@wootsup/yt-builder-mcp 1.3.0 → 1.4.0

package/README.md

@@ -117,7 +117,7 @@ Copies the bundled `skills/yootheme-builder/` folder into
 other AI clients pick it up automatically.
 
 `~/.claude/skills/` is the **universal marker path** recognised by
-Claude Desktop and (per the same convention as `@wootsup/mcp`) other
+Claude Desktop and (per the same convention as `@wootsup/apimapper-mcp`) other
 AI clients that follow the `~/AGENTS.md` discovery protocol. The
 single location keeps the skill discoverable across every supported
 client without per-client write logic.

package/dist/cli/doctor-command.d.ts

@@ -0,0 +1,21 @@
+import { type DoctorDeps } from '../diagnostics/doctor.js';
+interface ParsedDoctorArgs {
+    url?: string;
+    token?: string;
+}
+/** Parse `--url <x> --token <y>` from the doctor argv tail. */
+export declare function parseDoctorArgs(argv: readonly string[]): ParsedDoctorArgs;
+export interface DoctorCommandDeps {
+    deps?: DoctorDeps;
+    log?: (line: string) => void;
+    env?: NodeJS.ProcessEnv;
+}
+/**
+ * `yt-builder-mcp doctor [--url <site> --token <key>]` — run the self-diagnostic
+ * and print an actionable report. Falls back to YTB_MCP_SITE_URL /
+ * YTB_MCP_BEARER_TOKEN when the flags are omitted (so it works against an
+ * already-configured server entry). Returns 0 when all critical checks pass.
+ */
+export declare function doctorCommand(argv: readonly string[], overrides?: DoctorCommandDeps): Promise<number>;
+export {};
+//# sourceMappingURL=doctor-command.d.ts.map

package/dist/cli/doctor-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-command.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-command.ts"],"names":[],"mappings":"AAIA,OAAO,EAAiC,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAa1F,UAAU,gBAAgB;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,+DAA+D;AAC/D,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,gBAAgB,CAczE;AA4DD,MAAM,WAAW,iBAAiB;IAC9B,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CAC3B;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,GAAE,iBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmB/G"}

package/dist/cli/doctor-command.js

@@ -0,0 +1,111 @@
+// packages/mcp/src/cli/doctor-command.ts
+import { installGlobalProxyDispatcher } from '../net/proxy-dispatcher.js';
+import { SERVER_VERSION } from '../server.js';
+import { fetchLatestFromNpm } from '../update/update-check.js';
+import { runDoctor, formatDoctorReport } from '../diagnostics/doctor.js';
+const MCP_PACKAGE_NAME = '@wootsup/yt-builder-mcp';
+const PROBE_TIMEOUT_MS = 8_000;
+/** WP + Joomla health endpoints — doctor is platform-agnostic. */
+const HEALTH_PATHS = ['/wp-json/yt-builder-mcp/v1/health', '/api/index.php/v1/yt-builder-mcp/health'];
+const BEARER_PATHS = ['/wp-json/yt-builder-mcp/v1/etag', '/api/index.php/v1/yt-builder-mcp/etag'];
+function joinUrl(base, path) {
+    return base.replace(/\/+$/, '') + path;
+}
+/** Parse `--url <x> --token <y>` from the doctor argv tail. */
+export function parseDoctorArgs(argv) {
+    const parsed = {};
+    for (let i = 0; i < argv.length; i++) {
+        const flag = argv[i];
+        const next = argv[i + 1];
+        if (flag === '--url' && next !== undefined) {
+            parsed.url = next;
+            i++;
+        }
+        else if (flag === '--token' && next !== undefined) {
+            parsed.token = next;
+            i++;
+        }
+    }
+    return parsed;
+}
+/** Real network probes — try the WP path, then the Joomla path. */
+function defaultDoctorDeps() {
+    return {
+        async probeHealth(url) {
+            let lastError = null;
+            for (const path of HEALTH_PATHS) {
+                try {
+                    const res = await fetch(joinUrl(url, path), { signal: AbortSignal.timeout(PROBE_TIMEOUT_MS) });
+                    if (res.ok) {
+                        const body = await res.json().catch(() => ({}));
+                        const pluginVersion = body !== null && typeof body === 'object' && typeof body.plugin_version === 'string'
+                            ? body.plugin_version
+                            : undefined;
+                        return { ok: true, pluginVersion };
+                    }
+                    lastError = { status: res.status };
+                }
+                catch (err) {
+                    lastError = err;
+                }
+            }
+            return { ok: false, error: lastError };
+        },
+        async probeBearer(url, token) {
+            let lastError = null;
+            let lastStatus;
+            for (const path of BEARER_PATHS) {
+                try {
+                    const res = await fetch(joinUrl(url, path), {
+                        headers: { Authorization: `Bearer ${token}` },
+                        signal: AbortSignal.timeout(PROBE_TIMEOUT_MS),
+                    });
+                    if (res.ok)
+                        return { ok: true };
+                    lastStatus = res.status;
+                    // A 404 just means "wrong platform path" — keep trying.
+                    if (res.status !== 404)
+                        return { ok: false, status: res.status };
+                }
+                catch (err) {
+                    lastError = err;
+                }
+            }
+            return { ok: false, status: lastStatus, error: lastError };
+        },
+        // G-D #10 — surface the RAW registry error (not swallowed) so doctor can
+        // run the CA classifier on a TLS-inspection failure of the npm registry.
+        async probeRegistry() {
+            try {
+                const res = await fetch('https://registry.npmjs.org/-/ping', {
+                    signal: AbortSignal.timeout(PROBE_TIMEOUT_MS),
+                });
+                return res.ok ? { ok: true } : { ok: false, error: { status: res.status } };
+            }
+            catch (err) {
+                return { ok: false, error: err };
+            }
+        },
+        fetchLatest: (pkg) => fetchLatestFromNpm(pkg),
+    };
+}
+/**
+ * `yt-builder-mcp doctor [--url <site> --token <key>]` — run the self-diagnostic
+ * and print an actionable report. Falls back to YTB_MCP_SITE_URL /
+ * YTB_MCP_BEARER_TOKEN when the flags are omitted (so it works against an
+ * already-configured server entry). Returns 0 when all critical checks pass.
+ */
+export async function doctorCommand(argv, overrides = {}) {
+    const env = overrides.env ?? process.env;
+    const log = overrides.log ?? ((line) => process.stdout.write(`${line}\n`));
+    const deps = overrides.deps ?? defaultDoctorDeps();
+    // Honor a corporate proxy for doctor's own probes (CA via NODE_EXTRA_CA_CERTS).
+    installGlobalProxyDispatcher({ env });
+    const parsed = parseDoctorArgs(argv);
+    const url = parsed.url ?? env.YTB_MCP_SITE_URL ?? env.YTB_MCP_WP_URL;
+    const token = parsed.token ?? env.YTB_MCP_BEARER_TOKEN;
+    const report = await runDoctor({ url, token, env, currentVersion: SERVER_VERSION, packageName: MCP_PACKAGE_NAME }, deps);
+    log(formatDoctorReport(report));
+    return report.ok ? 0 : 1;
+}
+//# sourceMappingURL=doctor-command.js.map

package/dist/cli/doctor-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-command.js","sourceRoot":"","sources":["../../src/cli/doctor-command.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAmB,MAAM,0BAA0B,CAAC;AAE1F,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AACnD,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B,kEAAkE;AAClE,MAAM,YAAY,GAAG,CAAC,mCAAmC,EAAE,yCAAyC,CAAU,CAAC;AAC/G,MAAM,YAAY,GAAG,CAAC,iCAAiC,EAAE,uCAAuC,CAAU,CAAC;AAE3G,SAAS,OAAO,CAAC,IAAY,EAAE,IAAY;IACvC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC;AAC3C,CAAC;AAOD,+DAA+D;AAC/D,MAAM,UAAU,eAAe,CAAC,IAAuB;IACnD,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;YAClB,CAAC,EAAE,CAAC;QACR,CAAC;aAAM,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAClD,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;YACpB,CAAC,EAAE,CAAC;QACR,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,mEAAmE;AACnE,SAAS,iBAAiB;IACtB,OAAO;QACH,KAAK,CAAC,WAAW,CAAC,GAAG;YACjB,IAAI,SAAS,GAAY,IAAI,CAAC;YAC9B,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;gBAC9B,IAAI,CAAC;oBACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;oBAC/F,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;wBACT,MAAM,IAAI,GAAY,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;wBACzD,MAAM,aAAa,GACf,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAQ,IAAqC,CAAC,cAAc,KAAK,QAAQ;4BAClH,CAAC,CAAE,IAAmC,CAAC,cAAc;4BACrD,CAAC,CAAC,SAAS,CAAC;wBACpB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;oBACvC,CAAC;oBACD,SAAS,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;gBACvC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACX,SAAS,GAAG,GAAG,CAAC;gBACpB,CAAC;YACL,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAC3C,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK;YACxB,IAAI,SAAS,GAAY,IAAI,CAAC;YAC9B,IAAI,UAA8B,CAAC;YACnC,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;gBAC9B,IAAI,CAAC;oBACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE;wBACxC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;wBAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;qBAChD,CAAC,CAAC;oBACH,IAAI,GAAG,CAAC,EAAE;wBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;oBAChC,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC;oBACxB,wDAAwD;oBACxD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;wBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;gBACrE,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACX,SAAS,GAAG,GAAG,CAAC;gBACpB,CAAC;YACL,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAC/D,CAAC;QACD,yEAAyE;QACzE,yEAAyE;QACzE,KAAK,CAAC,aAAa;YACf,IAAI,CAAC;gBACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,mCAAmC,EAAE;oBACzD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;iBAChD,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;YAChF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;YACrC,CAAC;QACL,CAAC;QACD,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC;KAChD,CAAC;AACN,CAAC;AAQD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAuB,EAAE,YAA+B,EAAE;IAC1F,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACzC,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,IAAI,iBAAiB,EAAE,CAAC;IAEnD,gFAAgF;IAChF,4BAA4B,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IAEtC,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,cAAc,CAAC;IACrE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC,oBAAoB,CAAC;IAEvD,MAAM,MAAM,GAAG,MAAM,SAAS,CAC1B,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,cAAc,EAAE,cAAc,EAAE,WAAW,EAAE,gBAAgB,EAAE,EAClF,IAAI,CACP,CAAC;IAEF,GAAG,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC"}

package/dist/cli/invocation-decision.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"invocation-decision.d.ts","sourceRoot":"","sources":["../../src/cli/invocation-decision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAoBjD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAKxB,CAAC;AAEZ,qDAAqD;AACrD,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEzD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAElE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC5B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,UAAU,EAAE,OAAO,GAAG,SAAS,GAChC,gBAAgB,CAMlB"}
+{"version":3,"file":"invocation-decision.d.ts","sourceRoot":"","sources":["../../src/cli/invocation-decision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAsBjD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAKxB,CAAC;AAEZ,qDAAqD;AACrD,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEzD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAElE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC5B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,UAAU,EAAE,OAAO,GAAG,SAAS,GAChC,gBAAgB,CAMlB"}

package/dist/cli/invocation-decision.js

@@ -31,6 +31,8 @@ export const KNOWN_SUBCOMMANDS = Object.freeze(new Set([
     'setup',
     'install-skill',
     'install',
+    // Self-diagnostic: Node version, TLS chain, proxy, reachability, bearer.
+    'doctor',
     // Reverse-of-setup: remove our server entry + optional skill.
     'uninstall',
     'remove',

package/dist/cli/invocation-decision.js.map

@@ -1 +1 @@
-{"version":3,"file":"invocation-decision.js","sourceRoot":"","sources":["../../src/cli/invocation-decision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAwB,MAAM,CAAC,MAAM,CAC/D,IAAI,GAAG,CAAS;IACZ,OAAO;IACP,eAAe;IACf,SAAS;IACT,8DAA8D;IAC9D,WAAW;IACX,QAAQ;IACR,iCAAiC;IACjC,UAAU;IACV,YAAY;IACZ,aAAa;IACb,aAAa;IACb,WAAW;IACX,MAAM;IACN,QAAQ;IACR,IAAI;IACJ,WAAW;IACX,IAAI;CACP,CAAC,CACL,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAW;IACxC,sEAAsE;IACtE,oDAAoD;IACpD,sDAAsD;IACtD,4BAA4B;CAC/B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAKZ;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAuB;IACrD,OAAO,GAAG,KAAK,SAAS,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAC5B,UAA8B,EAC9B,UAA+B;IAE/B,IAAI,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,oEAAoE;IACpE,OAAO,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnD,CAAC"}
+{"version":3,"file":"invocation-decision.js","sourceRoot":"","sources":["../../src/cli/invocation-decision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAwB,MAAM,CAAC,MAAM,CAC/D,IAAI,GAAG,CAAS;IACZ,OAAO;IACP,eAAe;IACf,SAAS;IACT,yEAAyE;IACzE,QAAQ;IACR,8DAA8D;IAC9D,WAAW;IACX,QAAQ;IACR,iCAAiC;IACjC,UAAU;IACV,YAAY;IACZ,aAAa;IACb,aAAa;IACb,WAAW;IACX,MAAM;IACN,QAAQ;IACR,IAAI;IACJ,WAAW;IACX,IAAI;CACP,CAAC,CACL,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAW;IACxC,sEAAsE;IACtE,oDAAoD;IACpD,sDAAsD;IACtD,4BAA4B;CAC/B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAKZ;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAuB;IACrD,OAAO,GAAG,KAAK,SAAS,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAC5B,UAA8B,EAC9B,UAA+B;IAE/B,IAAI,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,oEAAoE;IACpE,OAAO,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnD,CAAC"}

package/dist/client.d.ts

@@ -31,6 +31,13 @@ export interface LegacyRestClientOptions {
     readonly timeoutMs?: number;
     /** Injected for tests. Defaults to `globalThis.fetch`. */
     readonly fetch?: typeof fetch;
+    /**
+     * Extra headers merged into EVERY outbound request (Glöckle gap #14 —
+     * HTTP Basic-Auth / WAF cookie / corporate gateway secret). The Bearer
+     * (and any per-request header) always wins on collision; these only fill
+     * gaps. Source: `YTB_MCP_EXTRA_HEADERS` (see `net/extra-headers.ts`).
+     */
+    readonly extraHeaders?: Record<string, string>;
 }
 /**
  * Platform-aware options shape (Wave G.0+).
@@ -43,6 +50,12 @@ export interface PlatformRestClientOptions {
     readonly timeoutMs?: number;
     /** Injected for tests. Defaults to `globalThis.fetch`. */
     readonly fetch?: typeof fetch;
+    /**
+     * Extra headers merged into EVERY outbound request (Glöckle gap #14).
+     * Bearer + per-request headers always win on collision. Source:
+     * `YTB_MCP_EXTRA_HEADERS` (see `net/extra-headers.ts`).
+     */
+    readonly extraHeaders?: Record<string, string>;
 }
 /** Discriminated union: callers pick whichever shape suits them. */
 export type RestClientOptions = LegacyRestClientOptions | PlatformRestClientOptions;
@@ -62,6 +75,7 @@ export declare class RestClient {
     private readonly bearerToken;
     private readonly timeoutMs;
     private readonly fetchImpl;
+    private readonly extraHeaders;
     constructor(options: RestClientOptions);
     /** Expose the underlying platform (used by tools that need restNamespacePath/kind). */
     getPlatform(): Platform;

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAGpD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,+BAAgC,CAAC;AAEjE;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACjC;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACtC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACjC;AAED,oEAAoE;AACpE,MAAM,MAAM,iBAAiB,GAAG,uBAAuB,GAAG,yBAAyB,CAAC;AAEpF,MAAM,WAAW,cAAc;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB;IACjB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,qBAAqB;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,4BAA4B;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CACjC;AAED,qBAAa,UAAU;IACnB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAW;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;gBAE7B,OAAO,EAAE,iBAAiB;IAYtC,uFAAuF;IACvF,WAAW,IAAI,QAAQ;IAIvB,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,CAAC,CAAC;IAIxE,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,CAAC,CAAC;IAIzE,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,CAAC,CAAC;IAIxE,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,CAAC,CAAC;IAIrE,OAAO,CAAC,CAAC,GAAG,OAAO,EACrB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,cAAmB,GAC7B,OAAO,CAAC,CAAC,CAAC;IAgDb,OAAO,CAAC,QAAQ;CAInB;AAgCD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAczD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE3D"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAGpD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,+BAAgC,CAAC;AAEjE;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClD;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACtC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClD;AAED,oEAAoE;AACpE,MAAM,MAAM,iBAAiB,GAAG,uBAAuB,GAAG,yBAAyB,CAAC;AAEpF,MAAM,WAAW,cAAc;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB;IACjB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,qBAAqB;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,4BAA4B;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CACjC;AAED,qBAAa,UAAU;IACnB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAW;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;gBAE1C,OAAO,EAAE,iBAAiB;IAatC,uFAAuF;IACvF,WAAW,IAAI,QAAQ;IAIvB,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,CAAC,CAAC;IAIxE,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,CAAC,CAAC;IAIzE,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,CAAC,CAAC;IAIxE,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,CAAC,CAAC;IAIrE,OAAO,CAAC,CAAC,GAAG,OAAO,EACrB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,cAAmB,GAC7B,OAAO,CAAC,CAAC,CAAC;IAuDb,OAAO,CAAC,QAAQ;CAInB;AAgCD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAczD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE3D"}

package/dist/client.js

@@ -16,6 +16,7 @@
  * @license MIT
  */
 import { NetworkError, RestError } from './errors.js';
+import { mergeExtraHeaders } from './net/extra-headers.js';
 import { WordPressPlatform, WORDPRESS_REST_NAMESPACE_PATH } from './platform/index.js';
 /**
  * Canonical WordPress REST-namespace path. Re-exported for backward
@@ -28,6 +29,7 @@ export class RestClient {
     bearerToken;
     timeoutMs;
     fetchImpl;
+    extraHeaders;
     constructor(options) {
         // Dual-form: accept either a `Platform` or a legacy `baseUrl`.
         const platform = isPlatformOptions(options)
@@ -38,6 +40,7 @@ export class RestClient {
         this.bearerToken = options.bearerToken;
         this.timeoutMs = options.timeoutMs ?? 15_000;
         this.fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);
+        this.extraHeaders = options.extraHeaders ?? {};
     }
     /** Expose the underlying platform (used by tools that need restNamespacePath/kind). */
     getPlatform() {
@@ -70,6 +73,12 @@ export class RestClient {
             headers['Content-Type'] = 'application/json';
             init.body = JSON.stringify(options.body);
         }
+        // Glöckle gap #14 — merge corporate extra headers UNDER the
+        // authoritative set so the Bearer (and every header above) always wins
+        // on collision; extras only fill gaps (Basic-Auth / WAF cookie / etc.).
+        if (Object.keys(this.extraHeaders).length > 0) {
+            init.headers = mergeExtraHeaders(headers, this.extraHeaders);
+        }
         const controller = new AbortController();
         const timeoutId = setTimeout(() => controller.abort(), this.timeoutMs);
         if (options.signal !== undefined) {

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,iBAAiB,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AAEvF;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;AAyCjE,MAAM,OAAO,UAAU;IACF,QAAQ,CAAW;IACnB,OAAO,CAAS;IAChB,WAAW,CAAS;IACpB,SAAS,CAAS;IAClB,SAAS,CAAe;IAEzC,YAAY,OAA0B;QAClC,+DAA+D;QAC/D,MAAM,QAAQ,GAAa,iBAAiB,CAAC,OAAO,CAAC;YACjD,CAAC,CAAC,OAAO,CAAC,QAAQ;YAClB,CAAC,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;QAC7C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxE,CAAC;IAED,uFAAuF;IACvF,WAAW;QACP,OAAO,IAAI,CAAC,QAAQ,CAAC;IACzB,CAAC;IAED,GAAG,CAAc,IAAY,EAAE,UAA0B,EAAE;QACvD,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,CAAc,IAAY,EAAE,UAA0B,EAAE;QACxD,OAAO,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAED,GAAG,CAAc,IAAY,EAAE,UAA0B,EAAE;QACvD,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,CAAc,IAAY,EAAE,UAA0B,EAAE;QAC1D,OAAO,IAAI,CAAC,OAAO,CAAI,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,OAAO,CACT,MAAc,EACd,IAAY,EACZ,UAA0B,EAAE;QAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,OAAO,GAA2B;YACpC,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE;YAC3C,MAAM,EAAE,kBAAkB;YAC1B,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;SAC7B,CAAC;QACF,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;YACpD,OAAO,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;QACvC,CAAC;QAED,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC9C,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC7C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAEhC,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACD,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,MAAM,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9C,CAAC;gBAAS,CAAC;YACP,YAAY,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAEnC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,SAAS,CAAC;gBAChB,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC;gBAC9B,OAAO,EAAE,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC;gBACzD,IAAI,EAAE,MAAM;aACf,CAAC,CAAC;QACP,CAAC;QAED,OAAO,MAAW,CAAC;IACvB,CAAC;IAEO,QAAQ,CAAC,IAAY;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAC5D,OAAO,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,iBAAiB,GAAG,UAAU,EAAE,CAAC;IAC5E,CAAC;CACJ;AAED,0EAA0E;AAC1E,SAAS,iBAAiB,CAAC,IAAuB;IAC9C,OAAO,UAAU,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC;AAC7D,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IAC/B,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa;IACnC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAI,IAA0B,CAAC,IAAI,CAAC;QAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAa,EAAE,QAAgB;IACxD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QACjE,MAAM,GAAG,GAAI,IAA6B,CAAC,OAAO,CAAC;QACnD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,GAAG,CAAC;IAC1D,CAAC;IACD,OAAO,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC;AAC7D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC7C,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IACjD,2DAA2D;IAC3D,8DAA8D;IAC9D,6DAA6D;IAC7D,8DAA8D;IAC9D,2DAA2D;IAC3D,4DAA4D;IAC5D,+DAA+D;IAC/D,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvD,OAAO,QAAQ;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;SACtD,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IAC/C,OAAO,kBAAkB,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC/D,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,iBAAiB,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AAEvF;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;AAsDjE,MAAM,OAAO,UAAU;IACF,QAAQ,CAAW;IACnB,OAAO,CAAS;IAChB,WAAW,CAAS;IACpB,SAAS,CAAS;IAClB,SAAS,CAAe;IACxB,YAAY,CAAyB;IAEtD,YAAY,OAA0B;QAClC,+DAA+D;QAC/D,MAAM,QAAQ,GAAa,iBAAiB,CAAC,OAAO,CAAC;YACjD,CAAC,CAAC,OAAO,CAAC,QAAQ;YAClB,CAAC,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;QAC7C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpE,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;IACnD,CAAC;IAED,uFAAuF;IACvF,WAAW;QACP,OAAO,IAAI,CAAC,QAAQ,CAAC;IACzB,CAAC;IAED,GAAG,CAAc,IAAY,EAAE,UAA0B,EAAE;QACvD,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,CAAc,IAAY,EAAE,UAA0B,EAAE;QACxD,OAAO,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAED,GAAG,CAAc,IAAY,EAAE,UAA0B,EAAE;QACvD,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,CAAc,IAAY,EAAE,UAA0B,EAAE;QAC1D,OAAO,IAAI,CAAC,OAAO,CAAI,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,OAAO,CACT,MAAc,EACd,IAAY,EACZ,UAA0B,EAAE;QAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,OAAO,GAA2B;YACpC,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE;YAC3C,MAAM,EAAE,kBAAkB;YAC1B,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;SAC7B,CAAC;QACF,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;YACpD,OAAO,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;QACvC,CAAC;QAED,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC9C,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC7C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;QAED,4DAA4D;QAC5D,uEAAuE;QACvE,wEAAwE;QACxE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,OAAO,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAEhC,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACD,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,MAAM,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9C,CAAC;gBAAS,CAAC;YACP,YAAY,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAEnC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,SAAS,CAAC;gBAChB,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC;gBAC9B,OAAO,EAAE,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC;gBACzD,IAAI,EAAE,MAAM;aACf,CAAC,CAAC;QACP,CAAC;QAED,OAAO,MAAW,CAAC;IACvB,CAAC;IAEO,QAAQ,CAAC,IAAY;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAC5D,OAAO,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,iBAAiB,GAAG,UAAU,EAAE,CAAC;IAC5E,CAAC;CACJ;AAED,0EAA0E;AAC1E,SAAS,iBAAiB,CAAC,IAAuB;IAC9C,OAAO,UAAU,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC;AAC7D,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IAC/B,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa;IACnC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAI,IAA0B,CAAC,IAAI,CAAC;QAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAa,EAAE,QAAgB;IACxD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QACjE,MAAM,GAAG,GAAI,IAA6B,CAAC,OAAO,CAAC;QACnD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,GAAG,CAAC;IAC1D,CAAC;IACD,OAAO,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC;AAC7D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC7C,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IACjD,2DAA2D;IAC3D,8DAA8D;IAC9D,6DAA6D;IAC7D,8DAA8D;IAC9D,2DAA2D;IAC3D,4DAA4D;IAC5D,+DAA+D;IAC/D,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvD,OAAO,QAAQ;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;SACtD,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IAC/C,OAAO,kBAAkB,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC/D,CAAC"}

package/dist/diagnostics/ca-trust.d.ts

@@ -0,0 +1,16 @@
+/**
+ * True when `err` (or anything in its `.cause` / `AggregateError.errors`
+ * chain) carries a TLS chain-of-trust failure code — the signature of a
+ * corporate TLS-inspection proxy injecting its own root CA. Pure; reuses the
+ * same walker + code set as {@link diagnoseNetworkError}.
+ */
+export declare function isCaTrustError(err: unknown): boolean;
+/** Node version that first reads the OS trust store via `--use-system-ca`. */
+export declare const SYSTEM_CA_NODE_FLOOR: readonly [number, number, number];
+/**
+ * Does `nodeVersion` (default `process.version`) support `--use-system-ca`?
+ * A real numeric triple compare against {@link SYSTEM_CA_NODE_FLOOR} —
+ * fail-closed (`false`) on unparseable input.
+ */
+export declare function supportsSystemCa(nodeVersion?: string): boolean;
+//# sourceMappingURL=ca-trust.d.ts.map

package/dist/diagnostics/ca-trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ca-trust.d.ts","sourceRoot":"","sources":["../../src/diagnostics/ca-trust.ts"],"names":[],"mappings":"AAqBA;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEpD;AAED,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAe,CAAC;AAQnF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,GAAE,MAAwB,GAAG,OAAO,CAS/E"}

package/dist/diagnostics/ca-trust.js

@@ -0,0 +1,54 @@
+// packages/mcp/src/diagnostics/ca-trust.ts
+/**
+ * Shared helpers for the corporate TLS-inspection (CA-trust) install path.
+ *
+ * G-D #6/#7 — two questions the wizard + CLI both need answered:
+ *   1. "Did this connection fail because of a TLS-inspection root CA?"
+ *      → {@link isCaTrustError}, classifying against the canonical
+ *        {@link CA_TRUST_CODES} (no duplicate set).
+ *   2. "Can this Node read the OS trust store natively (`--use-system-ca`)?"
+ *      → {@link supportsSystemCa}, a real numeric semver compare against the
+ *        backport floor — never a string comparison.
+ *
+ * Node's `--use-system-ca` (reads Windows CryptoAPI + macOS Keychain) was
+ * stabilised on the 24.x line and backported to 22.15.0, so the floor is
+ * 22.15.0. Below that floor, a corporate CA must be supplied as a `.pem`
+ * via NODE_EXTRA_CA_CERTS. Neither path ever disables TLS verification.
+ */
+import { CA_TRUST_CODES, collectCodes } from './diagnose-network-error.js';
+/**
+ * True when `err` (or anything in its `.cause` / `AggregateError.errors`
+ * chain) carries a TLS chain-of-trust failure code — the signature of a
+ * corporate TLS-inspection proxy injecting its own root CA. Pure; reuses the
+ * same walker + code set as {@link diagnoseNetworkError}.
+ */
+export function isCaTrustError(err) {
+    return collectCodes(err).some((c) => CA_TRUST_CODES.has(c));
+}
+/** Node version that first reads the OS trust store via `--use-system-ca`. */
+export const SYSTEM_CA_NODE_FLOOR = [22, 15, 0];
+function parseNodeVersion(v) {
+    const m = /^v?(\d+)\.(\d+)\.(\d+)/.exec(v);
+    if (m === null)
+        return null;
+    return [Number(m[1]), Number(m[2]), Number(m[3])];
+}
+/**
+ * Does `nodeVersion` (default `process.version`) support `--use-system-ca`?
+ * A real numeric triple compare against {@link SYSTEM_CA_NODE_FLOOR} —
+ * fail-closed (`false`) on unparseable input.
+ */
+export function supportsSystemCa(nodeVersion = process.version) {
+    const v = parseNodeVersion(nodeVersion);
+    if (v === null)
+        return false;
+    const floor = SYSTEM_CA_NODE_FLOOR;
+    for (let i = 0; i < 3; i++) {
+        if (v[i] > floor[i])
+            return true;
+        if (v[i] < floor[i])
+            return false;
+    }
+    return true; // exactly equal to the floor
+}
+//# sourceMappingURL=ca-trust.js.map

package/dist/diagnostics/ca-trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ca-trust.js","sourceRoot":"","sources":["../../src/diagnostics/ca-trust.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAE3C;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAE3E;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY;IACvC,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,oBAAoB,GAAsC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAEnF,SAAS,gBAAgB,CAAC,CAAS;IAC/B,MAAM,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,cAAsB,OAAO,CAAC,OAAO;IAClE,MAAM,CAAC,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,KAAK,GAAG,oBAAoB,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,KAAK,CAAC,CAAC,CAAE;YAAE,OAAO,IAAI,CAAC;QACnC,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,KAAK,CAAC,CAAC,CAAE;YAAE,OAAO,KAAK,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,6BAA6B;AAC9C,CAAC"}

package/dist/diagnostics/diagnose-network-error.d.ts

@@ -0,0 +1,37 @@
+/**
+ * A human-actionable diagnosis of an outbound-connection failure.
+ *
+ * The Glöckle corporate stress-test failed with an opaque 30-second timeout
+ * that "looked like an auth or server problem" when the real cause was a
+ * TLS-inspection root CA. Mapping the low-level `.code` to a copy-pasteable fix
+ * is the difference between a 5-minute self-serve and a support ticket.
+ */
+export interface NetworkDiagnosis {
+    /** The matched low-level code, e.g. `SELF_SIGNED_CERT_IN_CHAIN`, `ENOTFOUND`, `HTTP_401`. */
+    readonly code: string;
+    /** One-line summary of what went wrong. */
+    readonly summary: string;
+    /** Actionable, copy-pasteable fix. NEVER suggests disabling TLS verification. */
+    readonly fix: string;
+}
+/**
+ * TLS chain-of-trust failures — the corporate-CA / TLS-inspection signature.
+ *
+ * Exported so the wizard's CA-detection path (`isCaTrustError`) classifies an
+ * outbound failure against the SAME canonical set — there is exactly one
+ * definition of "this is a TLS-inspection CA problem" in the package.
+ */
+export declare const CA_TRUST_CODES: ReadonlySet<string>;
+/**
+ * Walk `err`, its `.cause` chain, and any `AggregateError.errors`, collecting
+ * every `.code` string. A Node global-fetch failure (`TypeError: fetch failed`)
+ * hides the real TLS/socket code one or more `.cause` levels down.
+ */
+export declare function collectCodes(err: unknown, depth?: number): string[];
+/**
+ * Classify an outbound-connection failure into an actionable diagnosis, or
+ * `null` when nothing specific matches (the caller should fall back to the raw
+ * error message). Pure — `env` is injectable for tests.
+ */
+export declare function diagnoseNetworkError(err: unknown, env?: NodeJS.ProcessEnv): NetworkDiagnosis | null;
+//# sourceMappingURL=diagnose-network-error.d.ts.map

package/dist/diagnostics/diagnose-network-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnose-network-error.d.ts","sourceRoot":"","sources":["../../src/diagnostics/diagnose-network-error.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC7B,6FAA6F;IAC7F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2CAA2C;IAC3C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,iFAAiF;IACjF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,EAAE,WAAW,CAAC,MAAM,CAO7C,CAAC;AAmCH;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,MAAM,EAAE,CAa9D;AAOD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAChC,GAAG,EAAE,OAAO,EACZ,GAAG,GAAE,MAAM,CAAC,UAAwB,GACrC,gBAAgB,GAAG,IAAI,CAqFzB"}

package/dist/diagnostics/diagnose-network-error.js

@@ -0,0 +1,158 @@
+// packages/mcp/src/diagnostics/diagnose-network-error.ts
+/**
+ * TLS chain-of-trust failures — the corporate-CA / TLS-inspection signature.
+ *
+ * Exported so the wizard's CA-detection path (`isCaTrustError`) classifies an
+ * outbound failure against the SAME canonical set — there is exactly one
+ * definition of "this is a TLS-inspection CA problem" in the package.
+ */
+export const CA_TRUST_CODES = new Set([
+    'SELF_SIGNED_CERT_IN_CHAIN',
+    'DEPTH_ZERO_SELF_SIGNED_CERT',
+    'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
+    'UNABLE_TO_GET_ISSUER_CERT_LOCALLY',
+    'SELF_SIGNED_CERT',
+    'CERT_UNTRUSTED',
+]);
+const TIMEOUT_CODES = new Set([
+    'UND_ERR_CONNECT_TIMEOUT',
+    'ETIMEDOUT',
+    'UND_ERR_HEADERS_TIMEOUT',
+    'UND_ERR_BODY_TIMEOUT',
+]);
+const DNS_CODES = new Set(['ENOTFOUND', 'EAI_AGAIN']);
+const CA_FIX = 'On Node ≥ 22.15, the zero-export fix is `npx -y @wootsup/yt-builder-mcp setup --use-system-ca` (Node reads your OS ' +
+    'trust store / Windows cert store / macOS Keychain). Otherwise export your corporate/proxy root CA to a .pem file and ' +
+    'set NODE_EXTRA_CA_CERTS=/path/to/corp-root-ca.pem in the server entry\'s env block (re-run setup with `--ca <path>`, ' +
+    'or `… doctor` to detect it), then restart your AI client. Never disable TLS verification.';
+/** Read a string `.code` off an unknown value, or null. */
+function codeOf(value) {
+    if (value !== null && typeof value === 'object' && 'code' in value) {
+        const c = value.code;
+        if (typeof c === 'string' && c !== '')
+            return c;
+    }
+    return null;
+}
+/** Read a numeric `.status` off an unknown value (RestError-like), or null. */
+function statusOf(value) {
+    if (value !== null && typeof value === 'object' && 'status' in value) {
+        const s = value.status;
+        if (typeof s === 'number' && Number.isFinite(s))
+            return s;
+    }
+    return null;
+}
+/**
+ * Walk `err`, its `.cause` chain, and any `AggregateError.errors`, collecting
+ * every `.code` string. A Node global-fetch failure (`TypeError: fetch failed`)
+ * hides the real TLS/socket code one or more `.cause` levels down.
+ */
+export function collectCodes(err, depth = 0) {
+    if (err === null || typeof err !== 'object' || depth > 6)
+        return [];
+    const codes = [];
+    const c = codeOf(err);
+    if (c !== null)
+        codes.push(c);
+    if ('cause' in err)
+        codes.push(...collectCodes(err.cause, depth + 1));
+    if ('errors' in err) {
+        const list = err.errors;
+        if (Array.isArray(list)) {
+            for (const inner of list)
+                codes.push(...collectCodes(inner, depth + 1));
+        }
+    }
+    return codes;
+}
+/** Does the environment have any forward-proxy configured? */
+function configuredProxy(env) {
+    return env.HTTPS_PROXY ?? env.https_proxy ?? env.HTTP_PROXY ?? env.http_proxy ?? null;
+}
+/**
+ * Classify an outbound-connection failure into an actionable diagnosis, or
+ * `null` when nothing specific matches (the caller should fall back to the raw
+ * error message). Pure — `env` is injectable for tests.
+ */
+export function diagnoseNetworkError(err, env = process.env) {
+    // HTTP-status failures (RestError-like) take precedence — the request DID
+    // reach the server, so it is not a transport problem.
+    const status = statusOf(err);
+    if (status === 401 || status === 403) {
+        return {
+            code: `HTTP_${status}`,
+            summary: `The site rejected the bearer token (HTTP ${status}).`,
+            fix: 'Re-issue an MCP key in the plugin admin (YT Builder MCP → Keys) and update YTB_MCP_BEARER_TOKEN, then restart.',
+        };
+    }
+    if (status === 404) {
+        return {
+            code: 'HTTP_404',
+            summary: 'The MCP endpoint was not found (HTTP 404).',
+            fix: 'Confirm the plugin is installed + active and YTB_MCP_SITE_URL points at the site root (not wp-admin). Run `… doctor`.',
+        };
+    }
+    if (status !== null && status >= 500) {
+        return {
+            code: `HTTP_${status}`,
+            summary: `The site returned a server error (HTTP ${status}).`,
+            fix: 'Check the site\'s PHP error log; retry once it recovers. If it persists, the plugin may have crashed on this request.',
+        };
+    }
+    const codes = collectCodes(err);
+    const has = (set) => codes.find((c) => set.has(c)) ?? null;
+    const caCode = has(CA_TRUST_CODES);
+    if (caCode !== null) {
+        return {
+            code: caCode,
+            summary: 'The TLS certificate could not be verified — the signature of a corporate TLS-inspection proxy that injects its own root CA.',
+            fix: CA_FIX,
+        };
+    }
+    if (codes.includes('CERT_HAS_EXPIRED')) {
+        return {
+            code: 'CERT_HAS_EXPIRED',
+            summary: 'The TLS certificate presented for the site has expired.',
+            fix: 'Renew the site certificate. If a corporate proxy presents it, update the CA in NODE_EXTRA_CA_CERTS.',
+        };
+    }
+    const proxy = configuredProxy(env);
+    if (codes.includes('ECONNREFUSED')) {
+        return proxy !== null
+            ? {
+                code: 'ECONNREFUSED',
+                summary: `The configured proxy (${proxy}) refused the connection.`,
+                fix: `Verify HTTPS_PROXY=${proxy} is correct and reachable, and set NO_PROXY for internal hosts that must bypass it.`,
+            }
+            : {
+                code: 'ECONNREFUSED',
+                summary: 'The target host refused the connection.',
+                fix: 'Check YTB_MCP_SITE_URL is correct and the site is up and reachable from this machine.',
+            };
+    }
+    const timeoutCode = has(TIMEOUT_CODES);
+    if (timeoutCode !== null) {
+        return proxy !== null
+            ? {
+                code: timeoutCode,
+                summary: `The connection through the proxy (${proxy}) timed out.`,
+                fix: `Confirm HTTPS_PROXY=${proxy} can reach the site, and set NO_PROXY for internal hosts. Run \`… doctor\`.`,
+            }
+            : {
+                code: timeoutCode,
+                summary: 'The connection timed out.',
+                fix: 'The site may be internal (VPN needed) or require a proxy (set HTTPS_PROXY). Run `npx -y @wootsup/yt-builder-mcp doctor` to diagnose.',
+            };
+    }
+    const dnsCode = has(DNS_CODES);
+    if (dnsCode !== null) {
+        return {
+            code: dnsCode,
+            summary: 'DNS lookup failed for the site host.',
+            fix: 'Check the host in YTB_MCP_SITE_URL is spelled correctly and resolvable from this machine (VPN/DNS).',
+        };
+    }
+    return null;
+}
+//# sourceMappingURL=diagnose-network-error.js.map

package/dist/diagnostics/diagnose-network-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnose-network-error.js","sourceRoot":"","sources":["../../src/diagnostics/diagnose-network-error.ts"],"names":[],"mappings":"AAAA,yDAAyD;AAmBzD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IACvD,2BAA2B;IAC3B,6BAA6B;IAC7B,iCAAiC;IACjC,mCAAmC;IACnC,kBAAkB;IAClB,gBAAgB;CACnB,CAAC,CAAC;AAEH,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAC;IAC/C,yBAAyB;IACzB,WAAW;IACX,yBAAyB;IACzB,sBAAsB;CACzB,CAAC,CAAC;AAEH,MAAM,SAAS,GAAwB,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAE3E,MAAM,MAAM,GACR,qHAAqH;IACrH,uHAAuH;IACvH,uHAAuH;IACvH,2FAA2F,CAAC;AAEhG,2DAA2D;AAC3D,SAAS,MAAM,CAAC,KAAc;IAC1B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;QACjE,MAAM,CAAC,GAAI,KAA2B,CAAC,IAAI,CAAC;QAC5C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,+EAA+E;AAC/E,SAAS,QAAQ,CAAC,KAAc;IAC5B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;QACnE,MAAM,CAAC,GAAI,KAA6B,CAAC,MAAM,CAAC;QAChD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,GAAY,EAAE,KAAK,GAAG,CAAC;IAChD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACpE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC,KAAK,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,OAAO,IAAI,GAAG;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,YAAY,CAAE,GAA0B,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9F,IAAI,QAAQ,IAAI,GAAG,EAAE,CAAC;QAClB,MAAM,IAAI,GAAI,GAA2B,CAAC,MAAM,CAAC;QACjD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,KAAK,MAAM,KAAK,IAAI,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,8DAA8D;AAC9D,SAAS,eAAe,CAAC,GAAsB;IAC3C,OAAO,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC;AAC1F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAChC,GAAY,EACZ,MAAyB,OAAO,CAAC,GAAG;IAEpC,0EAA0E;IAC1E,sDAAsD;IACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnC,OAAO;YACH,IAAI,EAAE,QAAQ,MAAM,EAAE;YACtB,OAAO,EAAE,4CAA4C,MAAM,IAAI;YAC/D,GAAG,EAAE,gHAAgH;SACxH,CAAC;IACN,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACjB,OAAO;YACH,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,4CAA4C;YACrD,GAAG,EAAE,uHAAuH;SAC/H,CAAC;IACN,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QACnC,OAAO;YACH,IAAI,EAAE,QAAQ,MAAM,EAAE;YACtB,OAAO,EAAE,0CAA0C,MAAM,IAAI;YAC7D,GAAG,EAAE,uHAAuH;SAC/H,CAAC;IACN,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,CAAC,GAAwB,EAAiB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAE/F,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO;YACH,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,6HAA6H;YACtI,GAAG,EAAE,MAAM;SACd,CAAC;IACN,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACrC,OAAO;YACH,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,yDAAyD;YAClE,GAAG,EAAE,qGAAqG;SAC7G,CAAC;IACN,CAAC;IAED,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACjC,OAAO,KAAK,KAAK,IAAI;YACjB,CAAC,CAAC;gBACI,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,yBAAyB,KAAK,2BAA2B;gBAClE,GAAG,EAAE,sBAAsB,KAAK,qFAAqF;aACxH;YACH,CAAC,CAAC;gBACI,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,yCAAyC;gBAClD,GAAG,EAAE,uFAAuF;aAC/F,CAAC;IACZ,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC;IACvC,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,KAAK,KAAK,IAAI;YACjB,CAAC,CAAC;gBACI,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,qCAAqC,KAAK,cAAc;gBACjE,GAAG,EAAE,uBAAuB,KAAK,6EAA6E;aACjH;YACH,CAAC,CAAC;gBACI,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,2BAA2B;gBACpC,GAAG,EAAE,sIAAsI;aAC9I,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO;YACH,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,sCAAsC;YAC/C,GAAG,EAAE,qGAAqG;SAC7G,CAAC;IACN,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC"}