@wootsup/yt-builder-mcp 1.12.0 → 2.0.0

package/dist/diagnostics/startup-self-probe.js

@@ -1,37 +1,5 @@
-// packages/mcp/src/diagnostics/startup-self-probe.ts
-/**
- * Startup TLS self-probe (P0.4 — fail-fast instead of a 30s /mcp hang).
- *
- * The customer install-blocker: when the configured site sits behind a corporate
- * TLS-inspection proxy whose root CA Node does not trust, the server opened
- * stdio and waited — answering nothing — so the host's 30s `/mcp` connect-timeout
- * fired with an opaque "Server disconnected" toast that "looked like an auth or
- * server problem". The real cause (a self-signed cert in the chain) was invisible.
- *
- * This module sends ONE bounded HTTPS request to the configured site BEFORE the
- * stdio transport is wired. If it rejects with a TLS chain-of-trust error
- * (`isCaTrustError`), `main()` / the proxy bridge writes the actionable
- * `--use-system-ca` / `NODE_EXTRA_CA_CERTS` fix to stderr and exits non-zero in
- * < 2s — turning a silent 30s timeout into an immediate, copy-pasteable remedy.
- * Any OTHER probe outcome (success, 401/404/5xx, DNS, plain timeout) is NOT a
- * reason to abort: the server must still boot for those (auth can be fixed via a
- * tool call; an unconfigured boot must stay). Never disables TLS verification.
- *
- * Pure + deps-injectable (the `probe` fn + `nodeVersion` + `now`) so it is
- * unit-testable offline with no real network.
- *
- * @license MIT
- */
 import { isCaTrustError, supportsSystemCa } from './ca-trust.js';
-/** Default bound for the startup probe — short enough to beat the host's ~30s
- * connect-timeout with wide margin, long enough for a real corporate proxy. */
 export const DEFAULT_SELF_PROBE_TIMEOUT_MS = 4000;
-/**
- * The default probe: a bounded `fetch` (HEAD) of `url` with an AbortController
- * timeout. Resolves on ANY response (the handshake completed); the only thing we
- * care about is whether the connection rejects with a CA-trust error, which
- * surfaces as a rejected promise whose `.cause` chain carries the TLS code.
- */
 export const defaultTlsProbe = async (url, timeoutMs) => {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
@@ -42,11 +10,6 @@ export const defaultTlsProbe = async (url, timeoutMs) => {
         clearTimeout(timer);
     }
 };
-/**
- * Build the actionable stderr message for a CA-trust startup failure. Chooses
- * the zero-export `--use-system-ca` remedy on Node ≥ 22.15, else the
- * `NODE_EXTRA_CA_CERTS=<pem>` remedy. Never suggests disabling verification.
- */
 export function caTrustStartupMessage(siteUrl, nodeVersion) {
     const remedy = supportsSystemCa(nodeVersion)
         ? 'set NODE_OPTIONS=--use-system-ca (Node ≥ 22.15 — reads your OS / corporate root CA store)'
@@ -56,13 +19,12 @@ export function caTrustStartupMessage(siteUrl, nodeVersion) {
         `Fix: ${remedy}, then restart your AI client. ` +
         'Re-run `npx -y @wootsup/yt-builder-mcp setup` to bake this automatically. Never disable TLS verification.');
 }
-/**
- * Run the startup TLS self-probe against `siteUrl`. Returns `{ caTrustFailure:
- * false }` for every outcome EXCEPT a TLS chain-of-trust rejection — only that
- * one outcome is fail-fast-worthy (everything else must still let the server
- * boot). When `siteUrl` is empty/undefined the probe is skipped (the
- * boot-unconfigured path must stay).
- */
+export function unreachableStartupMessage(siteUrl) {
+    return (`[yt-builder-mcp] notice: ${siteUrl} did not answer the startup probe. ` +
+        'The server is starting anyway, but if calls hang with no answer, this is the reason to check first: ' +
+        'the address may be wrong, the site may be behind a VPN this machine is not on, or a firewall may be ' +
+        'dropping the packets rather than refusing them. A site that is merely slow will answer normally.');
+}
 export async function runStartupSelfProbe(siteUrl, deps = {}) {
     const url = (siteUrl ?? '').trim();
     if (url === '')
@@ -78,10 +40,11 @@ export async function runStartupSelfProbe(siteUrl, deps = {}) {
         if (isCaTrustError(err)) {
             return { caTrustFailure: true, message: caTrustStartupMessage(url, nodeVersion) };
         }
-        // Any other failure (DNS, timeout, refused, plain abort) is NOT a
-        // boot-blocker — the server must still come up. The proxy bridge's
-        // first-frame catch already turns those into actionable JSON-RPC errors.
-        return { caTrustFailure: false };
+        return {
+            caTrustFailure: false,
+            unreachable: true,
+            unreachableMessage: unreachableStartupMessage(url),
+        };
     }
 }
 //# sourceMappingURL=startup-self-probe.js.map

package/dist/diagnostics/startup-self-probe.js.map

@@ -1 +1 @@
-{"version":3,"file":"startup-self-probe.js","sourceRoot":"","sources":["../../src/diagnostics/startup-self-probe.ts"],"names":[],"mappings":"AAAA,qDAAqD;AAErD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAcjE;+EAC+E;AAC/E,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAElD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAa,KAAK,EAAE,GAAW,EAAE,SAAiB,EAAiB,EAAE;IAC7F,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC;QACD,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxF,CAAC;YAAS,CAAC;QACP,YAAY,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;AACL,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,WAAmB;IACtE,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC;QACxC,CAAC,CAAC,2FAA2F;QAC7F,CAAC,CAAC,iEAAiE,WAAW,qDAAqD,CAAC;IACxI,OAAO,CACH,8DAA8D,OAAO,KAAK;QAC1E,0FAA0F;QAC1F,QAAQ,MAAM,iCAAiC;QAC/C,2GAA2G,CAC9G,CAAC;AACN,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACrC,OAA2B,EAC3B,OAII,EAAE;IAEN,MAAM,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IAEjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,eAAe,CAAC;IAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IACxD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,6BAA6B,CAAC;IAElE,IAAI,CAAC;QACD,MAAM,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC5B,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;QACtF,CAAC;QACD,kEAAkE;QAClE,mEAAmE;QACnE,yEAAyE;QACzE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC;AACL,CAAC"}
+{"version":3,"file":"startup-self-probe.js","sourceRoot":"","sources":["../../src/diagnostics/startup-self-probe.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAyBjE,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAQlD,MAAM,CAAC,MAAM,eAAe,GAAa,KAAK,EAAE,GAAW,EAAE,SAAiB,EAAiB,EAAE;IAC7F,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC;QACD,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxF,CAAC;YAAS,CAAC;QACP,YAAY,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;AACL,CAAC,CAAC;AAOF,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,WAAmB;IACtE,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC;QACxC,CAAC,CAAC,2FAA2F;QAC7F,CAAC,CAAC,iEAAiE,WAAW,qDAAqD,CAAC;IACxI,OAAO,CACH,8DAA8D,OAAO,KAAK;QAC1E,0FAA0F;QAC1F,QAAQ,MAAM,iCAAiC;QAC/C,2GAA2G,CAC9G,CAAC;AACN,CAAC;AASD,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACrD,OAAO,CACH,4BAA4B,OAAO,qCAAqC;QACxE,sGAAsG;QACtG,sGAAsG;QACtG,kGAAkG,CACrG,CAAC;AACN,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACrC,OAA2B,EAC3B,OAII,EAAE;IAEN,MAAM,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IAEjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,eAAe,CAAC;IAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IACxD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,6BAA6B,CAAC;IAElE,IAAI,CAAC;QACD,MAAM,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC5B,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;QACtF,CAAC;QAqBD,OAAO;YACH,cAAc,EAAE,KAAK;YACrB,WAAW,EAAE,IAAI;YACjB,kBAAkB,EAAE,yBAAyB,CAAC,GAAG,CAAC;SACrD,CAAC;IACN,CAAC;AACL,CAAC"}

package/dist/errors/hints.d.ts

@@ -1,51 +1,7 @@
-/**
- * Error-code taxonomy + AI-friendly hint messages.
- *
- * `classify(status)` maps the HTTP status of a failed REST call into one
- * of nine canonical `YtbErrorCode` values. `hintFor(code)` returns a
- * recovery-oriented hint string the LLM can act on without re-reading the
- * raw error message.
- *
- * Centralising the taxonomy means every tool's catch-block emits the
- * same vocabulary, and the audit gate can pin the exact set of hints
- * that ship.
- *
- * Reference: `apimapper-mcp/src/modules/apimapper/client.ts:hintFor`
- * (Wave G.6.1 — same shape, ported for the YOOtheme Builder REST API).
- *
- * @license MIT
- */
-/**
- * Canonical YOOtheme-Builder-MCP error code union.
- *
- * Order is documentary only — `classify()` returns whichever applies.
- */
 export type YtbErrorCode = 'auth_invalid' | 'auth_missing' | 'forbidden' | 'not_found' | 'conflict_etag' | 'validation_error' | 'rate_limit' | 'server_error' | 'network';
-/** Options for `classify()` — second-tier signals (e.g. response headers). */
 export interface ClassifyOptions {
-    /**
-     * Whether the response carried a `WWW-Authenticate` header. Used to
-     * distinguish `auth_missing` (no bearer sent → server didn't ask for one
-     * via WWW-Authenticate; misconfigured client) from `auth_invalid`
-     * (server rejected the bearer that WAS sent).
-     */
     readonly hasWwwAuthenticate?: boolean;
 }
-/**
- * Map an HTTP status into a `YtbErrorCode`.
- *
- * Special-cases:
- *   - 401 with `hasWwwAuthenticate: false` → `auth_missing`
- *   - 401 with `hasWwwAuthenticate: true`  → `auth_invalid` (default)
- *   - 412 (Precondition Failed) is treated as `conflict_etag` alongside 409.
- *   - Status 0 (no response) → `network`.
- *   - Anything we don't recognise (incl. 2xx) → `server_error` so the agent
- *     sees a non-empty hint rather than silently swallowing.
- */
 export declare function classify(status: number, options?: ClassifyOptions): YtbErrorCode;
-/**
- * Return a focused hint describing how the agent (or the user) can
- * recover from a given error code. Always non-empty.
- */
 export declare function hintFor(code: YtbErrorCode): string;
 //# sourceMappingURL=hints.d.ts.map

package/dist/errors/hints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hints.d.ts","sourceRoot":"","sources":["../../src/errors/hints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAClB,cAAc,GACd,cAAc,GACd,WAAW,GACX,WAAW,GACX,eAAe,GACf,kBAAkB,GAClB,YAAY,GACZ,cAAc,GACd,SAAS,CAAC;AAEhB,8EAA8E;AAC9E,MAAM,WAAW,eAAe;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CACzC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,YAAY,CAYpF;AAED;;;GAGG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CA2DlD"}
+{"version":3,"file":"hints.d.ts","sourceRoot":"","sources":["../../src/errors/hints.ts"],"names":[],"mappings":"AAuBA,MAAM,MAAM,YAAY,GAClB,cAAc,GACd,cAAc,GACd,WAAW,GACX,WAAW,GACX,eAAe,GACf,kBAAkB,GAClB,YAAY,GACZ,cAAc,GACd,SAAS,CAAC;AAGhB,MAAM,WAAW,eAAe;IAO5B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CACzC;AAaD,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,YAAY,CAYpF;AAMD,wBAAgB,OAAO,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CA2DlD"}

package/dist/errors/hints.js

@@ -1,31 +1,3 @@
-/**
- * Error-code taxonomy + AI-friendly hint messages.
- *
- * `classify(status)` maps the HTTP status of a failed REST call into one
- * of nine canonical `YtbErrorCode` values. `hintFor(code)` returns a
- * recovery-oriented hint string the LLM can act on without re-reading the
- * raw error message.
- *
- * Centralising the taxonomy means every tool's catch-block emits the
- * same vocabulary, and the audit gate can pin the exact set of hints
- * that ship.
- *
- * Reference: `apimapper-mcp/src/modules/apimapper/client.ts:hintFor`
- * (Wave G.6.1 — same shape, ported for the YOOtheme Builder REST API).
- *
- * @license MIT
- */
-/**
- * Map an HTTP status into a `YtbErrorCode`.
- *
- * Special-cases:
- *   - 401 with `hasWwwAuthenticate: false` → `auth_missing`
- *   - 401 with `hasWwwAuthenticate: true`  → `auth_invalid` (default)
- *   - 412 (Precondition Failed) is treated as `conflict_etag` alongside 409.
- *   - Status 0 (no response) → `network`.
- *   - Anything we don't recognise (incl. 2xx) → `server_error` so the agent
- *     sees a non-empty hint rather than silently swallowing.
- */
 export function classify(status, options = {}) {
     if (status === 0)
         return 'network';
@@ -46,10 +18,6 @@ export function classify(status, options = {}) {
         return 'server_error';
     return 'server_error';
 }
-/**
- * Return a focused hint describing how the agent (or the user) can
- * recover from a given error code. Always non-empty.
- */
 export function hintFor(code) {
     switch (code) {
         case 'auth_invalid':

package/dist/errors/hints.js.map

@@ -1 +1 @@
-{"version":3,"file":"hints.js","sourceRoot":"","sources":["../../src/errors/hints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AA6BH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAc,EAAE,UAA2B,EAAE;IAClE,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACjB,OAAO,OAAO,CAAC,kBAAkB,KAAK,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC;IAClF,CAAC;IACD,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,CAAC;IACvC,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,CAAC;IACvC,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,eAAe,CAAC;IAC7D,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,kBAAkB,CAAC;IAC9C,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,YAAY,CAAC;IACxC,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,cAAc,CAAC;IACzC,OAAO,cAAc,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,IAAkB;IACtC,QAAQ,IAAI,EAAE,CAAC;QACX,KAAK,cAAc;YACf,OAAO,CACH,oEAAoE;gBACpE,yEAAyE;gBACzE,iEAAiE;gBACjE,0BAA0B,CAC7B,CAAC;QACN,KAAK,cAAc;YACf,OAAO,CACH,sEAAsE;gBACtE,sEAAsE;gBACtE,mEAAmE,CACtE,CAAC;QACN,KAAK,WAAW;YACZ,OAAO,CACH,mEAAmE;gBACnE,8DAA8D;gBAC9D,2DAA2D,CAC9D,CAAC;QACN,KAAK,WAAW;YACZ,OAAO,CACH,gEAAgE;gBAChE,kEAAkE;gBAClE,wDAAwD,CAC3D,CAAC;QACN,KAAK,eAAe;YAChB,OAAO,CACH,gEAAgE;gBAChE,iEAAiE;gBACjE,oEAAoE,CACvE,CAAC;QACN,KAAK,kBAAkB;YACnB,OAAO,CACH,kEAAkE;gBAClE,8CAA8C;gBAC9C,kEAAkE,CACrE,CAAC;QACN,KAAK,YAAY;YACb,OAAO,CACH,8DAA8D;gBAC9D,iEAAiE;gBACjE,mEAAmE;gBACnE,oCAAoC,CACvC,CAAC;QACN,KAAK,cAAc;YACf,OAAO,CACH,+DAA+D;gBAC/D,iEAAiE;gBACjE,8DAA8D,CACjE,CAAC;QACN,KAAK,SAAS;YACV,OAAO,CACH,sDAAsD;gBACtD,8DAA8D;gBAC9D,4DAA4D,CAC/D,CAAC;IACV,CAAC;AACL,CAAC"}
+{"version":3,"file":"hints.js","sourceRoot":"","sources":["../../src/errors/hints.ts"],"names":[],"mappings":"AAwDA,MAAM,UAAU,QAAQ,CAAC,MAAc,EAAE,UAA2B,EAAE;IAClE,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACjB,OAAO,OAAO,CAAC,kBAAkB,KAAK,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC;IAClF,CAAC;IACD,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,CAAC;IACvC,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,CAAC;IACvC,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,eAAe,CAAC;IAC7D,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,kBAAkB,CAAC;IAC9C,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,YAAY,CAAC;IACxC,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,cAAc,CAAC;IACzC,OAAO,cAAc,CAAC;AAC1B,CAAC;AAMD,MAAM,UAAU,OAAO,CAAC,IAAkB;IACtC,QAAQ,IAAI,EAAE,CAAC;QACX,KAAK,cAAc;YACf,OAAO,CACH,oEAAoE;gBACpE,yEAAyE;gBACzE,iEAAiE;gBACjE,0BAA0B,CAC7B,CAAC;QACN,KAAK,cAAc;YACf,OAAO,CACH,sEAAsE;gBACtE,sEAAsE;gBACtE,mEAAmE,CACtE,CAAC;QACN,KAAK,WAAW;YACZ,OAAO,CACH,mEAAmE;gBACnE,8DAA8D;gBAC9D,2DAA2D,CAC9D,CAAC;QACN,KAAK,WAAW;YACZ,OAAO,CACH,gEAAgE;gBAChE,kEAAkE;gBAClE,wDAAwD,CAC3D,CAAC;QACN,KAAK,eAAe;YAChB,OAAO,CACH,gEAAgE;gBAChE,iEAAiE;gBACjE,oEAAoE,CACvE,CAAC;QACN,KAAK,kBAAkB;YACnB,OAAO,CACH,kEAAkE;gBAClE,8CAA8C;gBAC9C,kEAAkE,CACrE,CAAC;QACN,KAAK,YAAY;YACb,OAAO,CACH,8DAA8D;gBAC9D,iEAAiE;gBACjE,mEAAmE;gBACnE,oCAAoC,CACvC,CAAC;QACN,KAAK,cAAc;YACf,OAAO,CACH,+DAA+D;gBAC/D,iEAAiE;gBACjE,8DAA8D,CACjE,CAAC;QACN,KAAK,SAAS;YACV,OAAO,CACH,sDAAsD;gBACtD,8DAA8D;gBAC9D,4DAA4D,CAC/D,CAAC;IACV,CAAC;AACL,CAAC"}

package/dist/errors/mask.d.ts

@@ -1,35 +1,4 @@
-/**
- * Secret-masking helpers — Wave G.6.2.
- *
- * `maskBearerToken` rewrites any `Bearer <token>` substring to
- * `Bearer ***masked***`. `sanitizeForLogs` additionally truncates very
- * long strings so a paste of a multi-MB stack trace can't blow the
- * context budget.
- *
- * Defense-in-depth: this is the single choke-point for any string
- * (error message, response body excerpt, log line) that crosses the
- * MCP boundary into the LLM's view.
- *
- * @license MIT
- */
-/** Maximum length for a sanitised log string. Anything longer is truncated. */
 export declare const LOG_TRUNCATION_LIMIT = 2000;
-/**
- * Replace every `Bearer <opaque-token>` substring with `Bearer ***masked***`.
- *
- * Token-shape is intentionally permissive — we'd rather over-mask than
- * leak. Any non-whitespace run following the literal `Bearer ` is treated
- * as the token and replaced.
- */
 export declare function maskBearerToken(input: string): string;
-/**
- * Sanitise a string before it joins the LLM-visible output:
- *   1. mask any Bearer tokens
- *   2. truncate to `LOG_TRUNCATION_LIMIT` chars with a clear suffix
- *
- * Non-string inputs (null / undefined) collapse to an empty string —
- * caller code typically passes `error?.message` and `?? ''` is a common
- * upstream pattern.
- */
 export declare function sanitizeForLogs(input: string): string;
 //# sourceMappingURL=mask.d.ts.map

package/dist/errors/mask.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mask.d.ts","sourceRoot":"","sources":["../../src/errors/mask.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,OAAO,CAAC;AAEzC;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAIrD;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMrD"}
+{"version":3,"file":"mask.d.ts","sourceRoot":"","sources":["../../src/errors/mask.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,oBAAoB,OAAO,CAAC;AASzC,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAIrD;AAWD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMrD"}

package/dist/errors/mask.js

@@ -1,41 +1,9 @@
-/**
- * Secret-masking helpers — Wave G.6.2.
- *
- * `maskBearerToken` rewrites any `Bearer <token>` substring to
- * `Bearer ***masked***`. `sanitizeForLogs` additionally truncates very
- * long strings so a paste of a multi-MB stack trace can't blow the
- * context budget.
- *
- * Defense-in-depth: this is the single choke-point for any string
- * (error message, response body excerpt, log line) that crosses the
- * MCP boundary into the LLM's view.
- *
- * @license MIT
- */
-/** Maximum length for a sanitised log string. Anything longer is truncated. */
 export const LOG_TRUNCATION_LIMIT = 2000;
-/**
- * Replace every `Bearer <opaque-token>` substring with `Bearer ***masked***`.
- *
- * Token-shape is intentionally permissive — we'd rather over-mask than
- * leak. Any non-whitespace run following the literal `Bearer ` is treated
- * as the token and replaced.
- */
 export function maskBearerToken(input) {
     if (input === '')
         return '';
-    // The `g` flag handles repeated occurrences in one string.
     return input.replace(/Bearer\s+\S+/g, 'Bearer ***masked***');
 }
-/**
- * Sanitise a string before it joins the LLM-visible output:
- *   1. mask any Bearer tokens
- *   2. truncate to `LOG_TRUNCATION_LIMIT` chars with a clear suffix
- *
- * Non-string inputs (null / undefined) collapse to an empty string —
- * caller code typically passes `error?.message` and `?? ''` is a common
- * upstream pattern.
- */
 export function sanitizeForLogs(input) {
     if (input === null || input === undefined)
         return '';

package/dist/errors/mask.js.map

@@ -1 +1 @@
-{"version":3,"file":"mask.js","sourceRoot":"","sources":["../../src/errors/mask.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IACzC,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC5B,2DAA2D;IAC3D,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IACzC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrD,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,MAAM,IAAI,oBAAoB;QAAE,OAAO,MAAM,CAAC;IACzD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,GAAG,iBAAiB,CAAC;AACrE,CAAC"}
+{"version":3,"file":"mask.js","sourceRoot":"","sources":["../../src/errors/mask.ts"],"names":[],"mappings":"AAgBA,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC;AASzC,MAAM,UAAU,eAAe,CAAC,KAAa;IACzC,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAE5B,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;AACjE,CAAC;AAWD,MAAM,UAAU,eAAe,CAAC,KAAa;IACzC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrD,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,MAAM,IAAI,oBAAoB;QAAE,OAAO,MAAM,CAAC;IACzD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,GAAG,iBAAiB,CAAC;AACrE,CAAC"}

package/dist/errors/redact-credentials.d.ts

@@ -0,0 +1,2 @@
+export declare function redactCredentials(input: string): string;
+//# sourceMappingURL=redact-credentials.d.ts.map

package/dist/errors/redact-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-credentials.d.ts","sourceRoot":"","sources":["../../src/errors/redact-credentials.ts"],"names":[],"mappings":"AAgCA,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQvD"}

package/dist/errors/redact-credentials.js

@@ -0,0 +1,13 @@
+import { maskBearerToken } from './mask.js';
+const URL_CREDENTIALS = /([a-z][a-z0-9+.\-]*:\/\/)[^/\s@]+@/gi;
+const BASIC_CREDENTIAL = /Basic\s+[A-Za-z0-9+/=]+/g;
+const SECRET_REFERENCE = /op:\/\/[^\s'"]+/g;
+export function redactCredentials(input) {
+    if (input === '')
+        return '';
+    return maskBearerToken(input
+        .replace(URL_CREDENTIALS, '$1***:***@')
+        .replace(BASIC_CREDENTIAL, 'Basic ***masked***')
+        .replace(SECRET_REFERENCE, 'op://***redacted***'));
+}
+//# sourceMappingURL=redact-credentials.js.map

package/dist/errors/redact-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-credentials.js","sourceRoot":"","sources":["../../src/errors/redact-credentials.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAG5C,MAAM,eAAe,GAAG,sCAAsC,CAAC;AAG/D,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AAOpD,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAE5C,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC3C,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC5B,OAAO,eAAe,CAClB,KAAK;SACA,OAAO,CAAC,eAAe,EAAE,YAAY,CAAC;SACtC,OAAO,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;SAC/C,OAAO,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,CACxD,CAAC;AACN,CAAC"}

package/dist/errors/sanitize.d.ts

@@ -1,31 +1,2 @@
-/**
- * `sanitizeSecrets` — recursive value-walker that swaps any value at a
- * known-secret key for the sentinel `[REDACTED]`.
- *
- * Wave G.6.4. Pattern ported verbatim from
- * `apimapper-mcp/src/modules/apimapper/credential-sanitizer.ts` because
- * it's the same defense-in-depth shape and the apimapper version is
- * audit-hardened (A4 round 1 + 2).
- *
- * Used on both the error-path (RestError.body excerpts) AND the
- * success-path (jsonResult / structuredResult payloads in
- * `tool-builder.ts`) so a regressing REST handler — or a logging path —
- * can never leak `oauth_refresh_token` / `auth_data` / `bearer` etc.
- * into the LLM's context.
- *
- * Key-list intentionally mirrors apimapper-mcp; review both together
- * when extending.
- *
- * @license MIT
- */
-/**
- * Recursively walk any JSON-serialisable value and redact any nested
- * value whose key matches a known-secret name. Returns a fresh tree —
- * the input is never mutated.
- *
- * Primitives (string / number / boolean / null / undefined) pass through
- * unchanged. Arrays are mapped element-wise. Objects are reconstructed
- * with `[REDACTED]` substituted at any secret key.
- */
 export declare function sanitizeSecrets<T>(input: T): T;
 //# sourceMappingURL=sanitize.d.ts.map

package/dist/errors/sanitize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../src/errors/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAuDH;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAgB9C"}
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../src/errors/sanitize.ts"],"names":[],"mappings":"AAmFA,wBAAgB,eAAe,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAgB9C"}

package/dist/errors/sanitize.js

@@ -1,40 +1,16 @@
-/**
- * `sanitizeSecrets` — recursive value-walker that swaps any value at a
- * known-secret key for the sentinel `[REDACTED]`.
- *
- * Wave G.6.4. Pattern ported verbatim from
- * `apimapper-mcp/src/modules/apimapper/credential-sanitizer.ts` because
- * it's the same defense-in-depth shape and the apimapper version is
- * audit-hardened (A4 round 1 + 2).
- *
- * Used on both the error-path (RestError.body excerpts) AND the
- * success-path (jsonResult / structuredResult payloads in
- * `tool-builder.ts`) so a regressing REST handler — or a logging path —
- * can never leak `oauth_refresh_token` / `auth_data` / `bearer` etc.
- * into the LLM's context.
- *
- * Key-list intentionally mirrors apimapper-mcp; review both together
- * when extending.
- *
- * @license MIT
- */
 const SECRET_KEYS = new Set([
-    // Generic auth tokens
     'token',
     'bearer',
     'bearer_token',
     'bearerToken',
-    // Plugin-internal auth blob
     'auth_data',
     'authData',
-    // OAuth flows
     'oauth_refresh_token',
     'oauthRefreshToken',
     'refresh_token',
     'refreshToken',
     'access_token',
     'accessToken',
-    // App-secret pairs
     'client_secret',
     'clientSecret',
     'api_key',
@@ -44,7 +20,6 @@ const SECRET_KEYS = new Set([
     'secrets',
     'raw_secret',
     'rawSecret',
-    // Defense-in-depth additions (cf. apimapper A4 audit round 2)
     'private_key',
     'privateKey',
     'signing_key',
@@ -59,26 +34,11 @@ const SECRET_KEYS = new Set([
     'sessionToken',
     'id_token',
     'idToken',
-    // W12-R1.3 (A2-M2) — 1Password Secret References are not secrets
-    // per se (the ref string itself is safe to log), BUT they identify
-    // the vault path + item + field of a real bearer. Surfacing them
-    // verbatim in an error payload that ends up in a Discord paste, a
-    // GitHub issue, or an LLM-shared transcript leaks the production
-    // 1Password layout to anyone reading. Treat as secret to be safe.
     'bearer_ref',
     'bearerRef',
     'token_ref',
     'tokenRef',
 ]);
-/**
- * Recursively walk any JSON-serialisable value and redact any nested
- * value whose key matches a known-secret name. Returns a fresh tree —
- * the input is never mutated.
- *
- * Primitives (string / number / boolean / null / undefined) pass through
- * unchanged. Arrays are mapped element-wise. Objects are reconstructed
- * with `[REDACTED]` substituted at any secret key.
- */
 export function sanitizeSecrets(input) {
     if (Array.isArray(input)) {
         return input.map((item) => sanitizeSecrets(item));

package/dist/errors/sanitize.js.map

@@ -1 +1 @@
-{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../src/errors/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS;IAChC,sBAAsB;IACtB,OAAO;IACP,QAAQ;IACR,cAAc;IACd,aAAa;IACb,4BAA4B;IAC5B,WAAW;IACX,UAAU;IACV,cAAc;IACd,qBAAqB;IACrB,mBAAmB;IACnB,eAAe;IACf,cAAc;IACd,cAAc;IACd,aAAa;IACb,mBAAmB;IACnB,eAAe;IACf,cAAc;IACd,SAAS;IACT,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,SAAS;IACT,YAAY;IACZ,WAAW;IACX,8DAA8D;IAC9D,aAAa;IACb,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,gBAAgB;IAChB,eAAe;IACf,iBAAiB;IACjB,gBAAgB;IAChB,cAAc;IACd,aAAa;IACb,eAAe;IACf,cAAc;IACd,UAAU;IACV,SAAS;IACT,iEAAiE;IACjE,mEAAmE;IACnE,iEAAiE;IACjE,kEAAkE;IAClE,iEAAiE;IACjE,kEAAkE;IAClE,YAAY;IACZ,WAAW;IACX,WAAW;IACX,UAAU;CACb,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAI,KAAQ;IACvC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAiB,CAAC;IACtE,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACpE,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,GAAG,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACJ,GAAG,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;YAChC,CAAC;QACL,CAAC;QACD,OAAO,GAAmB,CAAC;IAC/B,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC"}
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../src/errors/sanitize.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS;IAEhC,OAAO;IACP,QAAQ;IACR,cAAc;IACd,aAAa;IAEb,WAAW;IACX,UAAU;IAEV,qBAAqB;IACrB,mBAAmB;IACnB,eAAe;IACf,cAAc;IACd,cAAc;IACd,aAAa;IAEb,eAAe;IACf,cAAc;IACd,SAAS;IACT,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,SAAS;IACT,YAAY;IACZ,WAAW;IAEX,aAAa;IACb,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,gBAAgB;IAChB,eAAe;IACf,iBAAiB;IACjB,gBAAgB;IAChB,cAAc;IACd,aAAa;IACb,eAAe;IACf,cAAc;IACd,UAAU;IACV,SAAS;IAOT,YAAY;IACZ,WAAW;IACX,WAAW;IACX,UAAU;CACb,CAAC,CAAC;AAWH,MAAM,UAAU,eAAe,CAAI,KAAQ;IACvC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAiB,CAAC;IACtE,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACpE,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,GAAG,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACJ,GAAG,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;YAChC,CAAC;QACL,CAAC;QACD,OAAO,GAAmB,CAAC;IAC/B,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC"}

package/dist/errors.d.ts

@@ -1,24 +1,7 @@
-/**
- * Error types for the YT Builder MCP package.
- *
- * `RestError` wraps non-2xx responses from the WP REST API with the
- * status, the canonical WP_Error `code` (if present) and the human
- * message. `ConfigError` is thrown when the server is missing
- * environment configuration.
- *
- * Wave G.6.3: `body` is routed through `sanitizeSecrets` at construction
- * time so any secret-bearing field returned by the upstream REST API
- * (e.g. WP_Error data carrying `auth_data` or `oauth_refresh_token`)
- * never lands in the LLM context — even if a future tool decides to
- * echo `error.body` somewhere.
- *
- * @license MIT
- */
 export interface RestErrorPayload {
     readonly status: number;
     readonly code?: string;
     readonly message: string;
-    /** Original parsed JSON body (or null if the body was not JSON). */
     readonly body: unknown;
 }
 export declare class RestError extends Error {
@@ -30,6 +13,12 @@ export declare class RestError extends Error {
 export declare class ConfigError extends Error {
     constructor(message: string);
 }
+export declare class RejectedConfigError extends ConfigError {
+    constructor(message: string);
+}
+export declare class NoDefaultSiteConfigError extends ConfigError {
+    constructor(message: string);
+}
 export interface NetworkErrorPayload {
     readonly cause: unknown;
     readonly url: string;

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,MAAM,WAAW,gBAAgB;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CAC1B;AAED,qBAAa,SAAU,SAAQ,KAAK;IAChC,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,IAAI,CAAC,EAAE,MAAM,CAAC;IAC9B,SAAgB,IAAI,EAAE,OAAO,CAAC;gBAElB,OAAO,EAAE,gBAAgB;CAUxC;AAED,qBAAa,WAAY,SAAQ,KAAK;gBACtB,OAAO,EAAE,MAAM;CAI9B;AAED,MAAM,WAAW,mBAAmB;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,YAAa,SAAQ,KAAK;IACnC,SAAgB,KAAK,EAAE,OAAO,CAAC;IAC/B,SAAgB,GAAG,EAAE,MAAM,CAAC;gBAEhB,OAAO,EAAE,mBAAmB;CAM3C"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,gBAAgB;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CAC1B;AAED,qBAAa,SAAU,SAAQ,KAAK;IAChC,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,IAAI,CAAC,EAAE,MAAM,CAAC;IAC9B,SAAgB,IAAI,EAAE,OAAO,CAAC;gBAElB,OAAO,EAAE,gBAAgB;CAUxC;AAED,qBAAa,WAAY,SAAQ,KAAK;gBACtB,OAAO,EAAE,MAAM;CAI9B;AAYD,qBAAa,mBAAoB,SAAQ,WAAW;gBACpC,OAAO,EAAE,MAAM;CAI9B;AAeD,qBAAa,wBAAyB,SAAQ,WAAW;gBACzC,OAAO,EAAE,MAAM;CAI9B;AAED,MAAM,WAAW,mBAAmB;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,YAAa,SAAQ,KAAK;IACnC,SAAgB,KAAK,EAAE,OAAO,CAAC;IAE/B,SAAgB,GAAG,EAAE,MAAM,CAAC;gBAEhB,OAAO,EAAE,mBAAmB;CAW3C"}

package/dist/errors.js

@@ -1,20 +1,5 @@
-/**
- * Error types for the YT Builder MCP package.
- *
- * `RestError` wraps non-2xx responses from the WP REST API with the
- * status, the canonical WP_Error `code` (if present) and the human
- * message. `ConfigError` is thrown when the server is missing
- * environment configuration.
- *
- * Wave G.6.3: `body` is routed through `sanitizeSecrets` at construction
- * time so any secret-bearing field returned by the upstream REST API
- * (e.g. WP_Error data carrying `auth_data` or `oauth_refresh_token`)
- * never lands in the LLM context — even if a future tool decides to
- * echo `error.body` somewhere.
- *
- * @license MIT
- */
 import { sanitizeSecrets } from './errors/sanitize.js';
+import { redactCredentials } from './errors/redact-credentials.js';
 export class RestError extends Error {
     status;
     code;
@@ -24,9 +9,6 @@ export class RestError extends Error {
         this.name = 'RestError';
         this.status = payload.status;
         this.code = payload.code;
-        // Deep-walk redaction at construction time (Wave G.6.3). The
-        // input body is never mutated; sanitizeSecrets returns a fresh
-        // tree with redacted secret-keys.
         this.body = sanitizeSecrets(payload.body);
     }
 }
@@ -36,14 +18,27 @@ export class ConfigError extends Error {
         this.name = 'ConfigError';
     }
 }
+export class RejectedConfigError extends ConfigError {
+    constructor(message) {
+        super(message);
+        this.name = 'RejectedConfigError';
+    }
+}
+export class NoDefaultSiteConfigError extends ConfigError {
+    constructor(message) {
+        super(message);
+        this.name = 'NoDefaultSiteConfigError';
+    }
+}
 export class NetworkError extends Error {
     cause;
     url;
     constructor(payload) {
-        super(`Network error contacting ${payload.url}: ${describeCause(payload.cause)}`);
+        const url = redactCredentials(payload.url);
+        super(`Network error contacting ${url}: ${redactCredentials(describeCause(payload.cause))}`);
         this.name = 'NetworkError';
         this.cause = payload.cause;
-        this.url = payload.url;
+        this.url = url;
     }
 }
 function describeCause(cause) {

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAUvD,MAAM,OAAO,SAAU,SAAQ,KAAK;IAChB,MAAM,CAAS;IACf,IAAI,CAAU;IACd,IAAI,CAAU;IAE9B,YAAY,OAAyB;QACjC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,6DAA6D;QAC7D,+DAA+D;QAC/D,kCAAkC;QAClC,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;CACJ;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IAClC,YAAY,OAAe;QACvB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC9B,CAAC;CACJ;AAOD,MAAM,OAAO,YAAa,SAAQ,KAAK;IACnB,KAAK,CAAU;IACf,GAAG,CAAS;IAE5B,YAAY,OAA4B;QACpC,KAAK,CAAC,4BAA4B,OAAO,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAC3B,CAAC;CACJ;AAED,SAAS,aAAa,CAAC,KAAc;IACjC,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;AACL,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAUnE,MAAM,OAAO,SAAU,SAAQ,KAAK;IAChB,MAAM,CAAS;IACf,IAAI,CAAU;IACd,IAAI,CAAU;IAE9B,YAAY,OAAyB;QACjC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAIzB,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;CACJ;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IAClC,YAAY,OAAe;QACvB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC9B,CAAC;CACJ;AAYD,MAAM,OAAO,mBAAoB,SAAQ,WAAW;IAChD,YAAY,OAAe;QACvB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACtC,CAAC;CACJ;AAeD,MAAM,OAAO,wBAAyB,SAAQ,WAAW;IACrD,YAAY,OAAe;QACvB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IAC3C,CAAC;CACJ;AAOD,MAAM,OAAO,YAAa,SAAQ,KAAK;IACnB,KAAK,CAAU;IAEf,GAAG,CAAS;IAE5B,YAAY,OAA4B;QAKpC,MAAM,GAAG,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3C,KAAK,CAAC,4BAA4B,GAAG,KAAK,iBAAiB,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7F,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACnB,CAAC;CACJ;AAED,SAAS,aAAa,CAAC,KAAc;IACjC,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;AACL,CAAC"}

package/dist/gateway/advanced-read-tool.d.ts

@@ -1,37 +1,5 @@
-/**
- * `yootheme_builder_advanced_read` — a READ-ONLY sibling of the
- * `yootheme_builder_advanced` gateway (F200a, 2026-06-12).
- *
- * The Desktop-E2E #2 forensic showed approval-gates firing on EVERY advanced
- * call. Root cause: the single `yootheme_builder_advanced` gateway is annotated
- * `readOnlyHint:false` + `destructiveHint:true` (correctly — it can route into
- * delete / unbind handlers), so spec-compliant MCP hosts gate it
- * conservatively. The read-only L2 subtools (page_get_schema,
- * element_get_binding, inspect_sublayout) inherited that gate even though they
- * mutate nothing — a per-call approval tax on pure inspection.
- *
- * This second gateway WHITELISTS only read-only advanced entries (annotation
- * `readOnlyHint:true`) and is itself annotated `readOnly()`, so hosts can
- * auto-allow it. Writing subtools (unbind, clean-implode) stay reachable ONLY
- * through the existing (gated) `yootheme_builder_advanced` — defense-in-depth:
- * the read gateway physically cannot route to them (they are not in its
- * registry view).
- *
- * Two modes mirror the write gateway:
- *   { tool }            → discovery (target schema + annotations; no invoke).
- *   { tool, arguments } → execution (strict-validated, then handler called).
- *
- * @license MIT
- */
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { AdvancedToolEntry } from './capturing-server.js';
-/** The pinned name — never rename (host configs + skill docs reference it). */
 export declare const ADVANCED_READ_TOOL_NAME = "yootheme_builder_advanced_read";
-/**
- * Registers `yootheme_builder_advanced_read` on the real McpServer.
- *
- * @param realServer       the McpServer that exposes the read gateway tool
- * @param advancedRegistry the captured non-essential tools (from CapturingServer)
- */
 export declare function registerAdvancedReadTool(realServer: McpServer, advancedRegistry: Map<string, AdvancedToolEntry>): void;
 //# sourceMappingURL=advanced-read-tool.d.ts.map

package/dist/gateway/advanced-read-tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"advanced-read-tool.d.ts","sourceRoot":"","sources":["../../src/gateway/advanced-read-tool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAMzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAM/D,+EAA+E;AAC/E,eAAO,MAAM,uBAAuB,mCAAmC,CAAC;AA0ExE;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACpC,UAAU,EAAE,SAAS,EACrB,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,GACjD,IAAI,CA0EN"}
+{"version":3,"file":"advanced-read-tool.d.ts","sourceRoot":"","sources":["../../src/gateway/advanced-read-tool.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAOzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAY/D,eAAO,MAAM,uBAAuB,mCAAmC,CAAC;AA+ExE,wBAAgB,wBAAwB,CACpC,UAAU,EAAE,SAAS,EACrB,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,GACjD,IAAI,CA2GN"}