health-export-mcp 1.6.7 → 1.7.0

package/README.md

@@ -158,7 +158,7 @@ Full reference with request/response examples: **[healthexport.dev/mcp](https://
 | `get_sleep_sessions` | Clustered sleep sessions attributed to the waking day; split nights returned as-is. |
 | `get_cycle_context` | Day-in-cycle and coarse phase derived from logged period starts. Never predictive. |
 | `correlate_metrics` | Pearson correlation between two metrics with a 0..3 day lag. Association, not causation, always stated. |
-| `resolve_metric` | Canonical name and unit for any spelling (`steps`, `StepCount`, `Body Weight`, `hrv`), unit variants with exact formulas, an optional `{value, unit}` conversion, and whether the export holds it. Ambiguous words come back with candidates, never guessed. The data tools accept the same aliases and report `resolvedFrom`. |
+| `resolve_metric` | Canonical name and unit for any spelling (`steps`, `StepCount`, `Body Weight`, `hrv`), unit variants with exact formulas, an optional `{value, unit}` conversion, and whether the export holds it. Ambiguous words come back with candidates, never guessed. The data tools accept the same aliases and report `resolvedFrom`. When the export carries per-source attribution (app builds that write `src`/`by` on daily points and a `health-sources.json`, cache schema minor 2), the answer adds a `sources` block naming the devices that fed the export, which one won each metric and the priority rules, and `sourceMerge` reports disagreement as visible; older exports report it as not available. |
 
 **Coverage:** 190 Apple Health metrics across activity, heart, HRV, mobility, respiratory, body, sleep, hearing, and nutrition, plus workouts. Data answers carry honest `coverage` blocks, and single-metric answers list logged events inside the window as `segmentBoundaries` so an average across a medication start or life change cannot masquerade as one regime.
 
@@ -209,6 +209,18 @@ node server.mjs --help
 
 ---
 
+## Building a wellness or coaching product?
+
+This server reads a file the MetricBridge iOS app writes **on the user's own device**, with no central
+health-data processor in the path. The same app can POST signed JSON (Standard Webhooks v1, published
+JSON Schemas) straight to **your** endpoint, so your users bring their own Apple Health to your product
+without an SDK in your app and without any vendor server holding the data. The offer, flat pricing and
+boundaries: [healthexport.dev/platforms](https://www.healthexport.dev/platforms/). The integration guide
+and the zero-dependency conformance kit: [healthexport.dev/docs/platforms](https://www.healthexport.dev/docs/platforms/).
+Wellness-scoped and end-user-directed; no clinical or HIPAA work.
+
+---
+
 ## The app that feeds it
 
 <p align="center">
@@ -227,11 +239,16 @@ node server.mjs --help
 
 ## Privacy & security
 
+The one non-health thing the server reads from the export is `_meta.license`, a marker the app writes
+with exactly two shapes: `{"state": "trial", "daysRemaining": N}` or `{"state": "unlocked"}`. A fresh
+export from a trial adds one sentence to `get_freshness` naming when the trial ends; an unlocked export
+adds nothing. No network call is involved and nothing is sent anywhere.
+
 - **Read-only.** The server only reads your exported data, it never touches HealthKit and never writes back.
 - **Local-first.** It runs on your machine over stdio. There is **no developer server** in the path.
 - **Optional pairing.** Set `PAIRING_SECRET` to the code the iOS app shows (Settings → Agent pairing) to gate access.
 - **Encrypted exports (optional).** If you switch on Export encryption in the iOS app, set `HEALTH_EXPORT_PASSPHRASE` (or `HEALTH_EXPORT_PASSPHRASE_FILE`) to the same passphrase and the server decrypts on your machine. See [Encrypted exports](#encrypted-exports).
-- **No telemetry.** The server makes no network requests. When it finds no usable export (none yet, a stale one, or `--demo`), `get_mcp_status` includes one static link to the companion app's website. That link carries fixed campaign labels (`utm_source=mcp`, `utm_medium=agent-tool`, `utm_campaign=mcp-unlock`) that are identical for every user and contain nothing about you or your data; they only count if you choose to open it.
+- **No telemetry.** The server makes no network requests. `get_mcp_status` always includes one static link to the companion app's website (and its App Store page), so the bridge is attributable back to install. Both links carry fixed campaign labels (`utm_source=mcp`, `utm_medium=agent-tool`, `utm_campaign=mcp-unlock`; `ct=mcpserver`, `ppid=…`) that are identical for every user and contain nothing about you or your data; they only count if you choose to open one.
 - **Auditable.** Zero dependencies and a few hundred lines of readable JavaScript, read every line.
 - **Signed releases.** Hosted artifacts are minisign-signed and checksummed, see [Verifying releases](#verifying-releases).
 

package/healthstore.mjs

@@ -65,11 +65,15 @@ export const UNLOCK_URL = 'https://www.healthexport.dev/?utm_source=mcp&utm_medi
 // arrives from an MCP client sees the page written for them. Text only, like UNLOCK_URL.
 export const APP_STORE_URL = 'https://apps.apple.com/app/apple-store/id6784185201?pt=129083290&ct=mcpserver&mt=8&ppid=2c28f88a-d94f-48f9-8e6a-74a8d89ce66e';
 
-/** The user-facing app card. get_mcp_status (the tool agents call first) returns it ONLY when this
- *  machine has no usable export: none at all, a stale one (a paused trial stops the writes), or the
- *  synthetic demo dataset. A user with a working export already has the app, and a link on every
- *  answer would be promotion rather than a description of what is missing, which is what MCP
- *  directory review rules object to. Exported so the tests read the same string. */
+/** The user-facing app card. get_mcp_status (the tool agents call first) returns it on EVERY
+ *  answer, not only when this machine has no usable export. The old gate (link only for no export /
+ *  stale / demo) hid the one attributable link to the app exactly where it mattered: the common
+ *  real-world order is buy the app, export, then wire up the server, so that user always had a
+ *  usable export and never saw the payment surface. Measured result: 1 visit to the tagged link in
+ *  90 days against ~290 npm installs/week. The card is text only and describes the companion app
+ *  that wrote the export; the sole exception is status()'s encrypted early return, where the export
+ *  came from the app and the fix is the passphrase, not a link. Exported so the tests read the same
+ *  string. */
 export const APP_INFO = {
   name: 'MetricBridge',
   unlockUrl: UNLOCK_URL,
@@ -258,6 +262,51 @@ export function cacheMeta() {
   return raw && typeof raw._meta === 'object' ? raw._meta : null;
 }
 
+/** The per-source attribution file (Track B3, cache schema minor 2): which devices feed the
+ *  export, which source won each metric, and the priority rules. Absent before app builds that
+ *  ship source reconciliation, so every consumer treats it as optional and degrades to today's
+ *  single-source behaviour when it is not there. */
+export function loadSources() {
+  if (DEMO || !pairing().ok) return null;
+  return readJSONCached(path.join(DATA_DIR, 'health-sources.json'), null);
+}
+
+/** True when this export carries per-source attribution: either the app stamped schemaMinor 2 onto
+ *  the cache (daily points then carry `src`/`by`) or a health-sources.json is present. Both are
+ *  additive and independent, so either is enough to flip the sourceMerge surface from the
+ *  "per-source values are not in the export" baseline to "available". */
+export function hasSourceAttribution() {
+  if (DEMO || !pairing().ok) return false;
+  if (Number(cacheMeta()?.schemaMinor ?? 0) >= 2) return true;
+  return fileExists('health-sources.json');
+}
+
+/** Compact per-source summary for tool answers (schema minor 2). Null when there is no attribution,
+ *  so an answer stays byte-for-byte what a pre-B3 reader produced when the export predates it. */
+export function sourcesBlock() {
+  const s = loadSources();
+  if (!s || typeof s !== 'object') return null;
+  const metrics = {};
+  for (const [name, m] of Object.entries(s.metrics ?? {})) {
+    metrics[name] = {
+      rule: m.rule,
+      ...(m.priority && { priority: m.priority }),
+      ...(m.comparableAcrossSources === false && { comparableAcrossSources: false }),
+      ...(m.daysBySource && { daysBySource: m.daysBySource }),
+      ...(m.multiSourceDays != null && { multiSourceDays: m.multiSourceDays }),
+      ...(m.alsoRecordedDays != null && { alsoRecordedDays: m.alsoRecordedDays }),
+      ...(m.mergedDays != null && { mergedDays: m.mergedDays }),
+    };
+  }
+  return {
+    sourceCount: s.sourceCount,
+    sources: (s.sources ?? []).map((x) => ({ label: x.label, class: x.class, days: x.days, firstDay: x.firstDay, lastDay: x.lastDay })),
+    metrics,
+    ...(s.workouts && typeof s.workouts === 'object' && { workouts: s.workouts }),
+    ...(s.rules && { rules: s.rules }),
+  };
+}
+
 // ---- Late-arrival recompute provenance (cache schema minor 1, docs/SCHEMA-CONTRACTS.md s.9) ----
 // The app re-reads only the trailing days on each run. When Apple Health later receives samples
 // dated BEFORE that window (a scale or toothbrush syncing after a gap, a back-logged entry), or
@@ -415,7 +464,13 @@ function rollUp(points, granularity, cumulative) {
   // A day rebuilt after late or deleted samples carries `recomputed_at`; an untouched day carries
   // nothing extra, so the two are distinguishable point by point (schema minor 1).
   if (granularity === 'day') {
-    return points.map((p) => ({ date: p.d, value: round(p.v), ...(typeof p.r === 'string' && { recomputed_at: p.r }) }));
+    return points.map((p) => ({
+      date: p.d,
+      value: round(p.v),
+      ...(typeof p.r === 'string' && { recomputed_at: p.r }),
+      ...(typeof p.src === 'string' && { src: p.src }),
+      ...(p.by && typeof p.by === 'object' && !Array.isArray(p.by) && { by: p.by }),
+    }));
   }
   const buckets = new Map();
   for (const p of points) {
@@ -504,14 +559,12 @@ export async function status() {
     if (d && (!lastDate || d > lastDate)) lastDate = d;
   }
   const fresh = await freshness({ detail: false });
-  // Locked is neither case: a pairing gate file exists only because the app wrote it.
-  const noUsableExport = DEMO || (p.ok && (names.length === 0 || fresh.stale === true));
   return {
     ok: names.length > 0 && p.ok,
     source: sourceLabel(),
-    // The campaign-tagged companion-app link, only when there is no usable export (see APP_INFO).
-    // Additive and text only: no runtime network call is made.
-    ...(noUsableExport && { app: APP_INFO }),
+    // The campaign-tagged companion-app link, on EVERY status answer (see APP_INFO). It is text
+    // only and additive: no runtime network call is made, and the user's own data is untouched.
+    app: APP_INFO,
     // Demo mode is reported LOUDLY and first-class here, not only in the per-answer watermark:
     // get_mcp_status is the tool agents are told to call first, so this is where a human debugging
     // "why do my numbers look wrong" finds out they are not their numbers at all.
@@ -567,14 +620,20 @@ export async function status() {
     // Additive presence flags for the optional context files, so an agent knows which of the
     // context tools can answer before calling them. Absence means "not exported", never "none".
     contextFiles: DEMO
-      ? { events: true, profile: true, sessions: true, cycles: true, days: true }
+      ? { events: true, profile: true, sessions: true, cycles: true, days: true, sources: false }
       : {
           events: !!ev.loadEventsFile(),
           profile: fileExists('health-profile.json'),
           sessions: fileExists('health-sessions.json'),
           cycles: fileExists('health-cycles.json'),
           days: !!ev.loadDaysFile(),
+          // health-sources.json (schema minor 2): which devices feed the export and which won each
+          // metric. False means the app build that wrote this export predates source attribution.
+          sources: fileExists('health-sources.json'),
         },
+    // Additive: true when daily points carry src/by or health-sources.json exists, so an agent
+    // knows before calling resolve_metric whether per-source disagreement is visible in this export.
+    sourceAttribution: hasSourceAttribution(),
     metrics: names.sort(),
   };
 }
@@ -601,6 +660,7 @@ export const DATA_FILES = [
   'health-sessions.json',
   'health-cycles.json',
   'health-days.json',
+  'health-sources.json',
 ];
 
 /** One daily automation run plus two hours of slack: iOS schedules background work loosely, so a
@@ -743,6 +803,19 @@ export async function freshness({ maxAgeHours, detail = true, now = Date.now() }
   // be read (an encrypted export without its passphrase): the app wrote that file, so the fix is
   // the passphrase, not the app -- the same rule as status()'s encrypted early return.
   const trialHint = stale && rawAge > Math.max(staleAfterHours(), DEFAULT_STALE_AFTER_HOURS) && !cacheReadError;
+  // The other half of the money moment: a FRESH export written by an app still inside its 7-day
+  // free trial (the stale/trialHint path above only reaches a trial that already ENDED). The app
+  // stamps `_meta.license` (non-health metadata) onto the cache from 1.x onward; an older cache
+  // simply lacks it and this degrades to the status quo. We add ONE sentence to the prose. The
+  // neutral `app` card is returned on every status answer regardless (see APP_INFO); the trial
+  // wording itself appears only here, only when the marker says trial, never for an unlocked app
+  // or an older export without the marker.
+  // Read the marker only when the cache is readable: cacheMeta() re-reads the file, which throws
+  // for an encrypted export without its passphrase (status() has its own early return for that).
+  let license = null;
+  if (!stale && !cacheReadError) { try { license = cacheMeta()?.license ?? null; } catch { license = null; } }
+  const midTrial = license?.state === 'trial' && Number.isInteger(license?.daysRemaining) && license.daysRemaining >= 0;
+  const trialEnds = midTrial ? (license.daysRemaining === 0 ? 'ends today' : `ends in ${license.daysRemaining} day${license.daysRemaining === 1 ? '' : 's'}`) : '';
   const readNote = cacheReadError
     ? ` The daily cache could not be read (${cacheReadError}), so data tools will fail until that is fixed; run get_mcp_status for the details.`
     : '';
@@ -767,7 +840,10 @@ export async function freshness({ maxAgeHours, detail = true, now = Date.now() }
       // prose is what makes the agent's answer carry the tagged link, not just the nested field.
       ? `The newest export is ${age} hours old, older than the ${threshold}-hour window. Answers only cover data up to ${lastDataDate ?? 'the last export'}; if current numbers matter, ask the user to open MetricBridge or run an export, then check again.`
         + (trialHint ? ` MetricBridge also stops exporting when its free trial ends; if that is why, the one-time unlock inside the iOS app resumes the exports (app website: ${UNLOCK_URL}).` : '')
-      : `Within the ${threshold}-hour freshness window: the newest export landed ${age} hours ago.`)
+      : `Within the ${threshold}-hour freshness window: the newest export landed ${age} hours ago.`
+        + (midTrial
+          ? ` MetricBridge's free trial ${trialEnds}; the one-time unlock inside the iOS app keeps exports running after that (app website: ${UNLOCK_URL}).`
+          : ''))
       + readNote,
   };
 }
@@ -1415,6 +1491,8 @@ export async function resolveMetric({ name, value, unit } = {}) {
   const present = unlocked ? await loadMetrics() : null;
   const inExport = (id) => (present ? !!present[id] : null);
   const lockedNote = unlocked ? undefined : 'Pairing is locked, so whether each metric is in this export is unknown (null). The naming and unit table itself does not depend on your data.';
+  const sourceMerge = norm.sourceMerge(hasSourceAttribution());
+  const sources = sourcesBlock();
   const r = norm.lookup(requested);
   // A name the export holds but the catalog does not (an older or newer app's metric) is still a
   // real metric: report it as present with its stored unit rather than "unknown".
@@ -1426,7 +1504,7 @@ export async function resolveMetric({ name, value, unit } = {}) {
       unit: m.unit || '', cumulative: !!m.cumulative, inExport: true, coverage: coverageOf(m),
       note: 'This metric is in the export under exactly this name but is not in this server\'s canonical table (the export may come from a newer app or another tool), so no aliases or unit variants are listed for it.'
         + (r.status === 'resolved' ? ` The table maps this spelling to "${r.metric}", which is a separate entry; the data tools use the exact name "${requested}".` : ''),
-      sourceMerge: norm.SOURCE_MERGE,
+      sourceMerge,
     };
   }
   if (r.status !== 'resolved') {
@@ -1465,7 +1543,8 @@ export async function resolveMetric({ name, value, unit } = {}) {
       unitMismatch: `The export stores this metric in "${present[row.id].unit || ''}", not the canonical "${row.unit}". Values are served exactly as stored; nothing was converted.`,
     }),
     ...(row.id === 'heart_rate_variability' && { measureNote: 'SDNN in milliseconds, as Apple Health records it. Not comparable with RMSSD values from other devices.' }),
-    sourceMerge: norm.SOURCE_MERGE,
+    sourceMerge,
+    ...(sources && { sources }),
     ...(lockedNote && { lockedNote }),
   };
   if (value != null) out.conversion = { input: { value, unit: String(unit) }, ...norm.convertToCanonical(row.id, value, unit) };

package/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": "0.3",
   "name": "health-export-ai",
   "display_name": "MetricBridge",
-  "version": "1.6.7",
+  "version": "1.7.0",
   "description": "Query your Apple Health data, exported by the MetricBridge iOS app to iCloud Drive, from any MCP agent. Local-first, read-only, zero dependencies.",
   "long_description": "A zero-dependency MCP server that exposes 190 Apple Health metrics (exported by the MetricBridge iOS app into an iCloud Drive folder) to any MCP-compatible agent: Claude Desktop, opencode, Cursor, OpenClaw, Hermes. No bridge, no Docker, no HTTP receiver: the server reads the synced cache file directly over stdio. 16 tools: get_mcp_status, get_freshness, list_metrics, get_health_metrics, get_trends, compare_periods, get_structured_export, get_intraday, query_health_data, list_events, get_profile, get_workouts, get_sleep_sessions, get_cycle_context, correlate_metrics, resolve_metric. Plus 22 MCP prompts and a --demo mode with a synthetic dataset. Get the companion iOS app on the App Store: https://apps.apple.com/app/apple-store/id6784185201?pt=129083290&ct=githubreadme&mt=8&ppid=2c28f88a-d94f-48f9-8e6a-74a8d89ce66e",
   "author": {

package/normalize.mjs

@@ -372,3 +372,18 @@ export const SOURCE_MERGE = {
   disagreementDetection: 'not_available',
   note: 'Each daily value in this export is the single figure Apple Health produces after merging every source on the device (for example an iPhone and a Watch counting the same steps). The export holds one value per metric per day, not one per source, so it cannot show whether two sources disagreed, and nothing here adjusts values to make sources agree.',
 };
+
+/** The sourceMerge surface for an export that DOES carry per-source attribution (schema minor 2,
+ *  written by app builds shipping Track B3 source reconciliation). Each daily point then carries
+ *  `src` (the source whose value won) and `by` (every source's own value when two or more recorded
+ *  the day), and a health-sources.json beside the cache lists which devices feed the export, which
+ *  source wins each metric, and the priority rules. Disagreement between sources is then visible
+ *  rather than pre-merged out of sight, so the answer stops claiming it cannot be seen. */
+export function sourceMerge(hasAttribution) {
+  if (!hasAttribution) return SOURCE_MERGE;
+  return {
+    perSourceValuesInExport: true,
+    disagreementDetection: 'available',
+    note: 'This export records per-source values: each daily point carries `src` (the source whose value was used) and, when two or more sources recorded the day, `by` (every source that recorded, the winner included). health-sources.json lists which devices feed the export, which source wins each metric and the priority rules, so an agent can say which source a value came from and where two sources disagreed.',
+  };
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "health-export-mcp",
   "mcpName": "io.github.PhilipAD/health-export-mcp",
-  "version": "1.6.7",
+  "version": "1.7.0",
   "type": "module",
   "description": "Open-source, zero-dependency Model Context Protocol (MCP) server to query Apple Health / HealthKit data (190 metrics) from Claude, ChatGPT, Cursor, OpenClaw, Hermes and any MCP agent.",
   "keywords": [
@@ -106,4 +106,4 @@
   "engines": {
     "node": ">=18"
   }
-}
+}

package/server.json

@@ -8,22 +8,22 @@
     "url": "https://github.com/PhilipAD/health-export-mcp",
     "source": "github"
   },
-  "version": "1.6.7",
+  "version": "1.7.0",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "health-export-mcp",
-      "version": "1.6.7",
+      "version": "1.7.0",
       "transport": {
         "type": "stdio"
       }
     },
     {
       "registryType": "mcpb",
-      "identifier": "https://github.com/PhilipAD/health-export-mcp/releases/download/v1.6.7/health-export.mcpb",
-      "version": "1.6.7",
-      "fileSha256": "194f9c3ecf81307bac975f753e833beba563d024dfa53646a007b63586817890",
+      "identifier": "https://github.com/PhilipAD/health-export-mcp/releases/download/v1.7.0/health-export.mcpb",
+      "version": "1.7.0",
+      "fileSha256": "167102086bcf5551fadc3ac56d8745088279f4ed71388b425a70433348dd1fe9",
       "transport": {
         "type": "stdio"
       }

package/server.mjs

@@ -21,7 +21,7 @@ import * as ev from './events.mjs';
 import { PROMPTS } from './prompts.mjs';
 import { DEMO } from './demo.mjs';
 
-const SERVER = { name: 'health-export-ai', version: '1.6.7' };
+const SERVER = { name: 'health-export-ai', version: '1.7.0' };
 const DEFAULT_PROTOCOL = '2025-06-18';
 const log = (...a) => process.stderr.write('[mcp] ' + a.join(' ') + '\n');
 
@@ -57,7 +57,7 @@ const ANNOTATIONS = { readOnlyHint: true, idempotentHint: true, openWorldHint: f
 const TOOLS = [
   {
     name: 'get_mcp_status',
-    description: 'Health check: data source, how many metrics/workouts are available, which optional context files exist, the most recent data date, and a `recompute` summary of past days rebuilt after late-arriving samples (with any days too old to rebuild). Call this first to confirm the bridge is connected. When there is no usable export (none found, a stale one, or demo data), the result also includes `app.unlockUrl` and `app.appStoreUrl`, the website and App Store page of the companion iOS app that writes the export; both links carry fixed campaign attribution labels.',
+    description: 'Health check: data source, how many metrics/workouts are available, which optional context files exist, the most recent data date, and a `recompute` summary of past days rebuilt after late-arriving samples (with any days too old to rebuild). Call this first to confirm the bridge is connected. The result also includes `app.unlockUrl` and `app.appStoreUrl`, the website and App Store page of the companion iOS app that writes the export; both links carry fixed campaign attribution labels.',
     inputSchema: { type: 'object', properties: {} },
     handler: () => store.status(),
   },
@@ -244,7 +244,7 @@ const TOOLS = [
   // ---- canonical naming and units (cross-source normalisation, first slice) ----
   {
     name: 'resolve_metric',
-    description: "Look a metric name up in the canonical naming and unit table. Accepts the export's own name (step_count), a HealthKit identifier (StepCount, HKQuantityTypeIdentifierStepCount), a display title (Step Count) or a common alias (steps, hrv, spo2, weight) and returns the canonical metric, its unit (percentages are 0 to 1 fractions), the unit variants other apps use with the exact formula into the canonical unit, and whether this export holds it. Pass {value, unit} to convert one value, e.g. 180 lb to kg. A word naming several metrics (distance, calories) comes back ambiguous with candidates, and a different measure (RMSSD vs the SDNN that Apple Health stores) is refused with the reason: nothing is guessed. get_health_metrics, get_trends, compare_periods, get_structured_export and correlate_metrics accept the same aliases and report `resolvedFrom` when they used one; other tools take the export's own names. The export holds one value per metric per day, already merged across sources by Apple Health, so this tool states that per-source disagreement cannot be seen in the file rather than inventing it.",
+    description: "Look a metric name up in the canonical naming and unit table. Accepts the export's own name (step_count), a HealthKit identifier (StepCount, HKQuantityTypeIdentifierStepCount), a display title (Step Count) or a common alias (steps, hrv, spo2, weight) and returns the canonical metric, its unit (percentages are 0 to 1 fractions), the unit variants other apps use with the exact formula into the canonical unit, and whether this export holds it. Pass {value, unit} to convert one value, e.g. 180 lb to kg. A word naming several metrics (distance, calories) comes back ambiguous with candidates, and a different measure (RMSSD vs the SDNN that Apple Health stores) is refused with the reason: nothing is guessed. get_health_metrics, get_trends, compare_periods, get_structured_export and correlate_metrics accept the same aliases and report `resolvedFrom` when they used one; other tools take the export's own names. The export holds one value per metric per day, merged across sources by Apple Health, so this tool states honestly whether per-source disagreement can be seen in the file (exports that record per-source attribution carry `src`/`by` and a `sources` block; others report it as not available) rather than inventing it.",
     inputSchema: {
       type: 'object',
       properties: {