@everfur/cli 0.8.0 → 0.9.0

package/dist/chunk-EDURPYNG.js

@@ -1,2976 +0,0 @@
-#!/usr/bin/env node
-import { ENVIRONMENTS, ENVELOPE_SHAPE, SURFACES, VERIFY_IDENTITY_MODES, refusal, API_BASE_URL_BY_ENVIRONMENT, fetchContract, NO_CONTRACT_CACHE, systemClock, fetchTransport, describeFailure, loadDecisionSpaceFromContract, uuidFromKey, resolveEndpoint, createApiClient, createContractProvider, nodeContractCache, CLI_VERSION, withPrefix, ephemeralCredential, isJsonObject, REFUSAL_POLICY, error_explanation_v1_schema_default, verification_v1_schema_default, diagnosis_v1_schema_default, plan_v1_schema_default, NEXT_ACTIONS, IDENTITY_QUESTION, IDENTITY_TREE, CAPABILITY_QUESTION, CAPABILITIES_TREE, WEB_EMBEDDING_QUESTION, PLATFORM_TREE, loadDecisionSpace, nodeFileSystem, expandCapabilities, detectThemeFromText, planIntegration, parseOrigin, parseLoaderUrl, isEverfurLoaderHost, EVERFUR_LOADER_HOSTS, resolveCredential, PARTNER_KEY, runVerification, themePropFromSource, normalizeSurfaces, failedResult, buildSupportBundle, chooseWidgetAuth, DIAGNOSTICS_PATH, diagnoseFailure, parseDiagnostics, buildDiagnosisDocument, toolCodeExplanation, resolveOffline, resolveWithoutRegistry, knownCodes, loadErrorRegistryFromContract, loadErrorRegistry, resolveAfterRegistryMiss, TOOL_CODES, registryAlsoIn, buildExplanationDocument, nextActionFor, digestOfProjection, detectProject, BASE_URL_ENV_VAR, checkTenantMode, isWorkspaceRootEvidence, plannableCapabilities, blockedCapabilities, offlineDocument, toolCodeMeaning, SESSION_TOKEN, SESSION_MINT_TREE, BACKEND_LANGUAGE_QUESTION, ALL_CAPABILITIES } from './chunk-WPEB2AVZ.js';
-import { z } from 'zod';
-import { McpServer, ResourceTemplate } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { isAbsolute, join, dirname, basename } from 'path';
-import { createHash } from 'crypto';
-import { InvalidTokenError, TooManyRequestsError, TemporarilyUnavailableError } from '@modelcontextprotocol/sdk/server/auth/errors.js';
-import { completable } from '@modelcontextprotocol/sdk/server/completable.js';
-
-var PLAN_STEPS_BUDGET_BYTES = 24 * 1024;
-var SUMMARY_MAX_CHARS = 120;
-var INTENT_MAX_CHARS = 72;
-var PLAN_SUMMARY_KIND = "everfur.plan.summary";
-var PLAN_SUMMARY_VERSION = 2;
-var PLAN_ID_PATTERN = /^[0-9a-f]{16}$/;
-var MAX_PAGES = 999;
-var PLAN_STEPS_INPUT_SHAPE = {
-  plan_id: z.string().regex(PLAN_ID_PATTERN).optional().describe("The plan_id of an earlier summary. When given, the call refuses with PLAN_CHANGED if the plan these arguments now produce has other steps, other arguments or another contract than the one summarised, so steps are never served from a plan other than the one summarised."),
-  page: z.number().int().min(1).max(MAX_PAGES).optional().describe("A page of an earlier summary, 1 to its pages, with the same arguments that produced it. The call then returns that page instead of the summary: its steps in full (detail, commands, files and the complete body of each file), and on page 1 the detection, the warnings and the checklist in full and the principles. Not with steps."),
-  steps: z.array(z.string().min(1).max(128)).min(1).max(64).optional().describe("Step ids from an earlier summary, with the same arguments that produced it. The call then returns those steps in full (detail, commands, files and the complete body of each file) instead of the summary, a page at a time: remaining_steps names the rest. Not with page.")
-};
-function byteLength(text) {
-  return new TextEncoder().encode(text).byteLength;
-}
-function planIdOf(plan) {
-  const identity = { steps: plan.steps, supplied: plan.supplied, contract: plan.decisionSpace?.digest ?? null };
-  return digestOfProjection(JSON.parse(JSON.stringify(identity))).slice(0, 16);
-}
-var SENTENCE_END = /[.!?](?=\s+[^a-z\s]|\s*$)/;
-var NAMES_A_SECRET = /SECRET_KEY/;
-function oneLine(text, max = SUMMARY_MAX_CHARS) {
-  const flat = text.replace(/\s+/g, " ").trim();
-  const end = flat.search(SENTENCE_END);
-  const sentence = end === -1 ? flat : flat.slice(0, end + 1);
-  if (sentence.length <= max || NAMES_A_SECRET.test(sentence)) return sentence;
-  const cut = sentence.slice(0, max - 1);
-  const space = cut.lastIndexOf(" ");
-  return `${(space > 0 ? cut.slice(0, space) : cut).replace(/[,;:(]$/, "")}\u2026`;
-}
-function principleByTitle(principle) {
-  return { treeId: principle.treeId, id: principle.id, title: principle.title, guide: `everfur://guide/${principle.treeId}` };
-}
-function preambleOf(plan) {
-  return {
-    detected: plan.detected,
-    warnings: plan.warnings,
-    principles: plan.principles.map(principleByTitle),
-    ...plan.checklist === void 0 ? {} : { checklist: plan.checklist }
-  };
-}
-var PAGE_ENVELOPE_BYTES = byteLength(JSON.stringify({
-  ok: true,
-  environment_source: "connected_tenant",
-  plan_id: "0".repeat(16),
-  page: MAX_PAGES,
-  pages: MAX_PAGES,
-  next_page: MAX_PAGES,
-  steps: []
-}));
-function pagesOf(plan) {
-  const pages = [];
-  let page = [];
-  let bytes = PAGE_ENVELOPE_BYTES + byteLength(JSON.stringify(preambleOf(plan)));
-  for (const step of plan.steps) {
-    const size = byteLength(JSON.stringify(step)) + 1;
-    const pageHasContent = page.length > 0 || pages.length === 0;
-    if (pageHasContent && bytes + size > PLAN_STEPS_BUDGET_BYTES) {
-      pages.push(page);
-      page = [];
-      bytes = PAGE_ENVELOPE_BYTES;
-    }
-    page.push(step);
-    bytes += size;
-  }
-  pages.push(page);
-  return pages;
-}
-function detectedFacts(detected) {
-  const { theme } = detected;
-  return {
-    root: detected.root,
-    projectType: detected.projectType,
-    packageManager: detected.packageManager,
-    dependencies: Object.fromEntries(detected.dependencies.map((dependency) => [dependency.name, dependency.installed ?? dependency.declared])),
-    ...detected.webEmbedding === void 0 ? {} : { webEmbedding: detected.webEmbedding },
-    ...detected.webFramework === void 0 ? {} : { webFramework: detected.webFramework },
-    ...theme === void 0 ? {} : { theme: theme === null ? null : { source: theme.source, confidence: theme.confidence, theme: theme.theme } }
-  };
-}
-function goalOf(plan, pages) {
-  const capabilities = plan.supplied.capabilities ?? [];
-  const what = capabilities.length === 0 ? "Everfur" : `Everfur ${capabilities.join(", ")}`;
-  const where = `this ${plan.detected.projectType} project`;
-  const environment = plan.supplied.environment ? ` on ${plan.supplied.environment}` : "";
-  const identity = plan.supplied.identityMode ? `, identity ${plan.supplied.identityMode}` : "";
-  const steps = plan.steps.length === 1 ? "1 step" : `${plan.steps.length} steps`;
-  return `Add ${what} to ${where}${environment}${identity}: ${steps} on ${pages === 1 ? "1 page" : `${pages} pages`}.`;
-}
-function summarizePlan(plan) {
-  const { steps, checklist, warnings } = plan;
-  const pages = pagesOf(plan);
-  const pageOf = new Map(pages.flatMap((page, index) => page.map((step) => [step.id, index + 1])));
-  return {
-    schemaVersion: plan.schemaVersion,
-    kind: PLAN_SUMMARY_KIND,
-    generatedBy: plan.generatedBy,
-    status: plan.status,
-    detected: detectedFacts(plan.detected),
-    supplied: plan.supplied,
-    missingFacts: plan.missingFacts,
-    blocked: plan.blocked,
-    ...plan.platformBlock === void 0 ? {} : { platformBlock: plan.platformBlock },
-    decisionSpace: plan.decisionSpace,
-    summaryVersion: PLAN_SUMMARY_VERSION,
-    goal: goalOf(plan, pages.length),
-    // A warning is what an agent must not have to fetch, so each is here by its first sentence, which states it; page 1
-    // carries it whole.
-    warnings: warnings.map(({ code, message }) => ({ code, message: oneLine(message) })),
-    pages: pages.length,
-    steps: steps.map((step) => ({
-      id: step.id,
-      title: step.title,
-      intent: oneLine(step.detail, INTENT_MAX_CHARS),
-      page: pageOf.get(step.id) ?? 1
-    })),
-    // The definition of done by its requirements: what an agent is held to is never a thing to fetch later. Each
-    // item's check and the steps it covers are on page 1.
-    ...checklist === void 0 ? {} : { checklist: checklist.map(({ id, requirement }) => ({ id, requirement })) }
-  };
-}
-var FETCH_STEPS = Object.freeze({
-  tool: "everfur_plan_integration",
-  with: "the same arguments plus plan_id and page, for page 1 to pages",
-  returns: "the steps in full, file bodies included; page 1 also detection, warnings and checklist in full, and the principles",
-  when: "every page before any command runs or any file is written, since the plan's own steps change the project"
-});
-function isPlanDocument(value) {
-  return typeof value === "object" && value !== null && Array.isArray(value.steps);
-}
-function summarizeRefusal(result) {
-  const error = result.document["error"];
-  const plan = error?.details?.["plan"];
-  if (error === void 0 || !isPlanDocument(plan)) return result;
-  return {
-    isError: true,
-    document: { ...result.document, error: { ...error, details: { ...error.details, plan: summarizePlan(plan) } } }
-  };
-}
-function stepPage(plan, requested, envelope) {
-  const wanted = new Set(requested);
-  const selected = plan.steps.filter((step) => wanted.has(step.id));
-  const page = [];
-  let bytes = byteLength(JSON.stringify({ ...envelope, steps: [], remaining_steps: selected.map((step) => step.id) }));
-  for (const step of selected) {
-    const size = byteLength(JSON.stringify(step)) + 1;
-    if (page.length > 0 && bytes + size > PLAN_STEPS_BUDGET_BYTES) break;
-    page.push(step);
-    bytes += size;
-  }
-  return { page, remaining: selected.slice(page.length).map((step) => step.id) };
-}
-function numberedPage(plan, number, envelope) {
-  const pages = pagesOf(plan);
-  const steps = pages[number - 1];
-  if (steps === void 0) {
-    return refusal(
-      "UNKNOWN_PLAN_PAGE",
-      `This plan has ${pages.length === 1 ? "1 page" : `${pages.length} pages`}, so there is no page ${number}. Pages run from 1 to the summary's pages.`,
-      { page: number, pages: pages.length, plan_id: envelope["plan_id"] }
-    );
-  }
-  return {
-    isError: false,
-    document: {
-      ...envelope,
-      page: number,
-      pages: pages.length,
-      ...number < pages.length ? { next_page: number + 1 } : {},
-      ...number === 1 ? preambleOf(plan) : {},
-      steps
-    }
-  };
-}
-function planOnTheWire(result, request) {
-  if (result.isError) return summarizeRefusal(result);
-  const { plan, ...rest } = result.document;
-  if (!isPlanDocument(plan)) return result;
-  const planId = planIdOf(plan);
-  if (request.page !== void 0 && request.steps !== void 0) {
-    return refusal(
-      "UNKNOWN_PLAN_PAGE",
-      "page and steps were both given. Ask for a page of the summary with page, or for steps by id with steps, not both.",
-      { page: request.page, steps: request.steps, plan_id: planId }
-    );
-  }
-  if (request.plan_id !== void 0 && request.plan_id !== planId) {
-    return refusal(
-      "PLAN_CHANGED",
-      `These arguments now produce plan ${planId}, not plan ${request.plan_id}. A plan_id stands for the plan's steps, the arguments it was asked with and the contract it was built from, so one of three things changed since the call that returned it: the arguments differ from that call, the project the plan reads changed in a way that changes a step (as a command run or a file written from the plan can), or the contract changed. The same call without plan_id, page and steps returns the summary of the current plan.`,
-      { plan_id: request.plan_id, current_plan_id: planId }
-    );
-  }
-  const envelope = { ...rest, plan_id: planId };
-  if (request.page !== void 0) return numberedPage(plan, request.page, envelope);
-  if (request.steps === void 0) {
-    return { isError: false, document: { ...envelope, plan: summarizePlan(plan), fetch_steps: FETCH_STEPS } };
-  }
-  const known = new Set(plan.steps.map((step) => step.id));
-  const unknown = [...new Set(request.steps)].filter((id) => !known.has(id));
-  if (unknown.length > 0) {
-    return refusal(
-      "UNKNOWN_PLAN_STEP",
-      "One or more step ids are not steps of this plan. The ids it has are listed in details.steps.",
-      { unknown, plan_id: planId, steps: plan.steps.map((step) => step.id) }
-    );
-  }
-  const { page, remaining } = stepPage(plan, request.steps, envelope);
-  return {
-    isError: false,
-    document: { ...envelope, steps: page, ...remaining.length === 0 ? {} : { remaining_steps: remaining } }
-  };
-}
-
-// src/mcp/tools.ts
-var DEFAULT_VERIFY_USER_REF = "everfur-mcp-verify";
-var HOSTED_NO_PUBLISHABLE_KEY = Object.freeze({
-  message: "The connected tenant has no active publishable key, so this call was not made.",
-  howToFix: Object.freeze([
-    "No publishable key yet. Contact support@everfur.com to finish onboarding.",
-    "The API keys tab of the partner console lists this tenant's publishable keys."
-  ])
-});
-function publishableKeyShape() {
-  const prefixes = [PARTNER_KEY.prefix, ...PARTNER_KEY.alsoAccepts ?? []].filter((prefix) => prefix !== null);
-  return `${prefixes.join(" or ")}, ${PARTNER_KEY.length ?? "a fixed number of"} characters in all`;
-}
-function hostedPublishableKeyRefusal(env) {
-  if (resolveCredential(env, PARTNER_KEY).status === "malformed") {
-    return refusal(
-      "TENANT_PUBLISHABLE_KEY_UNUSABLE",
-      `The connected tenant's publishable key does not have the shape this server sends (${publishableKeyShape()}), so this call was not made.`,
-      {
-        reason: "malformed",
-        how_to_fix: ["Everfur issues this tenant's publishable keys; the partner console names support@everfur.com for them."]
-      }
-    );
-  }
-  return refusal("TENANT_PUBLISHABLE_KEY_UNUSABLE", HOSTED_NO_PUBLISHABLE_KEY.message, {
-    reason: "missing",
-    how_to_fix: [...HOSTED_NO_PUBLISHABLE_KEY.howToFix]
-  });
-}
-var SYNTHETIC_USER_REF_PREFIX = "everfur-verify-";
-function hostedVerifyUserRef(requested) {
-  const seed = requested === void 0 || requested.trim() === "" ? DEFAULT_VERIFY_USER_REF : requested;
-  return `${SYNTHETIC_USER_REF_PREFIX}${uuidFromKey(`everfur_verify_integration:${seed}`)}`;
-}
-function contractProviderFor(context, ports = {}) {
-  return ports.contract ?? (() => fetchContract({
-    env: context.env,
-    transport: ports.transport ?? fetchTransport,
-    clock: ports.clock ?? systemClock,
-    cache: ports.contractCache ?? NO_CONTRACT_CACHE
-  }));
-}
-function contractRefusal(load, extra = {}) {
-  const details = { how_to_fix: [...load.details], request_id: load.requestId, ...extra };
-  switch (load.reason) {
-    case "credential_missing":
-      return refusal("CONTRACT_CREDENTIAL_MISSING", `${load.message}.`, details);
-    case "credential_malformed":
-    case "credential_rejected":
-      return refusal("CONTRACT_CREDENTIAL_UNUSABLE", `${load.message}.`, { ...details, status: load.status });
-    case "endpoint_missing":
-      return refusal("WIRE_NOT_CONFIGURED", `${load.message}.`, { errors: [...load.details], ...extra });
-    case "unreachable":
-      return refusal("CONTRACT_UNAVAILABLE", `${load.message}.`, { ...details, kind: "network" });
-    case "remote_error":
-    case "invalid_contract":
-      return refusal("CONTRACT_UNAVAILABLE", `${load.message}.`, { ...details, status: load.status });
-  }
-}
-var CAPABILITY = z.string().min(1);
-var IDENTITY_MODE_ALIAS = "personalized";
-var IDENTITY_MODE = z.string().min(1);
-function canonicalIdentityMode(mode) {
-  return mode === IDENTITY_MODE_ALIAS ? "partner-user-ref" : mode;
-}
-var MINT_LANGUAGE = z.string().min(1);
-var EMBEDDING = z.string().min(1);
-function unknownOptions(space, args) {
-  const problems = [];
-  const check = (argument, values, treeId, questionId, extra = []) => {
-    const allowed = [...space.choices(treeId, questionId), ...extra];
-    if (allowed.length === extra.length) return;
-    for (const value of values) {
-      if (!allowed.includes(value)) problems.push(`${argument}: "${value}" (supported: ${allowed.join(", ")})`);
-    }
-  };
-  check("capabilities", args.capabilities ?? [], CAPABILITIES_TREE, CAPABILITY_QUESTION, [ALL_CAPABILITIES]);
-  const identity = canonicalIdentityMode(args.identity_mode ?? null);
-  check("identity_mode", identity === null ? [] : [identity], IDENTITY_TREE, IDENTITY_QUESTION);
-  check("session_mint_language", args.session_mint_language === void 0 ? [] : [args.session_mint_language], SESSION_MINT_TREE, BACKEND_LANGUAGE_QUESTION);
-  check("embedding", args.embedding === void 0 ? [] : [args.embedding], PLATFORM_TREE, WEB_EMBEDDING_QUESTION);
-  return problems;
-}
-function clientFor(context, ports = {}) {
-  const endpoint = resolveEndpoint(null, context.env);
-  if (endpoint.ok === false) return { ok: false, errors: endpoint.errors };
-  return {
-    ok: true,
-    client: createApiClient({
-      transport: ports.transport ?? fetchTransport,
-      clock: ports.clock ?? systemClock,
-      endpoint: endpoint.endpoint
-    })
-  };
-}
-var IDENTITY_MODE_MEANING = Object.freeze({
-  anonymous: '"anonymous" (no backend, scoped to the device)',
-  "partner-user-ref": '"partner-user-ref" (your backend mints a session)',
-  "shopify-app-proxy": '"shopify-app-proxy" (a Shopify storefront; Shopify vouches for the signed-in customer and no partner backend mints)'
-});
-function identityModeList(options) {
-  const modes = options ?? ["anonymous", "partner-user-ref", "shopify-app-proxy"];
-  const described = modes.map((mode) => IDENTITY_MODE_MEANING[mode] ?? `"${mode}"`);
-  if (described.length === 1) return described[0];
-  return `${described.slice(0, -1).join(", ")}${described.length > 2 ? "," : ""} or ${described[described.length - 1]}`;
-}
-function supplyOverMcp(fact, space, options = null, detection = null) {
-  switch (fact) {
-    case "decisionTrees":
-      return "pass `contract_path` (a contract-public projection), or set EVERFUR_CONTRACT_PUBLIC in the server environment, or unset both so the contract is fetched with EVERFUR_DOCS_KEY";
-    case "capabilities": {
-      const plannable = space === null ? [] : plannableCapabilities(space);
-      const blocked = space === null ? [] : blockedCapabilities(space);
-      const choices = plannable.length === 0 ? 'pass `capabilities`, e.g. ["chat"] or ["chat","records"]' : `pass \`capabilities\`: one or more of ${plannable.join(", ")} (the ids the contract can plan today${blocked.length === 0 ? "" : `; blocked today: ${blocked.join(", ")}, which a plan refuses with the reason and where to ask`}), or ["all"] for every plannable one`;
-      return `${choices}. Which surfaces to build is the developer's choice, and nothing in the project decides it. The plan holds no credential, so it cannot know which of these the tenant is entitled to: everfur_verify_integration is the fail-closed check of what the tenant actually has`;
-    }
-    case "identityMode":
-      return "pass `identity_mode`: " + identityModeList(options) + ". " + (options === null ? "It is the developer's choice, and it changes the integration shape" : "These are the only modes this refusal accepts; the mode it refused cannot be built here");
-    case "sessionMintLanguage":
-      return "pass `session_mint_language`, the language of the backend that will mint sessions and receive Everfur's webhooks (node, python, go or other-language as the contract names them; node gets generated files)";
-    case "embedding":
-      return 'pass `embedding`: "in-page" (the SDK\'s React components in the page) or "frame" (the loader and the Everfur-hosted iframe). Detected from react-dom when omitted';
-    case "environment":
-      return 'pass `environment`: "test" (your sandbox tenant on https://api.everfur.com/api/v1, a pk_test_ key, livemode false), "staging" (your sandbox tenant on https://api-staging.everfur.com/api/v1, for early access) or "production" (your live tenant on https://api.everfur.com/api/v1, a pk_live_ key). It is the developer\'s choice; production is never assumed';
-    case "projectType":
-      if (detection !== null && isWorkspaceRootEvidence(detection.projectTypeEvidence)) {
-        return "describe the workspace package that holds the app, not the workspace root: pass its `project_root` when this is a local MCP, or its own `project_details` (with `workspace_root` for the root's lockfile) when this is a remote MCP; this fact is detected, not asserted";
-      }
-      return "pass `project_root` when this is a local MCP, or the manifest and file-marker-only `project_details` when this is a remote MCP; this fact is detected, not asserted";
-    case "packageManager":
-      return "pass `project_root` when this is a local MCP, or the manifest and file-marker-only `project_details` when this is a remote MCP (for a workspace package, with `workspace_root` naming the workspace root's lockfile or packageManager field); this fact is detected, not asserted";
-    default:
-      return "supply this fact as a tool argument of the same name";
-  }
-}
-var FIXED_QUESTIONS = Object.freeze({
-  capabilities: "Which Everfur surfaces should this integration build?",
-  identityMode: "How does your app identify the person using it?",
-  sessionMintLanguage: "What language is the backend that will mint Everfur sessions?",
-  environment: "Which Everfur environment should the generated code target?",
-  embedding: "Should the Everfur surface render inside your page, or in an Everfur-hosted frame?"
-});
-var QUESTION_ROUND_INSTRUCTION = "One question round: every question in missing_facts goes to the developer in one message, in the order given, worded as given and with its options; a question with required_when belongs in the same message and is used only for the answers it names. The answers are the developer's alone. The next everfur_plan_integration call carries the same arguments plus every answer.";
-function questionOptions(fact, space) {
-  switch (fact) {
-    case "capabilities":
-      return space === null ? null : [...plannableCapabilities(space), ALL_CAPABILITIES];
-    case "identityMode":
-      return space === null ? null : space.choices(IDENTITY_TREE, IDENTITY_QUESTION);
-    case "sessionMintLanguage":
-      return space === null ? null : space.choices(SESSION_MINT_TREE, BACKEND_LANGUAGE_QUESTION);
-    case "environment":
-      return [...ENVIRONMENTS];
-    case "embedding":
-      return space === null ? ["in-page", "frame"] : space.choices(PLATFORM_TREE, WEB_EMBEDDING_QUESTION);
-    default:
-      return null;
-  }
-}
-function fixedQuestion(fact, space, admitted = null) {
-  const question = FIXED_QUESTIONS[fact];
-  if (question === void 0) return null;
-  const options = admitted ?? questionOptions(fact, space);
-  return options === null || options.length === 0 ? { question } : { question, options: [...options] };
-}
-var REMOTE_PROJECT_MARKERS = [
-  "app.json",
-  "app.config.js",
-  "app.config.ts",
-  "ios/",
-  "android/",
-  "index.html",
-  "public/index.html",
-  "layout/theme.liquid",
-  "shopify.theme.toml",
-  "shopify.app.toml",
-  "app/",
-  "src/app/",
-  "pages/",
-  "src/pages/",
-  // A server directory, and a tsconfig in it the plan must never write over (hosted MCP web integration test, 2026-10-04).
-  "server/",
-  "server/tsconfig.json",
-  // An env template the app already has, which the plan adds to and never replaces (hosted MCP mobile test, 2026-10-04).
-  ".env.example",
-  "package-lock.json",
-  "npm-shrinkwrap.json",
-  "pnpm-lock.yaml",
-  "yarn.lock",
-  "bun.lockb",
-  "bun.lock"
-];
-function normalizeRemoteMarker(value) {
-  if (typeof value !== "string") return value;
-  const bare = value.trim().replace(/\\/g, "/").replace(/\/{2,}/g, "/").replace(/^(?:\.\/)+/, "").replace(/\/+$/, "");
-  const listed = REMOTE_PROJECT_MARKERS;
-  if (listed.includes(`${bare}/`)) return `${bare}/`;
-  if (listed.includes(bare)) return bare;
-  return value;
-}
-var REMOTE_PROJECT_MARKER = z.preprocess(normalizeRemoteMarker, z.enum(REMOTE_PROJECT_MARKERS));
-var REMOTE_WORKSPACE_LOCKFILES = [
-  "package-lock.json",
-  "npm-shrinkwrap.json",
-  "pnpm-lock.yaml",
-  "yarn.lock",
-  "bun.lockb",
-  "bun.lock"
-];
-var REMOTE_WORKSPACE_ROOT = z.object({
-  package_manager: z.string().min(1).max(128).optional(),
-  files: z.array(z.preprocess(normalizeRemoteMarker, z.enum(REMOTE_WORKSPACE_LOCKFILES))).max(6).optional()
-}).strict();
-var REMOTE_DEPENDENCY_MAP = z.record(z.string().min(1).max(128), z.string().min(1).max(256));
-var REMOTE_PROJECT_DETAILS = z.object({
-  /** A display label only. It is never treated as a path by the remote MCP. */
-  label: z.string().min(1).max(120).optional(),
-  package_json: z.object({
-    dependencies: REMOTE_DEPENDENCY_MAP.optional(),
-    dev_dependencies: REMOTE_DEPENDENCY_MAP.optional(),
-    peer_dependencies: REMOTE_DEPENDENCY_MAP.optional(),
-    package_manager: z.string().min(1).max(128).optional()
-  }).strict().optional(),
-  pubspec: z.object({
-    dart_sdk: z.string().min(1).max(128).optional(),
-    flutter_sdk: z.string().min(1).max(128).optional(),
-    dependencies: REMOTE_DEPENDENCY_MAP.optional()
-  }).strict().optional(),
-  /**
-   * Presence-only markers, from the fixed allowlist above. File contents are neither accepted nor read. `ios/` and
-   * `android/` are listed only when checked in: on an Expo app, directories .gitignore lists are continuous native
-   * generation's output, and the app is managed.
-   */
-  files: z.array(REMOTE_PROJECT_MARKER).max(24).optional(),
-  /** For a package inside a workspace: the workspace root's packageManager field and lockfiles, presence only. */
-  workspace_root: REMOTE_WORKSPACE_ROOT.optional(),
-  /** Optional resolved versions for the small dependency report; never needed to select an integration path. */
-  installed_versions: REMOTE_DEPENDENCY_MAP.optional()
-}).strict();
-var REMOTE_ROOT = "/everfur-remote-project";
-function detectRemoteProject(details) {
-  const files = /* @__PURE__ */ new Map();
-  const directories = /* @__PURE__ */ new Set([REMOTE_ROOT]);
-  if (details.package_json !== void 0) {
-    files.set(join(REMOTE_ROOT, "package.json"), JSON.stringify({
-      dependencies: details.package_json.dependencies ?? {},
-      devDependencies: details.package_json.dev_dependencies ?? {},
-      peerDependencies: details.package_json.peer_dependencies ?? {},
-      packageManager: details.package_json.package_manager
-    }));
-  }
-  if (details.pubspec !== void 0) {
-    files.set(join(REMOTE_ROOT, "pubspec.yaml"), JSON.stringify({
-      environment: {
-        sdk: details.pubspec.dart_sdk,
-        flutter: details.pubspec.flutter_sdk
-      },
-      dependencies: details.pubspec.dependencies ?? {}
-    }));
-  }
-  for (const marker of details.files ?? []) {
-    const path = join(REMOTE_ROOT, marker.replace(/\/+$/, ""));
-    if (marker.endsWith("/")) directories.add(path);
-    else files.set(path, "");
-    for (let parent = dirname(path); parent.startsWith(`${REMOTE_ROOT}/`); parent = dirname(parent)) directories.add(parent);
-  }
-  if (details.workspace_root !== void 0) {
-    const workspaceRoot = dirname(REMOTE_ROOT);
-    files.set(join(workspaceRoot, "package.json"), JSON.stringify({
-      workspaces: [basename(REMOTE_ROOT)],
-      packageManager: details.workspace_root.package_manager
-    }));
-    for (const lockfile of details.workspace_root.files ?? []) files.set(join(workspaceRoot, lockfile), "");
-  }
-  for (const [name, version] of Object.entries(details.installed_versions ?? {})) {
-    files.set(join(REMOTE_ROOT, "node_modules", ...name.split("/"), "package.json"), JSON.stringify({ version }));
-  }
-  const fs = Object.freeze({
-    readFile(path) {
-      return files.get(path) ?? null;
-    },
-    exists(path) {
-      return files.has(path) || directories.has(path);
-    },
-    isDirectory(path) {
-      return directories.has(path);
-    },
-    listDirectory() {
-      return Object.freeze([]);
-    }
-  });
-  const detection = detectProject(fs, REMOTE_ROOT);
-  const label = details.label === void 0 ? "remote project metadata" : `remote project metadata (${details.label})`;
-  return Object.freeze({
-    ...detection,
-    root: `[${label}]`,
-    projectTypeEvidence: Object.freeze([
-      "detected from the remote manifest-and-marker projection; Everfur did not read source files or a local path",
-      ...detection.projectTypeEvidence
-    ]),
-    packageManagerEvidence: Object.freeze([
-      "detected from the remote manifest-and-marker projection",
-      ...detection.packageManagerEvidence
-    ])
-  });
-}
-function planDetection(args) {
-  if (args.project_root !== void 0 && args.project_details !== void 0) {
-    return {
-      ok: false,
-      result: refusal(
-        "PROJECT_SOURCE_AMBIGUOUS",
-        "Pass exactly one project source. `project_root` is for a local MCP; `project_details` is for a remote MCP.",
-        { next_action: "fix_arguments" }
-      )
-    };
-  }
-  if (args.project_root === void 0 && args.project_details === void 0) {
-    return {
-      ok: false,
-      result: refusal(
-        "PROJECT_SOURCE_REQUIRED",
-        "Pass `project_root` to a local MCP or `project_details` to a remote MCP. project_details carries no source file and no credential.",
-        { next_action: "fix_arguments" }
-      )
-    };
-  }
-  if (args.project_details !== void 0) return { ok: true, detection: detectRemoteProject(args.project_details) };
-  const root = args.project_root;
-  const problem = !isAbsolute(root) ? "it is not an absolute path" : !nodeFileSystem.isDirectory(root) ? "no readable directory exists at it" : null;
-  if (problem !== null) {
-    return {
-      ok: false,
-      result: refusal(
-        "LOCAL_PATH_NOT_READABLE",
-        `project_root cannot be read: ${problem}. Pass the absolute path of the application root on the machine this server runs on, or describe the project with \`project_details\` instead.`,
-        { arguments: ["project_root"], project_root: root, next_action: "fix_arguments" }
-      )
-    };
-  }
-  return { ok: true, detection: detectProject(nodeFileSystem, root) };
-}
-var THEME_SOURCE_MAX_BYTES = 256 * 1024;
-var PLAN_INPUT_SHAPE = {
-  project_root: z.string().optional().describe("For a local MCP only: absolute path to the application root. Pass exactly one of this or project_details."),
-  project_details: REMOTE_PROJECT_DETAILS.optional().describe("For a remote MCP only: a safe projection of package dependencies, package manager, and fixed file-presence markers. Pass exactly one of this or project_root; never send source files, env files, or credentials."),
-  theme_source: z.string().min(1).max(THEME_SOURCE_MAX_BYTES).optional().describe(
-    "For a remote MCP: the text of the project's tailwind.config.{js,ts}, the CSS that declares its theme (a Tailwind v4 @theme block or :root custom properties), or a React Native theme or colours file, so the plan can match the generated surface to the project's own theme. Read statically and never executed. With project_root the project is read from disk instead; this argument, when given, wins. The plan refuses to guess a theme it cannot read and names the missing facts in its match-theme step."
-  ),
-  capabilities: z.array(CAPABILITY).optional().describe(
-    'Which Everfur capabilities this integration uses, as the contract names them. The ids the contract can plan today are "chat", "entitlements", "events", "notifications", "photo", "records", "records-clinic" and "televet"; "animations", "records-push", "records-transfer", "server-pets" and "video" are blocked today and a plan refuses them with the reason. Pass ["all"] for every plannable capability. The loaded contract is the authority: an UNKNOWN_OPTION refusal lists its exact ids. The plan holds no credential, so everfur_verify_integration (not this tool) is the fail-closed check of what the tenant actually has. The native setup an in-app vet call needs (the Daily modules, an Expo config plugin, a clean prebuild, camera and microphone declarations, and a warning naming the missing-native-module error Expo Go produces) is planned only when the generated React Native file mounts that call; a plan whose file mounts only the vet visit button installs none of it. Omit if unknown; the tool will refuse and list the ids.'
-  ),
-  identity_mode: IDENTITY_MODE.optional().describe('anonymous = no backend, scoped to the device. partner-user-ref = your backend mints a session against your own user id. shopify-app-proxy = a Shopify storefront, where Shopify vouches for the signed-in customer and no partner backend mints. "personalized" is accepted as an alias for partner-user-ref.'),
-  session_mint_language: MINT_LANGUAGE.optional().describe("Backend language that will mint sessions. Only meaningful when identity_mode is partner-user-ref."),
-  embedding: EMBEDDING.optional().describe(`For a web project only: "in-page" mounts the SDK's React components in the page (detected when package.json declares react-dom), "frame" includes the loader and renders the surface in an iframe on Everfur's origin (detected otherwise). Omit to accept what the project says; pass it to override.`),
-  environment: z.enum(ENVIRONMENTS).optional().describe("The Everfur deployment the generated configuration targets: test (your sandbox tenant on the production API, a pk_test_ key, livemode false), staging (your sandbox tenant on the staging API, for early access) or production (your live tenant, a pk_live_ key). Required for a plan that writes code; never assumed. Ask the developer. On the Everfur-hosted server an omitted environment is the connected tenant's, one naming a different host is refused (ENVIRONMENT_MISMATCH), and one naming a tenant mode the connected tenant does not have is refused (ENVIRONMENT_MODE_MISMATCH)."),
-  contract_path: z.string().optional().describe("Path to a contract-public projection. Defaults to EVERFUR_CONTRACT_PUBLIC, then to the contract fetched from the Everfur API with EVERFUR_DOCS_KEY."),
-  ...PLAN_STEPS_INPUT_SHAPE
-};
-var HOSTED_PLAN_INPUT_SHAPE = {
-  project_details: REMOTE_PROJECT_DETAILS.optional().describe("A safe projection of the project: package dependencies, package manager, and fixed file-presence markers. Never source files, env files, or credentials; this server reads no path."),
-  theme_source: PLAN_INPUT_SHAPE.theme_source.describe(
-    "The text of the project's tailwind.config.{js,ts}, the CSS that declares its theme (a Tailwind v4 @theme block or :root custom properties), or a React Native theme or colours file, so the plan can match the generated surface to the project's own theme. Read statically and never executed. A theme the plan cannot read is named in its match-theme step as missing facts, never guessed."
-  ),
-  capabilities: PLAN_INPUT_SHAPE.capabilities,
-  identity_mode: PLAN_INPUT_SHAPE.identity_mode,
-  session_mint_language: PLAN_INPUT_SHAPE.session_mint_language,
-  embedding: PLAN_INPUT_SHAPE.embedding,
-  // Owner-approved 2026-10-01 (production sandbox plan section 10: the CLI environment text).
-  environment: PLAN_INPUT_SHAPE.environment.describe(
-    "The Everfur deployment the generated configuration targets: test (the sandbox tenant on the production API, a pk_test_ key, livemode false; for a live tenant, its paired sandbox), staging (the sandbox tenant on the staging API, for early access) or production (the live tenant, a pk_live_ key). Omitted, the plan targets the connected tenant's deployment and mode; one naming a different host than the connected tenant's is refused (ENVIRONMENT_MISMATCH), and one naming a mode it does not have is refused (ENVIRONMENT_MODE_MISMATCH)."
-  ),
-  ...PLAN_STEPS_INPUT_SHAPE
-};
-function apiHostOf(apiBaseUrl) {
-  try {
-    return new URL(apiBaseUrl).hostname;
-  } catch {
-    return null;
-  }
-}
-function environmentOfApi(apiBaseUrl) {
-  if (apiBaseUrl === void 0) return null;
-  const host = apiHostOf(apiBaseUrl);
-  if (host === null) return null;
-  if (host === apiHostOf(API_BASE_URL_BY_ENVIRONMENT.staging)) return "staging";
-  if (host === apiHostOf(API_BASE_URL_BY_ENVIRONMENT.production)) return "production";
-  return null;
-}
-function hostedEnvironment(requested, context) {
-  if (context.credentialSource !== "hosted") return { ok: true, environment: requested, fromTenant: false };
-  const connectedApi = context.env[BASE_URL_ENV_VAR];
-  const deployment = environmentOfApi(connectedApi);
-  if (deployment === null) return { ok: true, environment: requested, fromTenant: false };
-  const mode = context.tenantMode ?? null;
-  const connected = deployment === "production" && mode !== null && !mode.livemode ? "test" : deployment;
-  if (requested === null) return { ok: true, environment: connected, fromTenant: true };
-  const requestedApi = API_BASE_URL_BY_ENVIRONMENT[requested];
-  const requestedHost = apiHostOf(requestedApi) ?? requestedApi;
-  const connectedHost = apiHostOf(connectedApi ?? "") ?? String(connectedApi);
-  if (apiHostOf(requestedApi) !== apiHostOf(API_BASE_URL_BY_ENVIRONMENT[deployment])) {
-    return {
-      ok: false,
-      result: refusal(
-        "ENVIRONMENT_MISMATCH",
-        `This server is connected to a tenant on ${connectedHost} (${connected}), but environment "${requested}" targets ${requestedHost}. A plan for ${requestedHost} would carry a key that host does not know, and every request would answer 401. Which of the two was meant is the developer's to say.`,
-        {
-          environment: requested,
-          requested_host: requestedHost,
-          connected_host: connectedHost,
-          connected_environment: connected,
-          how_to_fix: [
-            `omit environment to plan for the connected tenant on ${connectedHost}`,
-            `or connect the editor to the Everfur MCP server of the ${requested} environment and plan there`
-          ]
-        }
-      )
-    };
-  }
-  const modeMismatch = mode !== null && (requested === "production" && !mode.livemode || requested === "test" && deployment === "production" && mode.livemode && !mode.paired);
-  if (!modeMismatch) return { ok: true, environment: requested, fromTenant: false };
-  const needs = requested === "production" ? "a live tenant, and the connected tenant is a sandbox" : "a sandbox tenant, or a live tenant with a paired sandbox, and the connected tenant is live with no paired sandbox";
-  return {
-    ok: false,
-    result: refusal(
-      "ENVIRONMENT_MODE_MISMATCH",
-      `Environment "${requested}" needs ${needs}. Test and production share ${connectedHost}, so the tenant's mode, not the host, decides which one a plan is for. Which was meant is the developer's to say.`,
-      {
-        environment: requested,
-        connected_host: connectedHost,
-        connected_environment: connected,
-        tenant_livemode: mode.livemode,
-        test_mode_paired: mode.paired,
-        how_to_fix: [
-          `omit environment to plan for the connected tenant (${connected})`,
-          requested === "production" ? "or connect the editor with the live tenant and plan there" : "or connect the editor with the sandbox tenant, or pair this live tenant with one, and plan there"
-        ]
-      }
-    )
-  };
-}
-async function localTenantMode(environment, context, ports) {
-  if (context.credentialSource === "hosted") return { ok: true, warning: null };
-  const check = await checkTenantMode({
-    env: context.env,
-    environment,
-    transport: ports.transport ?? fetchTransport,
-    clock: ports.clock ?? systemClock
-  });
-  if (check.kind === "not_checked") return { ok: true, warning: check.warning };
-  if (check.kind !== "mismatch" || environment === null) return { ok: true, warning: null };
-  const host = apiHostOf(API_BASE_URL_BY_ENVIRONMENT[environment]) ?? API_BASE_URL_BY_ENVIRONMENT[environment];
-  const needs = environment === "production" ? "a live tenant" : "a sandbox tenant";
-  const has = check.livemode ? "a live tenant (livemode true)" : "a sandbox tenant (livemode false)";
-  const other = check.livemode ? "production" : "test";
-  return {
-    ok: false,
-    result: refusal(
-      "ENVIRONMENT_MODE_MISMATCH",
-      `Environment "${environment}" needs ${needs}, and the ${PARTNER_KEY.envVar} in this server's environment belongs to ${has}. Test and production share ${host}, so the tenant's mode, not the host, decides which one a plan is for. Which was meant is the developer's to say.`,
-      {
-        environment,
-        connected_host: host,
-        tenant_livemode: check.livemode,
-        how_to_fix: [
-          `pass environment "${other}" to plan for the tenant of this server's ${PARTNER_KEY.envVar}`,
-          `or set ${PARTNER_KEY.envVar} in this server's environment to the publishable key of the tenant you meant`
-        ]
-      }
-    )
-  };
-}
-async function planIntegrationTool(args, context, ports = {}) {
-  const detected = planDetection(args);
-  if (detected.ok === false) return detected.result;
-  const environment = hostedEnvironment(args.environment ?? null, context);
-  if (environment.ok === false) return environment.result;
-  const mode = await localTenantMode(environment.environment, context, ports);
-  if (mode.ok === false) return mode.result;
-  const contractPath = args.contract_path ?? context.env["EVERFUR_CONTRACT_PUBLIC"] ?? null;
-  let load;
-  if (contractPath === null) {
-    const fetched = await contractProviderFor(context, ports)();
-    if (fetched.kind === "unavailable") return contractRefusal(fetched);
-    load = loadDecisionSpaceFromContract(fetched.contract);
-  } else {
-    load = loadDecisionSpace(nodeFileSystem, contractPath);
-  }
-  if (load.kind === "loaded") {
-    const problems = unknownOptions(load.space, args);
-    if (problems.length > 0) {
-      return refusal(
-        "UNKNOWN_OPTION",
-        "One or more arguments name a value the contract does not publish; the values it supports are listed with each.",
-        { unknown: problems }
-      );
-    }
-  }
-  const space = load !== null && load.kind === "loaded" ? load.space : null;
-  const expanded = args.capabilities ? expandCapabilities([...args.capabilities], space) : null;
-  const theme = args.theme_source === void 0 ? void 0 : detectThemeFromText(args.theme_source, "theme_source");
-  const input = {
-    detection: detected.detection,
-    capabilities: expanded === null ? null : [...expanded.capabilities],
-    allCapabilities: expanded?.expanded ?? false,
-    identityMode: canonicalIdentityMode(args.identity_mode ?? null),
-    sessionMintLanguage: args.session_mint_language ?? null,
-    embedding: args.embedding ?? null,
-    environment: environment.environment,
-    space,
-    cliVersion: CLI_VERSION,
-    ...theme === void 0 ? {} : { theme },
-    // The hosted server knows whether a live tenant has a paired sandbox, which decides how a live plan is verified.
-    ...context.credentialSource === "hosted" && context.tenantMode?.livemode === true ? { tenantPairedSandbox: context.tenantMode.paired } : {}
-  };
-  const plan = planIntegration(input);
-  if (plan.platformBlock) {
-    return refusal(
-      "PLATFORM_NOT_SUPPORTED",
-      "No plan can be produced for this project shape, whatever facts or capabilities are supplied. The React Native package is not a substitute for it and no other integration exists for it; the reason, who can unblock it and where to ask are below.",
-      {
-        project_type: plan.detected.projectType,
-        project_type_evidence: plan.detected.projectTypeEvidence,
-        reason: plan.platformBlock.reason,
-        unblock_owner: plan.platformBlock.unblockOwner,
-        request_path: plan.platformBlock.requestPath,
-        blocked: plan.blocked,
-        warnings: plan.warnings,
-        plan,
-        next_call: null
-      }
-    );
-  }
-  if (plan.status === "underspecified") {
-    return refusal(
-      "UNDERSPECIFIED_INTEGRATION",
-      "This plan cannot be produced without the facts below. Each one is the developer's to answer, and none is guessed here.",
-      {
-        ask: QUESTION_ROUND_INSTRUCTION,
-        missing_facts: plan.missingFacts.map((fact) => ({
-          fact: fact.fact,
-          ...fixedQuestion(fact.fact, space, fact.options ?? null) ?? {},
-          why: fact.reason,
-          how_to_supply: supplyOverMcp(fact.fact, space, fact.options ?? null, detected.detection),
-          // The CLI's own phrasing, kept so the two surfaces are visibly the same refusal and a partner
-          // moving between them recognises it.
-          how_to_supply_via_cli: fact.supplyWith,
-          // A fact needed only for some answers to another missing fact, asked in the same round (one question round,
-          // timed integration run 2026-09-26): ask it beside that fact, and it is unused for any other answer.
-          ...fact.requiredWhen === void 0 ? {} : { required_when: { fact: fact.requiredWhen.fact, one_of: [...fact.requiredWhen.oneOf] } }
-        })),
-        // Everything detection already knows, so the agent does not learn it only after the round trip.
-        warnings: plan.warnings,
-        next_call: {
-          tool: "everfur_plan_integration",
-          with: "the same arguments plus every missing fact above"
-        }
-      }
-    );
-  }
-  if (plan.status === "blocked") {
-    return refusal(
-      "CAPABILITIES_BLOCKED",
-      "Everything this integration asked for is blocked by the contract, so nothing can be built today. Each reason and who owns it are below; no plan works around a blocked surface.",
-      { blocked: plan.blocked, warnings: plan.warnings, plan, next_call: null }
-    );
-  }
-  const ready = mode.warning === null ? plan : { ...plan, warnings: [...plan.warnings, mode.warning] };
-  return {
-    isError: false,
-    document: { ok: true, plan: ready, ...environment.fromTenant ? { environment_source: "connected_tenant" } : {} }
-  };
-}
-var PLAN_OUTPUT_SHAPE = {
-  ...ENVELOPE_SHAPE,
-  plan_id: z.string().optional().describe("A digest of the plan's steps, the arguments it was asked with and the contract it was built from. Present when ok is true."),
-  plan: z.object({}).passthrough().optional().describe("The plan summary (kind everfur.plan.summary, summaryVersion 2): the goal, detection, what was supplied, each warning by its first sentence, every step by its id, title, one-line intent and page, the number of pages, and the checklist's requirements. Present when ok is true and neither page nor steps was given."),
-  fetch_steps: z.object({}).passthrough().optional().describe("With the summary: the call that returns its pages."),
-  page: z.number().int().optional().describe("With page: the page this response carries."),
-  pages: z.number().int().optional().describe("With page: how many pages the plan has."),
-  next_page: z.number().int().optional().describe("With page: the page to ask for next, absent on the last page."),
-  detected: z.object({}).passthrough().optional().describe("On page 1: what was detected in the project, in full, with the evidence for each fact."),
-  warnings: z.array(z.object({}).passthrough()).optional().describe("On page 1: every warning of the plan, in full."),
-  principles: z.array(z.object({}).passthrough()).optional().describe("On page 1: the principles of every decision tree the plan consulted, each by its title and the everfur://guide section that states it in full."),
-  checklist: z.array(z.object({}).passthrough()).optional().describe("On page 1: the definition of done in full, each requirement with the check that proves it and the steps it covers."),
-  steps: z.array(z.object({}).passthrough()).optional().describe("With page or steps: those steps in full, as everfur://schema/plan.v1 describes a step, each with the complete body of every file it writes."),
-  remaining_steps: z.array(z.string()).optional().describe("With steps: requested steps left out to keep this response small. The same call with steps set to these returns them."),
-  environment_source: z.literal("connected_tenant").optional().describe("Present when environment was omitted on the Everfur-hosted server and the plan targets the connected tenant's deployment.")
-};
-var VERIFY_EMBEDDING = z.enum(["in-page", "frame"]);
-var VERIFY_INPUT_SHAPE = {
-  user_ref: z.string().optional().describe("End-user id to mint the test session for. Defaults to a CLI-owned value."),
-  identity_mode: z.enum(VERIFY_IDENTITY_MODES).optional().describe(`The identity to verify with. "partner-user-ref" (the default): a signed session. "anonymous": the publishable key and a device session id derived from user_ref, exactly what an anonymous integration sends; nothing is minted, the verdict and the conversation list are read on that identity, and the tenant's sessions_required policy is reported (it refuses only a publishable-key caller that asserts x-everfur-user-ref; pure anonymous chat keeps working).`),
-  attempts: z.number().int().min(1).max(20).optional().describe("How many times to read the verdict before concluding it is empty."),
-  origin: z.string().optional().describe("The web page origin, e.g. https://shop.example.com: the origin an in-page page calls the API from, or the one the frame renders on. Pass embedding beside it. Adds the web checks: the CORS preflight (of a widget request with the headers the SDK sends for in-page, of the fence request for a frame), CORS exposure of X-Request-ID and Retry-After, whether the tenant requires signed sessions, and, for a frame, the embed fence for that origin and the loader pairing with the configured API."),
-  embedding: VERIFY_EMBEDDING.optional().describe('With origin: how the page embeds the surface, the embedding the plan was built on (its supplied.embedding, else its detected.webEmbedding). "frame" runs every web check; "in-page" reports the embed fence and the loader N/A, since only the frame uses them, and still checks CORS and the session policy. Not named, every web check runs: only a page named in-page has the fence and the loader N/A, and a project read locally whose page includes the Everfur loader is checked as the frame it embeds.'),
-  loader_url: z.string().optional().describe("With origin: the loader to probe instead of the one derived from EVERFUR_API_BASE_URL (https, or http on localhost). Without it a local or unrecognised API reports the loader check as not checked."),
-  surfaces: z.array(z.enum(SURFACES)).optional().describe("Surfaces to exercise with the minted session. chat and records: the diagnostics reason, then a read on the session. televet: mints a real vet visit handoff, on a SANDBOX tenant only (never a live one); the one-time token is never returned. theme: the branding the verdict carries, judged with the SDK's own rules, merged with the theme prop everfur_plan_integration writes when project_root or theme_source is given. A surface Everfur has not switched on is reported GATED, not FAIL. With identity_mode anonymous, chat is read on the anonymous identity and records and televet are skipped: both take a signed session only."),
-  project_root: z.string().optional().describe("Absolute path to the application root. Adds offline project checks: no partner secret key in source or client build output, no secret behind a NEXT_PUBLIC_/VITE_/EXPO_PUBLIC_ prefix, the secret read only by server code, 'use client' on Next.js App Router files importing the SDK, and that the env files name the same API host this verify ran against. File contents are never returned."),
-  theme_source: z.string().min(1).max(THEME_SOURCE_MAX_BYTES).optional().describe("With the theme surface: the same text everfur_plan_integration takes as theme_source (the project's tailwind config, the CSS that declares its theme, or a React Native theme or colours file). The branding is judged merged with the theme prop the plan writes from it, as the SDK merges them. Read statically and never executed; when given, it wins over project_root.")
-};
-var HOSTED_VERIFY_INPUT_SHAPE = {
-  user_ref: VERIFY_INPUT_SHAPE.user_ref.describe(
-    "A label for the synthetic test user this verification runs as: the session is minted for everfur-verify- and a stable id derived from the label, never for a real member. Defaults to a fixed label."
-  ),
-  identity_mode: VERIFY_INPUT_SHAPE.identity_mode,
-  attempts: VERIFY_INPUT_SHAPE.attempts,
-  origin: VERIFY_INPUT_SHAPE.origin,
-  embedding: VERIFY_INPUT_SHAPE.embedding,
-  loader_url: VERIFY_INPUT_SHAPE.loader_url.describe(
-    "With origin: the loader to probe instead of the one that pairs with the connected tenant's API. On this server it is accepted only on an Everfur SDK host."
-  ),
-  surfaces: VERIFY_INPUT_SHAPE.surfaces.describe(
-    "Surfaces to exercise with the minted session. chat and records: the diagnostics reason, then a read on the session. televet: mints a real vet visit handoff, on a SANDBOX tenant only (never a live one); the one-time token is never returned. theme: the branding the verdict carries, judged with the SDK's own rules, merged with the theme prop everfur_plan_integration writes when theme_source is given. A surface Everfur has not switched on is reported GATED, not FAIL. With identity_mode anonymous, chat is read on the anonymous identity and records and televet are skipped: both take a signed session only."
-  ),
-  theme_source: VERIFY_INPUT_SHAPE.theme_source.describe(
-    "With the theme surface: the same text everfur_plan_integration takes as theme_source (the project's tailwind config, the CSS that declares its theme, or a React Native theme or colours file). The branding is judged merged with the theme prop the plan writes from it, as the SDK merges them. Read statically and never executed."
-  )
-};
-async function verifyIntegrationTool(args, context, ports = {}) {
-  const built = clientFor(context, ports);
-  if (built.ok === false) {
-    return refusal("WIRE_NOT_CONFIGURED", "The API connection could not be configured.", { errors: built.errors });
-  }
-  const origin = args.origin === void 0 ? { origin: null, error: null } : parseOrigin(args.origin);
-  if (origin.error !== null) {
-    return refusal("INVALID_ORIGIN", origin.error, { origin: args.origin });
-  }
-  const loader = args.loader_url === void 0 ? { url: null, error: null } : parseLoaderUrl(args.loader_url);
-  if (loader.error !== null) {
-    return refusal("INVALID_LOADER_URL", loader.error, { loader_url: args.loader_url });
-  }
-  if (context.credentialSource === "hosted" && loader.url !== null && !isEverfurLoaderHost(loader.url)) {
-    return refusal(
-      "INVALID_LOADER_URL",
-      `On the hosted server loader_url must be on ${[...EVERFUR_LOADER_HOSTS].join(" or ")}; omit it to probe the loader that pairs with the API.`,
-      { loader_url: args.loader_url, allowed_hosts: [...EVERFUR_LOADER_HOSTS] }
-    );
-  }
-  if (context.credentialSource === "hosted" && args.identity_mode === "anonymous" && resolveCredential(context.env, PARTNER_KEY).status !== "present") {
-    return hostedPublishableKeyRefusal(context.env);
-  }
-  const verification = await runVerification({
-    client: built.client,
-    clock: ports.clock ?? systemClock,
-    env: context.env,
-    // On the hosted server, the synthetic test user the session was minted for (CLAUDE-CONN-18), never the raw name.
-    userRef: context.syntheticUserRef ?? args.user_ref ?? DEFAULT_VERIFY_USER_REF,
-    attempts: args.attempts ?? 3,
-    pollDelayMs: 500,
-    origin: origin.origin,
-    // Named, or read from project_root when one is given; otherwise the frame, which is what origin has always checked.
-    embedding: args.embedding ?? null,
-    loaderUrl: loader.url,
-    // The MCP server's documented environment holds no secret key, so it verifies only with a session the partner
-    // backend minted (EVERFUR_SESSION_TOKEN) and never reads EVERFUR_PARTNER_SECRET_KEY, even when one is set.
-    mintWithSecretKey: false,
-    // On the Everfur-hosted server the session was minted by the Everfur API for the signed-in sandbox tenant
-    // before this call, and the step reports that outcome in words that name no variable.
-    sessionSource: context.credentialSource ?? "env",
-    hostedMint: context.hostedMint ?? null,
-    transport: ports.transport ?? fetchTransport,
-    // Normalized the way the CLI's `--surfaces` parser does: contract order, duplicates collapsed, so
-    // `["televet","televet"]` mints one handoff and reports each step once.
-    surfaces: normalizeSurfaces(args.surfaces ?? []),
-    // A root that is not a directory is reported by the project checks as a FAIL step, not refused here.
-    project: args.project_root === void 0 ? null : { fs: nodeFileSystem, root: args.project_root },
-    // Anonymous verifies the path an anonymous integration uses: the publishable key and a derived session id.
-    identityMode: args.identity_mode ?? "partner-user-ref",
-    // A pasted theme wins over the project on disk, as it does for the plan; absent, the project's own (if any) is read.
-    // A theme prop literal is read as the prop; a theme_source nothing could be read from fails the theme check.
-    ...args.theme_source === void 0 ? {} : (() => {
-      const read = themePropFromSource(args.theme_source, "theme_source");
-      return { themeProp: read.prop, themeSourceUnread: read.unread };
-    })()
-  });
-  const result = {
-    ok: verification.status === "passed",
-    status: verification.status,
-    base_url: built.client.baseUrl,
-    steps: verification.steps,
-    // Attribution: a wrongly generated integration has to be traceable to the corpus revision that
-    // produced it, or a bad recommendation is unfalsifiable after the fact.
-    attribution: { cli_version: CLI_VERSION, verified_at: (/* @__PURE__ */ new Date()).toISOString() }
-  };
-  if (verification.status !== "failed") return { isError: false, document: result };
-  const failed = verification.steps.filter((step) => step.result === "FAIL");
-  return failedResult(result, "VERIFICATION_FAILED", "At least one verification step failed.", {
-    failed_steps: failed.map((step) => step.id),
-    request_id: failed.find((step) => step.requestId !== null)?.requestId ?? null
-  });
-}
-var VERIFY_OUTPUT_SHAPE = {
-  ...ENVELOPE_SHAPE,
-  status: z.enum(["passed", "failed", "incomplete"]).optional().describe("passed: every step PASS, GATED or N/A. incomplete: a step was skipped for a missing credential. failed: a step FAILED."),
-  base_url: z.string().optional().describe("The API base URL the checks ran against."),
-  steps: z.array(z.object({
-    id: z.string(),
-    title: z.string(),
-    result: z.enum(["PASS", "FAIL", "SKIP", "GATED", "N/A"]),
-    reason: z.string(),
-    requestId: z.string().nullable(),
-    details: z.array(z.string())
-  }).passthrough()).optional().describe("One entry per check, in the order they ran."),
-  attribution: z.object({ cli_version: z.string(), verified_at: z.string() }).passthrough().optional()
-};
-var DIAGNOSE_INPUT_SHAPE = {
-  bundle: z.boolean().optional().describe("Return one support bundle instead of the diagnosis alone: project and framework, @everfur/sdk and CLI versions, the contract digest, which credentials are set (names and public prefixes, never values), and the diagnosis with its request id. Produced whatever state the integration is in; give it to the developer for a support ticket."),
-  project_root: z.string().optional().describe("With bundle: absolute path to the application root to describe. Never defaulted; without it the bundle reports the project as not read.")
-};
-var HOSTED_DIAGNOSE_INPUT_SHAPE = {
-  bundle: DIAGNOSE_INPUT_SHAPE.bundle.describe(
-    "Return one support bundle instead of the diagnosis alone: the @everfur/sdk and CLI versions, the contract digest, which credentials the connected tenant resolved (names and public prefixes, never values), and the diagnosis with its request id. Produced whatever state the integration is in, for a support ticket. This server reads no project."
-  )
-};
-async function diagnoseTool(args, context, ports = {}) {
-  const built = clientFor(context, ports);
-  if (args.bundle === true) {
-    const bundle = await buildSupportBundle({
-      fs: nodeFileSystem,
-      root: args.project_root ?? null,
-      env: context.env,
-      cliVersion: CLI_VERSION,
-      client: built.ok ? built.client : null,
-      wireErrors: built.ok ? [] : built.errors,
-      // The MCP client is built without an error registry (see `clientFor`), so no projection was loaded
-      // for error codes. `null` is the truth here; the CLI reports the file it loaded.
-      contractSource: null,
-      contract: contractProviderFor(context, ports),
-      credentialSource: context.credentialSource ?? "env"
-    });
-    return { isError: false, document: { ok: true, bundle } };
-  }
-  if (built.ok === false) {
-    return refusal("WIRE_NOT_CONFIGURED", "The API connection could not be configured.", { errors: built.errors });
-  }
-  const auth = chooseWidgetAuth(context.env);
-  if (auth.ok === false) {
-    if (context.credentialSource === "hosted") return hostedPublishableKeyRefusal(context.env);
-    const { error } = auth.outcome.json;
-    return refusal("WIDGET_CREDENTIAL_UNUSABLE", error.message, {
-      // The CLI's own code and remedy lines, so the two surfaces are visibly the same refusal.
-      cli_error_code: error.code,
-      how_to_fix: [...error.details]
-    });
-  }
-  const result = await built.client.request({
-    method: "GET",
-    path: DIAGNOSTICS_PATH,
-    credentials: auth.auth.headers
-  });
-  if (!result.ok && result.kind === "http" && result.status === 404) {
-    return refusal(
-      "DIAGNOSTICS_NOT_DEPLOYED",
-      "This deployment does not serve GET /widget/v1/diagnostics, so the four causes of an empty entitlement verdict cannot be told apart here. This is a gap in the PLATFORM, not in the integration being diagnosed.",
-      {
-        // No internal planning reference (plan numbers, estimates, dependencies) belongs here: this goes to partners.
-        base_url: built.client.baseUrl,
-        meanwhile: "everfur_verify_integration hard-asserts a non-empty verdict and will still catch the most common failure, an unprovisioned tenant, without naming which of the four causes it is."
-      }
-    );
-  }
-  if (result.ok === false) {
-    const diagnosed = diagnoseFailure(result, auth.auth);
-    return refusal("DIAGNOSTICS_FAILED", `The diagnostics call did not succeed: ${diagnosed.summary}.`, {
-      cause: diagnosed.cause,
-      evidence: diagnosed.evidence,
-      remedy: diagnosed.nextAction,
-      kind: result.kind,
-      ...result.kind === "http" ? { status: result.status, code: result.code } : {},
-      request_id: result.requestId ?? null,
-      // Which credential actually asked the question. A 401 answered under `partner_key` says nothing
-      // about whether the bearer path would have worked, and the reverse.
-      auth_mode: auth.auth.mode
-    });
-  }
-  const parsed = parseDiagnostics(result.value, result.requestId);
-  if (parsed.ok === false) {
-    return refusal(
-      "DIAGNOSTICS_MALFORMED",
-      `${DIAGNOSTICS_PATH} answered ${result.status} with a body this CLI does not recognise.`,
-      {
-        detail: parsed.detail,
-        request_id: result.requestId ?? null,
-        base_url: built.client.baseUrl,
-        check: "that EVERFUR_API_BASE_URL points at the Everfur API and not at a proxy or a login page"
-      }
-    );
-  }
-  return {
-    isError: false,
-    document: {
-      ok: true,
-      diagnosis: buildDiagnosisDocument({
-        diagnosis: parsed.diagnosis,
-        baseUrl: built.client.baseUrl,
-        path: DIAGNOSTICS_PATH,
-        cliVersion: CLI_VERSION
-      }),
-      auth_mode: auth.auth.mode
-    }
-  };
-}
-var DIAGNOSE_OUTPUT_SHAPE = {
-  ...ENVELOPE_SHAPE,
-  diagnosis: z.object({}).passthrough().optional().describe("One reason per capability, shaped by everfur://schema/diagnosis.v1. Present when ok is true."),
-  auth_mode: z.string().optional().describe("Which credential asked the question."),
-  bundle: z.object({}).passthrough().optional().describe("The support bundle, when bundle: true was passed. Present whatever state the integration is in.")
-};
-var EXPLAIN_ERROR_INPUT_SHAPE = {
-  code: z.string().min(1).describe("The wire error code, exactly as the response carried it. CASE SENSITIVE: three naming families are live at once, so `authExpired` and `AuthorizationException` are two different 401s and `authexpired` is neither."),
-  contract_path: z.string().optional().describe("Path to a contract-public projection to read the registry from. Defaults to EVERFUR_CONTRACT_PUBLIC, then to the contract fetched from the Everfur API with EVERFUR_DOCS_KEY.")
-};
-var HOSTED_EXPLAIN_ERROR_INPUT_SHAPE = {
-  code: EXPLAIN_ERROR_INPUT_SHAPE.code
-};
-async function explainErrorTool(args, context, ports = {}) {
-  const code = args.code.trim();
-  const toolCode = toolCodeExplanation(code, CLI_VERSION);
-  if (toolCode !== null) {
-    const wire = await wireExplanationOf(code, args, context, ports);
-    if (wire === null) return { isError: false, document: { ok: true, explanation: toolCode } };
-    return { isError: false, document: { ok: true, explanation: withToolCodeBeside(code, wire) } };
-  }
-  const offline = resolveOffline(code);
-  if (offline?.kind === "sdk_member") return offlineExplanation(offline, "no_registry");
-  const contractPath = args.contract_path ?? context.env["EVERFUR_CONTRACT_PUBLIC"] ?? null;
-  let load;
-  if (contractPath === null) {
-    const fetched = await contractProviderFor(context, ports)();
-    if (fetched.kind === "unavailable") {
-      const resolved = resolveWithoutRegistry(code);
-      if (resolved.kind !== "unknown") return offlineExplanation(resolved, "no_registry");
-      return refusal(
-        "UNKNOWN_ERROR_CODE",
-        `"${code}" is not a code this server knows, so its cause and whether a retry can help are unknown here. The shape of the string does not say, and the code the response carried may differ from this one. The live error registry was not read, and it can list a code the tables inside this server predate.`,
-        {
-          did_you_mean: resolved.suggestions,
-          case_sensitive: true,
-          searched: {
-            source: "the SDK taxonomy, the SDK contract table, the MCP tools' codes, the diagnostics reason codes, the CLI's error codes and the SDK's sub-enums this server carries",
-            codes: knownCodes(null).length
-          },
-          registry: { read: false, reason: fetched.message }
-        }
-      );
-    }
-    load = loadErrorRegistryFromContract(fetched.contract);
-  } else {
-    load = loadErrorRegistry(nodeFileSystem, contractPath);
-  }
-  if (load.kind === "contract_rejected") {
-    return refusal(
-      "CONTRACT_UNUSABLE",
-      "The contract-public projection named for this call could not be used, so no code was looked up.",
-      {
-        path: contractPath,
-        reason: load.outcome.kind,
-        remedy: "run `everfur contract validate --path <file>` for the specific failure, or omit `contract_path` and unset EVERFUR_CONTRACT_PUBLIC to fetch the contract with EVERFUR_DOCS_KEY"
-      }
-    );
-  }
-  if (load.kind === "no_registry") {
-    return refusal("NO_ERROR_REGISTRY", `${load.path} carries no error registry.`, {
-      detail: "the projection has no `errors.yaml` document with an `errors` list; it was built before the registry was published, or it is a partial projection"
-    });
-  }
-  const entry = load.registry.lookup(code);
-  if (entry === null) {
-    const fallback = resolveAfterRegistryMiss(code, load.registry);
-    if (fallback.kind !== "unknown") return offlineExplanation(fallback, "registry_miss");
-    return refusal(
-      "UNKNOWN_ERROR_CODE",
-      `"${code}" is not in the error registry, so its cause and whether a retry can help are unknown here. The shape of the string does not say, and the code the response carried may differ from this one.`,
-      {
-        did_you_mean: fallback.suggestions,
-        case_sensitive: true,
-        searched: {
-          source: load.path,
-          digest: load.digest,
-          codes: load.registry.codes.length,
-          // The SDK taxonomy and the SDK contract table were searched too, so a reader knows the refusal is not
-          // just "this one file does not have it".
-          with_sdk_tables: knownCodes(load.registry).length,
-          // Of them, the codes the tools on this server return (tool-codes.ts).
-          mcp_tool_codes: TOOL_CODES.length
-        }
-      }
-    );
-  }
-  return {
-    isError: false,
-    document: {
-      ok: true,
-      explanation: {
-        ...buildExplanationDocument({
-          entry,
-          contractPath: load.path,
-          digest: load.digest,
-          cliVersion: CLI_VERSION
-        }),
-        ...registryAlsoIn(code)
-      }
-    }
-  };
-}
-async function wireExplanationOf(code, args, context, ports) {
-  const offline = resolveOffline(code);
-  if (offline !== null) return offlineDocument(offline, CLI_VERSION, "no_registry");
-  const contractPath = args.contract_path ?? context.env["EVERFUR_CONTRACT_PUBLIC"] ?? null;
-  let load;
-  if (contractPath === null) {
-    const fetched = await contractProviderFor(context, ports)();
-    if (fetched.kind === "unavailable") return null;
-    load = loadErrorRegistryFromContract(fetched.contract);
-  } else {
-    load = loadErrorRegistry(nodeFileSystem, contractPath);
-  }
-  if (load.kind !== "loaded") return null;
-  const entry = load.registry.lookup(code);
-  if (entry === null) return null;
-  return buildExplanationDocument({ entry, contractPath: load.path, digest: load.digest, cliVersion: CLI_VERSION });
-}
-function withToolCodeBeside(code, wire) {
-  const tool = toolCodeMeaning(code);
-  if (tool === null) return wire;
-  return {
-    ...wire,
-    collision: `"${code}" is both a code in the error registry and a code an Everfur MCP tool returns (${tool.tools.join(", ")}). This document explains the registry's code, the one a response from the Everfur API carries; the error.code of an everfur_* tool result is the tool code in mcpToolCode.`,
-    mcpToolCode: {
-      tools: [...tool.tools],
-      meaning: tool.meaning,
-      nextAction: tool.nextAction,
-      retryable: tool.retryable,
-      policyNextAction: tool.policyNextAction,
-      docsPath: tool.docsPath
-    }
-  };
-}
-function offlineExplanation(resolution, context) {
-  return { isError: false, document: { ok: true, explanation: offlineDocument(resolution, CLI_VERSION, context) } };
-}
-var EXPLAIN_ERROR_OUTPUT_SHAPE = {
-  ...ENVELOPE_SHAPE,
-  explanation: z.object({}).passthrough().optional().describe("The registry's explanation, shaped by everfur://schema/error-explanation.v1. Present when ok is true.")
-};
-var ACCESS_TOKEN_SHAPE = /^mcp_at_[0-9a-f]{64}$/;
-var CONTEXT_PATH = "/mcp/context";
-var CONTEXT_CACHE_TTL_MS = 15e3;
-var REFUSAL_CACHE_TTL_MS = 3e4;
-var MAX_CACHE_ENTRIES = 1e4;
-function isAccessTokenShaped(raw) {
-  return ACCESS_TOKEN_SHAPE.test(raw);
-}
-function tokenCacheKey(token) {
-  return createHash("sha256").update(token, "utf8").digest("hex");
-}
-var TOKEN_BUCKET_HEX_CHARS = 8;
-function tokenBucketOf(presented) {
-  return tokenCacheKey(presented).slice(0, TOKEN_BUCKET_HEX_CHARS);
-}
-var MCP_SCOPE = "mcp:tools";
-var REVOKED_AUTHORIZATION_REMEDY = "the authorization was revoked or expired since it was verified; reconnect the editor to sign in again";
-var ACCEPT_CONTEXT_WITHOUT_RESOURCE = false;
-var CONTEXT_WIRE_FIELDS = Object.freeze([
-  "tenant",
-  "user_id",
-  "publishable_key",
-  "api_base_url",
-  "scopes",
-  "expires_at",
-  "resource"
-]);
-Object.freeze([...CONTEXT_WIRE_FIELDS, "test"]);
-function canonicalResource(value) {
-  let parsed;
-  try {
-    parsed = new URL(value);
-  } catch {
-    return null;
-  }
-  let path = parsed.pathname;
-  while (path.endsWith("/")) path = path.slice(0, -1);
-  return `${parsed.origin}${path}${parsed.search}${parsed.hash}`;
-}
-function parseTestMode(value) {
-  if (value === void 0 || value === null) return { ok: true, test: null };
-  if (!isJsonObject(value)) return { ok: false };
-  const slug = value["slug"];
-  const publishableKey = value["publishable_key"];
-  if (typeof slug !== "string" || slug.length === 0) return { ok: false };
-  if (publishableKey !== null && typeof publishableKey !== "string") return { ok: false };
-  if (value["livemode"] !== false) return { ok: false };
-  return {
-    ok: true,
-    test: Object.freeze({
-      slug,
-      publishableKey: publishableKey === null || publishableKey.length === 0 ? null : publishableKey,
-      livemode: false
-    })
-  };
-}
-function parseTenantContext(body) {
-  if (!isJsonObject(body)) return null;
-  const tenant = body["tenant"];
-  if (!isJsonObject(tenant)) return null;
-  const clientId = tenant["client_id"];
-  const slug = tenant["slug"];
-  const livemode = tenant["livemode"];
-  const userId = body["user_id"];
-  const publishableKey = body["publishable_key"];
-  const apiBaseUrl = body["api_base_url"];
-  const scopes = body["scopes"];
-  const expiresAt = body["expires_at"];
-  const resource = body["resource"];
-  if (typeof clientId !== "string" || clientId.length === 0) return null;
-  if (typeof slug !== "string") return null;
-  if (typeof livemode !== "boolean") return null;
-  if (typeof userId !== "string" || userId.length === 0) return null;
-  if (publishableKey !== null && typeof publishableKey !== "string") return null;
-  if (typeof apiBaseUrl !== "string" || apiBaseUrl.length === 0) return null;
-  if (!Array.isArray(scopes) || !scopes.every((scope) => typeof scope === "string")) return null;
-  if (typeof expiresAt !== "string" || Number.isNaN(Date.parse(expiresAt))) return null;
-  if (resource !== void 0 && resource !== null && typeof resource !== "string") return null;
-  const test = parseTestMode(body["test"]);
-  if (!test.ok) return null;
-  return Object.freeze({
-    tenant: Object.freeze({ clientId, slug, livemode }),
-    userId,
-    publishableKey: publishableKey === null || publishableKey.length === 0 ? null : publishableKey,
-    apiBaseUrl,
-    scopes: Object.freeze([...scopes]),
-    expiresAt,
-    resource: typeof resource === "string" ? resource : null,
-    test: test.test
-  });
-}
-function createTtlCache(ttlMs, now, live) {
-  const entries = /* @__PURE__ */ new Map();
-  return {
-    get(key) {
-      const entry = entries.get(key);
-      if (entry === void 0) return null;
-      const at = now();
-      if (at - entry.at >= ttlMs() || !live(entry.value, at)) {
-        entries.delete(key);
-        return null;
-      }
-      return entry.value;
-    },
-    set(key, value) {
-      const at = now();
-      if (entries.size >= MAX_CACHE_ENTRIES) {
-        for (const [entryKey, entry] of entries) {
-          if (at - entry.at >= ttlMs() || !live(entry.value, at)) entries.delete(entryKey);
-        }
-        while (entries.size >= MAX_CACHE_ENTRIES) {
-          const oldest = entries.keys().next().value;
-          if (oldest === void 0) break;
-          entries.delete(oldest);
-        }
-      }
-      entries.set(key, { value, at });
-    },
-    delete(key) {
-      entries.delete(key);
-    }
-  };
-}
-var EXTRA_KEY = "everfur";
-function authInfoFrom(token, context, ownResource) {
-  return {
-    token,
-    // The context names the tenant this bearer acts for, not the editor's OAuth client id, which the
-    // backend does not return. The tenant is the principal every tool runs as, so it is the id kept here.
-    clientId: context.tenant.clientId,
-    scopes: [...context.scopes],
-    expiresAt: Math.floor(Date.parse(context.expiresAt) / 1e3),
-    // The audience the TOKEN names, already checked to be this server's own (`verifyWithBackend`); this server's own
-    // when the backend named none (the rollout case).
-    resource: new URL(context.resource ?? ownResource),
-    extra: { [EXTRA_KEY]: context }
-  };
-}
-function tenantContextOf(authInfo) {
-  const extra = authInfo?.extra;
-  if (extra === void 0) return null;
-  const context = extra[EXTRA_KEY];
-  if (typeof context !== "object" || context === null) return null;
-  const candidate = context;
-  return typeof candidate.userId === "string" && typeof candidate.apiBaseUrl === "string" && typeof candidate.tenant === "object" ? candidate : null;
-}
-function createHostedTokenVerifier(options) {
-  const endpoint = resolveEndpoint(null, { EVERFUR_API_BASE_URL: options.apiBaseUrl });
-  if (endpoint.ok === false) throw new Error(`the hosted verifier needs a usable API base URL: ${endpoint.errors.join("; ")}`);
-  const client = createApiClient({
-    transport: options.transport ?? fetchTransport,
-    clock: options.clock ?? systemClock,
-    endpoint: endpoint.endpoint,
-    ...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs }
-  });
-  const now = options.now ?? Date.now;
-  const ttlMs = options.cacheTtlMs ?? CONTEXT_CACHE_TTL_MS;
-  const refusalTtlMs = options.refusalTtlMs ?? REFUSAL_CACHE_TTL_MS;
-  const ownResource = canonicalResource(options.resource);
-  if (ownResource === null) throw new Error("the hosted verifier needs an absolute resource URL");
-  const acceptWithoutResource = options.acceptContextWithoutResource ?? ACCEPT_CONTEXT_WITHOUT_RESOURCE;
-  function expired(authInfo, at) {
-    return typeof authInfo.expiresAt !== "number" || Number.isNaN(authInfo.expiresAt) || authInfo.expiresAt * 1e3 <= at;
-  }
-  const verified = createTtlCache(() => ttlMs, now, (authInfo, at) => !expired(authInfo, at));
-  const refused = createTtlCache(() => refusalTtlMs, now, () => true);
-  const inflight = /* @__PURE__ */ new Map();
-  async function verifyWithBackend(token) {
-    const result = await client.request({
-      method: "GET",
-      path: CONTEXT_PATH,
-      credentials: { authorization: withPrefix(ephemeralCredential("editor access token", token), "Bearer ") }
-    });
-    if (result.ok === false) {
-      if (result.kind === "http" && result.status === 401) {
-        throw new InvalidTokenError("The Everfur API refused this access token.");
-      }
-      throw new TemporarilyUnavailableError("The Everfur API could not verify this access token.");
-    }
-    const context = parseTenantContext(result.value);
-    if (context === null) {
-      throw new TemporarilyUnavailableError("The Everfur API answered with a context this server does not recognise.");
-    }
-    if (context.resource === null) {
-      if (!acceptWithoutResource) {
-        throw new TemporarilyUnavailableError("The Everfur API answered with a context that names no resource.");
-      }
-    } else if (canonicalResource(context.resource) !== ownResource) {
-      throw new InvalidTokenError("The access token was not issued for this server.");
-    }
-    return authInfoFrom(token, context, options.resource);
-  }
-  return Object.freeze({
-    forget(token) {
-      verified.delete(tokenCacheKey(token));
-    },
-    async verifyAccessToken(token, context = {}) {
-      if (!isAccessTokenShaped(token)) {
-        throw new InvalidTokenError("The bearer is not an Everfur MCP access token.");
-      }
-      const key = tokenCacheKey(token);
-      const cached = verified.get(key);
-      if (cached !== null) return cached;
-      const refusal2 = refused.get(key);
-      if (refusal2 !== null) throw refusal2;
-      const budget = options.failureBudget;
-      if (budget !== void 0 && context.clientIp !== void 0 && budget.exhausted(context.clientIp, context.bucket ?? tokenBucketOf(token))) {
-        throw new TooManyRequestsError("Too many unauthenticated requests from this client; retry later.");
-      }
-      const pending = inflight.get(key);
-      if (pending !== void 0) return pending;
-      const verification = verifyWithBackend(token).then((authInfo) => {
-        if (expired(authInfo, now())) throw new InvalidTokenError("The access token has expired.");
-        verified.set(key, authInfo);
-        return authInfo;
-      }).catch((error) => {
-        if (error instanceof InvalidTokenError) refused.set(key, error);
-        throw error;
-      }).finally(() => {
-        inflight.delete(key);
-      });
-      inflight.set(key, verification);
-      return verification;
-    }
-  });
-}
-var JSON_MIME = "application/json";
-var MARKDOWN_MIME = "text/markdown";
-function projection(contract) {
-  return contract.validation.projection;
-}
-function sourceOf(contract) {
-  return { generated_at: contract.generatedAt, digest: contract.digest };
-}
-async function requireContract(provider) {
-  const load = await provider();
-  if (load.kind === "loaded") return load.contract;
-  throw new Error([`${load.message}.`, ...load.details].join(" "));
-}
-async function optionalContract(provider) {
-  const load = await provider();
-  return load.kind === "loaded" ? load.contract : null;
-}
-function json(value) {
-  return JSON.stringify(value, null, 2);
-}
-function contractDocument(contract, key) {
-  return json({
-    source: { ...sourceOf(contract), document: key },
-    ...projection(contract)[key] ?? {}
-  });
-}
-function errorRows(contract) {
-  const errors = projection(contract)["errors.yaml"]?.errors;
-  return Array.isArray(errors) ? errors.filter((row) => typeof row === "object" && row !== null && typeof row.code === "string") : [];
-}
-function errorCodes(contract) {
-  return errorRows(contract).map((row) => row.code).sort();
-}
-function readErrorEntry(contract, code) {
-  const row = errorRows(contract).find((entry) => entry.code === code);
-  return row === void 0 ? null : json({ source: sourceOf(contract), ...row });
-}
-function trees(contract) {
-  const load = loadDecisionSpaceFromContract(contract);
-  return load.kind === "loaded" ? load.space.trees : [];
-}
-function guideSections(contract) {
-  return trees(contract).map((tree) => tree.treeId).sort();
-}
-function renderOutcome(option) {
-  const { outcome } = option;
-  switch (outcome.kind) {
-    case "branch":
-      return `next question \`${outcome.nextQuestionId}\``;
-    case "blocked":
-      return `blocked: ${outcome.reason} (owner: ${outcome.unblockOwner})`;
-    case "terminal":
-      if (outcome.agentBlocked) {
-        return `answered with UI for the person's own tap; blocked for agents: ${outcome.agentBlocked.reason} (owner: ${outcome.agentBlocked.unblockOwner})`;
-      }
-      return outcome.thenAskTreeId === null ? "answered" : `answered, then section \`${outcome.thenAskTreeId}\``;
-  }
-}
-function renderTree(contract, tree) {
-  const lines = [`# ${tree.title}`, "", tree.decides, ""];
-  lines.push(`Source: contract generated ${contract.generatedAt}, digest ${contract.digest}.`, "");
-  if (tree.principles.length > 0) {
-    lines.push("## Principles", "");
-    for (const principle of tree.principles) {
-      lines.push(`### ${principle.title}`, "", principle.statement, "");
-      if (principle.docPath !== null) lines.push(`Reference: \`${principle.docPath}\``, "");
-    }
-  }
-  lines.push("## Questions", "");
-  for (const question of tree.questions) {
-    lines.push(`### ${question.prompt} (\`${question.id}\`)`, "", question.whyItIsAsked, "");
-    for (const option of question.options) {
-      lines.push(`- \`${option.id}\`, ${option.label}. ${option.when} Outcome: ${renderOutcome(option)}.`);
-    }
-    lines.push("");
-  }
-  return lines.join("\n");
-}
-function readGuideSection(contract, section) {
-  const tree = trees(contract).find((entry) => entry.treeId === section);
-  return tree === void 0 ? null : renderTree(contract, tree);
-}
-function stringField(row, key) {
-  const value = row[key];
-  return typeof value === "string" ? value : "";
-}
-function capabilityPacks(contract) {
-  const packs = projection(contract)["capabilities.yaml"]?.packs;
-  if (!Array.isArray(packs)) return [];
-  return packs.flatMap((pack) => {
-    if (typeof pack !== "object" || pack === null) return [];
-    const row = pack;
-    const id = stringField(row, "id");
-    if (id === "") return [];
-    const actions = Array.isArray(row["actions"]) ? row["actions"].flatMap((action) => typeof action === "object" && action !== null ? [`${stringField(action, "id")} ${stringField(action, "detail")}`] : []) : [];
-    return [{ id, title: stringField(row, "title"), actions }];
-  });
-}
-function searchableDocuments(contract) {
-  const errors = errorRows(contract).map((row) => ({
-    uri: `everfur://contract/errors/${encodeURIComponent(row.code)}`,
-    kind: "error",
-    id: row.code,
-    title: row.code,
-    summary: stringField(row, "note") || stringField(row, "display"),
-    text: [stringField(row, "display"), stringField(row, "note"), stringField(row, "naming_family"), String(row["http_status"] ?? "")].join(" ")
-  }));
-  const packs = capabilityPacks(contract).map((pack) => ({
-    uri: "everfur://contract/capabilities",
-    kind: "capability",
-    id: pack.id,
-    title: pack.title,
-    summary: pack.title,
-    text: pack.actions.join(" ")
-  }));
-  const guides = trees(contract).map((tree) => ({
-    uri: `everfur://guide/${tree.treeId}`,
-    kind: "guide",
-    id: tree.treeId,
-    title: tree.title,
-    summary: tree.decides,
-    text: renderTree(contract, tree)
-  }));
-  return [...errors, ...packs, ...guides];
-}
-function renderGuideIndex(contract) {
-  const lines = ["# Everfur integration guide", ""];
-  for (const tree of [...trees(contract)].sort((a, b) => a.treeId.localeCompare(b.treeId))) {
-    lines.push(`- [${tree.title}](everfur://guide/${tree.treeId}): ${tree.decides}`);
-  }
-  return `${lines.join("\n")}
-`;
-}
-var SCHEMAS = {
-  "plan.v1": { schema: plan_v1_schema_default, title: "Plan document schema" },
-  "diagnosis.v1": { schema: diagnosis_v1_schema_default, title: "Diagnosis document schema" },
-  "verification.v1": { schema: verification_v1_schema_default, title: "Verification document schema" },
-  "error-explanation.v1": { schema: error_explanation_v1_schema_default, title: "Error explanation document schema" }
-};
-function staticResources(provider) {
-  const contract = (key, slug, title, description) => ({
-    uri: `everfur://contract/${slug}`,
-    name: `contract-${slug}`,
-    title,
-    description,
-    mimeType: JSON_MIME,
-    read: async () => contractDocument(await requireContract(provider), key)
-  });
-  return [
-    contract(
-      "errors.yaml",
-      "errors",
-      "Wire error registry",
-      "Every error code the Everfur API emits: HTTP status, retryability, naming family, envelope."
-    ),
-    contract(
-      "capabilities.yaml",
-      "capabilities",
-      "Capability packs",
-      "Every capability: its entitlement key, actions, exposure, runtime gate and data class."
-    ),
-    contract(
-      "credentials.yaml",
-      "credentials",
-      "Credential shapes",
-      "The shape of each Everfur credential: prefix, length, holder, and redaction pattern. Never a key."
-    ),
-    contract(
-      "decision-trees.yaml",
-      "decision-trees",
-      "Integration decision trees",
-      "The decision trees everfur_plan_integration walks, as published."
-    ),
-    contract(
-      "action-classes.yaml",
-      "action-classes",
-      "Action classes and exposures",
-      "How each capability action is classified and whether an agent may perform it."
-    ),
-    {
-      uri: "everfur://guide",
-      name: "guide",
-      title: "Integration guide",
-      description: "The sections of the integration guide, one per decision tree.",
-      mimeType: MARKDOWN_MIME,
-      read: async () => renderGuideIndex(await requireContract(provider))
-    },
-    {
-      uri: "everfur://mcp/refusal-codes",
-      name: "mcp-refusal-codes",
-      title: "Tool refusal codes",
-      description: "Every error.code an Everfur MCP tool can return, with retryable, next_action and docs_path.",
-      mimeType: JSON_MIME,
-      read: async () => json({
-        next_actions: NEXT_ACTIONS,
-        codes: Object.entries(REFUSAL_POLICY).map(([code, policy]) => ({
-          code,
-          retryable: policy.retryable,
-          next_action: policy.nextAction,
-          docs_path: policy.docsPath
-        }))
-      })
-    },
-    ...Object.entries(SCHEMAS).map(([id, entry]) => ({
-      uri: `everfur://schema/${id}`,
-      name: `schema-${id}`,
-      title: entry.title,
-      description: `The JSON Schema for the ${id} document the tools return.`,
-      mimeType: "application/schema+json",
-      read: async () => json(entry.schema)
-    }))
-  ];
-}
-function registerResources(server, provider) {
-  const annotations = { audience: ["assistant"] };
-  for (const resource of staticResources(provider)) {
-    server.registerResource(
-      resource.name,
-      resource.uri,
-      { title: resource.title, description: resource.description, mimeType: resource.mimeType, annotations },
-      async (uri) => ({ contents: [{ uri: uri.href, mimeType: resource.mimeType, text: await resource.read() }] })
-    );
-  }
-  server.registerResource(
-    "contract-error",
-    new ResourceTemplate("everfur://contract/errors/{code}", {
-      list: async () => {
-        const contract = await optionalContract(provider);
-        return {
-          resources: (contract === null ? [] : errorCodes(contract)).map((code) => ({
-            uri: `everfur://contract/errors/${encodeURIComponent(code)}`,
-            name: code,
-            mimeType: JSON_MIME
-          }))
-        };
-      },
-      complete: {
-        code: async (value) => {
-          const contract = await optionalContract(provider);
-          return contract === null ? [] : errorCodes(contract).filter((code) => code.startsWith(value));
-        }
-      }
-    }),
-    {
-      title: "One wire error code",
-      description: "A single entry of the wire error registry. The code is case sensitive.",
-      mimeType: JSON_MIME,
-      annotations
-    },
-    async (uri, variables) => {
-      const code = decodeURIComponent(String(variables["code"] ?? ""));
-      const text = readErrorEntry(await requireContract(provider), code);
-      if (text === null) {
-        throw new Error(`"${code}" is not in the error registry; call everfur_explain_error for near misses.`);
-      }
-      return { contents: [{ uri: uri.href, mimeType: JSON_MIME, text }] };
-    }
-  );
-  server.registerResource(
-    "guide-section",
-    new ResourceTemplate("everfur://guide/{section}", {
-      list: async () => {
-        const contract = await optionalContract(provider);
-        return {
-          resources: (contract === null ? [] : trees(contract)).map((tree) => ({
-            uri: `everfur://guide/${tree.treeId}`,
-            name: `guide-${tree.treeId}`,
-            title: tree.title,
-            mimeType: MARKDOWN_MIME
-          }))
-        };
-      },
-      complete: {
-        section: async (value) => {
-          const contract = await optionalContract(provider);
-          return contract === null ? [] : guideSections(contract).filter((id) => id.startsWith(value));
-        }
-      }
-    }),
-    {
-      title: "Integration guide section",
-      description: "One section of the integration guide, rendered from its decision tree.",
-      mimeType: MARKDOWN_MIME,
-      annotations
-    },
-    async (uri, variables) => {
-      const section = String(variables["section"] ?? "");
-      const text = readGuideSection(await requireContract(provider), section);
-      if (text === null) {
-        throw new Error(`"${section}" is not a guide section; read everfur://guide for the list.`);
-      }
-      return { contents: [{ uri: uri.href, mimeType: MARKDOWN_MIME, text }] };
-    }
-  );
-}
-
-// src/mcp/connector-tools.ts
-var TIMESTAMP = z.string();
-var COUNT = z.number().int().min(0);
-var TENANT = z.object({ client_id: z.string(), slug: z.string(), livemode: z.boolean() });
-var CONNECTED_TENANT = z.object({
-  slug: z.string(),
-  livemode: z.boolean(),
-  paired_sandbox_slug: z.string().nullable(),
-  environment: z.string(),
-  publishable_key_prefix: z.string().nullable()
-});
-var TENANT_STATUS = z.object({
-  tenant: TENANT,
-  mode: z.object({
-    livemode: z.boolean(),
-    has_sandbox_pair: z.boolean(),
-    sandbox_client_slug: z.string().nullable(),
-    live_client_slug: z.string().nullable()
-  }),
-  plan: z.object({
-    revision: z.number().int(),
-    allowed_features: z.array(z.string()),
-    partner_can_enable: z.array(z.string()),
-    limits: z.array(z.object({ limit: z.string(), value: z.number().int().nullable(), in_use: z.number().int().nullable() }))
-  }).nullable(),
-  features: z.array(z.object({
-    feature: z.string(),
-    in_plan: z.boolean(),
-    enabled: z.boolean(),
-    partner_toggleable: z.boolean(),
-    can_disable: z.boolean(),
-    can_enable: z.boolean(),
-    surface_available: z.boolean()
-  })).nullable(),
-  embed_origins: z.object({ origins: z.array(z.string()), max_embed_origins: z.number().int().nullable() }),
-  entitlements: z.object({ capabilities: z.array(z.string()) }),
-  // The id and the first 12 characters, never the value: a longer "prefix" is refused as outside the shape rather
-  // than relayed, because it could be the key itself.
-  publishable_key: z.object({ key_id: z.string(), prefix: z.string().max(12) }).nullable(),
-  televet: z.object({ return_destination_keys: z.array(z.string()), booking_lead_minutes: z.number().int().nullable() })
-});
-var WEBHOOK_ENDPOINT = z.object({
-  endpoint_id: z.string(),
-  url: z.string(),
-  description: z.string().nullable(),
-  enabled_events: z.array(z.string()),
-  status: z.string(),
-  api_version: z.string(),
-  failing_since: TIMESTAMP.nullable(),
-  created_at: TIMESTAMP,
-  updated_at: TIMESTAMP
-});
-var WEBHOOK_DELIVERY = z.object({
-  delivery_id: z.string(),
-  event_id: z.string(),
-  endpoint_id: z.string(),
-  type: z.string(),
-  status: z.string(),
-  attempts: COUNT,
-  is_manual_resend: z.boolean(),
-  last_status_code: z.number().int().nullable(),
-  last_error_class: z.string().nullable(),
-  next_attempt_at: TIMESTAMP.nullable(),
-  succeeded_at: TIMESTAMP.nullable(),
-  created_at: TIMESTAMP,
-  updated_at: TIMESTAMP
-});
-var WEBHOOK_DELIVERY_DETAIL = WEBHOOK_DELIVERY.extend({
-  attempt_history: z.array(z.object({
-    attempt_no: z.number().int(),
-    started_at: TIMESTAMP,
-    duration_ms: COUNT,
-    status_code: z.number().int().nullable(),
-    error_class: z.string().nullable()
-  }))
-});
-var EVENT = z.object({ id: z.string(), type: z.string(), api_version: z.string(), created: z.number().int(), livemode: z.boolean() });
-var USAGE = z.object({
-  window_days: z.number().int(),
-  conversations: COUNT,
-  user_messages: COUNT,
-  active_users: COUNT,
-  last_activity_at: TIMESTAMP.nullable(),
-  generated_at: TIMESTAMP
-});
-var RECORDS_STATUS = z.object({
-  counts: z.array(z.object({ simple_status: z.string(), count: COUNT })),
-  total: COUNT,
-  generated_at: TIMESTAMP
-});
-var TENANT_SURFACE_NOT_ENABLED_CODE = "tenant_surface_not_enabled";
-var TENANT_RESOURCE_NOT_FOUND_CODE = "tenant_resource_not_found";
-var SURFACE_NAMES = Object.freeze({
-  status: "The tenant status read",
-  webhooks: "The webhooks surface",
-  records: "The records status read"
-});
-function failedRead(route, surface, failure) {
-  if (surface !== null && failure.kind === "http" && failure.status === 409 && failure.code === TENANT_SURFACE_NOT_ENABLED_CODE) {
-    return refusal(
-      "TENANT_SURFACE_NOT_ENABLED",
-      `${SURFACE_NAMES[surface]} is not switched on for the connected tenant, so there is nothing to read. This is a setting Everfur holds, not a fault in the caller, and the partner console's page for it is off for this tenant too.`,
-      { surface, request_id: failure.requestId }
-    );
-  }
-  if (failure.kind === "http" && failure.status === 404) {
-    const missingEntry = failure.code === TENANT_RESOURCE_NOT_FOUND_CODE;
-    return refusal(
-      "TENANT_READ_FAILED",
-      missingEntry ? `GET /mcp/tenant/${route} answered 404 ${TENANT_RESOURCE_NOT_FOUND_CODE}: there is no such entry on the connected tenant.` : `The Everfur API answered 404 for GET /mcp/tenant/${route} without naming an entry: this deployment does not serve the tenant reads (the hosted surface is dark there, or the route is not deployed yet).`,
-      { kind: "http", status: 404, ...failure.code === null ? {} : { code: failure.code }, request_id: failure.requestId }
-    );
-  }
-  return refusal("TENANT_READ_FAILED", `${describeFailure(failure)}.`, {
-    kind: failure.kind,
-    ...failure.kind === "http" ? { status: failure.status, ...failure.code === null ? {} : { code: failure.code } } : {},
-    request_id: failure.requestId,
-    ...failure.kind === "http" && failure.status === 401 ? { how_to_fix: [REVOKED_AUTHORIZATION_REMEDY] } : {}
-  });
-}
-async function readTenant(context, route, surface, schema, query = {}) {
-  const reads = context.tenantReads;
-  if (reads === void 0 || reads === null) {
-    throw new Error("a hosted read tool ran without the tenant reads of the hosted server");
-  }
-  const result = await reads(route, query);
-  if (result.ok === false) return { ok: false, result: failedRead(route, surface, result) };
-  const parsed = schema.safeParse(result.value);
-  if (!parsed.success) {
-    return {
-      ok: false,
-      result: refusal("TENANT_READ_MALFORMED", `GET /mcp/tenant/${route} answered a body outside its documented shape, so nothing from it is relayed.`, {
-        // Where the body departs from the shape, never what it holds there.
-        issues: parsed.error.issues.slice(0, 10).map((issue) => `${issue.path.join(".") || "(body)"}: ${issue.code}`),
-        request_id: result.requestId
-      })
-    };
-  }
-  return { ok: true, value: parsed.data };
-}
-var MASKED_WEBHOOK_PATH = "/\u2026";
-function webhookUrlForDisplay(url) {
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    return "";
-  }
-  const path = parsed.pathname === "" || parsed.pathname === "/" ? parsed.pathname : MASKED_WEBHOOK_PATH;
-  return `${parsed.protocol}//${parsed.host}${path}`;
-}
-function ok(document) {
-  return { isError: false, document: { ok: true, ...document } };
-}
-var PAGE_LIMIT = z.number().int().min(1).max(100).optional().describe("How many entries to return, 1 to 100 (20 when omitted).");
-var DELIVERY_STATUSES = ["pending", "succeeded", "failed", "dead", "skipped"];
-var TENANT_STATUS_TOOL = {
-  name: "everfur_get_tenant_status",
-  description: "Read the connected tenant's status: its plan and limits, which features are on and which it may switch, live or test mode and its paired tenant, its embed origins, the capabilities its account holds, its publishable key's id and prefix (never the key), and its Televet return destination keys and booking lead. Read-only.",
-  input: {},
-  output: {
-    ...ENVELOPE_SHAPE,
-    tenant_status: TENANT_STATUS.optional().describe("The status, as GET /mcp/tenant/status serves it."),
-    connected_tenant: CONNECTED_TENANT.optional().describe(
-      "When the status read is switched off for the tenant: which tenant is connected, from the sign-in itself."
-    ),
-    tenant_status_unavailable: z.object({ code: z.string(), message: z.string(), request_id: z.string().nullable() }).optional().describe("Why the status itself was not read, beside connected_tenant.")
-  },
-  async run(_args, context) {
-    const read = await readTenant(context, "status", "status", TENANT_STATUS);
-    if (read.ok) return ok({ tenant_status: read.value });
-    const error = read.result.document["error"];
-    const connected = context.connectedTenant ?? null;
-    if (connected === null || error?.code !== "TENANT_SURFACE_NOT_ENABLED") return read.result;
-    const deployment = environmentOfApi(connected.apiBaseUrl);
-    return ok({
-      connected_tenant: {
-        slug: connected.slug,
-        livemode: connected.livemode,
-        paired_sandbox_slug: connected.pairedSandboxSlug,
-        environment: deployment === "production" && !connected.livemode ? "test" : deployment ?? "unknown",
-        publishable_key_prefix: connected.publishableKeyPrefix
-      },
-      tenant_status_unavailable: {
-        code: "TENANT_SURFACE_NOT_ENABLED",
-        message: typeof error.message === "string" ? error.message : "",
-        request_id: typeof error.details?.request_id === "string" ? error.details.request_id : null
-      }
-    });
-  }
-};
-var WEBHOOK_ENDPOINTS_TOOL = {
-  name: "everfur_list_webhook_endpoints",
-  description: "List the connected tenant's webhook endpoints: each one's id, its URL without the query string, the event types it receives, its status and since when it has been failing. Never returns a signing secret. Read-only.",
-  input: {},
-  output: { ...ENVELOPE_SHAPE, endpoints: z.array(WEBHOOK_ENDPOINT).optional().describe("The endpoints, newest first.") },
-  async run(_args, context) {
-    const read = await readTenant(context, "webhook-endpoints", "webhooks", z.object({ data: z.array(WEBHOOK_ENDPOINT) }));
-    if (!read.ok) return read.result;
-    return ok({ endpoints: read.value.data.map((endpoint) => ({ ...endpoint, url: webhookUrlForDisplay(endpoint.url) })) });
-  }
-};
-var DELIVERIES_INPUT = {
-  endpoint_id: z.string().uuid().optional().describe("Only the deliveries to this endpoint."),
-  status: z.enum(DELIVERY_STATUSES).optional().describe("Only the deliveries in this status."),
-  type: z.string().min(1).max(64).optional().describe("Only the deliveries of this event type, such as visit.booked."),
-  cursor: z.string().min(1).max(512).optional().describe("The next_cursor of the previous page."),
-  limit: PAGE_LIMIT
-};
-var WEBHOOK_DELIVERIES_TOOL = {
-  name: "everfur_list_webhook_deliveries",
-  description: "List the connected tenant's webhook deliveries, newest first, optionally for one endpoint, status or event type: each delivery's status, attempts, last HTTP status and error class, and next retry. Never returns an event payload or the receiving server's response. Read-only.",
-  input: DELIVERIES_INPUT,
-  output: {
-    ...ENVELOPE_SHAPE,
-    deliveries: z.array(WEBHOOK_DELIVERY).optional().describe("The deliveries on this page."),
-    has_more: z.boolean().optional().describe("Whether another page follows."),
-    next_cursor: z.string().nullable().optional().describe("The cursor of the next page, or null.")
-  },
-  async run(args, context) {
-    const read = await readTenant(context, "webhook-deliveries", "webhooks", z.object({
-      data: z.array(WEBHOOK_DELIVERY),
-      has_more: z.boolean(),
-      next_cursor: z.string().nullable()
-    }), { endpoint_id: args.endpoint_id, status: args.status, type: args.type, cursor: args.cursor, limit: args.limit });
-    if (!read.ok) return read.result;
-    return ok({ deliveries: read.value.data, has_more: read.value.has_more, next_cursor: read.value.next_cursor });
-  }
-};
-var DELIVERY_INPUT = {
-  delivery_id: z.string().uuid().describe("The delivery's id, as everfur_list_webhook_deliveries returns it.")
-};
-var WEBHOOK_DELIVERY_TOOL = {
-  name: "everfur_get_webhook_delivery",
-  description: "Read one webhook delivery of the connected tenant with its attempt history: when each attempt started, how long it took, and its HTTP status and error class. Never returns the event payload. Read-only.",
-  input: DELIVERY_INPUT,
-  output: { ...ENVELOPE_SHAPE, delivery: WEBHOOK_DELIVERY_DETAIL.optional().describe("The delivery and its attempts.") },
-  async run(args, context) {
-    const read = await readTenant(context, `webhook-deliveries/${args.delivery_id}`, "webhooks", WEBHOOK_DELIVERY_DETAIL);
-    return read.ok ? ok({ delivery: read.value }) : read.result;
-  }
-};
-var EVENTS_INPUT = {
-  type: z.string().min(1).max(64).optional().describe("Only the events of this type, such as visit.booked."),
-  created_gte: z.string().datetime({ offset: true }).optional().describe("Only the events created at or after this ISO 8601 time."),
-  starting_after: z.string().regex(/^evt_[0-9a-f]{32}$/).optional().describe("The id of the last event of the previous page."),
-  limit: PAGE_LIMIT
-};
-var EVENTS_TOOL = {
-  name: "everfur_list_events",
-  description: "List the events Everfur emitted to the connected tenant, newest first, optionally of one type or since a time: each event's id, type, API version, creation time (Unix seconds) and mode. Never returns an event's member content. Read-only.",
-  input: EVENTS_INPUT,
-  output: {
-    ...ENVELOPE_SHAPE,
-    events: z.array(EVENT).optional().describe("The events on this page."),
-    has_more: z.boolean().optional().describe("Whether another page follows.")
-  },
-  async run(args, context) {
-    const read = await readTenant(context, "events", "webhooks", z.object({ data: z.array(EVENT), has_more: z.boolean() }), {
-      type: args.type,
-      created_gte: args.created_gte,
-      starting_after: args.starting_after,
-      limit: args.limit
-    });
-    if (!read.ok) return read.result;
-    return ok({ events: read.value.data, has_more: read.value.has_more });
-  }
-};
-var USAGE_INPUT = {
-  window_days: z.number().int().min(1).max(365).optional().describe("The trailing window in days, 1 to 365 (30 when omitted).")
-};
-var USAGE_TOOL = {
-  name: "everfur_get_usage_summary",
-  description: "Read the connected tenant's aggregate chat usage over a trailing window: conversations, user messages, active users and the time of the last activity. Counts only, no conversation content. Read-only.",
-  input: USAGE_INPUT,
-  output: { ...ENVELOPE_SHAPE, usage: USAGE.optional().describe("The usage summary.") },
-  async run(args, context) {
-    const read = await readTenant(context, "usage", null, USAGE, { window_days: args.window_days });
-    return read.ok ? ok({ usage: read.value }) : read.result;
-  }
-};
-var RECORDS_STATUS_TOOL = {
-  name: "everfur_get_records_status_summary",
-  description: "Count the connected tenant's records requests per simple status (requested, awaiting clinic, received, parsing, published, failed, revoked). Counts only, nothing about a request, a pet or a record. Read-only.",
-  input: {},
-  output: { ...ENVELOPE_SHAPE, records_status: RECORDS_STATUS.optional().describe("The counts, in lifecycle order.") },
-  async run(_args, context) {
-    const read = await readTenant(context, "records-status", "records", RECORDS_STATUS);
-    return read.ok ? ok({ records_status: read.value }) : read.result;
-  }
-};
-var MAX_SEARCH_RESULTS = 20;
-var DEFAULT_SEARCH_RESULTS = 5;
-var EXCERPT_CHARS = 240;
-var STOPWORDS = /* @__PURE__ */ new Set([
-  "a",
-  "an",
-  "and",
-  "are",
-  "as",
-  "at",
-  "be",
-  "by",
-  "can",
-  "do",
-  "does",
-  "for",
-  "from",
-  "how",
-  "i",
-  "in",
-  "is",
-  "it",
-  "my",
-  "of",
-  "on",
-  "or",
-  "the",
-  "to",
-  "what",
-  "when",
-  "where",
-  "which",
-  "why",
-  "with"
-]);
-function words(text) {
-  return text.toLowerCase().split(/[^a-z0-9]+/).filter((word) => word.length > 0);
-}
-function excerpt(text) {
-  const flat = text.replace(/\s+/g, " ").trim();
-  return flat.length <= EXCERPT_CHARS ? flat : `${flat.slice(0, EXCERPT_CHARS - 3).trimEnd()}...`;
-}
-function searchDocuments(documents, query, limit) {
-  const all = [...new Set(words(query))];
-  const meaningful = all.filter((word) => !STOPWORDS.has(word));
-  const terms = meaningful.length > 0 ? meaningful : all;
-  if (terms.length === 0) return [];
-  const scored = documents.flatMap((document, index) => {
-    const head = new Set(words(`${document.id} ${document.title}`));
-    const body = words(`${document.summary} ${document.text}`);
-    let matched = 0;
-    let weight = 0;
-    for (const term of terms) {
-      const inHead = head.has(term);
-      const inBody = body.filter((word) => word === term).length;
-      if (inHead || inBody > 0) matched += 1;
-      weight += (inHead ? 10 : 0) + Math.min(inBody, 5);
-    }
-    return matched === 0 ? [] : [{ document, matched, weight, index }];
-  });
-  scored.sort((a, b) => b.matched - a.matched || b.weight - a.weight || a.index - b.index);
-  return scored.slice(0, limit).map(({ document }) => ({
-    uri: document.uri,
-    kind: document.kind,
-    id: document.id,
-    title: document.title,
-    excerpt: excerpt(document.summary)
-  }));
-}
-var SEARCH_INPUT = {
-  query: z.string().min(2).max(200).describe("What to look for: an error code, a capability, or a few words about an integration question."),
-  limit: z.number().int().min(1).max(MAX_SEARCH_RESULTS).optional().describe(`How many results to return, 1 to ${MAX_SEARCH_RESULTS} (${DEFAULT_SEARCH_RESULTS} when omitted).`)
-};
-var SEARCH_DOCS_TOOL = {
-  name: "everfur_search_docs",
-  description: "Search the Everfur contract served to the connected partner: the error registry, the capability packs, and the integration guide rendered from its decision trees. Returns the matching entries, best first, each with the everfur:// resource that holds it in full. Read-only.",
-  input: SEARCH_INPUT,
-  output: {
-    ...ENVELOPE_SHAPE,
-    query: z.string().optional().describe("The query, as given."),
-    results: z.array(z.object({
-      uri: z.string(),
-      kind: z.enum(["error", "capability", "guide"]),
-      id: z.string(),
-      title: z.string(),
-      excerpt: z.string()
-    })).optional().describe("The matching entries, best first."),
-    contract: z.object({ digest: z.string(), generated_at: z.string() }).optional().describe("The contract revision searched.")
-  },
-  async run(args, context, ports) {
-    const load = await contractProviderFor(context, ports)();
-    if (load.kind === "unavailable") return contractRefusal(load);
-    const results = searchDocuments(searchableDocuments(load.contract), args.query, args.limit ?? DEFAULT_SEARCH_RESULTS);
-    return ok({ query: args.query, results, contract: { digest: load.contract.digest, generated_at: load.contract.generatedAt } });
-  }
-};
-var CONNECTOR_TOOLS = Object.freeze([
-  TENANT_STATUS_TOOL,
-  WEBHOOK_ENDPOINTS_TOOL,
-  WEBHOOK_DELIVERIES_TOOL,
-  WEBHOOK_DELIVERY_TOOL,
-  EVENTS_TOOL,
-  USAGE_TOOL,
-  RECORDS_STATUS_TOOL,
-  SEARCH_DOCS_TOOL
-]);
-function contractChoices(provider, treeId, questionId) {
-  return async () => {
-    const load = await provider();
-    if (load.kind !== "loaded") return [];
-    const space = loadDecisionSpaceFromContract(load.contract);
-    return space.kind === "loaded" ? space.space.choices(treeId, questionId) : [];
-  };
-}
-function startingWith(options) {
-  return async (value) => (await options()).filter((option) => option.startsWith(value ?? ""));
-}
-function completeList(options) {
-  return async (value) => {
-    const available = await options();
-    const parts = (value ?? "").split(",");
-    const last = (parts.pop() ?? "").trim();
-    const head = parts.map((part) => part.trim()).filter((part) => part.length > 0);
-    return available.filter((option) => option.startsWith(last) && !head.includes(option)).map((option) => [...head, option].join(","));
-  };
-}
-function knownArguments(args) {
-  const lines = [];
-  for (const [name, value] of Object.entries(args)) {
-    if (value === void 0 || value.trim() === "") continue;
-    if (name === "capabilities") {
-      const list = value.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0);
-      lines.push(`  ${name}: ${JSON.stringify(list)}`);
-    } else {
-      lines.push(`  ${name}: ${JSON.stringify(value.trim())}`);
-    }
-  }
-  return lines.length === 0 ? "" : `
-Pass these arguments, which I have already decided:
-${lines.join("\n")}
-`;
-}
-function sharedRules(options) {
-  const hosted = options.sessionSource === "hosted";
-  const project = hosted ? `- Describe the project with project_details (dependencies, package manager, file-presence markers; never source
-  files or credentials). This server runs on Everfur's hosts and cannot read a path on my machine. To match the
-  surface to my site's theme, pass theme_source: the text of my tailwind config or the CSS that declares my colors.` : `- Describe the project with project_root when the MCP server runs beside the project, or with project_details
-  (dependencies, package manager, file-presence markers; never source files or credentials) for a remote MCP, plus
-  theme_source (the text of my tailwind config or the CSS that declares my colors) so the plan matches my theme.`;
-  const session = hosted ? `- Verification runs with a session this server obtains from the Everfur API for my sandbox tenant; on a live
-  tenant the session step is GATED. Never ask me for a session, a key or a variable to set.` : "- Verification reads EVERFUR_SESSION_TOKEN, a short-lived session my backend minted; never ask for the secret key.";
-  const keys = hosted ? "- Never put a key in a tool argument, a file you write, or a message. This server holds none of mine." : "- Never put a key in a tool argument, a file you write, or a message. Keys come from the environment.";
-  return `
-Rules for every step:
-${project}
-${session}
-- Branch on error.code, error.retryable and error.next_action in a tool result, never on its message text.
-- When any Everfur response carries an error code, call everfur_explain_error with that exact code. If it
-  says the code is unknown, say so; do not explain it yourself.
-${keys}`;
-}
-var PROMPT_DESCRIPTIONS = Object.freeze({
-  integrateWeb: "Plan, write, build and verify an Everfur integration in a web project.",
-  integrateReactNative: "Plan, write, typecheck and verify an Everfur integration in a React Native or Expo app.",
-  diagnoseIntegration: "Explain an error code, read diagnostics and verify the wire, before changing any code."
-});
-function verifyCall(embedding, origin) {
-  const given = origin === void 0 || origin.trim() === "" ? null : origin.trim();
-  const pageOrigin = (where) => given === null ? `\`origin\` set to ${where} (ask me for it)` : `\`origin\` set to ${JSON.stringify(given)}`;
-  switch (embedding?.trim()) {
-    case "in-page":
-      return `Call everfur_verify_integration with \`embedding\` "in-page" and ${pageOrigin("the page origin the SDK runs on")}: the page calls the API from that origin, so the CORS preflight, the exposure and the session policy apply, and the frame's own checks (its embed fence and its loader) are reported N/A.`;
-    case "frame":
-      return `Call everfur_verify_integration with \`embedding\` "frame" and ${pageOrigin("the page origin the frame renders on")}.`;
-    default:
-      return `Call everfur_verify_integration with \`embedding\` set to the embedding the plan was built on (its \`supplied.embedding\`, else its \`detected.webEmbedding\`: "in-page" or "frame") and ${pageOrigin("the page origin")}. With "in-page" the frame's own checks (the embed fence and the loader) are reported N/A; the CORS checks apply to both.`;
-  }
-}
-function integrateWebPrompt(args, options = {}) {
-  const { origin, ...planArgs } = args;
-  return {
-    description: PROMPT_DESCRIPTIONS.integrateWeb,
-    text: `Integrate Everfur into this web project. Follow these steps in order.
-${knownArguments(planArgs)}
-1. Read everfur://guide/platform and everfur://guide/identity-mode.
-2. Call everfur_plan_integration. If it refuses with UNDERSPECIFIED_INTEGRATION, ask me the question of every fact in
-   error.details.missing_facts in one message, worded as given and with its options (a fact with required_when is
-   needed only for the answers it names: ask it beside them), then call it again with my answers. Do not guess them.
-   If the plan's match-theme step says the theme could not be read, do what it says: find this app's brand colors
-   in its own code (a Tailwind config, the CSS that declares its theme, or a React Native theme file) and call again
-   with that file's text as theme_source. Never pick a color.
-3. If it refuses with PLATFORM_NOT_SUPPORTED or CAPABILITIES_BLOCKED, tell me the reason and the owner from
-   error.details and stop. Do not build around a blocked surface.
-4. Call everfur_plan_integration again with the same arguments plus plan_id and page, for page 1 to the summary's
-   pages, for every step's full detail, commands and file bodies (with steps instead of page, call again with steps
-   set to remaining_steps until none remain). Then write exactly the files the plan's steps name and
-   run the commands it gives, in order.
-5. Build the project and fix any build error before going on.
-6. ${verifyCall(args.embedding, origin)} Report each step's result with its request id.
-7. If the capability verdict is empty, call everfur_diagnose and report the reason it gives per capability.
-8. Report every item of the plan's checklist with the result of its verify. The integration is done only when every
-   item holds.
-${sharedRules(options)}`
-  };
-}
-function integrateReactNativePrompt(args, options = {}) {
-  return {
-    description: PROMPT_DESCRIPTIONS.integrateReactNative,
-    text: `Integrate Everfur into this React Native app. Follow these steps in order.
-${knownArguments(args)}
-1. Read everfur://guide/platform and everfur://guide/identity-mode.
-2. Call everfur_plan_integration. If it refuses with UNDERSPECIFIED_INTEGRATION, ask me the question of every fact in
-   error.details.missing_facts in one message, worded as given and with its options (a fact with required_when is
-   needed only for the answers it names: ask it beside them), then call it again with my answers. Do not guess them.
-   If the plan's match-theme step says the theme could not be read, do what it says: find this app's brand colors
-   in its own code (a Tailwind config, the CSS that declares its theme, or a React Native theme file) and call again
-   with that file's text as theme_source. Never pick a color.
-3. If it refuses with PLATFORM_NOT_SUPPORTED or CAPABILITIES_BLOCKED, tell me the reason and the owner from
-   error.details and stop. Do not build around a blocked surface.
-4. Call everfur_plan_integration again with the same arguments plus plan_id and page, for page 1 to the summary's
-   pages, for every step's full detail, commands and file bodies (with steps instead of page, call again with steps
-   set to remaining_steps until none remain). Then write exactly the files the plan's steps name and
-   run the install commands it gives, in order.
-5. Typecheck the app and fix any error before going on.
-6. Call everfur_verify_integration. Report each step's result with its request id.
-7. If the capability verdict is empty, call everfur_diagnose and report the reason it gives per capability.
-8. Report every item of the plan's checklist with the result of its verify. The integration is done only when every
-   item holds.
-${sharedRules(options)}`
-  };
-}
-function diagnoseIntegrationPrompt(args, options = {}) {
-  const symptom = args.symptom?.trim() ? `
-What I see: ${args.symptom.trim()}
-` : "";
-  const code = args.error_code?.trim() ? `call everfur_explain_error with the code ${JSON.stringify(args.error_code.trim())}` : "if a response carried an error code, call everfur_explain_error with that exact code";
-  const requestId = args.request_id?.trim() ? ` The failing request id was ${JSON.stringify(args.request_id.trim())}; quote it in your report.` : "";
-  return {
-    description: PROMPT_DESCRIPTIONS.diagnoseIntegration,
-    text: `Diagnose my Everfur integration. Do not change any code until the cause is named.
-${symptom}
-1. First, ${code}, and follow its retryable flag and next action.
-2. Call everfur_diagnose to read one reason per capability for the configured credential.
-3. Call everfur_verify_integration and report each FAIL with its request id.${requestId}
-4. Tell me which cause applies, whether it is fixed in my integration or by Everfur, and the next action.
-${sharedRules(options)}`
-  };
-}
-function userMessage(prompt) {
-  return { description: prompt.description, messages: [{ role: "user", content: { type: "text", text: prompt.text } }] };
-}
-function registerPrompts(server, provider, options = {}) {
-  const capabilities = contractChoices(provider, CAPABILITIES_TREE, CAPABILITY_QUESTION);
-  const identityModes = contractChoices(provider, IDENTITY_TREE, IDENTITY_QUESTION);
-  const embeddings = contractChoices(provider, PLATFORM_TREE, WEB_EMBEDDING_QUESTION);
-  const projectRoot = options.sessionSource === "hosted" ? {} : {
-    project_root: z.string().optional().describe(
-      "Absolute path to the project, for a local MCP. A remote MCP cannot read it; pass project_details to everfur_plan_integration instead."
-    )
-  };
-  const capabilityList = () => completable(
-    z.string().optional().describe("Comma-separated capabilities, as the contract names them."),
-    completeList(capabilities)
-  );
-  const identityMode = () => completable(
-    z.string().optional().describe("How end users are named, as the contract names the identity modes."),
-    startingWith(identityModes)
-  );
-  const environment = () => completable(
-    z.string().optional().describe(`The Everfur deployment the configuration targets, one of: ${ENVIRONMENTS.join(", ")}.`),
-    startingWith(async () => ENVIRONMENTS)
-  );
-  server.registerPrompt(
-    "integrate-web",
-    {
-      title: "Integrate Everfur into a web project",
-      description: PROMPT_DESCRIPTIONS.integrateWeb,
-      argsSchema: {
-        ...projectRoot,
-        capabilities: capabilityList(),
-        identity_mode: identityMode(),
-        embedding: completable(
-          z.string().optional().describe("How the surface is embedded, as the contract names the embedding modes."),
-          startingWith(embeddings)
-        ),
-        environment: environment(),
-        origin: z.string().optional().describe(
-          "The page origin, e.g. https://shop.example.com: where the SDK runs (embedding in-page) or where the frame renders (embedding frame). Verification passes it with the embedding and runs the CORS checks against it; with in-page the frame's own checks (the embed fence and the loader) are reported N/A."
-        )
-      }
-    },
-    (args) => userMessage(integrateWebPrompt(args, options))
-  );
-  server.registerPrompt(
-    "integrate-react-native",
-    {
-      title: "Integrate Everfur into a React Native app",
-      description: PROMPT_DESCRIPTIONS.integrateReactNative,
-      argsSchema: {
-        ...projectRoot,
-        capabilities: capabilityList(),
-        identity_mode: identityMode(),
-        environment: environment()
-      }
-    },
-    (args) => userMessage(integrateReactNativePrompt(args, options))
-  );
-  server.registerPrompt(
-    "diagnose-integration",
-    {
-      title: "Diagnose an Everfur integration",
-      description: PROMPT_DESCRIPTIONS.diagnoseIntegration,
-      argsSchema: {
-        error_code: completable(
-          z.string().optional().describe("The error code a response carried, exactly as it appeared."),
-          async (value) => {
-            const load = await provider();
-            return load.kind === "loaded" ? errorCodes(load.contract).filter((code) => code.startsWith(value ?? "")) : [];
-          }
-        ),
-        request_id: z.string().optional().describe("The request id of the failing call, when known."),
-        symptom: z.string().optional().describe("What the developer sees, in their own words.")
-      }
-    },
-    (args) => userMessage(diagnoseIntegrationPrompt(args, options))
-  );
-}
-var DEADLINE_MS = 3e4;
-var CONVERSATION_PAGE = 100;
-var MESSAGE_PAGE = 200;
-var DEFAULT_TEST_PET_REF = "everfur-mcp-test-pet";
-var PET_PROFILE_SHAPE = z.object({
-  name: z.string().min(1).max(100).optional().describe("The pet's name."),
-  species: z.string().min(1).max(50).optional().describe("Species, e.g. dog or cat."),
-  breed: z.string().min(1).max(100).optional().describe("Breed."),
-  age_years: z.number().min(0).max(50).optional().describe("Age in years."),
-  weight_kg: z.number().min(0).max(500).optional().describe("Weight in kilograms.")
-}).strict();
-function sendTestUserRef(idempotencyKey) {
-  return `${SYNTHETIC_USER_REF_PREFIX}${uuidFromKey(idempotencyKey)}`;
-}
-function sendTestConversationTitle(idempotencyKey) {
-  return `everfur-mcp-test-${uuidFromKey(idempotencyKey)}`;
-}
-function frameOf(block) {
-  const line = block.split("\n").find((l) => l.startsWith("data:"));
-  if (line === void 0) return null;
-  const raw = line.slice(5).trim();
-  if (raw.length === 0) return null;
-  try {
-    const parsed = JSON.parse(raw);
-    if (typeof parsed !== "object" || parsed === null) return { kind: "unknown" };
-    const obj = parsed;
-    if (typeof obj["token"] === "string") return { kind: "delta", text: obj["token"] };
-    if (typeof obj["status"] === "string") return { kind: `status:${obj["status"]}` };
-    if (obj["error"] !== void 0 || typeof obj["code"] === "string") {
-      return {
-        kind: "error",
-        ...typeof obj["code"] === "string" ? { code: obj["code"] } : {},
-        ...typeof obj["retryable"] === "boolean" ? { retryable: obj["retryable"] } : {}
-      };
-    }
-    if (obj["done"] === true) return { kind: "done" };
-    if (obj["metadata"] === true) return { kind: "metadata" };
-    return { kind: "unknown" };
-  } catch {
-    return { kind: "malformed" };
-  }
-}
-var SEND_TEST_MESSAGE_OUTPUT_SHAPE = {
-  ...ENVELOPE_SHAPE,
-  livemode: z.literal(false).optional().describe("Always false on a result: the tool refuses before sending to anything but a sandbox tenant."),
-  replayed: z.boolean().optional().describe("True when an earlier call with this idempotency_key already asked this and its stored answer is returned."),
-  identity: z.enum(["hosted_session", "session_token", "anonymous"]).optional().describe("Which identity asked: hosted_session, a session the Everfur API minted for a synthetic test user of this sandbox tenant; session_token, a session the partner backend minted and this server was given; anonymous, the publishable key and a derived session id."),
-  pet_ref: z.string().optional().describe("The pet the conversation is scoped to, when one was named or registered."),
-  pet_registered: z.boolean().optional().describe("True when pet_profile was registered for this identity before the send."),
-  conversation_id: z.string().optional(),
-  answer: z.string().optional().describe("The answer text, streamed now or replayed from the stored turn."),
-  frame_histogram: z.record(z.number()).optional().describe("How many frames of each kind the stream carried. Absent on a replay."),
-  elapsed_ms: z.number().optional()
-};
-function petProfileBody(profile) {
-  const body = {};
-  for (const key of ["name", "species", "breed", "age_years", "weight_kg"]) {
-    const value = profile[key];
-    if (value !== void 0) body[key] = value;
-  }
-  return body;
-}
-function failureFacts(failure) {
-  return failure.kind === "http" ? { status: failure.status, ...failure.code === null ? {} : { code: failure.code }, request_id: failure.requestId } : { kind: failure.kind };
-}
-function isObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-var CHAT_CAPABILITY = "chat.message.create";
-function isCapabilityEnabled(entry) {
-  return isObject(entry) && entry["enabled"] === true;
-}
-function capabilityReasonCode(entry) {
-  if (!isObject(entry)) return null;
-  const code = entry["reason_code"];
-  return typeof code === "string" && code.length > 0 ? code : null;
-}
-function availableCapabilities(map) {
-  return Object.keys(map).filter((key) => isCapabilityEnabled(map[key])).sort();
-}
-function unavailableCapabilities(map) {
-  const groups = {};
-  for (const key of Object.keys(map).sort()) {
-    if (isCapabilityEnabled(map[key])) continue;
-    const code = capabilityReasonCode(map[key]) ?? "unknown";
-    (groups[code] ??= []).push(key);
-  }
-  return groups;
-}
-var INCOMPLETE_STREAM_SENTINEL = "Something interrupted my response. Could you ask again?";
-function storedAnswer(content) {
-  if (typeof content !== "string") return null;
-  const trimmed = content.trim();
-  if (trimmed === "" || trimmed.startsWith(INCOMPLETE_STREAM_SENTINEL)) return null;
-  return content;
-}
-async function findPriorTurn(client, auth, message, petRef, conversationTitle) {
-  const listed = await client.request({
-    method: "GET",
-    path: `/widget/v1/conversations?limit=${CONVERSATION_PAGE}${petRef === null ? "" : `&pet_ref=${encodeURIComponent(petRef)}`}`,
-    ...auth
-  });
-  if (listed.ok === false) {
-    if (petRef !== null && listed.kind === "http" && listed.status === 404) {
-      return {
-        ok: false,
-        result: refusal("PET_NOT_REGISTERED", "The pet is not registered for this identity: the conversation list scoped to it answered 404. Nothing was sent.", {
-          pet_ref: petRef,
-          how_to_fix: "Pass pet_profile, which registers it for this identity.",
-          ...failureFacts(listed)
-        })
-      };
-    }
-    return {
-      ok: false,
-      result: refusal(
-        "CONVERSATIONS_UNREADABLE",
-        "Could not list the conversations this idempotency_key already opened, so a send could repeat an earlier one. Refusing rather than sending twice.",
-        failureFacts(listed)
-      )
-    };
-  }
-  const rows = isObject(listed.value) && Array.isArray(listed.value["conversations"]) ? listed.value["conversations"] : [];
-  let emptyConversationId = null;
-  for (const row of rows) {
-    const conversationId = isObject(row) ? row["conversation_id"] : void 0;
-    if (typeof conversationId !== "string") continue;
-    const rowPet = isObject(row) && typeof row["pet_ref"] === "string" && row["pet_ref"].length > 0 ? row["pet_ref"] : null;
-    if (rowPet !== null && rowPet !== petRef) continue;
-    if (conversationTitle !== null && (!isObject(row) || row["title"] !== conversationTitle)) continue;
-    const read = await client.request({
-      method: "GET",
-      path: `/widget/v1/conversations/${encodeURIComponent(conversationId)}/messages?limit=${MESSAGE_PAGE}`,
-      ...auth
-    });
-    if (read.ok === false) {
-      return {
-        ok: false,
-        result: refusal(
-          "CONVERSATIONS_UNREADABLE",
-          "Could not read a conversation this idempotency_key already opened, so a send could repeat an earlier one. Refusing rather than sending twice.",
-          { conversation_id: conversationId, ...failureFacts(read) }
-        )
-      };
-    }
-    const messages = (isObject(read.value) && Array.isArray(read.value["messages"]) ? read.value["messages"] : []).filter(isObject);
-    if (messages.length === 0) {
-      emptyConversationId ??= conversationId;
-      continue;
-    }
-    const question = messages.findIndex((m) => m["role"] === "user");
-    const asked = messages[question]?.["content"];
-    if (typeof asked !== "string" || asked.trim() !== message.trim()) continue;
-    const reply = messages.slice(question + 1).find((m) => m["role"] === "assistant");
-    const answer = storedAnswer(reply?.["content"]);
-    return {
-      ok: true,
-      prior: {
-        conversationId,
-        answer,
-        unanswered: answer !== null ? null : typeof reply?.["content"] === "string" ? "interrupted" : "pending"
-      },
-      emptyConversationId
-    };
-  }
-  return { ok: true, prior: null, emptyConversationId };
-}
-async function resolveIdentity(args, env, identity) {
-  if (identity.hostedMint !== void 0 && identity.hostedMint !== null) {
-    const minted = await identity.hostedMint();
-    const outcome = minted.outcome;
-    if (outcome.kind === "minted" && minted.sessionToken !== null) {
-      return {
-        ok: true,
-        identity: {
-          kind: "hosted_session",
-          auth: { headers: {}, credentials: { authorization: withPrefix(ephemeralCredential("hosted test session", minted.sessionToken), "Bearer ") } },
-          conversationTitle: null
-        }
-      };
-    }
-    if (outcome.kind === "gated") {
-      return {
-        ok: false,
-        result: refusal(
-          "NOT_A_SANDBOX_TENANT",
-          "This tool sends a REAL message and only runs against a sandbox tenant, and the signed-in tenant is live. Refusing: a test message landing in a tenant that holds real veterinary records is not recoverable by deleting it afterwards.",
-          { livemode: true, request_id: outcome.requestId }
-        )
-      };
-    }
-    const failure = outcome.kind === "failed" ? outcome.failure : void 0;
-    return {
-      ok: false,
-      result: refusal("SESSION_NOT_MINTED", "The Everfur API did not mint a session for this sandbox tenant, so nothing was sent.", {
-        reason: outcome.kind === "failed" ? outcome.reason : "the Everfur API reported a minted session without the session itself",
-        details: outcome.kind === "failed" ? [...outcome.details] : [],
-        request_id: outcome.requestId,
-        ...failure === void 0 ? {} : failure.kind === "http" ? { status: failure.status, ...failure.code === null ? {} : { code: failure.code } } : { kind: failure.kind }
-      })
-    };
-  }
-  const session = resolveCredential(env, SESSION_TOKEN);
-  if (session.status === "present" && session.credential !== null) {
-    return {
-      ok: true,
-      identity: {
-        kind: "session_token",
-        auth: { headers: {}, credentials: { authorization: withPrefix(session.credential, "Bearer ") } },
-        // The session names its own user, so the key cannot scope the identity; it scopes the conversations instead.
-        conversationTitle: sendTestConversationTitle(args.idempotency_key)
-      }
-    };
-  }
-  if (session.status === "malformed") {
-    return { ok: false, result: refusal("WIDGET_CREDENTIAL_UNUSABLE", `${session.reason ?? `${SESSION_TOKEN.envVar} is malformed`}.`) };
-  }
-  const partnerKey = resolveCredential(env, PARTNER_KEY);
-  if (partnerKey.status === "absent" || partnerKey.credential === null) {
-    if (partnerKey.status === "malformed") {
-      return { ok: false, result: refusal("PARTNER_KEY_MALFORMED", `${partnerKey.reason ?? `${PARTNER_KEY.envVar} is malformed`}.`) };
-    }
-    return { ok: false, result: refusal("NO_PARTNER_KEY", `Set ${PARTNER_KEY.envVar} to the publishable key of the sandbox tenant.`) };
-  }
-  return {
-    ok: true,
-    identity: {
-      kind: "anonymous",
-      auth: {
-        headers: { "x-everfur-session-id": uuidFromKey(args.idempotency_key) },
-        credentials: { "x-everfur-partner-key": partnerKey.credential }
-      },
-      conversationTitle: null
-    }
-  };
-}
-async function sendTestMessage(args, env, ports = {}, identitySources = {}) {
-  const endpoint = resolveEndpoint(null, env);
-  if (endpoint.ok === false) {
-    return refusal("WIRE_NOT_CONFIGURED", "The API connection could not be configured.", {
-      errors: endpoint.errors
-    });
-  }
-  const resolved = await resolveIdentity(args, env, identitySources);
-  if (resolved.ok === false) return resolved.result;
-  const identity = resolved.identity;
-  const petRef = args.pet_ref ?? (args.pet_profile === void 0 ? null : DEFAULT_TEST_PET_REF);
-  const transport = ports.transport ?? fetchTransport;
-  const clock = ports.clock ?? systemClock;
-  const client = createApiClient({ transport, clock, endpoint: endpoint.endpoint });
-  const streamClient = createApiClient({ transport, clock, endpoint: endpoint.endpoint, timeoutMs: DEADLINE_MS });
-  const auth = identity.auth;
-  const verdict = await client.request({ method: "GET", path: "/widget/v1/entitlements", ...auth });
-  if (verdict.ok === false) {
-    return refusal("ENTITLEMENTS_UNREADABLE", "Could not read the entitlement verdict, so the sandbox status of this tenant is unknown. Refusing rather than guessing.", failureFacts(verdict));
-  }
-  const body = isObject(verdict.value) ? verdict.value : {};
-  if (body.livemode !== false) {
-    return refusal(
-      "NOT_A_SANDBOX_TENANT",
-      "This tool sends a REAL message and only runs against a sandbox tenant. This key resolves to a tenant reporting livemode true, or to a deployment that does not report livemode at all. Refusing: a test message landing in a tenant that holds real veterinary records is not recoverable by deleting it afterwards.",
-      {
-        livemode: body.livemode ?? null,
-        // A sandbox is a TENANT, and the verdict is the authority: a sandbox tenant is issued a pk_test_ key (EFBackend
-        // #1630), an older one may still carry pk_live_, and either way its verdict reports livemode false
-        // (commands/plan/environment.ts).
-        // `everfur sandbox create` is Everfur-internal (it needs an admin token), so it is no partner's remedy; the
-        // documented path is the partner docs' testing page (tester run, 2026-10-01).
-        how_to_fix: 'Use the publishable key of a sandbox tenant: its key starts pk_test_ (a sandbox created before pk_test_ keys may still carry pk_live_), and its entitlements report livemode false. How a sandbox is created, and how a live tenant reaches its paired sandbox, is in docs/partner/10-TESTING.md ("Your sandbox and your live tenant").'
-      }
-    );
-  }
-  const capabilities = isObject(body.capabilities) ? body.capabilities : {};
-  const chat = capabilities[CHAT_CAPABILITY];
-  if (!isCapabilityEnabled(chat)) {
-    const listed = Object.prototype.hasOwnProperty.call(capabilities, CHAT_CAPABILITY);
-    const reasonCode = capabilityReasonCode(chat);
-    const facts = {
-      capability: CHAT_CAPABILITY,
-      reason_code: reasonCode,
-      available: availableCapabilities(capabilities),
-      unavailable: unavailableCapabilities(capabilities)
-    };
-    if (!listed) {
-      return refusal("CHAT_NOT_GRANTED", `This sandbox tenant does not grant ${CHAT_CAPABILITY}, so a message would be refused by the server.`, facts);
-    }
-    return refusal("CHAT_NOT_GRANTED", `This sandbox tenant is granted ${CHAT_CAPABILITY} and the verdict reports it switched off, so a message would be refused by the server.`, {
-      ...facts,
-      how_to_fix: nextActionFor(reasonCode ?? "unknown")
-    });
-  }
-  if (args.pet_profile !== void 0 && petRef !== null) {
-    const registered = await client.request({
-      method: "POST",
-      path: `/widget/v1/pets/${encodeURIComponent(petRef)}`,
-      body: petProfileBody(args.pet_profile),
-      ...auth
-    });
-    if (registered.ok === false) {
-      return refusal("PET_NOT_REGISTERED", "Could not register the sandbox pet, so nothing was sent.", {
-        pet_ref: petRef,
-        ...failureFacts(registered)
-      });
-    }
-  }
-  const lookup = await findPriorTurn(client, auth, args.message, petRef, identity.conversationTitle);
-  if (lookup.ok === false) return lookup.result;
-  const scope = { identity: identity.kind, ...petRef === null ? {} : { pet_ref: petRef } };
-  if (lookup.prior !== null) {
-    if (lookup.prior.answer === null && lookup.prior.unanswered === "interrupted") {
-      return refusal("PRIOR_TURN_INTERRUPTED", "An earlier call with this idempotency_key already sent this message and no answer was stored for it. Sending again would put the question in twice, so nothing was sent.", {
-        conversation_id: lookup.prior.conversationId,
-        how_to_fix: "To ask again, call with a new idempotency_key: the same key returns this turn instead of sending the message a second time."
-      });
-    }
-    if (lookup.prior.answer === null) {
-      return refusal("PRIOR_TURN_UNANSWERED", "An earlier call with this idempotency_key already sent this message and no answer was stored for it. Sending again would put the question in twice, so nothing was sent.", {
-        conversation_id: lookup.prior.conversationId,
-        how_to_fix: "Wait for the earlier answer and call again, or use a new idempotency_key to ask again."
-      });
-    }
-    return {
-      isError: false,
-      document: {
-        ok: true,
-        livemode: false,
-        replayed: true,
-        conversation_id: lookup.prior.conversationId,
-        answer: lookup.prior.answer,
-        ...scope,
-        ...args.pet_profile === void 0 ? {} : { pet_registered: true }
-      }
-    };
-  }
-  let conversationId = lookup.emptyConversationId;
-  if (conversationId === null) {
-    const created = await client.request({
-      method: "POST",
-      path: "/widget/v1/conversations",
-      body: {
-        ...petRef === null ? {} : { pet_ref: petRef },
-        ...identity.conversationTitle === null ? {} : { title: identity.conversationTitle }
-      },
-      ...auth
-    });
-    if (created.ok === false) {
-      return refusal("CONVERSATION_NOT_CREATED", "Could not open a conversation.", failureFacts(created));
-    }
-    const createdId = isObject(created.value) ? created.value["conversation_id"] : void 0;
-    if (typeof createdId !== "string") {
-      return refusal("CONVERSATION_NOT_CREATED", "The create call returned no conversation_id.");
-    }
-    conversationId = createdId;
-  }
-  const started = Date.now();
-  const streamed = await streamClient.request({
-    method: "POST",
-    path: `/widget/v1/conversations/${encodeURIComponent(conversationId)}/messages`,
-    // `message` is the ONLY field this route accepts. `content` returns a 422 naming body.message,
-    // which is an hour of a developer's life if the tool gets it wrong.
-    body: { message: args.message },
-    responseType: "text",
-    headers: {
-      ...auth.headers,
-      accept: "text/event-stream",
-      // Sent for a server that honours it. Today's does not, which is why reuse above exists.
-      "idempotency-key": args.idempotency_key
-    },
-    credentials: auth.credentials
-  });
-  if (streamed.ok === false) {
-    if (streamed.kind === "http") {
-      return refusal("SEND_FAILED", "The send did not open a stream.", {
-        conversation_id: conversationId,
-        ...failureFacts(streamed)
-      });
-    }
-    const timedOut = streamed.kind === "timeout";
-    return refusal(
-      timedOut ? "DEADLINE_EXCEEDED" : "STREAM_FAILED",
-      timedOut ? `The turn did not finish within ${DEADLINE_MS / 1e3}s.` : "The stream failed before it completed.",
-      { conversation_id: conversationId, ...streamed.kind === "timeout" ? {} : { detail: streamed.detail } }
-    );
-  }
-  const histogram = {};
-  let answer = "";
-  let streamError = null;
-  const blocks = (typeof streamed.value === "string" ? streamed.value : "").split("\n\n");
-  blocks.pop();
-  for (const block of blocks) {
-    const frame = frameOf(block);
-    if (frame === null) continue;
-    histogram[frame.kind] = (histogram[frame.kind] ?? 0) + 1;
-    if (frame.text !== void 0) answer += frame.text;
-    if (frame.kind === "error") streamError ??= frame;
-  }
-  const deltas = histogram["delta"] ?? 0;
-  const completed = (histogram["done"] ?? 0) > 0 && streamError === null;
-  const result = {
-    ok: deltas > 0 && completed,
-    livemode: false,
-    replayed: false,
-    conversation_id: conversationId,
-    answer,
-    frame_histogram: histogram,
-    elapsed_ms: Date.now() - started,
-    ...scope,
-    ...args.pet_profile === void 0 ? {} : { pet_registered: true }
-  };
-  if (deltas > 0 && completed) return { isError: false, document: result };
-  if (deltas > 0) {
-    const failed = streamError;
-    return failedResult(result, "STREAM_FAILED", "The stream failed before it completed.", {
-      conversation_id: conversationId,
-      ...failed?.code === void 0 ? {} : { stream_error_code: failed.code },
-      ...failed?.retryable === void 0 ? {} : { stream_error_retryable: failed.retryable }
-    });
-  }
-  return failedResult(
-    result,
-    "EMPTY_STREAM",
-    "The stream carried no delta frames, so no answer text arrived. Check the frame histogram.",
-    { conversation_id: conversationId }
-  );
-}
-
-// src/mcp/server.ts
-var MCP_INSTRUCTIONS = `Everfur partner integration tools.
-
-Everfur is a pet-health API. Partners embed chat, medical-records and Televet (vet visit) surfaces in their own apps and pages
-via @everfur/sdk (React Native and Expo; the web through @everfur/sdk/web and a hosted frame; Flutter
-through everfur_sdk). On the web the plan follows the contract: a React tree embeds the SDK in the page,
-any other page includes the loader and gets the frame, and a Shopify storefront gets the Everfur app's
-theme block with Shopify vouching for the signed-in customer (identity_mode shopify-app-proxy). A
-capability the web cannot render (photo in the page, anything but chat in the frame) is reported as
-blocked by the platform; do not substitute the React Native entry points and do not invent an
-integration from the HTTP routes.
-
-Use everfur_plan_integration FIRST. Describe the project with project_root when this server runs on the same
-machine as the project, or with project_details (package dependencies, package manager and file-presence markers,
-never source files or credentials) when this is a remote MCP that cannot read the project. The plan matches the
-generated surface to the project's own theme (a Tailwind v4 @theme block, tailwind.config, :root custom properties,
-a React Native theme file), read statically and never executed; a remote MCP passes that text as theme_source.
-When the theme cannot be read the plan says so in its match-theme step and never guesses one. A plan comes back as
-a summary with a plan_id and a number of pages (the goal, the detected facts, each step's id, title, one-line intent
-and page, and the checklist); call it again with the same arguments plus plan_id and page, for page 1 to pages, for
-the steps in full, with their commands and the complete body of each file, before writing them. Page 1 also carries
-the detection, the warnings and the checklist in full, and the principles. (The same arguments plus plan_id and steps,
-step ids, return those steps instead, a page at a time, and remaining_steps names the rest.) Fetch every page
-before any command runs or any file is written: each call recomputes the plan from the project, and the plan's own
-commands and files change it. everfur_plan_integration refuses
-underspecified input by naming exactly which facts are missing. When it refuses, ask the developer those specific questions and call it again. Do not guess the
-answers and do not proceed without them: an integration built on a guessed identity mode is wrong in a way
-that only shows up in production. Each missing fact carries a fixed question and its options: ask them all in one
-message, worded as given. When the plan's match-theme step says the theme could not be read, find the host app's
-brand colours in its own code as that step lists, pass the file's text as theme_source and plan again; never pick a
-colour. The tenant's console branding (partner console) is the other side of the theme. A ready plan carries a
-checklist: the integration is finished only when every item holds, each proved by its verify.
-
-Then everfur_verify_integration to exercise the real wire, and everfur_diagnose when a working integration
-stops returning capabilities. Verification uses EVERFUR_SESSION_TOKEN, a short-lived session the partner's backend
-minted for a test user; EVERFUR_PARTNER_SECRET_KEY never belongs in this server's environment and is never read by
-it. When the session step is skipped, ask the developer to mint a session on their backend and set it. An anonymous
-integration is verified with identity_mode anonymous instead: the publishable key and a derived session id, with
-nothing minted.
-
-Whenever an Everfur response carries an error code, call everfur_explain_error with that code rather than
-explaining it yourself; that includes the error.code these tools return. Three naming families are live at once and
-one code is the default for four different HTTP statuses, so a code explained from the shape of its string
-produces a confident, wrong retry policy. If the tool says the code is unknown, say so; do not fill it in.
-
-Every tool returns structured content. A failed call carries error.code, error.retryable and
-error.next_action: branch on those, not on the message. Reference material is served as resources
-(everfur://guide, everfur://contract/errors, everfur://mcp/refusal-codes), and the prompts
-integrate-web, integrate-react-native and diagnose-integration lay out the order to call the tools in.
-
-The Everfur contract (the error registry, capabilities and decision trees the planner, everfur_explain_error,
-the guide and the contract resources read) is served only to an authenticated partner. It is fetched with
-EVERFUR_DOCS_KEY from EVERFUR_API_BASE_URL. When a tool refuses with CONTRACT_CREDENTIAL_MISSING,
-tell the developer to set those variables in this server's environment; do not answer from memory instead.
-The documented environment is EVERFUR_DOCS_KEY, EVERFUR_API_BASE_URL, EVERFUR_PARTNER_KEY and, for verification,
-EVERFUR_SESSION_TOKEN.`;
-function toContent(result) {
-  return {
-    content: [{ type: "text", text: JSON.stringify(result.document) }],
-    structuredContent: result.document,
-    isError: result.isError
-  };
-}
-async function guarded(body) {
-  try {
-    return toContent(await body());
-  } catch (error) {
-    return toContent(refusal("INTERNAL_ERROR", "The tool failed before it could produce a result.", {
-      error_type: error instanceof Error ? error.name : typeof error
-    }));
-  }
-}
-var TOOL_DESCRIPTIONS = Object.freeze({
-  env: Object.freeze({
-    planContract: "Reads the contract from GET /partners/contract with EVERFUR_DOCS_KEY unless contract_path or EVERFUR_CONTRACT_PUBLIC names a projection file.",
-    explainContract: "The contract is fetched with EVERFUR_DOCS_KEY unless contract_path or EVERFUR_CONTRACT_PUBLIC names a projection file."
-  }),
-  hosted: Object.freeze({
-    planContract: "Reads the contract the Everfur API serves to the connected partner.",
-    explainContract: "The contract is the one the Everfur API serves to the connected partner."
-  })
-});
-var HOSTED_TOOL_DESCRIPTIONS = Object.freeze({
-  verify: "Exercise the real wire as the connected tenant: a short-lived session the Everfur API mints for a synthetic test user of a sandbox tenant, the entitlement verdict read with it, and the assertion that the verdict is not empty; optionally the chat, records, televet and theme surfaces and, with origin and embedding, the web checks of the page (the frame's embed fence and loader are N/A for embedding in-page). On a live tenant with a paired sandbox the session is minted on that sandbox and the call uses its publishable key; on a live tenant with no pair the signed session step is reported GATED. With identity_mode anonymous it verifies the anonymous path instead (the tenant's publishable key and a device session id derived for a synthetic test user), which is the read-only check a live tenant takes: GET requests only, with nothing minted and nothing written. Returns PASS/SKIP/FAIL/GATED/N/A per step with the request id of the call that produced it. Mints a session, and on a sandbox tenant only a real Televet handoff, so it is not read-only.",
-  diagnose: "Separate the four byte-identical causes of an empty entitlement verdict for the connected tenant, with its publishable key. Read-only. Reports honestly when the deployment does not serve the diagnostics route rather than relaying a bare 404. With bundle: true, returns one support bundle (SDK and CLI versions, contract digest, credential presence without values, and the diagnosis request id) whatever state the integration is in.",
-  sendTestMessage: "Send a REAL message and stream a real veterinary answer as a synthetic test user of the connected tenant, a SANDBOX tenant only: the session is one the Everfur API mints for everfur-verify- and a stable id derived from idempotency_key, and a live tenant with no paired sandbox is refused before anything is sent (a paired one runs on its sandbox). Returns the answer plus a frame histogram, so a stream that died mid-answer is distinguishable from a short one. With pet_profile it registers a sandbox pet first so the answer is pet-aware. Calling again with the same idempotency_key reuses that conversation and returns the existing answer instead of sending a second message."
-});
-var EFFECT_HINTS = Object.freeze({
-  reads: Object.freeze({ readOnlyHint: true, destructiveHint: false, idempotentHint: true }),
-  writes_sandbox: Object.freeze({ readOnlyHint: false, destructiveHint: true, idempotentHint: false }),
-  writes_live: Object.freeze({ readOnlyHint: false, destructiveHint: true, idempotentHint: false }),
-  destroys_live: Object.freeze({ readOnlyHint: false, destructiveHint: true, idempotentHint: false })
-});
-var TOOL_DECLARATIONS = Object.freeze({
-  everfur_plan_integration: { title: "Plan an Everfur integration", effect: "reads", openWorld: false },
-  everfur_verify_integration: { title: "Verify the wire end to end", effect: "writes_sandbox", openWorld: true },
-  everfur_diagnose: { title: "Explain why a capability is unavailable", effect: "reads", openWorld: false },
-  everfur_explain_error: { title: "Explain an Everfur API error code", effect: "reads", openWorld: false },
-  everfur_send_test_message: { title: "Send a real message against a sandbox tenant", effect: "writes_sandbox", openWorld: false },
-  everfur_get_tenant_status: { title: "Read the tenant status", effect: "reads", openWorld: false },
-  everfur_list_webhook_endpoints: { title: "List webhook endpoints", effect: "reads", openWorld: false },
-  everfur_list_webhook_deliveries: { title: "List webhook deliveries", effect: "reads", openWorld: false },
-  everfur_get_webhook_delivery: { title: "Read one webhook delivery", effect: "reads", openWorld: false },
-  everfur_list_events: { title: "List emitted events", effect: "reads", openWorld: false },
-  everfur_get_usage_summary: { title: "Read the usage summary", effect: "reads", openWorld: false },
-  everfur_get_records_status_summary: { title: "Count records requests by status", effect: "reads", openWorld: false },
-  everfur_search_docs: { title: "Search the Everfur docs", effect: "reads", openWorld: false }
-});
-var TOOL_ANNOTATIONS = Object.freeze(
-  Object.fromEntries(
-    Object.entries(TOOL_DECLARATIONS).map(([name, declared]) => [
-      name,
-      Object.freeze({ title: declared.title, ...EFFECT_HINTS[declared.effect], openWorldHint: declared.openWorld })
-    ])
-  )
-);
-Object.freeze(CONNECTOR_TOOLS.map((tool) => tool.name));
-var PATH_ARGUMENTS = Object.freeze(["project_root", "contract_path"]);
-function argumentsSchema(local, hosted, readsLocalFiles) {
-  return readsLocalFiles ? local : z.object(hosted).passthrough();
-}
-function localPathRefusal(args) {
-  const named = PATH_ARGUMENTS.filter((name) => Object.hasOwn(args, name) && args[name] !== void 0);
-  if (named.length === 0) return null;
-  return refusal(
-    "LOCAL_PATH_NOT_READABLE",
-    "This server does not run on the developer's machine and reads no path. Describe the project with `project_details` instead of `project_root`; `contract_path` is not accepted, the contract is served to the signed-in partner; the offline project checks of everfur_verify_integration and everfur_diagnose are not available on a hosted server.",
-    { arguments: named }
-  );
-}
-function buildServer(context, ports = {}, options = {}) {
-  const shared = {
-    ...ports,
-    contract: ports.contract ?? createContractProvider({
-      env: context.env,
-      transport: ports.transport ?? fetchTransport,
-      clock: ports.clock ?? systemClock,
-      cache: ports.contractCache ?? nodeContractCache(context.env)
-    })
-  };
-  const server = new McpServer(
-    { name: "everfur", version: CLI_VERSION },
-    { capabilities: { tools: {}, resources: {}, prompts: {} }, instructions: options.instructions ?? MCP_INSTRUCTIONS }
-  );
-  const contextFor = options.contextFor ?? (async () => context);
-  const readsLocalFiles = options.readsLocalFiles ?? true;
-  const hosted = context.credentialSource === "hosted";
-  const describe = hosted ? TOOL_DESCRIPTIONS.hosted : TOOL_DESCRIPTIONS.env;
-  const run = (tool, args, authInfo, body) => guarded(async () => {
-    if (!readsLocalFiles) {
-      const refused = localPathRefusal(args);
-      if (refused !== null) return refused;
-    }
-    return body(await contextFor({ tool, args, authInfo }));
-  });
-  server.registerTool(
-    "everfur_plan_integration",
-    {
-      title: TOOL_ANNOTATIONS.everfur_plan_integration.title,
-      description: `Produce an integration plan for a project. REFUSES underspecified input by naming the missing facts rather than guessing them, and REFUSES a project shape the SDK ships no entry point for (PLATFORM_NOT_SUPPORTED) or a capability set the contract blocks outright (CAPABILITIES_BLOCKED). Returns a small summary with a plan_id and a number of pages: the goal, the detected facts, each step's id, title, one-line intent and page, and the checklist. The same arguments plus plan_id and page (1 to pages) return that page: its steps in full, with their commands and the complete body of each file they write, and on page 1 the detection, warnings and checklist in full. With steps (step ids) instead of page, those steps come a page at a time and remaining_steps names the rest. Each call recomputes the plan from the project, which the plan's own commands and files change, so every page is fetched before any command runs or any file is written. Read-only. ${describe.planContract}`,
-      inputSchema: argumentsSchema(PLAN_INPUT_SHAPE, HOSTED_PLAN_INPUT_SHAPE, readsLocalFiles),
-      outputSchema: PLAN_OUTPUT_SHAPE,
-      annotations: { ...TOOL_ANNOTATIONS.everfur_plan_integration }
-    },
-    // The planner computes the full plan, as the CLI prints it; what the wire carries is its summary or the steps asked
-    // for (plan-wire.ts).
-    (args, extra) => run("everfur_plan_integration", args, extra.authInfo, async (resolved) => planOnTheWire(await planIntegrationTool(args, resolved, shared), args))
-  );
-  server.registerTool(
-    "everfur_verify_integration",
-    {
-      title: TOOL_ANNOTATIONS.everfur_verify_integration.title,
-      description: hosted ? HOSTED_TOOL_DESCRIPTIONS.verify : "Mint a session, poll entitlements, and hard-assert the verdict is not empty; optionally exercise the chat, records, televet and theme surfaces and check the project on disk. With identity_mode anonymous it verifies the anonymous path instead (the publishable key and a derived session id, the conversation list, and whether the tenant requires signed sessions). Returns PASS/SKIP/FAIL/GATED/N/A per step with the request id of the call that produced it. Mints a real session, and on a sandbox tenant only a real Televet handoff, so it is not read-only; it sends no write to a live tenant.",
-      inputSchema: argumentsSchema(VERIFY_INPUT_SHAPE, HOSTED_VERIFY_INPUT_SHAPE, readsLocalFiles),
-      outputSchema: VERIFY_OUTPUT_SHAPE,
-      annotations: { ...TOOL_ANNOTATIONS.everfur_verify_integration }
-    },
-    (args, extra) => run("everfur_verify_integration", args, extra.authInfo, (resolved) => verifyIntegrationTool(args, resolved, shared))
-  );
-  server.registerTool(
-    "everfur_diagnose",
-    {
-      title: TOOL_ANNOTATIONS.everfur_diagnose.title,
-      description: hosted ? HOSTED_TOOL_DESCRIPTIONS.diagnose : "Separate the four byte-identical causes of an empty entitlement verdict. Read-only. Reports honestly when the deployment does not serve the diagnostics route rather than relaying a bare 404. With bundle: true, returns one support bundle (project, framework, SDK and CLI versions, contract digest, credential presence without values, and the diagnosis request id) whatever state the integration is in.",
-      inputSchema: argumentsSchema(DIAGNOSE_INPUT_SHAPE, HOSTED_DIAGNOSE_INPUT_SHAPE, readsLocalFiles),
-      outputSchema: DIAGNOSE_OUTPUT_SHAPE,
-      annotations: { ...TOOL_ANNOTATIONS.everfur_diagnose }
-    },
-    (args, extra) => run("everfur_diagnose", args, extra.authInfo, (resolved) => diagnoseTool(args, resolved, shared))
-  );
-  server.registerTool(
-    "everfur_explain_error",
-    {
-      title: TOOL_ANNOTATIONS.everfur_explain_error.title,
-      description: `Explain an error code: cause, whether it is retryable, and the next action. A wire code is read from the registry in the contract. ${describe.explainContract} The SDK's own codes (EverfurError and its closed sub-enums such as AttachmentErrorCode and VetVisitErrorReason), the diagnostics reason codes, the CLI's error codes and the error.code these tools return (VERIFICATION_FAILED, PLAN_CHANGED and the rest) are answered offline. Needs no project. REFUSES a code the registry does not list, with near misses, rather than inventing an explanation from the shape of the string.`,
-      inputSchema: argumentsSchema(EXPLAIN_ERROR_INPUT_SHAPE, HOSTED_EXPLAIN_ERROR_INPUT_SHAPE, readsLocalFiles),
-      outputSchema: EXPLAIN_ERROR_OUTPUT_SHAPE,
-      annotations: { ...TOOL_ANNOTATIONS.everfur_explain_error }
-    },
-    (args, extra) => run("everfur_explain_error", args, extra.authInfo, (resolved) => explainErrorTool(args, resolved, shared))
-  );
-  server.registerTool(
-    "everfur_send_test_message",
-    {
-      title: TOOL_ANNOTATIONS.everfur_send_test_message.title,
-      description: hosted ? HOSTED_TOOL_DESCRIPTIONS.sendTestMessage : "Send a REAL message and stream a real veterinary answer, against a SANDBOX tenant only. Refuses unless the entitlement verdict reports livemode false. Returns the answer plus a frame histogram, so a stream that died mid-answer is distinguishable from a short one. Asks with a signed session when one is available, and with pet_profile registers a sandbox pet first so the answer is pet-aware. Calling again with the same idempotency_key reuses that conversation and returns the existing answer instead of sending a second message.",
-      inputSchema: {
-        message: z.string().min(1).max(4e3).describe("What to ask. A real pet-health question gets a real answer."),
-        idempotency_key: z.string().min(8).max(128).describe("Required and explicit. A call with a key and message already sent reuses that conversation and returns its stored answer instead of sending again. This is done by the tool reading the conversation first; the server does not deduplicate sends."),
-        pet_ref: z.string().min(1).max(128).optional().describe("Optional pet to scope the conversation to. Must already be registered for this identity, unless pet_profile is passed, which registers it."),
-        pet_profile: PET_PROFILE_SHAPE.optional().describe("Optional sandbox pet to register for this call's identity before the send (under pet_ref, else a fixed test ref), so the answer is scoped to it. Registered only once the sandbox fence has passed.")
-      },
-      outputSchema: SEND_TEST_MESSAGE_OUTPUT_SHAPE,
-      annotations: { ...TOOL_ANNOTATIONS.everfur_send_test_message }
-    },
-    (args, extra) => run("everfur_send_test_message", args, extra.authInfo, (resolved) => (
-      // On the hosted server the session comes from the Everfur API's mint for the signed-in sandbox tenant.
-      sendTestMessage(args, resolved.env, shared, { hostedMint: resolved.hostedMint ?? null })
-    ))
-  );
-  if (hosted) {
-    for (const tool of CONNECTOR_TOOLS) {
-      const annotations = TOOL_ANNOTATIONS[tool.name];
-      server.registerTool(
-        tool.name,
-        { title: annotations.title, description: tool.description, inputSchema: tool.input, outputSchema: tool.output, annotations: { ...annotations } },
-        (args, extra) => run(tool.name, args, extra.authInfo, (resolved) => tool.run(args, resolved, shared))
-      );
-    }
-  }
-  registerResources(server, shared.contract);
-  registerPrompts(server, shared.contract, { sessionSource: hosted ? "hosted" : "env" });
-  return server;
-}
-async function runStdioServer(env) {
-  const server = buildServer({ env });
-  await server.connect(new StdioServerTransport());
-}
-
-export { MCP_SCOPE, REVOKED_AUTHORIZATION_REMEDY, SYNTHETIC_USER_REF_PREFIX, buildServer, createHostedTokenVerifier, hostedVerifyUserRef, isAccessTokenShaped, runStdioServer, sendTestUserRef, tenantContextOf, tokenBucketOf };