@everfur/cli 0.2.1 → 0.4.1

package/dist/{chunk-SJUEHHU6.js → chunk-YRGSY4R2.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { hostnameOf, listen, close, writeJson, serveStatelessMcp } from './chunk-FC23PLWG.js';
-import { createHostedTokenVerifier, tokenBucketOf, isAccessTokenShaped, buildServer, MCP_SCOPE, tenantContextOf, sendTestUserRef, hostedVerifyUserRef, REVOKED_AUTHORIZATION_REMEDY, SYNTHETIC_USER_REF_PREFIX } from './chunk-XMIERMOW.js';
-import { BASE_URL_ENV_VAR, resolveEndpoint, fetchTransport, systemClock, createApiClient, withPrefix, ephemeralCredential, validateContractText, isJsonObject, describeFailure } from './chunk-KQICUK54.js';
+import { hostnameOf, listen, close, writeJson, serveStatelessMcp } from './chunk-A2QEBO5U.js';
+import { createHostedTokenVerifier, tokenBucketOf, isAccessTokenShaped, buildServer, MCP_SCOPE, tenantContextOf, sendTestUserRef, hostedVerifyUserRef, REVOKED_AUTHORIZATION_REMEDY, SYNTHETIC_USER_REF_PREFIX } from './chunk-QCXZJW5C.js';
+import { BASE_URL_ENV_VAR, resolveEndpoint, fetchTransport, systemClock, createApiClient, withPrefix, ephemeralCredential, validateContractText, isJsonObject, describeFailure } from './chunk-EBVP6FAD.js';
 import { createServer } from 'http';
 import { InvalidTokenError, TooManyRequestsError, TemporarilyUnavailableError } from '@modelcontextprotocol/sdk/server/auth/errors.js';
 import { isIP } from 'net';
@@ -12,8 +12,9 @@ var PORT_ENV_VAR = "EVERFUR_MCP_HTTP_PORT";
 var LEGACY_PORT_ENV_VAR = "MCP_PORT";
 var ALLOWED_HOSTS_ENV_VAR = "MCP_ALLOWED_HOSTS";
 var ALLOWED_ORIGINS_ENV_VAR = "MCP_ALLOWED_ORIGINS";
-var DEFAULT_ALLOWED_ORIGINS = Object.freeze(["https://claude.ai", "https://claude.com"]);
+var DEFAULT_ALLOWED_ORIGINS = Object.freeze(["https://claude.ai", "https://claude.com", "https://chatgpt.com"]);
 var TRUSTED_PROXY_HOPS_ENV_VAR = "MCP_TRUSTED_PROXY_HOPS";
+var OPENAI_APPS_CHALLENGE_TOKEN_ENV_VAR = "OPENAI_APPS_CHALLENGE_TOKEN";
 var MAX_TRUSTED_PROXY_HOPS = 8;
 var DEFAULT_HOSTED_PORT = 3100;
 var DEFAULT_MCP_PATH = "/mcp";
@@ -106,6 +107,14 @@ function parseAllowedOrigins(raw) {
     return origin;
   });
 }
+function parseOpenAiAppsChallengeToken(raw) {
+  const value = (raw ?? "").trim();
+  if (value.length === 0) return null;
+  if (!/^[\x21-\x7e]+$/.test(value)) {
+    throw new Error(`${OPENAI_APPS_CHALLENGE_TOKEN_ENV_VAR} must be one token of printable ASCII, with no space or line break inside it.`);
+  }
+  return value;
+}
 function loadHostedMcpConfig(env) {
   if ((env[BASE_URL_ENV_VAR] ?? "").trim().length === 0) {
     throw new Error(`${BASE_URL_ENV_VAR} is required: the Everfur API this server verifies bearers against.`);
@@ -126,7 +135,8 @@ function loadHostedMcpConfig(env) {
     port: parsePort(env),
     allowedHosts: /* @__PURE__ */ new Set([publicHostname, ...parseAllowedHosts(env[ALLOWED_HOSTS_ENV_VAR])]),
     trustedProxyHops: parseTrustedProxyHops(env[TRUSTED_PROXY_HOPS_ENV_VAR]),
-    allowedOrigins: /* @__PURE__ */ new Set([...DEFAULT_ALLOWED_ORIGINS, ...parseAllowedOrigins(env[ALLOWED_ORIGINS_ENV_VAR])])
+    allowedOrigins: /* @__PURE__ */ new Set([...DEFAULT_ALLOWED_ORIGINS, ...parseAllowedOrigins(env[ALLOWED_ORIGINS_ENV_VAR])]),
+    openaiAppsChallengeToken: parseOpenAiAppsChallengeToken(env[OPENAI_APPS_CHALLENGE_TOKEN_ENV_VAR])
   });
 }
 function resourceMetadataUrl(config) {
@@ -265,15 +275,35 @@ The integration tools:
 - everfur_plan_integration produces an integration plan, or a refusal that names each missing fact (identity mode,
   capabilities, backend language, environment) rather than a plan built on a guess. An integration built on a guessed
   identity mode is wrong in a way that only shows up in production. Omitted, the environment is the connected tenant's.
+  A plan comes back as a small summary with a plan_id and a number of pages: the goal, the detected facts, each step's
+  id, title, one-line intent and page, and the checklist. The steps in full, with their commands and the complete file
+  bodies, come from further everfur_plan_integration calls with the same arguments plus plan_id and page, for page 1
+  to pages; page 1 also carries the detection, the warnings and the checklist in full, and the principles. (With
+  steps, step ids, instead of page, those steps come a page at a time and remaining_steps names the rest.) Each call
+  recomputes the plan from the project_details it is given, and the plan's own commands and files change the project,
+  so every page is fetched before any command runs or any file is written. The same arguments
+  and contract always produce the same plan, byte for byte. A refusal for missing facts gives each fact the developer
+  answers a fixed question and its closed list of options, so the same refusal always asks the same thing. A ready
+  plan carries a checklist: the finished integration as a fixed list of requirements, each with the check that proves
+  it. The theme is matched to the host app's own brand colours, read from its code (a Tailwind config, the CSS that
+  declares its theme, or a React Native theme file) and passed as theme_source; when none is given, the plan's
+  match-theme step names where those colours are looked for, and no colour is chosen for the host. The tenant's console
+  branding is the other side of the theme: it fills every field the theme leaves unset and wins for a field the tenant
+  locked in the partner console.
 - everfur_verify_integration exercises the real wire with a short-lived session the Everfur API mints for a synthetic
-  test user of a sandbox tenant (its entitlements report livemode false). On a live tenant the signed session step is
-  reported GATED; no session can be supplied by hand. identity_mode anonymous verifies the anonymous path instead: the
+  test user of a sandbox tenant (its entitlements report livemode false). On a live tenant with a paired sandbox the
+  session is minted on that sandbox and the call uses its publishable key; on a live tenant with no pair the signed
+  session step is reported GATED; no session can be supplied by hand. identity_mode anonymous verifies the anonymous path instead: the
   tenant's publishable key and a device session id derived for a synthetic test user, with nothing minted. It is the
-  read-only check a live tenant takes, GET requests only.
+  read-only check a live tenant takes, GET requests only. For a web page pass origin with embedding beside it: an
+  in-page page calls the API from its own origin, so the CORS checks apply to it, and with embedding in-page the
+  frame's own checks (the embed fence and the loader) are reported N/A.
 - everfur_diagnose separates the four byte-identical causes of an empty entitlement verdict.
 - everfur_explain_error looks an error code up in the contract's registry, case sensitive, and refuses a code the
   registry does not list, with near misses. Three naming families are live at once and one code is the default for
-  four different HTTP statuses, so the registry, not the shape of a code's string, says whether a retry can help.
+  four different HTTP statuses, so the registry, not the shape of a code's string, says whether a retry can help. It
+  also answers, offline, the error.code the tools on this server return (VERIFICATION_FAILED, PLAN_CHANGED and the
+  rest).
 - everfur_send_test_message sends a real message to a sandbox tenant only, and streams the real answer.
 
 The tenant tools read the connected tenant's own state and change nothing:
@@ -296,6 +326,13 @@ diagnose-integration lay out an order to call the tools in.`;
 
 // src/mcp/hosted/tenant-env.ts
 var VERIFY_SESSIONS_PATH = "/mcp/verify-sessions";
+var MINTING_TOOLS = /* @__PURE__ */ new Set(["everfur_verify_integration", "everfur_send_test_message"]);
+function hostedCallMode(context, tool, args) {
+  if (!context.tenant.livemode || context.test === null) return "connected";
+  if (!MINTING_TOOLS.has(tool)) return "connected";
+  if (tool === "everfur_verify_integration" && args["identity_mode"] === "anonymous") return "connected";
+  return "test";
+}
 function toolApiBaseUrl(context, fallback) {
   const resolved = resolveEndpoint(null, { [BASE_URL_ENV_VAR]: context.apiBaseUrl });
   return resolved.ok ? resolved.endpoint.baseUrl : fallback;
@@ -334,7 +371,9 @@ async function mintVerifySession(options) {
         sessionToken: null,
         outcome: {
           kind: "gated",
-          reason: "this tenant is live: the Everfur API mints verify sessions for sandbox tenants only",
+          // The live-tenant wording applies to an UNPAIRED live tenant only: a paired one is minted on its sandbox, and is
+          // refused only when that sandbox is no longer an active partner sandbox (EFBackend #1629).
+          reason: options.paired === true ? "this tenant is live and its paired sandbox is no longer an active sandbox: the Everfur API mints verify sessions on a sandbox tenant only" : "this tenant is live: the Everfur API mints verify sessions for sandbox tenants only",
           requestId: result.requestId
         }
       };
@@ -391,7 +430,8 @@ async function mintVerifySession(options) {
   };
 }
 function synthesizeTenantEnv(options) {
-  const publishableKey = options.context.publishableKey;
+  const test = options.mode === "test" ? options.context.test : null;
+  const publishableKey = test === null ? options.context.publishableKey : test.publishableKey;
   return Object.freeze({
     [BASE_URL_ENV_VAR]: toolApiBaseUrl(options.context, options.apiBaseUrl),
     ...publishableKey === null ? {} : { EVERFUR_PARTNER_KEY: publishableKey }
@@ -610,6 +650,7 @@ function createWellKnownMirror(options) {
 
 // src/mcp/hosted/http.ts
 var HEALTH_PATH = "/healthz";
+var OPENAI_APPS_CHALLENGE_PATH = "/.well-known/openai-apps-challenge";
 var MAX_BODY_BYTES = 1024 * 1024;
 var DRAIN_CEILING_BYTES = 16 * 1024 * 1024;
 var RETRY_AFTER_SECONDS = 5;
@@ -720,12 +761,23 @@ function createHostedMcpRequestListener(options) {
     const userRef = call.tool === "everfur_send_test_message" && typeof idempotencyKey === "string" && idempotencyKey.length > 0 ? sendTestUserRef(idempotencyKey) : hostedVerifyUserRef(typeof label === "string" ? label : void 0);
     const bearer = call.authInfo.token;
     const onUnauthorized = () => verifier.forget(bearer);
+    const mode = hostedCallMode(tenant, call.tool, call.args);
+    const paired = tenant.tenant.livemode && tenant.test !== null;
     return {
-      env: synthesizeTenantEnv({ context: tenant, apiBaseUrl: config.apiBaseUrl }),
+      env: synthesizeTenantEnv({ context: tenant, apiBaseUrl: config.apiBaseUrl, mode }),
       credentialSource: "hosted",
-      hostedMint: createHostedMint({ bearer, apiBaseUrl: config.apiBaseUrl, userRef, transport, clock, onUnauthorized }),
+      hostedMint: createHostedMint({ bearer, apiBaseUrl: config.apiBaseUrl, userRef, transport, clock, onUnauthorized, paired }),
       syntheticUserRef: userRef,
-      tenantReads: createHostedTenantReads({ bearer, apiBaseUrl: config.apiBaseUrl, transport, clock, onUnauthorized })
+      tenantReads: createHostedTenantReads({ bearer, apiBaseUrl: config.apiBaseUrl, transport, clock, onUnauthorized }),
+      tenantMode: { livemode: tenant.tenant.livemode, paired },
+      connectedTenant: {
+        slug: tenant.tenant.slug,
+        livemode: tenant.tenant.livemode,
+        pairedSandboxSlug: tenant.test === null ? null : tenant.test.slug,
+        // The prefix alone, which names the tenant mode; the key itself never leaves the context.
+        publishableKeyPrefix: ["pk_test_", "pk_live_"].find((prefix) => tenant.publishableKey?.startsWith(prefix) === true) ?? null,
+        apiBaseUrl: tenant.apiBaseUrl
+      }
     };
   };
   return async (req, res) => {
@@ -738,6 +790,21 @@ function createHostedMcpRequestListener(options) {
       writeJson(res, 200, { status: "ok" });
       return;
     }
+    const challengeToken = config.openaiAppsChallengeToken;
+    if (challengeToken !== null && url.pathname === OPENAI_APPS_CHALLENGE_PATH) {
+      const refused2 = refusalFor(req, config, ["GET", "HEAD"]);
+      if (refused2 !== null) {
+        writeJson(res, refused2.status, { error: refused2.message }, refused2.headers);
+        return;
+      }
+      res.writeHead(200, {
+        "content-type": "text/plain; charset=utf-8",
+        "content-length": String(Buffer.byteLength(challengeToken)),
+        "cache-control": "no-store"
+      });
+      res.end(req.method === "HEAD" ? void 0 : challengeToken);
+      return;
+    }
     const document = metadataPaths.get(url.pathname);
     if (document !== void 0) {
       if (req.method === "OPTIONS") {

package/dist/everfur-mcp-hosted.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { loadHostedMcpConfig, startHostedMcpServer } from './chunk-SJUEHHU6.js';
-import './chunk-FC23PLWG.js';
-import './chunk-XMIERMOW.js';
-import { CLI_VERSION } from './chunk-KQICUK54.js';
+import { loadHostedMcpConfig, startHostedMcpServer } from './chunk-YRGSY4R2.js';
+import './chunk-A2QEBO5U.js';
+import './chunk-QCXZJW5C.js';
+import { CLI_VERSION } from './chunk-EBVP6FAD.js';
 
 // src/bin/everfur-mcp-hosted.ts
 async function main() {

package/dist/everfur-mcp-http.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { startRemoteMcpServer, loadRemoteMcpConfig } from './chunk-FC23PLWG.js';
-import './chunk-XMIERMOW.js';
-import { CLI_VERSION } from './chunk-KQICUK54.js';
+import { startRemoteMcpServer, loadRemoteMcpConfig } from './chunk-A2QEBO5U.js';
+import './chunk-QCXZJW5C.js';
+import { CLI_VERSION } from './chunk-EBVP6FAD.js';
 
 // src/bin/everfur-mcp-http.ts
 async function main() {

package/dist/everfur-mcp.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { runStdioServer } from './chunk-XMIERMOW.js';
-import { CLI_VERSION } from './chunk-KQICUK54.js';
+import { runStdioServer } from './chunk-QCXZJW5C.js';
+import { CLI_VERSION } from './chunk-EBVP6FAD.js';
 
 // src/bin/everfur-mcp.ts
 if (process.argv.slice(2).includes("--version")) {

package/dist/everfur.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { runCli } from './chunk-4UB26D67.js';
-import { ExitCode, systemClock, fetchTransport, CLI_VERSION, nodeFileSystem, nodeContractCache } from './chunk-KQICUK54.js';
+import { runCli } from './chunk-2MTX6YWO.js';
+import { ExitCode, systemClock, fetchTransport, CLI_VERSION, nodeFileSystem, nodeContractCache } from './chunk-EBVP6FAD.js';
 
 // src/bin/everfur.ts
 async function main() {