(
-      "mint-session",
-      title,
-      "PASS",
-      `minted a session valid until ${expiresAt}`,
-      result.requestId,
-      [
-        `advisory first-paint capabilities: ${advisory.length === 0 ? "(none)" : advisory.join(", ")}`,
-        "advisory only; the authoritative answer is the entitlement verdict below",
-        "the token itself is never printed"
-      ]
-    )
-  };
-}
-async function pollEntitlements(options, bearer) {
-  const title = "read the entitlement verdict";
-  if (bearer === null) {
-    return {
-      capabilities: null,
-      step: step("poll-entitlements", title, "SKIP", "no session was minted, so there is no bearer to read a verdict with")
-    };
-  }
-  let lastRequestId = null;
-  let observed = [];
-  const attempts = Math.max(1, options.attempts);
-  for (let attempt = 1; attempt <= attempts; attempt += 1) {
-    const result = await options.client.request({
-      method: "GET",
-      path: ENTITLEMENTS_PATH,
-      credentials: { authorization: bearer }
-    });
-    if (!result.ok) {
-      return {
-        capabilities: null,
-        step: step("poll-entitlements", title, "FAIL", describeFailure(result), result.requestId, [
-          `attempt ${attempt} of ${attempts}`
-        ])
-      };
-    }
-    lastRequestId = result.requestId;
-    const body = result.value;
-    if (!isJsonObject(body) || !isJsonObject(body["capabilities"])) {
-      return {
-        capabilities: null,
-        step: step(
-          "poll-entitlements",
-          title,
-          "FAIL",
-          `the verdict answered ${result.status} without a capabilities map`,
-          result.requestId,
-          ["the verdict is fail-closed: an empty map is normal, a missing key is not"]
-        )
-      };
-    }
-    observed = Object.keys(body["capabilities"]).sort();
-    const revision = typeof body["revision"] === "number" ? body["revision"] : -1;
-    if (observed.length > 0) {
-      return {
-        capabilities: observed,
-        step: step(
-          "poll-entitlements",
-          title,
-          "PASS",
-          `read a verdict at revision ${revision} on attempt ${attempt} of ${attempts}`,
-          result.requestId,
-          [`granted: ${observed.join(", ")}`]
-        )
-      };
-    }
-    if (attempt < attempts) await options.clock.sleep(options.pollDelayMs);
-  }
-  return {
-    capabilities: observed,
-    step: step(
-      "poll-entitlements",
-      title,
-      "PASS",
-      `read a verdict on all ${attempts} attempts; it granted nothing`,
-      lastRequestId,
-      ["the read itself worked; whether an empty verdict is acceptable is the next step"]
-    )
-  };
-}
-function assertVerdict(capabilities, poll) {
-  const title = "assert the verdict is not empty";
-  if (capabilities === null) {
-    return step("assert-verdict", title, "SKIP", "no verdict was read, so there is nothing to assert on");
-  }
-  if (capabilities.length === 0) {
-    return step(
-      "assert-verdict",
-      title,
-      "FAIL",
-      "the verdict is empty: this caller is granted no capabilities at all",
-      poll.requestId,
-      [
-        "an empty verdict has several distinct causes and carries no reason of its own",
-        "run `everfur diagnose` for the machine code and next action for each capability"
-      ]
-    );
-  }
-  return step(
-    "assert-verdict",
-    title,
-    "PASS",
-    `the verdict grants ${capabilities.length} capabilit${capabilities.length === 1 ? "y" : "ies"}`,
-    poll.requestId,
-    [capabilities.join(", ")]
-  );
-}
-async function runVerification(options) {
-  const mint = await mintSession(options);
-  const poll = await pollEntitlements(options, mint.bearer);
-  const assertion = assertVerdict(poll.capabilities, poll.step);
-  const steps = Object.freeze([mint.step, poll.step, assertion]);
-  const failed = steps.some((entry) => entry.result === "FAIL");
-  const skipped = steps.some((entry) => entry.result === "SKIP");
-  return Object.freeze({
-    steps,
-    status: failed ? "failed" : skipped ? "incomplete" : "passed"
-  });
-}
-
-// src/version.ts
-var CLI_VERSION = "0.1.0";
-
-export { ADMIN_TOKEN, API_PREFIX, BACKEND_LANGUAGE_QUESTION, BASE_URL_ENV_VAR, CAPABILITIES_TREE, CAPABILITY_QUESTION, CLI_VERSION, CREDENTIAL_SPECS, DEFAULT_TIMEOUT_MS, EMPTY_REGISTRY, ERRORS_DOCUMENT_KEY, IDEMPOTENT_METHODS, IDENTITY_QUESTION, IDENTITY_TREE, MAX_TIMEOUT_MS, MIN_TIMEOUT_MS, MISSING_FACT_NAMES, PARTNER_KEY, PARTNER_SECRET_KEY, PLAN_DOCUMENT_KIND, PLAN_SCHEMA_VERSION, REDACTED, SCHEMAS, SESSION_MINT_TREE, SESSION_TOKEN, TransportError, apiUrl, buildDecisionSpace, clampTimeout, createApiClient, createRecordingClock, describeFailure, detectProject, digestOfProjection, digestsEqual, entryFromRow, ephemeralCredential, errorCodeOf, failureDetails, fetchTransport, isCorrelatableRequestId, isIdempotent, isJsonObject, loadBundledDecisionSpace, loadDecisionSpace, loadErrorRegistry, missingFactsFor, nodeFileSystem, planIntegration, resolveContractPath, resolveCredential, resolveEndpoint, runVerification, systemClock, validateContractFile, validateContractPublicEnvelope, validateDiagnosisDocument, validateErrorExplanationDocument, validatePlanDocument, validateSandboxCreateDocument, validateVerificationDocument, verifyDigest, walkSingle, walkTree, withPrefix };