@everfur/cli 0.2.0 → 0.2.1

package/README.md

@@ -95,21 +95,36 @@ document with no credential value in it.
 
 ## The fastest path: let your agent do it
 
-### Hosted MCP: nothing to configure
+### Hosted MCP: nothing to install
 
-Everfur runs the MCP server for you at `https://mcp.everfur.com/mcp` (staging, where your sandbox tenant
-lives while you build: `https://mcp-staging.everfur.com/mcp`). Add that URL to your editor as a remote
-(Streamable HTTP) MCP server. When the editor connects, it sends you to the Everfur partner console to sign
-in; from then on every tool runs as your tenant. There is no key, token, variable or file to set.
+Everfur runs the MCP server for you, so there is no key, token, variable or file to set. Today it is
+reachable at one endpoint:
 
-- **Claude Code:** `claude mcp add --transport http everfur https://mcp.everfur.com/mcp`
-- **Cursor:** `.cursor/mcp.json` with `{"mcpServers":{"everfur":{"url":"https://mcp.everfur.com/mcp"}}}`
-- **VS Code:** `.vscode/mcp.json` with `{"servers":{"everfur":{"type":"http","url":"https://mcp.everfur.com/mcp"}}}`
+```
+https://mcp-staging.everfur.com/mcp
+```
+
+That is the staging deployment, and it is where your sandbox tenant lives while you build. **The production
+endpoint `https://mcp.everfur.com/mcp` is not available yet:** the hostname does not resolve, so a client
+pointed at it fails to connect rather than falling back to anything. Use the staging URL until Everfur tells
+you production is live.
+
+Add the URL to your editor as a remote (Streamable HTTP) MCP server. You paste the URL yourself; there is
+nothing to search for in a connector directory. Adding it is the whole configuration step:
+
+- **Claude Code:** `claude mcp add --transport http everfur https://mcp-staging.everfur.com/mcp`
+- **Cursor:** `.cursor/mcp.json` with `{"mcpServers":{"everfur":{"url":"https://mcp-staging.everfur.com/mcp"}}}`
+- **VS Code:** `.vscode/mcp.json` with `{"servers":{"everfur":{"type":"http","url":"https://mcp-staging.everfur.com/mcp"}}}`
 - **Codex:** a streamable HTTP server entry with that URL in `~/.codex/config.toml` (`[mcp_servers.everfur]`, `url`)
-- **claude.ai:** a custom connector with that URL. Click by click, including what the sign-in asks and how to
-  tell it worked:
+- **claude.ai:** add it as a **custom connector** and paste the URL into the dialog. Click by click,
+  including what the sign-in asks and how to tell it worked:
   [docs/ADD_THE_EVERFUR_CONNECTOR_IN_CLAUDE.md](docs/ADD_THE_EVERFUR_CONNECTOR_IN_CLAUDE.md)
 
+There is no key to type because the server authenticates you instead. On first connect it answers with a
+`401` naming its OAuth resource metadata, your client registers itself automatically (dynamic client
+registration, RFC 7591), and you are sent to the Everfur partner console to sign in and approve. From then
+on every tool runs as the tenant of that console session.
+
 The tools are the same five as below, plus eight that read your own tenant, with these differences that follow
 from where the server runs:
 
@@ -275,7 +290,7 @@ npx -y -p @everfur/cli everfur plan
 
 Plain `npx @everfur/cli` does not work, and the error it gives ("could not determine executable to
 run") does not explain why: this package ships four binaries, `everfur`, `everfur-mcp`,
-`everfur-mcp-http` and `everfur-mcp-hosted` (the entry Everfur runs at `mcp.everfur.com`), and npx only
+`everfur-mcp-http` and `everfur-mcp-hosted` (the entry Everfur runs itself), and npx only
 picks a binary on its own when there is exactly one, or when one is named after the package. `-p` names
 the package and the word after it names the binary.
 
@@ -350,7 +365,7 @@ with no network call and no credential.
 | `EVERFUR_MCP_HTTP_HOST` / `PORT` / `PATH` | Optional HTTP listener configuration; defaults to `127.0.0.1:3100/mcp`. `EVERFUR_MCP_HTTP_PORT` is also the hosted service's port. |
 | `EVERFUR_MCP_HTTP_ALLOWED_HOSTS` | Required for any non-loopback bind; comma-separated public hostnames only. |
 | `EVERFUR_MCP_HTTP_ALLOWED_ORIGINS` | Optional browser-origin allowlist. Origins are rejected unless explicitly listed. |
-| `MCP_PUBLIC_URL` | Everfur-internal: the FULL endpoint URL of the hosted service (`everfur-mcp-hosted`), path included (`https://mcp.everfur.com/mcp`), exactly as a partner pastes it into Claude. It is the OAuth resource every token names and the base of every 401's metadata pointer; a bare origin is refused at start. With `EVERFUR_API_BASE_URL`, `EVERFUR_MCP_HTTP_PORT` and `MCP_TRUSTED_PROXY_HOPS` it is the hosted task's whole environment. Partners do not set this. |
+| `MCP_PUBLIC_URL` | Everfur-internal: the FULL endpoint URL of the hosted service (`everfur-mcp-hosted`), path included (`https://mcp-staging.everfur.com/mcp` on the staging deployment), exactly as a partner pastes it into Claude. It is the OAuth resource every token names and the base of every 401's metadata pointer; a bare origin is refused at start. With `EVERFUR_API_BASE_URL`, `EVERFUR_MCP_HTTP_PORT` and `MCP_TRUSTED_PROXY_HOPS` it is the hosted task's whole environment. Partners do not set this. |
 | `MCP_ALLOWED_HOSTS` | Everfur-internal, optional: extra `Host` values the hosted service accepts beside its own. `MCP_PORT` is read only when `EVERFUR_MCP_HTTP_PORT` is unset. Partners do not set these. |
 | `MCP_ALLOWED_ORIGINS` | Everfur-internal, optional: extra `Origin` values the hosted service's MCP endpoint accepts beside `https://claude.ai` and `https://claude.com`; any other `Origin` is refused with `403`. A browser page at an accepted origin gets its CORS preflight answered and can read the `401` challenge. Partners do not set this. |
 | `MCP_TRUSTED_PROXY_HOPS` | Everfur-internal, optional: how many proxies appended to `X-Forwarded-For` (`1` behind the load balancer). Keys the hosted service's per-client budget of unauthenticated failures; `0` (default) uses the socket address. Partners do not set this. |
@@ -361,8 +376,14 @@ up. The publishable key is designed to ship inside your app; the secret key is n
 
 ## Documentation
 
-The full integration guide, API reference, error catalog, and testing guide ship with the SDK:
-[`@everfur/sdk` docs](https://github.com/Everfur-Health/everfur-sdk-rn/tree/main/docs/partner-integration).
+The integration guide, API reference, error catalog and testing guide are at
+[everfur.com/docs](https://everfur.com/docs): adoption paths, the HTTP contract, API keys, the launch
+checklist and troubleshooting.
+
+This page used to link to `github.com/Everfur-Health/everfur-sdk-rn`, which is a PRIVATE repository: the
+link returned 404 for every partner who clicked it, since a partner is outside Everfur by definition. If
+a doc you need is not on the site yet, ask [support@everfur.com](mailto:support@everfur.com) rather than
+looking for a repository you cannot open.
 
 ## License
 

package/dist/{chunk-S6UN7D2O.js → chunk-4UB26D67.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { VERIFY_IDENTITY_MODES, SURFACES, ENVIRONMENTS, BASE_URL_ENV_VAR, MIN_TIMEOUT_MS, MAX_TIMEOUT_MS, DEFAULT_TIMEOUT_MS, ALL_CAPABILITIES, expandCapabilities, errorOutcome, describeFailure, failureDetails, countsAsNotOn, diagnoseVerdict, isJsonObject, succeed, CAPABILITY_QUESTION, CAPABILITIES_TREE, WEB_EMBEDDING_QUESTION, PLATFORM_TREE, loadDecisionSpace, fetchContract, contractUnavailableOutcome, loadDecisionSpaceFromContract, parseEnvironment, detectProject, planIntegration, fail, ExitCode, DOCS_KEY, resolveContractPath, validateContractFile, buildSupportBundle, renderSupportBundle, chooseWidgetAuth, DIAGNOSTICS_PATH, diagnoseFailure, parseDiagnostics, buildDiagnosisDocument, PARTNER_KEY, SESSION_TOKEN, resolveCredential, ADMIN_TOKEN, withPrefix, parseOrigin, parseLoaderUrl, parseSurfaces, parseIdentityMode, runVerification, PARTNER_SECRET_KEY, resolveOffline, offlineSuggestions, loadErrorRegistryFromContract, loadErrorRegistry, resolveAfterRegistryMiss, knownCodes, buildExplanationDocument, renderExplanation, resolveEndpoint, isCorrelatableRequestId, EMPTY_REGISTRY, createApiClient, buildSdkExplanationDocument, renderSdkExplanation, buildContractTableExplanationDocument, renderContractTableExplanation, IDENTITY_QUESTION, IDENTITY_TREE, BACKEND_LANGUAGE_QUESTION, SESSION_MINT_TREE, CREDENTIAL_SPECS } from './chunk-CEWWBPPT.js';
+import { VERIFY_IDENTITY_MODES, SURFACES, ENVIRONMENTS, BASE_URL_ENV_VAR, MIN_TIMEOUT_MS, MAX_TIMEOUT_MS, DEFAULT_TIMEOUT_MS, ALL_CAPABILITIES, expandCapabilities, errorOutcome, describeFailure, failureDetails, countsAsNotOn, diagnoseVerdict, isJsonObject, succeed, CAPABILITY_QUESTION, CAPABILITIES_TREE, WEB_EMBEDDING_QUESTION, PLATFORM_TREE, loadDecisionSpace, fetchContract, contractUnavailableOutcome, loadDecisionSpaceFromContract, parseEnvironment, detectProject, planIntegration, fail, ExitCode, DOCS_KEY, resolveContractPath, validateContractFile, buildSupportBundle, renderSupportBundle, chooseWidgetAuth, DIAGNOSTICS_PATH, diagnoseFailure, parseDiagnostics, buildDiagnosisDocument, PARTNER_KEY, SESSION_TOKEN, resolveCredential, ADMIN_TOKEN, withPrefix, parseOrigin, parseLoaderUrl, parseSurfaces, parseIdentityMode, runVerification, PARTNER_SECRET_KEY, resolveOffline, offlineSuggestions, loadErrorRegistryFromContract, loadErrorRegistry, resolveAfterRegistryMiss, knownCodes, buildExplanationDocument, renderExplanation, resolveEndpoint, isCorrelatableRequestId, EMPTY_REGISTRY, createApiClient, buildSdkExplanationDocument, renderSdkExplanation, buildContractTableExplanationDocument, renderContractTableExplanation, IDENTITY_QUESTION, IDENTITY_TREE, BACKEND_LANGUAGE_QUESTION, SESSION_MINT_TREE, CREDENTIAL_SPECS } from './chunk-KQICUK54.js';
 import { isAbsolute, resolve } from 'path';
 
 // src/cli/format.ts

package/dist/{chunk-TBFOL2D3.js → chunk-FC23PLWG.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { buildServer } from './chunk-WCH6AI6K.js';
+import { buildServer } from './chunk-XMIERMOW.js';
 import { createServer } from 'http';
 import { timingSafeEqual } from 'crypto';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';

package/dist/{chunk-CEWWBPPT.js → chunk-KQICUK54.js}

@@ -3777,12 +3777,13 @@ function loadErrorRegistryFromContract(contract) {
 
 // src/commands/plan/sdk-package.ts
 var SDK_PACKAGE = "@everfur/sdk";
-var SDK_GIT_SPEC = "git+ssh://git@github.com/Everfur-Health/everfur-sdk-rn.git";
 function sdkInstallSpec() {
-  return SDK_GIT_SPEC;
+  return `'${SDK_PACKAGE}@${SDK_INSTALL_RANGE}'` ;
 }
 var SDK_PACKAGE_PLATFORMS = /* @__PURE__ */ new Set(["expo-managed", "bare-react-native", "web"]);
 var SDK_MIN_VERSION = "0.3.0";
+var SDK_MAX_VERSION_EXCLUSIVE = "0.5.0";
+var SDK_INSTALL_RANGE = `>=${SDK_MIN_VERSION} <${SDK_MAX_VERSION_EXCLUSIVE}`;
 var SDK_WEB_MIN_VERSION = SDK_MIN_VERSION;
 var SDK_RN_PROVIDER_PEERS = Object.freeze(["react-native-safe-area-context"]);
 var SDK_RN_SHAPES = /* @__PURE__ */ new Set(["expo-managed", "bare-react-native"]);
@@ -4769,6 +4770,11 @@ var WEB_SUBPATH_ATTRIBUTE = "web_subpath";
 var FRAME_SURFACE_ATTRIBUTE = "frame_surface";
 var NATIVE_PEERS_ATTRIBUTE = "native_peers";
 var SUMMARY_ATTRIBUTE = "summary";
+var NODE_EXTRA_SUBPATHS_ATTRIBUTE = "node_extra_subpaths";
+var WEB_EXTRA_SUBPATHS_ATTRIBUTE = "web_extra_subpaths";
+var VENDOR_REGISTER_ATTRIBUTE = "vendor_module_register";
+var VENDOR_PACKAGE_NODE_ATTRIBUTE = "vendor_module_package_node";
+var VENDOR_PACKAGE_WEB_ATTRIBUTE = "vendor_module_package_web";
 function resolveCapabilities(space, capabilities) {
   const tree = space.tree(CAPABILITIES_TREE);
   if (tree === null) {
@@ -4843,6 +4849,22 @@ function frameRenders(entry) {
 function summaryFor(entry) {
   return stringAttribute(entry.outcome, SUMMARY_ATTRIBUTE) ?? "";
 }
+function extraSubpathsFor(entry, surface) {
+  const kind = surface === true ? "dart" : surface === false ? "node" : surface;
+  if (kind === "dart" || kind === "frame") return Object.freeze([]);
+  return listAttribute(entry.outcome, kind === "web" ? WEB_EXTRA_SUBPATHS_ATTRIBUTE : NODE_EXTRA_SUBPATHS_ATTRIBUTE);
+}
+function vendorModuleFor(entry, surface) {
+  const kind = surface === true ? "dart" : surface === false ? "node" : surface;
+  if (kind === "dart" || kind === "frame") return null;
+  const register = stringAttribute(entry.outcome, VENDOR_REGISTER_ATTRIBUTE);
+  const packageName = stringAttribute(
+    entry.outcome,
+    kind === "web" ? VENDOR_PACKAGE_WEB_ATTRIBUTE : VENDOR_PACKAGE_NODE_ATTRIBUTE
+  );
+  if (register === null || packageName === null) return null;
+  return Object.freeze({ register, packageName });
+}
 
 // src/registry/sdk/client/theme/color.ts
 function parseColor(value) {
@@ -6697,6 +6719,46 @@ function chatElement(platform, base, indent = MOUNT_INDENT) {
   const seams = chatSeams(platform === "expo");
   return element("EverfurChat", [...base, ...seams.passed, FIND_VET_PROP], [...seamGroup(seams.commented), vetPrepGroup()]);
 }
+var RECORDS_NAMED_SCREENS = Object.freeze([
+  Object.freeze({
+    name: "EverfurRecordsDashboard",
+    purpose: "the pet's records home: its requests, its documents and the entry to everything below",
+    extraProps: Object.freeze([])
+  }),
+  Object.freeze({
+    name: "EverfurRecordsUpload",
+    purpose: "the owner uploading their own PDFs onto a request",
+    extraProps: Object.freeze([])
+  }),
+  Object.freeze({
+    name: "EverfurClinicPicker",
+    purpose: "choosing the clinic a records request is addressed to",
+    extraProps: Object.freeze([])
+  }),
+  Object.freeze({
+    name: "EverfurRecordsRequest",
+    purpose: "one request and where it has got to, which is the screen a record_request notification opens",
+    extraProps: Object.freeze([])
+  }),
+  Object.freeze({
+    name: "EverfurRecordDetail",
+    purpose: "one record in full: its facts, its series and its documents",
+    extraProps: Object.freeze([])
+  }),
+  Object.freeze({
+    name: "EverfurRecordDocument",
+    purpose: "one source document of a record",
+    extraProps: Object.freeze([])
+  }),
+  Object.freeze({
+    name: "EverfurRecordsConsent",
+    purpose: "the owner granting consent for this pet's records, which every read is gated on",
+    extraProps: Object.freeze([])
+  })
+]);
+function recordsNamedScreens() {
+  return RECORDS_NAMED_SCREENS;
+}
 function recordsNativeSeams(isExpo) {
   const seams = ["onPickDocument={pickRecordsDocument}", "onCopy={copyText}"];
   return isExpo ? { passed: seams, commented: [] } : { passed: [], commented: seams };
@@ -9298,12 +9360,6 @@ function warningsFor(input, mounted, blocked, platformBlock = null, installsNoth
       message: "The Everfur SDK is not declared in this project yet, so this integration starts from installing it."
     });
   }
-  {
-    warnings.push({
-      code: "sdk_not_published",
-      message: `${SDK_PACKAGE} is not published to a registry yet: installing it by name returns 404. The plan installs it from the git URL instead, which builds on install and needs access to the Everfur-Health GitHub organisation.`
-    });
-  }
   return Object.freeze(warnings);
 }
 function installSteps(detection, platform, mounted, identityMode, environment, theme2) {
@@ -9566,6 +9622,23 @@ var CHAT_SURFACE_NOTE = Object.freeze({
 var CHAT_VET_NOTE = " On an emergency or schedule-soon reply the banner's Find a vet pill opens the Everfur vet visit entry when Everfur has it on for your client, else calls onFindVet, else does not render: the mount passes onFindVet={findVet}, which opens a maps search until you replace it with your own vet finder (REPLACE in the file). The vet-visit prep starter chip opens the Everfur vet visit entry while Everfur has it on; the onVetPrep line beside the mount is commented, for an app with its own vet-visit preparation screen, because passing it replaces that entry.";
 var FRAME_CHAT_VET_NOTE = " A frame takes no onFindVet or onVetPrep: functions do not reach the frame, so on an emergency or schedule-soon reply the banner's Find a vet pill, and the vet-visit prep starter chip, appear only while Everfur has its vet visit entry on for your client.";
 var RECORDS_SURFACE_NOTE = ` EverfurRecords is the app's records flow: it opens on the pet's dashboard and owns its own stack (the hardware back key pops it on React Native), every screen is also exported by name for your own navigator, and initialScreen={{ name: 'request', requestId }} opens a request directly. The mount passes petName={selectedPet.name} for headings such as "{petName}'s lab trends". Lab markers, share links, the record PDF link, fact edits and the signature gallery need the platform flag partner.records_full_depth_enabled; while it is off for your tenant the SDK hides them, so their absence is not a defect in your integration.`;
+function recordsScreensStep(surface) {
+  const subpath = surface === "web" ? `${SDK_PACKAGE}/web/records` : `${SDK_PACKAGE}/records`;
+  const screens = recordsNamedScreens();
+  return {
+    id: "mount-records-screens",
+    phase: "code",
+    title: "Mount a single records screen on your own route, rather than the whole flow",
+    detail: [
+      `EverfurRecords is the flow: it opens on the dashboard and owns its own stack, which is what the generated mount uses and what a partner giving records one tab wants. If your app already has a navigator, ${subpath} also exports every screen by name, so you can put one on a route of your own:`,
+      ...screens.map((screen) => `${screen.name}: ${screen.purpose}.`),
+      "Every one of them takes the same base props: petRef (required), petName, onNavigate and onBack, plus the optional host seams onOpenUrl, onCopy, onAsk and location. onNavigate receives the exact screen an edge leads to, so your navigator decides where that goes; without it a control that only navigates is hidden rather than left inert, and without onBack no back control renders. The navigation model itself (recordsNavReducer, pushRecordsNav, currentRecordsScreen and the RecordsScreen type) is exported from the same subpath for a host driving the screens itself.",
+      "Consent gates the reads whichever screen you mount, and the depth flag hides the deeper views the same way it does inside the flow: mounting a screen directly bypasses neither."
+    ].join(" "),
+    commands: [],
+    files: []
+  };
+}
 var WEBHOOK_SIGNATURE_HEADER_ATTRIBUTE = "webhook_signature_header";
 var WEBHOOK_VERIFY_SUBPATH_ATTRIBUTE = "webhook_verify_subpath";
 var WEBHOOK_ENDPOINT_ROUTE_ATTRIBUTE = "webhook_endpoint_route";
@@ -9760,6 +9833,35 @@ function configureVisitReturnStep(detection, native) {
     files: []
   };
 }
+function televetNativeCallStep(input) {
+  if (input.surface !== "node" && input.surface !== "web") return null;
+  if (input.vendor === null) return null;
+  const native = input.surface === "node";
+  const expo = input.projectType === "expo-managed";
+  const loader = native ? `registerEverfurDaily(() => require('${input.vendor.packageName}'))` : `registerEverfurDaily(() => import('${input.vendor.packageName}'))`;
+  const sentences = [
+    `The vet consult renders inside your own ${native ? "app" : "page"} from ${input.callSubpath}, on ${input.vendor.packageName}. ${input.callSubpath} is a separate subpath from the visit button on purpose: a partner that mounts only the button never downloads a call surface and is never asked to take a WebRTC dependency for a surface it does not use.`,
+    `THE SDK NEVER IMPORTS ${input.vendor.packageName}. It is an optional peer, and nothing in the package names it in an import: a literal specifier there would become one every partner's bundler has to resolve, including the partners who never mount a call. You hand the module in once, at your entry, with ${input.vendor.register}: \`${loader}\`. Import ${input.vendor.register} from ${input.callSubpath}. Until you call it the call surface renders its deliberate unavailable state and reports the setup message to your code, which is a surface that explains itself rather than a black rectangle.`,
+    ...native ? [
+      `${input.vendor.packageName} ships native code, so Expo Go cannot load it${expo ? "" : " and autolinking has to see it"}: ` + (expo ? "a managed app needs a development build (npx expo prebuild, then npx expo run:ios and npx expo run:android). Add the Daily config plugin to the plugins array in app.json in the same change, because a prebuild that runs without it produces native projects the call cannot use." : "run `cd ios && pod install` after adding it."),
+      "The call needs the camera and the microphone, so declare both before you ship: NSCameraUsageDescription and NSMicrophoneUsageDescription on iOS, and the CAMERA and RECORD_AUDIO permissions on Android. REPLACE the purpose strings with your own: a permission prompt is copy shown to your customer in your app's voice, and this plan will not write it for you."
+    ] : [
+      "On the web there is nothing to build: the module is loaded by the dynamic import above, so the WebRTC stack reaches the bundle only on the pages that mount the call. The browser asks for the camera and the microphone itself, over https, on a user gesture."
+    ],
+    `THE CALL DOES NOT OBTAIN ITS OWN CREDENTIALS. roomUrl and token are minted server side and come in from you as props; the surface refuses a room credential that does not pass its own guard rather than joining a room it cannot verify.`,
+    ...input.bookingSubpath === null ? [] : [
+      `BOOKING IN APP IS NOT READY, AND MOUNTING IT TODAY IS STILL SAFE. ${input.bookingSubpath} carries the booking screens, and the partner booking routes are not served yet: every read answers 404, which the flow settles as unavailable and falls back to the hosted visit rather than dead-ending an owner inside a scheduler that cannot schedule. Its ported copy is gated shut as well, so the screens refuse to render a ported string until Everfur approves the deck. Two things have to land before this books anything: the partner booking routes, and that copy approval. Ask Everfur where both stand before you plan a launch around in-app booking.`
+    ]
+  ];
+  return {
+    id: "mount-televet-call",
+    phase: "code",
+    title: native ? "Render the vet consult in your app, and hand the SDK the native video module" : "Render the vet consult in your page, and hand the SDK the video module",
+    detail: sentences.join(" "),
+    commands: [],
+    files: []
+  };
+}
 function televetTestModeStep() {
   return {
     id: "televet-test-mode",
@@ -9825,7 +9927,17 @@ function verifySurfacesStep(candidates, anonymous) {
     detail: [
       `Run everfur_verify_integration with surfaces ${JSON.stringify(accepted)}${anonymous ? " and identity anonymous" : ""}, or the command below.`,
       "It exercises each surface on the real wire and reports GATED, naming the switch, for anything Everfur has not turned on for your client: a plan with status ready means the code can be built, never that the tenant is armed.",
-      "There is no environment argument. Verify reads the host from EVERFUR_API_BASE_URL in its own environment (with EVERFUR_PARTNER_KEY and, for a signed identity, EVERFUR_PARTNER_SECRET_KEY), so point that at the environment you mean rather than passing one.",
+      "There is no environment argument. Verify reads the host from EVERFUR_API_BASE_URL in its own environment, with EVERFUR_PARTNER_KEY, so point that at the environment you mean rather than passing one.",
+      /**
+       * WHERE THE SESSION COMES FROM, per front door. This sentence used to name EVERFUR_PARTNER_SECRET_KEY as
+       * something the verifying process reads "in its own environment", in the same step that tells the reader
+       * to run everfur_verify_integration. Over MCP that environment is the server's `env` block in .mcp.json,
+       * which is committed and which the agent reads into its own transcript, so the step taught exactly what
+       * docs/partner/12-CLI-AND-MCP.md promises never happens and what the MCP server does not do: it verifies
+       * with a session and never reads the secret key (mcp/tools.ts `mintWithSecretKey: false`). The local mint
+       * is the terminal command's alone.
+       */
+      anonymous ? "An anonymous identity mints nothing: verify reads with the publishable key and a derived session id, so no session token and no secret key are involved." : "A signed identity needs a session, and the secret key is not how the tool gets one. everfur_verify_integration reads EVERFUR_SESSION_TOKEN, a short-lived session your backend minted for a test user, and the Everfur-hosted connector mints its own; neither reads the secret key, which never belongs in an MCP configuration. The terminal command below is the only one that mints locally, from EVERFUR_PARTNER_SECRET_KEY and EVERFUR_PARTNER_KEY, from a local shell only.",
       missing.length === 0 ? "" : `This plan also builds ${missing.join(", ")}, which this CLI does not check yet: exercise those by hand and do not read a pass here as covering them.`
     ].filter((sentence) => sentence.length > 0).join(" "),
     commands: [`everfur verify${identity} --surfaces ${accepted.join(",")} --project-root .`],
@@ -10266,16 +10378,30 @@ function planIntegration(input) {
   }
   const lifecycle = lifecycleStep(file, frameSnippetWritten && personalized ? snippetPaths : []);
   if (lifecycle !== null) steps.push(lifecycle);
-  const televetMounted = renderable.some((entry) => entry.capability === "televet");
-  if (televetMounted) {
+  const televetEntry = renderable.find((entry) => entry.capability === "televet") ?? null;
+  if (televetEntry !== null) {
     const nativeSurface = surface === "node" && SDK_PACKAGE_PLATFORMS.has(input.detection.projectType);
     steps.push(openVisitStep(file?.path ?? null));
     steps.push(configureVisitReturnStep(input.detection, nativeSurface));
+    const extras = extraSubpathsFor(televetEntry, surface);
+    const callSubpath = extras.find((subpath) => subpath.endsWith("/call")) ?? null;
+    const bookingSubpath = extras.find((subpath) => subpath.endsWith("/booking")) ?? null;
+    if (callSubpath !== null) {
+      const callStep = televetNativeCallStep({
+        surface,
+        projectType: input.detection.projectType,
+        callSubpath,
+        bookingSubpath,
+        vendor: vendorModuleFor(televetEntry, surface)
+      });
+      if (callStep !== null) steps.push(callStep);
+    }
     if (input.environment === "staging" || input.environment === "test") {
       const testMode = televetTestModeFile(!nativeSurface);
       steps.push({ ...televetTestModeStep(), files: [testMode.path], code: [testMode] });
     }
   }
+  if (records && (surface === "node" || surface === "web")) steps.push(recordsScreensStep(surface));
   if (records && (input.environment === "staging" || input.environment === "test")) {
     const testMode = file === null ? null : recordsTestModeFile(
       surface === "web",
@@ -12329,7 +12455,7 @@ async function runVerification(options) {
 }
 
 // src/version.ts
-var CLI_VERSION = "0.2.0";
+var CLI_VERSION = "0.2.1";
 
 // src/cli/outcome.ts
 function succeed(json, text) {

package/dist/{chunk-VHZWTB6J.js → chunk-SJUEHHU6.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { hostnameOf, listen, close, writeJson, serveStatelessMcp } from './chunk-TBFOL2D3.js';
-import { createHostedTokenVerifier, tokenBucketOf, isAccessTokenShaped, buildServer, MCP_SCOPE, tenantContextOf, sendTestUserRef, hostedVerifyUserRef, REVOKED_AUTHORIZATION_REMEDY, SYNTHETIC_USER_REF_PREFIX } from './chunk-WCH6AI6K.js';
-import { BASE_URL_ENV_VAR, resolveEndpoint, fetchTransport, systemClock, createApiClient, withPrefix, ephemeralCredential, validateContractText, isJsonObject, describeFailure } from './chunk-CEWWBPPT.js';
+import { hostnameOf, listen, close, writeJson, serveStatelessMcp } from './chunk-FC23PLWG.js';
+import { createHostedTokenVerifier, tokenBucketOf, isAccessTokenShaped, buildServer, MCP_SCOPE, tenantContextOf, sendTestUserRef, hostedVerifyUserRef, REVOKED_AUTHORIZATION_REMEDY, SYNTHETIC_USER_REF_PREFIX } from './chunk-XMIERMOW.js';
+import { BASE_URL_ENV_VAR, resolveEndpoint, fetchTransport, systemClock, createApiClient, withPrefix, ephemeralCredential, validateContractText, isJsonObject, describeFailure } from './chunk-KQICUK54.js';
 import { createServer } from 'http';
 import { InvalidTokenError, TooManyRequestsError, TemporarilyUnavailableError } from '@modelcontextprotocol/sdk/server/auth/errors.js';
 import { isIP } from 'net';

package/dist/{chunk-WCH6AI6K.js → chunk-XMIERMOW.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { ENVIRONMENTS, SURFACES, VERIFY_IDENTITY_MODES, fetchContract, NO_CONTRACT_CACHE, systemClock, fetchTransport, describeFailure, loadDecisionSpaceFromContract, uuidFromKey, resolveEndpoint, createApiClient, createContractProvider, nodeContractCache, CLI_VERSION, withPrefix, ephemeralCredential, isJsonObject, error_explanation_v1_schema_default, verification_v1_schema_default, diagnosis_v1_schema_default, plan_v1_schema_default, IDENTITY_QUESTION, IDENTITY_TREE, CAPABILITY_QUESTION, CAPABILITIES_TREE, WEB_EMBEDDING_QUESTION, PLATFORM_TREE, loadDecisionSpace, nodeFileSystem, expandCapabilities, detectThemeFromText, planIntegration, parseOrigin, parseLoaderUrl, isEverfurLoaderHost, EVERFUR_LOADER_HOSTS, resolveCredential, PARTNER_KEY, runVerification, themePropFor, normalizeSurfaces, buildSupportBundle, chooseWidgetAuth, DIAGNOSTICS_PATH, diagnoseFailure, parseDiagnostics, buildDiagnosisDocument, resolveOffline, knownCodes, offlineSuggestions, loadErrorRegistryFromContract, loadErrorRegistry, resolveAfterRegistryMiss, buildExplanationDocument, nextActionFor, detectProject, BASE_URL_ENV_VAR, API_BASE_URL_BY_ENVIRONMENT, plannableCapabilities, blockedCapabilities, buildSdkExplanationDocument, buildContractTableExplanationDocument, SESSION_TOKEN, ALL_CAPABILITIES, BACKEND_LANGUAGE_QUESTION, SESSION_MINT_TREE } from './chunk-CEWWBPPT.js';
+import { ENVIRONMENTS, SURFACES, VERIFY_IDENTITY_MODES, fetchContract, NO_CONTRACT_CACHE, systemClock, fetchTransport, describeFailure, loadDecisionSpaceFromContract, uuidFromKey, resolveEndpoint, createApiClient, createContractProvider, nodeContractCache, CLI_VERSION, withPrefix, ephemeralCredential, isJsonObject, error_explanation_v1_schema_default, verification_v1_schema_default, diagnosis_v1_schema_default, plan_v1_schema_default, IDENTITY_QUESTION, IDENTITY_TREE, CAPABILITY_QUESTION, CAPABILITIES_TREE, WEB_EMBEDDING_QUESTION, PLATFORM_TREE, loadDecisionSpace, nodeFileSystem, expandCapabilities, detectThemeFromText, planIntegration, parseOrigin, parseLoaderUrl, isEverfurLoaderHost, EVERFUR_LOADER_HOSTS, resolveCredential, PARTNER_KEY, runVerification, themePropFor, normalizeSurfaces, buildSupportBundle, chooseWidgetAuth, DIAGNOSTICS_PATH, diagnoseFailure, parseDiagnostics, buildDiagnosisDocument, resolveOffline, knownCodes, offlineSuggestions, loadErrorRegistryFromContract, loadErrorRegistry, resolveAfterRegistryMiss, buildExplanationDocument, nextActionFor, detectProject, BASE_URL_ENV_VAR, API_BASE_URL_BY_ENVIRONMENT, plannableCapabilities, blockedCapabilities, buildSdkExplanationDocument, buildContractTableExplanationDocument, SESSION_TOKEN, ALL_CAPABILITIES, BACKEND_LANGUAGE_QUESTION, SESSION_MINT_TREE } from './chunk-KQICUK54.js';
 import { z } from 'zod';
 import { McpServer, ResourceTemplate } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';

package/dist/everfur-mcp-container.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { loadHostedMcpConfig, startHostedMcpServer } from './chunk-VHZWTB6J.js';
-import { startRemoteMcpServer, loadRemoteMcpConfig } from './chunk-TBFOL2D3.js';
-import './chunk-WCH6AI6K.js';
-import { CLI_VERSION } from './chunk-CEWWBPPT.js';
+import { loadHostedMcpConfig, startHostedMcpServer } from './chunk-SJUEHHU6.js';
+import { startRemoteMcpServer, loadRemoteMcpConfig } from './chunk-FC23PLWG.js';
+import './chunk-XMIERMOW.js';
+import { CLI_VERSION } from './chunk-KQICUK54.js';
 
 // src/mcp/container-entry.ts
 var HOSTED_MARKER = "MCP_PUBLIC_URL";

package/dist/everfur-mcp-hosted.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { loadHostedMcpConfig, startHostedMcpServer } from './chunk-VHZWTB6J.js';
-import './chunk-TBFOL2D3.js';
-import './chunk-WCH6AI6K.js';
-import { CLI_VERSION } from './chunk-CEWWBPPT.js';
+import { loadHostedMcpConfig, startHostedMcpServer } from './chunk-SJUEHHU6.js';
+import './chunk-FC23PLWG.js';
+import './chunk-XMIERMOW.js';
+import { CLI_VERSION } from './chunk-KQICUK54.js';
 
 // src/bin/everfur-mcp-hosted.ts
 async function main() {

package/dist/everfur-mcp-http.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { startRemoteMcpServer, loadRemoteMcpConfig } from './chunk-TBFOL2D3.js';
-import './chunk-WCH6AI6K.js';
-import { CLI_VERSION } from './chunk-CEWWBPPT.js';
+import { startRemoteMcpServer, loadRemoteMcpConfig } from './chunk-FC23PLWG.js';
+import './chunk-XMIERMOW.js';
+import { CLI_VERSION } from './chunk-KQICUK54.js';
 
 // src/bin/everfur-mcp-http.ts
 async function main() {

package/dist/everfur-mcp.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { runStdioServer } from './chunk-WCH6AI6K.js';
-import { CLI_VERSION } from './chunk-CEWWBPPT.js';
+import { runStdioServer } from './chunk-XMIERMOW.js';
+import { CLI_VERSION } from './chunk-KQICUK54.js';
 
 // src/bin/everfur-mcp.ts
 if (process.argv.slice(2).includes("--version")) {

package/dist/everfur.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { runCli } from './chunk-S6UN7D2O.js';
-import { ExitCode, systemClock, fetchTransport, CLI_VERSION, nodeFileSystem, nodeContractCache } from './chunk-CEWWBPPT.js';
+import { runCli } from './chunk-4UB26D67.js';
+import { ExitCode, systemClock, fetchTransport, CLI_VERSION, nodeFileSystem, nodeContractCache } from './chunk-KQICUK54.js';
 
 // src/bin/everfur.ts
 async function main() {

package/dist/index.d.ts

@@ -3340,6 +3340,6 @@ declare function parseSuppliedFacts(capabilitiesRaw: string | null, identityRaw:
  * install, and a bundled artifact. `tests/unit/version.test.ts` asserts this constant equals
  * the package.json version, so the two cannot drift.
  */
-declare const CLI_VERSION = "0.2.0";
+declare const CLI_VERSION = "0.2.1";
 
 export { ADMIN_TOKEN, API_PREFIX, type ApiClient, type ApiFailure, type ApiResult, type ApiSuccess, BASE_URL_ENV_VAR, type BlockedCapability, type BlockedOutcome, CLI_VERSION, COMMANDS, CREDENTIAL_SPECS, type Capability, type CapabilityDiagnosis, type ClockPort, type Command, type CommandContext, type CommandOutcome, type ContractValidationOutcome, type Credential, type CredentialSpec, DEFAULT_TIMEOUT_MS, type DecisionSpace, type DecisionSpaceProvenance, type DecisionTree, type DetectedDependency, type DetectedTheme, type Diagnosis, EMPTY_REGISTRY, ERRORS_DOCUMENT_KEY, type ErrorRegistry, type ErrorRegistryEntry, ExitCode, type FileSystemPort, type FormatOptions, type FormattedOutput, type HttpMethod, type HttpRequest, type HttpResponse, IDEMPOTENT_METHODS, type IdentityMode, MISSING_FACT_NAMES, type MissingFact, type MissingFactName, type Outcome, PARTNER_KEY, PARTNER_SECRET_KEY, PLAN_DOCUMENT_KIND, PLAN_SCHEMA_VERSION, type PackageManager, type PlanDocument, type PlanInput, type PlanPrinciple, type PlanStep, type PlanWarning, type PositionalSpec, type ProjectDetection, type ProjectType, REASON_CODES, REDACTED, type ReasonCode, type RegistryLoad, type RequestSpec, type ResolvedCredential, type ResolvedEndpoint, type RunOptions, SCHEMAS, SESSION_TOKEN, type SandboxCreateStatus, type SandboxCreation, type SchemaValidation, type SchemaViolation, type SessionMintLanguage, type StepResult, THEME_TOKEN_ORDER, type TerminalOutcome, type ThemeConfidence, type ThemeDetection, type ThemeEvidence, type ThemeSource, type ThemeToken, TransportError, type TransportPort, type TreeOption, type TreeQuestion, type Verification, type VerifyStep, type WalkResult, apiUrl, buildDecisionSpace, buildDiagnosisDocument, buildExplanationDocument, buildSandboxDocument, buildVerificationDocument, clampTimeout, createApiClient, createMemoryFileSystem, createRecordingClock, describeFailure, detectProject, detectTheme, detectThemeFromText, digestOfProjection, digestsEqual, editDistance, entryFromRow, ephemeralCredential, errorCodeOf, failureDetails, failureOutcome, fetchTransport, formatOutcome, isCorrelatableRequestId, isIdempotent, isKnownReasonCode, loadDecisionSpace, loadErrorRegistry, matchCommand, missingFactsFor, nextActionFor as nextActionForErrorCode, nextActionFor$1 as nextActionForReason, nextActionsFor, nodeFileSystem, parseCapabilities, parseDiagnostics, parseIdentityMode, parseSessionMintLanguage, parseSuppliedFacts, planIntegration, projectSandboxCreate, renderDiagnosis, renderExplanation, renderPlan, renderSandboxCreate, renderVerification, resolveContractPath, resolveCredential, resolveEndpoint, runCli, runVerification, suggestCodes, systemClock, validateContractFile, validateContractPublicEnvelope, validateDiagnosisDocument, validateErrorExplanationDocument, validatePlanDocument, validateSandboxCreateDocument, validateVerificationDocument, verifyDigest, walkSingle, walkTree, withPrefix };

package/dist/index.js

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-export { COMMANDS, buildSandboxDocument, buildVerificationDocument, failureOutcome, formatOutcome, matchCommand, nextActionsFor, parseCapabilities, parseIdentityMode, parseSessionMintLanguage, parseSuppliedFacts, projectSandboxCreate, renderDiagnosis, renderPlan, renderSandboxCreate, renderVerification, runCli } from './chunk-S6UN7D2O.js';
-export { ADMIN_TOKEN, API_PREFIX, BASE_URL_ENV_VAR, CLI_VERSION, CREDENTIAL_SPECS, DEFAULT_TIMEOUT_MS, EMPTY_REGISTRY, ERRORS_DOCUMENT_KEY, ExitCode, IDEMPOTENT_METHODS, MISSING_FACT_NAMES, PARTNER_KEY, PARTNER_SECRET_KEY, PLAN_DOCUMENT_KIND, PLAN_SCHEMA_VERSION, REASON_CODES, REDACTED, SCHEMAS, SESSION_TOKEN, THEME_TOKEN_ORDER, TransportError, apiUrl, buildDecisionSpace, buildDiagnosisDocument, buildExplanationDocument, clampTimeout, createApiClient, createMemoryFileSystem, createRecordingClock, describeFailure, detectProject, detectTheme, detectThemeFromText, digestOfProjection, digestsEqual, editDistance, entryFromRow, ephemeralCredential, errorCodeOf, failureDetails, fetchTransport, isCorrelatableRequestId, isIdempotent, isKnownReasonCode, loadDecisionSpace, loadErrorRegistry, missingFactsFor, nextActionFor2 as nextActionForErrorCode, nextActionFor as nextActionForReason, nodeFileSystem, parseDiagnostics, planIntegration, renderExplanation, resolveContractPath, resolveCredential, resolveEndpoint, runVerification, suggestCodes, systemClock, validateContractFile, validateContractPublicEnvelope, validateDiagnosisDocument, validateErrorExplanationDocument, validatePlanDocument, validateSandboxCreateDocument, validateVerificationDocument, verifyDigest, walkSingle, walkTree, withPrefix } from './chunk-CEWWBPPT.js';
+export { COMMANDS, buildSandboxDocument, buildVerificationDocument, failureOutcome, formatOutcome, matchCommand, nextActionsFor, parseCapabilities, parseIdentityMode, parseSessionMintLanguage, parseSuppliedFacts, projectSandboxCreate, renderDiagnosis, renderPlan, renderSandboxCreate, renderVerification, runCli } from './chunk-4UB26D67.js';
+export { ADMIN_TOKEN, API_PREFIX, BASE_URL_ENV_VAR, CLI_VERSION, CREDENTIAL_SPECS, DEFAULT_TIMEOUT_MS, EMPTY_REGISTRY, ERRORS_DOCUMENT_KEY, ExitCode, IDEMPOTENT_METHODS, MISSING_FACT_NAMES, PARTNER_KEY, PARTNER_SECRET_KEY, PLAN_DOCUMENT_KIND, PLAN_SCHEMA_VERSION, REASON_CODES, REDACTED, SCHEMAS, SESSION_TOKEN, THEME_TOKEN_ORDER, TransportError, apiUrl, buildDecisionSpace, buildDiagnosisDocument, buildExplanationDocument, clampTimeout, createApiClient, createMemoryFileSystem, createRecordingClock, describeFailure, detectProject, detectTheme, detectThemeFromText, digestOfProjection, digestsEqual, editDistance, entryFromRow, ephemeralCredential, errorCodeOf, failureDetails, fetchTransport, isCorrelatableRequestId, isIdempotent, isKnownReasonCode, loadDecisionSpace, loadErrorRegistry, missingFactsFor, nextActionFor2 as nextActionForErrorCode, nextActionFor as nextActionForReason, nodeFileSystem, parseDiagnostics, planIntegration, renderExplanation, resolveContractPath, resolveCredential, resolveEndpoint, runVerification, suggestCodes, systemClock, validateContractFile, validateContractPublicEnvelope, validateDiagnosisDocument, validateErrorExplanationDocument, validatePlanDocument, validateSandboxCreateDocument, validateVerificationDocument, verifyDigest, walkSingle, walkTree, withPrefix } from './chunk-KQICUK54.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everfur/cli",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Everfur CLI: plan, verify, and diagnose an Everfur pet-health integration from the terminal.",
   "license": "MIT",
   "type": "module",