@wootsup/yt-builder-mcp 1.1.0 → 1.1.5

package/manifest.json

@@ -2,7 +2,7 @@
     "dxt_version": "0.1",
     "name": "@wootsup/yt-builder-mcp",
     "display_name": "YT Builder MCP for YOOtheme Pro (unofficial)",
-    "version": "1.1.0",
+    "version": "1.1.5",
     "description": "Drive your YOOtheme Pro Page Builder programmatically from Claude, Cursor, Codex, Gemini and 5 other MCP-capable AI assistants — read layouts, edit settings, add elements, bind dynamic sources. Works on WordPress and Joomla 5/6. Built for YOOtheme Pro 4.0+. Independent third-party project, not affiliated with YOOtheme GmbH.",
     "long_description": "YT Builder MCP gives AI assistants a typed, scoped, and idempotent surface for your YOOtheme Pro Page Builder, on either WordPress or Joomla 5/6. Tools cover page discovery, layout inspection, element CRUD, source binding, and diagnostics. Bearer auth, optimistic locking via ETag, scope hierarchy (read < write < admin), and structured-error responses keep the agent safe and the workflow correct on first try. Independent third-party project — YOOtheme® is a registered trademark of YOOtheme GmbH (yootheme.com); YT Builder MCP is built by WootsUp (getimo productions) and is not affiliated with, endorsed by, or sponsored by YOOtheme.",
     "icon": "icon.png",
@@ -47,31 +47,31 @@
         }
     },
     "user_config": {
-        "YTB_MCP_SITES_FILE": {
+        "YTB_MCP_SITE_URL": {
             "type": "string",
-            "title": "Sites registry file (multi-site mode)",
-            "description": "Path to sites.json for multi-site setups (e.g. ~/.config/yt-builder-mcp/sites.json). When set, the legacy YTB_MCP_SITE_URL / YTB_MCP_BEARER_TOKEN fields are ignored. Create via `npx -y @wootsup/yt-builder-mcp add-site`.",
+            "title": "Site URL (connect one site)",
+            "description": "Fill this if you connect a SINGLE site (most people). The address of your YOOtheme site, e.g. https://example.com, or https://example.com/wordpress if WordPress runs in a subfolder. No trailing slash. Leave empty if you use the Sites file below.",
             "required": false
         },
-        "YTB_MCP_SITE_URL": {
+        "YTB_MCP_BEARER_TOKEN": {
             "type": "string",
-            "title": "Site URL",
-            "description": "Base URL of the site (e.g. https://example.com, https://example.com/wordpress for subdir WordPress, https://example.com/joomla for subdir Joomla). Without trailing slash.",
-            "required": false
+            "title": "Bearer token (for that one site)",
+            "description": "Fill this if you connect a SINGLE site. Paste the key you generated in your CMS admin: WordPress under Tools, YT Builder MCP; Joomla under Components, YT Builder MCP, then Generate Key. The 'write' scope is enough. Leave empty if you use the Sites file below.",
+            "required": false,
+            "sensitive": true
         },
         "YTB_MCP_PLATFORM": {
             "type": "string",
-            "title": "Platform (optional)",
-            "description": "CMS platform hint. Allowed values: \"auto\" (default — auto-detect from URL path and, if ambiguous, runtime-probe both platforms' /health endpoints), \"wordpress\", or \"joomla\". Set explicitly only to override auto-detection (e.g. when the host blocks anonymous health probes).",
+            "title": "Platform (one site, optional)",
+            "description": "Leave this on 'auto'. The server detects WordPress or Joomla by itself. Only set 'wordpress' or 'joomla' if your host blocks the automatic check.",
             "required": false,
             "default": "auto"
         },
-        "YTB_MCP_BEARER_TOKEN": {
+        "YTB_MCP_SITES_FILE": {
             "type": "string",
-            "title": "Bearer token",
-            "description": "Bearer token generated in the YT Builder MCP admin UI (WordPress: Tools → YT Builder MCP; Joomla: Components → YT Builder MCP) → Generate Key. Scope: write is sufficient for most agent workflows; admin only for key-management.",
-            "required": false,
-            "sensitive": true
+            "title": "Sites file (connect many sites, advanced)",
+            "description": "Only for managing several sites from one install (agencies). Path to a sites.json, e.g. /Users/you/.config/yt-builder-mcp/sites.json. Create and fill it with: npx -y @wootsup/yt-builder-mcp add-site (do not hand-edit). When set, the three single-site fields above are ignored. Most people leave this empty.",
+            "required": false
         }
     },
     "compatibility": {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@wootsup/yt-builder-mcp",
-    "version": "1.1.0",
+    "version": "1.1.5",
     "type": "module",
     "description": "YT Builder MCP — drive your page builder from Claude, Cursor, Codex, Gemini and 5 other MCP-capable AI assistants. Built for YOOtheme Pro 4.0+. Independent third-party project, not affiliated with YOOtheme GmbH.",
     "license": "MIT",
@@ -66,6 +66,7 @@
         "@modelcontextprotocol/sdk": "^1.27.0",
         "@clack/prompts": "^0.7.0",
         "pino": "^10.3.1",
+        "proper-lockfile": "^4.1.2",
         "zod": "^4.3.6"
     },
     "devDependencies": {
@@ -75,7 +76,6 @@
         "@typescript-eslint/parser": "^8.0.0",
         "@vitest/coverage-v8": "^1.4.0",
         "eslint": "^9.0.0",
-        "proper-lockfile": "^4.1.2",
         "typescript": "^5.4.0",
         "typescript-eslint": "^8.0.0",
         "vitest": "^1.4.0"

package/skills/yt-builder-mcp/SKILL.md

@@ -12,12 +12,12 @@ description: Drive the YOOtheme Pro Page Builder on WordPress or Joomla 5/6 —
 > WordPress and Joomla 5/6.
 
 This skill helps AI assistants drive the YOOtheme Pro Page Builder through the
-`@wootsup/yt-builder-mcp` server. The server exposes 26 typed, scoped, idempotent
-tools. 20 of them advertised as first-class entries in `tools/list` (17 essential
-L1 forwards + 2 direct L3 entries + 1 gateway), and 7 advanced tools reachable
-through the single `yootheme_builder_advanced` gateway. This 3-lane split keeps
-`tools/list` well below the ~40-tool Cursor cap while every catalogued tool stays
-fully reachable.
+`@wootsup/yt-builder-mcp` server. The server exposes 27 typed, scoped, idempotent
+callable tools. 20 of them advertised as first-class entries in `tools/list`
+(17 essential L1 forwards + 2 direct L3 entries + 1 gateway), and 7 advanced
+tools reachable through the single `yootheme_builder_advanced` gateway. This
+3-lane split keeps `tools/list` well below the ~40-tool Cursor cap while every
+catalogued tool stays fully reachable.
 
 ## How to use this MCP server
 
@@ -86,9 +86,11 @@ The server exposes:
   gateway tool: `yootheme_builder_advanced({ tool: "<name>", input: { ... } })`.
 - **1 gateway tool** — `yootheme_builder_advanced`.
 
-`tools/list` therefore advertises 20 names (17 + 2 + 1) for a total catalogue
-of 26. If the AI client reports "tool not found", you are almost certainly
-calling an advanced tool by its raw name. Wrap it in
+`tools/list` therefore advertises 20 names (17 + 2 + 1) — that's 17 L1
+essentials + 2 L3 direct + 1 gateway. The total callable surface is 27
+(20 advertised + 7 advanced reachable through the gateway). If the AI
+client reports "tool not found", you are almost certainly calling an
+advanced tool by its raw name. Wrap it in
 `yootheme_builder_advanced({ tool, input })` instead.
 
 ## Site and frontend URLs (for deep-linking and verification)
@@ -131,6 +133,12 @@ Do not loop on auth errors.
 > capabilities like `manage_options` gate the admin settings page only; the
 > REST API surface is Bearer-gated.
 
+> **Joomla L2 articles surface.** The Joomla plugin ships `/v1/articles*`
+> REST endpoints for per-article custom layouts, but they are NOT exposed
+> via MCP tools in v1.x. To use that surface, call the REST endpoints
+> directly with the Bearer key. MCP tool coverage for L2 articles is
+> planned for v1.2.0.
+
 ---
 
 ## Working with multiple sites
@@ -812,7 +820,7 @@ Joomla administrator access." Don't fabricate tool calls.
 
 <!-- TOOL-CATALOG:BEGIN -->
 
-**26 tools** — generated by `scripts/extract-tools.mjs` from the compiled `buildAllTools()` registry. Do not hand-edit this section; re-run `npm run build && node scripts/extract-tools.mjs` after changing tool definitions.
+**26 catalogued tools** plus the `yootheme_builder_advanced` gateway = **27 reachable via `tools/list`** (17 L1 + 2 L3 + 1 gateway = 20 advertised; the gateway routes to 7 additional advanced tools, bringing the total to 27 callable). Generated by `scripts/extract-tools.mjs` from the compiled `buildAllTools()` registry. Do not hand-edit this section; re-run `npm run build && node scripts/extract-tools.mjs` after changing tool definitions.
 
 | Tool | Kind | Input keys | Description |
 | --- | --- | --- | --- |
@@ -830,17 +838,17 @@ Joomla administrator access." Don't fabricate tool calls.
 | `yootheme_builder_element_types_list` | read+idempotent | `fields`, `site_id` | List element types registered on this site (built-ins + YOOessentials/uEssentials extras). Names feed `element_type` of element_add. Pass `fields[]` to narrow each row. Operates on the default site unless site_id is provided. |
 | `yootheme_builder_element_unbind_source` | destructive | `confirm`, `element_path`, `etag`, `site_id`, `template_id` | Remove the source binding from an element. Clears `props.source`. Destructive in the sense that it may break dynamic-content rendering — always ask the user to confirm. Requires ETag. Operates on the default site unless site_id is provided. |
 | `yootheme_builder_element_update_settings` | idempotent | `element_path`, `etag`, `merge`, `props`, `site_id`, `template_id` | Update `props` on an element. Default replaces all props; pass `merge:true` for server-side deep-merge (only request keys overwritten, others survive — avoids read-modify-write races). Requires ETag. Operates on the default site unless site_id is provided. |
-| `yootheme_builder_get_etag` | read+idempotent | `site_id` | Get the current top-level state ETag. Pass it back via `etag` on any write tool (page_save/page_publish/element_set/binding_set) to enforce optimistic-locking — the server returns 412 when the ETag has changed since you read it. Operates on the default site unless site_id is provided. |
+| `yootheme_builder_get_etag` | read+idempotent | `site_id` | Get the current ETag (state revision) for the YOOtheme builder. Returns sha256+revision string used for optimistic locking on writes. Pass the returned value back as `etag` on any write tool (page_save, page_publish, element_add, element_update_settings, element_clone, element_move, element_delete). The server returns HTTP 412 if the ETag has changed since you read it. Keywords: get etag, current etag, state revision, optimistic lock, version stamp. Operates on the default site unless site_id is provided. |
 | `yootheme_builder_health` | read+idempotent | `site_id` | Check plugin installed/reachable. Returns plugin version, YT Pro version, REST endpoints. Authenticated payload adds site_url + home_url for deep-linking. See yootheme_builder_diagnose for Bearer-validity + connectivity summary. Operates on the default site unless site_id is provided. |
 | `yootheme_builder_inspect_multi_items_binding` | read+idempotent | `element_path`, `site_id`, `template_id` | Reports Multi-Items binding state: container/item pair (grid↔grid_item, slideshow↔slideshow_item, …), current binding level (none\|container\|item), and a recommended_fix when the binding sits on the container instead of the child. Operates on the default site unless site_id is provided. |
 | `yootheme_builder_page_get_layout` | read+idempotent | `fields`, `flat`, `site_id`, `template_id` | Get full layout tree for one template. Default nested `{layout, etag}`. Set `flat:true` for depth-first array `{elements:[...], etag}`; combine with `fields[]` to project per-element. Operates on the default site unless site_id is provided. |
 | `yootheme_builder_page_get_schema` | read+idempotent | `site_id`, `template_id` | Get the flat schema for a template — a list of nodes with their JSON-Pointer paths and element types. Best entry-point for navigation: lighter than page_get_layout, sufficient to locate elements before editing. Operates on the default site unless site_id is provided. |
 | `yootheme_builder_page_publish` | idempotent | `etag`, `site_id`, `template_id` | Publish a template — persist state, flush YT + WP caches, snapshot the published-state ETag. ETag optional — when provided, 412 on conflict; when omitted, last-write-wins. Recommended for collaborative edits. Operates on the default site unless site_id is provided. |
 | `yootheme_builder_page_save` | idempotent | `etag`, `site_id`, `template_id` | Re-run save-transforms and persist. ETag optional — when provided, 412 on conflict; when omitted, last-write-wins. Recommended for collaborative edits. No-op when state is byte-identical (returns `no_changes:true`, ETag unchanged). Operates on the default site unless site_id is provided. |
-| `yootheme_builder_pages_list` | read+idempotent | `fields`, `site_id` | List YT templates. Returns id, label, usage meta + per-row `frontend_url` (permalink when public) and `frontend_url_template` (pattern for search / 404 / ID-based templates). Pass `fields:["id","label"]` to slim. Site URL: diagnose. Operates on the default site unless site_id is provided. |
-| `yootheme_builder_sites_list` | read+idempotent | `site_id` | List every site configured in this MCP server (site_id, URL, platform, default flag, bearer source). Platform-agnostic. Never calls a REST endpoint, never resolves a bearer. Useful when the agent needs to discover available site_ids before targeting one with `site_id: "<id>"`. (`site_id` is accepted for schema-uniformity but ignored by this tool.) |
-| `yootheme_builder_sites_test` | read+idempotent | `site_id` | Verify connectivity to ONE configured site: probes `/health` (unauthenticated) and `/etag` (authenticated) in parallel and returns plugin_reachable + bearer_valid in a single call. `site_id` is REQUIRED (this tool exists to test a specific id, never the default). Use `yootheme_builder_sites_list` to discover available IDs first. |
-| `yootheme_builder_sources_list` | read+idempotent | `fields`, `site_id` | List Builder sources grouped by origin (apimapper/wordpress/essentials). Returns name+label per source — pick one for `element_bind_source`. Pass `fields[]` to narrow each row. Operates on the default site unless site_id is provided. |
+| `yootheme_builder_pages_list` | read+idempotent | `fields`, `site_id` | List all pages, templates, and layouts in the YOOtheme Pro builder. Returns template_id, label, type, element count, and frontend_url per row. CALL THIS FIRST to discover available template IDs before any tool that needs a template_id (page_get_layout, element_list, page_get_schema, etc.). Keywords: list pages, list templates, list layouts, discover template_id, index, available templates, what pages exist. Pass `fields:["id","label"]` to slim. Returns ALL pages in one call (no pagination, typically <50 templates per site). Operates on the default site unless site_id is provided. |
+| `yootheme_builder_sites_list` | read+idempotent | `site_id` | List all sites configured in this multi-site MCP installation. Returns site_id + URL + platform (wordpress\|joomla) + default flag per row. CALL THIS FIRST when working with a fresh MCP connection to discover available site_ids before targeting one with any other tool. Read-only, no REST calls. Keywords: list sites, list connections, list installations, discover site_id, available sites, configured sites, what sites exist, multi-site index. (site_id is accepted for schema-uniformity but ignored by this tool.) |
+| `yootheme_builder_sites_test` | read+idempotent | `site_id` | Verify connectivity to ONE site: probes /health (no auth) + /etag (auth) in parallel; returns plugin_reachable + bearer_valid. `site_id` is REQUIRED. Use sites_list to find IDs. |
+| `yootheme_builder_sources_list` | read+idempotent | `fields`, `site_id` | List all data sources, feeds, and dynamic content sources available in the YOOtheme Pro builder. Returns name + label + origin (apimapper / wordpress / joomla / essentials) per source. CALL THIS BEFORE binding any element to a data source. Pick a source name from the list and pass it to `element_bind_source`. Keywords: list sources, list data sources, list feeds, list bindings, dynamic content, available data, what sources exist. Pass `fields[]` to narrow each row. Operates on the default site unless site_id is provided. |
 | `yootheme_builder_template_summary` | read+idempotent | `site_id`, `template_id` | Token-efficient template overview: element counts by type, binding count, max nesting depth, and named landmark sections — computed server-side in one call. Use this to grasp a large template before pulling element_list or page_get_layout. Operates on the default site unless site_id is provided. |
 
 <!-- TOOL-CATALOG:END -->

package/dist/auth.d.ts

@@ -1,119 +0,0 @@
-/**
- * Auth / configuration loading for the MCP server.
- *
- * The MCP server reads two environment variables on startup:
- *
- *   YTB_MCP_SITE_URL      — base URL of the host CMS install (WordPress
- *                           OR Joomla), e.g. `https://example.com`.
- *                           The per-platform REST namespace
- *                           (`/wp-json/yt-builder-mcp/v1` for WP,
- *                           `/api/index.php/v1/yt-builder-mcp` for
- *                           Joomla) is appended internally based on
- *                           runtime platform detection.
- *   YTB_MCP_WP_URL        — DEPRECATED alias for YTB_MCP_SITE_URL,
- *                           kept for back-compat with pre-Wave 7
- *                           configurations. A non-fatal deprecation
- *                           notice is written to stderr when the
- *                           legacy var is used in non-test mode.
- *   YTB_MCP_BEARER_TOKEN  — the Bearer key generated by the plugin
- *                           Settings page (`wp-admin → YT Builder MCP`
- *                           on WordPress, `Components → YT Builder MCP`
- *                           on Joomla).
- *
- * `loadConfig()` throws `ConfigError` if either is missing, so the
- * server fails fast with a useful message rather than emitting cryptic
- * 401/Network errors deep in the request stack.
- *
- * @license MIT
- */
-import { SiteRegistry } from './sites/registry.js';
-export interface ServerConfig {
-    /** Base URL of the host-CMS install (no trailing slash). */
-    readonly baseUrl: string;
-    /** Bearer key. */
-    readonly bearerToken: string;
-    /** Network timeout (ms) for REST calls. */
-    readonly timeoutMs: number;
-    /**
-     * Optional explicit platform hint from {@link ENV_PLATFORM}.
-     * `undefined` lets the consumer rely on URL-shape detection.
-     */
-    readonly platformHint?: 'wordpress' | 'joomla';
-}
-export interface LoadConfigOptions {
-    /** Allow the bearer-token to be empty (for health-only smoke tests). */
-    readonly allowMissingToken?: boolean;
-    /** Source of env vars (defaults to process.env). */
-    readonly env?: NodeJS.ProcessEnv;
-}
-/**
- * Canonical env-var name for the host-CMS base URL (Wave 7+: covers
- * both WordPress and Joomla). Prefer this for all new configurations.
- */
-export declare const ENV_SITE_URL = "YTB_MCP_SITE_URL";
-/**
- * Legacy env-var name kept for back-compat. Pre-Wave-7 configurations
- * (every release through v1.0.x) used `YTB_MCP_WP_URL`. New code should
- * use {@link ENV_SITE_URL}; this constant is retained so the wizard,
- * tests, and error hints can still reference the legacy name.
- */
-export declare const ENV_WP_URL = "YTB_MCP_WP_URL";
-export declare const ENV_BEARER = "YTB_MCP_BEARER_TOKEN";
-export declare const ENV_TIMEOUT = "YTB_MCP_TIMEOUT_MS";
-export declare const ENV_TEST_MODE = "YTB_MCP_TEST_MODE";
-/**
- * Optional platform hint env var — `'wordpress'` or `'joomla'`. When
- * unset, the server auto-detects from the URL shape (cookbook §3.7.1):
- *   - URL contains `/wp-json/`        → wordpress
- *   - URL contains `/api/index.php/`  → joomla
- *   - origin-only URL                 → defaults to wordpress (back-compat)
- *
- * Set this to `'joomla'` when your YTB_MCP_SITE_URL is an origin-only
- * Joomla URL like `https://example.com/joomla`.
- */
-export declare const ENV_PLATFORM = "YTB_MCP_PLATFORM";
-/**
- * W10 — canonical env-var name for the multi-site registry file. When
- * set, {@link loadRegistry} loads + validates the JSON at this path and
- * the legacy {@link ENV_SITE_URL} / {@link ENV_BEARER} pair is ignored.
- * When unset, the env-bridge falls back to building a one-site registry
- * from the legacy single-site pair.
- */
-export declare const ENV_SITES_FILE = "YTB_MCP_SITES_FILE";
-export declare function loadConfig(options?: LoadConfigOptions): ServerConfig;
-export declare function isTestMode(env?: NodeJS.ProcessEnv): boolean;
-/**
- * Options accepted by {@link loadRegistry}.
- */
-export interface LoadRegistryOptions {
-    /** Source of env vars (defaults to process.env). */
-    readonly env?: NodeJS.ProcessEnv;
-}
-/**
- * W10 — canonical boot-time registry loader.
- *
- * Resolution order:
- *   1. **Sites file** — if {@link ENV_SITES_FILE} is set to a non-empty
- *      string, parse + validate the JSON at that path and wrap it in a
- *      {@link SiteRegistry}. Schema failures bubble up as
- *      `SitesFileError` (the store does not swallow them); the caller
- *      decides whether to fail-fast or fall back. Wave 10 chooses
- *      fail-fast — explicit file = explicit intent.
- *
- *   2. **Legacy env-bridge** — synthesise a one-site registry from the
- *      pre-W10 single-site env-vars ({@link ENV_SITE_URL} +
- *      {@link ENV_BEARER}, with {@link ENV_PLATFORM} as optional hint).
- *      Preserves the single-site UX for every customer who has not
- *      migrated to a sites.json yet.
- *
- *   3. **Hard fail** — neither configured. Surface a {@link ConfigError}
- *      with the three setup options so the operator knows exactly which
- *      knob to turn.
- *
- * This function replaces {@link loadConfig} on the main boot path.
- * `loadConfig` is intentionally retained for the test-mode fallback in
- * `index.ts` (`--test-mode` smoke probes) and for any embedded consumer
- * that still wants a flat `ServerConfig`.
- */
-export declare function loadRegistry(opts?: LoadRegistryOptions): Promise<SiteRegistry>;
-//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAKH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAInD,MAAM,WAAW,YAAY;IACzB,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,kBAAkB;IAClB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,2CAA2C;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;CAClD;AAED,MAAM,WAAW,iBAAiB;IAC9B,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,oDAAoD;IACpD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACpC;AAED;;;GAGG;AACH,eAAO,MAAM,YAAY,qBAAqB,CAAC;AAC/C;;;;;GAKG;AACH,eAAO,MAAM,UAAU,mBAAmB,CAAC;AAC3C,eAAO,MAAM,UAAU,yBAAyB,CAAC;AACjD,eAAO,MAAM,WAAW,uBAAuB,CAAC;AAChD,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,qBAAqB,CAAC;AAC/C;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,uBAAuB,CAAC;AAkCnD,wBAAgB,UAAU,CAAC,OAAO,GAAE,iBAAsB,GAAG,YAAY,CA8ExE;AAED,wBAAgB,UAAU,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAExE;AAMD;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAChC,oDAAoD;IACpD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACpC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,YAAY,CAC9B,IAAI,GAAE,mBAAwB,GAC/B,OAAO,CAAC,YAAY,CAAC,CA8CvB"}

package/dist/auth.js

@@ -1,226 +0,0 @@
-/**
- * Auth / configuration loading for the MCP server.
- *
- * The MCP server reads two environment variables on startup:
- *
- *   YTB_MCP_SITE_URL      — base URL of the host CMS install (WordPress
- *                           OR Joomla), e.g. `https://example.com`.
- *                           The per-platform REST namespace
- *                           (`/wp-json/yt-builder-mcp/v1` for WP,
- *                           `/api/index.php/v1/yt-builder-mcp` for
- *                           Joomla) is appended internally based on
- *                           runtime platform detection.
- *   YTB_MCP_WP_URL        — DEPRECATED alias for YTB_MCP_SITE_URL,
- *                           kept for back-compat with pre-Wave 7
- *                           configurations. A non-fatal deprecation
- *                           notice is written to stderr when the
- *                           legacy var is used in non-test mode.
- *   YTB_MCP_BEARER_TOKEN  — the Bearer key generated by the plugin
- *                           Settings page (`wp-admin → YT Builder MCP`
- *                           on WordPress, `Components → YT Builder MCP`
- *                           on Joomla).
- *
- * `loadConfig()` throws `ConfigError` if either is missing, so the
- * server fails fast with a useful message rather than emitting cryptic
- * 401/Network errors deep in the request stack.
- *
- * @license MIT
- */
-import { z } from 'zod';
-import { ConfigError } from './errors.js';
-import { synthesiseFromEnv } from './sites/env-bridge.js';
-import { SiteRegistry } from './sites/registry.js';
-import { SitesFile } from './sites/schema.js';
-import { loadSitesFile } from './sites/store.js';
-/**
- * Canonical env-var name for the host-CMS base URL (Wave 7+: covers
- * both WordPress and Joomla). Prefer this for all new configurations.
- */
-export const ENV_SITE_URL = 'YTB_MCP_SITE_URL';
-/**
- * Legacy env-var name kept for back-compat. Pre-Wave-7 configurations
- * (every release through v1.0.x) used `YTB_MCP_WP_URL`. New code should
- * use {@link ENV_SITE_URL}; this constant is retained so the wizard,
- * tests, and error hints can still reference the legacy name.
- */
-export const ENV_WP_URL = 'YTB_MCP_WP_URL';
-export const ENV_BEARER = 'YTB_MCP_BEARER_TOKEN';
-export const ENV_TIMEOUT = 'YTB_MCP_TIMEOUT_MS';
-export const ENV_TEST_MODE = 'YTB_MCP_TEST_MODE';
-/**
- * Optional platform hint env var — `'wordpress'` or `'joomla'`. When
- * unset, the server auto-detects from the URL shape (cookbook §3.7.1):
- *   - URL contains `/wp-json/`        → wordpress
- *   - URL contains `/api/index.php/`  → joomla
- *   - origin-only URL                 → defaults to wordpress (back-compat)
- *
- * Set this to `'joomla'` when your YTB_MCP_SITE_URL is an origin-only
- * Joomla URL like `https://example.com/joomla`.
- */
-export const ENV_PLATFORM = 'YTB_MCP_PLATFORM';
-/**
- * W10 — canonical env-var name for the multi-site registry file. When
- * set, {@link loadRegistry} loads + validates the JSON at this path and
- * the legacy {@link ENV_SITE_URL} / {@link ENV_BEARER} pair is ignored.
- * When unset, the env-bridge falls back to building a one-site registry
- * from the legacy single-site pair.
- */
-export const ENV_SITES_FILE = 'YTB_MCP_SITES_FILE';
-const DEFAULT_TIMEOUT_MS = 15_000;
-/**
- * Maximum accepted length for a Bearer token (defense-in-depth bound;
- * the real plugin keys are ~150-300 bytes, the 512 ceiling protects
- * against accidental file-pastes / log dumps / memory abuse).
- */
-const BEARER_MAX_LEN = 512;
-/**
- * Bearer-token format check — matches the plugin's `KeyService.php`
- * `PREFIX = ytb_live_` (and the planned `ytb_test_` future variant).
- * Token shape: `ytb_(live|test)_<payloadB64Url>.<sigB64Url>` where
- * base64url uses `[A-Za-z0-9_-]` (no dots inside the payload or sig).
- *
- * Round-1 audit I7 fix (2026-05-22): the earlier `.trim()` + empty-check
- * was not enough to catch the most common config mistakes — the leading
- * `Bearer ` prefix accidentally pasted into the env var, copy-paste
- * truncation (no `.` separator), or a totally wrong token style. We
- * fail-fast here so the client never sends a known-bad value upstream.
- */
-const BEARER_FORMAT_SCHEMA = z
-    .string()
-    .max(BEARER_MAX_LEN, `Bearer too long (max ${String(BEARER_MAX_LEN)} chars). The env var YTB_MCP_BEARER_TOKEN seems to contain something other than a plain key — strip leading "Bearer " or paste only the key copied from wp-admin → "YT Builder MCP" → Settings.`)
-    .regex(/^ytb_(live|test)_[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/, 'Bearer must match ytb_(live|test)_<payloadB64Url>.<sigB64Url> format (copy the key as shown in wp-admin → "YT Builder MCP" → Settings; do NOT prepend "Bearer ").');
-export function loadConfig(options = {}) {
-    const env = options.env ?? process.env;
-    // Wave 7: YTB_MCP_SITE_URL is canonical (covers both WP + Joomla);
-    // YTB_MCP_WP_URL is retained as a deprecated back-compat alias.
-    // Resolution order: SITE_URL wins; legacy WP_URL fallback emits a
-    // soft deprecation note in non-test mode.
-    const rawSiteUrl = (env[ENV_SITE_URL] ?? '').trim();
-    const rawLegacyUrl = (env[ENV_WP_URL] ?? '').trim();
-    const rawUrl = rawSiteUrl !== '' ? rawSiteUrl : rawLegacyUrl;
-    // Soft deprecation notice — only when the loader is being used in
-    // its real-server role (env defaulted to process.env). Programmatic
-    // callers (tests, embedded uses) pass `options.env` explicitly and
-    // are silently treated as opt-in to the legacy var.
-    if (rawSiteUrl === ''
-        && rawLegacyUrl !== ''
-        && options.env === undefined
-        && !isTestMode(env)) {
-        process.stderr.write(`[yt-builder-mcp] notice: ${ENV_WP_URL} is deprecated — ` +
-            `set ${ENV_SITE_URL} instead (same value; covers WordPress + Joomla).\n`);
-    }
-    const rawToken = (env[ENV_BEARER] ?? '').trim();
-    const rawTimeout = (env[ENV_TIMEOUT] ?? '').trim();
-    if (rawUrl === '') {
-        throw new ConfigError(`Missing ${ENV_SITE_URL}. Set it to your CMS base URL ` +
-            '(e.g. https://example.com — WordPress or Joomla). ' +
-            'Run `yt-builder-mcp setup` to configure.');
-    }
-    if (!options.allowMissingToken && rawToken === '') {
-        throw new ConfigError(`Missing ${ENV_BEARER}. Generate a Bearer key in wp-admin → "YT Builder MCP" → ` +
-            'Settings, then run `yt-builder-mcp setup`.');
-    }
-    // I7-fix: enforce the Bearer-format contract before the client
-    // makes any request. Empty token is allowed only via
-    // `allowMissingToken` (the health-only smoke path); any other
-    // non-empty value MUST match the plugin's KeyService format.
-    if (rawToken !== '') {
-        const parsed = BEARER_FORMAT_SCHEMA.safeParse(rawToken);
-        if (!parsed.success) {
-            const issueMsg = parsed.error.issues
-                .map((iss) => iss.message)
-                .join(' ');
-            throw new ConfigError(`Invalid ${ENV_BEARER}: ${issueMsg}`);
-        }
-    }
-    let timeoutMs = DEFAULT_TIMEOUT_MS;
-    if (rawTimeout !== '') {
-        const parsed = Number.parseInt(rawTimeout, 10);
-        if (Number.isFinite(parsed) && parsed > 0) {
-            timeoutMs = parsed;
-        }
-    }
-    const rawPlatform = (env[ENV_PLATFORM] ?? '').trim().toLowerCase();
-    const platformHint = rawPlatform === 'wordpress' || rawPlatform === 'joomla'
-        ? rawPlatform
-        : undefined;
-    return {
-        baseUrl: stripTrailingSlash(rawUrl),
-        bearerToken: rawToken,
-        timeoutMs,
-        ...(platformHint !== undefined ? { platformHint } : {}),
-    };
-}
-export function isTestMode(env = process.env) {
-    return (env[ENV_TEST_MODE] ?? '') === '1';
-}
-function stripTrailingSlash(url) {
-    return url.replace(/\/+$/, '');
-}
-/**
- * W10 — canonical boot-time registry loader.
- *
- * Resolution order:
- *   1. **Sites file** — if {@link ENV_SITES_FILE} is set to a non-empty
- *      string, parse + validate the JSON at that path and wrap it in a
- *      {@link SiteRegistry}. Schema failures bubble up as
- *      `SitesFileError` (the store does not swallow them); the caller
- *      decides whether to fail-fast or fall back. Wave 10 chooses
- *      fail-fast — explicit file = explicit intent.
- *
- *   2. **Legacy env-bridge** — synthesise a one-site registry from the
- *      pre-W10 single-site env-vars ({@link ENV_SITE_URL} +
- *      {@link ENV_BEARER}, with {@link ENV_PLATFORM} as optional hint).
- *      Preserves the single-site UX for every customer who has not
- *      migrated to a sites.json yet.
- *
- *   3. **Hard fail** — neither configured. Surface a {@link ConfigError}
- *      with the three setup options so the operator knows exactly which
- *      knob to turn.
- *
- * This function replaces {@link loadConfig} on the main boot path.
- * `loadConfig` is intentionally retained for the test-mode fallback in
- * `index.ts` (`--test-mode` smoke probes) and for any embedded consumer
- * that still wants a flat `ServerConfig`.
- */
-export async function loadRegistry(opts = {}) {
-    const env = opts.env ?? process.env;
-    // (1) sites file (preferred).
-    const sitesFilePath = (env[ENV_SITES_FILE] ?? '').trim();
-    if (sitesFilePath !== '') {
-        // loadSitesFile handles both "file present" and "file absent"
-        // (the latter returns an emptySitesFile). When the file is
-        // empty (no sites), fall through to env-bridge instead of
-        // booting with an empty registry — operators who set
-        // SITES_FILE to a not-yet-populated path should still get the
-        // legacy env-var ramp until they run `add-site`.
-        const file = await loadSitesFile(sitesFilePath);
-        if (file.sites.length > 0) {
-            return new SiteRegistry(file);
-        }
-    }
-    // (2) legacy env-bridge. The bridge already enforces URL/bearer
-    // non-emptiness and platform-hint validity, but we re-validate the
-    // full file shape through the W1 Zod schema before handing it to
-    // the registry. Defense-in-depth: a future env-bridge change cannot
-    // introduce a SitesFileT-shape regression that lands on the
-    // registry path without first failing this gate.
-    const synth = synthesiseFromEnv(env);
-    if (synth !== null) {
-        const parsed = SitesFile.safeParse(synth);
-        if (!parsed.success) {
-            const issues = parsed.error.issues
-                .map((i) => `${i.path.join('.')}: ${i.message}`)
-                .join('; ');
-            throw new ConfigError(`Env-bridge synthesised an invalid sites file: ${issues}`);
-        }
-        return new SiteRegistry(parsed.data);
-    }
-    // (3) fail-fast.
-    throw new ConfigError('No sites configured. Either: '
-        + '(a) set YTB_MCP_SITES_FILE to your sites.json path, or '
-        + '(b) set YTB_MCP_SITE_URL + YTB_MCP_BEARER_TOKEN for '
-        + 'single-site mode, or '
-        + '(c) run `npx -y @wootsup/yt-builder-mcp setup` interactively.');
-}
-//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAuBjD;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAC/C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAC3C,MAAM,CAAC,MAAM,UAAU,GAAG,sBAAsB,CAAC;AACjD,MAAM,CAAC,MAAM,WAAW,GAAG,oBAAoB,CAAC;AAChD,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC;AACjD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAC/C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,oBAAoB,CAAC;AAEnD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC;;;;GAIG;AACH,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B;;;;;;;;;;;GAWG;AACH,MAAM,oBAAoB,GAAG,CAAC;KACzB,MAAM,EAAE;KACR,GAAG,CACA,cAAc,EACd,wBAAwB,MAAM,CAAC,cAAc,CAAC,iMAAiM,CAClP;KACA,KAAK,CACF,kDAAkD,EAClD,mKAAmK,CACtK,CAAC;AAEN,MAAM,UAAU,UAAU,CAAC,UAA6B,EAAE;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,mEAAmE;IACnE,gEAAgE;IAChE,kEAAkE;IAClE,0CAA0C;IAC1C,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC;IAC7D,kEAAkE;IAClE,oEAAoE;IACpE,mEAAmE;IACnE,oDAAoD;IACpD,IACI,UAAU,KAAK,EAAE;WACd,YAAY,KAAK,EAAE;WACnB,OAAO,CAAC,GAAG,KAAK,SAAS;WACzB,CAAC,UAAU,CAAC,GAAG,CAAC,EACrB,CAAC;QACC,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,4BAA4B,UAAU,mBAAmB;YACrD,OAAO,YAAY,qDAAqD,CAC/E,CAAC;IACN,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAEnD,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,WAAW,CACjB,WAAW,YAAY,gCAAgC;YACnD,oDAAoD;YACpD,0CAA0C,CACjD,CAAC;IACN,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAChD,MAAM,IAAI,WAAW,CACjB,WAAW,UAAU,2DAA2D;YAC5E,4CAA4C,CACnD,CAAC;IACN,CAAC;IAED,+DAA+D;IAC/D,qDAAqD;IACrD,8DAA8D;IAC9D,6DAA6D;IAC7D,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;iBAC/B,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC;iBACzB,IAAI,CAAC,GAAG,CAAC,CAAC;YACf,MAAM,IAAI,WAAW,CACjB,WAAW,UAAU,KAAK,QAAQ,EAAE,CACvC,CAAC;QACN,CAAC;IACL,CAAC;IAED,IAAI,SAAS,GAAG,kBAAkB,CAAC;IACnC,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,SAAS,GAAG,MAAM,CAAC;QACvB,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnE,MAAM,YAAY,GACd,WAAW,KAAK,WAAW,IAAI,WAAW,KAAK,QAAQ;QACnD,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,SAAS,CAAC;IAEpB,OAAO;QACH,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC;QACnC,WAAW,EAAE,QAAQ;QACrB,SAAS;QACT,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;AACN,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC3D,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,KAAK,GAAG,CAAC;AAC9C,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACnC,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAUD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAC9B,OAA4B,EAAE;IAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAEpC,8BAA8B;IAC9B,MAAM,aAAa,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzD,IAAI,aAAa,KAAK,EAAE,EAAE,CAAC;QACvB,8DAA8D;QAC9D,2DAA2D;QAC3D,0DAA0D;QAC1D,qDAAqD;QACrD,8DAA8D;QAC9D,iDAAiD;QACjD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;IACL,CAAC;IAED,gEAAgE;IAChE,mEAAmE;IACnE,iEAAiE;IACjE,oEAAoE;IACpE,4DAA4D;IAC5D,iDAAiD;IACjD,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;iBAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;iBAC/C,IAAI,CAAC,IAAI,CAAC,CAAC;YAChB,MAAM,IAAI,WAAW,CACjB,iDAAiD,MAAM,EAAE,CAC5D,CAAC;QACN,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,iBAAiB;IACjB,MAAM,IAAI,WAAW,CACjB,+BAA+B;UAC7B,yDAAyD;UACzD,sDAAsD;UACtD,uBAAuB;UACvB,+DAA+D,CACpE,CAAC;AACN,CAAC"}

package/dist/client.d.ts

@@ -1,84 +0,0 @@
-/**
- * `RestClient` — thin wrapper around `fetch` that targets the
- * `yt-builder-mcp/v1` REST namespace.
- *
- * Responsibilities:
- *   - Compose final URLs (`{baseUrl}/wp-json/yt-builder-mcp/v1{path}`)
- *   - Attach `Authorization: Bearer …`
- *   - Encode JSON bodies + propagate `If-Match` etag headers
- *   - Map non-2xx into `RestError` with status / `code` / message
- *   - Map network failures into `NetworkError`
- *
- * The client deliberately keeps zero state beyond constructor config
- * so each tool can hold a reference and call `.get/.post/.put/.delete`
- * without coordinating sessions.
- *
- * @license MIT
- */
-import type { Platform } from './platform/index.js';
-/**
- * Canonical WordPress REST-namespace path. Re-exported for backward
- * compat — new code should reach for `Platform.restNamespacePath`.
- */
-export declare const REST_NAMESPACE_PATH = "/wp-json/yt-builder-mcp/v1";
-/**
- * Legacy single-platform options shape. Kept so existing call-sites
- * continue working without touching every entry point.
- */
-export interface LegacyRestClientOptions {
-    readonly baseUrl: string;
-    readonly bearerToken: string;
-    readonly timeoutMs?: number;
-    /** Injected for tests. Defaults to `globalThis.fetch`. */
-    readonly fetch?: typeof fetch;
-}
-/**
- * Platform-aware options shape (Wave G.0+).
- * Pass an instance of `WordPressPlatform` (or any future `Platform`)
- * instead of a bare `baseUrl`.
- */
-export interface PlatformRestClientOptions {
-    readonly platform: Platform;
-    readonly bearerToken: string;
-    readonly timeoutMs?: number;
-    /** Injected for tests. Defaults to `globalThis.fetch`. */
-    readonly fetch?: typeof fetch;
-}
-/** Discriminated union: callers pick whichever shape suits them. */
-export type RestClientOptions = LegacyRestClientOptions | PlatformRestClientOptions;
-export interface RequestOptions {
-    /** Optional ETag for optimistic-lock (`If-Match` header). */
-    readonly etag?: string;
-    /** JSON body. */
-    readonly body?: unknown;
-    /** Extra headers. */
-    readonly headers?: Record<string, string>;
-    /** Optional AbortSignal. */
-    readonly signal?: AbortSignal;
-}
-export declare class RestClient {
-    private readonly platform;
-    private readonly baseUrl;
-    private readonly bearerToken;
-    private readonly timeoutMs;
-    private readonly fetchImpl;
-    constructor(options: RestClientOptions);
-    /** Expose the underlying platform (used by tools that need restNamespacePath/kind). */
-    getPlatform(): Platform;
-    get<T = unknown>(path: string, options?: RequestOptions): Promise<T>;
-    post<T = unknown>(path: string, options?: RequestOptions): Promise<T>;
-    put<T = unknown>(path: string, options?: RequestOptions): Promise<T>;
-    delete<T = unknown>(path: string, options?: RequestOptions): Promise<T>;
-    request<T = unknown>(method: string, path: string, options?: RequestOptions): Promise<T>;
-    private buildUrl;
-}
-/**
- * URL-encode a JSON-Pointer-style element path for use in the route.
- *
- * The plugin's regex captures everything after `/elements/`, so the
- * raw `/grid/1/columns/0` path can be passed as-is — but each segment
- * must be percent-encoded so reserved chars like `~` (used in
- * JSON-Pointer escapes) don't collide with WordPress' router.
- */
-export declare function encodeElementPath(pointer: string): string;
-//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAGpD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,+BAAgC,CAAC;AAEjE;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACjC;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACtC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACjC;AAED,oEAAoE;AACpE,MAAM,MAAM,iBAAiB,GAAG,uBAAuB,GAAG,yBAAyB,CAAC;AAEpF,MAAM,WAAW,cAAc;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB;IACjB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,qBAAqB;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,4BAA4B;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CACjC;AAED,qBAAa,UAAU;IACnB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAW;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;gBAE7B,OAAO,EAAE,iBAAiB;IAYtC,uFAAuF;IACvF,WAAW,IAAI,QAAQ;IAIvB,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,CAAC,CAAC;IAIxE,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,CAAC,CAAC;IAIzE,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,CAAC,CAAC;IAIxE,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,CAAC,CAAC;IAIrE,OAAO,CAAC,CAAC,GAAG,OAAO,EACrB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,cAAmB,GAC7B,OAAO,CAAC,CAAC,CAAC;IAgDb,OAAO,CAAC,QAAQ;CAInB;AAgCD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAKzD"}