@wootsup/yt-builder-mcp 1.11.0 → 2.0.0

package/dist/auth.js

@@ -1,136 +1,44 @@
-/**
- * Auth / configuration loading for the MCP server.
- *
- * The MCP server reads two environment variables on startup:
- *
- *   YTB_MCP_SITE_URL      — base URL of the host CMS install (WordPress
- *                           OR Joomla), e.g. `https://example.com`.
- *                           The per-platform REST namespace
- *                           (`/wp-json/yt-builder-mcp/v1` for WP,
- *                           `/api/index.php/v1/yt-builder-mcp` for
- *                           Joomla) is appended internally based on
- *                           runtime platform detection.
- *   YTB_MCP_WP_URL        — DEPRECATED alias for YTB_MCP_SITE_URL,
- *                           kept for back-compat with pre-Wave 7
- *                           configurations. A non-fatal deprecation
- *                           notice is written to stderr when the
- *                           legacy var is used in non-test mode.
- *   YTB_MCP_BEARER_TOKEN  — the Bearer key generated by the plugin
- *                           Settings page (`wp-admin → YT Builder MCP`
- *                           on WordPress, `Components → YT Builder MCP`
- *                           on Joomla).
- *
- * `loadConfig()` throws `ConfigError` if either is missing, so the
- * server fails fast with a useful message rather than emitting cryptic
- * 401/Network errors deep in the request stack.
- *
- * @license MIT
- */
 import { z } from 'zod';
-import { ConfigError } from './errors.js';
+import { ConfigError, RejectedConfigError } from './errors.js';
 import { synthesiseFromEnv } from './sites/env-bridge.js';
 import { SiteRegistry } from './sites/registry.js';
 import { SitesFile } from './sites/schema.js';
-import { loadSitesFile } from './sites/store.js';
-/**
- * Canonical env-var name for the host-CMS base URL (Wave 7+: covers
- * both WordPress and Joomla). Prefer this for all new configurations.
- */
+import { loadSitesFile, SitesFileError } from './sites/store.js';
 export const ENV_SITE_URL = 'YTB_MCP_SITE_URL';
-/**
- * Legacy env-var name kept for back-compat. Pre-Wave-7 configurations
- * (every release through v1.0.x) used `YTB_MCP_WP_URL`. New code should
- * use {@link ENV_SITE_URL}; this constant is retained so the wizard,
- * tests, and error hints can still reference the legacy name.
- */
 export const ENV_WP_URL = 'YTB_MCP_WP_URL';
 export const ENV_BEARER = 'YTB_MCP_BEARER_TOKEN';
 export const ENV_TIMEOUT = 'YTB_MCP_TIMEOUT_MS';
 export const ENV_TEST_MODE = 'YTB_MCP_TEST_MODE';
-/**
- * U3 — env-var name for a site-level HTTP **Basic-Auth** realm (`user:pass`),
- * distinct from the plugin Bearer. A site fronted by a pure HTTP Basic realm
- * (e.g. `qa.gloeckle.de`) needs `Authorization: Basic …`, which collides with
- * the Bearer on the one `Authorization` header — and `YTB_MCP_EXTRA_HEADERS`
- * forbids an `Authorization` key. This routes the Basic credentials on URL
- * userinfo (`https://user:pass@host`) instead, so the realm gets Basic while
- * the plugin still gets the Bearer. Canonical definition + parser live in
- * `net/site-basic-auth.ts`; re-exported here next to the other `ENV_*` names.
- */
 export { ENV_SITE_BASIC_AUTH } from './net/site-basic-auth.js';
-/**
- * Optional platform hint env var — `'wordpress'` or `'joomla'`. When
- * unset, the server auto-detects from the URL shape (cookbook §3.7.1):
- *   - URL contains `/wp-json/`        → wordpress
- *   - URL contains `/api/index.php/`  → joomla
- *   - origin-only URL                 → defaults to wordpress (back-compat)
- *
- * Set this to `'joomla'` when your YTB_MCP_SITE_URL is an origin-only
- * Joomla URL like `https://example.com/joomla`.
- */
 export const ENV_PLATFORM = 'YTB_MCP_PLATFORM';
-/**
- * W10 — canonical env-var name for the multi-site registry file. When
- * set, {@link loadRegistry} loads + validates the JSON at this path and
- * the legacy {@link ENV_SITE_URL} / {@link ENV_BEARER} pair is ignored.
- * When unset, the env-bridge falls back to building a one-site registry
- * from the legacy single-site pair.
- */
 export const ENV_SITES_FILE = 'YTB_MCP_SITES_FILE';
-/**
- * Optional boot-time active-site selector. Names a registry `site_id`
- * that becomes the active (default-target) site the moment the server
- * boots — the YT Builder analogue of api-mapper's `APIMAPPER_PROFILE`.
- *
- * Resolution (see {@link bootstrapActiveSite} in `sites/bootstrap.ts`):
- *   - unset / whitespace / `"default"` → no override; the registry's
- *     own default site applies.
- *   - `"<known site_id>"`              → that site becomes active.
- *   - `"<unknown site_id>"`            → silently ignored (no phantom
- *     switch on a fresh host that inherited the var from elsewhere).
- *
- * The runtime `yootheme_builder_use_site` tool switches it later within
- * a session; this env var only seeds the INITIAL active site so a
- * multi-client config (one MCP entry per client site, each with its own
- * `YTB_MCP_PROFILE`) lands on the right site without a first tool call.
- */
 export const ENV_PROFILE = 'YTB_MCP_PROFILE';
-const DEFAULT_TIMEOUT_MS = 15_000;
-/**
- * Maximum accepted length for a Bearer token (defense-in-depth bound;
- * the real plugin keys are ~150-300 bytes, the 512 ceiling protects
- * against accidental file-pastes / log dumps / memory abuse).
- */
+const UNRESOLVED_HOST_PLACEHOLDER = /^\$\{[^}]*\}$/;
+export function readHostEnv(env, key) {
+    const raw = env[key]?.trim();
+    if (raw === undefined || raw === '')
+        return undefined;
+    return UNRESOLVED_HOST_PLACEHOLDER.test(raw) ? undefined : raw;
+}
+export const DEFAULT_TIMEOUT_MS = 15_000;
+export function resolveTimeoutMs(env = process.env) {
+    const raw = (env[ENV_TIMEOUT] ?? '').trim();
+    if (raw === '') {
+        return DEFAULT_TIMEOUT_MS;
+    }
+    const parsed = Number.parseInt(raw, 10);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_TIMEOUT_MS;
+}
 const BEARER_MAX_LEN = 512;
-/**
- * Bearer-token format check — matches the plugin's `KeyService.php`
- * `PREFIX = ytb_live_` (and the planned `ytb_test_` future variant).
- * Token shape: `ytb_(live|test)_<payloadB64Url>.<sigB64Url>` where
- * base64url uses `[A-Za-z0-9_-]` (no dots inside the payload or sig).
- *
- * Round-1 audit I7 fix (2026-05-22): the earlier `.trim()` + empty-check
- * was not enough to catch the most common config mistakes — the leading
- * `Bearer ` prefix accidentally pasted into the env var, copy-paste
- * truncation (no `.` separator), or a totally wrong token style. We
- * fail-fast here so the client never sends a known-bad value upstream.
- */
 const BEARER_FORMAT_SCHEMA = z
     .string()
     .max(BEARER_MAX_LEN, `Bearer too long (max ${String(BEARER_MAX_LEN)} chars). The env var YTB_MCP_BEARER_TOKEN seems to contain something other than a plain key — strip leading "Bearer " or paste only the key copied from wp-admin → "YT Builder MCP" → Settings.`)
     .regex(/^ytb_(live|test)_[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/, 'Bearer must match ytb_(live|test)_<payloadB64Url>.<sigB64Url> format (copy the key as shown in wp-admin → "YT Builder MCP" → Settings; do NOT prepend "Bearer ").');
 export function loadConfig(options = {}) {
     const env = options.env ?? process.env;
-    // Wave 7: YTB_MCP_SITE_URL is canonical (covers both WP + Joomla);
-    // YTB_MCP_WP_URL is retained as a deprecated back-compat alias.
-    // Resolution order: SITE_URL wins; legacy WP_URL fallback emits a
-    // soft deprecation note in non-test mode.
-    const rawSiteUrl = (env[ENV_SITE_URL] ?? '').trim();
-    const rawLegacyUrl = (env[ENV_WP_URL] ?? '').trim();
+    const rawSiteUrl = readHostEnv(env, ENV_SITE_URL) ?? '';
+    const rawLegacyUrl = readHostEnv(env, ENV_WP_URL) ?? '';
     const rawUrl = rawSiteUrl !== '' ? rawSiteUrl : rawLegacyUrl;
-    // Soft deprecation notice — only when the loader is being used in
-    // its real-server role (env defaulted to process.env). Programmatic
-    // callers (tests, embedded uses) pass `options.env` explicitly and
-    // are silently treated as opt-in to the legacy var.
     if (rawSiteUrl === ''
         && rawLegacyUrl !== ''
         && options.env === undefined
@@ -138,8 +46,8 @@ export function loadConfig(options = {}) {
         process.stderr.write(`[yt-builder-mcp] notice: ${ENV_WP_URL} is deprecated — ` +
             `set ${ENV_SITE_URL} instead (same value; covers WordPress + Joomla).\n`);
     }
-    const rawToken = (env[ENV_BEARER] ?? '').trim();
-    const rawTimeout = (env[ENV_TIMEOUT] ?? '').trim();
+    const rawToken = readHostEnv(env, ENV_BEARER) ?? '';
+    const rawTimeout = readHostEnv(env, ENV_TIMEOUT) ?? '';
     if (rawUrl === '') {
         throw new ConfigError(`Missing ${ENV_SITE_URL}. Set it to your CMS base URL ` +
             '(e.g. https://example.com — WordPress or Joomla). ' +
@@ -149,10 +57,6 @@ export function loadConfig(options = {}) {
         throw new ConfigError(`Missing ${ENV_BEARER}. Generate a Bearer key in wp-admin → "YT Builder MCP" → ` +
             'Settings, then run `yt-builder-mcp setup`.');
     }
-    // I7-fix: enforce the Bearer-format contract before the client
-    // makes any request. Empty token is allowed only via
-    // `allowMissingToken` (the health-only smoke path); any other
-    // non-empty value MUST match the plugin's KeyService format.
     if (rawToken !== '') {
         const parsed = BEARER_FORMAT_SCHEMA.safeParse(rawToken);
         if (!parsed.success) {
@@ -162,13 +66,7 @@ export function loadConfig(options = {}) {
             throw new ConfigError(`Invalid ${ENV_BEARER}: ${issueMsg}`);
         }
     }
-    let timeoutMs = DEFAULT_TIMEOUT_MS;
-    if (rawTimeout !== '') {
-        const parsed = Number.parseInt(rawTimeout, 10);
-        if (Number.isFinite(parsed) && parsed > 0) {
-            timeoutMs = parsed;
-        }
-    }
+    const timeoutMs = resolveTimeoutMs(rawTimeout === '' ? {} : { [ENV_TIMEOUT]: rawTimeout });
     const rawPlatform = (env[ENV_PLATFORM] ?? '').trim().toLowerCase();
     const platformHint = rawPlatform === 'wordpress' || rawPlatform === 'joomla'
         ? rawPlatform
@@ -186,54 +84,23 @@ export function isTestMode(env = process.env) {
 function stripTrailingSlash(url) {
     return url.replace(/\/+$/, '');
 }
-/**
- * W10 — canonical boot-time registry loader.
- *
- * Resolution order:
- *   1. **Sites file** — if {@link ENV_SITES_FILE} is set to a non-empty
- *      string, parse + validate the JSON at that path and wrap it in a
- *      {@link SiteRegistry}. Schema failures bubble up as
- *      `SitesFileError` (the store does not swallow them); the caller
- *      decides whether to fail-fast or fall back. Wave 10 chooses
- *      fail-fast — explicit file = explicit intent.
- *
- *   2. **Legacy env-bridge** — synthesise a one-site registry from the
- *      pre-W10 single-site env-vars ({@link ENV_SITE_URL} +
- *      {@link ENV_BEARER}, with {@link ENV_PLATFORM} as optional hint).
- *      Preserves the single-site UX for every customer who has not
- *      migrated to a sites.json yet.
- *
- *   3. **Hard fail** — neither configured. Surface a {@link ConfigError}
- *      with the three setup options so the operator knows exactly which
- *      knob to turn.
- *
- * This function replaces {@link loadConfig} on the main boot path.
- * `loadConfig` is intentionally retained for the test-mode fallback in
- * `index.ts` (`--test-mode` smoke probes) and for any embedded consumer
- * that still wants a flat `ServerConfig`.
- */
 export async function loadRegistry(opts = {}) {
     const env = opts.env ?? process.env;
-    // (1) sites file (preferred).
     const sitesFilePath = (env[ENV_SITES_FILE] ?? '').trim();
+    let sitesFileFailure;
     if (sitesFilePath !== '') {
-        // loadSitesFile handles both "file present" and "file absent"
-        // (the latter returns an emptySitesFile). When the file is
-        // empty (no sites), fall through to env-bridge instead of
-        // booting with an empty registry — operators who set
-        // SITES_FILE to a not-yet-populated path should still get the
-        // legacy env-var ramp until they run `add-site`.
-        const file = await loadSitesFile(sitesFilePath);
-        if (file.sites.length > 0) {
-            return new SiteRegistry(file);
+        try {
+            const file = await loadSitesFile(sitesFilePath);
+            if (file.sites.length > 0) {
+                return new SiteRegistry(file);
+            }
+        }
+        catch (e) {
+            if (!(e instanceof SitesFileError))
+                throw e;
+            sitesFileFailure = e;
         }
     }
-    // (2) legacy env-bridge. The bridge already enforces URL/bearer
-    // non-emptiness and platform-hint validity, but we re-validate the
-    // full file shape through the W1 Zod schema before handing it to
-    // the registry. Defense-in-depth: a future env-bridge change cannot
-    // introduce a SitesFileT-shape regression that lands on the
-    // registry path without first failing this gate.
     const synth = synthesiseFromEnv(env);
     if (synth !== null) {
         const parsed = SitesFile.safeParse(synth);
@@ -241,11 +108,14 @@ export async function loadRegistry(opts = {}) {
             const issues = parsed.error.issues
                 .map((i) => `${i.path.join('.')}: ${i.message}`)
                 .join('; ');
-            throw new ConfigError(`Env-bridge synthesised an invalid sites file: ${issues}`);
+            throw new RejectedConfigError(`Env-bridge synthesised an invalid sites file: ${issues}`);
         }
-        return new SiteRegistry(parsed.data);
+        return new SiteRegistry(parsed.data, sitesFileFailure !== undefined
+            ? { configProblem: sitesFileFailure.message, sitesAreSubstituted: true }
+            : {});
     }
-    // (3) fail-fast.
+    if (sitesFileFailure !== undefined)
+        throw sitesFileFailure;
     throw new ConfigError('No sites configured. Either: '
         + '(a) set YTB_MCP_SITES_FILE to your sites.json path, or '
         + '(b) set YTB_MCP_SITE_URL + YTB_MCP_BEARER_TOKEN for '

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAuBjD;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAC/C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAC3C,MAAM,CAAC,MAAM,UAAU,GAAG,sBAAsB,CAAC;AACjD,MAAM,CAAC,MAAM,WAAW,GAAG,oBAAoB,CAAC;AAChD,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC;AACjD;;;;;;;;;GASG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAC/C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,oBAAoB,CAAC;AACnD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAE7C,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC;;;;GAIG;AACH,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B;;;;;;;;;;;GAWG;AACH,MAAM,oBAAoB,GAAG,CAAC;KACzB,MAAM,EAAE;KACR,GAAG,CACA,cAAc,EACd,wBAAwB,MAAM,CAAC,cAAc,CAAC,iMAAiM,CAClP;KACA,KAAK,CACF,kDAAkD,EAClD,mKAAmK,CACtK,CAAC;AAEN,MAAM,UAAU,UAAU,CAAC,UAA6B,EAAE;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,mEAAmE;IACnE,gEAAgE;IAChE,kEAAkE;IAClE,0CAA0C;IAC1C,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC;IAC7D,kEAAkE;IAClE,oEAAoE;IACpE,mEAAmE;IACnE,oDAAoD;IACpD,IACI,UAAU,KAAK,EAAE;WACd,YAAY,KAAK,EAAE;WACnB,OAAO,CAAC,GAAG,KAAK,SAAS;WACzB,CAAC,UAAU,CAAC,GAAG,CAAC,EACrB,CAAC;QACC,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,4BAA4B,UAAU,mBAAmB;YACrD,OAAO,YAAY,qDAAqD,CAC/E,CAAC;IACN,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAEnD,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,WAAW,CACjB,WAAW,YAAY,gCAAgC;YACnD,oDAAoD;YACpD,0CAA0C,CACjD,CAAC;IACN,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAChD,MAAM,IAAI,WAAW,CACjB,WAAW,UAAU,2DAA2D;YAC5E,4CAA4C,CACnD,CAAC;IACN,CAAC;IAED,+DAA+D;IAC/D,qDAAqD;IACrD,8DAA8D;IAC9D,6DAA6D;IAC7D,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;iBAC/B,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC;iBACzB,IAAI,CAAC,GAAG,CAAC,CAAC;YACf,MAAM,IAAI,WAAW,CACjB,WAAW,UAAU,KAAK,QAAQ,EAAE,CACvC,CAAC;QACN,CAAC;IACL,CAAC;IAED,IAAI,SAAS,GAAG,kBAAkB,CAAC;IACnC,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,SAAS,GAAG,MAAM,CAAC;QACvB,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnE,MAAM,YAAY,GACd,WAAW,KAAK,WAAW,IAAI,WAAW,KAAK,QAAQ;QACnD,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,SAAS,CAAC;IAEpB,OAAO;QACH,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC;QACnC,WAAW,EAAE,QAAQ;QACrB,SAAS;QACT,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;AACN,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC3D,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,KAAK,GAAG,CAAC;AAC9C,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACnC,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAUD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAC9B,OAA4B,EAAE;IAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAEpC,8BAA8B;IAC9B,MAAM,aAAa,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzD,IAAI,aAAa,KAAK,EAAE,EAAE,CAAC;QACvB,8DAA8D;QAC9D,2DAA2D;QAC3D,0DAA0D;QAC1D,qDAAqD;QACrD,8DAA8D;QAC9D,iDAAiD;QACjD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;IACL,CAAC;IAED,gEAAgE;IAChE,mEAAmE;IACnE,iEAAiE;IACjE,oEAAoE;IACpE,4DAA4D;IAC5D,iDAAiD;IACjD,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;iBAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;iBAC/C,IAAI,CAAC,IAAI,CAAC,CAAC;YAChB,MAAM,IAAI,WAAW,CACjB,iDAAiD,MAAM,EAAE,CAC5D,CAAC;QACN,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,iBAAiB;IACjB,MAAM,IAAI,WAAW,CACjB,+BAA+B;UAC7B,yDAAyD;UACzD,sDAAsD;UACtD,uBAAuB;UACvB,+DAA+D,CACpE,CAAC;AACN,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AA2BjE,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAO/C,MAAM,CAAC,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAC3C,MAAM,CAAC,MAAM,UAAU,GAAG,sBAAsB,CAAC;AACjD,MAAM,CAAC,MAAM,WAAW,GAAG,oBAAoB,CAAC;AAChD,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAWjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAW/D,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAQ/C,MAAM,CAAC,MAAM,cAAc,GAAG,oBAAoB,CAAC;AAkBnD,MAAM,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAkB7C,MAAM,2BAA2B,GAAG,eAAe,CAAC;AAEpD,MAAM,UAAU,WAAW,CACvB,GAAsB,EACtB,GAAW;IAEX,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;IAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACtD,OAAO,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAmBzC,MAAM,UAAU,gBAAgB,CAC5B,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACb,OAAO,kBAAkB,CAAC;IAC9B,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAExC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC;AAC/E,CAAC;AAOD,MAAM,cAAc,GAAG,GAAG,CAAC;AAc3B,MAAM,oBAAoB,GAAG,CAAC;KACzB,MAAM,EAAE;KACR,GAAG,CACA,cAAc,EACd,wBAAwB,MAAM,CAAC,cAAc,CAAC,iMAAiM,CAClP;KACA,KAAK,CACF,kDAAkD,EAClD,mKAAmK,CACtK,CAAC;AAEN,MAAM,UAAU,UAAU,CAAC,UAA6B,EAAE;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAKvC,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC;IACxD,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;IACxD,MAAM,MAAM,GAAG,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC;IAK7D,IACI,UAAU,KAAK,EAAE;WACd,YAAY,KAAK,EAAE;WACnB,OAAO,CAAC,GAAG,KAAK,SAAS;WACzB,CAAC,UAAU,CAAC,GAAG,CAAC,EACrB,CAAC;QACC,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,4BAA4B,UAAU,mBAAmB;YACrD,OAAO,YAAY,qDAAqD,CAC/E,CAAC;IACN,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;IACpD,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC;IAEvD,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,WAAW,CACjB,WAAW,YAAY,gCAAgC;YACnD,oDAAoD;YACpD,0CAA0C,CACjD,CAAC;IACN,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAChD,MAAM,IAAI,WAAW,CACjB,WAAW,UAAU,2DAA2D;YAC5E,4CAA4C,CACnD,CAAC;IACN,CAAC;IAMD,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;iBAC/B,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC;iBACzB,IAAI,CAAC,GAAG,CAAC,CAAC;YACf,MAAM,IAAI,WAAW,CACjB,WAAW,UAAU,KAAK,QAAQ,EAAE,CACvC,CAAC;QACN,CAAC;IACL,CAAC;IAID,MAAM,SAAS,GAAG,gBAAgB,CAC9B,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,CACzD,CAAC;IAEF,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnE,MAAM,YAAY,GACd,WAAW,KAAK,WAAW,IAAI,WAAW,KAAK,QAAQ;QACnD,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,SAAS,CAAC;IAEpB,OAAO;QACH,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC;QACnC,WAAW,EAAE,QAAQ;QACrB,SAAS;QACT,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;AACN,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC3D,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,KAAK,GAAG,CAAC;AAC9C,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACnC,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAoCD,MAAM,CAAC,KAAK,UAAU,YAAY,CAC9B,OAA4B,EAAE;IAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAGpC,MAAM,aAAa,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAWzD,IAAI,gBAA4C,CAAC;IACjD,IAAI,aAAa,KAAK,EAAE,EAAE,CAAC;QAOvB,IAAI,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,CAAC;YAChD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;YAClC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YA2BT,IAAI,CAAC,CAAC,CAAC,YAAY,cAAc,CAAC;gBAAE,MAAM,CAAC,CAAC;YAC5C,gBAAgB,GAAG,CAAC,CAAC;QACzB,CAAC;IACL,CAAC;IAQD,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;iBAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;iBAC/C,IAAI,CAAC,IAAI,CAAC,CAAC;YAMhB,MAAM,IAAI,mBAAmB,CACzB,iDAAiD,MAAM,EAAE,CAC5D,CAAC;QACN,CAAC;QACD,OAAO,IAAI,YAAY,CACnB,MAAM,CAAC,IAAI,EACX,gBAAgB,KAAK,SAAS;YAM1B,CAAC,CAAC,EAAE,aAAa,EAAE,gBAAgB,CAAC,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE;YACxE,CAAC,CAAC,EAAE,CACX,CAAC;IACN,CAAC;IAMD,IAAI,gBAAgB,KAAK,SAAS;QAAE,MAAM,gBAAgB,CAAC;IAG3D,MAAM,IAAI,WAAW,CACjB,+BAA+B;UAC7B,yDAAyD;UACzD,sDAAsD;UACtD,uBAAuB;UACvB,+DAA+D,CACpE,CAAC;AACN,CAAC"}

package/dist/catalog/build-catalog.d.ts

@@ -1,56 +1,9 @@
-/**
- * packages/mcp/src/catalog/build-catalog.ts — net-new (Slice 0b Task 12).
- *
- * Builds the machine-readable tool catalogue (SSOT for the PHP-served MCP
- * surface). Modelled on API Mapper's
- * `packages/apimapper-mcp/src/catalog/build-catalog.ts`, adapted to yt-builder's
- * `buildAllTools(pool)` entrypoint:
- *
- *  - yt-builder's tools carry `inputSchema` as a RAW Zod shape (ZodRawShape,
- *    no `_zod` marker), so `toJsonSchema` always takes the raw-shape branch
- *    (`z.object(inputSchema)`).
- *  - `tier` is derived per-name from the gateway essentials lists
- *    (`isEssential || isDirectTopLevel` ⇒ essential, else advanced). There is
- *    NO separate advanced registry to query.
- *  - The 32 catalogued tools are exactly what `buildAllTools` returns; the two
- *    top-level gateways are registered at server level (server.ts), not here.
- *
- * @license MIT
- */
-/**
- * Convert a tool inputSchema to JSON Schema. yt-builder tools yield a RAW Zod
- * shape (ZodRawShape) — the `_zod` guard keeps this a faithful port of the
- * API Mapper utility, but for this server the raw-shape branch
- * (`z.object(inputSchema)`) is the one that always fires. Native
- * `z.toJSONSchema` (zod 4).
- */
-export declare function toJsonSchema(inputSchema: unknown): object;
-/**
- * Post-process a generated JSON Schema for MCP-client compatibility + semantic
- * correctness, recursively at EVERY schema node. Two structural fixes:
- *
- *  A1 (#4): drop from a node's `required` array any property that carries a
- *  `default`. Zod `.default()` lands the key in `required` (a zod4 toJSONSchema
- *  quirk), but a field WITH a default is semantically OPTIONAL — advertising it
- *  as required makes a strict client (and the PHP gateway validator) reject a
- *  call that legitimately omits it.
- *
- *  A2 (#1): replace an EMPTY-object `additionalProperties: {}` (what
- *  z.record(z.string(), z.unknown()) emits) with `true`. The Anthropic client
- *  rejects an empty `{}` schema for additionalProperties; `true` is the
- *  faithful "any value" equivalent. A boolean `false`
- *  (z.object().strict()) is left untouched.
- *
- * Recurses through every schema-bearing position zod4 emits: `properties`
- * values, `items` (object or tuple array), an object-valued
- * `additionalProperties`, and the `oneOf`/`anyOf`/`allOf`/`prefixItems` branch
- * arrays.
- */
-export declare function normalizeJsonSchema(node: unknown): void;
+import { ClientPool } from '../sites/client-pool.js';
 export interface CatalogTool {
     name: string;
     description: string;
     jsonSchema: object;
+    outputJsonSchema?: object;
     annotations: Record<string, unknown>;
     tier: 'essential' | 'advanced';
 }
@@ -59,5 +12,7 @@ export interface Catalog {
     generatedFrom: 'zod';
     tools: CatalogTool[];
 }
+export declare function stubPool(): ClientPool;
+export declare function withErrorBranch(schema: object): object;
 export declare function buildCatalog(): Promise<Catalog>;
 //# sourceMappingURL=build-catalog.d.ts.map

package/dist/catalog/build-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-catalog.d.ts","sourceRoot":"","sources":["../../src/catalog/build-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AASH;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,OAAO,GAAG,MAAM,CAezD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CA+CvD;AAED,MAAM,WAAW,WAAW;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,IAAI,EAAE,WAAW,GAAG,UAAU,CAAC;CAClC;AACD,MAAM,WAAW,OAAO;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,KAAK,CAAC;IACrB,KAAK,EAAE,WAAW,EAAE,CAAC;CACxB;AA6BD,wBAAsB,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAiBrD"}
+{"version":3,"file":"build-catalog.d.ts","sourceRoot":"","sources":["../../src/catalog/build-catalog.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAGrD,MAAM,WAAW,WAAW;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IAiCnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,IAAI,EAAE,WAAW,GAAG,UAAU,CAAC;CAClC;AACD,MAAM,WAAW,OAAO;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,KAAK,CAAC;IACrB,KAAK,EAAE,WAAW,EAAE,CAAC;CACxB;AAcD,wBAAgB,QAAQ,IAAI,UAAU,CAiBrC;AAiCD,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAatD;AAED,wBAAsB,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CA2BrD"}

package/dist/catalog/build-catalog.js

@@ -1,133 +1,11 @@
-/**
- * packages/mcp/src/catalog/build-catalog.ts — net-new (Slice 0b Task 12).
- *
- * Builds the machine-readable tool catalogue (SSOT for the PHP-served MCP
- * surface). Modelled on API Mapper's
- * `packages/apimapper-mcp/src/catalog/build-catalog.ts`, adapted to yt-builder's
- * `buildAllTools(pool)` entrypoint:
- *
- *  - yt-builder's tools carry `inputSchema` as a RAW Zod shape (ZodRawShape,
- *    no `_zod` marker), so `toJsonSchema` always takes the raw-shape branch
- *    (`z.object(inputSchema)`).
- *  - `tier` is derived per-name from the gateway essentials lists
- *    (`isEssential || isDirectTopLevel` ⇒ essential, else advanced). There is
- *    NO separate advanced registry to query.
- *  - The 32 catalogued tools are exactly what `buildAllTools` returns; the two
- *    top-level gateways are registered at server level (server.ts), not here.
- *
- * @license MIT
- */
-import { z } from 'zod';
 import { buildAllTools } from '../tools/index.js';
+import { shippedOutputSchema } from '../server.js';
+import { toJsonSchema } from './json-schema.js';
 import { isEssential, isDirectTopLevel } from '../gateway/essentials.js';
 import { SiteRegistry } from '../sites/registry.js';
 import { ClientPool } from '../sites/client-pool.js';
 import { PlainSecretResolver } from '../sites/secret-resolver.js';
-/**
- * Convert a tool inputSchema to JSON Schema. yt-builder tools yield a RAW Zod
- * shape (ZodRawShape) — the `_zod` guard keeps this a faithful port of the
- * API Mapper utility, but for this server the raw-shape branch
- * (`z.object(inputSchema)`) is the one that always fires. Native
- * `z.toJSONSchema` (zod 4).
- */
-export function toJsonSchema(inputSchema) {
-    try {
-        if (inputSchema && typeof inputSchema === 'object') {
-            const isZodObject = '_zod' in inputSchema;
-            const schema = isZodObject
-                ? inputSchema
-                : z.object(inputSchema);
-            const json = z.toJSONSchema(schema);
-            normalizeJsonSchema(json);
-            return json;
-        }
-    }
-    catch {
-        /* malformed/unsupported shape → safe fallback */
-    }
-    return { type: 'object' };
-}
-/**
- * Post-process a generated JSON Schema for MCP-client compatibility + semantic
- * correctness, recursively at EVERY schema node. Two structural fixes:
- *
- *  A1 (#4): drop from a node's `required` array any property that carries a
- *  `default`. Zod `.default()` lands the key in `required` (a zod4 toJSONSchema
- *  quirk), but a field WITH a default is semantically OPTIONAL — advertising it
- *  as required makes a strict client (and the PHP gateway validator) reject a
- *  call that legitimately omits it.
- *
- *  A2 (#1): replace an EMPTY-object `additionalProperties: {}` (what
- *  z.record(z.string(), z.unknown()) emits) with `true`. The Anthropic client
- *  rejects an empty `{}` schema for additionalProperties; `true` is the
- *  faithful "any value" equivalent. A boolean `false`
- *  (z.object().strict()) is left untouched.
- *
- * Recurses through every schema-bearing position zod4 emits: `properties`
- * values, `items` (object or tuple array), an object-valued
- * `additionalProperties`, and the `oneOf`/`anyOf`/`allOf`/`prefixItems` branch
- * arrays.
- */
-export function normalizeJsonSchema(node) {
-    if (Array.isArray(node)) {
-        for (const child of node)
-            normalizeJsonSchema(child);
-        return;
-    }
-    if (!node || typeof node !== 'object')
-        return;
-    const obj = node;
-    // A2: empty-object additionalProperties → true (recurse into a non-empty one).
-    if ('additionalProperties' in obj) {
-        const ap = obj.additionalProperties;
-        if (ap &&
-            typeof ap === 'object' &&
-            !Array.isArray(ap) &&
-            Object.keys(ap).length === 0) {
-            obj.additionalProperties = true;
-        }
-        else {
-            normalizeJsonSchema(ap);
-        }
-    }
-    // A1: drop default-bearing keys from THIS node's `required`.
-    const props = obj.properties;
-    if (Array.isArray(obj.required) && props && typeof props === 'object') {
-        const propMap = props;
-        const kept = obj.required.filter((key) => {
-            if (typeof key !== 'string')
-                return true;
-            const p = propMap[key];
-            return !(p && typeof p === 'object' && 'default' in p);
-        });
-        // An emptied required array is dropped (zod itself omits an empty `required`).
-        if (kept.length === 0)
-            delete obj.required;
-        else
-            obj.required = kept;
-    }
-    // Recurse into the standard schema-bearing positions.
-    if (props && typeof props === 'object') {
-        for (const v of Object.values(props)) {
-            normalizeJsonSchema(v);
-        }
-    }
-    if ('items' in obj)
-        normalizeJsonSchema(obj.items);
-    for (const kw of ['oneOf', 'anyOf', 'allOf', 'prefixItems']) {
-        if (kw in obj)
-            normalizeJsonSchema(obj[kw]);
-    }
-}
-/**
- * One-site, in-memory, zero-IO {@link ClientPool}. Mirrors the stub
- * `scripts/extract-tools.mjs` wires (a single `wordpress` site with an inline
- * stub bearer), but importing the classes from `src/sites/*` rather than the
- * compiled `dist/index.js` barrel. `buildAllTools` only reads `pool.registry`
- * for tool registration and never resolves a bearer or hits the network at
- * catalogue-build time.
- */
-function stubPool() {
+export function stubPool() {
     const stubFile = {
         schema_version: 1,
         default_site_id: 'build-catalog-stub',
@@ -145,12 +23,23 @@ function stubPool() {
     const resolver = new PlainSecretResolver();
     return new ClientPool(registry, resolver);
 }
+export function withErrorBranch(schema) {
+    const { $schema, type, ...rest } = schema;
+    return {
+        ...($schema !== undefined ? { $schema } : {}),
+        ...(type !== undefined ? { type } : {}),
+        anyOf: [rest, { required: ['error'] }],
+    };
+}
 export async function buildCatalog() {
-    const tools = buildAllTools(stubPool()); // flat AnyToolDefinition[] — 32 entries
+    const tools = buildAllTools(stubPool());
     const catalogTools = tools.map((t) => ({
         name: t.name,
         description: t.description ?? '',
         jsonSchema: toJsonSchema(t.inputSchema),
+        ...(t.outputSchema !== undefined
+            ? { outputJsonSchema: withErrorBranch(toJsonSchema(shippedOutputSchema(t))) }
+            : {}),
         annotations: t.annotations ?? {},
         tier: isEssential(t.name) || isDirectTopLevel(t.name) ? 'essential' : 'advanced',
     }));

package/dist/catalog/build-catalog.js.map

@@ -1 +1 @@
-{"version":3,"file":"build-catalog.js","sourceRoot":"","sources":["../../src/catalog/build-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,WAAoB;IAC7C,IAAI,CAAC;QACD,IAAI,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACjD,MAAM,WAAW,GAAG,MAAM,IAAK,WAAuC,CAAC;YACvE,MAAM,MAAM,GAAG,WAAW;gBACtB,CAAC,CAAE,WAA4B;gBAC/B,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAA4B,CAAC,CAAC;YAC7C,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,CAAW,CAAC;YAC9C,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,iDAAiD;IACrD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAa;IAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,KAAK,MAAM,KAAK,IAAI,IAAI;YAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACrD,OAAO;IACX,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO;IAC9C,MAAM,GAAG,GAAG,IAA+B,CAAC;IAE5C,+EAA+E;IAC/E,IAAI,sBAAsB,IAAI,GAAG,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,GAAG,CAAC,oBAAoB,CAAC;QACpC,IACI,EAAE;YACF,OAAO,EAAE,KAAK,QAAQ;YACtB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC,EAAY,CAAC,CAAC,MAAM,KAAK,CAAC,EACxC,CAAC;YACC,GAAG,CAAC,oBAAoB,GAAG,IAAI,CAAC;QACpC,CAAC;aAAM,CAAC;YACJ,mBAAmB,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC;IACL,CAAC;IAED,6DAA6D;IAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC;IAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACpE,MAAM,OAAO,GAAG,KAAgC,CAAC;QACjD,MAAM,IAAI,GAAI,GAAG,CAAC,QAAsB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YACpD,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACzC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,SAAS,IAAK,CAAY,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;QACH,+EAA+E;QAC/E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC,QAAQ,CAAC;;YACtC,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED,sDAAsD;IACtD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC,EAAE,CAAC;YAC9D,mBAAmB,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;IACL,CAAC;IACD,IAAI,OAAO,IAAI,GAAG;QAAE,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACnD,KAAK,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,CAAU,EAAE,CAAC;QACnE,IAAI,EAAE,IAAI,GAAG;YAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,CAAC;AACL,CAAC;AAeD;;;;;;;GAOG;AACH,SAAS,QAAQ;IACb,MAAM,QAAQ,GAAG;QACb,cAAc,EAAE,CAAU;QAC1B,eAAe,EAAE,oBAAoB;QACrC,KAAK,EAAE;YACH;gBACI,OAAO,EAAE,oBAAoB;gBAC7B,GAAG,EAAE,qBAAqB;gBAC1B,QAAQ,EAAE,WAAoB;gBAC9B,MAAM,EAAE,oBAAoB;gBAC5B,UAAU,EAAE,IAAI;aACnB;SACJ;KACJ,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,mBAAmB,EAAE,CAAC;IAC3C,OAAO,IAAI,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAC9B,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,wCAAwC;IACjF,MAAM,YAAY,GAAkB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE;QAChC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;QACvC,WAAW,EAAG,CAAC,CAAC,WAAuC,IAAI,EAAE;QAC7D,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU;KACnF,CAAC,CAAC,CAAC;IACJ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO;QACH,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO;QACnD,aAAa,EAAE,KAAK;QACpB,KAAK,EAAE,YAAY;KACtB,CAAC;AACN,CAAC"}
+{"version":3,"file":"build-catalog.js","sourceRoot":"","sources":["../../src/catalog/build-catalog.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AA4DlE,MAAM,UAAU,QAAQ;IACpB,MAAM,QAAQ,GAAG;QACb,cAAc,EAAE,CAAU;QAC1B,eAAe,EAAE,oBAAoB;QACrC,KAAK,EAAE;YACH;gBACI,OAAO,EAAE,oBAAoB;gBAC7B,GAAG,EAAE,qBAAqB;gBAC1B,QAAQ,EAAE,WAAoB;gBAC9B,MAAM,EAAE,oBAAoB;gBAC5B,UAAU,EAAE,IAAI;aACnB;SACJ;KACJ,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,mBAAmB,EAAE,CAAC;IAC3C,OAAO,IAAI,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAiCD,MAAM,UAAU,eAAe,CAAC,MAAc;IAC1C,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,MAA+C,CAAC;IAOnF,OAAO;QACH,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;KACzC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAC9B,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxC,MAAM,YAAY,GAAkB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE;QAChC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;QAQvC,GAAG,CAAC,CAAC,CAAC,YAAY,KAAK,SAAS;YAC5B,CAAC,CAAC,EAAE,gBAAgB,EAAE,eAAe,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YAC7E,CAAC,CAAC,EAAE,CAAC;QACT,WAAW,EAAG,CAAC,CAAC,WAAuC,IAAI,EAAE;QAC7D,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU;KACnF,CAAC,CAAC,CAAC;IACJ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO;QACH,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO;QACnD,aAAa,EAAE,KAAK;QACpB,KAAK,EAAE,YAAY;KACtB,CAAC;AACN,CAAC"}

package/dist/catalog/json-schema.d.ts

@@ -0,0 +1,3 @@
+export declare function toJsonSchema(inputSchema: unknown): object;
+export declare function normalizeJsonSchema(node: unknown): void;
+//# sourceMappingURL=json-schema.d.ts.map

package/dist/catalog/json-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-schema.d.ts","sourceRoot":"","sources":["../../src/catalog/json-schema.ts"],"names":[],"mappings":"AA0BA,wBAAgB,YAAY,CAAC,WAAW,EAAE,OAAO,GAAG,MAAM,CA8BzD;AAuBD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CA+CvD"}

package/dist/catalog/json-schema.js

@@ -0,0 +1,68 @@
+import { z } from 'zod';
+export function toJsonSchema(inputSchema) {
+    try {
+        if (inputSchema && typeof inputSchema === 'object') {
+            const isZodObject = '_zod' in inputSchema;
+            const schema = isZodObject
+                ? inputSchema
+                : z.object(inputSchema);
+            const json = z.toJSONSchema(schema);
+            normalizeJsonSchema(json);
+            if (json.additionalProperties !== true) {
+                json.additionalProperties = false;
+            }
+            return json;
+        }
+    }
+    catch {
+    }
+    return { type: 'object' };
+}
+export function normalizeJsonSchema(node) {
+    if (Array.isArray(node)) {
+        for (const child of node)
+            normalizeJsonSchema(child);
+        return;
+    }
+    if (!node || typeof node !== 'object')
+        return;
+    const obj = node;
+    if ('additionalProperties' in obj) {
+        const ap = obj.additionalProperties;
+        if (ap &&
+            typeof ap === 'object' &&
+            !Array.isArray(ap) &&
+            Object.keys(ap).length === 0) {
+            obj.additionalProperties = true;
+        }
+        else {
+            normalizeJsonSchema(ap);
+        }
+    }
+    const props = obj.properties;
+    if (Array.isArray(obj.required) && props && typeof props === 'object') {
+        const propMap = props;
+        const kept = obj.required.filter((key) => {
+            if (typeof key !== 'string')
+                return true;
+            const p = propMap[key];
+            return !(p && typeof p === 'object' && 'default' in p);
+        });
+        if (kept.length === 0)
+            delete obj.required;
+        else
+            obj.required = kept;
+    }
+    if (props && typeof props === 'object') {
+        for (const v of Object.values(props)) {
+            normalizeJsonSchema(v);
+        }
+    }
+    if ('items' in obj)
+        normalizeJsonSchema(obj.items);
+    for (const kw of ['oneOf', 'anyOf', 'allOf', 'prefixItems']) {
+        if (kw in obj)
+            normalizeJsonSchema(obj[kw]);
+    }
+}
+//# sourceMappingURL=json-schema.js.map

package/dist/catalog/json-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-schema.js","sourceRoot":"","sources":["../../src/catalog/json-schema.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AASxB,MAAM,UAAU,YAAY,CAAC,WAAoB;IAC7C,IAAI,CAAC;QACD,IAAI,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACjD,MAAM,WAAW,GAAG,MAAM,IAAK,WAAuC,CAAC;YACvE,MAAM,MAAM,GAAG,WAAW;gBACtB,CAAC,CAAE,WAA4B;gBAC/B,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAA4B,CAAC,CAAC;YAC7C,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,CAA4B,CAAC;YAC/D,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAa1B,IAAI,IAAI,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;gBACrC,IAAI,CAAC,oBAAoB,GAAG,KAAK,CAAC;YACtC,CAAC;YACD,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;IAET,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAuBD,MAAM,UAAU,mBAAmB,CAAC,IAAa;IAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,KAAK,MAAM,KAAK,IAAI,IAAI;YAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACrD,OAAO;IACX,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO;IAC9C,MAAM,GAAG,GAAG,IAA+B,CAAC;IAG5C,IAAI,sBAAsB,IAAI,GAAG,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,GAAG,CAAC,oBAAoB,CAAC;QACpC,IACI,EAAE;YACF,OAAO,EAAE,KAAK,QAAQ;YACtB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC,EAAY,CAAC,CAAC,MAAM,KAAK,CAAC,EACxC,CAAC;YACC,GAAG,CAAC,oBAAoB,GAAG,IAAI,CAAC;QACpC,CAAC;aAAM,CAAC;YACJ,mBAAmB,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC;IACL,CAAC;IAGD,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC;IAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACpE,MAAM,OAAO,GAAG,KAAgC,CAAC;QACjD,MAAM,IAAI,GAAI,GAAG,CAAC,QAAsB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YACpD,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACzC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,SAAS,IAAK,CAAY,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC,QAAQ,CAAC;;YACtC,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC;IAC7B,CAAC;IAGD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC,EAAE,CAAC;YAC9D,mBAAmB,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;IACL,CAAC;IACD,IAAI,OAAO,IAAI,GAAG;QAAE,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACnD,KAAK,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,CAAU,EAAE,CAAC;QACnE,IAAI,EAAE,IAAI,GAAG;YAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,CAAC;AACL,CAAC"}

package/dist/catalog/output-shapes.d.ts

@@ -0,0 +1,6 @@
+export interface OutputShapes {
+    readonly generatedFrom: 'zod';
+    readonly tools: Record<string, readonly string[]>;
+}
+export declare function buildOutputShapes(): OutputShapes;
+//# sourceMappingURL=output-shapes.d.ts.map