PR

• Have you followed the contributing guidelines?
• Have you explained what your changes do, and why they add value?

---

This moves the optional Ever Platform modules and the egress audit to the Ever Platform SDK 1.0.0-rc.7 (from rc.6). Two things change in the SDK:

• the production root is pinned, so a Gauzy build pointed at https://api.ever.co can verify that API's key manifest and entitlement documents;
• the contract lists the live event stream (GET /rt/sse, row 35), which Gauzy does not make.

Plugins

• @gauzy/plugin-ever-connect and @gauzy/plugin-ever-stats pin @ever-co/connect-sdk, @ever-co/connect-contracts and @ever-co/connect-tools at 1.0.0-rc.7 (exact).
• No code change. Between rc.6 and rc.7, the request bodies, the statistics report and its schema are byte-identical, and so is the verifier API. The new part is a pinned root, plus one contract row that Gauzy does not call.

Egress audit and the outbound-call page

• The harness @ever-co/connect-tools moves to 1.0.0-rc.7, and tools/egress-audit/package-lock.json changes with it.
• every_trigger_exclude_rows gains row 35, so the every_trigger run leaves out exactly the rows Gauzy does not make. outbound-calls.mjs --check requires this: without it, it fails with "the rows Gauzy does not make are […, 35]".
• tools/ever-platform/outbound-calls.md is regenerated: contract version 1.0.0-rc.7, and row 35 is listed under "not built in this release".
• Follow-up outside this repo: the published copy of the page (ever-co/ever-gauzy-docs, website/docs/ever-platform/outbound-calls.md) needs the same two table lines.

Lockfile

• yarn.lock: the three @ever-co/connect-* entries move to rc.7 with the registry's tarball shasum and integrity. Nothing else moves.

Checked locally

• npm ci --prefix tools/egress-audit, then node tools/ever-platform/outbound-calls.mjs --check: ok (contract 1.0.0-rc.7; 13 rows made, 12 not made).
• node --test tools/ever-platform/outbound-calls.test.mjs: 4/4.
• The egress-audit and private-deps tool tests: 19/19.
• The published @ever-co/connect-sdk@1.0.0-rc.7 verifies the live production key manifest for https://api.ever.co, and refuses it for the development and staging issuers. The packages carry npm provenance, and npm audit signatures verifies them.
• The plugin jest suites and the mock-platform e2e jobs run in this PR's CI.

🤖 Generated with Claude Code

---

Summary by cubic

Updates the Ever Platform SDK dependencies to 1.0.0-rc.7 (from rc.6) in the optional Ever Platform plugins and the egress audit tooling. The SDK now pins its production root for https://api.ever.co and lists the live event stream (GET /rt/sse, row 35) in its contract, which Gauzy does not make.

• Pins @ever-co/connect-sdk, @ever-co/connect-contracts, and @ever-co/connect-tools at 1.0.0-rc.7 in @gauzy/plugin-ever-connect and @gauzy/plugin-ever-stats; no code changes, the SDK surface Gauzy uses is identical between rc.6 and rc.7.
• Updates yarn.lock and tools/egress-audit/package-lock.json with the new package versions.
• Adds row 35 to every_trigger_exclude_rows so outbound-calls.mjs --check passes, and regenerates outbound-calls.md listing row 35 as not built in this release.
• Updates patch-mock-clock.mjs to accept harness 1.0.0-rc.7, since the audit job patches the mock platform's entitlement bucket after npm ci and rejects versions it wasn't written for.
• Requires a related update to the published copy of the outbound-calls page in ever-co/ever-gauzy-docs.