@wootsup/yt-builder-mcp 1.3.0 → 1.4.0

package/dist/net/internal-host.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Classify a host as internal. A host is internal when ANY of:
+ *   - it is `localhost`,
+ *   - it is a private/loopback/link-local IPv4 or IPv6 literal,
+ *   - it ends in an internal DNS suffix (`.local`, `.internal`, …),
+ *   - it is a bare single-label hostname (no dot — an intranet short name).
+ *
+ * A normal public FQDN (`example.com`, `acme.co.uk`) is NOT internal.
+ */
+export declare function isInternalHost(rawHost: string): boolean;
+/** Extract a lowercased, bracket-stripped host from a URL string, or null. */
+export declare function hostFromUrl(rawUrl: string): string | null;
+export interface NoProxyDerivation {
+    /** True when this call would change NO_PROXY (host added). */
+    readonly changed: boolean;
+    /**
+     * The effective NO_PROXY value to use. When `changed` is false this is the
+     * input value verbatim (or undefined when it was unset and stays unset).
+     */
+    readonly noProxy: string | undefined;
+    /** The internal host that was added, or null when nothing was added. */
+    readonly addedHost: string | null;
+    /** Non-fatal reason when nothing was added (for an optional debug log). */
+    readonly reason?: string;
+}
+export interface DeriveNoProxyInput {
+    /** Source of env vars. */
+    readonly env: NodeJS.ProcessEnv;
+    /** The configured site URL (typically `YTB_MCP_SITE_URL`). */
+    readonly siteUrl: string | undefined;
+}
+/**
+ * Compute the NO_PROXY value to apply so an internal site host bypasses a
+ * configured corporate proxy. Idempotent + non-clobbering:
+ *
+ *   - No proxy configured → no change (the agent isn't installed anyway).
+ *   - `siteUrl` missing / unparseable / clearly public → no change.
+ *   - Host already present in NO_PROXY (case-insensitive) → no change.
+ *   - Otherwise → append the host to the existing operator NO_PROXY (preserved
+ *     verbatim, comma-joined), or seed NO_PROXY with just the host when unset.
+ *
+ * Pure: returns the value to write; the caller mutates `process.env`.
+ */
+export declare function deriveNoProxyForInternalSite(input: DeriveNoProxyInput): NoProxyDerivation;
+//# sourceMappingURL=internal-host.d.ts.map

package/dist/net/internal-host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-host.d.ts","sourceRoot":"","sources":["../../src/net/internal-host.ts"],"names":[],"mappings":"AAmEA;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAWvD;AAED,8EAA8E;AAC9E,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASzD;AAeD,MAAM,WAAW,iBAAiB;IAC9B,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IAC/B,0BAA0B;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,kBAAkB,GAAG,iBAAiB,CAwBzF"}

package/dist/net/internal-host.js

@@ -0,0 +1,164 @@
+// packages/mcp/src/net/internal-host.ts
+/**
+ * Classify a site host as internal vs public, and derive a NO_PROXY addition
+ * for an internal host when a forward proxy is configured (Glöckle gap #9).
+ *
+ * Why this exists: when a corporate `HTTP(S)_PROXY` is set, undici's
+ * `EnvHttpProxyAgent` routes EVERYTHING through it — including traffic to an
+ * intranet WordPress/Joomla that the proxy can't (or shouldn't) reach. The
+ * `NO_PROXY` exception list fixes that, but only if the operator pre-set it.
+ * A common Glöckle-class failure: the proxy reaches the public internet fine,
+ * but the internal CMS is direct-only (or vice-versa), and outbound MCP traffic
+ * silently dies.
+ *
+ * We therefore classify the configured `YTB_MCP_SITE_URL` host and, when a
+ * proxy is set AND the host is clearly internal, add it to the effective
+ * NO_PROXY the agent reads. **Conservative by construction:** only RFC1918 /
+ * loopback / link-local IPs, `.local` / `.internal` / `.intranet` suffixes, and
+ * bare single-label hostnames (no dot) are treated as internal. A normal
+ * public FQDN is NEVER routed to NO_PROXY.
+ *
+ * Pure + env-injectable so it is unit-testable offline. Never mutates input.
+ *
+ * @license MIT
+ */
+/** Internal-by-convention DNS suffixes (RFC 6762 + common intranet TLDs). */
+const INTERNAL_SUFFIXES = ['.local', '.internal', '.intranet', '.lan', '.home.arpa'];
+/** Strip an `[…]` IPv6 bracket wrapper and a trailing `.` if present. */
+function normalizeHost(host) {
+    let h = host.trim().toLowerCase();
+    if (h.startsWith('[') && h.endsWith(']'))
+        h = h.slice(1, -1);
+    if (h.endsWith('.'))
+        h = h.slice(0, -1);
+    return h;
+}
+/** Is `host` an IPv4 literal in a private/loopback/link-local range? */
+function isPrivateIpv4(host) {
+    const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+    if (m === null)
+        return false;
+    const octets = [m[1], m[2], m[3], m[4]].map((o) => Number.parseInt(o, 10));
+    if (octets.some((o) => o > 255))
+        return false;
+    const [a, b] = octets;
+    if (a === 10)
+        return true; // 10.0.0.0/8
+    if (a === 127)
+        return true; // 127.0.0.0/8 loopback
+    if (a === 192 && b === 168)
+        return true; // 192.168.0.0/16
+    if (a === 172 && b >= 16 && b <= 31)
+        return true; // 172.16.0.0/12
+    if (a === 169 && b === 254)
+        return true; // 169.254.0.0/16 link-local
+    return false;
+}
+/** Is `host` an IPv6 loopback / unique-local (fc00::/7) / link-local (fe80::/10)? */
+function isPrivateIpv6(host) {
+    if (!host.includes(':'))
+        return false;
+    if (host === '::1')
+        return true; // loopback
+    const first = host.split(':')[0] ?? '';
+    if (first === '')
+        return false; // e.g. "::" unspecified — not a real site host
+    const prefix = Number.parseInt(first, 16);
+    if (Number.isNaN(prefix))
+        return false;
+    // fc00::/7 (unique-local) → first hextet 0xfc00–0xfdff.
+    if (prefix >= 0xfc00 && prefix <= 0xfdff)
+        return true;
+    // fe80::/10 (link-local) → first hextet 0xfe80–0xfebf.
+    if (prefix >= 0xfe80 && prefix <= 0xfebf)
+        return true;
+    return false;
+}
+/**
+ * Classify a host as internal. A host is internal when ANY of:
+ *   - it is `localhost`,
+ *   - it is a private/loopback/link-local IPv4 or IPv6 literal,
+ *   - it ends in an internal DNS suffix (`.local`, `.internal`, …),
+ *   - it is a bare single-label hostname (no dot — an intranet short name).
+ *
+ * A normal public FQDN (`example.com`, `acme.co.uk`) is NOT internal.
+ */
+export function isInternalHost(rawHost) {
+    const host = normalizeHost(rawHost);
+    if (host === '')
+        return false;
+    if (host === 'localhost')
+        return true;
+    if (isPrivateIpv4(host))
+        return true;
+    if (isPrivateIpv6(host))
+        return true;
+    if (INTERNAL_SUFFIXES.some((s) => host.endsWith(s)))
+        return true;
+    // A bare hostname with no dot is an intranet short name (e.g. "wpserver").
+    // IPv6 literals contain ":" and are handled above; guard against them here.
+    if (!host.includes('.') && !host.includes(':'))
+        return true;
+    return false;
+}
+/** Extract a lowercased, bracket-stripped host from a URL string, or null. */
+export function hostFromUrl(rawUrl) {
+    const url = rawUrl.trim();
+    if (url === '')
+        return null;
+    try {
+        const parsed = new URL(url);
+        return normalizeHost(parsed.hostname);
+    }
+    catch {
+        return null;
+    }
+}
+/** Is any forward-proxy configured in `env`? */
+function hasProxyConfigured(env) {
+    return Boolean(env.HTTPS_PROXY ?? env.https_proxy ?? env.HTTP_PROXY ?? env.http_proxy);
+}
+/** Split a NO_PROXY string into trimmed, lowercased, non-empty entries. */
+function splitNoProxy(value) {
+    return value
+        .split(',')
+        .map((e) => e.trim().toLowerCase())
+        .filter((e) => e !== '');
+}
+/**
+ * Compute the NO_PROXY value to apply so an internal site host bypasses a
+ * configured corporate proxy. Idempotent + non-clobbering:
+ *
+ *   - No proxy configured → no change (the agent isn't installed anyway).
+ *   - `siteUrl` missing / unparseable / clearly public → no change.
+ *   - Host already present in NO_PROXY (case-insensitive) → no change.
+ *   - Otherwise → append the host to the existing operator NO_PROXY (preserved
+ *     verbatim, comma-joined), or seed NO_PROXY with just the host when unset.
+ *
+ * Pure: returns the value to write; the caller mutates `process.env`.
+ */
+export function deriveNoProxyForInternalSite(input) {
+    const { env, siteUrl } = input;
+    const current = env.NO_PROXY ?? env.no_proxy;
+    if (!hasProxyConfigured(env)) {
+        return { changed: false, noProxy: current, addedHost: null, reason: 'no proxy configured' };
+    }
+    const host = siteUrl !== undefined ? hostFromUrl(siteUrl) : null;
+    if (host === null) {
+        return { changed: false, noProxy: current, addedHost: null, reason: 'no parseable site URL' };
+    }
+    if (!isInternalHost(host)) {
+        return { changed: false, noProxy: current, addedHost: null, reason: 'site host is public' };
+    }
+    const existing = current !== undefined ? splitNoProxy(current) : [];
+    if (existing.includes(host)) {
+        return { changed: false, noProxy: current, addedHost: null, reason: 'host already in NO_PROXY' };
+    }
+    // Append, preserving the operator's existing entries verbatim (original
+    // casing/order) — we only add the host at the end.
+    const next = current !== undefined && current.trim() !== ''
+        ? `${current},${host}`
+        : host;
+    return { changed: true, noProxy: next, addedHost: host };
+}
+//# sourceMappingURL=internal-host.js.map

package/dist/net/internal-host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-host.js","sourceRoot":"","sources":["../../src/net/internal-host.ts"],"names":[],"mappings":"AAAA,wCAAwC;AAExC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,6EAA6E;AAC7E,MAAM,iBAAiB,GAAsB,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;AAExG,yEAAyE;AACzE,SAAS,aAAa,CAAC,IAAY;IAC/B,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxC,OAAO,CAAC,CAAC;AACb,CAAC;AAED,wEAAwE;AACxE,SAAS,aAAa,CAAC,IAAY;IAC/B,MAAM,CAAC,GAAG,8CAA8C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpE,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC5E,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAA0C,CAAC;IAC1D,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC,CAAC,aAAa;IACxC,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,uBAAuB;IACnD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,iBAAiB;IAC1D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,CAAC,gBAAgB;IAClE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,4BAA4B;IACrE,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,qFAAqF;AACrF,SAAS,aAAa,CAAC,IAAY;IAC/B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC,CAAC,WAAW;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC,CAAC,+CAA+C;IAC/E,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,wDAAwD;IACxD,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM;QAAE,OAAO,IAAI,CAAC;IACtD,uDAAuD;IACvD,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC1C,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,2EAA2E;IAC3E,4EAA4E;IAC5E,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,WAAW,CAAC,MAAc;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED,gDAAgD;AAChD,SAAS,kBAAkB,CAAC,GAAsB;IAC9C,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;AAC3F,CAAC;AAED,2EAA2E;AAC3E,SAAS,YAAY,CAAC,KAAa;IAC/B,OAAO,KAAK;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAClC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AACjC,CAAC;AAuBD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAyB;IAClE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC/B,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC;IAE7C,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAChG,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAClG,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAChG,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IACrG,CAAC;IACD,wEAAwE;IACxE,mDAAmD;IACnD,MAAM,IAAI,GAAG,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;QACvD,CAAC,CAAC,GAAG,OAAO,IAAI,IAAI,EAAE;QACtB,CAAC,CAAC,IAAI,CAAC;IACX,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC7D,CAAC"}

package/dist/net/proxy-dispatcher.d.ts

@@ -0,0 +1,40 @@
+import { type Dispatcher } from 'undici';
+/**
+ * Injection seam for tests — production uses the real undici functions + env.
+ */
+export interface ProxyDispatcherDeps {
+    /** Defaults to `process.env`. Read for HTTP(S)_PROXY presence. */
+    env?: NodeJS.ProcessEnv;
+    /** Defaults to undici's {@link undiciSetGlobalDispatcher}. */
+    setGlobalDispatcher?: (dispatcher: Dispatcher) => void;
+    /** Defaults to `() => new EnvHttpProxyAgent()`. */
+    makeEnvHttpProxyAgent?: () => Dispatcher;
+    /** Defaults to `console.error`. */
+    stderr?: (message: string) => void;
+}
+/**
+ * Install a process-global undici dispatcher that honors the enterprise
+ * `HTTP_PROXY` / `HTTPS_PROXY` / `NO_PROXY` environment variables at request
+ * time (undici's {@link EnvHttpProxyAgent}).
+ *
+ * Why this exists: Node's global `fetch` only auto-honors proxy env vars from
+ * **Node 24** (`NODE_USE_ENV_PROXY`). On the Node 18–23 floor this package
+ * supports, an enterprise forward/auth proxy is otherwise ignored and outbound
+ * MCP traffic silently fails. Node's global `fetch` reads the global dispatcher,
+ * and so does the MCP SDK's `StreamableHTTPClientTransport` (proxy mode) and the
+ * fat-mode `RestClient` — so one global dispatcher covers every outbound call.
+ *
+ * Installed ONLY when a forward proxy is actually configured
+ * (`HTTP_PROXY`/`HTTPS_PROXY`). With no proxy env, the default dispatcher (a
+ * direct connection) is already correct, so we skip — this also avoids undici's
+ * `EnvHttpProxyAgent is experimental` startup warning for the common, direct
+ * case. Corporate TLS-inspection root CAs are handled separately by Node's
+ * native `NODE_EXTRA_CA_CERTS` (undici's default connector honors it).
+ *
+ * Never throws: a failure to install (exotic runtime, frozen global) degrades
+ * to a stderr warning and a direct connection, returning `false`.
+ *
+ * @returns `true` if the dispatcher was installed, `false` if skipped/degraded.
+ */
+export declare function installGlobalProxyDispatcher(deps?: ProxyDispatcherDeps): boolean;
+//# sourceMappingURL=proxy-dispatcher.d.ts.map

package/dist/net/proxy-dispatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-dispatcher.d.ts","sourceRoot":"","sources":["../../src/net/proxy-dispatcher.ts"],"names":[],"mappings":"AACA,OAAO,EAAuE,KAAK,UAAU,EAAE,MAAM,QAAQ,CAAC;AAI9G;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAChC,kEAAkE;IAClE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,8DAA8D;IAC9D,mBAAmB,CAAC,EAAE,CAAC,UAAU,EAAE,UAAU,KAAK,IAAI,CAAC;IACvD,mDAAmD;IACnD,qBAAqB,CAAC,EAAE,MAAM,UAAU,CAAC;IACzC,mCAAmC;IACnC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC;AAOD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAkCpF"}

package/dist/net/proxy-dispatcher.js

@@ -0,0 +1,65 @@
+// packages/mcp/src/net/proxy-dispatcher.ts
+import { EnvHttpProxyAgent, setGlobalDispatcher as undiciSetGlobalDispatcher } from 'undici';
+import { deriveNoProxyForInternalSite } from './internal-host.js';
+/** Is any forward-proxy configured in the environment? */
+function hasProxyConfigured(env) {
+    return Boolean(env.HTTPS_PROXY ?? env.https_proxy ?? env.HTTP_PROXY ?? env.http_proxy);
+}
+/**
+ * Install a process-global undici dispatcher that honors the enterprise
+ * `HTTP_PROXY` / `HTTPS_PROXY` / `NO_PROXY` environment variables at request
+ * time (undici's {@link EnvHttpProxyAgent}).
+ *
+ * Why this exists: Node's global `fetch` only auto-honors proxy env vars from
+ * **Node 24** (`NODE_USE_ENV_PROXY`). On the Node 18–23 floor this package
+ * supports, an enterprise forward/auth proxy is otherwise ignored and outbound
+ * MCP traffic silently fails. Node's global `fetch` reads the global dispatcher,
+ * and so does the MCP SDK's `StreamableHTTPClientTransport` (proxy mode) and the
+ * fat-mode `RestClient` — so one global dispatcher covers every outbound call.
+ *
+ * Installed ONLY when a forward proxy is actually configured
+ * (`HTTP_PROXY`/`HTTPS_PROXY`). With no proxy env, the default dispatcher (a
+ * direct connection) is already correct, so we skip — this also avoids undici's
+ * `EnvHttpProxyAgent is experimental` startup warning for the common, direct
+ * case. Corporate TLS-inspection root CAs are handled separately by Node's
+ * native `NODE_EXTRA_CA_CERTS` (undici's default connector honors it).
+ *
+ * Never throws: a failure to install (exotic runtime, frozen global) degrades
+ * to a stderr warning and a direct connection, returning `false`.
+ *
+ * @returns `true` if the dispatcher was installed, `false` if skipped/degraded.
+ */
+export function installGlobalProxyDispatcher(deps = {}) {
+    const env = deps.env ?? process.env;
+    if (!hasProxyConfigured(env)) {
+        // No proxy to honor — leave the default (direct) dispatcher in place.
+        return false;
+    }
+    const setDispatcher = deps.setGlobalDispatcher ?? undiciSetGlobalDispatcher;
+    const makeAgent = deps.makeEnvHttpProxyAgent ?? (() => new EnvHttpProxyAgent());
+    const warn = deps.stderr ?? ((message) => console.error(message));
+    // Glöckle gap #9 — when the configured site is INTERNAL (RFC1918 / .local /
+    // bare hostname / loopback), make sure its host is in NO_PROXY so intranet
+    // traffic bypasses the corporate proxy. Idempotent + non-clobbering: the
+    // operator's NO_PROXY is preserved verbatim, the host is only appended.
+    // We mutate `env` BEFORE constructing the agent because EnvHttpProxyAgent
+    // snapshots NO_PROXY at construction. Public hosts are never touched.
+    const noProxy = deriveNoProxyForInternalSite({ env, siteUrl: env.YTB_MCP_SITE_URL });
+    if (noProxy.changed && noProxy.noProxy !== undefined) {
+        // Set BOTH cases so undici reads it regardless of which it prefers.
+        env.NO_PROXY = noProxy.noProxy;
+        env.no_proxy = noProxy.noProxy;
+        warn(`[yt-builder-mcp] internal site host "${noProxy.addedHost ?? ''}" added to NO_PROXY so it bypasses the configured proxy.`);
+    }
+    try {
+        setDispatcher(makeAgent());
+        return true;
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        // stderr only — stdout is the JSON-RPC channel in stdio transport.
+        warn(`[yt-builder-mcp] proxy dispatcher init failed (continuing with a direct connection): ${message}`);
+        return false;
+    }
+}
+//# sourceMappingURL=proxy-dispatcher.js.map

package/dist/net/proxy-dispatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-dispatcher.js","sourceRoot":"","sources":["../../src/net/proxy-dispatcher.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,IAAI,yBAAyB,EAAmB,MAAM,QAAQ,CAAC;AAE9G,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAgBlE,0DAA0D;AAC1D,SAAS,kBAAkB,CAAC,GAAsB;IAC9C,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAA4B,EAAE;IACvE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,sEAAsE;QACtE,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,IAAI,yBAAyB,CAAC;IAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,qBAAqB,IAAI,CAAC,GAAe,EAAE,CAAC,IAAI,iBAAiB,EAAE,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,OAAe,EAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAEhF,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,OAAO,GAAG,4BAA4B,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACrF,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnD,oEAAoE;QACpE,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,wCAAwC,OAAO,CAAC,SAAS,IAAI,EAAE,0DAA0D,CAAC,CAAC;IACpI,CAAC;IAED,IAAI,CAAC;QACD,aAAa,CAAC,SAAS,EAAE,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,mEAAmE;QACnE,IAAI,CAAC,wFAAwF,OAAO,EAAE,CAAC,CAAC;QACxG,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC"}

package/dist/proxy/bridge.d.ts

@@ -13,24 +13,31 @@ import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';
  * therefore `.catch()`es its `send()`.
  */
 export declare function bridgeTransports(local: Transport, remote: Transport): void;
-/** Build the real transports + bridge them; resolves when EITHER side closes. */
-export declare function runProxy(config: {
+/** Config the proxy run needs: the upstream endpoint, the Bearer, and any
+ * corporate extra headers (Glöckle gap #14) to attach to every upstream
+ * request. The Bearer always wins on collision. */
+interface ProxyConfig {
     endpointUrl: URL;
     token: string;
-}, deps?: {
-    makeTransports?: (c: {
-        endpointUrl: URL;
-        token: string;
-    }) => {
+    /** Extra headers from `YTB_MCP_EXTRA_HEADERS` (Basic-Auth / WAF / gateway). */
+    extraHeaders?: Record<string, string>;
+}
+/**
+ * Build the upstream `requestInit.headers` for proxy mode: the Bearer is
+ * authoritative; corporate extra headers (Glöckle gap #14) only fill gaps —
+ * `Authorization` can NEVER be overwritten. Exported for unit tests.
+ */
+export declare function buildProxyRequestHeaders(config: ProxyConfig): Record<string, string>;
+/** Build the real transports + bridge them; resolves when EITHER side closes. */
+export declare function runProxy(config: ProxyConfig, deps?: {
+    makeTransports?: (c: ProxyConfig) => {
         local: Transport;
         remote: Transport;
     };
 }): Promise<void>;
 /** Returns true if proxy mode handled the run; false → caller continues with fat. */
 export declare function maybeRunProxy(env: NodeJS.ProcessEnv, deps?: {
-    runProxy?: (c: {
-        endpointUrl: URL;
-        token: string;
-    }) => Promise<void>;
+    runProxy?: (c: ProxyConfig) => Promise<void>;
 }): Promise<boolean>;
+export {};
 //# sourceMappingURL=bridge.d.ts.map

package/dist/proxy/bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../../src/proxy/bridge.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AA6B/E;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,GAAG,IAAI,CA2C1E;AAcD,iFAAiF;AACjF,wBAAsB,QAAQ,CAC5B,MAAM,EAAE;IAAE,WAAW,EAAE,GAAG,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAC3C,IAAI,GAAE;IACJ,cAAc,CAAC,EAAE,CAAC,CAAC,EAAE;QAAE,WAAW,EAAE,GAAG,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK;QAC3D,KAAK,EAAE,SAAS,CAAC;QACjB,MAAM,EAAE,SAAS,CAAC;KACnB,CAAC;CACE,GACL,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,qFAAqF;AACrF,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE;QAAE,WAAW,EAAE,GAAG,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAO,GAClF,OAAO,CAAC,OAAO,CAAC,CAMlB"}
+{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../../src/proxy/bridge.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AA+B/E;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,GAAG,IAAI,CAoD1E;AAED;;mDAEmD;AACnD,UAAU,WAAW;IACnB,WAAW,EAAE,GAAG,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAKpF;AAcD,iFAAiF;AACjF,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,WAAW,EACnB,IAAI,GAAE;IACJ,cAAc,CAAC,EAAE,CAAC,CAAC,EAAE,WAAW,KAAK;QACnC,KAAK,EAAE,SAAS,CAAC;QACjB,MAAM,EAAE,SAAS,CAAC;KACnB,CAAC;CACE,GACL,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,qFAAqF;AACrF,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAO,GAC1D,OAAO,CAAC,OAAO,CAAC,CAalB"}

package/dist/proxy/bridge.js

@@ -1,6 +1,8 @@
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
 import { resolveMode } from './mode.js';
+import { diagnoseNetworkError } from '../diagnostics/diagnose-network-error.js';
+import { mergeExtraHeaders, parseExtraHeaders } from '../net/extra-headers.js';
 /** Narrow an unknown caught value to a human-readable message (no `any`). */
 function errorMessage(err) {
     if (err instanceof Error)
@@ -43,8 +45,14 @@ export function bridgeTransports(local, remote) {
     local.onmessage = (msg) => {
         remote.send(msg).catch((err) => {
             const message = errorMessage(err);
+            // Turn an opaque transport failure (TLS-inspection CA, proxy, DNS,
+            // timeout) into an actionable hint — the Glöckle stress-test died with a
+            // 30s timeout that looked like an auth problem. Falls back to the generic
+            // config hint when the cause is not recognised.
+            const diag = diagnoseNetworkError(err);
+            const hint = diag !== null ? `${diag.summary} Fix: ${diag.fix}` : 'Check YTB_MCP_SITE_URL / YTB_MCP_BEARER_TOKEN.';
             // stderr only — stdout is the JSON-RPC channel.
-            console.error('[yt-builder-proxy] upstream send failed:', message);
+            console.error('[yt-builder-proxy] upstream send failed:', message + (diag !== null ? `\n  → ${diag.fix}` : ''));
             const id = requestId(msg);
             if (id !== null) {
                 // Hand the client an actionable error instead of a dead pipe.
@@ -53,7 +61,7 @@ export function bridgeTransports(local, remote) {
                     id,
                     error: {
                         code: -32000,
-                        message: `Proxy upstream error: ${message}. Check YTB_MCP_SITE_URL / YTB_MCP_BEARER_TOKEN.`,
+                        message: `Proxy upstream error: ${message}. ${hint}`,
                     },
                 };
                 local.send(frame).catch((sendErr) => {
@@ -84,10 +92,21 @@ export function bridgeTransports(local, remote) {
         console.error('[yt-builder-proxy] remote transport error:', err.message);
     };
 }
+/**
+ * Build the upstream `requestInit.headers` for proxy mode: the Bearer is
+ * authoritative; corporate extra headers (Glöckle gap #14) only fill gaps —
+ * `Authorization` can NEVER be overwritten. Exported for unit tests.
+ */
+export function buildProxyRequestHeaders(config) {
+    const base = { Authorization: `Bearer ${config.token}` };
+    return config.extraHeaders !== undefined && Object.keys(config.extraHeaders).length > 0
+        ? mergeExtraHeaders(base, config.extraHeaders)
+        : base;
+}
 /** Injection seam for tests — production builds the real SDK transports. */
 function defaultTransports(config) {
     const remote = new StreamableHTTPClientTransport(config.endpointUrl, {
-        requestInit: { headers: { Authorization: `Bearer ${config.token}` } },
+        requestInit: { headers: buildProxyRequestHeaders(config) },
     });
     const local = new StdioServerTransport();
     return { local, remote };
@@ -123,7 +142,14 @@ export async function maybeRunProxy(env, deps = {}) {
     if (resolved.mode !== 'proxy')
         return false;
     const run = deps.runProxy ?? runProxy;
-    await run({ endpointUrl: resolved.endpointUrl, token: resolved.token });
+    // Glöckle gap #14 — attach corporate extra headers (Basic-Auth / WAF / gateway)
+    // to every upstream request. parseExtraHeaders reads YTB_MCP_EXTRA_HEADERS.
+    const { headers: extraHeaders } = parseExtraHeaders(env);
+    await run({
+        endpointUrl: resolved.endpointUrl,
+        token: resolved.token,
+        ...(Object.keys(extraHeaders).length > 0 ? { extraHeaders } : {}),
+    });
     return true;
 }
 //# sourceMappingURL=bridge.js.map

package/dist/proxy/bridge.js.map

@@ -1 +1 @@
-{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../../src/proxy/bridge.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,6EAA6E;AAC7E,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,eAAe,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC;QAC3D,MAAM,EAAE,GAAI,GAAuB,CAAC,EAAE,CAAC;QACvC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAgB,EAAE,MAAiB;IAClE,KAAK,CAAC,SAAS,GAAG,CAAC,GAAG,EAAE,EAAE;QACxB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtC,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YAClC,gDAAgD;YAChD,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,OAAO,CAAC,CAAC;YACnE,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,8DAA8D;gBAC9D,MAAM,KAAK,GAAG;oBACZ,OAAO,EAAE,KAAK;oBACd,EAAE;oBACF,KAAK,EAAE;wBACL,IAAI,EAAE,CAAC,KAAK;wBACZ,OAAO,EAAE,yBAAyB,OAAO,kDAAkD;qBAC5F;iBACF,CAAC;gBACF,KAAK,CAAC,IAAI,CAAC,KAAkC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAgB,EAAE,EAAE;oBACxE,OAAO,CAAC,KAAK,CAAC,mDAAmD,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC5F,CAAC,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,mEAAmE;gBACnE,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;YACtB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,MAAM,CAAC,SAAS,GAAG,CAAC,GAAG,EAAE,EAAE;QACzB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACrC,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;QACjF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,KAAK,CAAC,OAAO,GAAG,GAAG,EAAE;QACnB,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC,CAAC;IACF,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE;QACpB,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC,CAAC;IACF,KAAK,CAAC,OAAO,GAAG,CAAC,GAAG,EAAE,EAAE;QACtB,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1E,CAAC,CAAC;IACF,MAAM,CAAC,OAAO,GAAG,CAAC,GAAG,EAAE,EAAE;QACvB,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3E,CAAC,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,SAAS,iBAAiB,CAAC,MAA2C;IAIpE,MAAM,MAAM,GAAG,IAAI,6BAA6B,CAAC,MAAM,CAAC,WAAW,EAAE;QACnE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE;KACtE,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,oBAAoB,EAAE,CAAC;IACzC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,MAA2C,EAC3C,OAKI,EAAE;IAEN,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;IAE7E,wEAAwE;IACxE,2EAA2E;IAC3E,oCAAoC;IACpC,MAAM,MAAM,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAC3C,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAChC,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC;QACrC,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC;QACvC,KAAK,CAAC,OAAO,GAAG,GAAG,EAAE;YACnB,cAAc,EAAE,EAAE,CAAC;YACnB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE;YACpB,eAAe,EAAE,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACpB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACrB,MAAM,MAAM,CAAC;AACf,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAsB,EACtB,OAAiF,EAAE;IAEnF,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;IACtC,MAAM,GAAG,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IACxE,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../../src/proxy/bridge.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE/E,6EAA6E;AAC7E,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,eAAe,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC;QAC3D,MAAM,EAAE,GAAI,GAAuB,CAAC,EAAE,CAAC;QACvC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAgB,EAAE,MAAiB;IAClE,KAAK,CAAC,SAAS,GAAG,CAAC,GAAG,EAAE,EAAE;QACxB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtC,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YAClC,mEAAmE;YACnE,yEAAyE;YACzE,0EAA0E;YAC1E,gDAAgD;YAChD,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,gDAAgD,CAAC;YACnH,gDAAgD;YAChD,OAAO,CAAC,KAAK,CACX,0CAA0C,EAC1C,OAAO,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACrD,CAAC;YACF,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,8DAA8D;gBAC9D,MAAM,KAAK,GAAG;oBACZ,OAAO,EAAE,KAAK;oBACd,EAAE;oBACF,KAAK,EAAE;wBACL,IAAI,EAAE,CAAC,KAAK;wBACZ,OAAO,EAAE,yBAAyB,OAAO,KAAK,IAAI,EAAE;qBACrD;iBACF,CAAC;gBACF,KAAK,CAAC,IAAI,CAAC,KAAkC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAgB,EAAE,EAAE;oBACxE,OAAO,CAAC,KAAK,CAAC,mDAAmD,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC5F,CAAC,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,mEAAmE;gBACnE,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;YACtB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,MAAM,CAAC,SAAS,GAAG,CAAC,GAAG,EAAE,EAAE;QACzB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACrC,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;QACjF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,KAAK,CAAC,OAAO,GAAG,GAAG,EAAE;QACnB,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC,CAAC;IACF,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE;QACpB,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC,CAAC;IACF,KAAK,CAAC,OAAO,GAAG,CAAC,GAAG,EAAE,EAAE;QACtB,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1E,CAAC,CAAC;IACF,MAAM,CAAC,OAAO,GAAG,CAAC,GAAG,EAAE,EAAE;QACvB,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3E,CAAC,CAAC;AACJ,CAAC;AAYD;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAmB;IAC1D,MAAM,IAAI,GAA2B,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;IACjF,OAAO,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC;QACrF,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,CAAC;QAC9C,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,4EAA4E;AAC5E,SAAS,iBAAiB,CAAC,MAAmB;IAI5C,MAAM,MAAM,GAAG,IAAI,6BAA6B,CAAC,MAAM,CAAC,WAAW,EAAE;QACnE,WAAW,EAAE,EAAE,OAAO,EAAE,wBAAwB,CAAC,MAAM,CAAC,EAAE;KAC3D,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,oBAAoB,EAAE,CAAC;IACzC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,MAAmB,EACnB,OAKI,EAAE;IAEN,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;IAE7E,wEAAwE;IACxE,2EAA2E;IAC3E,oCAAoC;IACpC,MAAM,MAAM,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAC3C,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAChC,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC;QACrC,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC;QACvC,KAAK,CAAC,OAAO,GAAG,GAAG,EAAE;YACnB,cAAc,EAAE,EAAE,CAAC;YACnB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE;YACpB,eAAe,EAAE,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACpB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACrB,MAAM,MAAM,CAAC;AACf,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAsB,EACtB,OAAyD,EAAE;IAE3D,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;IACtC,gFAAgF;IAChF,4EAA4E;IAC5E,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACzD,MAAM,GAAG,CAAC;QACR,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/setup-ca-env.d.ts

@@ -0,0 +1,40 @@
+/**
+ * `setup-ca-env` — translate a wizard/CLI CA choice into MCP-server env keys.
+ *
+ * G-D #7: corporate TLS-inspection has two trust strategies, and exactly which
+ * env the server entry needs depends on the running Node:
+ *
+ *   - **file mode** (`caCertPath`): write `NODE_EXTRA_CA_CERTS=<path>`. Works on
+ *     every supported Node; the only option below the system-CA floor.
+ *   - **system mode** (`caMode: 'system'`): write `NODE_OPTIONS=--use-system-ca`
+ *     so Node reads the OS trust store (Windows CryptoAPI / macOS Keychain) —
+ *     the zero-export path, but only on Node ≥ 22.15. Below that floor we emit
+ *     NOTHING and warn to supply a `.pem` instead, so we never write a flag the
+ *     target Node would reject at startup.
+ *
+ * Pure + Node-version-injectable so it is unit-testable offline. Never disables
+ * TLS verification.
+ *
+ * @license MIT
+ */
+/** The CA-trust portion of a {@link WizardAnswers}. */
+export interface CaChoice {
+    readonly caCertPath?: string;
+    readonly caMode?: 'system';
+}
+export interface CaEnvResult {
+    /** Env keys to merge into the MCP server entry's env block. */
+    readonly env: Record<string, string>;
+    /** Non-fatal warnings (e.g. system-CA requested on too-old a Node). */
+    readonly warnings: readonly string[];
+}
+/**
+ * Resolve the CA env-block keys for `choice` under `nodeVersion` (default
+ * `process.version`). `currentEnv` (default `process.env`) is only read to
+ * preserve a pre-existing `NODE_OPTIONS` when appending the system-CA flag.
+ *
+ * File mode wins deterministically if both are set (an explicit `.pem` is the
+ * stronger signal). Pure — returns a fresh object, mutates nothing.
+ */
+export declare function buildCaEnv(choice: CaChoice, nodeVersion?: string, currentEnv?: NodeJS.ProcessEnv): CaEnvResult;
+//# sourceMappingURL=setup-ca-env.d.ts.map

package/dist/setup-ca-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-ca-env.d.ts","sourceRoot":"","sources":["../src/setup-ca-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,uDAAuD;AACvD,MAAM,WAAW,QAAQ;IACrB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;CAC9B;AAED,MAAM,WAAW,WAAW;IACxB,+DAA+D;IAC/D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAYD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CACtB,MAAM,EAAE,QAAQ,EAChB,WAAW,GAAE,MAAwB,EACrC,UAAU,GAAE,MAAM,CAAC,UAAwB,GAC5C,WAAW,CAoBb"}

package/dist/setup-ca-env.js

@@ -0,0 +1,58 @@
+/**
+ * `setup-ca-env` — translate a wizard/CLI CA choice into MCP-server env keys.
+ *
+ * G-D #7: corporate TLS-inspection has two trust strategies, and exactly which
+ * env the server entry needs depends on the running Node:
+ *
+ *   - **file mode** (`caCertPath`): write `NODE_EXTRA_CA_CERTS=<path>`. Works on
+ *     every supported Node; the only option below the system-CA floor.
+ *   - **system mode** (`caMode: 'system'`): write `NODE_OPTIONS=--use-system-ca`
+ *     so Node reads the OS trust store (Windows CryptoAPI / macOS Keychain) —
+ *     the zero-export path, but only on Node ≥ 22.15. Below that floor we emit
+ *     NOTHING and warn to supply a `.pem` instead, so we never write a flag the
+ *     target Node would reject at startup.
+ *
+ * Pure + Node-version-injectable so it is unit-testable offline. Never disables
+ * TLS verification.
+ *
+ * @license MIT
+ */
+import { supportsSystemCa } from './diagnostics/ca-trust.js';
+const SYSTEM_CA_FLAG = '--use-system-ca';
+/** Append `--use-system-ca` to an existing NODE_OPTIONS without duplicating it. */
+function withSystemCaFlag(existing) {
+    const trimmed = (existing ?? '').trim();
+    if (trimmed === '')
+        return SYSTEM_CA_FLAG;
+    if (trimmed.split(/\s+/).includes(SYSTEM_CA_FLAG))
+        return trimmed;
+    return `${trimmed} ${SYSTEM_CA_FLAG}`;
+}
+/**
+ * Resolve the CA env-block keys for `choice` under `nodeVersion` (default
+ * `process.version`). `currentEnv` (default `process.env`) is only read to
+ * preserve a pre-existing `NODE_OPTIONS` when appending the system-CA flag.
+ *
+ * File mode wins deterministically if both are set (an explicit `.pem` is the
+ * stronger signal). Pure — returns a fresh object, mutates nothing.
+ */
+export function buildCaEnv(choice, nodeVersion = process.version, currentEnv = process.env) {
+    const path = choice.caCertPath?.trim();
+    if (path !== undefined && path !== '') {
+        return { env: { NODE_EXTRA_CA_CERTS: path }, warnings: [] };
+    }
+    if (choice.caMode === 'system') {
+        if (supportsSystemCa(nodeVersion)) {
+            return { env: { NODE_OPTIONS: withSystemCaFlag(currentEnv.NODE_OPTIONS) }, warnings: [] };
+        }
+        return {
+            env: {},
+            warnings: [
+                `OS trust store (--use-system-ca) needs Node ≥ 22.15 — this Node is ${nodeVersion}. ` +
+                    'Re-run setup with `--ca <path-to-corp-root-ca.pem>` (export your corporate root CA to a .pem) instead. Never disable TLS verification.',
+            ],
+        };
+    }
+    return { env: {}, warnings: [] };
+}
+//# sourceMappingURL=setup-ca-env.js.map

package/dist/setup-ca-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-ca-env.js","sourceRoot":"","sources":["../src/setup-ca-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAe7D,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAEzC,mFAAmF;AACnF,SAAS,gBAAgB,CAAC,QAA4B;IAClD,MAAM,OAAO,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,cAAc,CAAC;IAC1C,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,OAAO,CAAC;IAClE,OAAO,GAAG,OAAO,IAAI,cAAc,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CACtB,MAAgB,EAChB,cAAsB,OAAO,CAAC,OAAO,EACrC,aAAgC,OAAO,CAAC,GAAG;IAE3C,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IACvC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QACpC,OAAO,EAAE,GAAG,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAChE,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,GAAG,EAAE,EAAE,YAAY,EAAE,gBAAgB,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC9F,CAAC;QACD,OAAO;YACH,GAAG,EAAE,EAAE;YACP,QAAQ,EAAE;gBACN,sEAAsE,WAAW,IAAI;oBACjF,wIAAwI;aAC/I;SACJ,CAAC;IACN,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AACrC,CAAC"}

package/dist/setup-ca-reprobe.d.ts

@@ -0,0 +1,38 @@
+/**
+ * `setup-ca-reprobe` — default `WizardDeps.applyAndReProbe` (G-D #6/#8).
+ *
+ * After the user picks a corporate-CA strategy, RE-PROBE the connection so the
+ * wizard can print ✅/❌ now instead of leaving a silent first-tool-call
+ * timeout for after the restart:
+ *
+ *   - **file mode**: read the `.pem` and run the probes through an undici
+ *     `Agent` whose connector trusts that CA — this validates in-process,
+ *     immediately, without a restart.
+ *   - **system mode**: the OS trust store is only consulted when Node is
+ *     (re)started with `--use-system-ca`, which the written config now does —
+ *     so we re-run the ordinary probes (best-effort) and report the truthful
+ *     current state; the config is already correct for the next launch.
+ *
+ * Never disables TLS verification.
+ *
+ * @license MIT
+ */
+import type { AuthProbeResult, CaPromptChoice, HealthProbeResult } from './setup-wizard-types.js';
+/**
+ * Probe health + auth for `wpUrl`/`bearer` under the chosen CA. The probes are
+ * injected (default to the real handshake probes) so this stays testable; the
+ * file-mode CA wiring is the only real-I/O part and is exercised by an
+ * integration probe, never a unit mock.
+ */
+export declare function defaultApplyAndReProbe(input: {
+    readonly wpUrl: string;
+    readonly bearer: string;
+    readonly choice: CaPromptChoice;
+}, probes?: {
+    probeHealth?: (wpUrl: string, fetchImpl?: typeof fetch) => Promise<HealthProbeResult>;
+    probeAuth?: (wpUrl: string, bearer: string, fetchImpl?: typeof fetch) => Promise<AuthProbeResult>;
+}): Promise<{
+    health: HealthProbeResult;
+    auth: AuthProbeResult;
+}>;
+//# sourceMappingURL=setup-ca-reprobe.d.ts.map

package/dist/setup-ca-reprobe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-ca-reprobe.d.ts","sourceRoot":"","sources":["../src/setup-ca-reprobe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAElG;;;;;GAKG;AACH,wBAAsB,sBAAsB,CACxC,KAAK,EAAE;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;CAAE,EAC3F,MAAM,GAAE;IACJ,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,KAAK,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACtF,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,KAAK,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CAChG,GACP,OAAO,CAAC;IAAE,MAAM,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,CAAC,CAkB/D"}