@everfur/cli 0.2.1 → 0.4.1

package/dist/index.d.ts

@@ -32,12 +32,11 @@ interface CredentialSpec {
     /**
      * Additional accepted prefixes, beyond `prefix`.
      *
-     * The prefix a publishable key must carry is a property of the DEPLOYMENT, not of the tenant: production and
-     * staging both take `pk_live_` (a staging sandbox tenant is issued a `pk_live_` key and refuses `pk_test_`), and
-     * `pk_test_` is the prefix a deployment configured as a sandbox deployment would take instead; no deployed
-     * environment is configured that way today, so no deployed environment accepts it. The CLI cannot tell which
-     * deployment it is pointed at before it makes a call, so it accepts both shapes. The SERVER is the authority: each
-     * deployment refuses the prefix it does not take on the fast-fail path, so accepting both here narrows nothing.
+     * The prefix a publishable key carries names the TENANT MODE (EFBackend #1630): a sandbox tenant is issued `pk_test_`
+     * and a live tenant `pk_live_`, on production and staging alike, and a sandbox created before `pk_test_` keys were
+     * issued may still carry `pk_live_` (commands/plan/environment.ts). Each deployment accepts `pk_test_` only for a
+     * sandbox tenant's row, so a test key never resolves a live tenant. The CLI cannot tell a tenant's mode from here, so
+     * it accepts both shapes; the SERVER is the authority, and accepting both here narrows nothing.
      */
     readonly alsoAccepts?: readonly string[];
     /** Exact expected length when the prefix is known, or null. */
@@ -282,6 +281,13 @@ declare const ExitCode: Readonly<{
      * and escalates to a human, which is the only thing that resolves it.
      */
     readonly BLOCKED: 9;
+    /**
+     * The command needs the Everfur contract and none could be had: no `--contract` file, no `EVERFUR_CONTRACT_PUBLIC`,
+     * and no `EVERFUR_DOCS_KEY` to fetch it with. Distinct from 2 (tester run, 2026-10-01): the invocation is fine and
+     * a wrapper that prompts for a corrected command line would loop; the missing piece is a credential a partner has
+     * to obtain, and the error document says where.
+     */
+    readonly CONTRACT_CREDENTIAL_MISSING: 10;
 }>;
 type ExitCode = (typeof ExitCode)[keyof typeof ExitCode];
 
@@ -663,6 +669,13 @@ declare const SCHEMAS: Readonly<{
                     $ref: string;
                 };
             };
+            checklist: {
+                description: string;
+                type: string;
+                items: {
+                    $ref: string;
+                };
+            };
             warnings: {
                 type: string;
                 items: {
@@ -885,19 +898,86 @@ declare const SCHEMAS: Readonly<{
                                 type: string;
                                 pattern: string;
                             };
+                            successColor: {
+                                type: string;
+                                pattern: string;
+                            };
+                            warningColor: {
+                                type: string;
+                                pattern: string;
+                            };
+                            infoColor: {
+                                type: string;
+                                pattern: string;
+                            };
+                            successColorDark: {
+                                type: string;
+                                pattern: string;
+                            };
+                            warningColorDark: {
+                                type: string;
+                                pattern: string;
+                            };
+                            infoColorDark: {
+                                type: string;
+                                pattern: string;
+                            };
+                            dangerColor: {
+                                type: string;
+                                pattern: string;
+                            };
+                            dangerColorDark: {
+                                type: string;
+                                pattern: string;
+                            };
                             brightness: {
                                 enum: string[];
                             };
+                            backgroundColor: {
+                                type: string;
+                                pattern: string;
+                                description: string;
+                            };
+                            backgroundColorDark: {
+                                type: string;
+                                pattern: string;
+                                description: string;
+                            };
+                            textColor: {
+                                type: string;
+                                pattern: string;
+                                description: string;
+                            };
+                            textColorDark: {
+                                type: string;
+                                pattern: string;
+                                description: string;
+                            };
                             surfaceStyle: {
                                 enum: string[];
                             };
                             radiusScale: {
                                 enum: string[];
                             };
+                            borderRadius: {
+                                type: string;
+                                minimum: number;
+                                description: string;
+                            };
+                            fontSizeBase: {
+                                type: string;
+                                exclusiveMinimum: number;
+                                description: string;
+                            };
                             fontFamily: {
                                 type: string;
                                 minLength: number;
                             };
+                            headingFontFamily: {
+                                type: string;
+                                minLength: number;
+                                description: string;
+                            };
                             fontRegular: {
                                 type: string;
                                 minLength: number;
@@ -1082,6 +1162,31 @@ declare const SCHEMAS: Readonly<{
                     };
                 };
             };
+            PlanChecklistItem: {
+                type: string;
+                required: string[];
+                properties: {
+                    id: {
+                        type: string;
+                        minLength: number;
+                    };
+                    requirement: {
+                        type: string;
+                        minLength: number;
+                    };
+                    verify: {
+                        type: string;
+                        minLength: number;
+                    };
+                    steps: {
+                        type: string;
+                        items: {
+                            type: string;
+                            minLength: number;
+                        };
+                    };
+                };
+            };
             DecisionSpaceProvenance: {
                 type: string;
                 required: string[];
@@ -1117,6 +1222,34 @@ declare const SCHEMAS: Readonly<{
                         type: string;
                         minLength: number;
                     };
+                    requiredWhen: {
+                        description: string;
+                        type: string;
+                        required: string[];
+                        properties: {
+                            fact: {
+                                type: string;
+                                minLength: number;
+                            };
+                            oneOf: {
+                                type: string;
+                                minItems: number;
+                                items: {
+                                    type: string;
+                                    minLength: number;
+                                };
+                            };
+                        };
+                    };
+                    options: {
+                        description: string;
+                        type: string;
+                        minItems: number;
+                        items: {
+                            type: string;
+                            minLength: number;
+                        };
+                    };
                 };
             };
             PlanStep: {
@@ -1684,6 +1817,11 @@ declare const SCHEMAS: Readonly<{
                         type: string;
                         minimum: number;
                     };
+                    notApplicable: {
+                        description: string;
+                        type: string;
+                        minimum: number;
+                    };
                 };
             };
             steps: {
@@ -1782,7 +1920,8 @@ declare const SCHEMAS: Readonly<{
                 minLength: number;
             };
             httpStatus: {
-                type: string;
+                description: string;
+                type: string[];
                 minimum: number;
             };
             namingFamily: {
@@ -1790,11 +1929,41 @@ declare const SCHEMAS: Readonly<{
                 minLength: number;
             };
             retryable: {
-                type: string;
+                description: string;
+                type: string[];
             };
             confirmedOnWire: {
+                description: string;
+                type: string[];
+            };
+            alsoIn: {
                 description: string;
                 type: string;
+                items: {
+                    type: string;
+                    required: string[];
+                    properties: {
+                        namingFamily: {
+                            type: string;
+                            minLength: number;
+                        };
+                        declaredIn: {
+                            type: string;
+                            minLength: number;
+                        };
+                        cause: {
+                            type: string;
+                            minLength: number;
+                        };
+                        retryable: {
+                            type: string[];
+                        };
+                        nextAction: {
+                            type: string;
+                            minLength: number;
+                        };
+                    };
+                };
             };
             surfaces: {
                 type: string;
@@ -2029,6 +2198,8 @@ type ApiFailure = {
     readonly retryable: boolean;
     readonly requestId: string | null;
     readonly attempts: number;
+    /** When to try again, as the response said it (retrySignalsOf). Absent where nothing built one. */
+    readonly retrySignals?: RetrySignals;
 } | {
     readonly ok: false;
     readonly kind: 'malformed';
@@ -2102,6 +2273,24 @@ declare function errorCodeOf(body: unknown): {
     readonly code: string | null;
     readonly wireMessage: string;
 };
+/**
+ * Build the `http` failure with `wireMessage` NON-ENUMERABLE.
+ *
+ * Written as a builder rather than an object literal because a literal cannot express
+ * "present on the type, invisible to a serialiser". The property is defined after the fact and
+ * the whole thing is frozen, so the field is readable by a deliberate `failure.wireMessage` and
+ * by nothing that walks the object.
+ */
+/**
+ * WHEN TO TRY AGAIN, AS THE RESPONSE SAID IT (tester run, 2026-10-01). The registry's note for the daily quota says
+ * `resets_at` in the body is the only reliable retry signal on that path (there is no Retry-After), and no command
+ * printed it. Both are read here, and only in a shape that cannot carry free text: `resets_at` as an ISO 8601 UTC or
+ * offset timestamp, `Retry-After` as delta-seconds or an HTTP date. Anything else is dropped, never rendered.
+ */
+interface RetrySignals {
+    readonly resetsAt: string | null;
+    readonly retryAfter: string | null;
+}
 declare function createApiClient(options: ApiClientOptions): ApiClient;
 /**
  * One-line human summary of a failure. Assembled from OPERATOR-OWNED DATA ONLY: the method and
@@ -2379,22 +2568,36 @@ declare function renderSandboxCreate(creation: SandboxCreation, revocation: Sand
  * THE MAPPING is to the SDK's `EverfurThemeInput` (everfur-sdk-rn src/client/theme/input.ts), and only where
  * it is unambiguous: primary or brand to `primaryColor`; accent or secondary to `accentColor`, unless it reads
  * as a surface tint (under 1.5:1 against the background, the shadcn `--accent` hover wash); the background to
- * `brightness` (pinned when the project declares no dark variant) and, for a light ground close to one of the
- * SDK's three compiled surfaces, `surfaceStyle`; a base radius to `radiusScale` by size; the first family of a
+ * `brightness` (pinned when the project declares no dark variant) and, as declared, `backgroundColor` (branding v2
+ * below); a base radius to `borderRadius` in px; the first family of a
  * font stack to `fontFamily` when it is a plain family name (the web, where the page loads the weights itself); a
  * React Native theme file's `fontFamily` literals to the registered faces `fontRegular`, `fontMedium` and
  * `fontBold` (written as the SDK's `fonts` map, names only: the app registers the faces, the SDK bundles no font
- * and synthesizes no weight on a named face). The foreground is read as evidence only: the SDK
- * computes its text colours from the ground (WCAG), and the prop has no text token outside slots. Every colour
+ * and synthesizes no weight on a named face). The foreground is the body text, `textColor` (branding v2). Every colour
  * is written as `#RRGGBB`, the form the SDK parses; `hsl()` and `oklch()` are converted (theme-color.ts).
  *
+ * BRANDING V2, THE LITERAL FIELDS (SDK 0.9.0; hosted MCP integration tests, 2026-10-04). The ground (and its dark twin)
+ * as `backgroundColor`, never the nearest of the SDK's compiled surfaces, and no `surfaceStyle` beside it; the body text
+ * as `textColor`; the radius as `borderRadius` and the body size as `fontSizeBase`, both in px; a danger colour
+ * (`--destructive`, `--danger`, `--error`) as `dangerColor`, mapped like the status colours below. A stock Tailwind app
+ * that names its colours by the default palette is read through that palette (tailwind-palette.ts): `@apply` utilities,
+ * a v4 `var(--color-<name>-<shade>)`, and a v3 `colors.<name>[<shade>]` from `tailwindcss/colors`.
+ *
+ * BRANDING V2 (SDK 0.9.0, 2026-10-03). Three status colours and a heading family, mapped by name only: a success,
+ * warning or info colour the project declares (`--success`, `--color-warning`, Tailwind v3 `colors.info`, a React
+ * Native colours key `success`) to `successColor`, `warningColor` or `infoColor`, with its dark twin where the project
+ * declares one; a heading font stack (`--font-heading`, `--font-display`, Tailwind v3 `fontFamily.heading`) to
+ * `headingFontFamily`, its first plain family. A project that declares none of them gets none: the SDK keeps
+ * Everfur's own status paint and heading faces, and no colour is chosen here. They ride on the reading the gate
+ * grades and never raise or lower it, so a project that declares only a status colour is still refused.
+ *
  * THE CONFIDENCE GATE. `high` when a primary and a background both come from one source with literal values;
  * `medium` when only some tokens were read; `low` otherwise. A computed colour the mapping wanted drops the
  * grade one level; a config that runs code at load time, or builds a theme value with a template literal, is
  * `low` whatever it declares. At `low` the theme is empty: nothing read from a source this tool could not fully
  * trust is written into a partner's app.
  */
-type ThemeSource = 'tailwind-v4' | 'tailwind-v3' | 'css-variables' | 'react-navigation' | 'rn-colors' | 'none';
+type ThemeSource = 'tailwind-v4' | 'tailwind-v3' | 'css-variables' | 'tailwind-classes' | 'react-navigation' | 'rn-colors' | 'none';
 type ThemeConfidence = 'high' | 'medium' | 'low';
 /**
  * The subset of the SDK's `EverfurThemeInput` a plan writes. Every value is a string, so the emitted literal
@@ -2421,6 +2624,32 @@ interface DetectedTheme {
     readonly fontRegular?: string;
     readonly fontMedium?: string;
     readonly fontBold?: string;
+    /** Branding v2 status colours, `#RRGGBB`, only where the project declares them by name (see the header). */
+    readonly successColor?: string;
+    readonly warningColor?: string;
+    readonly infoColor?: string;
+    /** Their dark twins, when the project declares a dark variant of the same key (or is dark only). */
+    readonly successColorDark?: string;
+    readonly warningColorDark?: string;
+    readonly infoColorDark?: string;
+    /** Branding v2: the family of the headings, one plain family name, never a stack. */
+    readonly headingFontFamily?: string;
+    /** Branding v2: errors and destructive actions, `#RRGGBB`, and its dark twin, where the project declares them by name. */
+    readonly dangerColor?: string;
+    readonly dangerColorDark?: string;
+    /**
+     * Branding v2: the ground of the light palette and of the dark one, `#RRGGBB`, exactly as the project declares it
+     * (SDK 0.9.0 background_color). Written instead of the nearest surfaceStyle preset, which snapped slate-50 to cream.
+     */
+    readonly backgroundColor?: string;
+    readonly backgroundColorDark?: string;
+    /** Branding v2: the body text of the light and dark palettes, `#RRGGBB` (the SDK keeps it at 4.5:1 on every ground). */
+    readonly textColor?: string;
+    readonly textColorDark?: string;
+    /** Branding v2: the medium corner radius in px (the SDK clamps 0 to 32), written instead of a radiusScale. */
+    readonly borderRadius?: number;
+    /** Branding v2: the body text size in px (the SDK clamps 12 to 20). */
+    readonly fontSizeBase?: number;
 }
 type ThemeToken = keyof DetectedTheme;
 /** The order the tokens are written in generated code. */
@@ -2510,6 +2739,124 @@ interface ThemeProp {
     readonly source: string;
 }
 
+/**
+ * The detection vocabulary. Every value here is something the CLI can establish from files on
+ * disk. Anything it cannot establish lives in `src/commands/plan/facts.ts` as a supplied fact,
+ * and the two sets are deliberately disjoint.
+ */
+type ProjectType = 'expo-managed' | 'bare-react-native' | 'flutter' | 'web' | 'shopify-storefront' | 'unknown';
+/**
+ * How a web project embeds the Everfur surface, read from the project: `in-page` when package.json
+ * declares react-dom (the SDK's React components render in the host's own tree), `frame` otherwise (the
+ * loader puts the surface in an iframe on Everfur's origin, and nothing is installed). The platform tree
+ * asks this as its `web-embedding` question; `--embedding` overrides the detected answer. Null for every
+ * other project shape.
+ */
+type WebEmbedding = 'in-page' | 'frame';
+/**
+ * The web framework facet of a `web` project (see `web-framework.ts`). It spells the generated files; the
+ * contract's platform tree still branches on the project type, which this never replaces.
+ */
+type WebFramework = 'next-app-router' | 'next-pages-router' | 'vite-react' | 'remix' | 'static-html' | 'other-web';
+interface WebFrameworkDetection {
+    readonly framework: WebFramework;
+    /** `src/` when the framework's source root is `src/` (Next.js with src/app, a Vite app), else empty. */
+    readonly sourceDir: '' | 'src/';
+    readonly evidence: readonly string[];
+}
+type PackageManager = 'npm' | 'pnpm' | 'yarn' | 'bun' | 'not-applicable' | 'undetermined';
+type DependencySource = 'package.json' | 'pubspec.yaml';
+type DependencyScope = 'dependencies' | 'devDependencies' | 'peerDependencies' | 'sdk';
+/**
+ * `declared` is the range written in the manifest. `installed` is the exact version resolved
+ * on disk when the dependency tree is present. Reporting both is the honest answer: a plan
+ * built against `^50.0.0` with nothing installed is materially less certain than one built
+ * against a resolved 50.0.17, and a reader deserves to see which of the two they are getting.
+ */
+interface DetectedDependency {
+    readonly name: string;
+    readonly declared: string | null;
+    readonly installed: string | null;
+    readonly source: DependencySource;
+    readonly scope: DependencyScope;
+}
+interface ProjectDetection {
+    readonly root: string;
+    readonly projectType: ProjectType;
+    /** Human-readable file-level facts that produced `projectType`, in the order they were found. */
+    readonly projectTypeEvidence: readonly string[];
+    readonly packageManager: PackageManager;
+    readonly packageManagerEvidence: readonly string[];
+    readonly dependencies: readonly DetectedDependency[];
+    /** The detected embedding of a `web` project; null for every other shape. Its evidence is in `projectTypeEvidence`. */
+    readonly webEmbedding: WebEmbedding | null;
+    /**
+     * The detected framework of a `web` project; null (or absent, for a detection built by hand) for every
+     * other shape.
+     */
+    readonly webFramework?: WebFrameworkDetection | null;
+    /**
+     * What the project already says about its own look (theme-detect.ts), for the shapes the plan writes a provider
+     * for (web, Expo, bare React Native); null for every other shape, and absent for a detection built by hand.
+     */
+    readonly theme?: ThemeDetection | null;
+    /**
+     * Expo Router, for a React Native project that uses it (expo-router.ts); null when it does not, and absent for a
+     * detection built by hand. It decides where the plan tells the app to mount its Everfur module: Expo Router never
+     * renders App.tsx, and every file under its routes directory is a route.
+     */
+    readonly expoRouter?: ExpoRouterDetection | null;
+    /**
+     * The URL schemes a React Native project declares and the application ids beside them (app-schemes.ts), so the
+     * visit-return step can say whether one of them is a destination Everfur would register (MCP-14). Null for every
+     * other shape, and absent for a detection built by hand.
+     */
+    readonly appSchemes?: AppSchemeDetection | null;
+    /**
+     * The Node server a web project already runs (express, fastify, koa or hono in its dependencies), so the plan writes
+     * the session route for that server instead of a development server of its own. Null when it declares none, and
+     * absent for a detection built by hand.
+     */
+    readonly nodeServer?: NodeServerDetection | null;
+    /**
+     * Whether the project already has a `server/` directory and a `server/tsconfig.json` in it, so the plan never writes
+     * over a tsconfig the project owns. Absent for a detection built by hand, which then has neither.
+     */
+    readonly serverDirectory?: ServerDirectoryDetection | null;
+    /**
+     * True when the project already has a `.env.example` at its root, so the plan adds its lines to it rather than
+     * handing over a whole file that replaces the app's own (hosted MCP mobile integration test, 2026-10-04).
+     */
+    readonly envExampleExists?: boolean;
+}
+/** The Node server frameworks the plan writes a session route for, in the order they are looked for. */
+type NodeServerFramework = 'express' | 'fastify' | 'koa' | 'hono';
+interface NodeServerDetection {
+    readonly framework: NodeServerFramework;
+    readonly evidence: readonly string[];
+}
+interface ServerDirectoryDetection {
+    readonly exists: boolean;
+    readonly tsconfig: boolean;
+}
+/** What a React Native project declares about its own URL schemes. */
+interface AppSchemeDetection {
+    /** Every declared scheme, in the order app.json, iOS, Android. */
+    readonly schemes: readonly string[];
+    /** The application ids declared beside them (the iOS bundle identifier, the Android package). */
+    readonly appIds: readonly string[];
+    /** The first declared scheme in reverse-DNS form, which is the only form Everfur registers; null when there is none. */
+    readonly reverseDns: string | null;
+    /** The file and key each scheme was read from. */
+    readonly evidence: readonly string[];
+}
+/** An Expo Router project: its routes directory, and the files that said so. */
+interface ExpoRouterDetection {
+    /** `app`, or `src/app` when the routes live there (Expo Router reads `src/app` when `app` is absent). */
+    readonly appDir: 'app' | 'src/app';
+    readonly evidence: readonly string[];
+}
+
 /**
  * THE SURFACE CHECKS, run when `--surfaces` names them: each asks whether one Everfur surface works for THIS tenant
  * with the session `verify` just minted, from the same wire a partner's app uses.
@@ -2522,11 +2869,13 @@ interface ThemeProp {
  *            is kept, so only the origin, the path and the expiry reach the report.
  *   theme    the branding the verdict's render_hints carry, rendered by the SDK's own resolver (theme-render.ts, over
  *            the SDK code mirrored into src/registry/sdk): which fields are overridden and which the tenant locked,
- *            whether the SDK drops the whole branding for a schema_version it does not read, whether it would drop a
- *            logo or font URL, whether text on the brand fill it paints reaches WCAG 4.5:1 on each palette it shows
- *            (light unless a brightness says otherwise, both for auto), and which configured slot colours its guard
- *            repaints. The inks it pushes until they read (brand text, links) and the dark variants it derives are
- *            reported, not failed. With a project (`--project-root`, `project_root`) or a pasted `theme_source`, the
+ *            whether the SDK drops the whole branding for a schema_version it does not read, whether it would ignore
+ *            a logo or assistant avatar that is not an image uploaded in the partner console (SDK 0.9.0) or drop a font
+ *            URL that is not https, whether text on the brand fill it paints reaches WCAG 4.5:1 on each palette it
+ *            shows (light unless a brightness says otherwise, both for auto), and which configured slot colours its
+ *            guard repaints, all seventeen slots of branding v2. The inks it pushes until they read (brand text,
+ *            links, and the branding v2 status colours), the dark variants it derives, and that font_sources load
+ *            in-page only (the hosted frame keeps Everfur's fonts) are reported, not failed. With a project (`--project-root`, `project_root`) or a pasted `theme_source`, the
  *            branding is judged MERGED with the `theme` prop `everfur plan` writes from that theme, as the SDK merges
  *            them: the prop wins per field unless the tenant locked it.
  *
@@ -2584,8 +2933,12 @@ type VerifyIdentityMode = (typeof VERIFY_IDENTITY_MODES)[number];
  * GATED is the fourth answer, added with the surface checks: the step ran and found a surface Everfur has switched
  * off for the tenant. It is neither a failure of the integration (FAIL) nor something the operator can supply to make
  * the step run (SKIP), so it moves the status in neither direction.
+ *
+ * N/A is the fifth, added with the embedding (timed integration run, 2026-09-26): a check that does not apply to this
+ * integration, such as the frame's embed fence for a page that renders in-page. It was not run, and nothing the
+ * operator supplies would make it apply, so, like GATED, it moves the status in neither direction.
  */
-type StepResult = 'PASS' | 'FAIL' | 'SKIP' | 'GATED';
+type StepResult = 'PASS' | 'FAIL' | 'SKIP' | 'GATED' | 'N/A';
 interface VerifyStep {
     /** Stable within a schemaVersion. Callers may key on it. */
     readonly id: string;
@@ -2654,6 +3007,11 @@ interface VerifyOptions {
      * exercise: the embed fence, the CORS exposure, the session policy, the loader. Null skips them.
      */
     readonly origin?: string | null;
+    /**
+     * How that page embeds the surface. Null reads it from `project` when one is given (react-dom means in-page), and
+     * is otherwise `frame`, what `origin` has always meant. `in-page` reports the frame's two checks N/A.
+     */
+    readonly embedding?: WebEmbedding | null;
     /** The transport for the loader probe, which leaves the API host. Null skips that one check. */
     readonly transport?: TransportPort | null;
     readonly timeoutMs?: number;
@@ -2690,6 +3048,8 @@ interface VerifyOptions {
      * the prop read from a pasted `theme_source`, which wins over the project on disk, as it does for the plan.
      */
     readonly themeProp?: ThemeProp | null;
+    /** Why a pasted `theme_source` gave no theme prop; the theme check then fails rather than judging the branding alone. */
+    readonly themeSourceUnread?: string | null;
 }
 interface Verification {
     readonly steps: readonly VerifyStep[];
@@ -2741,98 +3101,6 @@ declare const nodeFileSystem: FileSystemPort;
  */
 declare function createMemoryFileSystem(files: Readonly<Record<string, string>>): FileSystemPort;
 
-/**
- * The detection vocabulary. Every value here is something the CLI can establish from files on
- * disk. Anything it cannot establish lives in `src/commands/plan/facts.ts` as a supplied fact,
- * and the two sets are deliberately disjoint.
- */
-type ProjectType = 'expo-managed' | 'bare-react-native' | 'flutter' | 'web' | 'shopify-storefront' | 'unknown';
-/**
- * How a web project embeds the Everfur surface, read from the project: `in-page` when package.json
- * declares react-dom (the SDK's React components render in the host's own tree), `frame` otherwise (the
- * loader puts the surface in an iframe on Everfur's origin, and nothing is installed). The platform tree
- * asks this as its `web-embedding` question; `--embedding` overrides the detected answer. Null for every
- * other project shape.
- */
-type WebEmbedding = 'in-page' | 'frame';
-/**
- * The web framework facet of a `web` project (see `web-framework.ts`). It spells the generated files; the
- * contract's platform tree still branches on the project type, which this never replaces.
- */
-type WebFramework = 'next-app-router' | 'next-pages-router' | 'vite-react' | 'remix' | 'static-html' | 'other-web';
-interface WebFrameworkDetection {
-    readonly framework: WebFramework;
-    /** `src/` when the framework's source root is `src/` (Next.js with src/app, a Vite app), else empty. */
-    readonly sourceDir: '' | 'src/';
-    readonly evidence: readonly string[];
-}
-type PackageManager = 'npm' | 'pnpm' | 'yarn' | 'bun' | 'not-applicable' | 'undetermined';
-type DependencySource = 'package.json' | 'pubspec.yaml';
-type DependencyScope = 'dependencies' | 'devDependencies' | 'peerDependencies' | 'sdk';
-/**
- * `declared` is the range written in the manifest. `installed` is the exact version resolved
- * on disk when the dependency tree is present. Reporting both is the honest answer: a plan
- * built against `^50.0.0` with nothing installed is materially less certain than one built
- * against a resolved 50.0.17, and a reader deserves to see which of the two they are getting.
- */
-interface DetectedDependency {
-    readonly name: string;
-    readonly declared: string | null;
-    readonly installed: string | null;
-    readonly source: DependencySource;
-    readonly scope: DependencyScope;
-}
-interface ProjectDetection {
-    readonly root: string;
-    readonly projectType: ProjectType;
-    /** Human-readable file-level facts that produced `projectType`, in the order they were found. */
-    readonly projectTypeEvidence: readonly string[];
-    readonly packageManager: PackageManager;
-    readonly packageManagerEvidence: readonly string[];
-    readonly dependencies: readonly DetectedDependency[];
-    /** The detected embedding of a `web` project; null for every other shape. Its evidence is in `projectTypeEvidence`. */
-    readonly webEmbedding: WebEmbedding | null;
-    /**
-     * The detected framework of a `web` project; null (or absent, for a detection built by hand) for every
-     * other shape.
-     */
-    readonly webFramework?: WebFrameworkDetection | null;
-    /**
-     * What the project already says about its own look (theme-detect.ts), for the shapes the plan writes a provider
-     * for (web, Expo, bare React Native); null for every other shape, and absent for a detection built by hand.
-     */
-    readonly theme?: ThemeDetection | null;
-    /**
-     * Expo Router, for a React Native project that uses it (expo-router.ts); null when it does not, and absent for a
-     * detection built by hand. It decides where the plan tells the app to mount its Everfur module: Expo Router never
-     * renders App.tsx, and every file under its routes directory is a route.
-     */
-    readonly expoRouter?: ExpoRouterDetection | null;
-    /**
-     * The URL schemes a React Native project declares and the application ids beside them (app-schemes.ts), so the
-     * visit-return step can say whether one of them is a destination Everfur would register (MCP-14). Null for every
-     * other shape, and absent for a detection built by hand.
-     */
-    readonly appSchemes?: AppSchemeDetection | null;
-}
-/** What a React Native project declares about its own URL schemes. */
-interface AppSchemeDetection {
-    /** Every declared scheme, in the order app.json, iOS, Android. */
-    readonly schemes: readonly string[];
-    /** The application ids declared beside them (the iOS bundle identifier, the Android package). */
-    readonly appIds: readonly string[];
-    /** The first declared scheme in reverse-DNS form, which is the only form Everfur registers; null when there is none. */
-    readonly reverseDns: string | null;
-    /** The file and key each scheme was read from. */
-    readonly evidence: readonly string[];
-}
-/** An Expo Router project: its routes directory, and the files that said so. */
-interface ExpoRouterDetection {
-    /** `app`, or `src/app` when the routes live there (Expo Router reads `src/app` when `app` is absent). */
-    readonly appDir: 'app' | 'src/app';
-    readonly evidence: readonly string[];
-}
-
 declare function detectProject(fs: FileSystemPort, root: string): ProjectDetection;
 
 type AttributeValue = string | number | boolean | null | readonly string[];
@@ -2984,7 +3252,7 @@ interface PlanCode {
     /** Suggested path, relative to the project root. */
     readonly path: string;
     /** For syntax highlighting and for an agent deciding how to write it. */
-    readonly language: 'tsx' | 'ts' | 'dart' | 'html' | 'liquid' | 'dotenv';
+    readonly language: 'tsx' | 'ts' | 'dart' | 'html' | 'liquid' | 'dotenv' | 'json' | 'gitignore';
     readonly contents: string;
 }
 
@@ -3046,6 +3314,21 @@ interface MissingFact {
     readonly reason: string;
     /** The exact invocation change that resolves it. */
     readonly supplyWith: string;
+    /**
+     * Present when the fact is needed only for some answers to ANOTHER fact missing from the same refusal (additive to
+     * v1): it is required only when `fact` is one of `oneOf`. It is asked in the same round so a caller can collect every
+     * answer at once, rather than learn of it only after answering the other; given with any other answer, it is unused.
+     */
+    readonly requiredWhen?: MissingFactCondition;
+    /**
+     * Present when only some of the fact's answers resolve this refusal (additive to v1): the identity modes a
+     * capability or the project shape admits, never the one it just refused. A caller offers these and no others.
+     */
+    readonly options?: readonly string[];
+}
+interface MissingFactCondition {
+    readonly fact: MissingFactName;
+    readonly oneOf: readonly string[];
 }
 type PlanPhase = 'install' | 'native' | 'configure' | 'code' | 'verify';
 interface PlanStep {
@@ -3111,6 +3394,18 @@ interface PlanPrinciple {
     readonly statement: string;
     readonly docPath: string | null;
 }
+/**
+ * One item of a ready plan's definition of done (checklist.ts): what must hold when the agent is finished, and the
+ * check that proves it. Derived from the steps, so the same plan always carries the same list. Additive to schema v1.
+ */
+interface PlanChecklistItem {
+    /** Stable within a schemaVersion: a fixed name per kind of requirement. */
+    readonly id: string;
+    readonly requirement: string;
+    readonly verify: string;
+    /** The step ids the item covers; empty for an item about the project as a whole. */
+    readonly steps: readonly string[];
+}
 /** Which decision space produced this plan, so a stale plan can be traced to a stale contract. */
 interface DecisionSpaceProvenance {
     readonly source: string;
@@ -3187,6 +3482,11 @@ interface PlanDocument {
     readonly platformBlock?: PlatformBlock | null;
     /** The principles of every tree this plan consulted. */
     readonly principles: readonly PlanPrinciple[];
+    /**
+     * The definition of done of a READY plan: every item must hold, each proved by its `verify`, before the integration is
+     * reported finished. Absent on a refusal. Additive to schema v1 (optional; absent on documents written before it).
+     */
+    readonly checklist?: readonly PlanChecklistItem[];
     readonly warnings: readonly PlanWarning[];
     /** Null only on the refusal that says no decision space was found. */
     readonly decisionSpace: DecisionSpaceProvenance | null;
@@ -3256,6 +3556,13 @@ interface PlanInput {
      * detection's own (which is absent too for a detection built by hand, and then no theme step is planned).
      */
     readonly theme?: ThemeDetection | null;
+    /**
+     * For a live tenant: true when it has a paired sandbox (the hosted verify then mints on that sandbox), false when it
+     * has none. Absent or null is unknown, which a local plan always is. A live plan's verify is the read-only anonymous
+     * check unless this is true (hosted MCP web integration test, 2026-10-04): the Everfur API mints no verify session on
+     * a live tenant, and OD24 verifies a live tenant with reads only.
+     */
+    readonly tenantPairedSandbox?: boolean | null;
 }
 /**
  * Compute the missing facts in a fixed order: the contract first, because everything else is
@@ -3340,6 +3647,6 @@ declare function parseSuppliedFacts(capabilitiesRaw: string | null, identityRaw:
  * install, and a bundled artifact. `tests/unit/version.test.ts` asserts this constant equals
  * the package.json version, so the two cannot drift.
  */
-declare const CLI_VERSION = "0.2.1";
+declare const CLI_VERSION = "0.4.1";
 
 export { ADMIN_TOKEN, API_PREFIX, type ApiClient, type ApiFailure, type ApiResult, type ApiSuccess, BASE_URL_ENV_VAR, type BlockedCapability, type BlockedOutcome, CLI_VERSION, COMMANDS, CREDENTIAL_SPECS, type Capability, type CapabilityDiagnosis, type ClockPort, type Command, type CommandContext, type CommandOutcome, type ContractValidationOutcome, type Credential, type CredentialSpec, DEFAULT_TIMEOUT_MS, type DecisionSpace, type DecisionSpaceProvenance, type DecisionTree, type DetectedDependency, type DetectedTheme, type Diagnosis, EMPTY_REGISTRY, ERRORS_DOCUMENT_KEY, type ErrorRegistry, type ErrorRegistryEntry, ExitCode, type FileSystemPort, type FormatOptions, type FormattedOutput, type HttpMethod, type HttpRequest, type HttpResponse, IDEMPOTENT_METHODS, type IdentityMode, MISSING_FACT_NAMES, type MissingFact, type MissingFactName, type Outcome, PARTNER_KEY, PARTNER_SECRET_KEY, PLAN_DOCUMENT_KIND, PLAN_SCHEMA_VERSION, type PackageManager, type PlanDocument, type PlanInput, type PlanPrinciple, type PlanStep, type PlanWarning, type PositionalSpec, type ProjectDetection, type ProjectType, REASON_CODES, REDACTED, type ReasonCode, type RegistryLoad, type RequestSpec, type ResolvedCredential, type ResolvedEndpoint, type RunOptions, SCHEMAS, SESSION_TOKEN, type SandboxCreateStatus, type SandboxCreation, type SchemaValidation, type SchemaViolation, type SessionMintLanguage, type StepResult, THEME_TOKEN_ORDER, type TerminalOutcome, type ThemeConfidence, type ThemeDetection, type ThemeEvidence, type ThemeSource, type ThemeToken, TransportError, type TransportPort, type TreeOption, type TreeQuestion, type Verification, type VerifyStep, type WalkResult, apiUrl, buildDecisionSpace, buildDiagnosisDocument, buildExplanationDocument, buildSandboxDocument, buildVerificationDocument, clampTimeout, createApiClient, createMemoryFileSystem, createRecordingClock, describeFailure, detectProject, detectTheme, detectThemeFromText, digestOfProjection, digestsEqual, editDistance, entryFromRow, ephemeralCredential, errorCodeOf, failureDetails, failureOutcome, fetchTransport, formatOutcome, isCorrelatableRequestId, isIdempotent, isKnownReasonCode, loadDecisionSpace, loadErrorRegistry, matchCommand, missingFactsFor, nextActionFor as nextActionForErrorCode, nextActionFor$1 as nextActionForReason, nextActionsFor, nodeFileSystem, parseCapabilities, parseDiagnostics, parseIdentityMode, parseSessionMintLanguage, parseSuppliedFacts, planIntegration, projectSandboxCreate, renderDiagnosis, renderExplanation, renderPlan, renderSandboxCreate, renderVerification, resolveContractPath, resolveCredential, resolveEndpoint, runCli, runVerification, suggestCodes, systemClock, validateContractFile, validateContractPublicEnvelope, validateDiagnosisDocument, validateErrorExplanationDocument, validatePlanDocument, validateSandboxCreateDocument, validateVerificationDocument, verifyDigest, walkSingle, walkTree, withPrefix };