@everfur/cli 0.7.0 → 0.9.0

package/dist/{chunk-DE7AGMJD.js → chunk-OHA3JVME.js}

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
+/*! @everfur/cli. Copyright (c) 2026 Strand Health Inc. dba Everfur. All rights reserved. Use is subject to the Everfur SDK License: https://docs.everfur.com/license */
 import { mkdirSync, writeFileSync, renameSync, readFileSync, readdirSync, statSync } from 'fs';
 import { join, isAbsolute, resolve, dirname, relative, sep } from 'path';
+import { createHash, createHmac } from 'crypto';
 import { parse } from 'yaml';
 import Ajv2020 from 'ajv/dist/2020.js';
 import addFormats from 'ajv-formats';
-import { createHash } from 'crypto';
 import { z } from 'zod';
 
 var NO_CONTRACT_CACHE = Object.freeze({
@@ -113,13 +114,13 @@ var fetchTransport = Object.freeze({
       if (name === "TimeoutError" || name === "AbortError") {
         throw new TransportError("timeout", `no response within ${request.timeoutMs}ms`);
       }
-      throw new TransportError("network", cause instanceof Error ? cause.message : String(cause));
+      throw new TransportError("network", describeNetworkFailure(cause));
     }
     let body;
     try {
       body = await response.text();
     } catch (cause) {
-      throw new TransportError("network", cause instanceof Error ? cause.message : String(cause));
+      throw new TransportError("network", describeNetworkFailure(cause));
     }
     const headers = {};
     response.headers.forEach((value, key) => {
@@ -128,6 +129,15 @@ var fetchTransport = Object.freeze({
     return Object.freeze({ status: response.status, headers: Object.freeze(headers), body });
   }
 });
+function describeNetworkFailure(cause) {
+  if (!(cause instanceof Error)) return String(cause);
+  const inner = cause.cause;
+  if (inner instanceof Error && inner.message.length > 0 && inner.message !== cause.message) {
+    return `${cause.message} (${inner.message})`;
+  }
+  const code = typeof inner === "object" && inner !== null ? inner.code : void 0;
+  return typeof code === "string" && code.length > 0 ? `${cause.message} (${code})` : cause.message;
+}
 
 // src/time/clock.ts
 var systemClock = Object.freeze({
@@ -231,19 +241,20 @@ function resolveEndpoint(flagValue, env) {
       ]
     };
   }
+  const named = source === "flag" ? "--base-url" : BASE_URL_ENV_VAR;
   let parsed;
   try {
     parsed = new URL(raw);
   } catch {
-    return { ok: false, errors: [`--base-url is not a URL: ${raw}`] };
+    return { ok: false, errors: [`${named} is not a URL: ${raw}`] };
   }
   if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
-    return { ok: false, errors: [`--base-url must be http or https, not ${parsed.protocol}`] };
+    return { ok: false, errors: [`${named} must be http or https, not ${parsed.protocol}`] };
   }
   if (parsed.protocol === "http:" && !LOCAL_HTTP_HOSTS.has(parsed.hostname)) {
     return {
       ok: false,
-      errors: [`--base-url must be https (http only on localhost, 127.0.0.1 or [::1]), not http://${parsed.host}`]
+      errors: [`${named} must be https (http only on localhost, 127.0.0.1 or [::1]), not http://${parsed.host}`]
     };
   }
   const normalised = stripTrailingSlashes(`${parsed.origin}${parsed.pathname}`);
@@ -260,8 +271,15 @@ function apiUrl(endpoint, path) {
   const suffix = path.startsWith("/") ? path : `/${path}`;
   return endpoint.prefixIncluded ? `${endpoint.baseUrl}${suffix}` : `${endpoint.baseUrl}${API_PREFIX}${suffix}`;
 }
-
-// src/config/credentials.ts
+var SECRET_KEY_API_HOSTS = /* @__PURE__ */ new Set(["api.everfur.com", "api-staging.everfur.com"]);
+var ALLOW_CUSTOM_API_HOST_ENV_VAR = "EVERFUR_ALLOW_CUSTOM_API_HOST";
+function secretKeyHostProblem(endpoint, env) {
+  if ((env[ALLOW_CUSTOM_API_HOST_ENV_VAR] ?? "").trim() === "1") return null;
+  const url = new URL(endpoint.baseUrl);
+  if (url.protocol === "https:" && SECRET_KEY_API_HOSTS.has(url.hostname)) return null;
+  if (LOCAL_HTTP_HOSTS.has(url.hostname)) return null;
+  return `${BASE_URL_ENV_VAR} names ${url.host}, which is not api.everfur.com, api-staging.everfur.com or this machine, so the secret key is not sent to it. Set ${ALLOW_CUSTOM_API_HOST_ENV_VAR}=1 in the shell only if that host is an Everfur API you trust`;
+}
 var REDACTED = "[redacted]";
 var PARTNER_KEY = Object.freeze({
   envVar: "EVERFUR_PARTNER_KEY",
@@ -275,8 +293,12 @@ var PARTNER_KEY = Object.freeze({
 var PARTNER_SECRET_KEY = Object.freeze({
   envVar: "EVERFUR_PARTNER_SECRET_KEY",
   prefix: "sk_partner_",
+  // The session mint accepts both secret families on this one header (EFBackend sessions_router
+  // `_SECRET_KEY_FAMILIES`): the unrestricted sk_partner_ key and the rk_partner_ restricted key the plan
+  // already names. Both prefixes are 11 characters, so one expected length still covers either.
+  alsoAccepts: Object.freeze(["rk_partner_"]),
   length: "sk_partner_".length + 64,
-  summary: "Partner secret key (sk_partner_...). Presented only to the session mint route."
+  summary: "Partner secret key (sk_partner_..., or an rk_partner_... restricted key). Presented only to the session mint route."
 });
 var DOCS_KEY = Object.freeze({
   envVar: "EVERFUR_DOCS_KEY",
@@ -296,6 +318,21 @@ var ADMIN_TOKEN = Object.freeze({
   length: null,
   summary: "Admin bearer token for the /admin routes. Required by `sandbox create`."
 });
+var WEBHOOK_SIGNING_SECRET = Object.freeze({
+  envVar: "EVERFUR_WEBHOOK_SECRET",
+  prefix: "whsec_",
+  length: null,
+  summary: "A claims webhook endpoint signing secret (whsec_...). Read only to sign test deliveries to your own receiver."
+});
+var CLAIMS_INBOUND_SECRET = Object.freeze({
+  envVar: "EVERFUR_CLAIMS_INBOUND_SECRET",
+  prefix: "whsec_",
+  length: 70,
+  summary: "A claims inbound endpoint shared secret (whsec_...). Read only to sign sandbox sample events."
+});
+function publishableKeyShapes() {
+  return [...PARTNER_KEY.alsoAccepts ?? [], PARTNER_KEY.prefix].map((prefix) => `${prefix}...`).join(" or ");
+}
 var CREDENTIAL_SPECS = Object.freeze([
   PARTNER_KEY,
   PARTNER_SECRET_KEY,
@@ -365,6 +402,12 @@ function resolveCredential(env, spec) {
     matchedPrefix: accepted.find((p) => raw.startsWith(p)) ?? null
   });
 }
+function hmacSha256Hex(credential, message) {
+  return hmacSha256(credential, message).toString("hex");
+}
+function hmacSha256(credential, message) {
+  return createHmac("sha256", Buffer.from(credential.reveal(), "utf8")).update(message).digest();
+}
 
 // src/detect/theme-color.ts
 var NAMED = Object.freeze({ white: "#FFFFFF", black: "#000000" });
@@ -4832,7 +4875,7 @@ function sdkInstallSpec() {
   return `${SDK_PACKAGE}@^${SDK_MIN_VERSION}` ;
 }
 var SDK_PACKAGE_PLATFORMS = /* @__PURE__ */ new Set(["expo-managed", "bare-react-native", "web"]);
-var SDK_MIN_VERSION = "0.11.0";
+var SDK_MIN_VERSION = "0.17.0";
 var SDK_WEB_MIN_VERSION = SDK_MIN_VERSION;
 var SDK_TELEVET_MIN_VERSION = SDK_MIN_VERSION;
 function sdkInstallSpecFor(options) {
@@ -4914,7 +4957,7 @@ function televetCallInstallSpecs(options) {
   );
 }
 var TELEVET_WEB_CALL_MODULE = Object.freeze({ name: "@daily-co/daily-js", spec: "^0.91.0" });
-var SDK_CONTRACT_VERSION = "2026-08-01";
+var SDK_CONTRACT_VERSION = "2026-09-19";
 function platformUnsupportedReason(projectType) {
   return `${SDK_PACKAGE} publishes no entry point for a "${projectType}" project: its device entry points import react-native, its web entry point renders with react-dom, and neither resolves inside this project shape. Until the contract names a package or install commands for the shape no plan can be produced for it, and substituting another entry point would produce a bundle that does not build.`;
 }
@@ -5433,8 +5476,8 @@ function booleanAttribute(outcome, key) {
 }
 
 // src/version.ts
-var CLI_VERSION = "0.7.0";
-var CLI_PUBLISHED_VERSION = "0.5.0";
+var CLI_VERSION = "0.9.0";
+var CLI_PUBLISHED_VERSION = "0.8.0";
 
 // src/commands/diagnose/reasons.ts
 var REASON_CODES = Object.freeze([
@@ -6394,6 +6437,16 @@ var THEME_SLOT_NAMES = Object.freeze([
   //   tab          the tabs and segmented controls
   //   bookingStep  the container of one booking step
   //   dialog       the dialogs and sheets
+  // And since 15 Oct 2026 the Health Plan's cart bar (`cartBar`): the bar that carries the cart count, the subtotal
+  // and the checkout control. Its default fill is the brand colour, so its text is guarded on that.
+  // And the Health Plan's own two (15 Oct 2026), so a shop can differ from every other SDK card and chip:
+  //   planCard         a Health Plan product card (fill, edge, radius, ink). Unset, it follows `card`.
+  //   planReasonLabel  the label of a reason drawn as a row (`reasonVariant: 'rows'`): only its ink is read. Unset,
+  //                    it follows the `chip` ink, then brand ink.
+  // And the plan page's two link washes (22 Oct 2026), so a partner can give his exact tints rather than the mix:
+  //   planWash         the soft link wash (the icon tiles, the tip, the "Add her weight" row): only its fill is read.
+  //   planChip         the stronger link wash of a chip: only its fill is read.
+  //                    Unset, each is the link ink mixed over the card (12% and 20%).
   "header",
   "banner",
   "chip",
@@ -6401,8 +6454,18 @@ var THEME_SLOT_NAMES = Object.freeze([
   "input",
   "tab",
   "bookingStep",
-  "dialog"
+  "dialog",
+  "cartBar",
+  "planCard",
+  "planReasonLabel",
+  "planWash",
+  "planChip"
 ]);
+var THEME_SLOT_KEYS_BY_SLOT = Object.freeze({
+  planReasonLabel: Object.freeze(["textColor"]),
+  planWash: Object.freeze(["backgroundColor"]),
+  planChip: Object.freeze(["backgroundColor"])
+});
 var SLOT_MIN_CONTRAST = 4.5;
 var EMPTY = Object.freeze({});
 function isSlotName(value) {
@@ -6420,13 +6483,22 @@ function parseThemeSlots(json) {
   let any = false;
   for (const [name, raw] of Object.entries(json)) {
     if (!isSlotName(name) || raw === null || typeof raw !== "object") continue;
-    const slot = parseSlot(raw);
+    const parsed = parseSlot(raw);
+    if (parsed === null) continue;
+    const slot = restrictSlotKeys(name, parsed);
     if (slot === null) continue;
     out[name] = slot;
     any = true;
   }
   return any ? Object.freeze(out) : null;
 }
+function restrictSlotKeys(name, slot) {
+  const allowed = THEME_SLOT_KEYS_BY_SLOT[name];
+  if (allowed === void 0) return slot;
+  const out = {};
+  for (const key of allowed) if (slot[key] !== void 0) out[key] = slot[key];
+  return Object.keys(out).length === 0 ? null : Object.freeze(out);
+}
 function pick(raw, snake, camel) {
   return raw[snake] !== void 0 ? raw[snake] : raw[camel];
 }
@@ -6458,7 +6530,9 @@ var DECORATIVE_EDGE_SLOTS = /* @__PURE__ */ new Set([
   "banner",
   "header",
   "dialog",
-  "bookingStep"
+  "bookingStep",
+  "cartBar",
+  "planCard"
 ]);
 function sameColor(a, b) {
   const left = parseColor(a);
@@ -7246,7 +7320,12 @@ function slotGrounds(c) {
     input: [c.surface, c.composerFill, c.surfaceCream, c.surfaceSubtle],
     tab: [c.surface, c.background],
     bookingStep: [c.surface, c.background],
-    dialog: [c.surface]
+    dialog: [c.surface],
+    cartBar: [c.brand],
+    planCard: [c.surface],
+    planReasonLabel: [c.surface],
+    planWash: [c.surface],
+    planChip: [c.surface]
   };
 }
 function slotSurrounds(c) {
@@ -7260,6 +7339,11 @@ function slotSurrounds(c) {
   };
 }
 
+// src/registry/sdk/client/wire/read.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 // src/registry/sdk/client/theme/appearance.ts
 var APPEARANCE_PRESET_NAMES = Object.freeze(["everfur", "minimal", "night"]);
 var APPEARANCE_PRESETS = Object.freeze({
@@ -7272,9 +7356,6 @@ var APPEARANCE_SIZE_RANGES = Object.freeze({
   borderRadius: Object.freeze({ min: 0, max: 32, default: 14 }),
   spacingUnit: Object.freeze({ min: 3, max: 6, default: 4 })
 });
-function isRecord(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function isPreset(value) {
   return typeof value === "string" && APPEARANCE_PRESET_NAMES.includes(value.trim().toLowerCase());
 }
@@ -7363,6 +7444,73 @@ function expandAppearance(appearance) {
   }
   return Object.keys(out).length === 0 ? null : Object.freeze(out);
 }
+var PRESENTATION_WIRE_NAMES = Object.freeze({
+  chatAnswerStyle: "chat_answer_style",
+  chatHistoryStyle: "chat_history_style",
+  chatTopCard: "chat_top_card",
+  chatFollowUpCount: "chat_follow_up_count",
+  chatFollowUpsExcludeTelevet: "chat_follow_ups_exclude_televet",
+  chatComposerMic: "chat_composer_mic",
+  chatComposerUpload: "chat_composer_upload",
+  safetyDisclaimerPlacement: "safety_disclaimer_placement",
+  healthPlanLayout: "health_plan_layout",
+  recordsTopRiskLine: "records_top_risk_line",
+  recordsClearResultsFilter: "records_clear_results_filter",
+  chatComposerStyle: "chat_composer_style",
+  chatComposerPlaceholder: "chat_composer_placeholder",
+  chatHistoryBar: "chat_history_bar",
+  chatGeneralBanner: "chat_general_banner",
+  chatSendButton: "chat_send_button",
+  chatTextingAsk: "chat_texting_ask"
+});
+var FIELDS = Object.keys(PRESENTATION_WIRE_NAMES);
+var PRESENTATION_LOCK = "presentation";
+var PRESENTATION_LOCK_PREFIX = "presentation.";
+function isPresentationLockName(name) {
+  if (name === PRESENTATION_LOCK) return true;
+  if (!name.startsWith(PRESENTATION_LOCK_PREFIX)) return false;
+  const field = name.slice(PRESENTATION_LOCK_PREFIX.length);
+  return Object.values(PRESENTATION_WIRE_NAMES).includes(field);
+}
+var ENUMS = {
+  chatAnswerStyle: ["bubbles", "cards"],
+  chatHistoryStyle: ["drawer", "sheet"],
+  chatTopCard: ["none", "focus"],
+  safetyDisclaimerPlacement: ["composer", "answer_footer"],
+  healthPlanLayout: ["standard", "focus_plan"],
+  chatComposerStyle: ["standard", "compact"],
+  chatComposerPlaceholder: ["generic", "pet_name"],
+  chatHistoryBar: ["pinned", "scroll"],
+  chatSendButton: ["always_dark", "dim_when_empty"]
+};
+var BOOLS = /* @__PURE__ */ new Set([
+  "chatFollowUpsExcludeTelevet",
+  "chatComposerMic",
+  "chatComposerUpload",
+  "recordsTopRiskLine",
+  "recordsClearResultsFilter",
+  "chatGeneralBanner",
+  "chatTextingAsk"
+]);
+function parseField(field, value) {
+  if (value === null || value === void 0) return void 0;
+  const allowed = ENUMS[field];
+  if (allowed !== void 0) return typeof value === "string" && allowed.includes(value) ? value : void 0;
+  if (BOOLS.has(field)) return typeof value === "boolean" ? value : void 0;
+  return typeof value === "number" && Number.isInteger(value) && value >= 0 && value <= 3 ? value : void 0;
+}
+function parsePresentation(raw) {
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const source = raw;
+  const out = {};
+  for (const field of FIELDS) {
+    const wire = PRESENTATION_WIRE_NAMES[field];
+    const value = Object.prototype.hasOwnProperty.call(source, wire) ? source[wire] : source[field];
+    const parsed = parseField(field, value);
+    if (parsed !== void 0) out[field] = parsed;
+  }
+  return Object.keys(out).length === 0 ? null : Object.freeze(out);
+}
 
 // src/registry/sdk/client/theme/fontSources.ts
 var MAX_FONT_SOURCES = 4;
@@ -7399,15 +7547,12 @@ function familyName(value) {
   if (trimmed.length === 0 || trimmed.length > FAMILY_MAX_LENGTH) return null;
   return /[\u0000-\u001F\u007F]/.test(trimmed) ? null : trimmed;
 }
-function isRecord2(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function pick2(raw, ...keys) {
   for (const key of keys) if (raw[key] !== void 0 && raw[key] !== null) return raw[key];
   return void 0;
 }
 function parseFontSource(raw) {
-  if (!isRecord2(raw)) return null;
+  if (!isRecord(raw)) return null;
   const family = familyName(raw["family"]);
   if (family === null) return null;
   const srcRaw = pick2(raw, "src");
@@ -7498,6 +7643,7 @@ function lockedFieldsOf(b) {
 }
 function isThemeLockName(name) {
   if (name === "hide_powered_by" || LOCKABLE_THEME_FIELDS.includes(name)) return true;
+  if (isPresentationLockName(name)) return true;
   return name.startsWith(SLOT_LOCK_PREFIX) && THEME_SLOT_NAMES.includes(name.slice(SLOT_LOCK_PREFIX.length));
 }
 function parseClientBranding(json) {
@@ -7538,6 +7684,7 @@ function parseFlat(raw) {
     slots: parseThemeSlots(pick3(raw, "slots")),
     accessibilityMaxFontScale: parseMaxFontScale(pick3(raw, "accessibility_max_font_scale", "accessibilityMaxFontScale")),
     lockedFields: parseLockedFields(pick3(raw, "locked_fields", "lockedFields")),
+    presentation: parsePresentation(pick3(raw, "presentation")),
     schemaVersion: parseSchemaVersion(pick3(raw, "schema_version", "schemaVersion")),
     backgroundColor: parseColor(pick3(raw, "background_color", "backgroundColor")),
     backgroundColorDark: parseColor(pick3(raw, "background_color_dark", "backgroundColorDark")),
@@ -7633,6 +7780,9 @@ function parseSchemaVersion(value) {
 function toWireName(name) {
   const trimmed = name.trim();
   if (trimmed.startsWith(SLOT_LOCK_PREFIX)) return trimmed;
+  if (trimmed.startsWith(PRESENTATION_LOCK_PREFIX)) {
+    return PRESENTATION_LOCK_PREFIX + trimmed.slice(PRESENTATION_LOCK_PREFIX.length).replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase();
+  }
   return trimmed.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase();
 }
 function parseLockedFields(value) {
@@ -12844,7 +12994,7 @@ var FRAME_CHAT_VET_NOTE = " A frame takes no onFindVet or onVetPrep: functions d
 var RECORDS_DEPTH_SENTENCE = " Lab markers, share links, the record PDF link, fact edits and the signature gallery need the platform flag partner.records_full_depth_enabled; while it is off for your tenant the SDK hides them, so their absence is not a defect in your integration.";
 var RECORDS_SURFACE_NOTE = Object.freeze({
   native: ` EverfurRecords is the app's records flow: it opens on the pet's dashboard and owns its own stack (the hardware back key pops it on React Native), every screen is also exported by name for your own navigator (the mount-records-screens step names them), and initialScreen={{ name: 'request', requestId }} opens a request directly. The mount passes petName={selectedPet.name} for headings such as "{petName}'s lab trends".` + RECORDS_DEPTH_SENTENCE,
-  web: ` The mount is ${WEB_RECORDS_SURFACE}, written into the file: it renders EverfurRecordsPage, the SDK's page-shaped root ported from Everfur's own web records page (one scrolling document with the pet's requests), and opens what the page links to (the full record with its vaccinations, the timeline, and an upload on an empty page) in the records flow EverfurRecords in the same place, whose back from its first screen returns to the page, so moving between them stays in place and adds no route to your app. The share link and the record PDF still open in a new tab, the SDK's web default, until the SDK changes it. The page holds no clinic request of its own: a plan that also asks for records-clinic mounts that surface beside it. When the flow sends a clinic request (one clinic or a batch), or the member opens their records from a published request, it lands on its own dashboard, whose back returns to the page. The mount passes petName={selectedPet.name} for headings such as "{petName}'s lab trends".` + RECORDS_DEPTH_SENTENCE
+  web: ` The mount is ${WEB_RECORDS_SURFACE}, written into the file: it renders EverfurRecordsPage, the SDK's page-shaped root ported from Everfur's own web records page (one scrolling document with the pet's requests), and opens what the page links to (the full record with its vaccinations, the timeline, and an upload on an empty page) in the records flow EverfurRecords in the same place, whose back from its first screen returns to the page, so moving between them stays in place and adds no route to your app. The share link and the record PDF still open in a new tab, the SDK's web default, until the SDK changes it. The page also opens its clinic-request flow with consent and signature. A plan that also asks for records-clinic mounts its dedicated request surface beside the page. When the flow sends a clinic request (one clinic or a batch), or the member opens their records from a published request, it lands on its own dashboard, whose back returns to the page. The mount passes petName={selectedPet.name} for headings such as "{petName}'s lab trends".` + RECORDS_DEPTH_SENTENCE
 });
 function recordsScreensStep(surface) {
   const web = surface === "web";
@@ -13823,8 +13973,8 @@ function planIntegration(input) {
 // src/registry/sdk/client/contract/contract.generated.ts
 var CONTRACT_SOURCE = Object.freeze({
   digestAlgorithm: "sha256",
-  digest: "860245ebc1d82ec87e76bd5d9eb33d845fddc73ab1998b9e7b67457defe81f48",
-  generatedAt: "2026-10-07T05:52:37Z",
+  digest: "f2c258aa21d5f24e8b1056db2114c3b4e5317c82119d86022fde295b059b4bfe",
+  generatedAt: "2026-10-31T06:47:06Z",
   capabilitySchemaVersion: 1,
   errorSchemaVersion: 1
 });
@@ -13851,6 +14001,8 @@ var CONTRACT_RETRYABILITY = Object.freeze([
   Object.freeze({ wireCode: "attachment_unreadable", envelope: "http_envelope", httpStatus: 400, retryable: false }),
   Object.freeze({ wireCode: "authExpired", envelope: "http_envelope", httpStatus: 401, retryable: true }),
   Object.freeze({ wireCode: "authRejected", envelope: "http_envelope", httpStatus: 401, retryable: false }),
+  Object.freeze({ wireCode: "catalog_empty_refused", envelope: "http_envelope", httpStatus: 409, retryable: false }),
+  Object.freeze({ wireCode: "catalog_shrink_refused", envelope: "http_envelope", httpStatus: 409, retryable: false }),
   Object.freeze({ wireCode: "consent_invalid", envelope: "http_envelope", httpStatus: 422, retryable: false }),
   Object.freeze({ wireCode: "consent_required", envelope: "http_envelope", httpStatus: 422, retryable: false }),
   Object.freeze({ wireCode: "consent_scope_wrong_route", envelope: "http_envelope", httpStatus: 400, retryable: false }),
@@ -13875,6 +14027,7 @@ var CONTRACT_RETRYABILITY = Object.freeze([
   Object.freeze({ wireCode: "invalid_request", envelope: "oauth_error", httpStatus: 400, retryable: false }),
   Object.freeze({ wireCode: "invalid_scope", envelope: "oauth_error", httpStatus: 400, retryable: false }),
   Object.freeze({ wireCode: "invalid_target", envelope: "oauth_error", httpStatus: 400, retryable: false }),
+  Object.freeze({ wireCode: "linked_account_read_only", envelope: "http_envelope", httpStatus: 409, retryable: false }),
   Object.freeze({ wireCode: "mcp_connection_not_found", envelope: "http_envelope", httpStatus: 404, retryable: false }),
   Object.freeze({ wireCode: "mcp_request_conflict", envelope: "http_envelope", httpStatus: 409, retryable: false }),
   Object.freeze({ wireCode: "mcp_request_gone", envelope: "http_envelope", httpStatus: 410, retryable: false }),
@@ -13911,6 +14064,7 @@ var CONTRACT_RETRYABILITY = Object.freeze([
   Object.freeze({ wireCode: "unrestrictedKeyRequired", envelope: "http_envelope", httpStatus: 403, retryable: false }),
   Object.freeze({ wireCode: "unsupported_grant_type", envelope: "oauth_error", httpStatus: 400, retryable: false }),
   Object.freeze({ wireCode: "unsupported_response_type", envelope: "oauth_error", httpStatus: 302, retryable: false }),
+  Object.freeze({ wireCode: "user_ref_invalid", envelope: "http_envelope", httpStatus: 400, retryable: false }),
   Object.freeze({ wireCode: "verify_mint_rate_limited", envelope: "http_envelope", httpStatus: 429, retryable: true }),
   Object.freeze({ wireCode: "verify_mint_refused", envelope: "http_envelope", httpStatus: 403, retryable: false }),
   Object.freeze({ wireCode: "verify_mint_unavailable", envelope: "http_envelope", httpStatus: 503, retryable: true }),
@@ -13969,6 +14123,9 @@ var NORMALIZED_FOLD = Object.freeze({
   // revoke, decided on the key's shape alone. A partner_server 403 that no retry or fresh token fixes, so it
   // folds with `insufficientCapability`. It never reaches a device runtime.
   unrestrictedKeyRequired: "accessDenied",
+  // the session mint and revoke reject a malformed user_ref (a partner_server 400 checked before any
+  // credential work). Fixing the user_ref is the only cure, so it is a non-retryable input fault.
+  user_ref_invalid: "validationFailed",
   // the partner events server surface (POST/GET /partners/events). Every one is a non-retryable input
   // fault, so each folds to validationFailed; the 413 matches the ValidationException the rest of the API
   // answers for an oversized body. `idempotency_key_reused` is the same client bug as
@@ -14158,7 +14315,18 @@ var NORMALIZED_FOLD = Object.freeze({
   //    `already_mapped`, so a client that timed out learns the pet id instead of a conflict.
   partner_visit_owner_only: "accessDenied",
   partner_visit_link_conflict: "conflict",
-  partner_visit_pet_already_mapped: "conflict"
+  partner_visit_pet_already_mapped: "conflict",
+  // The 409 a write gets when the member's Everfur account is linked to this partner read-only. On the wire it
+  // is `ConflictException` with this token as `reason_code`, and `isLinkedAccountReadOnly` already keeps it on
+  // `conflict` (an `accessDenied` would read as a consent or plan gate), so the registered code folds the same.
+  linked_account_read_only: "conflict",
+  // The partner catalog replace's two guards (PUT /partners/catalog/products), read off `reason_code` on a
+  // `ConflictException` 409: an empty list, or one that would deactivate most of the active products, sent
+  // without `confirm_empty` or `confirm_shrink`. NOTHING is written. They fold with the envelope's
+  // ConflictException, the reading `src/server/catalog.ts` (CATALOG_REASONS) already gives them, and that table
+  // keeps both non-retryable. Server to server only; neither reaches a device runtime.
+  catalog_empty_refused: "conflict",
+  catalog_shrink_refused: "conflict"
 });
 var CONTRACT_ERROR_ROWS = Object.freeze(
   CONTRACT_RETRYABILITY.map(
@@ -14326,16 +14494,16 @@ function userFacingError(code) {
 var MANIFEST_default = {
   sdk: {
     name: "@everfur/sdk",
-    version: "0.11.0"
+    version: "0.17.0"
   },
   files: [
     {
       path: "client/contract/contract.generated.ts",
-      sha256: "7d0a933511698d009787ae98833f9ac4be12f49b4157d710bdff3dac758f4a92"
+      sha256: "dbfc4cc268c85c1c6177a4772a08cadd75c551f22dfe995f48b9ebdcc0df3731"
     },
     {
       path: "client/errors/EverfurError.ts",
-      sha256: "3465877ba734750fd8985d9c8c02ab3d1188f9dd19a9e1c3ecf8cc86d6ac5806"
+      sha256: "82c84b6152adb24ec0c78fac93579e16e1e24d3584aa38a6f5b5e6ca2699e382"
     },
     {
       path: "client/errors/codes.ts",
@@ -14343,7 +14511,7 @@ var MANIFEST_default = {
     },
     {
       path: "client/errors/contract.ts",
-      sha256: "eb68d4729cf54c7d6935096cef1372cbdbfbc34f73b7b5b436302506a5204cc7"
+      sha256: "b7aa7fed5f456a9a299f99ff49bdc594e83581e2bdf7b3ee4f683fdcb2ab7ba9"
     },
     {
       path: "client/theme/adjustments.ts",
@@ -14351,11 +14519,11 @@ var MANIFEST_default = {
     },
     {
       path: "client/theme/appearance.ts",
-      sha256: "fe9db62840ed13a43cb51066b19220d4552e8b2c51f117c8c62d093cfa677009"
+      sha256: "1e045809a1944ae09d98f614a3d6eab43bb8db463589f4f1cef5aa3fd281cc08"
     },
     {
       path: "client/theme/branding.ts",
-      sha256: "15d9c3c725e7daf08ad6209101346381698b4dc85257c92a46b08a9ff77ea49b"
+      sha256: "bd886ecce5ea14d3f00815a972af7691120e72d383af542e3d4050fa17e46da8"
     },
     {
       path: "client/theme/color.ts",
@@ -14367,7 +14535,7 @@ var MANIFEST_default = {
     },
     {
       path: "client/theme/fontSources.ts",
-      sha256: "69bbe37f7ef1d51f00b988af67b0b0e17baa84e87d32a405e931e0a8028ac54b"
+      sha256: "c734b1ec50b8615653b7d027534a264e11defe2892397c41bcf88285e6a3a699"
     },
     {
       path: "client/theme/globals.ts",
@@ -14381,21 +14549,29 @@ var MANIFEST_default = {
       path: "client/theme/input.ts",
       sha256: "cc601aed813c6f5ae61822ee18cd717f0b9fa1fba5b743d63c6edfec0f0bc2e2"
     },
+    {
+      path: "client/theme/presentation.ts",
+      sha256: "af152d2acce2383e7382061d2bc6b2d10c3c04df8348fc462636cb72445882e0"
+    },
     {
       path: "client/theme/resolve.ts",
       sha256: "cad427919d7371f8f9ea7cc32b98ff9dd9454a9123bc73d345bfaf80952c9cae"
     },
     {
       path: "client/theme/slotGrounds.ts",
-      sha256: "c40192ff1793d44e9967892565827b27f8800dffab9d9a77b9c27e7399fc0a61"
+      sha256: "a80402d0c572e1ca5fc77f378b171bbd53fa7c37127b6693d1ab0d6b660c3df2"
     },
     {
       path: "client/theme/slots.ts",
-      sha256: "47105b734b77269949db05d8014f3b0eb2a2171958343866adb5421615d86cd9"
+      sha256: "64c108b2751ac28b48a7b837b25271a28058e93be32ee241b397c0f7df6b5d84"
     },
     {
       path: "client/theme/tokens.ts",
       sha256: "f9446c1cb689ea0af89c3289f7c8efa8330ca21a8710cdd8affa4fb1cc4ffd8e"
+    },
+    {
+      path: "client/wire/read.ts",
+      sha256: "fd03f0123d2ee1bf1ede61d5a114efd6dfe68b44b9329796ba17e2717174eb11"
     }
   ]
 };
@@ -14779,7 +14955,7 @@ function suggestCodes(query, codes) {
   near.sort((left, right) => left.distance - right.distance || (left.code < right.code ? -1 : 1));
   return Object.freeze([...exact, ...contains.sort(), ...near.map((entry) => entry.code)].slice(0, MAX_SUGGESTIONS));
 }
-var SECRET_LITERAL = /\b(sk_partner_|sk_egress_)[A-Za-z0-9]{16,}/;
+var SECRET_LITERAL = /\b(sk_partner_|rk_partner_|sk_egress_)[A-Za-z0-9]{16,}/;
 var SECRET_ENV_NAME = "EVERFUR_PARTNER_SECRET_KEY";
 var PUBLIC_SECRET_NAME = /\b(NEXT_PUBLIC_|VITE_|EXPO_PUBLIC_)[A-Z0-9_]*SECRET[A-Z0-9_]*/;
 var API_BASE_URL_LINE = /^\s*(?:export\s+)?([A-Z0-9_]*EVERFUR_API_BASE_URL)\s*=\s*["']?([^"'\s#]+)/gm;
@@ -15656,7 +15832,7 @@ function anonymousIdentity(options) {
     return {
       auth: null,
       step: step5("anonymous-identity", title, "SKIP", `no anonymous identity to verify with: ${PARTNER_KEY.envVar} is not set`, null, [
-        `export ${PARTNER_KEY.envVar} with your publishable key (${PARTNER_KEY.prefix}...)`
+        `export ${PARTNER_KEY.envVar} with your publishable key (${publishableKeyShapes()})`
       ])
     };
   }
@@ -16483,6 +16659,8 @@ var REFUSAL_POLICY = Object.freeze({
   CHAT_NOT_GRANTED: { retryable: false, nextAction: "call_diagnose", docsPath: null },
   CONVERSATIONS_UNREADABLE: { retryable: "from_failure", nextAction: "from_failure", docsPath: "everfur://contract/errors" },
   PRIOR_TURN_UNANSWERED: { retryable: true, nextAction: "wait_then_retry", docsPath: null },
+  // the earlier turn's stored reply is the interrupted-stream sentinel: final, so the same key can never succeed
+  PRIOR_TURN_INTERRUPTED: { retryable: false, nextAction: "fix_arguments", docsPath: null },
   CONVERSATION_NOT_CREATED: { retryable: "from_failure", nextAction: "from_failure", docsPath: "everfur://contract/errors" },
   SEND_FAILED: { retryable: "from_failure", nextAction: "from_failure", docsPath: "everfur://contract/errors" },
   DEADLINE_EXCEEDED: { retryable: true, nextAction: "retry", docsPath: null },
@@ -16497,6 +16675,43 @@ var REFUSAL_POLICY = Object.freeze({
   // hosted only: the connected tenant has no publishable key, or one of a shape no deployment issues. Its keys are
   // Everfur's to issue and nothing a developer exports reaches them, so the refusal is reported, never "fixed" locally
   TENANT_PUBLISHABLE_KEY_UNUSABLE: { retryable: false, nextAction: "report_to_developer", docsPath: null },
+  // the claims tools (claims-tools.ts). The sandbox tool reads the sandbox tenant's secret key from a local shell
+  // only; the sandbox routes refuse a live key (sandbox_key_required) and answer 404 while switched off for the tenant
+  CLAIMS_SERVER_KEY_UNAVAILABLE: { retryable: false, nextAction: "fix_environment", docsPath: null },
+  CLAIMS_SERVER_KEY_MALFORMED: { retryable: false, nextAction: "fix_environment", docsPath: null },
+  CLAIMS_SANDBOX_KEY_REQUIRED: { retryable: false, nextAction: "use_sandbox_tenant", docsPath: null },
+  CLAIMS_SANDBOX_NOT_ENABLED: { retryable: false, nextAction: "report_to_developer", docsPath: null },
+  CLAIMS_SANDBOX_CALL_FAILED: { retryable: "from_failure", nextAction: "from_failure", docsPath: null },
+  CLAIMS_ARGUMENTS_INVALID: { retryable: false, nextAction: "fix_arguments", docsPath: null },
+  // everfur_verify_claims_receiver: the URL is not localhost or public https, the signing secret is not usable, or
+  // the receiver failed a check (each failed check carries its own fix)
+  CLAIMS_RECEIVER_URL_REFUSED: { retryable: false, nextAction: "fix_arguments", docsPath: null },
+  CLAIMS_WEBHOOK_SECRET_UNUSABLE: { retryable: false, nextAction: "fix_environment", docsPath: null },
+  CLAIMS_RECEIVER_CHECKS_FAILED: { retryable: false, nextAction: "report_to_developer", docsPath: null },
+  // the sandbox and verify claims tools on the Everfur-hosted server, which holds no local key or signing secret
+  CLAIMS_TOOL_NOT_HOSTED: { retryable: false, nextAction: "report_to_developer", docsPath: null },
+  // the inbound claims tools (claims-inbound-tools.ts): a mapping the checks refuse, an activation no person
+  // confirmed, the inbound secret or URL not usable here, and samples that did not apply
+  CLAIMS_MAPPING_INVALID: { retryable: false, nextAction: "fix_arguments", docsPath: null },
+  CLAIMS_MAPPING_CONFIRMATION_REQUIRED: { retryable: false, nextAction: "report_to_developer", docsPath: null },
+  // activate_draft with no draft saved (the active mapping, if any, is named): a person saves and confirms a new one
+  CLAIMS_MAPPING_DRAFT_MISSING: { retryable: false, nextAction: "report_to_developer", docsPath: null },
+  CLAIMS_INBOUND_SECRET_UNUSABLE: { retryable: false, nextAction: "fix_environment", docsPath: null },
+  CLAIMS_INBOUND_URL_UNUSABLE: { retryable: false, nextAction: "fix_environment", docsPath: null },
+  CLAIMS_INBOUND_SAMPLES_FAILED: { retryable: false, nextAction: "report_to_developer", docsPath: null },
+  // create_endpoint: no person confirmed the one-time create, the tenant already has its endpoint, or the endpoint
+  // was created and its URL or secret (shown once) could not be written to the env file
+  CLAIMS_INBOUND_CREATE_CONFIRMATION_REQUIRED: { retryable: false, nextAction: "report_to_developer", docsPath: null },
+  CLAIMS_INBOUND_ENDPOINT_EXISTS: { retryable: false, nextAction: "report_to_developer", docsPath: null },
+  CLAIMS_INBOUND_CREDENTIALS_NOT_WRITTEN: { retryable: false, nextAction: "report_to_developer", docsPath: null },
+  // the one-time and replacing sandbox actions: no person has confirmed yet (a local code was written, or none could
+  // be), or the person declined when the client asked them
+  CLAIMS_HUMAN_CONFIRMATION_REQUIRED: { retryable: false, nextAction: "report_to_developer", docsPath: null },
+  CLAIMS_HUMAN_DECLINED: { retryable: false, nextAction: "report_to_developer", docsPath: null },
+  // the sandbox claims tools: EVERFUR_API_BASE_URL names a host the secret key is not sent to
+  CLAIMS_API_HOST_NOT_ALLOWED: { retryable: false, nextAction: "fix_environment", docsPath: null },
+  // everfur_explain_claims_error
+  UNKNOWN_CLAIMS_ERROR_CODE: { retryable: false, nextAction: "fix_arguments", docsPath: null },
   // any tool: a body threw instead of returning a document
   INTERNAL_ERROR: { retryable: false, nextAction: "report_to_developer", docsPath: null }
 });
@@ -16634,7 +16849,7 @@ function chooseWidgetAuth(env) {
   return {
     ok: false,
     outcome: errorOutcome("credential_missing", "no widget credential is configured", [
-      `export ${PARTNER_KEY.envVar} with your publishable key (${PARTNER_KEY.prefix}...)`,
+      `export ${PARTNER_KEY.envVar} with your publishable key (${publishableKeyShapes()})`,
       `or export ${SESSION_TOKEN.envVar} with an existing session bearer to diagnose the signed path`
     ])
   };
@@ -16742,6 +16957,15 @@ var DIAGNOSE = "everfur_diagnose";
 var EXPLAIN = "everfur_explain_error";
 var SEND = "everfur_send_test_message";
 var SEARCH = "everfur_search_docs";
+var CLAIMS_PLAN = "everfur_plan_claims_integration";
+var CLAIMS_SANDBOX = "everfur_send_claims_test_events";
+var CLAIMS_VERIFY = "everfur_verify_claims_receiver";
+var CLAIMS_EXPLAIN = "everfur_explain_claims_error";
+var CLAIMS_PROPOSE = "everfur_propose_claims_mapping";
+var CLAIMS_SAVE = "everfur_save_claims_mapping";
+var CLAIMS_SETUP = "everfur_claims_inbound_signing_setup";
+var CLAIMS_SAMPLES = "everfur_send_claims_inbound_samples";
+var CLAIMS_INBOUND = [CLAIMS_SAVE, CLAIMS_SETUP, CLAIMS_SAMPLES];
 var TENANT_READS = [
   "everfur_get_tenant_status",
   "everfur_list_webhook_endpoints",
@@ -16762,12 +16986,12 @@ var MEANINGS = Object.freeze({
     nextAction: "Ask the developer each fact in error.details.missing_facts, then call everfur_plan_integration again with the same arguments plus those answers. Do not guess them."
   },
   PROJECT_SOURCE_REQUIRED: {
-    tools: [PLAN],
+    tools: [PLAN, CLAIMS_PLAN],
     meaning: "Neither project_root nor project_details was passed, so there was no project to plan for.",
     nextAction: "Call again with project_details (the dependencies, package manager and file-presence markers) on a remote or hosted server, or project_root on a server that runs beside the project."
   },
   PROJECT_SOURCE_AMBIGUOUS: {
-    tools: [PLAN],
+    tools: [PLAN, CLAIMS_PLAN],
     meaning: "Both project_root and project_details were passed, and the plan takes exactly one project source.",
     nextAction: "Call again with one of them: project_root on a server beside the project, project_details on a remote one."
   },
@@ -16792,23 +17016,23 @@ var MEANINGS = Object.freeze({
     nextAction: "Ask the developer which was meant: omit environment to plan for the connected tenant's own mode, or connect with a tenant of the mode the environment needs. On a local server, pass the environment of the key's tenant, or set EVERFUR_PARTNER_KEY to the key of the tenant meant."
   },
   UNKNOWN_PLAN_STEP: {
-    tools: [PLAN],
+    tools: [PLAN, CLAIMS_PLAN],
     meaning: "A step id in steps is not a step of this plan. error.details.unknown lists the ids that are not, and error.details.steps every id the plan has.",
     nextAction: "Call again with the same arguments and plan_id, and steps taken from error.details.steps."
   },
   UNKNOWN_PLAN_PAGE: {
-    tools: [PLAN],
+    tools: [PLAN, CLAIMS_PLAN],
     meaning: "The page asked for is not a page of this plan, or page and steps were both given. error.details.pages is how many pages the plan has.",
     nextAction: "Call again with the same arguments and plan_id, and page from 1 to error.details.pages, or with steps and no page."
   },
   PLAN_CHANGED: {
-    tools: [PLAN],
+    tools: [PLAN, CLAIMS_PLAN],
     meaning: "The plan_id passed is not the plan these arguments produce now: the arguments differ from the call that returned it, the project changed in a way that changes a step (a command run or a file written from the plan can), or the contract changed. error.details carries both ids.",
     nextAction: "Call again with the same arguments and without plan_id, page and steps for the summary of the current plan, then fetch its pages with the plan_id it returns."
   },
   // shared wire configuration
   WIRE_NOT_CONFIGURED: {
-    tools: [PLAN, VERIFY, DIAGNOSE, EXPLAIN, SEND, SEARCH],
+    tools: [PLAN, VERIFY, DIAGNOSE, EXPLAIN, SEND, SEARCH, CLAIMS_SANDBOX],
     meaning: "The server could not set up its connection to the Everfur API: the API base URL is missing or not usable. error.details names what is wrong.",
     nextAction: "Fix the server's environment as error.details says (EVERFUR_API_BASE_URL on a server you run), then call again."
   },
@@ -16939,6 +17163,12 @@ var MEANINGS = Object.freeze({
     meaning: "An earlier call with this idempotency_key already sent the message and no answer was stored for it; sending again would ask the question twice, so nothing was sent.",
     nextAction: "Wait for the earlier answer and call again with the same idempotency_key, or use a new idempotency_key to ask again."
   },
+  PRIOR_TURN_INTERRUPTED: {
+    tools: [SEND],
+    // Copy reused verbatim: PRIOR_TURN_UNANSWERED's meaning and EMPTY_STREAM's remedy sentence.
+    meaning: "An earlier call with this idempotency_key already sent the message and no answer was stored for it; sending again would ask the question twice, so nothing was sent.",
+    nextAction: "To ask again, call with a new idempotency_key: the same key returns this turn instead of sending the message a second time."
+  },
   CONVERSATION_NOT_CREATED: {
     tools: [SEND],
     meaning: "A conversation could not be opened: the create call failed, or returned no conversation_id.",
@@ -16985,6 +17215,122 @@ var MEANINGS = Object.freeze({
     meaning: "On the Everfur-hosted server: the connected tenant has no active publishable key, or one of a shape no deployment issues, so the call was not made. Everfur issues the tenant's keys; nothing the developer exports reaches them.",
     nextAction: "Tell the developer what error.details.how_to_fix says."
   },
+  // the claims tools (claims-tools.ts)
+  CLAIMS_SERVER_KEY_UNAVAILABLE: {
+    tools: [CLAIMS_SANDBOX, ...CLAIMS_INBOUND],
+    meaning: "The sandbox tenant's secret key is not set in the environment of the local shell this server runs from, so no sandbox route was called.",
+    nextAction: "Tell the developer the sandbox tool needs the sandbox tenant's secret key exported from a local shell only, never in a committed MCP configuration."
+  },
+  CLAIMS_SERVER_KEY_MALFORMED: {
+    tools: [CLAIMS_SANDBOX, ...CLAIMS_INBOUND],
+    meaning: "The secret key set in the local shell is not of the shape a partner secret key has, so no sandbox route was called.",
+    nextAction: "Tell the developer to check the key exported in that shell; the value is never shown."
+  },
+  CLAIMS_SANDBOX_KEY_REQUIRED: {
+    tools: [CLAIMS_SANDBOX, ...CLAIMS_INBOUND],
+    meaning: "The sandbox route answered 403 sandbox_key_required: the key is a live tenant's key, and the sandbox routes take only a sandbox tenant's.",
+    nextAction: "Use the sandbox tenant's secret key, then call again."
+  },
+  CLAIMS_SANDBOX_NOT_ENABLED: {
+    tools: [CLAIMS_SANDBOX, ...CLAIMS_INBOUND],
+    meaning: "The sandbox route answered 404 with no code of its own: the sandbox webhook or claims-inbound routes are not switched on for this tenant or deployment, the endpoint_id names no endpoint of this tenant, or (inbound) the tenant has no claims portal or no inbound endpoint exists yet. The sandbox key can create the sandbox inbound endpoint once (everfur_claims_inbound_signing_setup, create_endpoint with confirm: true from a person); its inbound URL and first secret are shown once, at creation. Live inbound endpoints are set up by Everfur.",
+    nextAction: "Check the endpoint_id with list_endpoints; when list_endpoints itself answers this, switching the routes on is a step Everfur holds. When an inbound route answers it and the routes are on, the sandbox endpoint may not exist yet: offer create_endpoint, and create it only when a person confirms."
+  },
+  CLAIMS_SANDBOX_CALL_FAILED: {
+    tools: [CLAIMS_SANDBOX, ...CLAIMS_INBOUND],
+    meaning: "A sandbox route failed on the wire or answered an error with a code (error.details.code), such as webhook_url_rejected, webhook_endpoint_limit_reached or webhook_test_rate_limited.",
+    nextAction: `Explain error.details.code with everfur_explain_claims_error (not everfur_explain_error) when there is one; after a 429, wait for error.details.retry_after. ${FROM_FAILURE}`
+  },
+  CLAIMS_ARGUMENTS_INVALID: {
+    tools: [CLAIMS_SANDBOX, CLAIMS_PROPOSE, ...CLAIMS_INBOUND],
+    meaning: "The action lacks an argument it needs (error.details.arguments), or secret_env_file cannot take the signing secret. Nothing was created.",
+    nextAction: "Call again with the arguments named in error.details.arguments."
+  },
+  CLAIMS_RECEIVER_URL_REFUSED: {
+    tools: [CLAIMS_VERIFY],
+    meaning: "receiver_url is neither http(s) on localhost or 127.0.0.1 nor a public https URL, so nothing was sent to it.",
+    nextAction: "Call again with the receiver on localhost or on its public https URL."
+  },
+  CLAIMS_WEBHOOK_SECRET_UNUSABLE: {
+    tools: [CLAIMS_VERIFY],
+    meaning: "The endpoint signing secret the checks sign with is not set in this server's environment, or is not a whsec_ value, so nothing was sent.",
+    nextAction: "Tell the developer to set the same whsec_ signing secret their receiver reads in the environment this server runs from."
+  },
+  CLAIMS_RECEIVER_CHECKS_FAILED: {
+    tools: [CLAIMS_VERIFY],
+    meaning: "The receiver failed at least one check. Each check in the result says what was expected, what came back and the fix.",
+    nextAction: "Apply the fix of each FAIL check to the receiver, then run the checks again."
+  },
+  CLAIMS_TOOL_NOT_HOSTED: {
+    tools: [CLAIMS_SANDBOX, CLAIMS_VERIFY, ...CLAIMS_INBOUND],
+    meaning: "This claims tool runs only on an MCP server on the developer's own machine; the Everfur-hosted server holds no sandbox key and no signing secret for a tenant.",
+    nextAction: "Tell the developer to run the tool from the local MCP server or the CLI."
+  },
+  CLAIMS_MAPPING_INVALID: {
+    tools: [CLAIMS_SAVE],
+    meaning: "The mapping does not pass the mapping checks (error.details.problems: a path, a transform, a limit, or pii_paths hiding a field the mapping reads), or the API refused to save or activate it. Nothing was saved or activated.",
+    nextAction: "Fix each problem in the mapping (everfur_propose_claims_mapping can propose one again), then save again."
+  },
+  CLAIMS_MAPPING_CONFIRMATION_REQUIRED: {
+    tools: [CLAIMS_SAVE],
+    meaning: "activate_draft was called without confirm: true and the confirmation phrase the save answer gave, or the phrase does not match the current draft. Nothing was activated.",
+    nextAction: "Show the developer the draft and its phrase; activate only when a person who read it types the phrase back. Never activate on your own."
+  },
+  CLAIMS_MAPPING_DRAFT_MISSING: {
+    tools: [CLAIMS_SAVE],
+    meaning: "activate_draft found no mapping draft saved: none was ever saved, or it was already activated (error.details.active_version names the active one). Nothing was activated.",
+    nextAction: "To change the active mapping, save a new draft with save_draft, show it and its phrase to the developer, and activate only when a person who read it types the phrase back."
+  },
+  CLAIMS_INBOUND_SECRET_UNUSABLE: {
+    tools: [CLAIMS_SAMPLES],
+    meaning: "The inbound endpoint's shared secret is not set in this server's environment or in secret_env_file, or is not a whsec_ value, so nothing was sent.",
+    nextAction: "Rotate the sandbox secret into a local env file with everfur_claims_inbound_signing_setup (rotate_secret: true), then pass that file as secret_env_file."
+  },
+  CLAIMS_INBOUND_URL_UNUSABLE: {
+    tools: [CLAIMS_SAMPLES],
+    meaning: "The sandbox inbound URL is not set in this server's environment or in secret_env_file, is malformed, or names another host than the configured Everfur API, so nothing was sent.",
+    nextAction: "Tell the developer to set the inbound URL from where it was saved when the sandbox endpoint was created (shown once), on the same API host as EVERFUR_API_BASE_URL; with no endpoint yet, offer create_endpoint."
+  },
+  CLAIMS_INBOUND_CREATE_CONFIRMATION_REQUIRED: {
+    tools: [CLAIMS_SETUP],
+    meaning: "create_endpoint was called without confirm: true. Creating the sandbox inbound endpoint is a one-time action (its URL and secret are shown once, and no route deletes a sandbox endpoint), so a person decides it. Nothing was created.",
+    nextAction: "Show the developer the signing config; call create_endpoint with confirm: true only when a person asks for it. Never confirm on your own."
+  },
+  CLAIMS_INBOUND_ENDPOINT_EXISTS: {
+    tools: [CLAIMS_SETUP],
+    meaning: "The create answered 409 endpoint_exists: this sandbox tenant already has its inbound endpoint, whose URL was shown once, at creation. Nothing was created.",
+    nextAction: "Tell the developer to set EVERFUR_CLAIMS_INBOUND_URL from where they saved it, and offer rotate_secret for a new secret or rotate_token for a new URL."
+  },
+  CLAIMS_INBOUND_CREDENTIALS_NOT_WRITTEN: {
+    tools: [CLAIMS_SETUP],
+    meaning: "The sandbox inbound endpoint was created, but its URL or secret (error.details.url_written, secret_written) could not be written to secret_env_file, and the API shows them only once.",
+    nextAction: "Tell the developer plainly: the endpoint exists; a lost secret is recovered with rotate_secret and a lost URL with rotate_token, each with a writable secret_env_file. Never create again."
+  },
+  CLAIMS_HUMAN_CONFIRMATION_REQUIRED: {
+    tools: [CLAIMS_SANDBOX, CLAIMS_SAVE, CLAIMS_SETUP],
+    meaning: "A person must confirm this one-time or replacing sandbox action, and this client cannot ask them directly, so a one-time code was written to a local file (error.details.code_file, mode 600) and printed on the server's stderr. Nothing was done.",
+    nextAction: "Tell the developer the file path and ask them to type the code back only if they want the action; call again with confirmation_code set to what they typed. Never open the file yourself."
+  },
+  CLAIMS_HUMAN_DECLINED: {
+    tools: [CLAIMS_SANDBOX, CLAIMS_SAVE, CLAIMS_SETUP],
+    meaning: "The client asked the person to confirm the action, and they declined or cancelled. Nothing was done.",
+    nextAction: "Do not retry on your own; ask the developer what they want changed."
+  },
+  CLAIMS_API_HOST_NOT_ALLOWED: {
+    tools: [CLAIMS_SANDBOX, CLAIMS_PROPOSE, ...CLAIMS_INBOUND],
+    meaning: "EVERFUR_API_BASE_URL names a host other than api.everfur.com, api-staging.everfur.com or this machine, so the secret key is not sent to it. Nothing was sent.",
+    nextAction: "Tell the developer to point EVERFUR_API_BASE_URL at the Everfur API, or to set EVERFUR_ALLOW_CUSTOM_API_HOST=1 in the shell for an Everfur API they trust."
+  },
+  CLAIMS_INBOUND_SAMPLES_FAILED: {
+    tools: [CLAIMS_SAMPLES],
+    meaning: "At least one sample did not end applied or duplicate, or a check failed. Each result carries its reason code and the fix.",
+    nextAction: "Apply each result's fix (the mapping, the signing or the sample), then send the samples again."
+  },
+  UNKNOWN_CLAIMS_ERROR_CODE: {
+    tools: [CLAIMS_EXPLAIN],
+    meaning: "The code is not a Claims API code, a webhook delivery state or a profile import code. error.details.near_misses lists close spellings.",
+    nextAction: "Check the code was copied exactly; when it was, say it is unknown."
+  },
   // any tool
   INTERNAL_ERROR: {
     tools: ["any tool"],
@@ -17232,7 +17578,7 @@ var SDK_SUB_ENUMS = Object.freeze([
   },
   {
     name: "DictationErrorKind",
-    file: "src/web/chat/dictation/webSpeechDictation.ts",
+    file: "src/react/chat/dictation/dictation.ts",
     declaration: "type",
     members: {
       permissionDenied: { meaning: "The browser refused microphone or speech recognition access (not-allowed, service-not-allowed).", retryable: false, nextAction: "The person allows the microphone in the browser's site settings." },
@@ -17393,4 +17739,4 @@ function resolveAfterRegistryMiss(code, registry) {
   return { kind: "unknown", suggestions: suggestCodes(code, knownCodes(registry)) };
 }
 
-export { ADMIN_TOKEN, ALL_CAPABILITIES, API_BASE_URL_BY_ENVIRONMENT, API_PREFIX, BACKEND_LANGUAGE_QUESTION, BASE_URL_ENV_VAR, CAPABILITIES_TREE, CAPABILITY_QUESTION, CLI_VERSION, CREDENTIAL_SPECS, DEFAULT_TIMEOUT_MS, DIAGNOSTICS_PATH, DOCS_KEY, EMPTY_REGISTRY, ENVELOPE_SHAPE, ENVIRONMENTS, ERRORS_DOCUMENT_KEY, EVERFUR_LOADER_HOSTS, ExitCode, IDEMPOTENT_METHODS, IDENTITY_QUESTION, IDENTITY_TREE, MAX_TIMEOUT_MS, MIN_TIMEOUT_MS, MISSING_FACT_NAMES, NEXT_ACTIONS, NO_CONTRACT_CACHE, PARTNER_KEY, PARTNER_SECRET_KEY, PLAN_DOCUMENT_KIND, PLAN_SCHEMA_VERSION, PLATFORM_TREE, REASON_CODES, REDACTED, REFUSAL_POLICY, SCHEMAS, SESSION_MINT_TREE, SESSION_TOKEN, SURFACES, THEME_TOKEN_ORDER, TOOL_CODES, TransportError, VERIFY_IDENTITY_MODES, WEB_EMBEDDING_QUESTION, alsoInLines, apiUrl, blockedCapabilities, buildDecisionSpace, buildDiagnosisDocument, buildExplanationDocument, buildSupportBundle, checkTenantMode, chooseWidgetAuth, clampTimeout, contractUnavailableOutcome, countsAsNotOn, createApiClient, createContractProvider, createMemoryFileSystem, createRecordingClock, describeFailure, detectProject, detectTheme, detectThemeFromText, diagnoseFailure, diagnoseVerdict, diagnosis_v1_schema_default, digestOfProjection, digestsEqual, editDistance, entryFromRow, ephemeralCredential, errorCodeOf, errorOutcome, error_explanation_v1_schema_default, expandCapabilities, fail, failedResult, failureDetails, fetchContract, fetchTransport, isCorrelatableRequestId, isEverfurLoaderHost, isIdempotent, isJsonObject, isKnownReasonCode, isWorkspaceRootEvidence, knownCodes, loadDecisionSpace, loadDecisionSpaceFromContract, loadErrorRegistry, loadErrorRegistryFromContract, missingFactsFor, nextActionFor, nextActionFor2, nodeContractCache, nodeFileSystem, normalizeSurfaces, offlineDocument, parseDiagnostics, parseEnvironment, parseIdentityMode, parseLoaderUrl, parseOrigin, parseSurfaces, planIntegration, plan_v1_schema_default, plannableCapabilities, refusal, registryAlsoIn, renderExplanation, renderOffline, renderSupportBundle, resolveAfterRegistryMiss, resolveContractPath, resolveCredential, resolveEndpoint, resolveOffline, resolveWithoutRegistry, runVerification, succeed, suggestCodes, systemClock, themePropFromSource, toolCodeExplanation, toolCodeMeaning, uuidFromKey, validateContractFile, validateContractPublicEnvelope, validateContractText, validateDiagnosisDocument, validateErrorExplanationDocument, validatePlanDocument, validateSandboxCreateDocument, validateVerificationDocument, verification_v1_schema_default, verifyDigest, walkSingle, walkTree, withPrefix };
+export { ADMIN_TOKEN, ALLOW_CUSTOM_API_HOST_ENV_VAR, ALL_CAPABILITIES, API_BASE_URL_BY_ENVIRONMENT, API_BASE_URL_PLACEHOLDER, API_PREFIX, BACKEND_LANGUAGE_QUESTION, BASE_URL_ENV_VAR, CAPABILITIES_TREE, CAPABILITY_QUESTION, CLAIMS_INBOUND_SECRET, CLI_VERSION, CREDENTIAL_SPECS, DEFAULT_TIMEOUT_MS, DIAGNOSTICS_PATH, DOCS_KEY, EMPTY_REGISTRY, ENVELOPE_SHAPE, ENVIRONMENTS, ERRORS_DOCUMENT_KEY, EVERFUR_LOADER_HOSTS, ExitCode, IDEMPOTENT_METHODS, IDENTITY_QUESTION, IDENTITY_TREE, MAX_TIMEOUT_MS, MIN_TIMEOUT_MS, MISSING_FACT_NAMES, NEXT_ACTIONS, NO_CONTRACT_CACHE, PARTNER_KEY, PARTNER_SECRET_KEY, PLAN_DOCUMENT_KIND, PLAN_SCHEMA_VERSION, PLATFORM_TREE, REASON_CODES, REDACTED, REFUSAL_POLICY, SCHEMAS, SESSION_MINT_TREE, SESSION_TOKEN, SURFACES, THEME_TOKEN_ORDER, TOOL_CODES, TransportError, VERIFY_IDENTITY_MODES, WEBHOOK_PUBLIC_PATH, WEBHOOK_RECEIVER_PATH, WEBHOOK_SIGNING_SECRET, WEB_EMBEDDING_QUESTION, alsoInLines, apiUrl, blockedCapabilities, buildDecisionSpace, buildDiagnosisDocument, buildExplanationDocument, buildSupportBundle, checkTenantMode, chooseWidgetAuth, clampTimeout, contractUnavailableOutcome, countsAsNotOn, createApiClient, createContractProvider, createMemoryFileSystem, createRecordingClock, describeFailure, detectProject, detectTheme, detectThemeFromText, diagnoseFailure, diagnoseVerdict, diagnosis_v1_schema_default, digestOfProjection, digestsEqual, editDistance, entryFromRow, ephemeralCredential, errorCodeOf, errorOutcome, error_explanation_v1_schema_default, expandCapabilities, fail, failedResult, failureDetails, fetchContract, fetchTransport, hmacSha256, hmacSha256Hex, importPath, isCorrelatableRequestId, isEverfurLoaderHost, isIdempotent, isJsonObject, isKnownReasonCode, isWorkspaceRootEvidence, knownCodes, loadDecisionSpace, loadDecisionSpaceFromContract, loadErrorRegistry, loadErrorRegistryFromContract, missingFactsFor, nextActionFor, nextActionFor2, nodeContractCache, nodeFileSystem, normalizeSurfaces, offlineDocument, parseDiagnostics, parseEnvironment, parseIdentityMode, parseLoaderUrl, parseOrigin, parseSurfaces, planIntegration, plan_v1_schema_default, plannableCapabilities, refusal, registryAlsoIn, renderExplanation, renderOffline, renderSupportBundle, resolveAfterRegistryMiss, resolveContractPath, resolveCredential, resolveEndpoint, resolveOffline, resolveWithoutRegistry, runVerification, secretKeyHostProblem, succeed, suggestCodes, systemClock, themePropFromSource, toolCodeExplanation, toolCodeMeaning, uuidFromKey, validateContractFile, validateContractPublicEnvelope, validateContractText, validateDiagnosisDocument, validateErrorExplanationDocument, validatePlanDocument, validateSandboxCreateDocument, validateVerificationDocument, verification_v1_schema_default, verifyDigest, walkSingle, walkTree, webhookRouteFile, withPrefix };