@wootsup/yt-builder-mcp 0.2.0-alpha.2

package/dist/setup-cli.js

@@ -0,0 +1,355 @@
+#!/usr/bin/env node
+/**
+ * Top-level CLI dispatcher for `@wootsup/yt-builder-mcp`.
+ *
+ * Round-1 audit I5 fix (2026-05-22): the wizard implementation lives in
+ * `setup-wizard.ts`; this file is the thin dispatcher (`runCli`) plus
+ * the ESM main-guard. Both have their own deps-bag (`WizardDeps` /
+ * `RunCliDeps`) so unit tests can drive them independently.
+ *
+ * Subcommands:
+ *
+ *   setup (default)   — runWizard (see `setup-wizard.ts`)
+ *   install-skill     — copy the bundled skill into ~/.claude/skills/
+ *                       and append a marker block to ~/AGENTS.md.
+ *   --help / help     — print usage.
+ *   --version / -v    — print the package version.
+ *
+ * Re-exports `runWizard`, `majorMinor` and the wizard public types so
+ * existing callers (and tests that already import from `./setup-cli`)
+ * keep working with a one-line import.
+ *
+ * @license MIT
+ */
+import { ALL_CLIENTS } from './clients/index.js';
+import { installSkill as defaultInstallSkill } from './install-skill.js';
+import { SERVER_VERSION } from './server.js';
+import { DEFAULT_WIZARD_DEPS, runWizard as runWizardImpl } from './setup-wizard.js';
+// Re-export the wizard surface so consumers that imported from
+// `./setup-cli` before the I5 split keep working without changes.
+export { DEFAULT_WIZARD_DEPS, majorMinor, runWizard, } from './setup-wizard.js';
+const HELP_TEXT = `Usage: yt-builder-mcp <command> [flags]
+
+Commands:
+  setup            Interactive first-run wizard (default if no command)
+  install-skill    Copy the bundled YOOtheme Builder skill into
+                   ~/.claude/skills/ and register it in ~/AGENTS.md.
+                   Note: ~/.claude/skills/ is the universal-marker path
+                   recognised by Claude Desktop and other AI clients.
+  --version, -v    Print the package version.
+  --help, -h, help Show this message.
+
+Setup flags (for non-interactive / CI usage):
+  --non-interactive       Skip all prompts; fail-fast on missing input.
+  --url <wp-url>          WordPress base URL (required with --non-interactive).
+  --token <bearer>        Bearer key (required with --non-interactive).
+  --client <id>           AI client id to configure; repeatable. Valid ids:
+                          claude-desktop, claude-code, cursor, zed, continue,
+                          cline, roo-code, codex-cli, gemini-cli.
+
+Example (non-interactive):
+  npx -y @wootsup/yt-builder-mcp setup \\
+    --non-interactive \\
+    --client cursor --client claude-desktop \\
+    --url https://example.com \\
+    --token "$YTB_TOKEN"
+
+Pickup mode (one-click setup via wp-admin):
+  --pickup <url>          Pickup URL revealed by the wp-admin "Setup wizard"
+                          flow; e.g. https://example.com/wp-json/yt-builder-mcp/v1/setup/pickup
+  --nonce <code>          One-shot nonce revealed alongside the pickup URL.
+                          Pairs 1:1 with --pickup (both or neither).
+
+  When --pickup + --nonce are passed, the wizard fetches the freshly-minted
+  Bearer + canonical URL from the plugin in a single POST and skips the
+  URL/token prompts entirely. The pickup is IP-bound, single-use, and
+  expires after 5 minutes. If --url or --token are also passed they are
+  ignored (a warning is printed to stderr).
+
+Example (pickup):
+  npx -y @wootsup/yt-builder-mcp setup \\
+    --pickup https://example.com/wp-json/yt-builder-mcp/v1/setup/pickup \\
+    --nonce "$NONCE" \\
+    --client claude-desktop
+
+Environment (when launched by an AI client):
+  YTB_MCP_WP_URL         WordPress base URL (e.g. https://example.com).
+  YTB_MCP_BEARER_TOKEN   Bearer key from wp-admin → Tools → "YT Builder MCP".
+                         Format: ytb_(live|test)_<payload>.<signature>
+  YTB_MCP_TEST_MODE=1    Skip stdio loop (used by smoke tests).
+
+Documentation: https://github.com/wootsup/yt-builder-mcp
+`;
+/**
+ * Parse the `setup` subcommand argv tail. Pure function; does no I/O.
+ *
+ * Accepts both `--key value` and `--key=value` styles. Unknown flags
+ * are reported as errors so typos don't silently disable validation.
+ */
+export function parseSetupArgs(argv) {
+    let nonInteractive = false;
+    let url = '';
+    let token = '';
+    let pickup = '';
+    let nonce = '';
+    const clients = [];
+    const errors = [];
+    const warnings = [];
+    function consumeValue(name, inline, i) {
+        if (inline !== undefined) {
+            return { value: inline, nextIndex: i };
+        }
+        const next = argv[i + 1];
+        if (next === undefined || next.startsWith('--')) {
+            errors.push(`Flag ${name} requires a value.`);
+            return { value: '', nextIndex: i };
+        }
+        return { value: next, nextIndex: i + 1 };
+    }
+    for (let i = 0; i < argv.length; i++) {
+        const raw = argv[i];
+        const eq = raw.indexOf('=');
+        const flag = eq >= 0 ? raw.slice(0, eq) : raw;
+        const inline = eq >= 0 ? raw.slice(eq + 1) : undefined;
+        switch (flag) {
+            case '--non-interactive': {
+                nonInteractive = true;
+                if (inline !== undefined) {
+                    errors.push('Flag --non-interactive does not take a value.');
+                }
+                break;
+            }
+            case '--url': {
+                const { value, nextIndex } = consumeValue('--url', inline, i);
+                url = value.trim().replace(/\/+$/, '');
+                i = nextIndex;
+                break;
+            }
+            case '--token': {
+                const { value, nextIndex } = consumeValue('--token', inline, i);
+                token = value.trim();
+                i = nextIndex;
+                break;
+            }
+            case '--pickup': {
+                const { value, nextIndex } = consumeValue('--pickup', inline, i);
+                pickup = value.trim();
+                i = nextIndex;
+                break;
+            }
+            case '--nonce': {
+                const { value, nextIndex } = consumeValue('--nonce', inline, i);
+                nonce = value.trim();
+                i = nextIndex;
+                break;
+            }
+            case '--client': {
+                const { value, nextIndex } = consumeValue('--client', inline, i);
+                if (value !== '')
+                    clients.push(value.trim());
+                i = nextIndex;
+                break;
+            }
+            default: {
+                errors.push(`Unknown setup flag: ${flag}`);
+            }
+        }
+    }
+    // Pickup mode validation (Wave C). Pickup pairs 1:1 with nonce; when
+    // both are present, the wizard fetches token + URL from the plugin and
+    // ignores --url/--token (with a warning so typos don't go silent).
+    const pickupMode = pickup !== '' || nonce !== '';
+    if (pickupMode) {
+        if (pickup === '')
+            errors.push('--pickup is required when --nonce is given.');
+        if (nonce === '')
+            errors.push('--nonce is required when --pickup is given.');
+        if (url !== '')
+            warnings.push('--url is ignored in pickup mode (the plugin returns the canonical URL).');
+        if (token !== '')
+            warnings.push('--token is ignored in pickup mode (the plugin returns the Bearer token).');
+        if (clients.length === 0) {
+            errors.push('--client is required with --pickup (at least one).');
+        }
+        const knownIds = new Set(ALL_CLIENTS.map((c) => c.id));
+        for (const id of clients) {
+            if (!knownIds.has(id)) {
+                errors.push(`Unknown --client id "${id}". Valid: ${[...knownIds].sort().join(', ')}.`);
+            }
+        }
+    }
+    else if (nonInteractive) {
+        if (url === '')
+            errors.push('--url is required with --non-interactive.');
+        if (token === '')
+            errors.push('--token is required with --non-interactive.');
+        if (clients.length === 0)
+            errors.push('--client is required with --non-interactive (at least one).');
+        const knownIds = new Set(ALL_CLIENTS.map((c) => c.id));
+        for (const id of clients) {
+            if (!knownIds.has(id)) {
+                errors.push(`Unknown --client id "${id}". Valid: ${[...knownIds].sort().join(', ')}.`);
+            }
+        }
+    }
+    return { nonInteractive, url, token, pickup, nonce, clients, errors, warnings };
+}
+/**
+ * Build a `WizardDeps` bag that answers prompts from CLI flags instead
+ * of asking a human. Reuses every other dependency (probes, writes,
+ * handshake) from `DEFAULT_WIZARD_DEPS` so the wizard's exit-code
+ * contract (0/2/3/4/5) stays identical.
+ *
+ * `confirmContinue` always returns `false` — there is no human to ask,
+ * so a probe failure cleanly aborts with the documented exit code.
+ */
+export function buildNonInteractiveDeps(parsed, base = DEFAULT_WIZARD_DEPS) {
+    const answers = {
+        wpUrl: parsed.url,
+        bearer: parsed.token,
+        selectedClients: parsed.clients,
+    };
+    return {
+        ...base,
+        prompt: async () => answers,
+        confirmContinue: async () => false,
+    };
+}
+/**
+ * Build a `WizardDeps` bag for the Wave-C pickup flow. The wizard's
+ * `prompt` step calls `base.fetchPickup(url, nonce)` once, then
+ * synthesises the `WizardAnswers` from the response — the actual answers
+ * (token + canonical WordPress URL) come straight from the plugin via
+ * a 256-bit one-shot nonce, never through chat history / provider logs.
+ *
+ * On `fetchPickup` failure the prompt resolves to `null` so the wizard
+ * exits cleanly with code 130 (user-cancel equivalent — we treat
+ * an unrecoverable pickup as "the conversation ends here"). The
+ * thrown error is logged via the `log` dep so the operator sees why.
+ *
+ * `confirmContinue` returns `false` (same rationale as non-interactive).
+ */
+export function buildPickupDeps(parsed, base = DEFAULT_WIZARD_DEPS) {
+    const pickupUrl = parsed.pickup ?? '';
+    const nonce = parsed.nonce ?? '';
+    const fetchPickup = base.fetchPickup;
+    const logFn = base.log;
+    return {
+        ...base,
+        prompt: async () => {
+            if (fetchPickup === undefined) {
+                const msg = 'Pickup mode requested but no fetchPickup is wired in this WizardDeps bag.';
+                if (logFn !== undefined)
+                    logFn(msg);
+                else
+                    process.stderr.write(`${msg}\n`);
+                return null;
+            }
+            try {
+                const result = await fetchPickup(pickupUrl, nonce);
+                return {
+                    wpUrl: result.siteurl,
+                    bearer: result.token,
+                    selectedClients: parsed.clients,
+                };
+            }
+            catch (e) {
+                const msg = e instanceof Error ? e.message : String(e);
+                if (logFn !== undefined)
+                    logFn(`Pickup failed: ${msg}`);
+                else
+                    process.stderr.write(`Pickup failed: ${msg}\n`);
+                return null;
+            }
+        },
+        confirmContinue: async () => false,
+    };
+}
+export async function runCli(argv, deps) {
+    const out = deps?.log ?? ((s) => process.stdout.write(`${s}\n`));
+    const err = deps?.error ?? ((s) => process.stderr.write(`${s}\n`));
+    const wizard = deps?.runWizard ?? ((wizDeps) => runWizardImpl(wizDeps));
+    const install = deps?.installSkill ?? defaultInstallSkill;
+    const [subcommand] = argv;
+    if (subcommand === undefined || subcommand === 'setup') {
+        const setupArgs = argv[0] === 'setup' ? argv.slice(1) : argv;
+        const parsed = parseSetupArgs(setupArgs);
+        // Surface non-fatal warnings (e.g. "--url ignored in pickup mode").
+        for (const line of parsed.warnings)
+            err(`yt-builder-mcp: warning: ${line}`);
+        const pickupMode = (parsed.pickup ?? '') !== '' || (parsed.nonce ?? '') !== '';
+        if (pickupMode) {
+            if (parsed.errors.length > 0) {
+                for (const line of parsed.errors)
+                    err(`yt-builder-mcp: ${line}`);
+                err(HELP_TEXT);
+                return 2;
+            }
+            return wizard(buildPickupDeps(parsed));
+        }
+        if (parsed.nonInteractive) {
+            if (parsed.errors.length > 0) {
+                for (const line of parsed.errors)
+                    err(`yt-builder-mcp: ${line}`);
+                err(HELP_TEXT);
+                return 2;
+            }
+            return wizard(buildNonInteractiveDeps(parsed));
+        }
+        if (parsed.errors.length > 0) {
+            for (const line of parsed.errors)
+                err(`yt-builder-mcp: ${line}`);
+            err(HELP_TEXT);
+            return 1;
+        }
+        return wizard();
+    }
+    switch (subcommand) {
+        case 'install-skill':
+        case 'install': {
+            try {
+                const result = await install();
+                if (result.markerAlreadyPresent) {
+                    out(`yt-builder-mcp: skill refreshed at ${result.skillTargetDir} (marker already in AGENTS.md).`);
+                }
+                else {
+                    out(`yt-builder-mcp: skill installed at ${result.skillTargetDir}; ${result.agentsFile} updated.`);
+                }
+                return 0;
+            }
+            catch (e) {
+                const msg = e instanceof Error ? e.message : String(e);
+                err(`yt-builder-mcp: install-skill failed: ${msg}`);
+                return 2;
+            }
+        }
+        case '--version':
+        case '-v': {
+            out(SERVER_VERSION);
+            return 0;
+        }
+        case 'help':
+        case '--help':
+        case '-h': {
+            out(HELP_TEXT);
+            return 0;
+        }
+        default: {
+            err(`yt-builder-mcp: unknown command "${subcommand}".`);
+            err(HELP_TEXT);
+            return 1;
+        }
+    }
+}
+// ── direct CLI entry ────────────────────────────────────────────────────
+const isMain = typeof process !== 'undefined' &&
+    process.argv[1] !== undefined &&
+    import.meta.url === `file://${process.argv[1]}`;
+if (isMain) {
+    runCli(process.argv.slice(2)).then((code) => process.exit(code), (err) => {
+        const msg = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`yt-builder-mcp: fatal: ${msg}\n`);
+        process.exit(99);
+    });
+}
+//# sourceMappingURL=setup-cli.js.map

package/dist/setup-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-cli.js","sourceRoot":"","sources":["../src/setup-cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,IAAI,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGpF,+DAA+D;AAC/D,kEAAkE;AAClE,OAAO,EACH,mBAAmB,EACnB,UAAU,EACV,SAAS,GAOZ,MAAM,mBAAmB,CAAC;AAE3B,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmDjB,CAAC;AAkCF;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAuB;IAClD,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,SAAS,YAAY,CAAC,IAAY,EAAE,MAA0B,EAAE,CAAS;QAIrE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QAC3C,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,oBAAoB,CAAC,CAAC;YAC9C,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACvC,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAC7C,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACrB,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9C,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvD,QAAQ,IAAI,EAAE,CAAC;YACX,KAAK,mBAAmB,CAAC,CAAC,CAAC;gBACvB,cAAc,GAAG,IAAI,CAAC;gBACtB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACvB,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;gBACjE,CAAC;gBACD,MAAM;YACV,CAAC;YACD,KAAK,OAAO,CAAC,CAAC,CAAC;gBACX,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBAC9D,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBACvC,CAAC,GAAG,SAAS,CAAC;gBACd,MAAM;YACV,CAAC;YACD,KAAK,SAAS,CAAC,CAAC,CAAC;gBACb,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBAChE,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;gBACrB,CAAC,GAAG,SAAS,CAAC;gBACd,MAAM;YACV,CAAC;YACD,KAAK,UAAU,CAAC,CAAC,CAAC;gBACd,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBACjE,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;gBACtB,CAAC,GAAG,SAAS,CAAC;gBACd,MAAM;YACV,CAAC;YACD,KAAK,SAAS,CAAC,CAAC,CAAC;gBACb,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBAChE,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;gBACrB,CAAC,GAAG,SAAS,CAAC;gBACd,MAAM;YACV,CAAC;YACD,KAAK,UAAU,CAAC,CAAC,CAAC;gBACd,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBACjE,IAAI,KAAK,KAAK,EAAE;oBAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC7C,CAAC,GAAG,SAAS,CAAC;gBACd,MAAM;YACV,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;YAC/C,CAAC;QACL,CAAC;IACL,CAAC;IAED,qEAAqE;IACrE,uEAAuE;IACvE,mEAAmE;IACnE,MAAM,UAAU,GAAG,MAAM,KAAK,EAAE,IAAI,KAAK,KAAK,EAAE,CAAC;IACjD,IAAI,UAAU,EAAE,CAAC;QACb,IAAI,MAAM,KAAK,EAAE;YAAE,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QAC9E,IAAI,KAAK,KAAK,EAAE;YAAE,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QAC7E,IAAI,GAAG,KAAK,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;QACzG,IAAI,KAAK,KAAK,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;QAC5G,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvD,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;YACvB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3F,CAAC;QACL,CAAC;IACL,CAAC;SAAM,IAAI,cAAc,EAAE,CAAC;QACxB,IAAI,GAAG,KAAK,EAAE;YAAE,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QACzE,IAAI,KAAK,KAAK,EAAE;YAAE,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QAC7E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;QACrG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvD,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;YACvB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3F,CAAC;QACL,CAAC;IACL,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACpF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACnC,MAAuB,EACvB,OAAmB,mBAAmB;IAEtC,MAAM,OAAO,GAAkB;QAC3B,KAAK,EAAE,MAAM,CAAC,GAAG;QACjB,MAAM,EAAE,MAAM,CAAC,KAAK;QACpB,eAAe,EAAE,MAAM,CAAC,OAAO;KAClC,CAAC;IACF,OAAO;QACH,GAAG,IAAI;QACP,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,OAAO;QAC3B,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;KACrC,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAC3B,MAAuB,EACvB,OAAmB,mBAAmB;IAEtC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;IACjC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC;IAEvB,OAAO;QACH,GAAG,IAAI;QACP,MAAM,EAAE,KAAK,IAAI,EAAE;YACf,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,GAAG,GAAG,2EAA2E,CAAC;gBACxF,IAAI,KAAK,KAAK,SAAS;oBAAE,KAAK,CAAC,GAAG,CAAC,CAAC;;oBAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;gBACtC,OAAO,IAAI,CAAC;YAChB,CAAC;YACD,IAAI,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;gBACnD,OAAO;oBACH,KAAK,EAAE,MAAM,CAAC,OAAO;oBACrB,MAAM,EAAE,MAAM,CAAC,KAAK;oBACpB,eAAe,EAAE,MAAM,CAAC,OAAO;iBAClC,CAAC;YACN,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACT,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACvD,IAAI,KAAK,KAAK,SAAS;oBAAE,KAAK,CAAC,kBAAkB,GAAG,EAAE,CAAC,CAAC;;oBACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;gBACrD,OAAO,IAAI,CAAC;YAChB,CAAC;QACL,CAAC;QACD,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;KACrC,CAAC;AACN,CAAC;AAgBD,MAAM,CAAC,KAAK,UAAU,MAAM,CACxB,IAAuB,EACvB,IAA0B;IAE1B,MAAM,GAAG,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,MAAM,GAAG,GACL,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,IAAI,EAAE,SAAS,IAAI,CAAC,CAAC,OAAoB,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,IAAI,EAAE,YAAY,IAAI,mBAAmB,CAAC;IAE1D,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IAE1B,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7D,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QAEzC,oEAAoE;QACpE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,QAAQ;YAAE,GAAG,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC;QAE5E,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QAE/E,IAAI,UAAU,EAAE,CAAC;YACb,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM;oBAAE,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;gBACjE,GAAG,CAAC,SAAS,CAAC,CAAC;gBACf,OAAO,CAAC,CAAC;YACb,CAAC;YACD,OAAO,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM;oBAAE,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;gBACjE,GAAG,CAAC,SAAS,CAAC,CAAC;gBACf,OAAO,CAAC,CAAC;YACb,CAAC;YACD,OAAO,MAAM,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM;gBAAE,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;YACjE,GAAG,CAAC,SAAS,CAAC,CAAC;YACf,OAAO,CAAC,CAAC;QACb,CAAC;QACD,OAAO,MAAM,EAAE,CAAC;IACpB,CAAC;IAED,QAAQ,UAAU,EAAE,CAAC;QACjB,KAAK,eAAe,CAAC;QACrB,KAAK,SAAS,CAAC,CAAC,CAAC;YACb,IAAI,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC;gBAC/B,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;oBAC9B,GAAG,CACC,sCAAsC,MAAM,CAAC,cAAc,iCAAiC,CAC/F,CAAC;gBACN,CAAC;qBAAM,CAAC;oBACJ,GAAG,CACC,sCAAsC,MAAM,CAAC,cAAc,KAAK,MAAM,CAAC,UAAU,WAAW,CAC/F,CAAC;gBACN,CAAC;gBACD,OAAO,CAAC,CAAC;YACb,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACT,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACvD,GAAG,CAAC,yCAAyC,GAAG,EAAE,CAAC,CAAC;gBACpD,OAAO,CAAC,CAAC;YACb,CAAC;QACL,CAAC;QACD,KAAK,WAAW,CAAC;QACjB,KAAK,IAAI,CAAC,CAAC,CAAC;YACR,GAAG,CAAC,cAAc,CAAC,CAAC;YACpB,OAAO,CAAC,CAAC;QACb,CAAC;QACD,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI,CAAC,CAAC,CAAC;YACR,GAAG,CAAC,SAAS,CAAC,CAAC;YACf,OAAO,CAAC,CAAC;QACb,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACN,GAAG,CAAC,oCAAoC,UAAU,IAAI,CAAC,CAAC;YACxD,GAAG,CAAC,SAAS,CAAC,CAAC;YACf,OAAO,CAAC,CAAC;QACb,CAAC;IACL,CAAC;AACL,CAAC;AAED,2EAA2E;AAE3E,MAAM,MAAM,GACR,OAAO,OAAO,KAAK,WAAW;IAC9B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;IAC7B,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AAEpD,IAAI,MAAM,EAAE,CAAC;IACT,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAC9B,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAC5B,CAAC,GAAY,EAAE,EAAE;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,GAAG,IAAI,CAAC,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrB,CAAC,CACJ,CAAC;AACN,CAAC"}

package/dist/setup-prompts.d.ts

@@ -0,0 +1,41 @@
+/**
+ * `setup-prompts` — interactive clack prompts for the setup wizard.
+ *
+ * Split from `setup-wizard-defaults.ts` in Round-1.5 (replaces the
+ * Round-1 LoC-exception spec-amendment with a structural code-fix).
+ *
+ * Cohesion:
+ *  - this file owns every clack/inquirer-style prompt sequence
+ *    (`defaultPrompt`, `defaultConfirmContinue`) — pure terminal
+ *    I/O, no REST / file-system side effects.
+ *  - `setup-wizard-defaults.ts` retains the real-I/O implementations
+ *    (RestClient probes, file-system writers, rollback, handshake).
+ *
+ * @license MIT
+ */
+import { type DetectedClient } from './clients/index.js';
+import type { WizardAnswers } from './setup-wizard-types.js';
+/**
+ * Interactive multi-step prompt sequence — Wave 6.5 UX-parity with
+ * api-mapper:
+ *
+ *   1. password input for the Bearer key (length-validated)
+ *   2. decode the token's signed payload (signature-unverified) and use
+ *      `iss` to pre-fill the URL prompt — the typical user only needs
+ *      to press Enter here
+ *   3. text input for the profile name (default: `default`) — supports
+ *      multi-site usage in a single wizard install
+ *   4. multiselect AI clients (pre-populates with detected clients)
+ *
+ * Returns `null` when the user cancels any prompt — `runWizard`
+ * treats that as a clean exit.
+ */
+export declare function defaultPrompt(input: {
+    detected: readonly DetectedClient[];
+}): Promise<WizardAnswers | null>;
+/**
+ * Yes/no confirmation prompt. Returns `false` on cancel (safer default
+ * than `true` — the wizard treats it as "don't continue").
+ */
+export declare function defaultConfirmContinue(message: string): Promise<boolean>;
+//# sourceMappingURL=setup-prompts.d.ts.map

package/dist/setup-prompts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-prompts.d.ts","sourceRoot":"","sources":["../src/setup-prompts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAYH,OAAO,EAEH,KAAK,cAAc,EACtB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAE7D;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE;IACvC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;CACvC,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAmGhC;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAI9E"}

package/dist/setup-prompts.js

@@ -0,0 +1,142 @@
+/**
+ * `setup-prompts` — interactive clack prompts for the setup wizard.
+ *
+ * Split from `setup-wizard-defaults.ts` in Round-1.5 (replaces the
+ * Round-1 LoC-exception spec-amendment with a structural code-fix).
+ *
+ * Cohesion:
+ *  - this file owns every clack/inquirer-style prompt sequence
+ *    (`defaultPrompt`, `defaultConfirmContinue`) — pure terminal
+ *    I/O, no REST / file-system side effects.
+ *  - `setup-wizard-defaults.ts` retains the real-I/O implementations
+ *    (RestClient probes, file-system writers, rollback, handshake).
+ *
+ * @license MIT
+ */
+import { cancel, confirm as clackConfirm, intro, isCancel, multiselect, password, text, } from '@clack/prompts';
+import { ALL_CLIENTS, } from './clients/index.js';
+import { SERVER_NAME, SERVER_VERSION } from './server.js';
+import { decodeToken, normaliseUrl } from './setup-token.js';
+/**
+ * Interactive multi-step prompt sequence — Wave 6.5 UX-parity with
+ * api-mapper:
+ *
+ *   1. password input for the Bearer key (length-validated)
+ *   2. decode the token's signed payload (signature-unverified) and use
+ *      `iss` to pre-fill the URL prompt — the typical user only needs
+ *      to press Enter here
+ *   3. text input for the profile name (default: `default`) — supports
+ *      multi-site usage in a single wizard install
+ *   4. multiselect AI clients (pre-populates with detected clients)
+ *
+ * Returns `null` when the user cancels any prompt — `runWizard`
+ * treats that as a clean exit.
+ */
+export async function defaultPrompt(input) {
+    intro(`${SERVER_NAME} v${SERVER_VERSION} — setup wizard`);
+    // 1. Bearer key first. Decoded `iss` will pre-fill the URL prompt.
+    const bearerRaw = await password({
+        message: 'Bearer key (from wp-admin → Tools → "YT Builder MCP" → Bearer Keys):',
+        validate: (v) => {
+            const trimmed = v.trim();
+            if (trimmed === '')
+                return 'Bearer key is required.';
+            if (trimmed.length < 16) {
+                return 'Bearer key looks too short — expected at least 16 chars.';
+            }
+            return undefined;
+        },
+    });
+    if (isCancel(bearerRaw)) {
+        cancel('Setup cancelled.');
+        return null;
+    }
+    const bearer = bearerRaw.trim();
+    const decoded = decodeToken(bearer);
+    const urlInitial = decoded?.iss ?? '';
+    // 2. WordPress site URL — pre-filled from the decoded `iss` claim
+    //    when the token was decodable; the user just presses Enter.
+    const wpUrlRaw = await text({
+        message: urlInitial !== ''
+            ? 'WordPress site URL (pre-filled from your key — press Enter to accept):'
+            : 'WordPress site URL (e.g. https://example.com):',
+        placeholder: urlInitial !== '' ? urlInitial : 'https://example.com',
+        initialValue: urlInitial,
+        validate: (v) => {
+            const trimmed = v.trim();
+            if (trimmed === '')
+                return 'URL is required.';
+            if (!/^https?:\/\//.test(trimmed)) {
+                return 'URL must start with http:// or https://.';
+            }
+            try {
+                void new URL(trimmed);
+            }
+            catch {
+                return 'URL is not a valid web address.';
+            }
+            return undefined;
+        },
+    });
+    if (isCancel(wpUrlRaw)) {
+        cancel('Setup cancelled.');
+        return null;
+    }
+    const wpUrl = normaliseUrl(wpUrlRaw);
+    // 3. Profile name — multi-site switching. Default 'default'.
+    const profileRaw = await text({
+        message: 'Profile name (for switching between sites):',
+        placeholder: 'default',
+        initialValue: 'default',
+        validate: (v) => {
+            const trimmed = v.trim();
+            if (trimmed === '')
+                return 'Profile name is required.';
+            if (!/^[a-zA-Z0-9_-]+$/.test(trimmed)) {
+                return 'Use letters, digits, dashes, or underscores only.';
+            }
+            return undefined;
+        },
+    });
+    if (isCancel(profileRaw)) {
+        cancel('Setup cancelled.');
+        return null;
+    }
+    const profileName = profileRaw.trim();
+    // 4. AI client selection (multi-select; pre-checks detected ones).
+    const clientChoices = ALL_CLIENTS.map((c) => {
+        const detection = input.detected.find((d) => d.id === c.id);
+        return {
+            value: c.id,
+            label: detection?.detected === true ? `${c.label}  (detected)` : c.label,
+            hint: detection?.configPath ?? '',
+        };
+    });
+    const selectedRaw = await multiselect({
+        message: 'Which AI clients should we configure?',
+        options: clientChoices,
+        initialValues: input.detected.filter((d) => d.detected).map((d) => d.id),
+        required: true,
+    });
+    if (isCancel(selectedRaw)) {
+        cancel('Setup cancelled.');
+        return null;
+    }
+    return {
+        wpUrl,
+        bearer,
+        selectedClients: selectedRaw,
+        profileName,
+    };
+}
+/**
+ * Yes/no confirmation prompt. Returns `false` on cancel (safer default
+ * than `true` — the wizard treats it as "don't continue").
+ */
+export async function defaultConfirmContinue(message) {
+    const ans = await clackConfirm({ message, initialValue: false });
+    if (isCancel(ans))
+        return false;
+    return ans === true;
+}
+//# sourceMappingURL=setup-prompts.js.map

package/dist/setup-prompts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-prompts.js","sourceRoot":"","sources":["../src/setup-prompts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACH,MAAM,EACN,OAAO,IAAI,YAAY,EACvB,KAAK,EACL,QAAQ,EACR,WAAW,EACX,QAAQ,EACR,IAAI,GACP,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACH,WAAW,GAEd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAG7D;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAEnC;IACG,KAAK,CAAC,GAAG,WAAW,KAAK,cAAc,iBAAiB,CAAC,CAAC;IAE1D,mEAAmE;IACnE,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC;QAC7B,OAAO,EAAE,sEAAsE;QAC/E,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;YACZ,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,OAAO,KAAK,EAAE;gBAAE,OAAO,yBAAyB,CAAC;YACrD,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;gBACtB,OAAO,0DAA0D,CAAC;YACtE,CAAC;YACD,OAAO,SAAS,CAAC;QACrB,CAAC;KACJ,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAI,SAAoB,CAAC,IAAI,EAAE,CAAC;IAE5C,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAEtC,kEAAkE;IAClE,gEAAgE;IAChE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC;QACxB,OAAO,EAAE,UAAU,KAAK,EAAE;YACtB,CAAC,CAAC,wEAAwE;YAC1E,CAAC,CAAC,gDAAgD;QACtD,WAAW,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,qBAAqB;QACnE,YAAY,EAAE,UAAU;QACxB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;YACZ,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,OAAO,KAAK,EAAE;gBAAE,OAAO,kBAAkB,CAAC;YAC9C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChC,OAAO,0CAA0C,CAAC;YACtD,CAAC;YACD,IAAI,CAAC;gBACD,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACL,OAAO,iCAAiC,CAAC;YAC7C,CAAC;YACD,OAAO,SAAS,CAAC;QACrB,CAAC;KACJ,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,QAAkB,CAAC,CAAC;IAE/C,6DAA6D;IAC7D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC;QAC1B,OAAO,EAAE,6CAA6C;QACtD,WAAW,EAAE,SAAS;QACtB,YAAY,EAAE,SAAS;QACvB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;YACZ,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,OAAO,KAAK,EAAE;gBAAE,OAAO,2BAA2B,CAAC;YACvD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpC,OAAO,mDAAmD,CAAC;YAC/D,CAAC;YACD,OAAO,SAAS,CAAC;QACrB,CAAC;KACJ,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,WAAW,GAAI,UAAqB,CAAC,IAAI,EAAE,CAAC;IAElD,mEAAmE;IACnE,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACxC,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5D,OAAO;YACH,KAAK,EAAE,CAAC,CAAC,EAAE;YACX,KAAK,EAAE,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK;YACxE,IAAI,EAAE,SAAS,EAAE,UAAU,IAAI,EAAE;SACpC,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC;QAClC,OAAO,EAAE,uCAAuC;QAChD,OAAO,EAAE,aAAa;QACtB,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,QAAQ,EAAE,IAAI;KACjB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,OAAO;QACH,KAAK;QACL,MAAM;QACN,eAAe,EAAE,WAAuB;QACxC,WAAW;KACd,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAAe;IACxD,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,IAAI,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAChC,OAAO,GAAG,KAAK,IAAI,CAAC;AACxB,CAAC"}

package/dist/setup-token.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Pure helpers for the setup wizard — token decode + URL extraction.
+ *
+ * Split out of `setup-prompts.ts` so it can be unit-tested without a TTY
+ * and so the `runWizard` body can decode a token without dragging in the
+ * @clack/prompts UI surface.
+ *
+ * The decode is intentionally signature-UNVERIFIED. The wizard cannot
+ * verify the HMAC signature (that requires the plugin's signing-secret
+ * which only the server holds). We use the decoded payload purely to
+ * pre-fill the URL prompt as a convenience — the canonical auth check
+ * happens later when `runWizard` hits `/v1/health` with the token; if
+ * the payload has been tampered with, that probe rejects it.
+ *
+ * @license MIT
+ */
+import type { DecodedTokenPayload } from './setup-wizard-types.js';
+/**
+ * Decode the base64url payload of a Bearer key.
+ *
+ * Returns `null` when the token shape is invalid OR the payload JSON is
+ * malformed OR the required fields (kid + scope + iss) are missing or
+ * the wrong type. Callers should treat `null` as "this token is unusable
+ * for URL pre-fill; ask the user to type the URL by hand."
+ */
+export declare function decodeToken(token: string): DecodedTokenPayload | null;
+/**
+ * Normalise a URL string the way the wizard wants it:
+ *  - trim whitespace
+ *  - strip trailing slashes
+ *  - return empty string on null/undefined input
+ *
+ * Exposed so the prompt validator and the identity probe share one
+ * canonicalisation rule (otherwise drift causes "looks the same to the
+ * human, mismatches in code" bugs).
+ */
+export declare function normaliseUrl(input: string | null | undefined): string;
+//# sourceMappingURL=setup-token.d.ts.map

package/dist/setup-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-token.d.ts","sourceRoot":"","sources":["../src/setup-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAKnE;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAmDrE;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAGrE"}