@everfur/cli 0.6.0 → 0.8.0

package/README.md

@@ -99,7 +99,7 @@ the SDK's default opens both in the system browser until you pass your own. Lab
 edits and the signature gallery need the platform flag `partner.records_full_depth_enabled`; while it is off the
 SDK hides them.
 
-**The vet visit runs inside your app.** A plan that mounts `televet` installs `@everfur/sdk@^0.9.0`, a release
+**The vet visit runs inside your app.** A plan that mounts `televet` installs `@everfur/sdk@^0.11.0`, a release
 whose `VetVisitButton`, `useVetVisit().open()` and `openVisit()`, and every vet entry inside chat open the visit in
 the app by default, and writes the two things that default needs: `registerEverfurDaily(...)` once at load, from
 `@everfur/sdk/televet/call` over `@daily-co/react-native-daily-js` (React Native) or from
@@ -112,7 +112,7 @@ manifest and Info.plist edits), and the notifications file opens a tapped visit
 The booking lists vets only for the member's US state and the SDK never reads a device location, so the file's
 `YOUR_USER_US_STATE` reaches the button, the chat and the notifications bridge, and `everfur verify --project-root`
 fails while it is still `null` as shipped. The hosted visit in the system browser or a new tab is the SDK's explicit
-`prefer="redirect"`, which no generated file passes. A plan without `televet` installs the same `@everfur/sdk@^0.9.0`
+`prefer="redirect"`, which no generated file passes. A plan without `televet` installs the same `@everfur/sdk@^0.11.0`
 and none of the call.
 
 <!-- Owner-approved 2026-10-01 (production sandbox plan, PC-1/PC-2): what `test` and the key prefixes mean. -->
@@ -206,7 +206,7 @@ The Everfur MCP server ships with this package (and standalone as `@everfur/mcp`
 your agent's MCP configuration. It is the same block for Claude Code, Cursor and VS Code; only the file it
 goes in differs:
 
-- **Claude Code:** `.mcp.json` at the project root (or `claude mcp add-json everfur '<the everfur entry>'`
+- **Claude Code:** `.mcp.json` at the project root (or `claude mcp add-json --scope user everfur '<the everfur entry>'`
   for your user scope).
 - **Cursor:** `.cursor/mcp.json` in the project (or `~/.cursor/mcp.json` for every project).
 - **VS Code:** `.vscode/mcp.json` in the workspace, which wraps the same `everfur` entry under a `servers`
@@ -219,8 +219,8 @@ goes in differs:
       "command": "npx",
       "args": ["-y", "-p", "@everfur/mcp", "everfur-mcp"],
       "env": {
-        "EVERFUR_API_BASE_URL": "https://api-staging.everfur.com/api/v1",
-        "EVERFUR_PARTNER_KEY": "pk_live_your_sandbox_tenant_key",
+        "EVERFUR_API_BASE_URL": "https://api.everfur.com/api/v1",
+        "EVERFUR_PARTNER_KEY": "pk_test_your_sandbox_tenant_key",
         "EVERFUR_DOCS_KEY": "dk_partner_your_docs_key",
         "EVERFUR_SESSION_TOKEN": "a_short_lived_session_your_backend_minted"
       }
@@ -271,7 +271,7 @@ answer, naming each one:
    `everfur verify` is the fail-closed check of what your tenant actually has.
 2. **How your users sign in**: `partner-user-ref` (your backend mints a session for your own user id),
    `shopify-app-proxy` (a Shopify storefront vouches for the signed-in customer) or `anonymous`.
-3. **Which environment** the generated configuration targets (`staging` or `production`).
+3. **Which environment** the generated configuration targets (`test`, `staging` or `production`).
 4. **The language of the backend that mints sessions**, asked for `partner-user-ref`, because that is
    the one mode where the plan generates a session route for you, and for `events`, because the webhook
    receiver it generates (the server-side copy of every event about your members, for your own handling;

package/dist/{chunk-4WAGFCO2.js → chunk-4Q2SPVPA.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { hostnameOf, listen, close, writeJson, serveStatelessMcp } from './chunk-KIX4GJKB.js';
-import { createHostedTokenVerifier, tokenBucketOf, isAccessTokenShaped, buildServer, MCP_SCOPE, tenantContextOf, sendTestUserRef, hostedVerifyUserRef, REVOKED_AUTHORIZATION_REMEDY, SYNTHETIC_USER_REF_PREFIX } from './chunk-REQLWFQZ.js';
-import { BASE_URL_ENV_VAR, resolveEndpoint, fetchTransport, systemClock, createApiClient, withPrefix, ephemeralCredential, validateContractText, isJsonObject, describeFailure } from './chunk-GDH5F4QE.js';
+import { hostnameOf, listen, close, writeJson, serveStatelessMcp } from './chunk-AEY522A6.js';
+import { createHostedTokenVerifier, tokenBucketOf, isAccessTokenShaped, buildServer, MCP_SCOPE, tenantContextOf, sendTestUserRef, hostedVerifyUserRef, REVOKED_AUTHORIZATION_REMEDY, SYNTHETIC_USER_REF_PREFIX } from './chunk-EDURPYNG.js';
+import { BASE_URL_ENV_VAR, resolveEndpoint, fetchTransport, systemClock, createApiClient, withPrefix, ephemeralCredential, validateContractText, isJsonObject, describeFailure } from './chunk-WPEB2AVZ.js';
 import { createServer } from 'http';
 import { InvalidTokenError, TooManyRequestsError, TemporarilyUnavailableError } from '@modelcontextprotocol/sdk/server/auth/errors.js';
 import { isIP } from 'net';

package/dist/{chunk-KIX4GJKB.js → chunk-AEY522A6.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { buildServer } from './chunk-REQLWFQZ.js';
+import { buildServer } from './chunk-EDURPYNG.js';
 import { createServer } from 'http';
 import { timingSafeEqual } from 'crypto';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';

package/dist/{chunk-REQLWFQZ.js → chunk-EDURPYNG.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { ENVIRONMENTS, ENVELOPE_SHAPE, SURFACES, VERIFY_IDENTITY_MODES, refusal, API_BASE_URL_BY_ENVIRONMENT, fetchContract, NO_CONTRACT_CACHE, systemClock, fetchTransport, describeFailure, loadDecisionSpaceFromContract, uuidFromKey, resolveEndpoint, createApiClient, createContractProvider, nodeContractCache, CLI_VERSION, withPrefix, ephemeralCredential, isJsonObject, REFUSAL_POLICY, error_explanation_v1_schema_default, verification_v1_schema_default, diagnosis_v1_schema_default, plan_v1_schema_default, NEXT_ACTIONS, IDENTITY_QUESTION, IDENTITY_TREE, CAPABILITY_QUESTION, CAPABILITIES_TREE, WEB_EMBEDDING_QUESTION, PLATFORM_TREE, loadDecisionSpace, nodeFileSystem, expandCapabilities, detectThemeFromText, planIntegration, parseOrigin, parseLoaderUrl, isEverfurLoaderHost, EVERFUR_LOADER_HOSTS, resolveCredential, PARTNER_KEY, runVerification, themePropFromSource, normalizeSurfaces, failedResult, buildSupportBundle, chooseWidgetAuth, DIAGNOSTICS_PATH, diagnoseFailure, parseDiagnostics, buildDiagnosisDocument, toolCodeExplanation, resolveOffline, resolveWithoutRegistry, knownCodes, loadErrorRegistryFromContract, loadErrorRegistry, resolveAfterRegistryMiss, TOOL_CODES, registryAlsoIn, buildExplanationDocument, nextActionFor, digestOfProjection, detectProject, BASE_URL_ENV_VAR, checkTenantMode, isWorkspaceRootEvidence, plannableCapabilities, blockedCapabilities, offlineDocument, toolCodeMeaning, SESSION_TOKEN, SESSION_MINT_TREE, BACKEND_LANGUAGE_QUESTION, ALL_CAPABILITIES } from './chunk-GDH5F4QE.js';
+import { ENVIRONMENTS, ENVELOPE_SHAPE, SURFACES, VERIFY_IDENTITY_MODES, refusal, API_BASE_URL_BY_ENVIRONMENT, fetchContract, NO_CONTRACT_CACHE, systemClock, fetchTransport, describeFailure, loadDecisionSpaceFromContract, uuidFromKey, resolveEndpoint, createApiClient, createContractProvider, nodeContractCache, CLI_VERSION, withPrefix, ephemeralCredential, isJsonObject, REFUSAL_POLICY, error_explanation_v1_schema_default, verification_v1_schema_default, diagnosis_v1_schema_default, plan_v1_schema_default, NEXT_ACTIONS, IDENTITY_QUESTION, IDENTITY_TREE, CAPABILITY_QUESTION, CAPABILITIES_TREE, WEB_EMBEDDING_QUESTION, PLATFORM_TREE, loadDecisionSpace, nodeFileSystem, expandCapabilities, detectThemeFromText, planIntegration, parseOrigin, parseLoaderUrl, isEverfurLoaderHost, EVERFUR_LOADER_HOSTS, resolveCredential, PARTNER_KEY, runVerification, themePropFromSource, normalizeSurfaces, failedResult, buildSupportBundle, chooseWidgetAuth, DIAGNOSTICS_PATH, diagnoseFailure, parseDiagnostics, buildDiagnosisDocument, toolCodeExplanation, resolveOffline, resolveWithoutRegistry, knownCodes, loadErrorRegistryFromContract, loadErrorRegistry, resolveAfterRegistryMiss, TOOL_CODES, registryAlsoIn, buildExplanationDocument, nextActionFor, digestOfProjection, detectProject, BASE_URL_ENV_VAR, checkTenantMode, isWorkspaceRootEvidence, plannableCapabilities, blockedCapabilities, offlineDocument, toolCodeMeaning, SESSION_TOKEN, SESSION_MINT_TREE, BACKEND_LANGUAGE_QUESTION, ALL_CAPABILITIES } from './chunk-WPEB2AVZ.js';
 import { z } from 'zod';
 import { McpServer, ResourceTemplate } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
@@ -2336,7 +2336,13 @@ function frameOf(block) {
     const obj = parsed;
     if (typeof obj["token"] === "string") return { kind: "delta", text: obj["token"] };
     if (typeof obj["status"] === "string") return { kind: `status:${obj["status"]}` };
-    if (obj["error"] !== void 0 || typeof obj["code"] === "string") return { kind: "error" };
+    if (obj["error"] !== void 0 || typeof obj["code"] === "string") {
+      return {
+        kind: "error",
+        ...typeof obj["code"] === "string" ? { code: obj["code"] } : {},
+        ...typeof obj["retryable"] === "boolean" ? { retryable: obj["retryable"] } : {}
+      };
+    }
     if (obj["done"] === true) return { kind: "done" };
     if (obj["metadata"] === true) return { kind: "metadata" };
     return { kind: "unknown" };
@@ -2365,7 +2371,7 @@ function petProfileBody(profile) {
   return body;
 }
 function failureFacts(failure) {
-  return failure.kind === "http" ? { status: failure.status, request_id: failure.requestId } : { kind: failure.kind };
+  return failure.kind === "http" ? { status: failure.status, ...failure.code === null ? {} : { code: failure.code }, request_id: failure.requestId } : { kind: failure.kind };
 }
 function isObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -2456,9 +2462,14 @@ async function findPriorTurn(client, auth, message, petRef, conversationTitle) {
     const asked = messages[question]?.["content"];
     if (typeof asked !== "string" || asked.trim() !== message.trim()) continue;
     const reply = messages.slice(question + 1).find((m) => m["role"] === "assistant");
+    const answer = storedAnswer(reply?.["content"]);
     return {
       ok: true,
-      prior: { conversationId, answer: storedAnswer(reply?.["content"]) },
+      prior: {
+        conversationId,
+        answer,
+        unanswered: answer !== null ? null : typeof reply?.["content"] === "string" ? "interrupted" : "pending"
+      },
       emptyConversationId
     };
   }
@@ -2606,6 +2617,12 @@ async function sendTestMessage(args, env, ports = {}, identitySources = {}) {
   if (lookup.ok === false) return lookup.result;
   const scope = { identity: identity.kind, ...petRef === null ? {} : { pet_ref: petRef } };
   if (lookup.prior !== null) {
+    if (lookup.prior.answer === null && lookup.prior.unanswered === "interrupted") {
+      return refusal("PRIOR_TURN_INTERRUPTED", "An earlier call with this idempotency_key already sent this message and no answer was stored for it. Sending again would put the question in twice, so nothing was sent.", {
+        conversation_id: lookup.prior.conversationId,
+        how_to_fix: "To ask again, call with a new idempotency_key: the same key returns this turn instead of sending the message a second time."
+      });
+    }
     if (lookup.prior.answer === null) {
       return refusal("PRIOR_TURN_UNANSWERED", "An earlier call with this idempotency_key already sent this message and no answer was stored for it. Sending again would put the question in twice, so nothing was sent.", {
         conversation_id: lookup.prior.conversationId,
@@ -2677,6 +2694,7 @@ async function sendTestMessage(args, env, ports = {}, identitySources = {}) {
   }
   const histogram = {};
   let answer = "";
+  let streamError = null;
   const blocks = (typeof streamed.value === "string" ? streamed.value : "").split("\n\n");
   blocks.pop();
   for (const block of blocks) {
@@ -2684,10 +2702,12 @@ async function sendTestMessage(args, env, ports = {}, identitySources = {}) {
     if (frame === null) continue;
     histogram[frame.kind] = (histogram[frame.kind] ?? 0) + 1;
     if (frame.text !== void 0) answer += frame.text;
+    if (frame.kind === "error") streamError ??= frame;
   }
   const deltas = histogram["delta"] ?? 0;
+  const completed = (histogram["done"] ?? 0) > 0 && streamError === null;
   const result = {
-    ok: deltas > 0,
+    ok: deltas > 0 && completed,
     livemode: false,
     replayed: false,
     conversation_id: conversationId,
@@ -2697,7 +2717,15 @@ async function sendTestMessage(args, env, ports = {}, identitySources = {}) {
     ...scope,
     ...args.pet_profile === void 0 ? {} : { pet_registered: true }
   };
-  if (deltas > 0) return { isError: false, document: result };
+  if (deltas > 0 && completed) return { isError: false, document: result };
+  if (deltas > 0) {
+    const failed = streamError;
+    return failedResult(result, "STREAM_FAILED", "The stream failed before it completed.", {
+      conversation_id: conversationId,
+      ...failed?.code === void 0 ? {} : { stream_error_code: failed.code },
+      ...failed?.retryable === void 0 ? {} : { stream_error_retryable: failed.retryable }
+    });
+  }
   return failedResult(
     result,
     "EMPTY_STREAM",
@@ -2914,7 +2942,7 @@ function buildServer(context, ports = {}, options = {}) {
       description: hosted ? HOSTED_TOOL_DESCRIPTIONS.sendTestMessage : "Send a REAL message and stream a real veterinary answer, against a SANDBOX tenant only. Refuses unless the entitlement verdict reports livemode false. Returns the answer plus a frame histogram, so a stream that died mid-answer is distinguishable from a short one. Asks with a signed session when one is available, and with pet_profile registers a sandbox pet first so the answer is pet-aware. Calling again with the same idempotency_key reuses that conversation and returns the existing answer instead of sending a second message.",
       inputSchema: {
         message: z.string().min(1).max(4e3).describe("What to ask. A real pet-health question gets a real answer."),
-        idempotency_key: z.string().min(8).describe("Required and explicit. A call with a key and message already sent reuses that conversation and returns its stored answer instead of sending again. This is done by the tool reading the conversation first; the server does not deduplicate sends."),
+        idempotency_key: z.string().min(8).max(128).describe("Required and explicit. A call with a key and message already sent reuses that conversation and returns its stored answer instead of sending again. This is done by the tool reading the conversation first; the server does not deduplicate sends."),
         pet_ref: z.string().min(1).max(128).optional().describe("Optional pet to scope the conversation to. Must already be registered for this identity, unless pet_profile is passed, which registers it."),
         pet_profile: PET_PROFILE_SHAPE.optional().describe("Optional sandbox pet to register for this call's identity before the send (under pet_ref, else a fixed test ref), so the answer is scoped to it. Registered only once the sandbox fence has passed.")
       },

package/dist/{chunk-WDZLDFN3.js → chunk-U4Q4OAVK.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { VERIFY_IDENTITY_MODES, SURFACES, ENVIRONMENTS, BASE_URL_ENV_VAR, MIN_TIMEOUT_MS, MAX_TIMEOUT_MS, DEFAULT_TIMEOUT_MS, ALL_CAPABILITIES, expandCapabilities, errorOutcome, describeFailure, failureDetails, countsAsNotOn, diagnoseVerdict, isJsonObject, succeed, CAPABILITY_QUESTION, CAPABILITIES_TREE, WEB_EMBEDDING_QUESTION, PLATFORM_TREE, loadDecisionSpace, fetchContract, contractUnavailableOutcome, loadDecisionSpaceFromContract, parseEnvironment, checkTenantMode, detectProject, planIntegration, fail, ExitCode, DOCS_KEY, resolveContractPath, validateContractFile, buildSupportBundle, renderSupportBundle, chooseWidgetAuth, DIAGNOSTICS_PATH, diagnoseFailure, parseDiagnostics, buildDiagnosisDocument, PARTNER_KEY, SESSION_TOKEN, resolveCredential, ADMIN_TOKEN, withPrefix, parseOrigin, parseLoaderUrl, parseSurfaces, parseIdentityMode, runVerification, PARTNER_SECRET_KEY, resolveOffline, resolveWithoutRegistry, knownCodes, loadErrorRegistryFromContract, loadErrorRegistry, resolveAfterRegistryMiss, registryAlsoIn, buildExplanationDocument, renderExplanation, alsoInLines, resolveEndpoint, isCorrelatableRequestId, EMPTY_REGISTRY, createApiClient, offlineDocument, renderOffline, IDENTITY_QUESTION, IDENTITY_TREE, BACKEND_LANGUAGE_QUESTION, SESSION_MINT_TREE, CREDENTIAL_SPECS } from './chunk-GDH5F4QE.js';
+import { VERIFY_IDENTITY_MODES, SURFACES, ENVIRONMENTS, BASE_URL_ENV_VAR, MIN_TIMEOUT_MS, MAX_TIMEOUT_MS, DEFAULT_TIMEOUT_MS, ALL_CAPABILITIES, expandCapabilities, errorOutcome, describeFailure, failureDetails, countsAsNotOn, diagnoseVerdict, isJsonObject, succeed, CAPABILITY_QUESTION, CAPABILITIES_TREE, WEB_EMBEDDING_QUESTION, PLATFORM_TREE, loadDecisionSpace, fetchContract, contractUnavailableOutcome, loadDecisionSpaceFromContract, parseEnvironment, checkTenantMode, detectProject, planIntegration, fail, ExitCode, DOCS_KEY, resolveContractPath, validateContractFile, buildSupportBundle, renderSupportBundle, chooseWidgetAuth, DIAGNOSTICS_PATH, diagnoseFailure, parseDiagnostics, buildDiagnosisDocument, PARTNER_KEY, SESSION_TOKEN, resolveCredential, ADMIN_TOKEN, withPrefix, parseOrigin, parseLoaderUrl, parseSurfaces, parseIdentityMode, runVerification, PARTNER_SECRET_KEY, resolveOffline, resolveWithoutRegistry, knownCodes, loadErrorRegistryFromContract, loadErrorRegistry, resolveAfterRegistryMiss, registryAlsoIn, buildExplanationDocument, renderExplanation, alsoInLines, resolveEndpoint, isCorrelatableRequestId, EMPTY_REGISTRY, createApiClient, offlineDocument, renderOffline, IDENTITY_QUESTION, IDENTITY_TREE, BACKEND_LANGUAGE_QUESTION, SESSION_MINT_TREE, CREDENTIAL_SPECS } from './chunk-WPEB2AVZ.js';
 import { isAbsolute, resolve } from 'path';
 
 // src/cli/format.ts

package/dist/{chunk-GDH5F4QE.js → chunk-WPEB2AVZ.js}

@@ -113,13 +113,13 @@ var fetchTransport = Object.freeze({
       if (name === "TimeoutError" || name === "AbortError") {
         throw new TransportError("timeout", `no response within ${request.timeoutMs}ms`);
       }
-      throw new TransportError("network", cause instanceof Error ? cause.message : String(cause));
+      throw new TransportError("network", describeNetworkFailure(cause));
     }
     let body;
     try {
       body = await response.text();
     } catch (cause) {
-      throw new TransportError("network", cause instanceof Error ? cause.message : String(cause));
+      throw new TransportError("network", describeNetworkFailure(cause));
     }
     const headers = {};
     response.headers.forEach((value, key) => {
@@ -128,6 +128,15 @@ var fetchTransport = Object.freeze({
     return Object.freeze({ status: response.status, headers: Object.freeze(headers), body });
   }
 });
+function describeNetworkFailure(cause) {
+  if (!(cause instanceof Error)) return String(cause);
+  const inner = cause.cause;
+  if (inner instanceof Error && inner.message.length > 0 && inner.message !== cause.message) {
+    return `${cause.message} (${inner.message})`;
+  }
+  const code = typeof inner === "object" && inner !== null ? inner.code : void 0;
+  return typeof code === "string" && code.length > 0 ? `${cause.message} (${code})` : cause.message;
+}
 
 // src/time/clock.ts
 var systemClock = Object.freeze({
@@ -231,19 +240,20 @@ function resolveEndpoint(flagValue, env) {
       ]
     };
   }
+  const named = source === "flag" ? "--base-url" : BASE_URL_ENV_VAR;
   let parsed;
   try {
     parsed = new URL(raw);
   } catch {
-    return { ok: false, errors: [`--base-url is not a URL: ${raw}`] };
+    return { ok: false, errors: [`${named} is not a URL: ${raw}`] };
   }
   if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
-    return { ok: false, errors: [`--base-url must be http or https, not ${parsed.protocol}`] };
+    return { ok: false, errors: [`${named} must be http or https, not ${parsed.protocol}`] };
   }
   if (parsed.protocol === "http:" && !LOCAL_HTTP_HOSTS.has(parsed.hostname)) {
     return {
       ok: false,
-      errors: [`--base-url must be https (http only on localhost, 127.0.0.1 or [::1]), not http://${parsed.host}`]
+      errors: [`${named} must be https (http only on localhost, 127.0.0.1 or [::1]), not http://${parsed.host}`]
     };
   }
   const normalised = stripTrailingSlashes(`${parsed.origin}${parsed.pathname}`);
@@ -275,8 +285,12 @@ var PARTNER_KEY = Object.freeze({
 var PARTNER_SECRET_KEY = Object.freeze({
   envVar: "EVERFUR_PARTNER_SECRET_KEY",
   prefix: "sk_partner_",
+  // The session mint accepts both secret families on this one header (EFBackend sessions_router
+  // `_SECRET_KEY_FAMILIES`): the unrestricted sk_partner_ key and the rk_partner_ restricted key the plan
+  // already names. Both prefixes are 11 characters, so one expected length still covers either.
+  alsoAccepts: Object.freeze(["rk_partner_"]),
   length: "sk_partner_".length + 64,
-  summary: "Partner secret key (sk_partner_...). Presented only to the session mint route."
+  summary: "Partner secret key (sk_partner_..., or an rk_partner_... restricted key). Presented only to the session mint route."
 });
 var DOCS_KEY = Object.freeze({
   envVar: "EVERFUR_DOCS_KEY",
@@ -296,6 +310,9 @@ var ADMIN_TOKEN = Object.freeze({
   length: null,
   summary: "Admin bearer token for the /admin routes. Required by `sandbox create`."
 });
+function publishableKeyShapes() {
+  return [...PARTNER_KEY.alsoAccepts ?? [], PARTNER_KEY.prefix].map((prefix) => `${prefix}...`).join(" or ");
+}
 var CREDENTIAL_SPECS = Object.freeze([
   PARTNER_KEY,
   PARTNER_SECRET_KEY,
@@ -4832,7 +4849,7 @@ function sdkInstallSpec() {
   return `${SDK_PACKAGE}@^${SDK_MIN_VERSION}` ;
 }
 var SDK_PACKAGE_PLATFORMS = /* @__PURE__ */ new Set(["expo-managed", "bare-react-native", "web"]);
-var SDK_MIN_VERSION = "0.10.0";
+var SDK_MIN_VERSION = "0.11.0";
 var SDK_WEB_MIN_VERSION = SDK_MIN_VERSION;
 var SDK_TELEVET_MIN_VERSION = SDK_MIN_VERSION;
 function sdkInstallSpecFor(options) {
@@ -4914,7 +4931,7 @@ function televetCallInstallSpecs(options) {
   );
 }
 var TELEVET_WEB_CALL_MODULE = Object.freeze({ name: "@daily-co/daily-js", spec: "^0.91.0" });
-var SDK_CONTRACT_VERSION = "2026-08-01";
+var SDK_CONTRACT_VERSION = "2026-09-19";
 function platformUnsupportedReason(projectType) {
   return `${SDK_PACKAGE} publishes no entry point for a "${projectType}" project: its device entry points import react-native, its web entry point renders with react-dom, and neither resolves inside this project shape. Until the contract names a package or install commands for the shape no plan can be produced for it, and substituting another entry point would produce a bundle that does not build.`;
 }
@@ -5433,8 +5450,8 @@ function booleanAttribute(outcome, key) {
 }
 
 // src/version.ts
-var CLI_VERSION = "0.6.0";
-var CLI_PUBLISHED_VERSION = "0.5.0";
+var CLI_VERSION = "0.8.0";
+var CLI_PUBLISHED_VERSION = "0.7.0";
 
 // src/commands/diagnose/reasons.ts
 var REASON_CODES = Object.freeze([
@@ -13823,8 +13840,8 @@ function planIntegration(input) {
 // src/registry/sdk/client/contract/contract.generated.ts
 var CONTRACT_SOURCE = Object.freeze({
   digestAlgorithm: "sha256",
-  digest: "6863b6fba6f545dab1877fa04badc35737f987d60c7bfbcfa94d09793d25237b",
-  generatedAt: "2026-10-06T14:37:02Z",
+  digest: "860245ebc1d82ec87e76bd5d9eb33d845fddc73ab1998b9e7b67457defe81f48",
+  generatedAt: "2026-10-07T05:52:37Z",
   capabilitySchemaVersion: 1,
   errorSchemaVersion: 1
 });
@@ -13896,6 +13913,7 @@ var CONTRACT_RETRYABILITY = Object.freeze([
   Object.freeze({ wireCode: "records_consent_required", envelope: "http_envelope", httpStatus: 409, retryable: false }),
   Object.freeze({ wireCode: "sandbox_only", envelope: "http_envelope", httpStatus: 403, retryable: false }),
   Object.freeze({ wireCode: "session_required", envelope: "http_envelope", httpStatus: 403, retryable: false }),
+  Object.freeze({ wireCode: "session_revoked", envelope: "http_envelope", httpStatus: 401, retryable: false }),
   Object.freeze({ wireCode: "share_limit_reached", envelope: "http_envelope", httpStatus: 429, retryable: false }),
   Object.freeze({ wireCode: "slow_down", envelope: "oauth_error", httpStatus: 429, retryable: true }),
   Object.freeze({ wireCode: "species_unsupported", envelope: "http_envelope", httpStatus: 422, retryable: false }),
@@ -13907,6 +13925,7 @@ var CONTRACT_RETRYABILITY = Object.freeze([
   Object.freeze({ wireCode: "token_invalid", envelope: "http_envelope", httpStatus: 422, retryable: false }),
   Object.freeze({ wireCode: "unavailable", envelope: "sse_frame", httpStatus: 200, retryable: true }),
   Object.freeze({ wireCode: "unavailable", envelope: "http_envelope", httpStatus: 503, retryable: true }),
+  Object.freeze({ wireCode: "unrestrictedKeyRequired", envelope: "http_envelope", httpStatus: 403, retryable: false }),
   Object.freeze({ wireCode: "unsupported_grant_type", envelope: "oauth_error", httpStatus: 400, retryable: false }),
   Object.freeze({ wireCode: "unsupported_response_type", envelope: "oauth_error", httpStatus: 302, retryable: false }),
   Object.freeze({ wireCode: "verify_mint_rate_limited", envelope: "http_envelope", httpStatus: 429, retryable: true }),
@@ -13947,6 +13966,13 @@ var NORMALIZED_FOLD = Object.freeze({
   authExpired: "authExpired",
   unavailable: "serviceUnavailable",
   session_required: "sessionRequired",
+  // The partner revoked this member's sessions (POST /widget/v1/sessions/revoke, or a member erasure) and
+  // this bearer predates the revocation. It folds to `authExpired`, NOT `authRejected`: the registry says
+  // the SDK's single refresh mints a new session, which works whenever the partner backend still mints one
+  // for this member, so it takes the same 401 -> re-mint -> replay-once path as an expired token. A refused
+  // re-mint, or a second 401 after it, settles `authRejected` and raises `session_expired` as before, so it
+  // cannot spin a refresh loop. A failed revocation check answers 503 `unavailable`, never this code.
+  session_revoked: "authExpired",
   accessDenied: "accessDenied",
   invalidRequest: "sdkUpdateRequired",
   // the session mints (POST /widget/v1/sessions and the identity bridge): a refused credential is the
@@ -13956,6 +13982,10 @@ var NORMALIZED_FOLD = Object.freeze({
   rateLimited: "rateLimited",
   // a restricted key without the route's capability: a 403 that a retry or a fresh token cannot fix
   insufficientCapability: "accessDenied",
+  // POST /widget/v1/sessions/revoke called with a restricted key: only the unrestricted secret key may
+  // revoke, decided on the key's shape alone. A partner_server 403 that no retry or fresh token fixes, so it
+  // folds with `insufficientCapability`. It never reaches a device runtime.
+  unrestrictedKeyRequired: "accessDenied",
   // the partner events server surface (POST/GET /partners/events). Every one is a non-retryable input
   // fault, so each folds to validationFailed; the 413 matches the ValidationException the rest of the API
   // answers for an oversized body. `idempotency_key_reused` is the same client bug as
@@ -14313,12 +14343,12 @@ function userFacingError(code) {
 var MANIFEST_default = {
   sdk: {
     name: "@everfur/sdk",
-    version: "0.10.0"
+    version: "0.11.0"
   },
   files: [
     {
       path: "client/contract/contract.generated.ts",
-      sha256: "9462084408bec0fcd65d3b5f0403655b223135bc5f0994a49c6cf361592275bb"
+      sha256: "7d0a933511698d009787ae98833f9ac4be12f49b4157d710bdff3dac758f4a92"
     },
     {
       path: "client/errors/EverfurError.ts",
@@ -14330,7 +14360,7 @@ var MANIFEST_default = {
     },
     {
       path: "client/errors/contract.ts",
-      sha256: "a8503124b5feffd6c10c2d25af5708bdc24fbc774a7ead26dd1c4594184e7e1f"
+      sha256: "eb68d4729cf54c7d6935096cef1372cbdbfbc34f73b7b5b436302506a5204cc7"
     },
     {
       path: "client/theme/adjustments.ts",
@@ -14766,7 +14796,7 @@ function suggestCodes(query, codes) {
   near.sort((left, right) => left.distance - right.distance || (left.code < right.code ? -1 : 1));
   return Object.freeze([...exact, ...contains.sort(), ...near.map((entry) => entry.code)].slice(0, MAX_SUGGESTIONS));
 }
-var SECRET_LITERAL = /\b(sk_partner_|sk_egress_)[A-Za-z0-9]{16,}/;
+var SECRET_LITERAL = /\b(sk_partner_|rk_partner_|sk_egress_)[A-Za-z0-9]{16,}/;
 var SECRET_ENV_NAME = "EVERFUR_PARTNER_SECRET_KEY";
 var PUBLIC_SECRET_NAME = /\b(NEXT_PUBLIC_|VITE_|EXPO_PUBLIC_)[A-Z0-9_]*SECRET[A-Z0-9_]*/;
 var API_BASE_URL_LINE = /^\s*(?:export\s+)?([A-Z0-9_]*EVERFUR_API_BASE_URL)\s*=\s*["']?([^"'\s#]+)/gm;
@@ -15643,7 +15673,7 @@ function anonymousIdentity(options) {
     return {
       auth: null,
       step: step5("anonymous-identity", title, "SKIP", `no anonymous identity to verify with: ${PARTNER_KEY.envVar} is not set`, null, [
-        `export ${PARTNER_KEY.envVar} with your publishable key (${PARTNER_KEY.prefix}...)`
+        `export ${PARTNER_KEY.envVar} with your publishable key (${publishableKeyShapes()})`
       ])
     };
   }
@@ -16470,6 +16500,8 @@ var REFUSAL_POLICY = Object.freeze({
   CHAT_NOT_GRANTED: { retryable: false, nextAction: "call_diagnose", docsPath: null },
   CONVERSATIONS_UNREADABLE: { retryable: "from_failure", nextAction: "from_failure", docsPath: "everfur://contract/errors" },
   PRIOR_TURN_UNANSWERED: { retryable: true, nextAction: "wait_then_retry", docsPath: null },
+  // the earlier turn's stored reply is the interrupted-stream sentinel: final, so the same key can never succeed
+  PRIOR_TURN_INTERRUPTED: { retryable: false, nextAction: "fix_arguments", docsPath: null },
   CONVERSATION_NOT_CREATED: { retryable: "from_failure", nextAction: "from_failure", docsPath: "everfur://contract/errors" },
   SEND_FAILED: { retryable: "from_failure", nextAction: "from_failure", docsPath: "everfur://contract/errors" },
   DEADLINE_EXCEEDED: { retryable: true, nextAction: "retry", docsPath: null },
@@ -16621,7 +16653,7 @@ function chooseWidgetAuth(env) {
   return {
     ok: false,
     outcome: errorOutcome("credential_missing", "no widget credential is configured", [
-      `export ${PARTNER_KEY.envVar} with your publishable key (${PARTNER_KEY.prefix}...)`,
+      `export ${PARTNER_KEY.envVar} with your publishable key (${publishableKeyShapes()})`,
       `or export ${SESSION_TOKEN.envVar} with an existing session bearer to diagnose the signed path`
     ])
   };
@@ -16926,6 +16958,12 @@ var MEANINGS = Object.freeze({
     meaning: "An earlier call with this idempotency_key already sent the message and no answer was stored for it; sending again would ask the question twice, so nothing was sent.",
     nextAction: "Wait for the earlier answer and call again with the same idempotency_key, or use a new idempotency_key to ask again."
   },
+  PRIOR_TURN_INTERRUPTED: {
+    tools: [SEND],
+    // Copy reused verbatim: PRIOR_TURN_UNANSWERED's meaning and EMPTY_STREAM's remedy sentence.
+    meaning: "An earlier call with this idempotency_key already sent the message and no answer was stored for it; sending again would ask the question twice, so nothing was sent.",
+    nextAction: "To ask again, call with a new idempotency_key: the same key returns this turn instead of sending the message a second time."
+  },
   CONVERSATION_NOT_CREATED: {
     tools: [SEND],
     meaning: "A conversation could not be opened: the create call failed, or returned no conversation_id.",

package/dist/everfur-mcp-hosted.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { loadHostedMcpConfig, startHostedMcpServer } from './chunk-4WAGFCO2.js';
-import './chunk-KIX4GJKB.js';
-import './chunk-REQLWFQZ.js';
-import { CLI_VERSION } from './chunk-GDH5F4QE.js';
+import { loadHostedMcpConfig, startHostedMcpServer } from './chunk-4Q2SPVPA.js';
+import './chunk-AEY522A6.js';
+import './chunk-EDURPYNG.js';
+import { CLI_VERSION } from './chunk-WPEB2AVZ.js';
 
 // src/bin/everfur-mcp-hosted.ts
 async function main() {

package/dist/everfur-mcp-http.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { startRemoteMcpServer, loadRemoteMcpConfig } from './chunk-KIX4GJKB.js';
-import './chunk-REQLWFQZ.js';
-import { CLI_VERSION } from './chunk-GDH5F4QE.js';
+import { startRemoteMcpServer, loadRemoteMcpConfig } from './chunk-AEY522A6.js';
+import './chunk-EDURPYNG.js';
+import { CLI_VERSION } from './chunk-WPEB2AVZ.js';
 
 // src/bin/everfur-mcp-http.ts
 async function main() {

package/dist/everfur-mcp.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { runStdioServer } from './chunk-REQLWFQZ.js';
-import { CLI_VERSION } from './chunk-GDH5F4QE.js';
+import { runStdioServer } from './chunk-EDURPYNG.js';
+import { CLI_VERSION } from './chunk-WPEB2AVZ.js';
 
 // src/bin/everfur-mcp.ts
 if (process.argv.slice(2).includes("--version")) {

package/dist/everfur.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { runCli } from './chunk-WDZLDFN3.js';
-import { ExitCode, systemClock, fetchTransport, CLI_VERSION, nodeFileSystem, nodeContractCache } from './chunk-GDH5F4QE.js';
+import { runCli } from './chunk-U4Q4OAVK.js';
+import { ExitCode, systemClock, fetchTransport, CLI_VERSION, nodeFileSystem, nodeContractCache } from './chunk-WPEB2AVZ.js';
 
 // src/bin/everfur.ts
 async function main() {

package/dist/index.d.ts

@@ -3647,6 +3647,6 @@ declare function parseSuppliedFacts(capabilitiesRaw: string | null, identityRaw:
  * install, and a bundled artifact. `tests/unit/version.test.ts` asserts this constant equals
  * the package.json version, so the two cannot drift.
  */
-declare const CLI_VERSION = "0.6.0";
+declare const CLI_VERSION = "0.8.0";
 
 export { ADMIN_TOKEN, API_PREFIX, type ApiClient, type ApiFailure, type ApiResult, type ApiSuccess, BASE_URL_ENV_VAR, type BlockedCapability, type BlockedOutcome, CLI_VERSION, COMMANDS, CREDENTIAL_SPECS, type Capability, type CapabilityDiagnosis, type ClockPort, type Command, type CommandContext, type CommandOutcome, type ContractValidationOutcome, type Credential, type CredentialSpec, DEFAULT_TIMEOUT_MS, type DecisionSpace, type DecisionSpaceProvenance, type DecisionTree, type DetectedDependency, type DetectedTheme, type Diagnosis, EMPTY_REGISTRY, ERRORS_DOCUMENT_KEY, type ErrorRegistry, type ErrorRegistryEntry, ExitCode, type FileSystemPort, type FormatOptions, type FormattedOutput, type HttpMethod, type HttpRequest, type HttpResponse, IDEMPOTENT_METHODS, type IdentityMode, MISSING_FACT_NAMES, type MissingFact, type MissingFactName, type Outcome, PARTNER_KEY, PARTNER_SECRET_KEY, PLAN_DOCUMENT_KIND, PLAN_SCHEMA_VERSION, type PackageManager, type PlanDocument, type PlanInput, type PlanPrinciple, type PlanStep, type PlanWarning, type PositionalSpec, type ProjectDetection, type ProjectType, REASON_CODES, REDACTED, type ReasonCode, type RegistryLoad, type RequestSpec, type ResolvedCredential, type ResolvedEndpoint, type RunOptions, SCHEMAS, SESSION_TOKEN, type SandboxCreateStatus, type SandboxCreation, type SchemaValidation, type SchemaViolation, type SessionMintLanguage, type StepResult, THEME_TOKEN_ORDER, type TerminalOutcome, type ThemeConfidence, type ThemeDetection, type ThemeEvidence, type ThemeSource, type ThemeToken, TransportError, type TransportPort, type TreeOption, type TreeQuestion, type Verification, type VerifyStep, type WalkResult, apiUrl, buildDecisionSpace, buildDiagnosisDocument, buildExplanationDocument, buildSandboxDocument, buildVerificationDocument, clampTimeout, createApiClient, createMemoryFileSystem, createRecordingClock, describeFailure, detectProject, detectTheme, detectThemeFromText, digestOfProjection, digestsEqual, editDistance, entryFromRow, ephemeralCredential, errorCodeOf, failureDetails, failureOutcome, fetchTransport, formatOutcome, isCorrelatableRequestId, isIdempotent, isKnownReasonCode, loadDecisionSpace, loadErrorRegistry, matchCommand, missingFactsFor, nextActionFor as nextActionForErrorCode, nextActionFor$1 as nextActionForReason, nextActionsFor, nodeFileSystem, parseCapabilities, parseDiagnostics, parseIdentityMode, parseSessionMintLanguage, parseSuppliedFacts, planIntegration, projectSandboxCreate, renderDiagnosis, renderExplanation, renderPlan, renderSandboxCreate, renderVerification, resolveContractPath, resolveCredential, resolveEndpoint, runCli, runVerification, suggestCodes, systemClock, validateContractFile, validateContractPublicEnvelope, validateDiagnosisDocument, validateErrorExplanationDocument, validatePlanDocument, validateSandboxCreateDocument, validateVerificationDocument, verifyDigest, walkSingle, walkTree, withPrefix };

package/dist/index.js

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-export { COMMANDS, buildSandboxDocument, buildVerificationDocument, failureOutcome, formatOutcome, matchCommand, nextActionsFor, parseCapabilities, parseIdentityMode, parseSessionMintLanguage, parseSuppliedFacts, projectSandboxCreate, renderDiagnosis, renderPlan, renderSandboxCreate, renderVerification, runCli } from './chunk-WDZLDFN3.js';
-export { ADMIN_TOKEN, API_PREFIX, BASE_URL_ENV_VAR, CLI_VERSION, CREDENTIAL_SPECS, DEFAULT_TIMEOUT_MS, EMPTY_REGISTRY, ERRORS_DOCUMENT_KEY, ExitCode, IDEMPOTENT_METHODS, MISSING_FACT_NAMES, PARTNER_KEY, PARTNER_SECRET_KEY, PLAN_DOCUMENT_KIND, PLAN_SCHEMA_VERSION, REASON_CODES, REDACTED, SCHEMAS, SESSION_TOKEN, THEME_TOKEN_ORDER, TransportError, apiUrl, buildDecisionSpace, buildDiagnosisDocument, buildExplanationDocument, clampTimeout, createApiClient, createMemoryFileSystem, createRecordingClock, describeFailure, detectProject, detectTheme, detectThemeFromText, digestOfProjection, digestsEqual, editDistance, entryFromRow, ephemeralCredential, errorCodeOf, failureDetails, fetchTransport, isCorrelatableRequestId, isIdempotent, isKnownReasonCode, loadDecisionSpace, loadErrorRegistry, missingFactsFor, nextActionFor2 as nextActionForErrorCode, nextActionFor as nextActionForReason, nodeFileSystem, parseDiagnostics, planIntegration, renderExplanation, resolveContractPath, resolveCredential, resolveEndpoint, runVerification, suggestCodes, systemClock, validateContractFile, validateContractPublicEnvelope, validateDiagnosisDocument, validateErrorExplanationDocument, validatePlanDocument, validateSandboxCreateDocument, validateVerificationDocument, verifyDigest, walkSingle, walkTree, withPrefix } from './chunk-GDH5F4QE.js';
+export { COMMANDS, buildSandboxDocument, buildVerificationDocument, failureOutcome, formatOutcome, matchCommand, nextActionsFor, parseCapabilities, parseIdentityMode, parseSessionMintLanguage, parseSuppliedFacts, projectSandboxCreate, renderDiagnosis, renderPlan, renderSandboxCreate, renderVerification, runCli } from './chunk-U4Q4OAVK.js';
+export { ADMIN_TOKEN, API_PREFIX, BASE_URL_ENV_VAR, CLI_VERSION, CREDENTIAL_SPECS, DEFAULT_TIMEOUT_MS, EMPTY_REGISTRY, ERRORS_DOCUMENT_KEY, ExitCode, IDEMPOTENT_METHODS, MISSING_FACT_NAMES, PARTNER_KEY, PARTNER_SECRET_KEY, PLAN_DOCUMENT_KIND, PLAN_SCHEMA_VERSION, REASON_CODES, REDACTED, SCHEMAS, SESSION_TOKEN, THEME_TOKEN_ORDER, TransportError, apiUrl, buildDecisionSpace, buildDiagnosisDocument, buildExplanationDocument, clampTimeout, createApiClient, createMemoryFileSystem, createRecordingClock, describeFailure, detectProject, detectTheme, detectThemeFromText, digestOfProjection, digestsEqual, editDistance, entryFromRow, ephemeralCredential, errorCodeOf, failureDetails, fetchTransport, isCorrelatableRequestId, isIdempotent, isKnownReasonCode, loadDecisionSpace, loadErrorRegistry, missingFactsFor, nextActionFor2 as nextActionForErrorCode, nextActionFor as nextActionForReason, nodeFileSystem, parseDiagnostics, planIntegration, renderExplanation, resolveContractPath, resolveCredential, resolveEndpoint, runVerification, suggestCodes, systemClock, validateContractFile, validateContractPublicEnvelope, validateDiagnosisDocument, validateErrorExplanationDocument, validatePlanDocument, validateSandboxCreateDocument, validateVerificationDocument, verifyDigest, walkSingle, walkTree, withPrefix } from './chunk-WPEB2AVZ.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everfur/cli",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Everfur CLI: plan, verify, and diagnose an Everfur pet-health integration from the terminal.",
   "license": "MIT",
   "type": "module",