@wootsup/yt-builder-mcp 1.11.0 → 2.0.0

package/dist/clients/zed.d.ts

@@ -1,12 +1,3 @@
-/**
- * Zed MCP config writer.
- *
- *   Global: ~/.config/zed/settings.json  (JSONC; we treat as JSON for write)
- *
- * Schema: `context_servers` map (Zed-specific naming).
- *
- * @license MIT
- */
 import { type ClientWriter } from './index.js';
 export declare const zedClient: ClientWriter;
 //# sourceMappingURL=zed.d.ts.map

package/dist/clients/zed.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zed.d.ts","sourceRoot":"","sources":["../../src/clients/zed.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,EAKH,KAAK,YAAY,EAEpB,MAAM,YAAY,CAAC;AAwBpB,eAAO,MAAM,SAAS,EAAE,YA6BvB,CAAC"}
+{"version":3,"file":"zed.d.ts","sourceRoot":"","sources":["../../src/clients/zed.ts"],"names":[],"mappings":"AAcA,OAAO,EAKH,KAAK,YAAY,EAEpB,MAAM,YAAY,CAAC;AAwBpB,eAAO,MAAM,SAAS,EAAE,YA6BvB,CAAC"}

package/dist/clients/zed.js

@@ -1,23 +1,7 @@
-/**
- * Zed MCP config writer.
- *
- *   Global: ~/.config/zed/settings.json  (JSONC; we treat as JSON for write)
- *
- * Schema: `context_servers` map (Zed-specific naming).
- *
- * @license MIT
- */
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { userHome } from './home.js';
 import { detectInServerMap, mergeServerEnv, patchJsonFile, removeFromServerMap, } from './index.js';
-/**
- * Pull the `.command.env` block off a prior Zed `context_servers` entry
- * (Zed nests under `{ command: { path, args, env }, settings }`). Returns
- * `undefined` when the entry / command is missing or not an object —
- * `mergeServerEnv` treats that as "no prior env to preserve". Defensive against
- * hand-edited JSONC.
- */
 function priorZedEnv(entry) {
     if (entry === null || typeof entry !== 'object' || Array.isArray(entry)) {
         return undefined;
@@ -43,8 +27,6 @@ export const zedClient = {
                 !Array.isArray(current.context_servers)
                 ? { ...current.context_servers }
                 : {};
-            // P0.2 — preserve a hand-added / previously-baked CA / proxy /
-            // extra-header key on re-run instead of wiping the env wholesale.
             const priorEnv = priorZedEnv(servers[serverName]);
             servers[serverName] = {
                 command: {

package/dist/clients/zed.js.map

@@ -1 +1 @@
-{"version":3,"file":"zed.js","sourceRoot":"","sources":["../../src/clients/zed.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EACH,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,mBAAmB,GAGtB,MAAM,YAAY,CAAC;AAEpB;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,KAAc;IAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,OAAO,GAAI,KAAiC,CAAC,OAAO,CAAC;IAC3D,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5E,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,OAAQ,OAAmC,CAAC,GAAG,CAAC;AACpD,CAAC;AAED,SAAS,UAAU;IACf,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAiB;IACnC,EAAE,EAAE,KAAK;IACT,KAAK,EAAE,KAAK;IACZ,UAAU;IACV,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAChE,KAAK,EAAE,KAAK,EAAE,UAAkB,EAAE,MAAuB,EAAE,EAAE;QACzD,MAAM,aAAa,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE;YAC1C,MAAM,OAAO,GACT,OAAO,CAAC,eAAe,KAAK,IAAI;gBAChC,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ;gBAC3C,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC;gBACnC,CAAC,CAAC,EAAE,GAAI,OAAO,CAAC,eAA2C,EAAE;gBAC7D,CAAC,CAAC,EAAE,CAAC;YACb,+DAA+D;YAC/D,kEAAkE;YAClE,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;YAClD,OAAO,CAAC,UAAU,CAAC,GAAG;gBAClB,OAAO,EAAE;oBACL,IAAI,EAAE,MAAM,CAAC,OAAO;oBACpB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,GAAG,EAAE,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC;iBAC5C;gBACD,QAAQ,EAAE,EAAE;aACf,CAAC;YACF,OAAO,EAAE,GAAG,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;QACpD,CAAC,CAAC,CAAC;IACP,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,UAAU,EAAE,EAAE,iBAAiB,CAAC;IAChE,MAAM,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,UAAU,EAAE,EAAE,iBAAiB,CAAC;CACrE,CAAC"}
+{"version":3,"file":"zed.js","sourceRoot":"","sources":["../../src/clients/zed.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EACH,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,mBAAmB,GAGtB,MAAM,YAAY,CAAC;AASpB,SAAS,WAAW,CAAC,KAAc;IAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,OAAO,GAAI,KAAiC,CAAC,OAAO,CAAC;IAC3D,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5E,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,OAAQ,OAAmC,CAAC,GAAG,CAAC;AACpD,CAAC;AAED,SAAS,UAAU;IACf,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAiB;IACnC,EAAE,EAAE,KAAK;IACT,KAAK,EAAE,KAAK;IACZ,UAAU;IACV,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAChE,KAAK,EAAE,KAAK,EAAE,UAAkB,EAAE,MAAuB,EAAE,EAAE;QACzD,MAAM,aAAa,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE;YAC1C,MAAM,OAAO,GACT,OAAO,CAAC,eAAe,KAAK,IAAI;gBAChC,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ;gBAC3C,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC;gBACnC,CAAC,CAAC,EAAE,GAAI,OAAO,CAAC,eAA2C,EAAE;gBAC7D,CAAC,CAAC,EAAE,CAAC;YAGb,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;YAClD,OAAO,CAAC,UAAU,CAAC,GAAG;gBAClB,OAAO,EAAE;oBACL,IAAI,EAAE,MAAM,CAAC,OAAO;oBACpB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,GAAG,EAAE,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC;iBAC5C;gBACD,QAAQ,EAAE,EAAE;aACf,CAAC;YACF,OAAO,EAAE,GAAG,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;QACpD,CAAC,CAAC,CAAC;IACP,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,UAAU,EAAE,EAAE,iBAAiB,CAAC;IAChE,MAAM,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,UAAU,EAAE,EAAE,iBAAiB,CAAC;CACrE,CAAC"}

package/dist/compat-floor.d.ts

@@ -0,0 +1,35 @@
+import { RestError } from './errors.js';
+export declare const COMPAT: {
+    readonly min_plugin: "2.0.0";
+    readonly min_client: "2.0.0";
+};
+export declare const CLIENT_VERSION_HEADER = "X-Ytb-Mcp-Client";
+export declare function compareVersions(a: string, b: string): number | null;
+export declare function isBelowFloor(version: string, floor: string): boolean;
+export interface PluginBelowFloorRejection {
+    readonly error: string;
+    readonly code: 'plugin_below_floor';
+    readonly min_plugin: string;
+    readonly current_plugin: string;
+    readonly current_client: string;
+    readonly hint: string;
+}
+export interface PluginVersionPairing {
+    readonly plugin: string;
+    readonly client: string;
+    readonly site?: string;
+}
+export declare function pluginFloorError(pairing: PluginVersionPairing): RestError | null;
+export declare function pluginBelowFloorRejection({ plugin, client, site }: PluginVersionPairing): PluginBelowFloorRejection;
+export type CompatNotice = {
+    readonly kind: 'below_floor';
+    readonly message: string;
+} | {
+    readonly kind: 'plugin_behind';
+    readonly message: string;
+} | {
+    readonly kind: 'package_behind';
+    readonly message: string;
+};
+export declare function versionSkewNotice({ plugin, client, site }: PluginVersionPairing): CompatNotice | null;
+//# sourceMappingURL=compat-floor.d.ts.map

package/dist/compat-floor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compat-floor.d.ts","sourceRoot":"","sources":["../src/compat-floor.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAOxC,eAAO,MAAM,MAAM;;;CAcT,CAAC;AASX,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AAgBxD,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASnE;AAeD,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAGpE;AAGD,MAAM,WAAW,yBAAyB;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACzB;AAoBD,MAAM,WAAW,oBAAoB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CAC1B;AAcD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,oBAAoB,GAAG,SAAS,GAAG,IAAI,CAShF;AAUD,wBAAgB,yBAAyB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,oBAAoB,GAAG,yBAAyB,CAiBnH;AAUD,MAAM,MAAM,YAAY,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAwBpE,wBAAgB,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,oBAAoB,GAAG,YAAY,GAAG,IAAI,CA2BrG"}

package/dist/compat-floor.js

@@ -0,0 +1,84 @@
+import { RestError } from './errors.js';
+export const COMPAT = {
+    min_plugin: '2.0.0',
+    min_client: '2.0.0',
+};
+export const CLIENT_VERSION_HEADER = 'X-Ytb-Mcp-Client';
+export function compareVersions(a, b) {
+    const pa = parseVersion(a);
+    const pb = parseVersion(b);
+    if (pa === null || pb === null)
+        return null;
+    for (let i = 0; i < 3; i++) {
+        const diff = (pa[i] ?? 0) - (pb[i] ?? 0);
+        if (diff !== 0)
+            return diff;
+    }
+    return 0;
+}
+function parseVersion(version) {
+    const m = /^\s*v?(\d+)(?:\.(\d+))?(?:\.(\d+))?/.exec(version);
+    if (m === null)
+        return null;
+    return [Number(m[1]), Number(m[2] ?? 0), Number(m[3] ?? 0)];
+}
+export function isBelowFloor(version, floor) {
+    const cmp = compareVersions(version, floor);
+    return cmp !== null && cmp < 0;
+}
+function siteLabel(site) {
+    return site === undefined ? 'this site' : `site "${site}"`;
+}
+export function pluginFloorError(pairing) {
+    if (!isBelowFloor(pairing.plugin, COMPAT.min_plugin))
+        return null;
+    const rejection = pluginBelowFloorRejection(pairing);
+    return new RestError({
+        status: 409,
+        code: rejection.code,
+        message: `${rejection.error} ${rejection.hint}`,
+        body: rejection,
+    });
+}
+export function pluginBelowFloorRejection({ plugin, client, site }) {
+    return {
+        error: `The YT Builder MCP plugin on ${siteLabel(site)} is version ${plugin}, but `
+            + `this MCP package (version ${client}) requires plugin ${COMPAT.min_plugin} `
+            + 'or newer. The two disagree about the shape of write responses, so a write '
+            + 'that succeeds can be reported as a failure. Refusing to continue rather '
+            + 'than risk that.',
+        code: 'plugin_below_floor',
+        min_plugin: COMPAT.min_plugin,
+        current_plugin: plugin,
+        current_client: client,
+        hint: 'Update the YT Builder MCP plugin on the site: WordPress → Plugins → '
+            + 'Update, or Joomla → System → Update → Extensions. Then start a new '
+            + 'conversation so the MCP server reconnects.',
+    };
+}
+export function versionSkewNotice({ plugin, client, site }) {
+    const cmp = compareVersions(plugin, client);
+    if (cmp === null || cmp === 0)
+        return null;
+    if (cmp < 0) {
+        return {
+            kind: 'plugin_behind',
+            message: `The YT Builder MCP plugin on ${siteLabel(site)} is version ${plugin}; `
+                + `this MCP server is ${client}. Everything you already use keeps `
+                + 'working. Anything added in the newer version becomes available after '
+                + 'updating the plugin: WordPress admin → Plugins → Update, or Joomla → '
+                + 'System → Update → Extensions.',
+        };
+    }
+    return {
+        kind: 'package_behind',
+        message: `This MCP server is version ${client}; the YT Builder MCP plugin on `
+            + `${siteLabel(site)} is ${plugin}. The site may answer with fields this server `
+            + 'does not know. Three things cause it: the server was pinned to a version '
+            + '(re-run setup without --pin to float to the latest), npx cannot reach '
+            + 'the npm registry from this machine, or you installed the Claude Desktop '
+            + "bundle, which is a frozen copy no registry updates — download the current "
+            + "one from the plugin's admin screen.",
+    };
+}
+//# sourceMappingURL=compat-floor.js.map

package/dist/compat-floor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compat-floor.js","sourceRoot":"","sources":["../src/compat-floor.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAOxC,MAAM,CAAC,MAAM,MAAM,GAAG;IAYlB,UAAU,EAAE,OAAO;IACnB,UAAU,EAAE,OAAO;CACb,CAAC;AASX,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AAgBxD,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS;IAChD,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IAChC,CAAC;IACD,OAAO,CAAC,CAAC;AACb,CAAC;AAGD,SAAS,YAAY,CAAC,OAAe;IACjC,MAAM,CAAC,GAAG,qCAAqC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9D,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAQD,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,KAAa;IACvD,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5C,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,GAAG,CAAC,CAAC;AACnC,CAAC;AAkBD,SAAS,SAAS,CAAC,IAAwB;IACvC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,IAAI,GAAG,CAAC;AAC/D,CAAC;AA6BD,MAAM,UAAU,gBAAgB,CAAC,OAA6B;IAC1D,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,MAAM,SAAS,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACrD,OAAO,IAAI,SAAS,CAAC;QACjB,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,OAAO,EAAE,GAAG,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,IAAI,EAAE;QAC/C,IAAI,EAAE,SAAS;KAClB,CAAC,CAAC;AACP,CAAC;AAUD,MAAM,UAAU,yBAAyB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAwB;IACpF,OAAO;QACH,KAAK,EACD,gCAAgC,SAAS,CAAC,IAAI,CAAC,eAAe,MAAM,QAAQ;cAC1E,6BAA6B,MAAM,qBAAqB,MAAM,CAAC,UAAU,GAAG;cAC5E,4EAA4E;cAC5E,0EAA0E;cAC1E,iBAAiB;QACvB,IAAI,EAAE,oBAAoB;QAC1B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,cAAc,EAAE,MAAM;QACtB,cAAc,EAAE,MAAM;QACtB,IAAI,EACA,sEAAsE;cACpE,qEAAqE;cACrE,4CAA4C;KACrD,CAAC;AACN,CAAC;AAqCD,MAAM,UAAU,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAwB;IAC5E,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3C,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QACV,OAAO;YACH,IAAI,EAAE,eAAe;YACrB,OAAO,EACH,gCAAgC,SAAS,CAAC,IAAI,CAAC,eAAe,MAAM,IAAI;kBACtE,sBAAsB,MAAM,qCAAqC;kBACjE,uEAAuE;kBACvE,uEAAuE;kBACvE,+BAA+B;SACxC,CAAC;IACN,CAAC;IAED,OAAO;QACH,IAAI,EAAE,gBAAgB;QACtB,OAAO,EACH,8BAA8B,MAAM,iCAAiC;cACnE,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,MAAM,gDAAgD;cAC/E,2EAA2E;cAC3E,wEAAwE;cACxE,0EAA0E;cAC1E,4EAA4E;cAC5E,qCAAqC;KAC9C,CAAC;AACN,CAAC"}

package/dist/compat-probe.d.ts

@@ -0,0 +1,6 @@
+import { type CompatNotice } from './compat-floor.js';
+export interface HealthReader {
+    get(path: string): Promise<unknown>;
+}
+export declare function probeCompatNotice(client: HealthReader, site?: string): Promise<CompatNotice | undefined>;
+//# sourceMappingURL=compat-probe.d.ts.map

package/dist/compat-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compat-probe.d.ts","sourceRoot":"","sources":["../src/compat-probe.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAuC,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAS3F,MAAM,WAAW,YAAY;IAazB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACvC;AAoBD,wBAAsB,iBAAiB,CACnC,MAAM,EAAE,YAAY,EACpB,IAAI,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAqBnC"}

package/dist/compat-probe.js

@@ -0,0 +1,20 @@
+import { pluginFloorError, versionSkewNotice } from './compat-floor.js';
+import { extractHealthPluginVersion } from './health-response.js';
+import { PACKAGE_VERSION } from './package-version.js';
+export async function probeCompatNotice(client, site) {
+    try {
+        const raw = await client.get('/health');
+        const version = extractHealthPluginVersion(raw);
+        if (version === undefined)
+            return undefined;
+        const pairing = { plugin: version, client: PACKAGE_VERSION, site };
+        const blocking = pluginFloorError(pairing);
+        if (blocking !== null)
+            return { kind: 'below_floor', message: blocking.message };
+        return versionSkewNotice(pairing) ?? undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=compat-probe.js.map

package/dist/compat-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compat-probe.js","sourceRoot":"","sources":["../src/compat-probe.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAqB,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAyCvD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACnC,MAAoB,EACpB,IAAa;IAEb,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAE5C,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;QAKnE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;QAEjF,OAAO,iBAAiB,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QAIL,OAAO,SAAS,CAAC;IACrB,CAAC;AACL,CAAC"}

package/dist/diagnostics/ca-reexec.d.ts

@@ -1,41 +1,11 @@
-/** Env var name the parent stamps on the re-exec'd child to break the loop. */
 export declare const CA_REEXEC_SENTINEL = "YTB_MCP_CA_REEXEC";
-/** The Node flag we re-exec with — adds the OS trust store, never disables TLS. */
 export declare const USE_SYSTEM_CA_FLAG = "--use-system-ca";
-/**
- * Is `--use-system-ca` already active for THIS process — either passed on the
- * command line (surfaces in `process.execArgv`) or carried in `NODE_OPTIONS`?
- *
- * Both inputs are matched as whitespace-delimited tokens so a longer flag that
- * merely CONTAINS the substring (none exists today, but defensively) cannot
- * produce a false positive. `execArgv` entries are already individual tokens;
- * `NODE_OPTIONS` is a single space-separated string, so it is split first.
- *
- * @param execArgv     `process.execArgv` (Node-level flags, one per element).
- * @param nodeOptions  the `NODE_OPTIONS` env value (or undefined when unset).
- */
 export declare function isSystemCaActive(execArgv: readonly string[], nodeOptions: string | undefined): boolean;
-/** Inputs to {@link decideCaReexec} — every signal is passed in (no globals). */
 export interface CaReexecInputs {
-    /** `process.version`, e.g. "v22.17.0". */
     readonly nodeVersion: string;
-    /** `process.execArgv` — Node flags this process was launched with. */
     readonly execArgv: readonly string[];
-    /** The `NODE_OPTIONS` env value, or undefined when unset. */
     readonly nodeOptions: string | undefined;
-    /** The loop-guard sentinel env value ({@link CA_REEXEC_SENTINEL}), or undefined. */
     readonly sentinel: string | undefined;
 }
-/**
- * Should the server bin re-exec itself WITH `--use-system-ca`?
- *
- * Returns `true` iff ALL hold:
- *   1. this Node can read the OS trust store ({@link supportsSystemCa}: ≥ 22.15.0),
- *   2. `--use-system-ca` is NOT already active ({@link isSystemCaActive}),
- *   3. the loop-guard sentinel is NOT set.
- *
- * Any of: Node too old, flag already active, or sentinel set → `false`
- * (proceed in-process). Pure: depends only on its arguments.
- */
 export declare function decideCaReexec(inputs: CaReexecInputs): boolean;
 //# sourceMappingURL=ca-reexec.d.ts.map

package/dist/diagnostics/ca-reexec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ca-reexec.d.ts","sourceRoot":"","sources":["../../src/diagnostics/ca-reexec.ts"],"names":[],"mappings":"AAoCA,+EAA+E;AAC/E,eAAO,MAAM,kBAAkB,sBAAsB,CAAC;AAEtD,mFAAmF;AACnF,eAAO,MAAM,kBAAkB,oBAAoB,CAAC;AAEpD;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC5B,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,WAAW,EAAE,MAAM,GAAG,SAAS,GAChC,OAAO,CAaT;AAED,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC3B,0CAA0C;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,6DAA6D;IAC7D,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;CACzC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAe9D"}
+{"version":3,"file":"ca-reexec.d.ts","sourceRoot":"","sources":["../../src/diagnostics/ca-reexec.ts"],"names":[],"mappings":"AAqCA,eAAO,MAAM,kBAAkB,sBAAsB,CAAC;AAGtD,eAAO,MAAM,kBAAkB,oBAAoB,CAAC;AAcpD,wBAAgB,gBAAgB,CAC5B,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,WAAW,EAAE,MAAM,GAAG,SAAS,GAChC,OAAO,CAaT;AAGD,MAAM,WAAW,cAAc;IAE3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAErC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAEzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;CACzC;AAaD,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAe9D"}

package/dist/diagnostics/ca-reexec.js

@@ -1,59 +1,11 @@
-// packages/mcp/src/diagnostics/ca-reexec.ts
-/**
- * Pure decision core for the runtime `--use-system-ca` SELF-HEAL re-exec in
- * `bin/yt-builder-mcp.js` (server branch only).
- *
- * THE PROBLEM IT SOLVES — env-clobber regression (Glöckle v1.6, 2026-06):
- * corporate-CA trust depended ENTIRELY on `NODE_OPTIONS=--use-system-ca` being
- * present in the MCP client config env BEFORE Node booted. On the Glöckle
- * install that value got wiped, so Node fell back to its bundled Mozilla CA set,
- * could not build the corporate TLS-inspection chain, and the `/mcp` handshake
- * hung for 30s. `mergeServerEnv` (clients/index.ts) is correct; the robust fix
- * is to STOP depending on the config carrying the flag and have the SERVER
- * self-heal at launch by re-exec'ing itself WITH `--use-system-ca`.
- *
- * WHY `--use-system-ca` IS SAFE TO APPLY UNCONDITIONALLY (on a supporting Node):
- * the flag only ADDS the OS trust store (Windows CryptoAPI / macOS Keychain) to
- * Node's bundled Mozilla CAs. It never DISABLES TLS verification. For a
- * non-corporate user it is a harmless superset; for a corporate user it is the
- * whole fix.
- *
- * THE LOOP-GUARD (critical): a re-exec that itself re-execs is an infinite fork
- * bomb. {@link decideCaReexec} returns `false` whenever the flag is ALREADY
- * active (in `process.execArgv` OR the `NODE_OPTIONS` env) OR a sentinel env var
- * (set by the parent on the child it spawns) is present. The shim sets the
- * sentinel on the child, so the child's own `decideCaReexec` returns `false` and
- * proceeds in-process.
- *
- * The bin shim is a thin, un-typed JS file; the decision logic lives here, in a
- * typed + unit-tested module, exactly like `cli/invocation-decision.ts`.
- *
- * @license MIT
- */
 import { supportsSystemCa } from './ca-trust.js';
-/** Env var name the parent stamps on the re-exec'd child to break the loop. */
 export const CA_REEXEC_SENTINEL = 'YTB_MCP_CA_REEXEC';
-/** The Node flag we re-exec with — adds the OS trust store, never disables TLS. */
 export const USE_SYSTEM_CA_FLAG = '--use-system-ca';
-/**
- * Is `--use-system-ca` already active for THIS process — either passed on the
- * command line (surfaces in `process.execArgv`) or carried in `NODE_OPTIONS`?
- *
- * Both inputs are matched as whitespace-delimited tokens so a longer flag that
- * merely CONTAINS the substring (none exists today, but defensively) cannot
- * produce a false positive. `execArgv` entries are already individual tokens;
- * `NODE_OPTIONS` is a single space-separated string, so it is split first.
- *
- * @param execArgv     `process.execArgv` (Node-level flags, one per element).
- * @param nodeOptions  the `NODE_OPTIONS` env value (or undefined when unset).
- */
 export function isSystemCaActive(execArgv, nodeOptions) {
     if (execArgv.includes(USE_SYSTEM_CA_FLAG)) {
         return true;
     }
     if (typeof nodeOptions === 'string') {
-        // NODE_OPTIONS is a space-separated flag list; tokenise before matching
-        // so we compare whole flags, never a substring of one.
         const tokens = nodeOptions.split(/\s+/).filter((t) => t.length > 0);
         if (tokens.includes(USE_SYSTEM_CA_FLAG)) {
             return true;
@@ -61,28 +13,14 @@ export function isSystemCaActive(execArgv, nodeOptions) {
     }
     return false;
 }
-/**
- * Should the server bin re-exec itself WITH `--use-system-ca`?
- *
- * Returns `true` iff ALL hold:
- *   1. this Node can read the OS trust store ({@link supportsSystemCa}: ≥ 22.15.0),
- *   2. `--use-system-ca` is NOT already active ({@link isSystemCaActive}),
- *   3. the loop-guard sentinel is NOT set.
- *
- * Any of: Node too old, flag already active, or sentinel set → `false`
- * (proceed in-process). Pure: depends only on its arguments.
- */
 export function decideCaReexec(inputs) {
     const { nodeVersion, execArgv, nodeOptions, sentinel } = inputs;
-    // Loop-guard: a child we already re-exec'd carries the sentinel. Never re-exec it.
     if (sentinel !== undefined && sentinel !== '') {
         return false;
     }
-    // Node too old to read the OS trust store — re-exec would be a no-op flag.
     if (!supportsSystemCa(nodeVersion)) {
         return false;
     }
-    // Already running with the flag (execArgv or NODE_OPTIONS) — nothing to heal.
     if (isSystemCaActive(execArgv, nodeOptions)) {
         return false;
     }

package/dist/diagnostics/ca-reexec.js.map

@@ -1 +1 @@
-{"version":3,"file":"ca-reexec.js","sourceRoot":"","sources":["../../src/diagnostics/ca-reexec.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AAEtD,mFAAmF;AACnF,MAAM,CAAC,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AAEpD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAC5B,QAA2B,EAC3B,WAA+B;IAE/B,IAAI,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QAClC,wEAAwE;QACxE,uDAAuD;QACvD,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACpE,IAAI,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAcD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,MAAsB;IACjD,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAChE,mFAAmF;IACnF,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,2EAA2E;IAC3E,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,8EAA8E;IAC9E,IAAI,gBAAgB,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC"}
+{"version":3,"file":"ca-reexec.js","sourceRoot":"","sources":["../../src/diagnostics/ca-reexec.ts"],"names":[],"mappings":"AAkCA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAGjD,MAAM,CAAC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AAGtD,MAAM,CAAC,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AAcpD,MAAM,UAAU,gBAAgB,CAC5B,QAA2B,EAC3B,WAA+B;IAE/B,IAAI,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QAGlC,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACpE,IAAI,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAyBD,MAAM,UAAU,cAAc,CAAC,MAAsB;IACjD,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAEhE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,IAAI,gBAAgB,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC"}

package/dist/diagnostics/ca-trust.d.ts

@@ -1,27 +1,5 @@
-/**
- * True when `err` (or anything in its `.cause` / `AggregateError.errors`
- * chain) carries a TLS chain-of-trust failure code — the signature of a
- * corporate TLS-inspection proxy injecting its own root CA. Pure; reuses the
- * same walker + code set as {@link diagnoseNetworkError}.
- */
 export declare function isCaTrustError(err: unknown): boolean;
-/**
- * True when `err` (or anything in its `.cause` / `AggregateError.errors`
- * chain) carries a connection/handshake timeout code — the OPAQUE form a
- * corporate TLS-inspection proxy takes when the cert chain can't be built and
- * the handshake hangs instead of failing with a clean CA-trust code. Pure;
- * reuses the same walker + canonical {@link TIMEOUT_CODES} set as
- * {@link diagnoseNetworkError} (no duplicate classifier). The wizard uses this
- * to attempt the OS-trust-store (`--use-system-ca`) recovery on a timeout —
- * safe because `--use-system-ca` only ADDS the OS store and never disables TLS.
- */
 export declare function isTimeoutError(err: unknown): boolean;
-/** Node version that first reads the OS trust store via `--use-system-ca`. */
 export declare const SYSTEM_CA_NODE_FLOOR: readonly [number, number, number];
-/**
- * Does `nodeVersion` (default `process.version`) support `--use-system-ca`?
- * A real numeric triple compare against {@link SYSTEM_CA_NODE_FLOOR} —
- * fail-closed (`false`) on unparseable input.
- */
 export declare function supportsSystemCa(nodeVersion?: string): boolean;
 //# sourceMappingURL=ca-trust.d.ts.map

package/dist/diagnostics/ca-trust.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ca-trust.d.ts","sourceRoot":"","sources":["../../src/diagnostics/ca-trust.ts"],"names":[],"mappings":"AAqBA;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEpD;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEpD;AAED,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAe,CAAC;AAQnF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,GAAE,MAAwB,GAAG,OAAO,CAS/E"}
+{"version":3,"file":"ca-trust.d.ts","sourceRoot":"","sources":["../../src/diagnostics/ca-trust.ts"],"names":[],"mappings":"AA2BA,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEpD;AAuBD,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEpD;AAGD,eAAO,MAAM,oBAAoB,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAe,CAAC;AAanF,wBAAgB,gBAAgB,CAAC,WAAW,GAAE,MAAwB,GAAG,OAAO,CAS/E"}

package/dist/diagnostics/ca-trust.js

@@ -1,44 +1,10 @@
-// packages/mcp/src/diagnostics/ca-trust.ts
-/**
- * Shared helpers for the corporate TLS-inspection (CA-trust) install path.
- *
- * G-D #6/#7 — two questions the wizard + CLI both need answered:
- *   1. "Did this connection fail because of a TLS-inspection root CA?"
- *      → {@link isCaTrustError}, classifying against the canonical
- *        {@link CA_TRUST_CODES} (no duplicate set).
- *   2. "Can this Node read the OS trust store natively (`--use-system-ca`)?"
- *      → {@link supportsSystemCa}, a real numeric semver compare against the
- *        backport floor — never a string comparison.
- *
- * Node's `--use-system-ca` (reads Windows CryptoAPI + macOS Keychain) was
- * stabilised on the 24.x line and backported to 22.15.0, so the floor is
- * 22.15.0. Below that floor, a corporate CA must be supplied as a `.pem`
- * via NODE_EXTRA_CA_CERTS. Neither path ever disables TLS verification.
- */
-import { CA_TRUST_CODES, collectCodes, TIMEOUT_CODES } from './diagnose-network-error.js';
-/**
- * True when `err` (or anything in its `.cause` / `AggregateError.errors`
- * chain) carries a TLS chain-of-trust failure code — the signature of a
- * corporate TLS-inspection proxy injecting its own root CA. Pure; reuses the
- * same walker + code set as {@link diagnoseNetworkError}.
- */
+import { CA_TRUST_CODES, collectCodes, hasAbortSignature, TIMEOUT_CODES } from './diagnose-network-error.js';
 export function isCaTrustError(err) {
     return collectCodes(err).some((c) => CA_TRUST_CODES.has(c));
 }
-/**
- * True when `err` (or anything in its `.cause` / `AggregateError.errors`
- * chain) carries a connection/handshake timeout code — the OPAQUE form a
- * corporate TLS-inspection proxy takes when the cert chain can't be built and
- * the handshake hangs instead of failing with a clean CA-trust code. Pure;
- * reuses the same walker + canonical {@link TIMEOUT_CODES} set as
- * {@link diagnoseNetworkError} (no duplicate classifier). The wizard uses this
- * to attempt the OS-trust-store (`--use-system-ca`) recovery on a timeout —
- * safe because `--use-system-ca` only ADDS the OS store and never disables TLS.
- */
 export function isTimeoutError(err) {
-    return collectCodes(err).some((c) => TIMEOUT_CODES.has(c));
+    return collectCodes(err).some((c) => TIMEOUT_CODES.has(c)) || hasAbortSignature(err);
 }
-/** Node version that first reads the OS trust store via `--use-system-ca`. */
 export const SYSTEM_CA_NODE_FLOOR = [22, 15, 0];
 function parseNodeVersion(v) {
     const m = /^v?(\d+)\.(\d+)\.(\d+)/.exec(v);
@@ -46,11 +12,6 @@ function parseNodeVersion(v) {
         return null;
     return [Number(m[1]), Number(m[2]), Number(m[3])];
 }
-/**
- * Does `nodeVersion` (default `process.version`) support `--use-system-ca`?
- * A real numeric triple compare against {@link SYSTEM_CA_NODE_FLOOR} —
- * fail-closed (`false`) on unparseable input.
- */
 export function supportsSystemCa(nodeVersion = process.version) {
     const v = parseNodeVersion(nodeVersion);
     if (v === null)
@@ -62,6 +23,6 @@ export function supportsSystemCa(nodeVersion = process.version) {
         if (v[i] < floor[i])
             return false;
     }
-    return true; // exactly equal to the floor
+    return true;
 }
 //# sourceMappingURL=ca-trust.js.map

package/dist/diagnostics/ca-trust.js.map

@@ -1 +1 @@
-{"version":3,"file":"ca-trust.js","sourceRoot":"","sources":["../../src/diagnostics/ca-trust.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAE3C;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE1F;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY;IACvC,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY;IACvC,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,oBAAoB,GAAsC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAEnF,SAAS,gBAAgB,CAAC,CAAS;IAC/B,MAAM,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,cAAsB,OAAO,CAAC,OAAO;IAClE,MAAM,CAAC,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,KAAK,GAAG,oBAAoB,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,KAAK,CAAC,CAAC,CAAE;YAAE,OAAO,IAAI,CAAC;QACnC,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,KAAK,CAAC,CAAC,CAAE;YAAE,OAAO,KAAK,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,6BAA6B;AAC9C,CAAC"}
+{"version":3,"file":"ca-trust.js","sourceRoot":"","sources":["../../src/diagnostics/ca-trust.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAQ7G,MAAM,UAAU,cAAc,CAAC,GAAY;IACvC,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAuBD,MAAM,UAAU,cAAc,CAAC,GAAY;IACvC,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC;AACzF,CAAC;AAGD,MAAM,CAAC,MAAM,oBAAoB,GAAsC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAEnF,SAAS,gBAAgB,CAAC,CAAS;IAC/B,MAAM,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC;AAOD,MAAM,UAAU,gBAAgB,CAAC,cAAsB,OAAO,CAAC,OAAO;IAClE,MAAM,CAAC,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,KAAK,GAAG,oBAAoB,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,KAAK,CAAC,CAAC,CAAE;YAAE,OAAO,IAAI,CAAC;QACnC,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,KAAK,CAAC,CAAC,CAAE;YAAE,OAAO,KAAK,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC"}

package/dist/diagnostics/diagnose-network-error.d.ts

@@ -1,48 +1,11 @@
-/**
- * A human-actionable diagnosis of an outbound-connection failure.
- *
- * The Glöckle corporate stress-test failed with an opaque 30-second timeout
- * that "looked like an auth or server problem" when the real cause was a
- * TLS-inspection root CA. Mapping the low-level `.code` to a copy-pasteable fix
- * is the difference between a 5-minute self-serve and a support ticket.
- */
 export interface NetworkDiagnosis {
-    /** The matched low-level code, e.g. `SELF_SIGNED_CERT_IN_CHAIN`, `ENOTFOUND`, `HTTP_401`. */
     readonly code: string;
-    /** One-line summary of what went wrong. */
     readonly summary: string;
-    /** Actionable, copy-pasteable fix. NEVER suggests disabling TLS verification. */
     readonly fix: string;
 }
-/**
- * TLS chain-of-trust failures — the corporate-CA / TLS-inspection signature.
- *
- * Exported so the wizard's CA-detection path (`isCaTrustError`) classifies an
- * outbound failure against the SAME canonical set — there is exactly one
- * definition of "this is a TLS-inspection CA problem" in the package.
- */
 export declare const CA_TRUST_CODES: ReadonlySet<string>;
-/**
- * Connection/handshake timeout signatures.
- *
- * Exported so the wizard's timeout-detection path (`isTimeoutError`) classifies
- * an outbound failure against the SAME canonical set — there is exactly one
- * definition of "this connection timed out" in the package. A TLS-inspecting
- * corporate proxy whose root CA can't be built can manifest as one of these
- * opaque timeouts (the handshake hangs) rather than a clean CA-trust code, which
- * is why the wizard now attempts `--use-system-ca` on a timeout too.
- */
 export declare const TIMEOUT_CODES: ReadonlySet<string>;
-/**
- * Walk `err`, its `.cause` chain, and any `AggregateError.errors`, collecting
- * every `.code` string. A Node global-fetch failure (`TypeError: fetch failed`)
- * hides the real TLS/socket code one or more `.cause` levels down.
- */
 export declare function collectCodes(err: unknown, depth?: number): string[];
-/**
- * Classify an outbound-connection failure into an actionable diagnosis, or
- * `null` when nothing specific matches (the caller should fall back to the raw
- * error message). Pure — `env` is injectable for tests.
- */
+export declare function hasAbortSignature(err: unknown, depth?: number): boolean;
 export declare function diagnoseNetworkError(err: unknown, env?: NodeJS.ProcessEnv): NetworkDiagnosis | null;
 //# sourceMappingURL=diagnose-network-error.d.ts.map

package/dist/diagnostics/diagnose-network-error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"diagnose-network-error.d.ts","sourceRoot":"","sources":["../../src/diagnostics/diagnose-network-error.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC7B,6FAA6F;IAC7F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2CAA2C;IAC3C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,iFAAiF;IACjF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,EAAE,WAAW,CAAC,MAAM,CAO7C,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa,EAAE,WAAW,CAAC,MAAM,CAK5C,CAAC;AA4BH;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,MAAM,EAAE,CAa9D;AAOD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAChC,GAAG,EAAE,OAAO,EACZ,GAAG,GAAE,MAAM,CAAC,UAAwB,GACrC,gBAAgB,GAAG,IAAI,CA2FzB"}
+{"version":3,"file":"diagnose-network-error.d.ts","sourceRoot":"","sources":["../../src/diagnostics/diagnose-network-error.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,gBAAgB;IAE7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACxB;AASD,eAAO,MAAM,cAAc,EAAE,WAAW,CAAC,MAAM,CAO7C,CAAC;AAYH,eAAO,MAAM,aAAa,EAAE,WAAW,CAAC,MAAM,CAK5C,CAAC;AAiCH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,MAAM,EAAE,CAa9D;AAgCD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,OAAO,CAelE;AAYD,wBAAgB,oBAAoB,CAChC,GAAG,EAAE,OAAO,EACZ,GAAG,GAAE,MAAM,CAAC,UAAwB,GACrC,gBAAgB,GAAG,IAAI,CA2FzB"}