@wootsup/yt-builder-mcp 1.0.0 → 1.1.0

package/dist/sites/cli/test-site.js

@@ -0,0 +1,146 @@
+/**
+ * W9 — `test-site` CLI subcommand.
+ *
+ * Live connectivity probe for ONE site_id. Mirrors the runtime
+ * behaviour of the `yootheme_builder_sites_test` MCP tool, but from
+ * the CLI so operators can pre-flight a site without launching the
+ * stdio server.
+ *
+ * Pipeline (per plan §W9):
+ *  1. Load `sites.json` via the W1 store.
+ *  2. Build a {@link SiteRegistry} + {@link ClientPool} from the
+ *     entries, wired to the supplied {@link SecretResolver}.
+ *  3. Call `pool.resolve(siteId)` → throws structured
+ *     {@link UnknownSiteError} / {@link NoDefaultSiteError} which we
+ *     map to a structured CLI result + a non-zero exit code.
+ *  4. Probe `/health` (no auth) + `/etag` (auth) in parallel via
+ *     `Promise.allSettled` so a failure on one path never hides the
+ *     other's outcome.
+ *  5. Print a green/red structured result and return it for the
+ *     dispatcher / tests.
+ *
+ * Returns a {@link TestSiteResult} (not exit codes directly) so tests
+ * can assert deterministic outputs without re-implementing the
+ * probe-routing logic.
+ *
+ * @license MIT
+ */
+import { platformForUrlAsync, } from '../../platform/index.js';
+import { ClientPool } from '../client-pool.js';
+import { NoDefaultSiteError, UnknownSiteError, } from '../client-pool.js';
+import { probeSite } from '../probe.js';
+import { SiteRegistry } from '../registry.js';
+import { CompositeSecretResolver, } from '../secret-resolver.js';
+import { loadSitesFile } from '../store.js';
+export class TestSiteError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'TestSiteError';
+    }
+}
+/**
+ * Build the runtime result lines for stdout — keeps the live CLI path
+ * + tests in sync without forcing tests to parse text.
+ */
+export function renderTestSiteLines(result) {
+    if (result.unknownSite) {
+        const avail = result.available ?? [];
+        return [
+            `FAIL — Site "${result.siteId}" not found.`,
+            avail.length > 0
+                ? `Available: ${avail.join(', ')}`
+                : '(no sites configured)',
+        ];
+    }
+    const lines = [
+        `Site:           ${result.siteId}`,
+        `URL:            ${result.siteUrl}`,
+        `Platform:       ${result.platform}`,
+        `Plugin reachable: ${result.pluginReachable ? 'yes' : 'NO'}`,
+        `Bearer valid:     ${result.bearerValid ? 'yes' : 'NO'}`,
+        `ETag received:    ${result.etagReceived ? 'yes' : 'NO'}`,
+    ];
+    if (result.pluginError !== undefined) {
+        lines.push(`Plugin error:   ${result.pluginError}`);
+    }
+    if (result.bearerError !== undefined) {
+        lines.push(`Bearer error:   ${result.bearerError}`);
+    }
+    lines.push('', result.summary);
+    return lines;
+}
+/**
+ * Probe one site and return a structured outcome. Never throws on a
+ * probe failure (those are surfaced inside the result); throws ONLY
+ * on file-IO failures the operator cannot recover from.
+ */
+export async function testSiteCommand(siteId, path, deps) {
+    const file = await deps.load(path);
+    const registry = new SiteRegistry(file, {
+        ...(deps.platformForUrlAsync !== undefined
+            ? { platformForUrlAsync: deps.platformForUrlAsync }
+            : { platformForUrlAsync }),
+    });
+    const resolver = deps.secretResolver ?? new CompositeSecretResolver();
+    const pool = deps.buildPool !== undefined
+        ? deps.buildPool(registry, resolver)
+        : new ClientPool(registry, resolver);
+    let client;
+    let site;
+    try {
+        const resolution = await pool.resolve(siteId);
+        client = resolution.client;
+        site = resolution.site;
+    }
+    catch (e) {
+        if (e instanceof UnknownSiteError) {
+            const result = {
+                siteId,
+                siteUrl: '',
+                platform: 'unknown',
+                pluginReachable: false,
+                bearerValid: false,
+                etagReceived: false,
+                summary: `FAIL — Site "${siteId}" not found.`,
+                unknownSite: true,
+                available: e.available,
+            };
+            if (deps.log !== undefined) {
+                for (const line of renderTestSiteLines(result))
+                    deps.log(line);
+            }
+            return result;
+        }
+        if (e instanceof NoDefaultSiteError) {
+            throw new TestSiteError('NO_DEFAULT_SITE', e.message);
+        }
+        throw e;
+    }
+    // W12-R1.2: probe lives in sites/probe.ts — single source of truth
+    // shared with the MCP tool surface so the two output channels never
+    // drift on edge cases (401 with /health rejected, 500 on /etag etc.).
+    const probe = await probeSite(client);
+    const result = {
+        siteId: site.id,
+        siteUrl: site.url,
+        platform: site.platform.kind,
+        pluginReachable: probe.plugin_reachable,
+        bearerValid: probe.bearer_valid,
+        etagReceived: probe.etag_received,
+        summary: probe.summary,
+        ...(probe.plugin_error !== undefined ? { pluginError: probe.plugin_error } : {}),
+        ...(probe.bearer_error !== undefined ? { bearerError: probe.bearer_error } : {}),
+        unknownSite: false,
+    };
+    if (deps.log !== undefined) {
+        for (const line of renderTestSiteLines(result))
+            deps.log(line);
+    }
+    return result;
+}
+export const DEFAULT_TEST_SITE_DEPS = {
+    load: loadSitesFile,
+};
+//# sourceMappingURL=test-site.js.map

package/dist/sites/cli/test-site.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-site.js","sourceRoot":"","sources":["../../../src/sites/cli/test-site.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EACH,mBAAmB,GAGtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EACH,kBAAkB,EAClB,gBAAgB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EACH,uBAAuB,GAE1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAsC5C,MAAM,OAAO,aAAc,SAAQ,KAAK;IACR;IAA5B,YAA4B,IAAY,EAAE,OAAe;QACrD,KAAK,CAAC,OAAO,CAAC,CAAC;QADS,SAAI,GAAJ,IAAI,CAAQ;QAEpC,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAChC,CAAC;CACJ;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAsB;IACtD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;QACrC,OAAO;YACH,gBAAgB,MAAM,CAAC,MAAM,cAAc;YAC3C,KAAK,CAAC,MAAM,GAAG,CAAC;gBACZ,CAAC,CAAC,cAAc,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAClC,CAAC,CAAC,uBAAuB;SAChC,CAAC;IACN,CAAC;IACD,MAAM,KAAK,GAAa;QACpB,mBAAmB,MAAM,CAAC,MAAM,EAAE;QAClC,mBAAmB,MAAM,CAAC,OAAO,EAAE;QACnC,mBAAmB,MAAM,CAAC,QAAQ,EAAE;QACpC,qBAAqB,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;QAC5D,qBAAqB,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;QACxD,qBAAqB,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;KAC5D,CAAC;IACF,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACjC,MAAc,EACd,IAAY,EACZ,IAAkB;IAElB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,YAAY,CAAC,IAAI,EAAE;QACpC,GAAG,CAAC,IAAI,CAAC,mBAAmB,KAAK,SAAS;YACtC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,EAAE;YACnD,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC;KACjC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,IAAI,IAAI,uBAAuB,EAAE,CAAC;IACtE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,KAAK,SAAS;QACrC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC;QACpC,CAAC,CAAC,IAAI,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEzC,IAAI,MAAM,CAAC;IACX,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAC3B,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;IAC3B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,IAAI,CAAC,YAAY,gBAAgB,EAAE,CAAC;YAChC,MAAM,MAAM,GAAmB;gBAC3B,MAAM;gBACN,OAAO,EAAE,EAAE;gBACX,QAAQ,EAAE,SAAS;gBACnB,eAAe,EAAE,KAAK;gBACtB,WAAW,EAAE,KAAK;gBAClB,YAAY,EAAE,KAAK;gBACnB,OAAO,EAAE,gBAAgB,MAAM,cAAc;gBAC7C,WAAW,EAAE,IAAI;gBACjB,SAAS,EAAE,CAAC,CAAC,SAAS;aACzB,CAAC;YACF,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBACzB,KAAK,MAAM,IAAI,IAAI,mBAAmB,CAAC,MAAM,CAAC;oBAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACnE,CAAC;YACD,OAAO,MAAM,CAAC;QAClB,CAAC;QACD,IAAI,CAAC,YAAY,kBAAkB,EAAE,CAAC;YAClC,MAAM,IAAI,aAAa,CACnB,iBAAiB,EACjB,CAAC,CAAC,OAAO,CACZ,CAAC;QACN,CAAC;QACD,MAAM,CAAC,CAAC;IACZ,CAAC;IAED,mEAAmE;IACnE,oEAAoE;IACpE,sEAAsE;IACtE,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;IAEtC,MAAM,MAAM,GAAmB;QAC3B,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,OAAO,EAAE,IAAI,CAAC,GAAG;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;QAC5B,eAAe,EAAE,KAAK,CAAC,gBAAgB;QACvC,WAAW,EAAE,KAAK,CAAC,YAAY;QAC/B,YAAY,EAAE,KAAK,CAAC,aAAa;QACjC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,WAAW,EAAE,KAAK;KACrB,CAAC;IAEF,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,mBAAmB,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAiB;IAChD,IAAI,EAAE,aAAa;CACtB,CAAC"}

package/dist/sites/client-pool.d.ts

@@ -0,0 +1,124 @@
+/**
+ * W4 — ClientPool: caches one {@link RestClient} per `site_id`.
+ *
+ * The pool sits between the W3 {@link SiteRegistry} (which maps a
+ * `site_id` → entry + memoised {@link Platform}) and the W2
+ * {@link SecretResolver} (which produces a bearer token at call time)
+ * and emits {@link PoolResolution} bundles ready for tool handlers.
+ *
+ * Design choices (per plan §W4, Z.562-644):
+ *
+ *  - **One client per site_id.** The first `resolve(id)` runs bearer +
+ *    platform resolve in parallel via `Promise.all` (saves one
+ *    round-trip-time per cold site) and stores the constructed
+ *    `RestClient`. All subsequent calls reuse the same instance —
+ *    identity-equal across the process lifetime.
+ *
+ *  - **Cold parallel calls are racey-but-safe.** When N callers arrive
+ *    for the same uncached site_id simultaneously, the plan §W4
+ *    explicitly accepts N first-time `secretResolver.resolve()` calls
+ *    (Z.630): `op read` is idempotent + latency dominates so a
+ *    hard-once Promise-cache would not materially help. The W3
+ *    registry's Promise-cache handles the platform side. The last
+ *    setter wins the `cache.set(id, client)` race; subsequent
+ *    `resolve()` calls see a stable single instance. Identity is
+ *    eventual, not instantaneous — but stable from call N+1 onwards.
+ *
+ *  - **`invalidate(siteId)` for post-401 force-re-resolve.** When the
+ *    auth layer detects a `401 invalid_kid`, it can drop the cached
+ *    client so the next call re-fetches the bearer through `op` and
+ *    constructs a fresh `RestClient`.
+ *
+ *  - **Structured errors.** `NoDefaultSiteError` and `UnknownSiteError`
+ *    carry `code` + (for unknown) `siteId` + `available[]` so the
+ *    auth/tool layer can branch on `error.code` instead of substring
+ *    matching the message.
+ *
+ * @license MIT
+ */
+import { RestClient } from '../client.js';
+import type { SiteRegistry, ResolvedSite } from './registry.js';
+import type { SecretResolver } from './secret-resolver.js';
+/**
+ * Thrown when `resolve()` is called without a `siteId` AND the
+ * registry has no default configured (neither `default_site_id` nor a
+ * flagged `is_default:true` entry). The auth layer surfaces this as a
+ * `no_default_site` MCP error with a hint to run
+ * `npx -y @wootsup/yt-builder-mcp add-site --default`.
+ */
+export declare class NoDefaultSiteError extends Error {
+    readonly code: "no_default_site";
+    constructor(message?: string);
+}
+/**
+ * Thrown when `resolve('some-id')` cannot find `some-id` in the
+ * registry. Carries the requested `siteId` and the (insertion-order)
+ * list of configured ids so the caller can render a friendly
+ * "did-you-mean" hint.
+ */
+export declare class UnknownSiteError extends Error {
+    readonly siteId: string;
+    readonly available: readonly string[];
+    readonly code: "unknown_site";
+    constructor(siteId: string, available: readonly string[]);
+}
+/**
+ * Bundle returned by {@link ClientPool.resolve}. Carries the cached
+ * REST client together with the fully-resolved site descriptor for
+ * downstream logging / display.
+ */
+export interface PoolResolution {
+    readonly client: RestClient;
+    readonly site: ResolvedSite;
+}
+/**
+ * Process-local cache of {@link RestClient} instances keyed by
+ * `site_id`. Constructed once at server boot (W6) and shared across
+ * all tool handlers.
+ *
+ * The pool is NOT thread-safe in the strict sense (Node is
+ * single-threaded but `await` can interleave); the cold-parallel-call
+ * behaviour is documented at the top of this file.
+ */
+export declare class ClientPool {
+    private readonly _registry;
+    private readonly secretResolver;
+    private readonly timeoutMs;
+    private readonly cache;
+    constructor(_registry: SiteRegistry, secretResolver: SecretResolver, timeoutMs?: number);
+    /**
+     * Read-only accessor for the underlying {@link SiteRegistry}. Used
+     * internally by the W7 `buildSitesTools(pool)` aggregator so the
+     * `sites_list` tool can render the configured-sites table without
+     * requiring callers to thread the registry separately. The registry
+     * itself is immutable from the outside (no mutator surface) so
+     * exposing it here is safe — `listForDisplay()` / `defaultSiteId()` /
+     * `listIds()` are all read-only operations.
+     *
+     * @internal Internal accessor for buildSitesTools; do not consume
+     * from tool handlers. Handlers should call `pool.resolve(siteId)`
+     * to get a `{client, site}` bundle instead.
+     */
+    get registry(): SiteRegistry;
+    /**
+     * Resolve a site_id to its cached {@link RestClient} + descriptor.
+     *
+     * @param siteId Explicit site_id from the tool param. When
+     *   `undefined`, the registry's `defaultSiteId()` is used.
+     * @throws {NoDefaultSiteError} when `siteId` is omitted and no
+     *   default is configured.
+     * @throws {UnknownSiteError} when the resolved id is not in the
+     *   registry (either the explicit id is wrong, or the registry's
+     *   `default_site_id` points at a stale entry).
+     */
+    resolve(siteId?: string): Promise<PoolResolution>;
+    /**
+     * Drop the cached client for `siteId` — used by the auth layer
+     * after a `401 invalid_kid` so the next call re-runs the bearer
+     * resolve and builds a fresh {@link RestClient}.
+     *
+     * No-op when `siteId` is not in the cache.
+     */
+    invalidate(siteId: string): void;
+}
+//# sourceMappingURL=client-pool.d.ts.map

package/dist/sites/client-pool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-pool.d.ts","sourceRoot":"","sources":["../../src/sites/client-pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D;;;;;;GAMG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IACzC,SAAgB,IAAI,EAAG,iBAAiB,CAAU;gBAG9C,OAAO,SAG6E;CAK3F;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;aAInB,MAAM,EAAE,MAAM;aACd,SAAS,EAAE,SAAS,MAAM,EAAE;IAJhD,SAAgB,IAAI,EAAG,cAAc,CAAU;gBAG3B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,SAAS,MAAM,EAAE;CAQnD;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC3B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,qBAAa,UAAU;IAIf,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAL9B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;gBAGlC,SAAS,EAAE,YAAY,EACvB,cAAc,EAAE,cAAc,EAC9B,SAAS,GAAE,MAAe;IAG/C;;;;;;;;;;;;OAYG;IACH,IAAI,QAAQ,IAAI,YAAY,CAE3B;IAED;;;;;;;;;;OAUG;IACG,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IA8CvD;;;;;;OAMG;IACH,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;CAGnC"}

package/dist/sites/client-pool.js

@@ -0,0 +1,172 @@
+/**
+ * W4 — ClientPool: caches one {@link RestClient} per `site_id`.
+ *
+ * The pool sits between the W3 {@link SiteRegistry} (which maps a
+ * `site_id` → entry + memoised {@link Platform}) and the W2
+ * {@link SecretResolver} (which produces a bearer token at call time)
+ * and emits {@link PoolResolution} bundles ready for tool handlers.
+ *
+ * Design choices (per plan §W4, Z.562-644):
+ *
+ *  - **One client per site_id.** The first `resolve(id)` runs bearer +
+ *    platform resolve in parallel via `Promise.all` (saves one
+ *    round-trip-time per cold site) and stores the constructed
+ *    `RestClient`. All subsequent calls reuse the same instance —
+ *    identity-equal across the process lifetime.
+ *
+ *  - **Cold parallel calls are racey-but-safe.** When N callers arrive
+ *    for the same uncached site_id simultaneously, the plan §W4
+ *    explicitly accepts N first-time `secretResolver.resolve()` calls
+ *    (Z.630): `op read` is idempotent + latency dominates so a
+ *    hard-once Promise-cache would not materially help. The W3
+ *    registry's Promise-cache handles the platform side. The last
+ *    setter wins the `cache.set(id, client)` race; subsequent
+ *    `resolve()` calls see a stable single instance. Identity is
+ *    eventual, not instantaneous — but stable from call N+1 onwards.
+ *
+ *  - **`invalidate(siteId)` for post-401 force-re-resolve.** When the
+ *    auth layer detects a `401 invalid_kid`, it can drop the cached
+ *    client so the next call re-fetches the bearer through `op` and
+ *    constructs a fresh `RestClient`.
+ *
+ *  - **Structured errors.** `NoDefaultSiteError` and `UnknownSiteError`
+ *    carry `code` + (for unknown) `siteId` + `available[]` so the
+ *    auth/tool layer can branch on `error.code` instead of substring
+ *    matching the message.
+ *
+ * @license MIT
+ */
+import { RestClient } from '../client.js';
+/**
+ * Thrown when `resolve()` is called without a `siteId` AND the
+ * registry has no default configured (neither `default_site_id` nor a
+ * flagged `is_default:true` entry). The auth layer surfaces this as a
+ * `no_default_site` MCP error with a hint to run
+ * `npx -y @wootsup/yt-builder-mcp add-site --default`.
+ */
+export class NoDefaultSiteError extends Error {
+    code = 'no_default_site';
+    constructor(message = 'No site_id supplied and no default site is configured. '
+        + 'Add a site via `npx -y @wootsup/yt-builder-mcp add-site --default --url ... --token ...` '
+        + 'or pass site_id explicitly. Use yootheme_builder_sites_list to discover IDs.') {
+        super(message);
+        this.name = 'NoDefaultSiteError';
+    }
+}
+/**
+ * Thrown when `resolve('some-id')` cannot find `some-id` in the
+ * registry. Carries the requested `siteId` and the (insertion-order)
+ * list of configured ids so the caller can render a friendly
+ * "did-you-mean" hint.
+ */
+export class UnknownSiteError extends Error {
+    siteId;
+    available;
+    code = 'unknown_site';
+    constructor(siteId, available) {
+        super(`Site "${siteId}" not found. Available: `
+            + (available.length > 0 ? available.join(', ') : '(none configured)'));
+        this.siteId = siteId;
+        this.available = available;
+        this.name = 'UnknownSiteError';
+    }
+}
+/**
+ * Process-local cache of {@link RestClient} instances keyed by
+ * `site_id`. Constructed once at server boot (W6) and shared across
+ * all tool handlers.
+ *
+ * The pool is NOT thread-safe in the strict sense (Node is
+ * single-threaded but `await` can interleave); the cold-parallel-call
+ * behaviour is documented at the top of this file.
+ */
+export class ClientPool {
+    _registry;
+    secretResolver;
+    timeoutMs;
+    cache = new Map();
+    constructor(_registry, secretResolver, timeoutMs = 15_000) {
+        this._registry = _registry;
+        this.secretResolver = secretResolver;
+        this.timeoutMs = timeoutMs;
+    }
+    /**
+     * Read-only accessor for the underlying {@link SiteRegistry}. Used
+     * internally by the W7 `buildSitesTools(pool)` aggregator so the
+     * `sites_list` tool can render the configured-sites table without
+     * requiring callers to thread the registry separately. The registry
+     * itself is immutable from the outside (no mutator surface) so
+     * exposing it here is safe — `listForDisplay()` / `defaultSiteId()` /
+     * `listIds()` are all read-only operations.
+     *
+     * @internal Internal accessor for buildSitesTools; do not consume
+     * from tool handlers. Handlers should call `pool.resolve(siteId)`
+     * to get a `{client, site}` bundle instead.
+     */
+    get registry() {
+        return this._registry;
+    }
+    /**
+     * Resolve a site_id to its cached {@link RestClient} + descriptor.
+     *
+     * @param siteId Explicit site_id from the tool param. When
+     *   `undefined`, the registry's `defaultSiteId()` is used.
+     * @throws {NoDefaultSiteError} when `siteId` is omitted and no
+     *   default is configured.
+     * @throws {UnknownSiteError} when the resolved id is not in the
+     *   registry (either the explicit id is wrong, or the registry's
+     *   `default_site_id` points at a stale entry).
+     */
+    async resolve(siteId) {
+        const id = siteId ?? this.registry.defaultSiteId();
+        if (id === null) {
+            throw new NoDefaultSiteError();
+        }
+        const entry = this.registry.get(id);
+        if (entry === null) {
+            throw new UnknownSiteError(id, this.registry.listIds());
+        }
+        let client = this.cache.get(id);
+        if (client === undefined) {
+            // Plan §W4 Z.604-608: parallelise bearer + platform on a
+            // cold call. The W3 registry's Promise-cache de-dupes the
+            // platform probe across N parallel callers; the bearer
+            // side is allowed N first-time calls (op read idempotent).
+            const [bearer, platform] = await Promise.all([
+                this.secretResolver.resolve(entry),
+                this.registry.platformFor(id),
+            ]);
+            client = new RestClient({
+                platform,
+                bearerToken: bearer.token,
+                timeoutMs: this.timeoutMs,
+            });
+            this.cache.set(id, client);
+        }
+        // `platformFor` is memoised in the registry; calling it a
+        // second time here is a O(1) Promise.resolve from the W3
+        // Promise-cache, NOT a fresh probe. Keeps the `ResolvedSite`
+        // synthesis self-contained even when the client was warm.
+        const platform = await this.registry.platformFor(id);
+        const resolved = {
+            id,
+            url: entry.url,
+            platform,
+            isDefault: entry.is_default,
+            bearerSource: entry.bearer_ref !== undefined ? 'op' : 'plain',
+            ...(entry.label !== undefined ? { label: entry.label } : {}),
+        };
+        return { client, site: resolved };
+    }
+    /**
+     * Drop the cached client for `siteId` — used by the auth layer
+     * after a `401 invalid_kid` so the next call re-runs the bearer
+     * resolve and builds a fresh {@link RestClient}.
+     *
+     * No-op when `siteId` is not in the cache.
+     */
+    invalidate(siteId) {
+        this.cache.delete(siteId);
+    }
+}
+//# sourceMappingURL=client-pool.js.map

package/dist/sites/client-pool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-pool.js","sourceRoot":"","sources":["../../src/sites/client-pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAK1C;;;;;;GAMG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACzB,IAAI,GAAG,iBAA0B,CAAC;IAElD,YACI,OAAO,GACH,yDAAyD;UACvD,2FAA2F;UAC3F,8EAA8E;QAEpF,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACrC,CAAC;CACJ;AAED;;;;;GAKG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAInB;IACA;IAJJ,IAAI,GAAG,cAAuB,CAAC;IAE/C,YACoB,MAAc,EACd,SAA4B;QAE5C,KAAK,CACD,SAAS,MAAM,0BAA0B;cACvC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CACxE,CAAC;QANc,WAAM,GAAN,MAAM,CAAQ;QACd,cAAS,GAAT,SAAS,CAAmB;QAM5C,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACnC,CAAC;CACJ;AAYD;;;;;;;;GAQG;AACH,MAAM,OAAO,UAAU;IAIE;IACA;IACA;IALJ,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEvD,YACqB,SAAuB,EACvB,cAA8B,EAC9B,YAAoB,MAAM;QAF1B,cAAS,GAAT,SAAS,CAAc;QACvB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,cAAS,GAAT,SAAS,CAAiB;IAC5C,CAAC;IAEJ;;;;;;;;;;;;OAYG;IACH,IAAI,QAAQ;QACR,OAAO,IAAI,CAAC,SAAS,CAAC;IAC1B,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,OAAO,CAAC,MAAe;QACzB,MAAM,EAAE,GAAG,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QACnD,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YACd,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACnC,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACvB,yDAAyD;YACzD,0DAA0D;YAC1D,uDAAuD;YACvD,2DAA2D;YAC3D,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACzC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC;gBAClC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;aAChC,CAAC,CAAC;YACH,MAAM,GAAG,IAAI,UAAU,CAAC;gBACpB,QAAQ;gBACR,WAAW,EAAE,MAAM,CAAC,KAAK;gBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;aAC5B,CAAC,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/B,CAAC;QAED,0DAA0D;QAC1D,yDAAyD;QACzD,6DAA6D;QAC7D,0DAA0D;QAC1D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAiB;YAC3B,EAAE;YACF,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,QAAQ;YACR,SAAS,EAAE,KAAK,CAAC,UAAU;YAC3B,YAAY,EAAE,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;YAC7D,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC;QAEF,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IACH,UAAU,CAAC,MAAc;QACrB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;CACJ"}

package/dist/sites/env-bridge.d.ts

@@ -0,0 +1,55 @@
+/**
+ * W3 — Env-Bridge: synthesise a one-site {@link SitesFileT} from the
+ * legacy single-site env-vars when no `sites.json` exists on disk.
+ *
+ * Why: pre-multi-site customers configured the MCP server via
+ * `YTB_MCP_SITE_URL` (or the older `YTB_MCP_WP_URL`) + `YTB_MCP_BEARER_TOKEN`.
+ * Multi-site infra must NEVER break that experience. When no
+ * `sites.json` is found, the boot path consults this bridge; if both
+ * required env-vars are present we materialise an in-memory one-site
+ * file with `site_id: 'default'` and `is_default: true`. The rest of
+ * the system (registry, resolver, tool builder) then operates on
+ * `SitesFileT` uniformly — there is no second code path for the
+ * legacy single-site case.
+ *
+ * Returns `null` when either required env-var is missing or empty so
+ * the caller can fall through to "no sites configured" UX.
+ *
+ * W12-R1.1 consolidation:
+ *   - Env-var names are imported from `../auth.js` (single source of
+ *     truth) instead of duplicated as string-literals.
+ *   - Raw URL + bearer are `.trim()`ed; whitespace-only values are
+ *     treated as missing (return null), matching `loadConfig` behaviour.
+ *   - Unknown `YTB_MCP_PLATFORM` values throw `ConfigError` so a typo
+ *     (`woodpress`, `joomlaa`) surfaces immediately instead of silently
+ *     downgrading to `'auto'` and confusing the runtime probe.
+ *
+ * @license MIT
+ */
+import type { SitesFileT } from './schema.js';
+/**
+ * Trim exactly one trailing `/` from a string. `""` stays `""`. A
+ * string with two trailing slashes keeps the inner one (`"a//"` →
+ * `"a/"`), preserving the operator's apparent intent — single-slash
+ * normalisation is a paste-error fix, not an aggressive cleanup.
+ */
+export declare function stripTrailingSlash(s: string): string;
+/**
+ * Build a one-site {@link SitesFileT} from `env`, or return `null` if
+ * neither URL nor bearer is configured. Order of URL precedence:
+ *   1. {@link ENV_SITE_URL} (new, multi-site-aware name)
+ *   2. {@link ENV_WP_URL}   (legacy single-site name, still honoured)
+ *
+ * The platform hint comes from {@link ENV_PLATFORM} when set to
+ * `wordpress` / `joomla` / `auto`. An empty / unset value falls back to
+ * `'auto'` so the runtime probe (see `platformForUrlAsync`) decides.
+ * Any OTHER non-empty value throws `ConfigError` — a typo like
+ * `woodpress` is loud-failed at boot rather than silently degraded.
+ *
+ * Note: this function does NOT validate the URL or bearer-token shape
+ * beyond non-empty trimming — the W1 {@link SitesFile} schema does that
+ * the moment the caller hands the synthesised file to a registry
+ * constructor.
+ */
+export declare function synthesiseFromEnv(env: NodeJS.ProcessEnv): SitesFileT | null;
+//# sourceMappingURL=env-bridge.d.ts.map

package/dist/sites/env-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-bridge.d.ts","sourceRoot":"","sources":["../../src/sites/env-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAUH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAGpD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAC7B,GAAG,EAAE,MAAM,CAAC,UAAU,GACvB,UAAU,GAAG,IAAI,CAqCnB"}

package/dist/sites/env-bridge.js

@@ -0,0 +1,94 @@
+/**
+ * W3 — Env-Bridge: synthesise a one-site {@link SitesFileT} from the
+ * legacy single-site env-vars when no `sites.json` exists on disk.
+ *
+ * Why: pre-multi-site customers configured the MCP server via
+ * `YTB_MCP_SITE_URL` (or the older `YTB_MCP_WP_URL`) + `YTB_MCP_BEARER_TOKEN`.
+ * Multi-site infra must NEVER break that experience. When no
+ * `sites.json` is found, the boot path consults this bridge; if both
+ * required env-vars are present we materialise an in-memory one-site
+ * file with `site_id: 'default'` and `is_default: true`. The rest of
+ * the system (registry, resolver, tool builder) then operates on
+ * `SitesFileT` uniformly — there is no second code path for the
+ * legacy single-site case.
+ *
+ * Returns `null` when either required env-var is missing or empty so
+ * the caller can fall through to "no sites configured" UX.
+ *
+ * W12-R1.1 consolidation:
+ *   - Env-var names are imported from `../auth.js` (single source of
+ *     truth) instead of duplicated as string-literals.
+ *   - Raw URL + bearer are `.trim()`ed; whitespace-only values are
+ *     treated as missing (return null), matching `loadConfig` behaviour.
+ *   - Unknown `YTB_MCP_PLATFORM` values throw `ConfigError` so a typo
+ *     (`woodpress`, `joomlaa`) surfaces immediately instead of silently
+ *     downgrading to `'auto'` and confusing the runtime probe.
+ *
+ * @license MIT
+ */
+import { ENV_BEARER, ENV_PLATFORM, ENV_SITE_URL, ENV_WP_URL, } from '../auth.js';
+import { ConfigError } from '../errors.js';
+/**
+ * Trim exactly one trailing `/` from a string. `""` stays `""`. A
+ * string with two trailing slashes keeps the inner one (`"a//"` →
+ * `"a/"`), preserving the operator's apparent intent — single-slash
+ * normalisation is a paste-error fix, not an aggressive cleanup.
+ */
+export function stripTrailingSlash(s) {
+    if (s.length === 0)
+        return s;
+    return s.endsWith('/') ? s.slice(0, -1) : s;
+}
+/**
+ * Build a one-site {@link SitesFileT} from `env`, or return `null` if
+ * neither URL nor bearer is configured. Order of URL precedence:
+ *   1. {@link ENV_SITE_URL} (new, multi-site-aware name)
+ *   2. {@link ENV_WP_URL}   (legacy single-site name, still honoured)
+ *
+ * The platform hint comes from {@link ENV_PLATFORM} when set to
+ * `wordpress` / `joomla` / `auto`. An empty / unset value falls back to
+ * `'auto'` so the runtime probe (see `platformForUrlAsync`) decides.
+ * Any OTHER non-empty value throws `ConfigError` — a typo like
+ * `woodpress` is loud-failed at boot rather than silently degraded.
+ *
+ * Note: this function does NOT validate the URL or bearer-token shape
+ * beyond non-empty trimming — the W1 {@link SitesFile} schema does that
+ * the moment the caller hands the synthesised file to a registry
+ * constructor.
+ */
+export function synthesiseFromEnv(env) {
+    const rawUrl = (env[ENV_SITE_URL] ?? env[ENV_WP_URL] ?? '').trim();
+    const bearer = (env[ENV_BEARER] ?? '').trim();
+    if (rawUrl === '' || bearer === '')
+        return null;
+    const rawPlatform = env[ENV_PLATFORM];
+    const platformHint = rawPlatform === undefined ? '' : rawPlatform.trim();
+    let platform;
+    if (platformHint === '') {
+        platform = 'auto';
+    }
+    else if (platformHint === 'wordpress'
+        || platformHint === 'joomla'
+        || platformHint === 'auto') {
+        platform = platformHint;
+    }
+    else {
+        throw new ConfigError(`Invalid ${ENV_PLATFORM}: "${platformHint}". `
+            + 'Must be one of: wordpress, joomla, auto (or unset for auto-detect).');
+    }
+    return {
+        schema_version: 1,
+        default_site_id: 'default',
+        sites: [
+            {
+                site_id: 'default',
+                url: stripTrailingSlash(rawUrl),
+                platform,
+                bearer,
+                is_default: true,
+                label: 'Default site (env)',
+            },
+        ],
+    };
+}
+//# sourceMappingURL=env-bridge.js.map

package/dist/sites/env-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-bridge.js","sourceRoot":"","sources":["../../src/sites/env-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EACH,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,UAAU,GACb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAI3C;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAS;IACxC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAC7B,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,iBAAiB,CAC7B,GAAsB;IAEtB,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnE,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,IAAI,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAEhD,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC;IACtC,MAAM,YAAY,GAAG,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IACzE,IAAI,QAAyC,CAAC;IAC9C,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;QACtB,QAAQ,GAAG,MAAM,CAAC;IACtB,CAAC;SAAM,IACH,YAAY,KAAK,WAAW;WACzB,YAAY,KAAK,QAAQ;WACzB,YAAY,KAAK,MAAM,EAC5B,CAAC;QACC,QAAQ,GAAG,YAAY,CAAC;IAC5B,CAAC;SAAM,CAAC;QACJ,MAAM,IAAI,WAAW,CACjB,WAAW,YAAY,MAAM,YAAY,KAAK;cAC5C,qEAAqE,CAC1E,CAAC;IACN,CAAC;IAED,OAAO;QACH,cAAc,EAAE,CAAC;QACjB,eAAe,EAAE,SAAS;QAC1B,KAAK,EAAE;YACH;gBACI,OAAO,EAAE,SAAS;gBAClB,GAAG,EAAE,kBAAkB,CAAC,MAAM,CAAC;gBAC/B,QAAQ;gBACR,MAAM;gBACN,UAAU,EAAE,IAAI;gBAChB,KAAK,EAAE,oBAAoB;aAC9B;SACJ;KACJ,CAAC;AACN,CAAC"}

package/dist/sites/paths.d.ts

@@ -0,0 +1,21 @@
+/**
+ * W1 — Sites-Storage Foundation: default on-disk path resolver.
+ *
+ * Resolution order:
+ *  1. `$XDG_CONFIG_HOME/yt-builder-mcp/sites.json` (XDG Base-Dir spec)
+ *  2. `$HOME/.config/yt-builder-mcp/sites.json` (XDG fallback)
+ *  3. `os.tmpdir()/yt-builder-mcp/sites.json` + stderr warning (last
+ *     resort — used in CI / containers where HOME may be unset).
+ *
+ * The W2/W3 layer never touches paths directly — callers ask this module
+ * for the canonical location and pass the resolved string to the store.
+ *
+ * @license MIT
+ */
+/**
+ * Pure environment lookup so tests can inject a process-env-like object
+ * without mutating `process.env`. Returns the path that the load/save
+ * layer should target.
+ */
+export declare function defaultSitesFilePath(env?: NodeJS.ProcessEnv, log?: (msg: string) => void): string;
+//# sourceMappingURL=paths.d.ts.map

package/dist/sites/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/sites/paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH;;;;GAIG;AACH,wBAAgB,oBAAoB,CAChC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,GAAG,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAqD,GAC5E,MAAM,CAgBR"}