@wootsup/yt-builder-mcp 1.2.0 → 1.4.0

package/dist/net/proxy-dispatcher.js

@@ -0,0 +1,65 @@
+// packages/mcp/src/net/proxy-dispatcher.ts
+import { EnvHttpProxyAgent, setGlobalDispatcher as undiciSetGlobalDispatcher } from 'undici';
+import { deriveNoProxyForInternalSite } from './internal-host.js';
+/** Is any forward-proxy configured in the environment? */
+function hasProxyConfigured(env) {
+    return Boolean(env.HTTPS_PROXY ?? env.https_proxy ?? env.HTTP_PROXY ?? env.http_proxy);
+}
+/**
+ * Install a process-global undici dispatcher that honors the enterprise
+ * `HTTP_PROXY` / `HTTPS_PROXY` / `NO_PROXY` environment variables at request
+ * time (undici's {@link EnvHttpProxyAgent}).
+ *
+ * Why this exists: Node's global `fetch` only auto-honors proxy env vars from
+ * **Node 24** (`NODE_USE_ENV_PROXY`). On the Node 18–23 floor this package
+ * supports, an enterprise forward/auth proxy is otherwise ignored and outbound
+ * MCP traffic silently fails. Node's global `fetch` reads the global dispatcher,
+ * and so does the MCP SDK's `StreamableHTTPClientTransport` (proxy mode) and the
+ * fat-mode `RestClient` — so one global dispatcher covers every outbound call.
+ *
+ * Installed ONLY when a forward proxy is actually configured
+ * (`HTTP_PROXY`/`HTTPS_PROXY`). With no proxy env, the default dispatcher (a
+ * direct connection) is already correct, so we skip — this also avoids undici's
+ * `EnvHttpProxyAgent is experimental` startup warning for the common, direct
+ * case. Corporate TLS-inspection root CAs are handled separately by Node's
+ * native `NODE_EXTRA_CA_CERTS` (undici's default connector honors it).
+ *
+ * Never throws: a failure to install (exotic runtime, frozen global) degrades
+ * to a stderr warning and a direct connection, returning `false`.
+ *
+ * @returns `true` if the dispatcher was installed, `false` if skipped/degraded.
+ */
+export function installGlobalProxyDispatcher(deps = {}) {
+    const env = deps.env ?? process.env;
+    if (!hasProxyConfigured(env)) {
+        // No proxy to honor — leave the default (direct) dispatcher in place.
+        return false;
+    }
+    const setDispatcher = deps.setGlobalDispatcher ?? undiciSetGlobalDispatcher;
+    const makeAgent = deps.makeEnvHttpProxyAgent ?? (() => new EnvHttpProxyAgent());
+    const warn = deps.stderr ?? ((message) => console.error(message));
+    // Glöckle gap #9 — when the configured site is INTERNAL (RFC1918 / .local /
+    // bare hostname / loopback), make sure its host is in NO_PROXY so intranet
+    // traffic bypasses the corporate proxy. Idempotent + non-clobbering: the
+    // operator's NO_PROXY is preserved verbatim, the host is only appended.
+    // We mutate `env` BEFORE constructing the agent because EnvHttpProxyAgent
+    // snapshots NO_PROXY at construction. Public hosts are never touched.
+    const noProxy = deriveNoProxyForInternalSite({ env, siteUrl: env.YTB_MCP_SITE_URL });
+    if (noProxy.changed && noProxy.noProxy !== undefined) {
+        // Set BOTH cases so undici reads it regardless of which it prefers.
+        env.NO_PROXY = noProxy.noProxy;
+        env.no_proxy = noProxy.noProxy;
+        warn(`[yt-builder-mcp] internal site host "${noProxy.addedHost ?? ''}" added to NO_PROXY so it bypasses the configured proxy.`);
+    }
+    try {
+        setDispatcher(makeAgent());
+        return true;
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        // stderr only — stdout is the JSON-RPC channel in stdio transport.
+        warn(`[yt-builder-mcp] proxy dispatcher init failed (continuing with a direct connection): ${message}`);
+        return false;
+    }
+}
+//# sourceMappingURL=proxy-dispatcher.js.map

package/dist/net/proxy-dispatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-dispatcher.js","sourceRoot":"","sources":["../../src/net/proxy-dispatcher.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,IAAI,yBAAyB,EAAmB,MAAM,QAAQ,CAAC;AAE9G,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAgBlE,0DAA0D;AAC1D,SAAS,kBAAkB,CAAC,GAAsB;IAC9C,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAA4B,EAAE;IACvE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,sEAAsE;QACtE,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,IAAI,yBAAyB,CAAC;IAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,qBAAqB,IAAI,CAAC,GAAe,EAAE,CAAC,IAAI,iBAAiB,EAAE,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,OAAe,EAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAEhF,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,OAAO,GAAG,4BAA4B,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACrF,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnD,oEAAoE;QACpE,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,wCAAwC,OAAO,CAAC,SAAS,IAAI,EAAE,0DAA0D,CAAC,CAAC;IACpI,CAAC;IAED,IAAI,CAAC;QACD,aAAa,CAAC,SAAS,EAAE,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,mEAAmE;QACnE,IAAI,CAAC,wFAAwF,OAAO,EAAE,CAAC,CAAC;QACxG,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC"}

package/dist/proxy/bridge.d.ts

@@ -0,0 +1,43 @@
+import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';
+/**
+ * Wire two MCP transports into a transparent pipe: every message from one side
+ * is relayed verbatim to the other, and a close/error on either side tears down
+ * the other. No transformation — the PHP server owns the protocol semantics.
+ * The caller is responsible for start()ing both transports.
+ *
+ * `StreamableHTTPClientTransport.send()` re-throws on any upstream failure
+ * (401/5xx/connection refused / missing PHP endpoint). The forwarders MUST NOT
+ * fire-and-forget that rejection: an unhandled rejection crashes the Node
+ * process, so a wrong key / unreachable site would kill the proxy on the first
+ * `initialize` instead of surfacing an actionable error. Each direction
+ * therefore `.catch()`es its `send()`.
+ */
+export declare function bridgeTransports(local: Transport, remote: Transport): void;
+/** Config the proxy run needs: the upstream endpoint, the Bearer, and any
+ * corporate extra headers (Glöckle gap #14) to attach to every upstream
+ * request. The Bearer always wins on collision. */
+interface ProxyConfig {
+    endpointUrl: URL;
+    token: string;
+    /** Extra headers from `YTB_MCP_EXTRA_HEADERS` (Basic-Auth / WAF / gateway). */
+    extraHeaders?: Record<string, string>;
+}
+/**
+ * Build the upstream `requestInit.headers` for proxy mode: the Bearer is
+ * authoritative; corporate extra headers (Glöckle gap #14) only fill gaps —
+ * `Authorization` can NEVER be overwritten. Exported for unit tests.
+ */
+export declare function buildProxyRequestHeaders(config: ProxyConfig): Record<string, string>;
+/** Build the real transports + bridge them; resolves when EITHER side closes. */
+export declare function runProxy(config: ProxyConfig, deps?: {
+    makeTransports?: (c: ProxyConfig) => {
+        local: Transport;
+        remote: Transport;
+    };
+}): Promise<void>;
+/** Returns true if proxy mode handled the run; false → caller continues with fat. */
+export declare function maybeRunProxy(env: NodeJS.ProcessEnv, deps?: {
+    runProxy?: (c: ProxyConfig) => Promise<void>;
+}): Promise<boolean>;
+export {};
+//# sourceMappingURL=bridge.d.ts.map

package/dist/proxy/bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../../src/proxy/bridge.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AA+B/E;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,GAAG,IAAI,CAoD1E;AAED;;mDAEmD;AACnD,UAAU,WAAW;IACnB,WAAW,EAAE,GAAG,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAKpF;AAcD,iFAAiF;AACjF,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,WAAW,EACnB,IAAI,GAAE;IACJ,cAAc,CAAC,EAAE,CAAC,CAAC,EAAE,WAAW,KAAK;QACnC,KAAK,EAAE,SAAS,CAAC;QACjB,MAAM,EAAE,SAAS,CAAC;KACnB,CAAC;CACE,GACL,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,qFAAqF;AACrF,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAO,GAC1D,OAAO,CAAC,OAAO,CAAC,CAalB"}

package/dist/proxy/bridge.js

@@ -0,0 +1,155 @@
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import { resolveMode } from './mode.js';
+import { diagnoseNetworkError } from '../diagnostics/diagnose-network-error.js';
+import { mergeExtraHeaders, parseExtraHeaders } from '../net/extra-headers.js';
+/** Narrow an unknown caught value to a human-readable message (no `any`). */
+function errorMessage(err) {
+    if (err instanceof Error)
+        return err.message;
+    if (typeof err === 'string')
+        return err;
+    try {
+        return String(err);
+    }
+    catch {
+        return 'unknown error';
+    }
+}
+/**
+ * A forwarded message is request-shaped (and therefore answerable with a
+ * JSON-RPC error) iff it carries a non-null `id`. Notifications have no `id`.
+ */
+function requestId(msg) {
+    if (msg !== null && typeof msg === 'object' && 'id' in msg) {
+        const id = msg.id;
+        if (typeof id === 'string' || typeof id === 'number')
+            return id;
+    }
+    return null;
+}
+/**
+ * Wire two MCP transports into a transparent pipe: every message from one side
+ * is relayed verbatim to the other, and a close/error on either side tears down
+ * the other. No transformation — the PHP server owns the protocol semantics.
+ * The caller is responsible for start()ing both transports.
+ *
+ * `StreamableHTTPClientTransport.send()` re-throws on any upstream failure
+ * (401/5xx/connection refused / missing PHP endpoint). The forwarders MUST NOT
+ * fire-and-forget that rejection: an unhandled rejection crashes the Node
+ * process, so a wrong key / unreachable site would kill the proxy on the first
+ * `initialize` instead of surfacing an actionable error. Each direction
+ * therefore `.catch()`es its `send()`.
+ */
+export function bridgeTransports(local, remote) {
+    local.onmessage = (msg) => {
+        remote.send(msg).catch((err) => {
+            const message = errorMessage(err);
+            // Turn an opaque transport failure (TLS-inspection CA, proxy, DNS,
+            // timeout) into an actionable hint — the Glöckle stress-test died with a
+            // 30s timeout that looked like an auth problem. Falls back to the generic
+            // config hint when the cause is not recognised.
+            const diag = diagnoseNetworkError(err);
+            const hint = diag !== null ? `${diag.summary} Fix: ${diag.fix}` : 'Check YTB_MCP_SITE_URL / YTB_MCP_BEARER_TOKEN.';
+            // stderr only — stdout is the JSON-RPC channel.
+            console.error('[yt-builder-proxy] upstream send failed:', message + (diag !== null ? `\n  → ${diag.fix}` : ''));
+            const id = requestId(msg);
+            if (id !== null) {
+                // Hand the client an actionable error instead of a dead pipe.
+                const frame = {
+                    jsonrpc: '2.0',
+                    id,
+                    error: {
+                        code: -32000,
+                        message: `Proxy upstream error: ${message}. ${hint}`,
+                    },
+                };
+                local.send(frame).catch((sendErr) => {
+                    console.error('[yt-builder-proxy] failed to deliver error frame:', errorMessage(sendErr));
+                });
+            }
+            else {
+                // A notification has no id to answer — tear the pipe down instead.
+                void remote.close();
+            }
+        });
+    };
+    remote.onmessage = (msg) => {
+        local.send(msg).catch((err) => {
+            console.error('[yt-builder-proxy] downstream send failed:', errorMessage(err));
+        });
+    };
+    local.onclose = () => {
+        void remote.close();
+    };
+    remote.onclose = () => {
+        void local.close();
+    };
+    local.onerror = (err) => {
+        console.error('[yt-builder-proxy] local transport error:', err.message);
+    };
+    remote.onerror = (err) => {
+        console.error('[yt-builder-proxy] remote transport error:', err.message);
+    };
+}
+/**
+ * Build the upstream `requestInit.headers` for proxy mode: the Bearer is
+ * authoritative; corporate extra headers (Glöckle gap #14) only fill gaps —
+ * `Authorization` can NEVER be overwritten. Exported for unit tests.
+ */
+export function buildProxyRequestHeaders(config) {
+    const base = { Authorization: `Bearer ${config.token}` };
+    return config.extraHeaders !== undefined && Object.keys(config.extraHeaders).length > 0
+        ? mergeExtraHeaders(base, config.extraHeaders)
+        : base;
+}
+/** Injection seam for tests — production builds the real SDK transports. */
+function defaultTransports(config) {
+    const remote = new StreamableHTTPClientTransport(config.endpointUrl, {
+        requestInit: { headers: buildProxyRequestHeaders(config) },
+    });
+    const local = new StdioServerTransport();
+    return { local, remote };
+}
+/** Build the real transports + bridge them; resolves when EITHER side closes. */
+export async function runProxy(config, deps = {}) {
+    const { local, remote } = (deps.makeTransports ?? defaultTransports)(config);
+    // Resolve the moment EITHER transport closes — never hang if the remote
+    // (upstream) drops first. Capture the bridge's own onclose handlers so the
+    // cross-teardown wiring still runs.
+    const closed = new Promise((resolve) => {
+        bridgeTransports(local, remote);
+        const prevLocalClose = local.onclose;
+        const prevRemoteClose = remote.onclose;
+        local.onclose = () => {
+            prevLocalClose?.();
+            resolve();
+        };
+        remote.onclose = () => {
+            prevRemoteClose?.();
+            resolve();
+        };
+    });
+    // Start LOCAL (stdio) first so the listener is installed before any client
+    // message can race in; only then open the upstream connection.
+    await local.start();
+    await remote.start();
+    await closed;
+}
+/** Returns true if proxy mode handled the run; false → caller continues with fat. */
+export async function maybeRunProxy(env, deps = {}) {
+    const resolved = resolveMode(env);
+    if (resolved.mode !== 'proxy')
+        return false;
+    const run = deps.runProxy ?? runProxy;
+    // Glöckle gap #14 — attach corporate extra headers (Basic-Auth / WAF / gateway)
+    // to every upstream request. parseExtraHeaders reads YTB_MCP_EXTRA_HEADERS.
+    const { headers: extraHeaders } = parseExtraHeaders(env);
+    await run({
+        endpointUrl: resolved.endpointUrl,
+        token: resolved.token,
+        ...(Object.keys(extraHeaders).length > 0 ? { extraHeaders } : {}),
+    });
+    return true;
+}
+//# sourceMappingURL=bridge.js.map

package/dist/proxy/bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../../src/proxy/bridge.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE/E,6EAA6E;AAC7E,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,eAAe,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC;QAC3D,MAAM,EAAE,GAAI,GAAuB,CAAC,EAAE,CAAC;QACvC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAgB,EAAE,MAAiB;IAClE,KAAK,CAAC,SAAS,GAAG,CAAC,GAAG,EAAE,EAAE;QACxB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtC,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YAClC,mEAAmE;YACnE,yEAAyE;YACzE,0EAA0E;YAC1E,gDAAgD;YAChD,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,gDAAgD,CAAC;YACnH,gDAAgD;YAChD,OAAO,CAAC,KAAK,CACX,0CAA0C,EAC1C,OAAO,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACrD,CAAC;YACF,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,8DAA8D;gBAC9D,MAAM,KAAK,GAAG;oBACZ,OAAO,EAAE,KAAK;oBACd,EAAE;oBACF,KAAK,EAAE;wBACL,IAAI,EAAE,CAAC,KAAK;wBACZ,OAAO,EAAE,yBAAyB,OAAO,KAAK,IAAI,EAAE;qBACrD;iBACF,CAAC;gBACF,KAAK,CAAC,IAAI,CAAC,KAAkC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAgB,EAAE,EAAE;oBACxE,OAAO,CAAC,KAAK,CAAC,mDAAmD,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC5F,CAAC,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,mEAAmE;gBACnE,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;YACtB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,MAAM,CAAC,SAAS,GAAG,CAAC,GAAG,EAAE,EAAE;QACzB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACrC,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;QACjF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,KAAK,CAAC,OAAO,GAAG,GAAG,EAAE;QACnB,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC,CAAC;IACF,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE;QACpB,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC,CAAC;IACF,KAAK,CAAC,OAAO,GAAG,CAAC,GAAG,EAAE,EAAE;QACtB,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1E,CAAC,CAAC;IACF,MAAM,CAAC,OAAO,GAAG,CAAC,GAAG,EAAE,EAAE;QACvB,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3E,CAAC,CAAC;AACJ,CAAC;AAYD;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAmB;IAC1D,MAAM,IAAI,GAA2B,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;IACjF,OAAO,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC;QACrF,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,CAAC;QAC9C,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,4EAA4E;AAC5E,SAAS,iBAAiB,CAAC,MAAmB;IAI5C,MAAM,MAAM,GAAG,IAAI,6BAA6B,CAAC,MAAM,CAAC,WAAW,EAAE;QACnE,WAAW,EAAE,EAAE,OAAO,EAAE,wBAAwB,CAAC,MAAM,CAAC,EAAE;KAC3D,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,oBAAoB,EAAE,CAAC;IACzC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,MAAmB,EACnB,OAKI,EAAE;IAEN,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;IAE7E,wEAAwE;IACxE,2EAA2E;IAC3E,oCAAoC;IACpC,MAAM,MAAM,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAC3C,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAChC,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC;QACrC,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC;QACvC,KAAK,CAAC,OAAO,GAAG,GAAG,EAAE;YACnB,cAAc,EAAE,EAAE,CAAC;YACnB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE;YACpB,eAAe,EAAE,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACpB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACrB,MAAM,MAAM,CAAC;AACf,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAsB,EACtB,OAAyD,EAAE;IAE3D,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;IACtC,gFAAgF;IAChF,4EAA4E;IAC5E,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACzD,MAAM,GAAG,CAAC;QACR,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/proxy/mode.d.ts

@@ -0,0 +1,10 @@
+export type ModeResolution = {
+    mode: 'fat';
+} | {
+    mode: 'proxy';
+    endpointUrl: URL;
+    token: string;
+};
+/** Resolve the MCP run mode from the environment. Default is the legacy fat path. */
+export declare function resolveMode(env: NodeJS.ProcessEnv): ModeResolution;
+//# sourceMappingURL=mode.d.ts.map

package/dist/proxy/mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mode.d.ts","sourceRoot":"","sources":["../../src/proxy/mode.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GACf;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,GAAG,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvD,qFAAqF;AACrF,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,cAAc,CAqBlE"}

package/dist/proxy/mode.js

@@ -0,0 +1,20 @@
+/** Resolve the MCP run mode from the environment. Default is the legacy fat path. */
+export function resolveMode(env) {
+    if (env.YTB_MCP_MODE !== 'proxy') {
+        return { mode: 'fat' };
+    }
+    const token = env.YTB_MCP_BEARER_TOKEN?.trim();
+    if (!token) {
+        throw new Error('Proxy mode requires YTB_MCP_BEARER_TOKEN (the ytb_* MCP key).');
+    }
+    const override = env.YTB_MCP_MCP_URL?.trim();
+    const site = env.YTB_MCP_SITE_URL?.trim();
+    if (!override && !site) {
+        throw new Error('Proxy mode requires YTB_MCP_SITE_URL (or YTB_MCP_MCP_URL override).');
+    }
+    const endpointUrl = override
+        ? new URL(override)
+        : new URL(`${site.replace(/\/+$/, '')}/wp-json/yt-builder-mcp/mcp`);
+    return { mode: 'proxy', endpointUrl, token };
+}
+//# sourceMappingURL=mode.js.map

package/dist/proxy/mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mode.js","sourceRoot":"","sources":["../../src/proxy/mode.ts"],"names":[],"mappings":"AAIA,qFAAqF;AACrF,MAAM,UAAU,WAAW,CAAC,GAAsB;IAChD,IAAI,GAAG,CAAC,YAAY,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC;IAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,WAAW,GAAG,QAAQ;QAC1B,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC;QACnB,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,IAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,6BAA6B,CAAC,CAAC;IAEvE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAC/C,CAAC"}

package/dist/server.d.ts

@@ -23,9 +23,11 @@
  *        Registered LAST on the real server, after every L1/L2 tool is
  *        placed and the advanced registry is final.
  *
- * Result: `tools/list.length === 23` (20 L1 + 2 L3 + 1 gateway), and the
- * full callable tool surface is 30 (23 advertised + 7 advanced reachable
- * through the gateway).
+ * Result: `tools/list.length === 26` (23 L1 + 2 L3 + 1 gateway), and the
+ * full callable tool surface is 30 (26 advertised + 4 advanced reachable
+ * through the gateway). F116 (2026-06-11) promoted the bind→save→publish
+ * chain (element_bind_source / page_save / page_publish) L2 → L1, so the
+ * advertised surface grew 23 → 26 and the advanced lane shrank 7 → 4.
  *
  * @license MIT
  */

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAMH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAIpE,OAAO,EAAE,eAAe,EAAsB,MAAM,+BAA+B,CAAC;AAEpF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AASxD,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEtE,eAAO,MAAM,WAAW,4BAA4B,CAAC;AA4BrD,eAAO,MAAM,cAAc,QAAuB,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,oBAAoB,CAAC;AAEpD,iEAAiE;AACjE,eAAO,MAAM,mBAAmB,+BAA+B,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,0BAA0B,QAGsB,CAAC;AAE9D,mDAAmD;AACnD,eAAO,MAAM,wBAAwB,qBAAqB,CAAC;AAE3D;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,SAAS,gBAAgB,EAAE,CAAC;CAC/C;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,WAAW,GAAG,QAAQ,GAAG,MAAM,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CACrC,QAAQ,EAAE,YAAY,GACvB,oBAAoB,CAmBtB;AAED,MAAM,WAAW,mBAAmB;IAChC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,aAAa;IAC1B,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,gFAAgF;IAChF,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IAC1C,qEAAqE;IACrE,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;CACvC;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,aAAa,CAuIxE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAMH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAKpE,OAAO,EAAE,eAAe,EAAsB,MAAM,+BAA+B,CAAC;AAEpF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AASxD,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEtE,eAAO,MAAM,WAAW,4BAA4B,CAAC;AA4BrD,eAAO,MAAM,cAAc,QAAuB,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,oBAAoB,CAAC;AAEpD,iEAAiE;AACjE,eAAO,MAAM,mBAAmB,+BAA+B,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,0BAA0B,QAGsB,CAAC;AAE9D,mDAAmD;AACnD,eAAO,MAAM,wBAAwB,qBAAqB,CAAC;AAE3D;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,SAAS,gBAAgB,EAAE,CAAC;CAC/C;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,WAAW,GAAG,QAAQ,GAAG,MAAM,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CACrC,QAAQ,EAAE,YAAY,GACvB,oBAAoB,CAmBtB;AAED,MAAM,WAAW,mBAAmB;IAChC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,aAAa;IAC1B,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,gFAAgF;IAChF,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IAC1C,qEAAqE;IACrE,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;CACvC;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,aAAa,CA+IxE"}

package/dist/server.js

@@ -23,9 +23,11 @@
  *        Registered LAST on the real server, after every L1/L2 tool is
  *        placed and the advanced registry is final.
  *
- * Result: `tools/list.length === 23` (20 L1 + 2 L3 + 1 gateway), and the
- * full callable tool surface is 30 (23 advertised + 7 advanced reachable
- * through the gateway).
+ * Result: `tools/list.length === 26` (23 L1 + 2 L3 + 1 gateway), and the
+ * full callable tool surface is 30 (26 advertised + 4 advanced reachable
+ * through the gateway). F116 (2026-06-11) promoted the bind→save→publish
+ * chain (element_bind_source / page_save / page_publish) L2 → L1, so the
+ * advertised surface grew 23 → 26 and the advanced lane shrank 7 → 4.
  *
  * @license MIT
  */
@@ -33,6 +35,7 @@ import { readFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { registerAdvancedReadTool } from './gateway/advanced-read-tool.js';
 import { registerAdvancedTool } from './gateway/advanced-tool.js';
 import { CapturingServer } from './gateway/capturing-server.js';
 import { isDirectTopLevel } from './gateway/essentials.js';
@@ -221,6 +224,13 @@ export function createServer(options) {
     }
     // Gateway — registered LAST so the advanced registry is final.
     registerAdvancedTool(mcp, capturing.getAdvancedRegistry());
+    // F200a — READ-ONLY gateway sibling. Routes ONLY the read-only L2 subtools
+    // (annotation readOnlyHint:true) and is itself readOnly-annotated, so MCP
+    // hosts auto-allow it instead of gating every advanced inspection call (the
+    // Desktop-E2E #2 per-call approval tax). Writing tools stay reachable only
+    // through the (gated) write gateway above. It does NOT capture or duplicate
+    // the L2 subtools — it shares the same advanced registry, read-filtered.
+    registerAdvancedReadTool(mcp, capturing.getAdvancedRegistry());
     return { mcp, tools, capturing };
 }
 /**

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAsB,MAAM,+BAA+B,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAG3D,OAAO,EACH,gBAAgB,EAChB,0BAA0B,EAC1B,wBAAwB,EACxB,mBAAmB,EACnB,kBAAkB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAuB,MAAM,kBAAkB,CAAC;AAEtE,MAAM,CAAC,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAErD;;;;;;;;;;;;GAYG;AACH,SAAS,kBAAkB;IACvB,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAC;IACxD,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CACX,mCAAmC,OAAO,sCAAsC,CACnF,CAAC;IACN,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,kBAAkB,EAAE,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AAEpD,iEAAiE;AACjE,MAAM,CAAC,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;AAEhE,wDAAwD;AACxD,MAAM,CAAC,MAAM,0BAA0B,GACnC,mEAAmE;IACnE,8DAA8D;IAC9D,yDAAyD,CAAC;AAE9D,mDAAmD;AACnD,MAAM,CAAC,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AA4B3D;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,yBAAyB,CACrC,QAAsB;IAEtB,MAAM,IAAI,GAAG,QAAQ,CAAC,cAAc,EAAE,CAAC;IACvC,OAAO;QACH,eAAe,EAAE,QAAQ,CAAC,aAAa,EAAE;QACzC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAoB,EAAE;YACtC,MAAM,QAAQ,GACV,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,aAAa,CAAC;YAC/C,MAAM,GAAG,GAAqE;gBAC1E,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,QAAQ;gBACR,UAAU,EAAE,GAAG,CAAC,UAAU;aAC7B,CAAC;YACF,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC1B,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;YAC1B,CAAC;YACD,OAAO,GAAG,CAAC;QACf,CAAC,CAAC;KACL,CAAC;AACN,CAAC;AAqBD,MAAM,UAAU,YAAY,CAAC,OAA4B;IACrD,mDAAmD;IACnD,EAAE;IACF,qEAAqE;IACrE,EAAE;IACF,oEAAoE;IACpE,iEAAiE;IACjE,mEAAmE;IACnE,qDAAqD;IACrD,EAAE;IACF,sDAAsD;IACtD,mEAAmE;IACnE,2DAA2D;IAC3D,EAAE;IACF,kEAAkE;IAClE,0DAA0D;IAC1D,EAAE;IACF,mEAAmE;IACnE,gEAAgE;IAChE,+DAA+D;IAC/D,6DAA6D;IAC7D,uDAAuD;IACvD,gDAAgD;IAChD,MAAM,YAAY,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE7D,MAAM,GAAG,GAAG,IAAI,SAAS,CACrB;QACI,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,cAAc;KAC1B,EACD;QACI,YAAY;KACf,CACJ,CAAC;IAEF,iEAAiE;IACjE,kEAAkE;IAClE,gEAAgE;IAChE,sDAAsD;IACtD,GAAG,CAAC,gBAAgB,CAChB,mBAAmB,EACnB,kBAAkB,EAClB;QACI,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,0BAA0B;QACvC,QAAQ,EAAE,wBAAwB;KACrC,EACD,KAAK,EAAE,GAAQ,EAAE,EAAE,CAAC,CAAC;QACjB,QAAQ,EAAE;YACN;gBACI,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;gBACnB,QAAQ,EAAE,wBAAwB;gBAClC,IAAI,EAAE,YAAY;aACrB;SACJ;KACJ,CAAC,CACL,CAAC;IAEF,mEAAmE;IACnE,EAAE;IACF,kEAAkE;IAClE,mEAAmE;IACnE,oEAAoE;IACpE,mEAAmE;IACnE,iEAAiE;IACjE,2DAA2D;IAC3D,EAAE;IACF,gDAAgD;IAChD,iEAAiE;IACjE,4DAA4D;IAC5D,iEAAiE;IACjE,UAAU;IACV,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;IACvC,GAAG,CAAC,gBAAgB,CAChB,mBAAmB,EACnB,kBAAkB,EAClB;QACI,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,0BAA0B;QACvC,QAAQ,EAAE,wBAAwB;KACrC,EACD,KAAK,EAAE,GAAQ,EAAE,EAAE,CAAC,CAAC;QACjB,QAAQ,EAAE;YACN;gBACI,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;gBACnB,QAAQ,EAAE,wBAAwB;gBAClC,IAAI,EAAE,IAAI,CAAC,SAAS,CAChB,yBAAyB,CAAC,QAAQ,CAAC,EACnC,IAAI,EACJ,CAAC,CACJ;aACJ;SACJ;KACJ,CAAC,CACL,CAAC;IAEF,kDAAkD;IAClD,EAAE;IACF,4DAA4D;IAC5D,kEAAkE;IAClE,qDAAqD;IACrD,qEAAqE;IACrE,qEAAqE;IACrE,iEAAiE;IACjE,uEAAuE;IACvE,kEAAkE;IAClE,mEAAmE;IACnE,MAAM,WAAW,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAEjD,MAAM,KAAK,GACP,OAAO,CAAC,KAAK,IAAI,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;IAElE,wEAAwE;IACxE,qEAAqE;IACrE,uEAAuE;IACvE,oEAAoE;IACpE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;IACL,CAAC;IAED,oEAAoE;IACpE,qEAAqE;IACrE,8BAA8B;IAC9B,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC1C,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,+DAA+D;IAC/D,oBAAoB,CAAC,GAAG,EAAE,SAAS,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAE3D,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,SAAwB,EAAE,IAAoB;IAClE,mEAAmE;IACnE,0EAA0E;IAC1E,mEAAmE;IACnE,kEAAkE;IAClE,iEAAiE;IACjE,mEAAmE;IACnE,uDAAuD;IACvD,sCAAsC;IACtC,MAAM,WAAW,GACb,IAAI,CAAC,iBAAiB,KAAK,SAAS;QAChC,CAAC,CAAE,IAAI,CAAC,iBAAkD;QAC1D,CAAC,CAAE,IAAI,CAAC,WAAiC,CAAC;IAElD,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,qEAAqE;IACrE,iCAAiC;IACjC,MAAM,YAAY,GACd,IAAI,CAAC,YAAY,KAAK,SAAS;QAC3B,CAAC,CAAE,IAAI,CAAC,YAA6C;QACrD,CAAC,CAAC,SAAS,CAAC;IAEpB,SAAS,CAAC,YAAY,CAClB,IAAI,CAAC,IAAI,EACT;QACI,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW;QACX,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,WAAW,EAAE,IAAI,CAAC,WAAW;KAChC;IACD,oEAAoE;IACpE,+DAA+D;IAC/D,iEAAiE;IACjE,iEAAiE;IACjE,kEAAkE;IAClE,8DAA8D;IAC9D,iEAAiE;IACjE,gEAAgE;IAChE,yCAAyC;IACzC,4IAA4I;IAC5I,CAAC,KAAK,EAAE,IAAS,EAAE,KAAU,EAAE,EAAE;QAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC,CAAU,CACd,CAAC;AACN,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGpE,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAsB,MAAM,+BAA+B,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAG3D,OAAO,EACH,gBAAgB,EAChB,0BAA0B,EAC1B,wBAAwB,EACxB,mBAAmB,EACnB,kBAAkB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAuB,MAAM,kBAAkB,CAAC;AAEtE,MAAM,CAAC,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAErD;;;;;;;;;;;;GAYG;AACH,SAAS,kBAAkB;IACvB,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAC;IACxD,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CACX,mCAAmC,OAAO,sCAAsC,CACnF,CAAC;IACN,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,kBAAkB,EAAE,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AAEpD,iEAAiE;AACjE,MAAM,CAAC,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;AAEhE,wDAAwD;AACxD,MAAM,CAAC,MAAM,0BAA0B,GACnC,mEAAmE;IACnE,8DAA8D;IAC9D,yDAAyD,CAAC;AAE9D,mDAAmD;AACnD,MAAM,CAAC,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AA4B3D;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,yBAAyB,CACrC,QAAsB;IAEtB,MAAM,IAAI,GAAG,QAAQ,CAAC,cAAc,EAAE,CAAC;IACvC,OAAO;QACH,eAAe,EAAE,QAAQ,CAAC,aAAa,EAAE;QACzC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAoB,EAAE;YACtC,MAAM,QAAQ,GACV,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,aAAa,CAAC;YAC/C,MAAM,GAAG,GAAqE;gBAC1E,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,QAAQ;gBACR,UAAU,EAAE,GAAG,CAAC,UAAU;aAC7B,CAAC;YACF,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC1B,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;YAC1B,CAAC;YACD,OAAO,GAAG,CAAC;QACf,CAAC,CAAC;KACL,CAAC;AACN,CAAC;AAqBD,MAAM,UAAU,YAAY,CAAC,OAA4B;IACrD,mDAAmD;IACnD,EAAE;IACF,qEAAqE;IACrE,EAAE;IACF,oEAAoE;IACpE,iEAAiE;IACjE,mEAAmE;IACnE,qDAAqD;IACrD,EAAE;IACF,sDAAsD;IACtD,mEAAmE;IACnE,2DAA2D;IAC3D,EAAE;IACF,kEAAkE;IAClE,0DAA0D;IAC1D,EAAE;IACF,mEAAmE;IACnE,gEAAgE;IAChE,+DAA+D;IAC/D,6DAA6D;IAC7D,uDAAuD;IACvD,gDAAgD;IAChD,MAAM,YAAY,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE7D,MAAM,GAAG,GAAG,IAAI,SAAS,CACrB;QACI,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,cAAc;KAC1B,EACD;QACI,YAAY;KACf,CACJ,CAAC;IAEF,iEAAiE;IACjE,kEAAkE;IAClE,gEAAgE;IAChE,sDAAsD;IACtD,GAAG,CAAC,gBAAgB,CAChB,mBAAmB,EACnB,kBAAkB,EAClB;QACI,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,0BAA0B;QACvC,QAAQ,EAAE,wBAAwB;KACrC,EACD,KAAK,EAAE,GAAQ,EAAE,EAAE,CAAC,CAAC;QACjB,QAAQ,EAAE;YACN;gBACI,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;gBACnB,QAAQ,EAAE,wBAAwB;gBAClC,IAAI,EAAE,YAAY;aACrB;SACJ;KACJ,CAAC,CACL,CAAC;IAEF,mEAAmE;IACnE,EAAE;IACF,kEAAkE;IAClE,mEAAmE;IACnE,oEAAoE;IACpE,mEAAmE;IACnE,iEAAiE;IACjE,2DAA2D;IAC3D,EAAE;IACF,gDAAgD;IAChD,iEAAiE;IACjE,4DAA4D;IAC5D,iEAAiE;IACjE,UAAU;IACV,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;IACvC,GAAG,CAAC,gBAAgB,CAChB,mBAAmB,EACnB,kBAAkB,EAClB;QACI,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,0BAA0B;QACvC,QAAQ,EAAE,wBAAwB;KACrC,EACD,KAAK,EAAE,GAAQ,EAAE,EAAE,CAAC,CAAC;QACjB,QAAQ,EAAE;YACN;gBACI,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;gBACnB,QAAQ,EAAE,wBAAwB;gBAClC,IAAI,EAAE,IAAI,CAAC,SAAS,CAChB,yBAAyB,CAAC,QAAQ,CAAC,EACnC,IAAI,EACJ,CAAC,CACJ;aACJ;SACJ;KACJ,CAAC,CACL,CAAC;IAEF,kDAAkD;IAClD,EAAE;IACF,4DAA4D;IAC5D,kEAAkE;IAClE,qDAAqD;IACrD,qEAAqE;IACrE,qEAAqE;IACrE,iEAAiE;IACjE,uEAAuE;IACvE,kEAAkE;IAClE,mEAAmE;IACnE,MAAM,WAAW,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAEjD,MAAM,KAAK,GACP,OAAO,CAAC,KAAK,IAAI,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;IAElE,wEAAwE;IACxE,qEAAqE;IACrE,uEAAuE;IACvE,oEAAoE;IACpE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;IACL,CAAC;IAED,oEAAoE;IACpE,qEAAqE;IACrE,8BAA8B;IAC9B,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC1C,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,+DAA+D;IAC/D,oBAAoB,CAAC,GAAG,EAAE,SAAS,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAE3D,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,wBAAwB,CAAC,GAAG,EAAE,SAAS,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAE/D,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,SAAwB,EAAE,IAAoB;IAClE,mEAAmE;IACnE,0EAA0E;IAC1E,mEAAmE;IACnE,kEAAkE;IAClE,iEAAiE;IACjE,mEAAmE;IACnE,uDAAuD;IACvD,sCAAsC;IACtC,MAAM,WAAW,GACb,IAAI,CAAC,iBAAiB,KAAK,SAAS;QAChC,CAAC,CAAE,IAAI,CAAC,iBAAkD;QAC1D,CAAC,CAAE,IAAI,CAAC,WAAiC,CAAC;IAElD,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,qEAAqE;IACrE,iCAAiC;IACjC,MAAM,YAAY,GACd,IAAI,CAAC,YAAY,KAAK,SAAS;QAC3B,CAAC,CAAE,IAAI,CAAC,YAA6C;QACrD,CAAC,CAAC,SAAS,CAAC;IAEpB,SAAS,CAAC,YAAY,CAClB,IAAI,CAAC,IAAI,EACT;QACI,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW;QACX,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,WAAW,EAAE,IAAI,CAAC,WAAW;KAChC;IACD,oEAAoE;IACpE,+DAA+D;IAC/D,iEAAiE;IACjE,iEAAiE;IACjE,kEAAkE;IAClE,8DAA8D;IAC9D,iEAAiE;IACjE,gEAAgE;IAChE,yCAAyC;IACzC,4IAA4I;IAC5I,CAAC,KAAK,EAAE,IAAS,EAAE,KAAU,EAAE,EAAE;QAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC,CAAU,CACd,CAAC;AACN,CAAC"}

package/dist/setup-ca-env.d.ts

@@ -0,0 +1,40 @@
+/**
+ * `setup-ca-env` — translate a wizard/CLI CA choice into MCP-server env keys.
+ *
+ * G-D #7: corporate TLS-inspection has two trust strategies, and exactly which
+ * env the server entry needs depends on the running Node:
+ *
+ *   - **file mode** (`caCertPath`): write `NODE_EXTRA_CA_CERTS=<path>`. Works on
+ *     every supported Node; the only option below the system-CA floor.
+ *   - **system mode** (`caMode: 'system'`): write `NODE_OPTIONS=--use-system-ca`
+ *     so Node reads the OS trust store (Windows CryptoAPI / macOS Keychain) —
+ *     the zero-export path, but only on Node ≥ 22.15. Below that floor we emit
+ *     NOTHING and warn to supply a `.pem` instead, so we never write a flag the
+ *     target Node would reject at startup.
+ *
+ * Pure + Node-version-injectable so it is unit-testable offline. Never disables
+ * TLS verification.
+ *
+ * @license MIT
+ */
+/** The CA-trust portion of a {@link WizardAnswers}. */
+export interface CaChoice {
+    readonly caCertPath?: string;
+    readonly caMode?: 'system';
+}
+export interface CaEnvResult {
+    /** Env keys to merge into the MCP server entry's env block. */
+    readonly env: Record<string, string>;
+    /** Non-fatal warnings (e.g. system-CA requested on too-old a Node). */
+    readonly warnings: readonly string[];
+}
+/**
+ * Resolve the CA env-block keys for `choice` under `nodeVersion` (default
+ * `process.version`). `currentEnv` (default `process.env`) is only read to
+ * preserve a pre-existing `NODE_OPTIONS` when appending the system-CA flag.
+ *
+ * File mode wins deterministically if both are set (an explicit `.pem` is the
+ * stronger signal). Pure — returns a fresh object, mutates nothing.
+ */
+export declare function buildCaEnv(choice: CaChoice, nodeVersion?: string, currentEnv?: NodeJS.ProcessEnv): CaEnvResult;
+//# sourceMappingURL=setup-ca-env.d.ts.map

package/dist/setup-ca-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-ca-env.d.ts","sourceRoot":"","sources":["../src/setup-ca-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,uDAAuD;AACvD,MAAM,WAAW,QAAQ;IACrB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;CAC9B;AAED,MAAM,WAAW,WAAW;IACxB,+DAA+D;IAC/D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAYD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CACtB,MAAM,EAAE,QAAQ,EAChB,WAAW,GAAE,MAAwB,EACrC,UAAU,GAAE,MAAM,CAAC,UAAwB,GAC5C,WAAW,CAoBb"}

package/dist/setup-ca-env.js

@@ -0,0 +1,58 @@
+/**
+ * `setup-ca-env` — translate a wizard/CLI CA choice into MCP-server env keys.
+ *
+ * G-D #7: corporate TLS-inspection has two trust strategies, and exactly which
+ * env the server entry needs depends on the running Node:
+ *
+ *   - **file mode** (`caCertPath`): write `NODE_EXTRA_CA_CERTS=<path>`. Works on
+ *     every supported Node; the only option below the system-CA floor.
+ *   - **system mode** (`caMode: 'system'`): write `NODE_OPTIONS=--use-system-ca`
+ *     so Node reads the OS trust store (Windows CryptoAPI / macOS Keychain) —
+ *     the zero-export path, but only on Node ≥ 22.15. Below that floor we emit
+ *     NOTHING and warn to supply a `.pem` instead, so we never write a flag the
+ *     target Node would reject at startup.
+ *
+ * Pure + Node-version-injectable so it is unit-testable offline. Never disables
+ * TLS verification.
+ *
+ * @license MIT
+ */
+import { supportsSystemCa } from './diagnostics/ca-trust.js';
+const SYSTEM_CA_FLAG = '--use-system-ca';
+/** Append `--use-system-ca` to an existing NODE_OPTIONS without duplicating it. */
+function withSystemCaFlag(existing) {
+    const trimmed = (existing ?? '').trim();
+    if (trimmed === '')
+        return SYSTEM_CA_FLAG;
+    if (trimmed.split(/\s+/).includes(SYSTEM_CA_FLAG))
+        return trimmed;
+    return `${trimmed} ${SYSTEM_CA_FLAG}`;
+}
+/**
+ * Resolve the CA env-block keys for `choice` under `nodeVersion` (default
+ * `process.version`). `currentEnv` (default `process.env`) is only read to
+ * preserve a pre-existing `NODE_OPTIONS` when appending the system-CA flag.
+ *
+ * File mode wins deterministically if both are set (an explicit `.pem` is the
+ * stronger signal). Pure — returns a fresh object, mutates nothing.
+ */
+export function buildCaEnv(choice, nodeVersion = process.version, currentEnv = process.env) {
+    const path = choice.caCertPath?.trim();
+    if (path !== undefined && path !== '') {
+        return { env: { NODE_EXTRA_CA_CERTS: path }, warnings: [] };
+    }
+    if (choice.caMode === 'system') {
+        if (supportsSystemCa(nodeVersion)) {
+            return { env: { NODE_OPTIONS: withSystemCaFlag(currentEnv.NODE_OPTIONS) }, warnings: [] };
+        }
+        return {
+            env: {},
+            warnings: [
+                `OS trust store (--use-system-ca) needs Node ≥ 22.15 — this Node is ${nodeVersion}. ` +
+                    'Re-run setup with `--ca <path-to-corp-root-ca.pem>` (export your corporate root CA to a .pem) instead. Never disable TLS verification.',
+            ],
+        };
+    }
+    return { env: {}, warnings: [] };
+}
+//# sourceMappingURL=setup-ca-env.js.map

package/dist/setup-ca-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-ca-env.js","sourceRoot":"","sources":["../src/setup-ca-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAe7D,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAEzC,mFAAmF;AACnF,SAAS,gBAAgB,CAAC,QAA4B;IAClD,MAAM,OAAO,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,cAAc,CAAC;IAC1C,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,OAAO,CAAC;IAClE,OAAO,GAAG,OAAO,IAAI,cAAc,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CACtB,MAAgB,EAChB,cAAsB,OAAO,CAAC,OAAO,EACrC,aAAgC,OAAO,CAAC,GAAG;IAE3C,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IACvC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QACpC,OAAO,EAAE,GAAG,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAChE,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,GAAG,EAAE,EAAE,YAAY,EAAE,gBAAgB,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC9F,CAAC;QACD,OAAO;YACH,GAAG,EAAE,EAAE;YACP,QAAQ,EAAE;gBACN,sEAAsE,WAAW,IAAI;oBACjF,wIAAwI;aAC/I;SACJ,CAAC;IACN,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AACrC,CAAC"}

package/dist/setup-ca-reprobe.d.ts

@@ -0,0 +1,38 @@
+/**
+ * `setup-ca-reprobe` — default `WizardDeps.applyAndReProbe` (G-D #6/#8).
+ *
+ * After the user picks a corporate-CA strategy, RE-PROBE the connection so the
+ * wizard can print ✅/❌ now instead of leaving a silent first-tool-call
+ * timeout for after the restart:
+ *
+ *   - **file mode**: read the `.pem` and run the probes through an undici
+ *     `Agent` whose connector trusts that CA — this validates in-process,
+ *     immediately, without a restart.
+ *   - **system mode**: the OS trust store is only consulted when Node is
+ *     (re)started with `--use-system-ca`, which the written config now does —
+ *     so we re-run the ordinary probes (best-effort) and report the truthful
+ *     current state; the config is already correct for the next launch.
+ *
+ * Never disables TLS verification.
+ *
+ * @license MIT
+ */
+import type { AuthProbeResult, CaPromptChoice, HealthProbeResult } from './setup-wizard-types.js';
+/**
+ * Probe health + auth for `wpUrl`/`bearer` under the chosen CA. The probes are
+ * injected (default to the real handshake probes) so this stays testable; the
+ * file-mode CA wiring is the only real-I/O part and is exercised by an
+ * integration probe, never a unit mock.
+ */
+export declare function defaultApplyAndReProbe(input: {
+    readonly wpUrl: string;
+    readonly bearer: string;
+    readonly choice: CaPromptChoice;
+}, probes?: {
+    probeHealth?: (wpUrl: string, fetchImpl?: typeof fetch) => Promise<HealthProbeResult>;
+    probeAuth?: (wpUrl: string, bearer: string, fetchImpl?: typeof fetch) => Promise<AuthProbeResult>;
+}): Promise<{
+    health: HealthProbeResult;
+    auth: AuthProbeResult;
+}>;
+//# sourceMappingURL=setup-ca-reprobe.d.ts.map

package/dist/setup-ca-reprobe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-ca-reprobe.d.ts","sourceRoot":"","sources":["../src/setup-ca-reprobe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAElG;;;;;GAKG;AACH,wBAAsB,sBAAsB,CACxC,KAAK,EAAE;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;CAAE,EAC3F,MAAM,GAAE;IACJ,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,KAAK,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACtF,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,KAAK,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CAChG,GACP,OAAO,CAAC;IAAE,MAAM,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,CAAC,CAkB/D"}

package/dist/setup-ca-reprobe.js

@@ -0,0 +1,68 @@
+/**
+ * `setup-ca-reprobe` — default `WizardDeps.applyAndReProbe` (G-D #6/#8).
+ *
+ * After the user picks a corporate-CA strategy, RE-PROBE the connection so the
+ * wizard can print ✅/❌ now instead of leaving a silent first-tool-call
+ * timeout for after the restart:
+ *
+ *   - **file mode**: read the `.pem` and run the probes through an undici
+ *     `Agent` whose connector trusts that CA — this validates in-process,
+ *     immediately, without a restart.
+ *   - **system mode**: the OS trust store is only consulted when Node is
+ *     (re)started with `--use-system-ca`, which the written config now does —
+ *     so we re-run the ordinary probes (best-effort) and report the truthful
+ *     current state; the config is already correct for the next launch.
+ *
+ * Never disables TLS verification.
+ *
+ * @license MIT
+ */
+import { readFile } from 'node:fs/promises';
+import { Agent, fetch as undiciFetch } from 'undici';
+import { defaultProbeAuth, defaultProbeHealth } from './setup-wizard-handshake.js';
+/**
+ * Probe health + auth for `wpUrl`/`bearer` under the chosen CA. The probes are
+ * injected (default to the real handshake probes) so this stays testable; the
+ * file-mode CA wiring is the only real-I/O part and is exercised by an
+ * integration probe, never a unit mock.
+ */
+export async function defaultApplyAndReProbe(input, probes = {}) {
+    const probeHealth = probes.probeHealth ?? defaultProbeHealth;
+    const probeAuth = probes.probeAuth ?? defaultProbeAuth;
+    if (input.choice.choice === 'file') {
+        const fetchImpl = await caBoundFetch(input.choice.path);
+        if (fetchImpl !== null) {
+            const health = await probeHealth(input.wpUrl, fetchImpl);
+            const auth = await probeAuth(input.wpUrl, input.bearer, fetchImpl);
+            return { health, auth };
+        }
+        // Could not read the .pem — fall through to a plain re-probe so the
+        // operator still gets a (failing) verdict + the file warning above.
+    }
+    const health = await probeHealth(input.wpUrl);
+    const auth = await probeAuth(input.wpUrl, input.bearer);
+    return { health, auth };
+}
+/**
+ * A `fetch` whose TLS connector additionally trusts the PEM at `caPath`, or
+ * `null` when the file cannot be read. The CA is ADDED to the default trust
+ * set (undici merges it with the system roots) — verification stays on.
+ */
+async function caBoundFetch(caPath) {
+    let ca;
+    try {
+        ca = await readFile(caPath, 'utf8');
+    }
+    catch {
+        return null;
+    }
+    const agent = new Agent({ connect: { ca } });
+    // undici's fetch accepts a per-call `dispatcher`; wrap it to match the
+    // global `fetch` signature the RestClient expects.
+    const bound = ((input, init) => undiciFetch(input, {
+        ...init,
+        dispatcher: agent,
+    }));
+    return bound;
+}
+//# sourceMappingURL=setup-ca-reprobe.js.map