@wootsup/yt-builder-mcp 1.0.0 → 1.0.1

package/dist/clients/index.js

@@ -1,72 +0,0 @@
-/**
- * Client-config-writers.
- *
- * Each supported AI client has its own module that knows
- *   - which config file to read/write
- *   - what JSON shape to inject under `mcpServers` (or equivalent)
- *
- * The setup wizard calls `detectAvailableClients()` to enumerate, then
- * `writeClientConfig({client, server})` once the user picks one.
- *
- * @license MIT
- */
-import { existsSync } from 'node:fs';
-import { mkdir, readFile, writeFile } from 'node:fs/promises';
-import { dirname } from 'node:path';
-import { claudeCodeClient } from './claude-code.js';
-import { claudeDesktopClient } from './claude-desktop.js';
-import { clineClient } from './cline.js';
-import { codexCliClient } from './codex-cli.js';
-import { continueClient } from './continue.js';
-import { cursorClient } from './cursor.js';
-import { geminiCliClient } from './gemini-cli.js';
-import { rooCodeClient } from './roo-code.js';
-import { zedClient } from './zed.js';
-export const ALL_CLIENTS = [
-    claudeDesktopClient,
-    claudeCodeClient,
-    cursorClient,
-    zedClient,
-    continueClient,
-    clineClient,
-    rooCodeClient,
-    codexCliClient,
-    geminiCliClient,
-];
-export function detectAvailableClients() {
-    return ALL_CLIENTS.map((c) => ({
-        id: c.id,
-        label: c.label,
-        configPath: c.configPath(),
-        detected: c.isDetected(),
-    }));
-}
-export function findClient(id) {
-    return ALL_CLIENTS.find((c) => c.id === id);
-}
-/**
- * Shared helper: read a JSON file, mutate via callback, write back.
- * Creates parent directories if missing.
- */
-export async function patchJsonFile(path, mutator) {
-    let current = {};
-    if (existsSync(path)) {
-        try {
-            const raw = await readFile(path, 'utf-8');
-            const parsed = raw.trim() === '' ? {} : JSON.parse(raw);
-            if (parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)) {
-                current = parsed;
-            }
-        }
-        catch {
-            current = {};
-        }
-    }
-    else {
-        await mkdir(dirname(path), { recursive: true });
-    }
-    const next = mutator(current);
-    await writeFile(path, JSON.stringify(next, null, 2) + '\n', 'utf-8');
-}
-export { claudeCodeClient, claudeDesktopClient, clineClient, codexCliClient, continueClient, cursorClient, geminiCliClient, rooCodeClient, zedClient, };
-//# sourceMappingURL=index.js.map

package/dist/clients/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/clients/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAmBrC,MAAM,CAAC,MAAM,WAAW,GAA4B;IAChD,mBAAmB;IACnB,gBAAgB;IAChB,YAAY;IACZ,SAAS;IACT,cAAc;IACd,WAAW;IACX,aAAa;IACb,cAAc;IACd,eAAe;CAClB,CAAC;AASF,MAAM,UAAU,sBAAsB;IAClC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3B,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE;QAC1B,QAAQ,EAAE,CAAC,CAAC,UAAU,EAAE;KAC3B,CAAC,CAAC,CAAC;AACR,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,EAAU;IACjC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAC/B,IAAY,EACZ,OAAsE;IAEtE,IAAI,OAAO,GAA4B,EAAE,CAAC;IAC1C,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAa,CAAC;YACrE,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1E,OAAO,GAAG,MAAiC,CAAC;YAChD,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,GAAG,EAAE,CAAC;QACjB,CAAC;IACL,CAAC;SAAM,CAAC;QACJ,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;AACzE,CAAC;AAED,OAAO,EACH,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,EACX,cAAc,EACd,cAAc,EACd,YAAY,EACZ,eAAe,EACf,aAAa,EACb,SAAS,GACZ,CAAC"}

package/dist/clients/roo-code.d.ts

@@ -1,23 +0,0 @@
-/**
- * Roo Code MCP config writer.
- *
- * Roo Code (formerly Roo Cline) is the VS Code extension
- * `rooveterinaryinc.roo-cline` — a fork of Cline. It follows the
- * same VS Code globalStorage layout but its own settings file is
- * named `mcp_settings.json` (without the legacy `cline_` prefix
- * its parent uses).
- *
- *   <vsCodeUserDir>/globalStorage/rooveterinaryinc.roo-cline/settings/mcp_settings.json
- *
- * VS Code's `<vsCodeUserDir>` is:
- *   macOS:    ~/Library/Application Support/Code/User
- *   Linux:    ~/.config/Code/User
- *   Windows:  %APPDATA%\Code\User
- *
- * Schema mirrors Claude Desktop's `mcpServers` map.
- *
- * @license MIT
- */
-import { type ClientWriter } from './index.js';
-export declare const rooCodeClient: ClientWriter;
-//# sourceMappingURL=roo-code.d.ts.map

package/dist/clients/roo-code.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"roo-code.d.ts","sourceRoot":"","sources":["../../src/clients/roo-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAOH,OAAO,EAAiB,KAAK,YAAY,EAAwB,MAAM,YAAY,CAAC;AAkCpF,eAAO,MAAM,aAAa,EAAE,YAqB3B,CAAC"}

package/dist/clients/roo-code.js

@@ -1,69 +0,0 @@
-/**
- * Roo Code MCP config writer.
- *
- * Roo Code (formerly Roo Cline) is the VS Code extension
- * `rooveterinaryinc.roo-cline` — a fork of Cline. It follows the
- * same VS Code globalStorage layout but its own settings file is
- * named `mcp_settings.json` (without the legacy `cline_` prefix
- * its parent uses).
- *
- *   <vsCodeUserDir>/globalStorage/rooveterinaryinc.roo-cline/settings/mcp_settings.json
- *
- * VS Code's `<vsCodeUserDir>` is:
- *   macOS:    ~/Library/Application Support/Code/User
- *   Linux:    ~/.config/Code/User
- *   Windows:  %APPDATA%\Code\User
- *
- * Schema mirrors Claude Desktop's `mcpServers` map.
- *
- * @license MIT
- */
-import { existsSync } from 'node:fs';
-import { platform } from 'node:os';
-import { join } from 'node:path';
-import { userHome } from './home.js';
-import { patchJsonFile } from './index.js';
-const EXTENSION_ID = 'rooveterinaryinc.roo-cline';
-const SETTINGS_FILENAME = 'mcp_settings.json';
-function vsCodeUserDir() {
-    const home = userHome();
-    switch (platform()) {
-        case 'darwin':
-            return join(home, 'Library', 'Application Support', 'Code', 'User');
-        case 'win32': {
-            const appData = process.env.APPDATA ?? join(home, 'AppData', 'Roaming');
-            return join(appData, 'Code', 'User');
-        }
-        default:
-            return join(home, '.config', 'Code', 'User');
-    }
-}
-function configPath() {
-    return join(vsCodeUserDir(), 'globalStorage', EXTENSION_ID, 'settings', SETTINGS_FILENAME);
-}
-function isDetected() {
-    const extDir = join(vsCodeUserDir(), 'globalStorage', EXTENSION_ID);
-    return existsSync(extDir) || existsSync(configPath());
-}
-export const rooCodeClient = {
-    id: 'roo-code',
-    label: 'Roo Code (VS Code)',
-    configPath,
-    isDetected,
-    apply: async (serverName, config) => {
-        await patchJsonFile(configPath(), (current) => {
-            const servers = current.mcpServers !== null &&
-                typeof current.mcpServers === 'object' &&
-                !Array.isArray(current.mcpServers)
-                ? { ...current.mcpServers }
-                : {};
-            servers[serverName] = {
-                command: config.command,
-                args: config.args,
-                env: config.env,
-            };
-            return { ...current, mcpServers: servers };
-        });
-    },
-};
-//# sourceMappingURL=roo-code.js.map

package/dist/clients/roo-code.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"roo-code.js","sourceRoot":"","sources":["../../src/clients/roo-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,aAAa,EAA2C,MAAM,YAAY,CAAC;AAEpF,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAClD,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAE9C,SAAS,aAAa;IAClB,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IACxB,QAAQ,QAAQ,EAAE,EAAE,CAAC;QACjB,KAAK,QAAQ;YACT,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACxE,KAAK,OAAO,CAAC,CAAC,CAAC;YACX,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;YACxE,OAAO,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QACD;YACI,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;AACL,CAAC;AAED,SAAS,UAAU;IACf,OAAO,IAAI,CACP,aAAa,EAAE,EACf,eAAe,EACf,YAAY,EACZ,UAAU,EACV,iBAAiB,CACpB,CAAC;AACN,CAAC;AAED,SAAS,UAAU;IACf,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;IACpE,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAiB;IACvC,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,oBAAoB;IAC3B,UAAU;IACV,UAAU;IACV,KAAK,EAAE,KAAK,EAAE,UAAkB,EAAE,MAAuB,EAAE,EAAE;QACzD,MAAM,aAAa,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE;YAC1C,MAAM,OAAO,GACT,OAAO,CAAC,UAAU,KAAK,IAAI;gBAC3B,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ;gBACtC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC;gBAC9B,CAAC,CAAC,EAAE,GAAI,OAAO,CAAC,UAAsC,EAAE;gBACxD,CAAC,CAAC,EAAE,CAAC;YACb,OAAO,CAAC,UAAU,CAAC,GAAG;gBAClB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,GAAG,EAAE,MAAM,CAAC,GAAG;aAClB,CAAC;YACF,OAAO,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QAC/C,CAAC,CAAC,CAAC;IACP,CAAC;CACJ,CAAC"}

package/dist/clients/zed.d.ts

@@ -1,12 +0,0 @@
-/**
- * Zed MCP config writer.
- *
- *   Global: ~/.config/zed/settings.json  (JSONC; we treat as JSON for write)
- *
- * Schema: `context_servers` map (Zed-specific naming).
- *
- * @license MIT
- */
-import { type ClientWriter } from './index.js';
-export declare const zedClient: ClientWriter;
-//# sourceMappingURL=zed.d.ts.map

package/dist/clients/zed.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"zed.d.ts","sourceRoot":"","sources":["../../src/clients/zed.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,EAAiB,KAAK,YAAY,EAAwB,MAAM,YAAY,CAAC;AAMpF,eAAO,MAAM,SAAS,EAAE,YAwBvB,CAAC"}

package/dist/clients/zed.js

@@ -1,41 +0,0 @@
-/**
- * Zed MCP config writer.
- *
- *   Global: ~/.config/zed/settings.json  (JSONC; we treat as JSON for write)
- *
- * Schema: `context_servers` map (Zed-specific naming).
- *
- * @license MIT
- */
-import { existsSync } from 'node:fs';
-import { join } from 'node:path';
-import { userHome } from './home.js';
-import { patchJsonFile } from './index.js';
-function configPath() {
-    return join(userHome(), '.config', 'zed', 'settings.json');
-}
-export const zedClient = {
-    id: 'zed',
-    label: 'Zed',
-    configPath,
-    isDetected: () => existsSync(join(userHome(), '.config', 'zed')),
-    apply: async (serverName, config) => {
-        await patchJsonFile(configPath(), (current) => {
-            const servers = current.context_servers !== null &&
-                typeof current.context_servers === 'object' &&
-                !Array.isArray(current.context_servers)
-                ? { ...current.context_servers }
-                : {};
-            servers[serverName] = {
-                command: {
-                    path: config.command,
-                    args: config.args,
-                    env: config.env,
-                },
-                settings: {},
-            };
-            return { ...current, context_servers: servers };
-        });
-    },
-};
-//# sourceMappingURL=zed.js.map

package/dist/clients/zed.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"zed.js","sourceRoot":"","sources":["../../src/clients/zed.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,aAAa,EAA2C,MAAM,YAAY,CAAC;AAEpF,SAAS,UAAU;IACf,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAiB;IACnC,EAAE,EAAE,KAAK;IACT,KAAK,EAAE,KAAK;IACZ,UAAU;IACV,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAChE,KAAK,EAAE,KAAK,EAAE,UAAkB,EAAE,MAAuB,EAAE,EAAE;QACzD,MAAM,aAAa,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE;YAC1C,MAAM,OAAO,GACT,OAAO,CAAC,eAAe,KAAK,IAAI;gBAChC,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ;gBAC3C,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC;gBACnC,CAAC,CAAC,EAAE,GAAI,OAAO,CAAC,eAA2C,EAAE;gBAC7D,CAAC,CAAC,EAAE,CAAC;YACb,OAAO,CAAC,UAAU,CAAC,GAAG;gBAClB,OAAO,EAAE;oBACL,IAAI,EAAE,MAAM,CAAC,OAAO;oBACpB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,GAAG,EAAE,MAAM,CAAC,GAAG;iBAClB;gBACD,QAAQ,EAAE,EAAE;aACf,CAAC;YACF,OAAO,EAAE,GAAG,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;QACpD,CAAC,CAAC,CAAC;IACP,CAAC;CACJ,CAAC"}

package/dist/errors/hints.d.ts

@@ -1,51 +0,0 @@
-/**
- * Error-code taxonomy + AI-friendly hint messages.
- *
- * `classify(status)` maps the HTTP status of a failed REST call into one
- * of nine canonical `YtbErrorCode` values. `hintFor(code)` returns a
- * recovery-oriented hint string the LLM can act on without re-reading the
- * raw error message.
- *
- * Centralising the taxonomy means every tool's catch-block emits the
- * same vocabulary, and the audit gate can pin the exact set of hints
- * that ship.
- *
- * Reference: `apimapper-mcp/src/modules/apimapper/client.ts:hintFor`
- * (Wave G.6.1 — same shape, ported for the YOOtheme Builder REST API).
- *
- * @license MIT
- */
-/**
- * Canonical YOOtheme-Builder-MCP error code union.
- *
- * Order is documentary only — `classify()` returns whichever applies.
- */
-export type YtbErrorCode = 'auth_invalid' | 'auth_missing' | 'forbidden' | 'not_found' | 'conflict_etag' | 'validation_error' | 'rate_limit' | 'server_error' | 'network';
-/** Options for `classify()` — second-tier signals (e.g. response headers). */
-export interface ClassifyOptions {
-    /**
-     * Whether the response carried a `WWW-Authenticate` header. Used to
-     * distinguish `auth_missing` (no bearer sent → server didn't ask for one
-     * via WWW-Authenticate; misconfigured client) from `auth_invalid`
-     * (server rejected the bearer that WAS sent).
-     */
-    readonly hasWwwAuthenticate?: boolean;
-}
-/**
- * Map an HTTP status into a `YtbErrorCode`.
- *
- * Special-cases:
- *   - 401 with `hasWwwAuthenticate: false` → `auth_missing`
- *   - 401 with `hasWwwAuthenticate: true`  → `auth_invalid` (default)
- *   - 412 (Precondition Failed) is treated as `conflict_etag` alongside 409.
- *   - Status 0 (no response) → `network`.
- *   - Anything we don't recognise (incl. 2xx) → `server_error` so the agent
- *     sees a non-empty hint rather than silently swallowing.
- */
-export declare function classify(status: number, options?: ClassifyOptions): YtbErrorCode;
-/**
- * Return a focused hint describing how the agent (or the user) can
- * recover from a given error code. Always non-empty.
- */
-export declare function hintFor(code: YtbErrorCode): string;
-//# sourceMappingURL=hints.d.ts.map

package/dist/errors/hints.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"hints.d.ts","sourceRoot":"","sources":["../../src/errors/hints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAClB,cAAc,GACd,cAAc,GACd,WAAW,GACX,WAAW,GACX,eAAe,GACf,kBAAkB,GAClB,YAAY,GACZ,cAAc,GACd,SAAS,CAAC;AAEhB,8EAA8E;AAC9E,MAAM,WAAW,eAAe;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CACzC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,YAAY,CAYpF;AAED;;;GAGG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CA2DlD"}

package/dist/errors/hints.js

@@ -1,95 +0,0 @@
-/**
- * Error-code taxonomy + AI-friendly hint messages.
- *
- * `classify(status)` maps the HTTP status of a failed REST call into one
- * of nine canonical `YtbErrorCode` values. `hintFor(code)` returns a
- * recovery-oriented hint string the LLM can act on without re-reading the
- * raw error message.
- *
- * Centralising the taxonomy means every tool's catch-block emits the
- * same vocabulary, and the audit gate can pin the exact set of hints
- * that ship.
- *
- * Reference: `apimapper-mcp/src/modules/apimapper/client.ts:hintFor`
- * (Wave G.6.1 — same shape, ported for the YOOtheme Builder REST API).
- *
- * @license MIT
- */
-/**
- * Map an HTTP status into a `YtbErrorCode`.
- *
- * Special-cases:
- *   - 401 with `hasWwwAuthenticate: false` → `auth_missing`
- *   - 401 with `hasWwwAuthenticate: true`  → `auth_invalid` (default)
- *   - 412 (Precondition Failed) is treated as `conflict_etag` alongside 409.
- *   - Status 0 (no response) → `network`.
- *   - Anything we don't recognise (incl. 2xx) → `server_error` so the agent
- *     sees a non-empty hint rather than silently swallowing.
- */
-export function classify(status, options = {}) {
-    if (status === 0)
-        return 'network';
-    if (status === 401) {
-        return options.hasWwwAuthenticate === false ? 'auth_missing' : 'auth_invalid';
-    }
-    if (status === 403)
-        return 'forbidden';
-    if (status === 404)
-        return 'not_found';
-    if (status === 409 || status === 412)
-        return 'conflict_etag';
-    if (status === 422)
-        return 'validation_error';
-    if (status === 429)
-        return 'rate_limit';
-    if (status >= 500)
-        return 'server_error';
-    return 'server_error';
-}
-/**
- * Return a focused hint describing how the agent (or the user) can
- * recover from a given error code. Always non-empty.
- */
-export function hintFor(code) {
-    switch (code) {
-        case 'auth_invalid':
-            return ('Bearer key rejected (HTTP 401, key signature invalid or revoked). ' +
-                'Open wp-admin → Tools → "YT Builder MCP" → Bearer Keys, regenerate the ' +
-                'key, and update YTB_MCP_BEARER_TOKEN in your AI-client config. ' +
-                'Then restart the client.');
-        case 'auth_missing':
-            return ('No Bearer credential sent (HTTP 401 without WWW-Authenticate echo). ' +
-                'Set the YTB_MCP_BEARER_TOKEN environment variable in your AI-client ' +
-                'MCP configuration to a key generated by the plugin Settings page.');
-        case 'forbidden':
-            return ('Permission denied (HTTP 403). Your Bearer key lacks the required ' +
-                'scope for this operation. Regenerate a key with the correct ' +
-                'scope (read / write / admin) in the plugin Settings page.');
-        case 'not_found':
-            return ('Resource not found (HTTP 404). Use the matching `*_list` tool ' +
-                '(yootheme_builder_pages_list, yootheme_builder_element_list, …) ' +
-                'to discover valid IDs / paths. IDs are case-sensitive.');
-        case 'conflict_etag':
-            return ('Optimistic-lock failed (HTTP 409/412). Another writer changed ' +
-                'the state since you fetched it. Call yootheme_builder_get_etag ' +
-                'again to get the fresh ETag, then retry your write with that ETag.');
-        case 'validation_error':
-            return ('Request body failed validation (HTTP 422). Re-check the tool\'s ' +
-                'inputSchema and the element-type schema via ' +
-                'yootheme_builder_element_type_get_schema for valid `props` keys.');
-        case 'rate_limit':
-            return ('Rate limit reached (HTTP 429). This is likely Cloudflare or ' +
-                'another WAF in front of WordPress, not the plugin itself. Wait ' +
-                'a few seconds and retry. If persistent, check the WAF rate-limit ' +
-                'rule in your Cloudflare dashboard.');
-        case 'server_error':
-            return ('Upstream server error (HTTP 5xx or unexpected status). Retry ' +
-                'after a short delay; if it persists, check the WordPress error ' +
-                'log (wp-content/debug.log) for the underlying PHP exception.');
-        case 'network':
-            return ('Network or timeout error reaching WordPress. Verify ' +
-                'YTB_MCP_WP_URL is correct and reachable from this host (try ' +
-                '`curl <YTB_MCP_WP_URL>/wp-json/yt-builder-mcp/v1/health`).');
-    }
-}
-//# sourceMappingURL=hints.js.map

package/dist/errors/hints.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"hints.js","sourceRoot":"","sources":["../../src/errors/hints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AA6BH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAc,EAAE,UAA2B,EAAE;IAClE,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACjB,OAAO,OAAO,CAAC,kBAAkB,KAAK,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC;IAClF,CAAC;IACD,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,CAAC;IACvC,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,CAAC;IACvC,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,eAAe,CAAC;IAC7D,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,kBAAkB,CAAC;IAC9C,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,YAAY,CAAC;IACxC,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,cAAc,CAAC;IACzC,OAAO,cAAc,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,IAAkB;IACtC,QAAQ,IAAI,EAAE,CAAC;QACX,KAAK,cAAc;YACf,OAAO,CACH,oEAAoE;gBACpE,yEAAyE;gBACzE,iEAAiE;gBACjE,0BAA0B,CAC7B,CAAC;QACN,KAAK,cAAc;YACf,OAAO,CACH,sEAAsE;gBACtE,sEAAsE;gBACtE,mEAAmE,CACtE,CAAC;QACN,KAAK,WAAW;YACZ,OAAO,CACH,mEAAmE;gBACnE,8DAA8D;gBAC9D,2DAA2D,CAC9D,CAAC;QACN,KAAK,WAAW;YACZ,OAAO,CACH,gEAAgE;gBAChE,kEAAkE;gBAClE,wDAAwD,CAC3D,CAAC;QACN,KAAK,eAAe;YAChB,OAAO,CACH,gEAAgE;gBAChE,iEAAiE;gBACjE,oEAAoE,CACvE,CAAC;QACN,KAAK,kBAAkB;YACnB,OAAO,CACH,kEAAkE;gBAClE,8CAA8C;gBAC9C,kEAAkE,CACrE,CAAC;QACN,KAAK,YAAY;YACb,OAAO,CACH,8DAA8D;gBAC9D,iEAAiE;gBACjE,mEAAmE;gBACnE,oCAAoC,CACvC,CAAC;QACN,KAAK,cAAc;YACf,OAAO,CACH,+DAA+D;gBAC/D,iEAAiE;gBACjE,8DAA8D,CACjE,CAAC;QACN,KAAK,SAAS;YACV,OAAO,CACH,sDAAsD;gBACtD,8DAA8D;gBAC9D,4DAA4D,CAC/D,CAAC;IACV,CAAC;AACL,CAAC"}

package/dist/errors/mask.d.ts

@@ -1,35 +0,0 @@
-/**
- * Secret-masking helpers — Wave G.6.2.
- *
- * `maskBearerToken` rewrites any `Bearer <token>` substring to
- * `Bearer ***masked***`. `sanitizeForLogs` additionally truncates very
- * long strings so a paste of a multi-MB stack trace can't blow the
- * context budget.
- *
- * Defense-in-depth: this is the single choke-point for any string
- * (error message, response body excerpt, log line) that crosses the
- * MCP boundary into the LLM's view.
- *
- * @license MIT
- */
-/** Maximum length for a sanitised log string. Anything longer is truncated. */
-export declare const LOG_TRUNCATION_LIMIT = 2000;
-/**
- * Replace every `Bearer <opaque-token>` substring with `Bearer ***masked***`.
- *
- * Token-shape is intentionally permissive — we'd rather over-mask than
- * leak. Any non-whitespace run following the literal `Bearer ` is treated
- * as the token and replaced.
- */
-export declare function maskBearerToken(input: string): string;
-/**
- * Sanitise a string before it joins the LLM-visible output:
- *   1. mask any Bearer tokens
- *   2. truncate to `LOG_TRUNCATION_LIMIT` chars with a clear suffix
- *
- * Non-string inputs (null / undefined) collapse to an empty string —
- * caller code typically passes `error?.message` and `?? ''` is a common
- * upstream pattern.
- */
-export declare function sanitizeForLogs(input: string): string;
-//# sourceMappingURL=mask.d.ts.map

package/dist/errors/mask.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mask.d.ts","sourceRoot":"","sources":["../../src/errors/mask.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,OAAO,CAAC;AAEzC;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAIrD;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMrD"}

package/dist/errors/mask.js

@@ -1,49 +0,0 @@
-/**
- * Secret-masking helpers — Wave G.6.2.
- *
- * `maskBearerToken` rewrites any `Bearer <token>` substring to
- * `Bearer ***masked***`. `sanitizeForLogs` additionally truncates very
- * long strings so a paste of a multi-MB stack trace can't blow the
- * context budget.
- *
- * Defense-in-depth: this is the single choke-point for any string
- * (error message, response body excerpt, log line) that crosses the
- * MCP boundary into the LLM's view.
- *
- * @license MIT
- */
-/** Maximum length for a sanitised log string. Anything longer is truncated. */
-export const LOG_TRUNCATION_LIMIT = 2000;
-/**
- * Replace every `Bearer <opaque-token>` substring with `Bearer ***masked***`.
- *
- * Token-shape is intentionally permissive — we'd rather over-mask than
- * leak. Any non-whitespace run following the literal `Bearer ` is treated
- * as the token and replaced.
- */
-export function maskBearerToken(input) {
-    if (input === '')
-        return '';
-    // The `g` flag handles repeated occurrences in one string.
-    return input.replace(/Bearer\s+\S+/g, 'Bearer ***masked***');
-}
-/**
- * Sanitise a string before it joins the LLM-visible output:
- *   1. mask any Bearer tokens
- *   2. truncate to `LOG_TRUNCATION_LIMIT` chars with a clear suffix
- *
- * Non-string inputs (null / undefined) collapse to an empty string —
- * caller code typically passes `error?.message` and `?? ''` is a common
- * upstream pattern.
- */
-export function sanitizeForLogs(input) {
-    if (input === null || input === undefined)
-        return '';
-    if (input === '')
-        return '';
-    const masked = maskBearerToken(input);
-    if (masked.length <= LOG_TRUNCATION_LIMIT)
-        return masked;
-    return masked.slice(0, LOG_TRUNCATION_LIMIT) + '... [truncated]';
-}
-//# sourceMappingURL=mask.js.map

package/dist/errors/mask.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mask.js","sourceRoot":"","sources":["../../src/errors/mask.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IACzC,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC5B,2DAA2D;IAC3D,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IACzC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrD,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,MAAM,IAAI,oBAAoB;QAAE,OAAO,MAAM,CAAC;IACzD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,GAAG,iBAAiB,CAAC;AACrE,CAAC"}

package/dist/errors/sanitize.d.ts

@@ -1,31 +0,0 @@
-/**
- * `sanitizeSecrets` — recursive value-walker that swaps any value at a
- * known-secret key for the sentinel `[REDACTED]`.
- *
- * Wave G.6.4. Pattern ported verbatim from
- * `apimapper-mcp/src/modules/apimapper/credential-sanitizer.ts` because
- * it's the same defense-in-depth shape and the apimapper version is
- * audit-hardened (A4 round 1 + 2).
- *
- * Used on both the error-path (RestError.body excerpts) AND the
- * success-path (jsonResult / structuredResult payloads in
- * `tool-builder.ts`) so a regressing REST handler — or a logging path —
- * can never leak `oauth_refresh_token` / `auth_data` / `bearer` etc.
- * into the LLM's context.
- *
- * Key-list intentionally mirrors apimapper-mcp; review both together
- * when extending.
- *
- * @license MIT
- */
-/**
- * Recursively walk any JSON-serialisable value and redact any nested
- * value whose key matches a known-secret name. Returns a fresh tree —
- * the input is never mutated.
- *
- * Primitives (string / number / boolean / null / undefined) pass through
- * unchanged. Arrays are mapped element-wise. Objects are reconstructed
- * with `[REDACTED]` substituted at any secret key.
- */
-export declare function sanitizeSecrets<T>(input: T): T;
-//# sourceMappingURL=sanitize.d.ts.map

package/dist/errors/sanitize.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../src/errors/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AA6CH;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAgB9C"}

package/dist/errors/sanitize.js

@@ -1,90 +0,0 @@
-/**
- * `sanitizeSecrets` — recursive value-walker that swaps any value at a
- * known-secret key for the sentinel `[REDACTED]`.
- *
- * Wave G.6.4. Pattern ported verbatim from
- * `apimapper-mcp/src/modules/apimapper/credential-sanitizer.ts` because
- * it's the same defense-in-depth shape and the apimapper version is
- * audit-hardened (A4 round 1 + 2).
- *
- * Used on both the error-path (RestError.body excerpts) AND the
- * success-path (jsonResult / structuredResult payloads in
- * `tool-builder.ts`) so a regressing REST handler — or a logging path —
- * can never leak `oauth_refresh_token` / `auth_data` / `bearer` etc.
- * into the LLM's context.
- *
- * Key-list intentionally mirrors apimapper-mcp; review both together
- * when extending.
- *
- * @license MIT
- */
-const SECRET_KEYS = new Set([
-    // Generic auth tokens
-    'token',
-    'bearer',
-    'bearer_token',
-    'bearerToken',
-    // Plugin-internal auth blob
-    'auth_data',
-    'authData',
-    // OAuth flows
-    'oauth_refresh_token',
-    'oauthRefreshToken',
-    'refresh_token',
-    'refreshToken',
-    'access_token',
-    'accessToken',
-    // App-secret pairs
-    'client_secret',
-    'clientSecret',
-    'api_key',
-    'apiKey',
-    'password',
-    'secret',
-    'secrets',
-    'raw_secret',
-    'rawSecret',
-    // Defense-in-depth additions (cf. apimapper A4 audit round 2)
-    'private_key',
-    'privateKey',
-    'signing_key',
-    'signingKey',
-    'webhook_secret',
-    'webhookSecret',
-    'consumer_secret',
-    'consumerSecret',
-    'consumer_key',
-    'consumerKey',
-    'session_token',
-    'sessionToken',
-    'id_token',
-    'idToken',
-]);
-/**
- * Recursively walk any JSON-serialisable value and redact any nested
- * value whose key matches a known-secret name. Returns a fresh tree —
- * the input is never mutated.
- *
- * Primitives (string / number / boolean / null / undefined) pass through
- * unchanged. Arrays are mapped element-wise. Objects are reconstructed
- * with `[REDACTED]` substituted at any secret key.
- */
-export function sanitizeSecrets(input) {
-    if (Array.isArray(input)) {
-        return input.map((item) => sanitizeSecrets(item));
-    }
-    if (input !== null && typeof input === 'object') {
-        const out = {};
-        for (const [k, v] of Object.entries(input)) {
-            if (SECRET_KEYS.has(k)) {
-                out[k] = '[REDACTED]';
-            }
-            else {
-                out[k] = sanitizeSecrets(v);
-            }
-        }
-        return out;
-    }
-    return input;
-}
-//# sourceMappingURL=sanitize.js.map

package/dist/errors/sanitize.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../src/errors/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS;IAChC,sBAAsB;IACtB,OAAO;IACP,QAAQ;IACR,cAAc;IACd,aAAa;IACb,4BAA4B;IAC5B,WAAW;IACX,UAAU;IACV,cAAc;IACd,qBAAqB;IACrB,mBAAmB;IACnB,eAAe;IACf,cAAc;IACd,cAAc;IACd,aAAa;IACb,mBAAmB;IACnB,eAAe;IACf,cAAc;IACd,SAAS;IACT,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,SAAS;IACT,YAAY;IACZ,WAAW;IACX,8DAA8D;IAC9D,aAAa;IACb,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,gBAAgB;IAChB,eAAe;IACf,iBAAiB;IACjB,gBAAgB;IAChB,cAAc;IACd,aAAa;IACb,eAAe;IACf,cAAc;IACd,UAAU;IACV,SAAS;CACZ,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAI,KAAQ;IACvC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAiB,CAAC;IACtE,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACpE,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,GAAG,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACJ,GAAG,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;YAChC,CAAC;QACL,CAAC;QACD,OAAO,GAAmB,CAAC;IAC/B,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC"}