@wootsup/yt-builder-mcp 1.1.6 → 1.2.0

package/dist/setup-wizard.js

@@ -0,0 +1,199 @@
+/**
+ * Interactive setup wizard for `@wootsup/yt-builder-mcp`.
+ *
+ * `runWizard()` accepts a {@link WizardDeps} bag so unit tests can drive
+ * a deterministic prompt → validate → probe → write → handshake sequence
+ * without touching real subprocesses or filesystems.
+ *
+ * After the Round-1 audit I5 fix, this file is the wizard ALGORITHM only:
+ *   - `WizardDeps` and its result types live in `setup-wizard-types.ts`.
+ *   - Default real-I/O implementations + `rollbackWrites` + `majorMinor`
+ *     live in `setup-wizard-defaults.ts`.
+ *   - The CLI dispatcher + main-guard live in `setup-cli.ts`.
+ *
+ * @license MIT
+ */
+import { cancel, log, note, outro, spinner } from '@clack/prompts';
+import { SERVER_NAME, SERVER_VERSION } from './server.js';
+import { DEFAULT_WIZARD_DEPS, rollbackWrites, } from './setup-wizard-defaults.js';
+// Re-export the public surface so `import { runWizard, WizardDeps } from
+// './setup-wizard.js'` continues to work without touching the split files.
+export { DEFAULT_WIZARD_DEPS, majorMinor } from './setup-wizard-defaults.js';
+// 1.0.2 Wave-R Part 2: renamed `yootheme-builder` → `yt-builder-mcp`
+// to match the package slug + REST namespace + GitHub repo + skill
+// folder. Pre-1.0.1 installs (alpha-tester only, per Thomas 2026-05-23)
+// would land their server under the old key; no migration logic is
+// shipped because there were no production installs to migrate. If
+// someone re-runs setup they'll get a fresh `yt-builder-mcp` entry +
+// the legacy `yootheme-builder` entry stays dormant (harmless, points
+// at the same npm package).
+const SERVER_KEY = 'yt-builder-mcp';
+/**
+ * Run the interactive setup wizard. Returns a process exit-code so the
+ * outer dispatcher can `process.exit(rc)` cleanly.
+ *
+ * Exit codes:
+ *   0  — success (configs written, handshake OK)
+ *   1  — invalid input that prevents proceeding
+ *   2  — health probe failed and user declined to continue
+ *   3  — auth probe failed and user declined to continue
+ *   4  — write failed; configs rolled back
+ *   5  — handshake failed; configs rolled back
+ *   130 — user cancelled (matches the SIGINT convention)
+ */
+export async function runWizard(deps = DEFAULT_WIZARD_DEPS) {
+    const logFn = deps.log ?? ((line) => process.stderr.write(`${line}\n`));
+    // 1. Detect clients + collect answers.
+    const detected = deps.detectClients();
+    const answers = await deps.prompt({ detected });
+    if (answers === null)
+        return 130;
+    if (answers.wpUrl === '' || answers.bearer === '') {
+        logFn('Both the WordPress URL and the Bearer key are required.');
+        return 1;
+    }
+    // 2a. Identity probe (no auth) — confirms the URL hosts our plugin
+    //     and cross-checks against the URL the user entered. Optional
+    //     dep for back-compat: missing field = skip (older WizardDeps
+    //     bags + pre-6.5 plugins don't expose it).
+    if (deps.probeIdentity !== undefined) {
+        const idSpinner = spinner();
+        idSpinner.start('Verifying plugin identity…');
+        const identity = await deps.probeIdentity(answers.wpUrl);
+        if (identity.ok) {
+            const summary = identity.siteurl !== undefined
+                ? `Plugin identified at ${identity.siteurl}.`
+                : 'Plugin identified.';
+            idSpinner.stop(summary);
+            if (identity.siteurl !== undefined && identity.siteurl !== answers.wpUrl) {
+                log.warn(`URL mismatch: you entered ${answers.wpUrl} but the plugin reports its canonical URL as ${identity.siteurl}. ` +
+                    `Using the URL you entered — fix the mismatch if you get auth errors.`);
+            }
+        }
+        else {
+            idSpinner.stop('Identity probe failed.');
+            log.warn(`Identity probe: ${identity.error ?? 'unknown'} (continuing — older plugins lack this endpoint).`);
+        }
+    }
+    // 2b. Health probe (no auth).
+    const healthSpinner = spinner();
+    healthSpinner.start('Probing plugin health…');
+    const health = await deps.probeHealth(answers.wpUrl);
+    if (health.ok) {
+        healthSpinner.stop(health.pluginVersion !== undefined
+            ? `Plugin reachable (v${health.pluginVersion}).`
+            : 'Plugin reachable.');
+    }
+    else {
+        healthSpinner.stop('Plugin probe failed.');
+        log.error(`Could not reach the plugin: ${health.error ?? 'unknown'}`);
+        const cont = await deps.confirmContinue('Continue anyway and write the config? (You can fix this later.)');
+        if (!cont) {
+            cancel('Setup cancelled.');
+            return 2;
+        }
+    }
+    // 3. Auth probe (Bearer).
+    const authSpinner = spinner();
+    authSpinner.start('Verifying Bearer key…');
+    const auth = await deps.probeAuth(answers.wpUrl, answers.bearer);
+    const authOk = auth.ok;
+    if (authOk) {
+        authSpinner.stop('Bearer key accepted.');
+    }
+    else {
+        authSpinner.stop('Bearer probe failed.');
+        log.warn(`Auth probe failed: ${auth.error ?? 'unknown'}`);
+        const cont = await deps.confirmContinue('Continue anyway and write the config?');
+        if (!cont) {
+            cancel('Setup cancelled.');
+            return 3;
+        }
+    }
+    // 4. Write configs. Track previous content for rollback.
+    //
+    // Wave 7 (2026-05-24): write BOTH env-var names so the config works
+    // with every release line — pre-Wave-7 servers only know
+    // YTB_MCP_WP_URL; Wave-7+ servers prefer YTB_MCP_SITE_URL but still
+    // honour the legacy alias. The wizard intentionally writes both so a
+    // wizard-rendered config never needs editing after an npm upgrade.
+    const serverConfig = {
+        command: 'npx',
+        args: ['-y', SERVER_NAME],
+        env: {
+            YTB_MCP_SITE_URL: answers.wpUrl,
+            YTB_MCP_WP_URL: answers.wpUrl,
+            YTB_MCP_BEARER_TOKEN: answers.bearer,
+        },
+    };
+    const writes = [];
+    let writeFailed = false;
+    for (const id of answers.selectedClients) {
+        const result = await deps.writeClient(id, SERVER_KEY, serverConfig);
+        writes.push(result);
+        if (!result.ok) {
+            writeFailed = true;
+            break;
+        }
+    }
+    const summary = writes
+        .map((r) => r.ok
+        ? `  ✓ ${r.label}: configured`
+        : `  ✗ ${r.label}: FAILED (${r.error ?? 'unknown'})`)
+        .join('\n');
+    note(summary, 'Results');
+    if (writeFailed) {
+        log.error('Write failed — rolling back any partial writes.');
+        await rollbackWrites(writes, logFn);
+        return 4;
+    }
+    // 5. Dist-tag handshake (only when auth probe succeeded — there's
+    // no point handshaking with a known-bad token).
+    if (authOk) {
+        const hsSpinner = spinner();
+        hsSpinner.start('Verifying dist-tag handshake…');
+        const hs = await deps.handshake(answers.wpUrl, answers.bearer, SERVER_VERSION);
+        if (!hs.ok) {
+            hsSpinner.stop('Handshake failed.');
+            log.error(`Handshake failed after writing configs: ${hs.error ?? 'unknown'}. Rolling back.`);
+            await rollbackWrites(writes, logFn);
+            return 5;
+        }
+        if (hs.warning !== undefined) {
+            hsSpinner.stop('Handshake OK (with warning).');
+            log.warn(hs.warning);
+        }
+        else {
+            hsSpinner.stop('Handshake OK.');
+        }
+    }
+    else {
+        log.warn('Skipping handshake because the Bearer probe failed.');
+    }
+    // W9 — persist the answers to the multi-site sites.json registry
+    // when the dispatcher wired a `persistSite` callback. We do this
+    // AFTER the handshake passes so the sites.json never contains a
+    // site that failed the probe. Optional hook so pre-W9 callers
+    // (and tests that drive the wizard without sites.json) skip the
+    // write transparently.
+    if (deps.persistSite !== undefined && writes.every((r) => r.ok)) {
+        try {
+            await deps.persistSite(answers);
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            log.error(`Failed to persist site to sites.json: ${msg}`);
+            // Don't rollback the client configs — the env-var path
+            // still works; the sites.json file is an additive surface.
+            // Operator just sees the warning + can retry with `add-site`.
+        }
+    }
+    if (writes.every((r) => r.ok) && authOk) {
+        outro('Done — restart your AI client to load the new MCP server.');
+    }
+    else {
+        outro('Setup finished with warnings. See the messages above.');
+    }
+    return 0;
+}
+//# sourceMappingURL=setup-wizard.js.map

package/dist/setup-wizard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-wizard.js","sourceRoot":"","sources":["../src/setup-wizard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAGnE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EACH,mBAAmB,EACnB,cAAc,GACjB,MAAM,4BAA4B,CAAC;AAUpC,yEAAyE;AACzE,2EAA2E;AAC3E,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAU7E,qEAAqE;AACrE,mEAAmE;AACnE,wEAAwE;AACxE,mEAAmE;AACnE,mEAAmE;AACnE,qEAAqE;AACrE,sEAAsE;AACtE,4BAA4B;AAC5B,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAEpC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC3B,OAAmB,mBAAmB;IAEtC,MAAM,KAAK,GACP,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC;IAEtE,uCAAuC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC;IAEjC,IAAI,OAAO,CAAC,KAAK,KAAK,EAAE,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAChD,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACjE,OAAO,CAAC,CAAC;IACb,CAAC;IAED,mEAAmE;IACnE,kEAAkE;IAClE,kEAAkE;IAClE,+CAA+C;IAC/C,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,OAAO,EAAE,CAAC;QAC5B,SAAS,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,KAAK,SAAS;gBAC1C,CAAC,CAAC,wBAAwB,QAAQ,CAAC,OAAO,GAAG;gBAC7C,CAAC,CAAC,oBAAoB,CAAC;YAC3B,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;gBACvE,GAAG,CAAC,IAAI,CACJ,6BAA6B,OAAO,CAAC,KAAK,gDAAgD,QAAQ,CAAC,OAAO,IAAI;oBAC1G,sEAAsE,CAC7E,CAAC;YACN,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,SAAS,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;YACzC,GAAG,CAAC,IAAI,CAAC,mBAAmB,QAAQ,CAAC,KAAK,IAAI,SAAS,mDAAmD,CAAC,CAAC;QAChH,CAAC;IACL,CAAC;IAED,8BAA8B;IAC9B,MAAM,aAAa,GAAG,OAAO,EAAE,CAAC;IAChC,aAAa,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAsB,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACZ,aAAa,CAAC,IAAI,CACd,MAAM,CAAC,aAAa,KAAK,SAAS;YAC9B,CAAC,CAAC,sBAAsB,MAAM,CAAC,aAAa,IAAI;YAChD,CAAC,CAAC,mBAAmB,CAC5B,CAAC;IACN,CAAC;SAAM,CAAC;QACJ,aAAa,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAC3C,GAAG,CAAC,KAAK,CAAC,+BAA+B,MAAM,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CACnC,iEAAiE,CACpE,CAAC;QACF,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC3B,OAAO,CAAC,CAAC;QACb,CAAC;IACL,CAAC;IAED,0BAA0B;IAC1B,MAAM,WAAW,GAAG,OAAO,EAAE,CAAC;IAC9B,WAAW,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAoB,MAAM,IAAI,CAAC,SAAS,CAC9C,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,MAAM,CACjB,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;IACvB,IAAI,MAAM,EAAE,CAAC;QACT,WAAW,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC7C,CAAC;SAAM,CAAC;QACJ,WAAW,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CACnC,uCAAuC,CAC1C,CAAC;QACF,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC3B,OAAO,CAAC,CAAC;QACb,CAAC;IACL,CAAC;IAED,yDAAyD;IACzD,EAAE;IACF,oEAAoE;IACpE,yDAAyD;IACzD,oEAAoE;IACpE,qEAAqE;IACrE,mEAAmE;IACnE,MAAM,YAAY,GAAoB;QAClC,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC;QACzB,GAAG,EAAE;YACD,gBAAgB,EAAE,OAAO,CAAC,KAAK;YAC/B,cAAc,EAAE,OAAO,CAAC,KAAK;YAC7B,oBAAoB,EAAE,OAAO,CAAC,MAAM;SACvC;KACJ,CAAC;IAEF,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpB,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACb,WAAW,GAAG,IAAI,CAAC;YACnB,MAAM;QACV,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,MAAM;SACjB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,EAAE;QACA,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,cAAc;QAC9B,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,KAAK,IAAI,SAAS,GAAG,CAC3D;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAEzB,IAAI,WAAW,EAAE,CAAC;QACd,GAAG,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QAC7D,MAAM,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACpC,OAAO,CAAC,CAAC;IACb,CAAC;IAED,kEAAkE;IAClE,gDAAgD;IAChD,IAAI,MAAM,EAAE,CAAC;QACT,MAAM,SAAS,GAAG,OAAO,EAAE,CAAC;QAC5B,SAAS,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACjD,MAAM,EAAE,GAAoB,MAAM,IAAI,CAAC,SAAS,CAC5C,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,MAAM,EACd,cAAc,CACjB,CAAC;QACF,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACT,SAAS,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YACpC,GAAG,CAAC,KAAK,CACL,2CAA2C,EAAE,CAAC,KAAK,IAAI,SAAS,iBAAiB,CACpF,CAAC;YACF,MAAM,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACpC,OAAO,CAAC,CAAC;QACb,CAAC;QACD,IAAI,EAAE,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3B,SAAS,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;YAC/C,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;aAAM,CAAC;YACJ,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACpC,CAAC;IACL,CAAC;SAAM,CAAC;QACJ,GAAG,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;IACpE,CAAC;IAED,iEAAiE;IACjE,iEAAiE;IACjE,gEAAgE;IAChE,8DAA8D;IAC9D,gEAAgE;IAChE,uBAAuB;IACvB,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC;YACD,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,GAAG,CAAC,KAAK,CAAC,yCAAyC,GAAG,EAAE,CAAC,CAAC;YAC1D,uDAAuD;YACvD,2DAA2D;YAC3D,8DAA8D;QAClE,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC;QACtC,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACvE,CAAC;SAAM,CAAC;QACJ,KAAK,CAAC,uDAAuD,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,CAAC,CAAC;AACb,CAAC"}

package/dist/setup.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Backwards-compat entry point for `npx -y @wootsup/yt-builder-mcp setup`.
+ *
+ * The Wave G.7 refactor moved the wizard implementation into
+ * {@link runWizard} (with dependency injection so it's unit-testable)
+ * and the subcommand dispatcher into {@link runCli}, both in
+ * `./setup-cli.ts`. This file remains so the published `bin/`
+ * shim that does `import('../dist/setup.js')` still works after a
+ * partial deploy where only the published tarball is updated; it
+ * simply forwards to `runWizard()`.
+ *
+ * `YTB_MCP_TEST_MODE=1` short-circuits the wizard for smoke tests.
+ *
+ * @license MIT
+ */
+export {};
+//# sourceMappingURL=setup.d.ts.map

package/dist/setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../src/setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG"}

package/dist/setup.js

@@ -0,0 +1,33 @@
+/**
+ * Backwards-compat entry point for `npx -y @wootsup/yt-builder-mcp setup`.
+ *
+ * The Wave G.7 refactor moved the wizard implementation into
+ * {@link runWizard} (with dependency injection so it's unit-testable)
+ * and the subcommand dispatcher into {@link runCli}, both in
+ * `./setup-cli.ts`. This file remains so the published `bin/`
+ * shim that does `import('../dist/setup.js')` still works after a
+ * partial deploy where only the published tarball is updated; it
+ * simply forwards to `runWizard()`.
+ *
+ * `YTB_MCP_TEST_MODE=1` short-circuits the wizard for smoke tests.
+ *
+ * @license MIT
+ */
+import { runWizard } from './setup-cli.js';
+const TEST_MODE = process.env.YTB_MCP_TEST_MODE === '1';
+async function run() {
+    if (TEST_MODE) {
+        process.stderr.write('[yt-builder-mcp setup] Test mode — exiting after banner.\n');
+        return;
+    }
+    const code = await runWizard();
+    if (code !== 0) {
+        process.exit(code);
+    }
+}
+run().catch((e) => {
+    const message = e instanceof Error ? e.message : String(e);
+    process.stderr.write(`[yt-builder-mcp setup] fatal: ${message}\n`);
+    process.exit(1);
+});
+//# sourceMappingURL=setup.js.map

package/dist/setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../src/setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,GAAG,CAAC;AAExD,KAAK,UAAU,GAAG;IACd,IAAI,SAAS,EAAE,CAAC;QACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;QACnF,OAAO;IACX,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC;IAC/B,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;AACL,CAAC;AAED,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;IACvB,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,OAAO,IAAI,CAAC,CAAC;IACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC,CAAC,CAAC"}

package/dist/sites/bootstrap.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Phase 3 — boot-time active-site selection from `YTB_MCP_PROFILE`.
+ *
+ * The YT Builder analogue of api-mapper's `bootstrapActiveProfile`
+ * (`APIMAPPER_PROFILE` → ProfileStore.setActive). Here the "profile" is
+ * a registry `site_id` and the active pointer is the {@link ClientPool}'s
+ * in-memory override — the registry itself is immutable, nothing is
+ * written to disk.
+ *
+ * Why this exists: a customer who manages several client sites typically
+ * adds one MCP-client entry per site, each binding a different
+ * `YTB_MCP_PROFILE`. Without this bridge every entry would boot on the
+ * registry's lone `default_site_id` and the first tool call would target
+ * the wrong site until the user manually ran `yootheme_builder_use_site`.
+ *
+ * Behaviour (pinned by tests/sites/bootstrap-active-site.test.ts —
+ * deliberately identical to api-mapper's bootstrapActiveProfile):
+ *   - unset / whitespace-only  → no override (registry default applies)
+ *   - "default"                → no-op (the manifest default value is the
+ *                                implicit registry-default state)
+ *   - "<known site_id>"        → pool.setActiveSite(id)
+ *   - "<unknown site_id>"      → no-op, no throw (a fresh host that
+ *                                inherited the var from a different
+ *                                config must not crash or phantom-switch)
+ *
+ * Best-effort + synchronous: `setActiveSite` is a pure in-memory pointer
+ * move (no I/O), so unlike the api-mapper async store version this needs
+ * no try/catch around disk reads. An unknown id is pre-checked against
+ * the registry so the `UnknownSiteError` path is never reached.
+ *
+ * @license MIT
+ */
+import type { ClientPool } from './client-pool.js';
+/**
+ * Seed the pool's active-site override from `env[YTB_MCP_PROFILE]`.
+ *
+ * @param pool The process-wide {@link ClientPool}.
+ * @param env  Env source (defaults to `process.env`). Injectable for tests.
+ */
+export declare function bootstrapActiveSite(pool: ClientPool, env?: NodeJS.ProcessEnv): void;
+//# sourceMappingURL=bootstrap.d.ts.map

package/dist/sites/bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../src/sites/bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAC/B,IAAI,EAAE,UAAU,EAChB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACrC,IAAI,CAoBN"}

package/dist/sites/bootstrap.js

@@ -0,0 +1,58 @@
+/**
+ * Phase 3 — boot-time active-site selection from `YTB_MCP_PROFILE`.
+ *
+ * The YT Builder analogue of api-mapper's `bootstrapActiveProfile`
+ * (`APIMAPPER_PROFILE` → ProfileStore.setActive). Here the "profile" is
+ * a registry `site_id` and the active pointer is the {@link ClientPool}'s
+ * in-memory override — the registry itself is immutable, nothing is
+ * written to disk.
+ *
+ * Why this exists: a customer who manages several client sites typically
+ * adds one MCP-client entry per site, each binding a different
+ * `YTB_MCP_PROFILE`. Without this bridge every entry would boot on the
+ * registry's lone `default_site_id` and the first tool call would target
+ * the wrong site until the user manually ran `yootheme_builder_use_site`.
+ *
+ * Behaviour (pinned by tests/sites/bootstrap-active-site.test.ts —
+ * deliberately identical to api-mapper's bootstrapActiveProfile):
+ *   - unset / whitespace-only  → no override (registry default applies)
+ *   - "default"                → no-op (the manifest default value is the
+ *                                implicit registry-default state)
+ *   - "<known site_id>"        → pool.setActiveSite(id)
+ *   - "<unknown site_id>"      → no-op, no throw (a fresh host that
+ *                                inherited the var from a different
+ *                                config must not crash or phantom-switch)
+ *
+ * Best-effort + synchronous: `setActiveSite` is a pure in-memory pointer
+ * move (no I/O), so unlike the api-mapper async store version this needs
+ * no try/catch around disk reads. An unknown id is pre-checked against
+ * the registry so the `UnknownSiteError` path is never reached.
+ *
+ * @license MIT
+ */
+import { ENV_PROFILE } from '../auth.js';
+/**
+ * Seed the pool's active-site override from `env[YTB_MCP_PROFILE]`.
+ *
+ * @param pool The process-wide {@link ClientPool}.
+ * @param env  Env source (defaults to `process.env`). Injectable for tests.
+ */
+export function bootstrapActiveSite(pool, env = process.env) {
+    const desired = (env[ENV_PROFILE] ?? '').trim();
+    // Unset / whitespace / the manifest default → leave the registry
+    // default in effect (no override).
+    if (desired === '' || desired === 'default')
+        return;
+    // Only switch when the named site actually exists in the registry.
+    // An inherited / stale var pointing at a site that is not configured
+    // on THIS host must be a silent no-op — never a crash, never a
+    // phantom override.
+    if (pool.registry.get(desired) === null) {
+        process.stderr.write(`[yt-builder-mcp] notice: ${ENV_PROFILE}="${desired}" does not match any `
+            + 'configured site_id — keeping the registry default. '
+            + 'Use yootheme_builder_sites_list to see available IDs.\n');
+        return;
+    }
+    pool.setActiveSite(desired);
+}
+//# sourceMappingURL=bootstrap.js.map

package/dist/sites/bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/sites/bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGzC;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAC/B,IAAgB,EAChB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,iEAAiE;IACjE,mCAAmC;IACnC,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO;IAEpD,mEAAmE;IACnE,qEAAqE;IACrE,+DAA+D;IAC/D,oBAAoB;IACpB,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,4BAA4B,WAAW,KAAK,OAAO,uBAAuB;cACxE,qDAAqD;cACrD,yDAAyD,CAC9D,CAAC;QACF,OAAO;IACX,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC"}

package/dist/sites/cli/add-site.d.ts

@@ -0,0 +1,106 @@
+/**
+ * W9 — `add-site` CLI subcommand.
+ *
+ * Adds (or, with `--yes`, overwrites) a single site entry in the
+ * on-disk `sites.json` registry. Pure file-IO surface: loads, mutates
+ * in memory, and atomic-saves through {@link saveSitesFile}. NEVER
+ * touches the network — the optional connectivity probe lives in
+ * `test-site` so callers can compose the two.
+ *
+ * Design choices (per plan §W9):
+ *  - **Mutual-exclusion `--token` vs `--token-ref`.** Exactly one
+ *    credential field must be set; reuses the W1 SiteEntry refine() as
+ *    the on-disk guard but also pre-checks here for an immediate CLI
+ *    error rather than a Zod surprise at save time.
+ *  - **Auto-default on first site.** If `sites.json` is empty (or did
+ *    not exist), the first added entry gets `is_default: true` AND
+ *    `default_site_id` is updated, regardless of whether `--default`
+ *    was passed. The plan calls this out explicitly so users don't
+ *    end up with a registry that has sites but no default.
+ *  - **Idempotent + safe overwrite.** Re-adding the same `site_id`
+ *    fails with exit code 2 unless `--yes` is passed; with `--yes` the
+ *    existing entry is replaced AND its `is_default` flag is preserved
+ *    so an overwrite of the default site stays the default.
+ *  - **Defence-in-depth platform default.** When `--platform` is
+ *    omitted the entry stores `'auto'`, which the W3 registry resolves
+ *    at first use via the runtime probe.
+ *
+ * @license MIT
+ */
+import { type SitesFileT } from '../schema.js';
+/**
+ * Parsed shape consumed by {@link addSiteCommand}. The dispatcher
+ * (`setup-cli.ts:runCli`) translates argv flags into this object and
+ * the public test surface drives it directly so flag parsing is
+ * exercised separately from the file-IO and registry-mutation logic.
+ */
+export interface AddSiteArgs {
+    readonly url: string;
+    /** Inline plain bearer; mutually exclusive with `tokenRef`. */
+    readonly token?: string;
+    /** 1Password Secret Reference; mutually exclusive with `token`. */
+    readonly tokenRef?: string;
+    /** Optional explicit platform hint; defaults to `'auto'`. */
+    readonly platform?: 'auto' | 'wordpress' | 'joomla';
+    /** Optional human-readable label (≤120 chars). */
+    readonly label?: string;
+    /** When true, mark the new site as the default. Ignored if it's
+     *  the first site (auto-default applies). */
+    readonly default?: boolean;
+    /** Override the site_id slug; defaults to `'default'`. */
+    readonly siteId?: string;
+    /** Skip "this site_id exists" guard and overwrite instead. */
+    readonly yes?: boolean;
+}
+/**
+ * Outcome of a successful add. The CLI dispatcher uses this to render
+ * the "Site '<id>' added (default)." line + the restart hint. Returned
+ * as a value (not stdout-side) so tests can assert without parsing
+ * captured stdout.
+ */
+export interface AddSiteResult {
+    /** site_id that was written. */
+    readonly siteId: string;
+    /** Path of the sites.json that was written. */
+    readonly path: string;
+    /** True when this site was first AND auto-promoted to default. */
+    readonly becameDefault: boolean;
+    /** True when an existing entry with the same site_id was replaced. */
+    readonly overwritten: boolean;
+    /** True when --default flag was honoured (and not just auto-default). */
+    readonly defaultRequested: boolean;
+}
+/**
+ * Domain-tagged CLI failure. The dispatcher maps these to exit codes
+ * (typically 2 for "input invalid" + a friendly stderr line). Carries
+ * a `code` so tests / callers can branch without substring matching.
+ */
+export declare class AddSiteError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+/**
+ * Test/IO injection seam. Production callers use the default
+ * implementations imported above; tests inject in-memory store
+ * helpers and a frozen `now()`.
+ */
+export interface AddSiteDeps {
+    readonly load: (path: string) => Promise<SitesFileT>;
+    readonly save: (path: string, data: SitesFileT) => Promise<void>;
+    readonly now?: () => string;
+}
+/**
+ * Add (or overwrite-with-`--yes`) a single site entry. See file header
+ * for the auto-default / mutual-exclusion / idempotency contract.
+ *
+ * @throws {AddSiteError} on any input-validation failure or when the
+ *   site_id already exists and `--yes` was not passed.
+ */
+export declare function addSiteCommand(args: AddSiteArgs, path: string, deps: AddSiteDeps): Promise<AddSiteResult>;
+/**
+ * Default IO deps wired to the real store. Exported so the dispatcher
+ * + the W9 wizard-internal call-site can both share them without
+ * duplicating the import surface.
+ */
+export declare const DEFAULT_ADD_SITE_DEPS: AddSiteDeps;
+//# sourceMappingURL=add-site.d.ts.map

package/dist/sites/cli/add-site.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-site.d.ts","sourceRoot":"","sources":["../../../src/sites/cli/add-site.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAGH,OAAO,EAKH,KAAK,UAAU,EAClB,MAAM,cAAc,CAAC;AAEtB;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAC;IACpD,kDAAkD;IAClD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;iDAC6C;IAC7C,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC1B,gCAAgC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACtC;AAED;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,KAAK;aACP,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAI5D;AA0GD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IACxB,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACrD,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAChC,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,WAAW,GAClB,OAAO,CAAC,aAAa,CAAC,CAoExB;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,WAQnC,CAAC"}