@wootsup/yt-builder-mcp 1.1.0 → 1.1.6

package/dist/server.js

@@ -1,237 +0,0 @@
-/**
- * MCP server factory — Wave G.1 / Gateway-Hub edition.
- *
- * `createServer({client})` builds a configured `McpServer` with a 3-lane
- * tool registration:
- *
- *   L3 — direct top-level (yootheme_builder_health + yootheme_builder_diagnose)
- *        Registered FIRST, BEFORE the CapturingServer wraps the real server.
- *        These tools must reach the LLM even when the gateway itself
- *        misbehaves (chicken-and-egg: the LLM diagnoses gateway breakage
- *        via these two).
- *
- *   L1 — essential forwarded (7 tools)
- *        Routed through the CapturingServer to the real server. Appear in
- *        `tools/list` as first-class entries (Cursor-cap-safe).
- *
- *   L2 — advanced captured (12 tools)
- *        Routed through the CapturingServer into its in-process advanced
- *        registry; reachable via the single `yootheme_builder_advanced`
- *        gateway tool. Hidden from `tools/list`.
- *
- *   Gateway — `yootheme_builder_advanced`
- *        Registered LAST on the real server, after every L1/L2 tool is
- *        placed and the advanced registry is final.
- *
- * Result: `tools/list.length === 10` (7 L1 + 2 L3 + 1 gateway), and the
- * full tool surface is 22 (collectAllRegisteredTools).
- *
- * @license MIT
- */
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { registerAdvancedTool } from './gateway/advanced-tool.js';
-import { CapturingServer } from './gateway/capturing-server.js';
-import { isDirectTopLevel } from './gateway/essentials.js';
-import { loadSkillContent, SKILL_RESOURCE_DESCRIPTION, SKILL_RESOURCE_MIME_TYPE, SKILL_RESOURCE_NAME, SKILL_RESOURCE_URI, } from './skill-loader.js';
-import { toElicitationCapability } from './tools/elicitation.js';
-import { buildAllTools } from './tools/index.js';
-export const SERVER_NAME = '@wootsup/yt-builder-mcp';
-export const SERVER_VERSION = '0.2.0-alpha.2';
-/**
- * W8 — stable URI under which the live sites snapshot is exposed via
- * MCP `resources/*`. Single fixed resource (no list-changed needed) —
- * MCP hosts can fetch the current registry roster on demand without
- * having to invoke a tool.
- */
-export const SITES_RESOURCE_URI = 'sites://current';
-/** Human-readable resource name surfaced in `resources/list`. */
-export const SITES_RESOURCE_NAME = 'Currently configured sites';
-/** Short description for `resources/list` consumers. */
-export const SITES_RESOURCE_DESCRIPTION = 'Live snapshot of sites wired into this MCP server (site_id, URL, ' +
-    'platform, default flag, label). Bearer fields are redacted. ' +
-    'Mirrors what `yootheme_builder_sites_list` would print.';
-/** MIME type for the `sites://current` payload. */
-export const SITES_RESOURCE_MIME_TYPE = 'application/json';
-/**
- * Build the JSON payload served by the `sites://current` resource.
- *
- * Field projection (per plan §W8 Z.925-933):
- *  - `default_site_id` from {@link SiteRegistry.defaultSiteId}.
- *  - `sites[].site_id` / `url` / `is_default` / `label` verbatim.
- *  - `sites[].platform` prefers the resolved kind from the W3 memo
- *    cache (peek-only, no probe) and falls back to the configured
- *    hint when no probe has run.
- *
- * Bearer fields are NEVER referenced. The `bearer_source` hint that
- * the W7 `sites_list` tool exposes is intentionally omitted from this
- * resource: even the "plain" vs "op" hint hints at storage layout,
- * and the resource is positioned as a host-facing public roster.
- */
-export function buildSitesResourcePayload(registry) {
-    const rows = registry.listForDisplay();
-    return {
-        default_site_id: registry.defaultSiteId(),
-        sites: rows.map((row) => {
-            const platform = row.platform_resolved ?? row.platform_hint;
-            const out = {
-                site_id: row.site_id,
-                url: row.url,
-                platform,
-                is_default: row.is_default,
-            };
-            if (row.label !== undefined) {
-                out.label = row.label;
-            }
-            return out;
-        }),
-    };
-}
-export function createServer(options) {
-    // Stream B1 — Skill-Distribution via MCP-Protocol.
-    //
-    // The bundled SKILL.md is published through two MCP-native channels:
-    //
-    //   (a) `instructions` field on the `initialize` response. MCP-spec
-    //       hosts (Claude Desktop, Cursor, …) surface this string as
-    //       auto-context so Maria-the-Claude-Desktop-user receives the
-    //       skill narrative without ever calling a tool.
-    //
-    //   (b) `skill://yt-builder-mcp` resource exposed via
-    //       `resources/list` + `resources/read`. Backup for hosts that
-    //       ignore `instructions` but honor the resources API.
-    //
-    // Reading SKILL.md is synchronous (small file, ~17 KB) and cached
-    // after first call by `loadSkillContent` — no async cost.
-    //
-    // W8 — pass the pool's registry so loadSkillContent can append the
-    // live "Currently configured sites" block. When the registry is
-    // empty (fresh install, no sites yet) the appendix is silently
-    // omitted and the host receives the unchanged skill content.
-    // Bearer fields are never touched by the appendix (see
-    // {@link appendSitesBlock} in skill-loader.ts).
-    const instructions = loadSkillContent(options.pool.registry);
-    const mcp = new McpServer({
-        name: SERVER_NAME,
-        version: SERVER_VERSION,
-    }, {
-        instructions,
-    });
-    // Register the SKILL.md as a static MCP resource. The capability
-    // (`resources: { listChanged: true }` etc.) is auto-advertised by
-    // McpServer the moment the first resource is registered, so MCP
-    // hosts see `resources` in `initialize.capabilities`.
-    mcp.registerResource(SKILL_RESOURCE_NAME, SKILL_RESOURCE_URI, {
-        title: SKILL_RESOURCE_NAME,
-        description: SKILL_RESOURCE_DESCRIPTION,
-        mimeType: SKILL_RESOURCE_MIME_TYPE,
-    }, async (uri) => ({
-        contents: [
-            {
-                uri: uri.toString(),
-                mimeType: SKILL_RESOURCE_MIME_TYPE,
-                text: instructions,
-            },
-        ],
-    }));
-    // W8 — `sites://current` resource: live registry snapshot as JSON.
-    //
-    // The payload is computed on every read (cheap — listForDisplay()
-    // is in-memory) so hosts that re-fetch after a sites file edit see
-    // up-to-date data. We do NOT emit `notifications/resources/updated`
-    // since the only mutation path is the W9 CLI which itself requires
-    // an AI-client restart (per plan §W8 line 919) — the resource is
-    // structurally static for the lifetime of the MCP session.
-    //
-    // Bearer / bearer_ref are NEVER referenced (see
-    // {@link buildSitesResourcePayload}). The resource intentionally
-    // omits the `bearer_source` hint that the `sites_list` tool
-    // surfaces; a host-facing roster should not even hint at storage
-    // layout.
-    const registry = options.pool.registry;
-    mcp.registerResource(SITES_RESOURCE_NAME, SITES_RESOURCE_URI, {
-        title: SITES_RESOURCE_NAME,
-        description: SITES_RESOURCE_DESCRIPTION,
-        mimeType: SITES_RESOURCE_MIME_TYPE,
-    }, async (uri) => ({
-        contents: [
-            {
-                uri: uri.toString(),
-                mimeType: SITES_RESOURCE_MIME_TYPE,
-                text: JSON.stringify(buildSitesResourcePayload(registry), null, 2),
-            },
-        ],
-    }));
-    // Wave G.4.5 — MCP elicitation capability wiring.
-    //
-    // `toElicitationCapability(mcp)` bridges the SDK's stricter
-    // discriminated `ElicitRequestFormParams` to the toolkit's looser
-    // `ElicitInputParams`. The 3 elicitation-aware tools
-    // (`element_delete`, `element_unbind_source`, `element_bind_source`)
-    // consume this capability through their `*HandlerDeps`; the other 19
-    // tools never see it. When the host the SDK connects to does not
-    // advertise the elicitation capability, the toolkit's `elicitChoice` /
-    // `elicitConfirmation` return `null` / `false` and the tool falls
-    // back to the structured-error / preview path (no hang, no guess).
-    const elicitation = toElicitationCapability(mcp);
-    const tools = options.tools ?? buildAllTools(options.pool, { elicitation });
-    // L3 — direct top-level: registered FIRST on the real McpServer, before
-    // the CapturingServer wraps it. These names get a no-op route inside
-    // the CapturingServer (see capturing-server.ts), so the SDK never sees
-    // a duplicate registration when the builder list is later replayed.
-    for (const tool of tools) {
-        if (isDirectTopLevel(tool.name)) {
-            registerToolOn(mcp, tool);
-        }
-    }
-    // L1 / L2 — every other tool is routed through the CapturingServer,
-    // which forwards essentials to the real server and captures the rest
-    // into its advanced registry.
-    const capturing = new CapturingServer(mcp);
-    for (const tool of tools) {
-        if (isDirectTopLevel(tool.name))
-            continue;
-        registerToolOn(capturing, tool);
-    }
-    // Gateway — registered LAST so the advanced registry is final.
-    registerAdvancedTool(mcp, capturing.getAdvancedRegistry());
-    return { mcp, tools, capturing };
-}
-/**
- * Registers a `ToolDefinition` on a `ToolRegistrar`. A real `McpServer`
- * satisfies `ToolRegistrar` structurally (its `registerTool` returns
- * `RegisteredTool`, which is assignable to the `ToolRegistrar` declared
- * `void` return type), so call-sites pass either a real server (for L3
- * + the gateway, which need not be captured) or a `CapturingServer`
- * (for L1 + L2 routing).
- */
-function registerToolOn(registrar, tool) {
-    // The SDK's `registerTool` accepts a raw Zod shape as inputSchema. We
-    // cast through `ZodRawShapeCompat` to keep our `ToolDefinition` generic
-    // (any ZodRawShape) compatible with the SDK's v3/v4 dual-zod surface.
-    const inputSchema = tool.inputSchema;
-    // outputSchema is optional — tools migrated to structured-content (Wave
-    // G.2) declare a Zod schema describing the `structuredContent` payload.
-    // The SDK accepts a `ZodTypeAny` (v3/v4) via `AnySchema`; we forward our
-    // schema verbatim. Hosts that support MCP structured output validate
-    // responses against this schema.
-    const outputSchema = tool.outputSchema !== undefined
-        ? tool.outputSchema
-        : undefined;
-    registrar.registerTool(tool.name, {
-        description: tool.description,
-        inputSchema,
-        ...(outputSchema !== undefined ? { outputSchema } : {}),
-        annotations: tool.annotations,
-    }, 
-    // Wave G.5 — forward the SDK-supplied `extra` (RequestHandlerExtra)
-    // as the 2nd argument to every handler. Write-handlers consume
-    // `extra._meta.progressToken` + `extra.sendNotification` via the
-    // local `createProgressReporter` helper; read-handlers ignore it
-    // (their handler signature still binds `extra` to `HandlerExtra |
-    // undefined`, so no runtime coupling for non-progress tools).
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- SDK generic narrows to inferred shape; safe because zod validates upstream
-    (async (args, extra) => {
-        return tool.handler(args, extra);
-    }));
-}
-//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAsB,MAAM,+BAA+B,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAG3D,OAAO,EACH,gBAAgB,EAChB,0BAA0B,EAC1B,wBAAwB,EACxB,mBAAmB,EACnB,kBAAkB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAuB,MAAM,kBAAkB,CAAC;AAEtE,MAAM,CAAC,MAAM,WAAW,GAAG,yBAAyB,CAAC;AACrD,MAAM,CAAC,MAAM,cAAc,GAAG,eAAe,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AAEpD,iEAAiE;AACjE,MAAM,CAAC,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;AAEhE,wDAAwD;AACxD,MAAM,CAAC,MAAM,0BAA0B,GACnC,mEAAmE;IACnE,8DAA8D;IAC9D,yDAAyD,CAAC;AAE9D,mDAAmD;AACnD,MAAM,CAAC,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AA4B3D;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,yBAAyB,CACrC,QAAsB;IAEtB,MAAM,IAAI,GAAG,QAAQ,CAAC,cAAc,EAAE,CAAC;IACvC,OAAO;QACH,eAAe,EAAE,QAAQ,CAAC,aAAa,EAAE;QACzC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAoB,EAAE;YACtC,MAAM,QAAQ,GACV,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,aAAa,CAAC;YAC/C,MAAM,GAAG,GAAqE;gBAC1E,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,QAAQ;gBACR,UAAU,EAAE,GAAG,CAAC,UAAU;aAC7B,CAAC;YACF,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC1B,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;YAC1B,CAAC;YACD,OAAO,GAAG,CAAC;QACf,CAAC,CAAC;KACL,CAAC;AACN,CAAC;AAqBD,MAAM,UAAU,YAAY,CAAC,OAA4B;IACrD,mDAAmD;IACnD,EAAE;IACF,qEAAqE;IACrE,EAAE;IACF,oEAAoE;IACpE,iEAAiE;IACjE,mEAAmE;IACnE,qDAAqD;IACrD,EAAE;IACF,sDAAsD;IACtD,mEAAmE;IACnE,2DAA2D;IAC3D,EAAE;IACF,kEAAkE;IAClE,0DAA0D;IAC1D,EAAE;IACF,mEAAmE;IACnE,gEAAgE;IAChE,+DAA+D;IAC/D,6DAA6D;IAC7D,uDAAuD;IACvD,gDAAgD;IAChD,MAAM,YAAY,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE7D,MAAM,GAAG,GAAG,IAAI,SAAS,CACrB;QACI,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,cAAc;KAC1B,EACD;QACI,YAAY;KACf,CACJ,CAAC;IAEF,iEAAiE;IACjE,kEAAkE;IAClE,gEAAgE;IAChE,sDAAsD;IACtD,GAAG,CAAC,gBAAgB,CAChB,mBAAmB,EACnB,kBAAkB,EAClB;QACI,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,0BAA0B;QACvC,QAAQ,EAAE,wBAAwB;KACrC,EACD,KAAK,EAAE,GAAQ,EAAE,EAAE,CAAC,CAAC;QACjB,QAAQ,EAAE;YACN;gBACI,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;gBACnB,QAAQ,EAAE,wBAAwB;gBAClC,IAAI,EAAE,YAAY;aACrB;SACJ;KACJ,CAAC,CACL,CAAC;IAEF,mEAAmE;IACnE,EAAE;IACF,kEAAkE;IAClE,mEAAmE;IACnE,oEAAoE;IACpE,mEAAmE;IACnE,iEAAiE;IACjE,2DAA2D;IAC3D,EAAE;IACF,gDAAgD;IAChD,iEAAiE;IACjE,4DAA4D;IAC5D,iEAAiE;IACjE,UAAU;IACV,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;IACvC,GAAG,CAAC,gBAAgB,CAChB,mBAAmB,EACnB,kBAAkB,EAClB;QACI,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,0BAA0B;QACvC,QAAQ,EAAE,wBAAwB;KACrC,EACD,KAAK,EAAE,GAAQ,EAAE,EAAE,CAAC,CAAC;QACjB,QAAQ,EAAE;YACN;gBACI,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;gBACnB,QAAQ,EAAE,wBAAwB;gBAClC,IAAI,EAAE,IAAI,CAAC,SAAS,CAChB,yBAAyB,CAAC,QAAQ,CAAC,EACnC,IAAI,EACJ,CAAC,CACJ;aACJ;SACJ;KACJ,CAAC,CACL,CAAC;IAEF,kDAAkD;IAClD,EAAE;IACF,4DAA4D;IAC5D,kEAAkE;IAClE,qDAAqD;IACrD,qEAAqE;IACrE,qEAAqE;IACrE,iEAAiE;IACjE,uEAAuE;IACvE,kEAAkE;IAClE,mEAAmE;IACnE,MAAM,WAAW,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAEjD,MAAM,KAAK,GACP,OAAO,CAAC,KAAK,IAAI,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;IAElE,wEAAwE;IACxE,qEAAqE;IACrE,uEAAuE;IACvE,oEAAoE;IACpE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;IACL,CAAC;IAED,oEAAoE;IACpE,qEAAqE;IACrE,8BAA8B;IAC9B,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC1C,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,+DAA+D;IAC/D,oBAAoB,CAAC,GAAG,EAAE,SAAS,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAE3D,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,SAAwB,EAAE,IAAoB;IAClE,sEAAsE;IACtE,wEAAwE;IACxE,sEAAsE;IACtE,MAAM,WAAW,GAAG,IAAI,CAAC,WAAgC,CAAC;IAE1D,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,qEAAqE;IACrE,iCAAiC;IACjC,MAAM,YAAY,GACd,IAAI,CAAC,YAAY,KAAK,SAAS;QAC3B,CAAC,CAAE,IAAI,CAAC,YAA6C;QACrD,CAAC,CAAC,SAAS,CAAC;IAEpB,SAAS,CAAC,YAAY,CAClB,IAAI,CAAC,IAAI,EACT;QACI,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW;QACX,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,WAAW,EAAE,IAAI,CAAC,WAAW;KAChC;IACD,oEAAoE;IACpE,+DAA+D;IAC/D,iEAAiE;IACjE,iEAAiE;IACjE,kEAAkE;IAClE,8DAA8D;IAC9D,4IAA4I;IAC5I,CAAC,KAAK,EAAE,IAAS,EAAE,KAAU,EAAE,EAAE;QAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC,CAAU,CACd,CAAC;AACN,CAAC"}

package/dist/setup-cli-confirm.d.ts

@@ -1,36 +0,0 @@
-/**
- * W12-R2A — TTY confirm prompt for destructive CLI subcommands.
- *
- * Hosts `confirmTTY(prompt)`, the y/N readline callback the W9
- * dispatcher wires into the `removeSiteCommand` / `setDefaultCommand`
- * deps bag. Lives in its own file so the dispatcher stays a thin
- * routing layer and so tests can mock the prompt without touching the
- * subcommand factories.
- *
- * Contract:
- *
- *  - Returns `true` ONLY when stdin is a TTY AND the operator types
- *    "y", "Y", or "yes" (case-insensitive). Anything else (incl. EOF,
- *    empty line, Ctrl-D) returns `false` → caller treats this as a
- *    cancel and skips the write.
- *
- *  - When stdin is NOT a TTY (CI, piped input, MCP-server stdio), the
- *    function does NOT block — it returns `false` immediately and
- *    writes a one-line hint to stderr telling the operator to pass
- *    `--yes` for non-interactive use. The dispatcher then surfaces a
- *    typed `CONFIRM_REQUIRED` / `SET_DEFAULT_CONFIRM_REQUIRED` error
- *    via the subcommand factory (which fails closed when no confirm
- *    hook AND no --yes is in play).
- *
- *  - No external deps; uses Node's built-in `node:readline` so the
- *    package keeps the same dep-graph as Round-1.
- *
- * @license MIT
- */
-/**
- * Read one line via readline and resolve `true` on y/Y/yes,
- * `false` otherwise. Stdin-not-a-TTY short-circuits to `false` with a
- * stderr hint so a piped invocation can't silently hang.
- */
-export declare function confirmTTY(prompt: string): Promise<boolean>;
-//# sourceMappingURL=setup-cli-confirm.d.ts.map

package/dist/setup-cli-confirm.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"setup-cli-confirm.d.ts","sourceRoot":"","sources":["../src/setup-cli-confirm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAuBjE"}

package/dist/setup-cli-confirm.js

@@ -1,59 +0,0 @@
-/**
- * W12-R2A — TTY confirm prompt for destructive CLI subcommands.
- *
- * Hosts `confirmTTY(prompt)`, the y/N readline callback the W9
- * dispatcher wires into the `removeSiteCommand` / `setDefaultCommand`
- * deps bag. Lives in its own file so the dispatcher stays a thin
- * routing layer and so tests can mock the prompt without touching the
- * subcommand factories.
- *
- * Contract:
- *
- *  - Returns `true` ONLY when stdin is a TTY AND the operator types
- *    "y", "Y", or "yes" (case-insensitive). Anything else (incl. EOF,
- *    empty line, Ctrl-D) returns `false` → caller treats this as a
- *    cancel and skips the write.
- *
- *  - When stdin is NOT a TTY (CI, piped input, MCP-server stdio), the
- *    function does NOT block — it returns `false` immediately and
- *    writes a one-line hint to stderr telling the operator to pass
- *    `--yes` for non-interactive use. The dispatcher then surfaces a
- *    typed `CONFIRM_REQUIRED` / `SET_DEFAULT_CONFIRM_REQUIRED` error
- *    via the subcommand factory (which fails closed when no confirm
- *    hook AND no --yes is in play).
- *
- *  - No external deps; uses Node's built-in `node:readline` so the
- *    package keeps the same dep-graph as Round-1.
- *
- * @license MIT
- */
-import { createInterface } from 'node:readline';
-/**
- * Read one line via readline and resolve `true` on y/Y/yes,
- * `false` otherwise. Stdin-not-a-TTY short-circuits to `false` with a
- * stderr hint so a piped invocation can't silently hang.
- */
-export async function confirmTTY(prompt) {
-    // process.stdin.isTTY is `true | undefined` per Node's typings —
-    // explicit !== true guards against both undefined and false.
-    if (process.stdin.isTTY !== true) {
-        process.stderr.write('yt-builder-mcp: no TTY available for confirmation. '
-            + 'Pass --yes to run this subcommand non-interactively.\n');
-        return false;
-    }
-    const rl = createInterface({
-        input: process.stdin,
-        output: process.stderr,
-    });
-    try {
-        const answer = await new Promise((resolve) => {
-            rl.question(`${prompt} [y/N] `, (line) => resolve(line));
-        });
-        const normalised = answer.trim().toLowerCase();
-        return normalised === 'y' || normalised === 'yes';
-    }
-    finally {
-        rl.close();
-    }
-}
-//# sourceMappingURL=setup-cli-confirm.js.map

package/dist/setup-cli-confirm.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"setup-cli-confirm.js","sourceRoot":"","sources":["../src/setup-cli-confirm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAc;IAC3C,iEAAiE;IACjE,6DAA6D;IAC7D,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,qDAAqD;cAC/C,wDAAwD,CACjE,CAAC;QACF,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,MAAM,EAAE,GAAG,eAAe,CAAC;QACvB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;KACzB,CAAC,CAAC;IACH,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;YACjD,EAAE,CAAC,QAAQ,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC/C,OAAO,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,KAAK,CAAC;IACtD,CAAC;YAAS,CAAC;QACP,EAAE,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;AACL,CAAC"}

package/dist/setup-cli.d.ts

@@ -1,152 +0,0 @@
-#!/usr/bin/env node
-/**
- * Top-level CLI dispatcher for `@wootsup/yt-builder-mcp`.
- *
- * Round-1 audit I5 fix (2026-05-22): the wizard implementation lives in
- * `setup-wizard.ts`; this file is the thin dispatcher (`runCli`) plus
- * the ESM main-guard. Both have their own deps-bag (`WizardDeps` /
- * `RunCliDeps`) so unit tests can drive them independently.
- *
- * Subcommands:
- *
- *   setup (default)   — runWizard (see `setup-wizard.ts`)
- *   install-skill     — copy the bundled skill into ~/.claude/skills/
- *                       and append a marker block to ~/AGENTS.md.
- *   --help / help     — print usage.
- *   --version / -v    — print the package version.
- *
- * Re-exports `runWizard`, `majorMinor` and the wizard public types so
- * existing callers (and tests that already import from `./setup-cli`)
- * keep working with a one-line import.
- *
- * @license MIT
- */
-import { installSkill as defaultInstallSkill } from './install-skill.js';
-import type { WizardDeps } from './setup-wizard-types.js';
-import { type AddSiteArgs, type AddSiteDeps, type AddSiteResult } from './sites/cli/add-site.js';
-import { type ListSitesDeps } from './sites/cli/list-sites.js';
-import { type RemoveSiteDeps } from './sites/cli/remove-site.js';
-import { type SetDefaultDeps } from './sites/cli/set-default.js';
-import { type TestSiteDeps } from './sites/cli/test-site.js';
-export { DEFAULT_WIZARD_DEPS, majorMinor, runWizard, type AuthProbeResult, type HandshakeResult, type HealthProbeResult, type WizardAnswers, type WizardDeps, type WriteResult, } from './setup-wizard.js';
-export interface ParsedSetupArgs {
-    /** True when `--non-interactive` was passed. Always boolean. */
-    readonly nonInteractive: boolean;
-    /** Site base URL from `--url` (WordPress or Joomla), trailing slash stripped, trimmed. */
-    readonly url: string;
-    /** Bearer token from `--token`, trimmed. */
-    readonly token: string;
-    /** Client ids from repeated `--client`. */
-    readonly clients: readonly string[];
-    /**
-     * Pickup URL from `--pickup`, trimmed. When set together with
-     * `nonce`, the wizard fetches the Bearer + canonical URL from the
-     * plugin in a single POST instead of prompting.
-     */
-    readonly pickup?: string;
-    /** One-shot nonce from `--nonce`, trimmed. Pairs 1:1 with `pickup`. */
-    readonly nonce?: string;
-    /**
-     * Human-readable validation errors. Empty array means the parsed
-     * args are usable. The dispatcher prints these to stderr and exits
-     * non-zero when non-empty AND `--non-interactive` was requested.
-     */
-    readonly errors: readonly string[];
-    /**
-     * Non-fatal warnings to surface on stderr (e.g. "--url ignored in
-     * pickup mode"). These do NOT block the wizard from running.
-     */
-    readonly warnings: readonly string[];
-}
-/**
- * Parse the `setup` subcommand argv tail. Pure function; does no I/O.
- *
- * Accepts both `--key value` and `--key=value` styles. Unknown flags
- * are reported as errors so typos don't silently disable validation.
- */
-export declare function parseSetupArgs(argv: readonly string[]): ParsedSetupArgs;
-/**
- * Build a `WizardDeps` bag that answers prompts from CLI flags instead
- * of asking a human. Reuses every other dependency (probes, writes,
- * handshake) from `DEFAULT_WIZARD_DEPS` so the wizard's exit-code
- * contract (0/2/3/4/5) stays identical.
- *
- * `confirmContinue` always returns `false` — there is no human to ask,
- * so a probe failure cleanly aborts with the documented exit code.
- */
-export declare function buildNonInteractiveDeps(parsed: ParsedSetupArgs, base?: WizardDeps): WizardDeps;
-/**
- * Build a `WizardDeps` bag for the Wave-C pickup flow. The wizard's
- * `prompt` step calls `base.fetchPickup(url, nonce)` once, then
- * synthesises the `WizardAnswers` from the response — the actual answers
- * (token + canonical WordPress URL) come straight from the plugin via
- * a 256-bit one-shot nonce, never through chat history / provider logs.
- *
- * On `fetchPickup` failure the prompt resolves to `null` so the wizard
- * exits cleanly with code 130 (user-cancel equivalent — we treat
- * an unrecoverable pickup as "the conversation ends here"). The
- * thrown error is logged via the `log` dep so the operator sees why.
- *
- * `confirmContinue` returns `false` (same rationale as non-interactive).
- */
-export declare function buildPickupDeps(parsed: ParsedSetupArgs, base?: WizardDeps): WizardDeps;
-/**
- * Parsed shape for the `add-site` subcommand. Pure-data; tests
- * exercise this without filesystem deps.
- */
-export interface ParsedAddSiteArgs {
-    readonly url: string;
-    readonly token: string;
-    readonly tokenRef: string;
-    readonly platform?: 'auto' | 'wordpress' | 'joomla';
-    readonly label: string;
-    readonly siteId: string;
-    readonly default: boolean;
-    readonly yes: boolean;
-    readonly sitesFile?: string;
-    readonly errors: readonly string[];
-}
-/**
- * Parse `add-site` flags from the tail of argv. Accepts both
- * `--key value` and `--key=value` styles. Unknown flags are reported
- * as errors so typos never silently disable validation.
- */
-export declare function parseAddSiteArgs(argv: readonly string[]): ParsedAddSiteArgs;
-export interface RunCliDeps {
-    /**
-     * Wizard runner. The optional deps bag lets the non-interactive
-     * dispatcher inject prebuilt answers; interactive callers pass
-     * nothing and the wizard uses `DEFAULT_WIZARD_DEPS`.
-     */
-    runWizard: (deps?: WizardDeps) => Promise<number>;
-    installSkill: typeof defaultInstallSkill;
-    log?: (line: string) => void;
-    error?: (line: string) => void;
-    /** Test injection — override the resolved sites.json path. */
-    resolveSitesPath?: () => string;
-    addSiteDeps?: AddSiteDeps;
-    listSitesDeps?: ListSitesDeps;
-    removeSiteDeps?: RemoveSiteDeps;
-    setDefaultDeps?: SetDefaultDeps;
-    testSiteDeps?: TestSiteDeps;
-    /**
-     * W12-R2A — y/N prompt for destructive subcommands (remove-site,
-     * set-default). Defaults to {@link defaultConfirmTTY} which reads
-     * from process.stdin via readline. Tests inject a stub.
-     *
-     * Note: when the operator passes `--yes`, this hook is NEVER
-     * invoked — the subcommand factory short-circuits before reaching
-     * the confirm step. When `--yes` is absent AND no confirm hook is
-     * injectable (CI / piped stdin), the factory throws a typed
-     * CONFIRM_REQUIRED / SET_DEFAULT_CONFIRM_REQUIRED error.
-     */
-    confirm?: (message: string) => Promise<boolean>;
-    /**
-     * Optional override for the post-wizard `addSiteCommand` call.
-     * Tests stub this to assert the wizard wires through addSiteCommand
-     * without writing to disk.
-     */
-    addSiteFromWizard?: (args: AddSiteArgs, path: string) => Promise<AddSiteResult>;
-}
-export declare function runCli(argv: readonly string[], deps?: Partial<RunCliDeps>): Promise<number>;
-//# sourceMappingURL=setup-cli.d.ts.map

package/dist/setup-cli.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"setup-cli.d.ts","sourceRoot":"","sources":["../src/setup-cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,YAAY,IAAI,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAIzE,OAAO,KAAK,EAAiB,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAIH,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,aAAa,EACrB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAGH,KAAK,aAAa,EACrB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAIH,KAAK,cAAc,EACtB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAIH,KAAK,cAAc,EACtB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAKH,KAAK,YAAY,EACpB,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EACH,mBAAmB,EACnB,UAAU,EACV,SAAS,EACT,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,WAAW,GACnB,MAAM,mBAAmB,CAAC;AAyF3B,MAAM,WAAW,eAAe;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,0FAA0F;IAC1F,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,4CAA4C;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,2CAA2C;IAC3C,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,uEAAuE;IACvE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,eAAe,CAyGvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACnC,MAAM,EAAE,eAAe,EACvB,IAAI,GAAE,UAAgC,GACvC,UAAU,CAWZ;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAC3B,MAAM,EAAE,eAAe,EACvB,IAAI,GAAE,UAAgC,GACvC,UAAU,CA+BZ;AAID;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,iBAAiB,CAuH3E;AAoID,MAAM,WAAW,UAAU;IACvB;;;;OAIG;IACH,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,YAAY,EAAE,OAAO,mBAAmB,CAAC;IACzC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAC;IAChC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,CAChB,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,MAAM,KACX,OAAO,CAAC,aAAa,CAAC,CAAC;CAC/B;AAED,wBAAsB,MAAM,CACxB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,IAAI,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,GAC3B,OAAO,CAAC,MAAM,CAAC,CAmVjB"}