@wootsup/yt-builder-mcp 1.4.1 → 1.6.0

package/dist/gateway/essentials.js

@@ -15,11 +15,20 @@
  *                                 entirely (no forward, no capture) so the
  *                                 SDK never sees a duplicate registration.
  *
- * Why this split: Cursor caps MCP servers at ~40 tools. This adapter
- * declares 31 callable tools (26 domain L1/L3 + 4 advanced L2 + 1 gateway).
- * The 3-lane shape keeps `tools/list` at 24 (L1) + 2 (L3) + 1 (gateway) =
- * 27 entries, well under the cap, while every tool stays fully reachable
- * (advanced tools through `yootheme_builder_advanced`).
+ * Why this split: Cursor caps MCP servers at ~40 tools. The 3-lane shape
+ * keeps `tools/list` at 32 (L1) + 2 (L3) + 2 (gateways) = 36 entries, well
+ * under the cap, while every tool stays fully reachable (advanced tools
+ * through `yootheme_builder_advanced` / `yootheme_builder_advanced_read`).
+ * B4 (2026-06-27): element_get_binding promoted L2 → L1 (binding-read made
+ * first-class, mirroring the already-L1 element_bind_source write). L1 26 → 27.
+ * U4-L1 (Glöckle onboarding, 2026-06-27): source_get_schema promoted L2 → L1
+ * (the archive/category binding entry-point made first-class, mirroring how the
+ * bind→verify tools are already L1). L1 27 → 28.
+ * HANDOFF-4/5 L1 (Glöckle onboarding, 2026-06-28): render_preview,
+ * element_set_source, rename_source, template_set_type promoted L2 → L1 — the
+ * core write/refactor + render-verify tools the Glöckle HANDOFF-4/5 ask for,
+ * made first-class so a cold agent can discover them in tools/list (L2 was a
+ * discoverability workaround). L1 28 → 32, advanced 9 → 5.
  *
  * F116 (2026-06-11): the bind→save→publish chain (element_bind_source,
  * page_save, page_publish) was promoted from the advanced lane to L1. It is
@@ -112,6 +121,16 @@ export const ESSENTIAL_TOOLS = [
     'yootheme_builder_element_bind_source',
     'yootheme_builder_page_save',
     'yootheme_builder_page_publish',
+    // B4 (Glöckle onboarding, 2026-06-27) — promote the binding READ to L1,
+    // mirroring its already-L1 WRITE sibling element_bind_source (F116). The
+    // READ stayed behind the advanced(-read) gateway: an agent that had just
+    // bound a relation traversal could not directly confirm query.field /
+    // arguments without first discovering the gateway — a 2-call discovery tax
+    // on the verify half of the bind→verify loop. Making binding-read
+    // first-class closes the asymmetry. This is a tier-LIST move (the catalog
+    // tool already exists); sync-catalog re-run flips its tier to essential.
+    // L1 surface 26 → 27.
+    'yootheme_builder_element_get_binding',
     // P-G (Goldstandard wave 3) — page_dynamize is THE canonical one-call
     // path to dynamize an existing designed section (copy byte-identically,
     // swap only mapped queries + leaf names). It MUST be L1 so an agent
@@ -126,6 +145,33 @@ export const ESSENTIAL_TOOLS = [
     // directly INSTEAD of hand-building (and tripping the guard on) an
     // invalid root/section/row placement. With the prior set L1 24 → 25.
     'yootheme_builder_scaffold_section',
+    // U4-L1 (Glöckle onboarding, 2026-06-27) — promote source_get_schema to L1.
+    // It is THE one-call entry-point for binding on an archive/category template
+    // (introspect a source's query methods + RELATIONS + the archive-context
+    // flag — turning a ~25-call code-dive into one). It stayed behind the
+    // advanced(-read) gateway, so a cold agent orienting toward a Term→Posts
+    // bind had to discover the gateway first — a 2-call discovery tax on the
+    // very first call of the canonical archive-binding workflow, whose write
+    // sibling element_bind_source is already L1 (F116). Making source-schema
+    // discovery first-class closes that asymmetry. This is a tier-LIST move
+    // (the catalog tool already exists); sync-catalog re-run flips its tier to
+    // essential. L1 surface 27 → 28.
+    'yootheme_builder_source_get_schema',
+    // HANDOFF-4/5 L1 (Glöckle onboarding, 2026-06-28) — promote the four core
+    // write/refactor + render-verify tools the Glöckle HANDOFF-4/5 explicitly
+    // ask for to L1. They were registered + reachable only via the advanced
+    // (-read) gateway, so a cold agent could not DISCOVER them in tools/list —
+    // L2 was a discoverability workaround, not a design choice. These ARE the
+    // canonical archive-rebind/refactor surface (set a precomposed source at a
+    // pointer; render-verify the saved page is not silently blank; rename a
+    // source/field template-wide after a taxonomy/CPT rename; re-type an
+    // orphaned archive/single template). Each is a tier-LIST move (the catalog
+    // tools already exist); sync-catalog re-run flips their tier to essential.
+    // L1 surface 28 → 32.
+    'yootheme_builder_render_preview',
+    'yootheme_builder_element_set_source',
+    'yootheme_builder_rename_source',
+    'yootheme_builder_template_set_type',
 ];
 /**
  * L3 — Tools registered DIRECTLY on the real McpServer, BEFORE the

package/dist/gateway/essentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"essentials.js","sourceRoot":"","sources":["../../src/gateway/essentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC3B,6BAA6B;IAC7B,qEAAqE;IACrE,qEAAqE;IACrE,uEAAuE;IACvE,mEAAmE;IACnE,gCAAgC;IAChC,2BAA2B;IAC3B,+BAA+B;IAC/B,8BAA8B;IAC9B,0CAA0C;IAC1C,+BAA+B;IAC/B,qCAAqC;IACrC,6DAA6D;IAC7D,kEAAkE;IAClE,6DAA6D;IAC7D,yCAAyC;IACzC,8CAA8C;IAC9C,iEAAiE;IACjE,4DAA4D;IAC5D,mEAAmE;IACnE,iEAAiE;IACjE,sEAAsE;IACtE,qEAAqE;IACrE,8BAA8B;IAC9B,iCAAiC;IACjC,gCAAgC;IAChC,+BAA+B;IAC/B,kCAAkC;IAClC,oEAAoE;IACpE,sEAAsE;IACtE,mCAAmC;IACnC,iEAAiE;IACjE,iEAAiE;IACjE,iEAAiE;IACjE,4DAA4D;IAC5D,4DAA4D;IAC5D,0CAA0C;IAC1C,mEAAmE;IACnE,oEAAoE;IACpE,mEAAmE;IACnE,kEAAkE;IAClE,uEAAuE;IACvE,6BAA6B;IAC7B,6BAA6B;IAC7B,mEAAmE;IACnE,oEAAoE;IACpE,oEAAoE;IACpE,8DAA8D;IAC9D,+BAA+B;IAC/B,2BAA2B;IAC3B,oEAAoE;IACpE,iEAAiE;IACjE,mEAAmE;IACnE,oEAAoE;IACpE,kEAAkE;IAClE,kCAAkC;IAClC,+BAA+B;IAC/B,+BAA+B;IAC/B,8EAA8E;IAC9E,sEAAsE;IACtE,uEAAuE;IACvE,oEAAoE;IACpE,oEAAoE;IACpE,yEAAyE;IACzE,kEAAkE;IAClE,yCAAyC;IACzC,sCAAsC;IACtC,4BAA4B;IAC5B,+BAA+B;IAC/B,sEAAsE;IACtE,wEAAwE;IACxE,oEAAoE;IACpE,qEAAqE;IACrE,kEAAkE;IAClE,oEAAoE;IACpE,gCAAgC;IAChC,wEAAwE;IACxE,oEAAoE;IACpE,wEAAwE;IACxE,wEAAwE;IACxE,mEAAmE;IACnE,qEAAqE;IACrE,mCAAmC;CAC7B,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IAClC,yBAAyB;IACzB,2BAA2B;CACrB,CAAC;AAKX,gEAAgE;AAChE,MAAM,UAAU,WAAW,CAAC,IAAY;IACpC,OAAQ,eAAqC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACjE,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB,CAAC,IAAY;IACzC,OAAQ,sBAA4C,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACxE,CAAC"}
+{"version":3,"file":"essentials.js","sourceRoot":"","sources":["../../src/gateway/essentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC3B,6BAA6B;IAC7B,qEAAqE;IACrE,qEAAqE;IACrE,uEAAuE;IACvE,mEAAmE;IACnE,gCAAgC;IAChC,2BAA2B;IAC3B,+BAA+B;IAC/B,8BAA8B;IAC9B,0CAA0C;IAC1C,+BAA+B;IAC/B,qCAAqC;IACrC,6DAA6D;IAC7D,kEAAkE;IAClE,6DAA6D;IAC7D,yCAAyC;IACzC,8CAA8C;IAC9C,iEAAiE;IACjE,4DAA4D;IAC5D,mEAAmE;IACnE,iEAAiE;IACjE,sEAAsE;IACtE,qEAAqE;IACrE,8BAA8B;IAC9B,iCAAiC;IACjC,gCAAgC;IAChC,+BAA+B;IAC/B,kCAAkC;IAClC,oEAAoE;IACpE,sEAAsE;IACtE,mCAAmC;IACnC,iEAAiE;IACjE,iEAAiE;IACjE,iEAAiE;IACjE,4DAA4D;IAC5D,4DAA4D;IAC5D,0CAA0C;IAC1C,mEAAmE;IACnE,oEAAoE;IACpE,mEAAmE;IACnE,kEAAkE;IAClE,uEAAuE;IACvE,6BAA6B;IAC7B,6BAA6B;IAC7B,mEAAmE;IACnE,oEAAoE;IACpE,oEAAoE;IACpE,8DAA8D;IAC9D,+BAA+B;IAC/B,2BAA2B;IAC3B,oEAAoE;IACpE,iEAAiE;IACjE,mEAAmE;IACnE,oEAAoE;IACpE,kEAAkE;IAClE,kCAAkC;IAClC,+BAA+B;IAC/B,+BAA+B;IAC/B,8EAA8E;IAC9E,sEAAsE;IACtE,uEAAuE;IACvE,oEAAoE;IACpE,oEAAoE;IACpE,yEAAyE;IACzE,kEAAkE;IAClE,yCAAyC;IACzC,sCAAsC;IACtC,4BAA4B;IAC5B,+BAA+B;IAC/B,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,sEAAsE;IACtE,2EAA2E;IAC3E,kEAAkE;IAClE,0EAA0E;IAC1E,yEAAyE;IACzE,sBAAsB;IACtB,sCAAsC;IACtC,sEAAsE;IACtE,wEAAwE;IACxE,oEAAoE;IACpE,qEAAqE;IACrE,kEAAkE;IAClE,oEAAoE;IACpE,gCAAgC;IAChC,wEAAwE;IACxE,oEAAoE;IACpE,wEAAwE;IACxE,wEAAwE;IACxE,mEAAmE;IACnE,qEAAqE;IACrE,mCAAmC;IACnC,4EAA4E;IAC5E,6EAA6E;IAC7E,yEAAyE;IACzE,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,wEAAwE;IACxE,2EAA2E;IAC3E,iCAAiC;IACjC,oCAAoC;IACpC,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,qEAAqE;IACrE,2EAA2E;IAC3E,2EAA2E;IAC3E,sBAAsB;IACtB,iCAAiC;IACjC,qCAAqC;IACrC,gCAAgC;IAChC,oCAAoC;CAC9B,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IAClC,yBAAyB;IACzB,2BAA2B;CACrB,CAAC;AAKX,gEAAgE;AAChE,MAAM,UAAU,WAAW,CAAC,IAAY;IACpC,OAAQ,eAAqC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACjE,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB,CAAC,IAAY;IACzC,OAAQ,sBAA4C,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACxE,CAAC"}

package/dist/index.d.ts

@@ -11,6 +11,7 @@
  *
  * @license MIT
  */
+import { type TlsProbe } from './diagnostics/startup-self-probe.js';
 export { createServer, SERVER_NAME, SERVER_VERSION } from './server.js';
 export { RestClient, REST_NAMESPACE_PATH, encodeElementPath } from './client.js';
 export { loadConfig, loadRegistry, isTestMode, ENV_SITE_URL, ENV_WP_URL, ENV_BEARER, ENV_SITES_FILE, ENV_PLATFORM, ENV_PROFILE, ENV_TEST_MODE, } from './auth.js';
@@ -25,6 +26,19 @@ export { ESSENTIAL_TOOLS, DIRECT_TOP_LEVEL_TOOLS, isEssential, isDirectTopLevel,
 export { CapturingServer, type AdvancedToolEntry, type CapturedToolHandler, type ToolRegistrar, } from './gateway/capturing-server.js';
 export { registerAdvancedTool } from './gateway/advanced-tool.js';
 export { collectAllRegisteredTools, findTool, type CollectedTool, } from './gateway/test-support.js';
-declare function main(): Promise<void>;
+/**
+ * Optional injection seam for {@link main} — lets the startup self-probe (P0.4)
+ * be driven deterministically in tests without a real network. Production passes
+ * nothing, so the real bounded `fetch` probe runs.
+ */
+export interface MainDeps {
+    /** Override the startup TLS self-probe (P0.4). Default: real bounded fetch. */
+    readonly selfProbe?: TlsProbe;
+    /** Override `process.version` for the self-probe's remedy choice. */
+    readonly nodeVersion?: string;
+    /** Override `process.exit` so a CA-trust abort is observable in tests. */
+    readonly exit?: (code: number) => never;
+}
+declare function main(deps?: MainDeps): Promise<void>;
 export { main };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAkBH,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EACH,UAAU,EACV,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,UAAU,EACV,UAAU,EACV,cAAc,EACd,YAAY,EACZ,WAAW,EACX,aAAa,GAChB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGjD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACxF,OAAO,EACH,eAAe,EACf,sBAAsB,EACtB,WAAW,EACX,gBAAgB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACH,eAAe,EACf,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,aAAa,GACrB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EACH,yBAAyB,EACzB,QAAQ,EACR,KAAK,aAAa,GACrB,MAAM,2BAA2B,CAAC;AAEnC,iBAAe,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAiHnC;AAkBD,OAAO,EAAE,IAAI,EAAE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,EAAuB,KAAK,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAczF,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EACH,UAAU,EACV,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,UAAU,EACV,UAAU,EACV,cAAc,EACd,YAAY,EACZ,WAAW,EACX,aAAa,GAChB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGjD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACxF,OAAO,EACH,eAAe,EACf,sBAAsB,EACtB,WAAW,EACX,gBAAgB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACH,eAAe,EACf,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,aAAa,GACrB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EACH,yBAAyB,EACzB,QAAQ,EACR,KAAK,aAAa,GACrB,MAAM,2BAA2B,CAAC;AAEnC;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACrB,+EAA+E;IAC/E,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,KAAK,CAAC;CAC3C;AAED,iBAAe,IAAI,CAAC,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAoJtD;AAkBD,OAAO,EAAE,IAAI,EAAE,CAAC"}

package/dist/index.js

@@ -12,7 +12,8 @@
  * @license MIT
  */
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { isTestMode, loadRegistry } from './auth.js';
+import { ENV_SITE_URL, ENV_WP_URL, isTestMode, loadRegistry } from './auth.js';
+import { runStartupSelfProbe } from './diagnostics/startup-self-probe.js';
 import { ConfigError } from './errors.js';
 import { installGlobalProxyDispatcher } from './net/proxy-dispatcher.js';
 import { SERVER_VERSION } from './server.js';
@@ -40,7 +41,7 @@ export { ESSENTIAL_TOOLS, DIRECT_TOP_LEVEL_TOOLS, isEssential, isDirectTopLevel,
 export { CapturingServer, } from './gateway/capturing-server.js';
 export { registerAdvancedTool } from './gateway/advanced-tool.js';
 export { collectAllRegisteredTools, findTool, } from './gateway/test-support.js';
-async function main() {
+async function main(deps = {}) {
     // Honor an enterprise HTTP(S)_PROXY / NO_PROXY before any outbound call —
     // BOTH proxy mode (below) and fat mode use Node's global fetch, which reads
     // this global dispatcher. Unconditional + passthrough-safe (no proxy env =
@@ -55,6 +56,13 @@ async function main() {
         for (const w of parseExtraHeaders().warnings) {
             process.stderr.write(`[yt-builder-mcp] ${w}\n`);
         }
+        // U3 — surface any YTB_MCP_SITE_BASIC_AUTH parse warning (missing colon /
+        // empty username) ONCE at startup. The warning NEVER contains the
+        // credential value (see net/site-basic-auth.ts).
+        const { parseSiteBasicAuth } = await import('./net/site-basic-auth.js');
+        for (const w of parseSiteBasicAuth().warnings) {
+            process.stderr.write(`[yt-builder-mcp] ${w}\n`);
+        }
     }
     // Update notice (non-blocking, cached 24h, fail-silent) — surfaces a newer
     // npm version to stderr without ever delaying serving or breaking behind a
@@ -71,6 +79,33 @@ async function main() {
             /* fail-silent — the notifier is a courtesy, never a dependency */
         });
     }
+    // P0.4 — bounded startup TLS self-probe. Before we open stdio (in EITHER
+    // proxy or fat mode), send ONE short HTTPS request to the configured site.
+    // If it rejects with a TLS chain-of-trust error (a corporate TLS-inspection
+    // proxy whose root CA Node doesn't trust), print the actionable
+    // --use-system-ca / NODE_EXTRA_CA_CERTS fix to stderr and exit fast (< 2s)
+    // instead of hanging until the host's ~30s /mcp connect-timeout. Skipped in
+    // test-mode (the smoke probe must not hit the network) and when no site is
+    // configured (the boot-unconfigured path must stay). Any non-CA outcome
+    // (success, 401/404/5xx, DNS, plain timeout) lets the server boot normally.
+    if (!isTestMode()) {
+        const siteUrl = process.env[ENV_SITE_URL] ?? process.env[ENV_WP_URL];
+        const probeResult = await runStartupSelfProbe(siteUrl, {
+            ...(deps.selfProbe !== undefined ? { probe: deps.selfProbe } : {}),
+            ...(deps.nodeVersion !== undefined ? { nodeVersion: deps.nodeVersion } : {}),
+        });
+        if (probeResult.caTrustFailure) {
+            process.stderr.write(`${probeResult.message ?? ''}\n`);
+            // Default exits the process (never returns). An injected stub in
+            // tests does NOT terminate, so we must still stop here — return
+            // BEFORE the call would be wrong (the real exit must fire), so we
+            // invoke then return. Typed `(code) => void` so the post-call return
+            // stays reachable for the stub path.
+            const doExit = deps.exit ?? ((code) => process.exit(code));
+            doExit(1);
+            return;
+        }
+    }
     // Proxy mode: forward stdio 1:1 to the plugin-served PHP MCP endpoint and
     // stop here — the fat catalog below is bypassed entirely. Default (fat) is
     // unchanged. The dynamic import is gated on the env so the fat path never

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9E,gFAAgF;AAChF,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EACH,UAAU,EACV,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,UAAU,EACV,UAAU,EACV,cAAc,EACd,YAAY,EACZ,WAAW,EACX,aAAa,GAChB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,mEAAmE;AACnE,+DAA+D;AAC/D,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACxF,OAAO,EACH,eAAe,EACf,sBAAsB,EACtB,WAAW,EACX,gBAAgB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACH,eAAe,GAIlB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EACH,yBAAyB,EACzB,QAAQ,GAEX,MAAM,2BAA2B,CAAC;AAEnC,KAAK,UAAU,IAAI;IACf,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,0EAA0E;IAC1E,+BAA+B;IAC/B,4BAA4B,EAAE,CAAC;IAE/B,6EAA6E;IAC7E,0EAA0E;IAC1E,+EAA+E;IAC/E,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QAChB,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACrE,KAAK,MAAM,CAAC,IAAI,iBAAiB,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,0DAA0D;IAC1D,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QAChB,KAAK,cAAc,CAAC,EAAE,cAAc,EAAE,cAAc,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;aACjF,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACb,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE;YACR,kEAAkE;QACtE,CAAC,CAAC,CAAC;IACX,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,OAAO,EAAE,CAAC;QACvC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC5D,IAAI,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO;IACjD,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;IAE9B,mDAAmD;IACnD,4DAA4D;IAC5D,yDAAyD;IACzD,4DAA4D;IAC5D,2CAA2C;IAC3C,EAAE;IACF,8DAA8D;IAC9D,gEAAgE;IAChE,iEAAiE;IACjE,mEAAmE;IACnE,6DAA6D;IAC7D,+CAA+C;IAC/C,IAAI,QAAsB,CAAC;IAC3B,IAAI,CAAC;QACD,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,8DAA8D;QAC9D,yDAAyD;QACzD,0DAA0D;QAC1D,kEAAkE;QAClE,kEAAkE;QAClE,gEAAgE;QAChE,kEAAkE;QAClE,kEAAkE;QAClE,gEAAgE;QAChE,+DAA+D;QAC/D,+DAA+D;QAC/D,gEAAgE;QAChE,kEAAkE;QAClE,yBAAyB;QACzB,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,CAAC,YAAY,WAAW;YACjC,CAAC,CAAC,uBAAuB;YACzB,CAAC,CAAC,wCAAwC,CAAC;QAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,IAAI,MAAM,GAAG,IAAI,CAAC,CAAC;QAC5D,QAAQ,GAAG,IAAI,YAAY,CAAC;YACxB,cAAc,EAAE,CAAC;YACjB,eAAe,EAAE,IAAI;YACrB,KAAK,EAAE,EAAE;SACZ,CAAC,CAAC;IACP,CAAC;IAED,MAAM,cAAc,GAAG,qBAAqB,EAAE,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAEtD,gEAAgE;IAChE,kEAAkE;IAClE,gEAAgE;IAChE,8DAA8D;IAC9D,oEAAoE;IACpE,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAE1B,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAE9C,IAAI,QAAQ,EAAE,CAAC;QACX,kEAAkE;QAClE,yDAAyD;QACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,gCAAgC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAC7E,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,GAAG,EAAE,CAAC;IACzC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;QACxB,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,OAAO,IAAI,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;AACP,CAAC;AAED,OAAO,EAAE,IAAI,EAAE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAiB,MAAM,qCAAqC,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9E,gFAAgF;AAChF,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EACH,UAAU,EACV,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,UAAU,EACV,UAAU,EACV,cAAc,EACd,YAAY,EACZ,WAAW,EACX,aAAa,GAChB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,mEAAmE;AACnE,+DAA+D;AAC/D,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACxF,OAAO,EACH,eAAe,EACf,sBAAsB,EACtB,WAAW,EACX,gBAAgB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACH,eAAe,GAIlB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EACH,yBAAyB,EACzB,QAAQ,GAEX,MAAM,2BAA2B,CAAC;AAgBnC,KAAK,UAAU,IAAI,CAAC,OAAiB,EAAE;IACnC,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,0EAA0E;IAC1E,+BAA+B;IAC/B,4BAA4B,EAAE,CAAC;IAE/B,6EAA6E;IAC7E,0EAA0E;IAC1E,+EAA+E;IAC/E,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QAChB,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACrE,KAAK,MAAM,CAAC,IAAI,iBAAiB,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QACD,0EAA0E;QAC1E,kEAAkE;QAClE,iDAAiD;QACjD,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACxE,KAAK,MAAM,CAAC,IAAI,kBAAkB,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,0DAA0D;IAC1D,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QAChB,KAAK,cAAc,CAAC,EAAE,cAAc,EAAE,cAAc,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;aACjF,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACb,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE;YACR,kEAAkE;QACtE,CAAC,CAAC,CAAC;IACX,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,gEAAgE;IAChE,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,wEAAwE;IACxE,4EAA4E;IAC5E,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrE,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE;YACnD,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/E,CAAC,CAAC;QACH,IAAI,WAAW,CAAC,cAAc,EAAE,CAAC;YAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,OAAO,IAAI,EAAE,IAAI,CAAC,CAAC;YACvD,iEAAiE;YACjE,gEAAgE;YAChE,kEAAkE;YAClE,qEAAqE;YACrE,qCAAqC;YACrC,MAAM,MAAM,GAA2B,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAY,EAAS,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAClG,MAAM,CAAC,CAAC,CAAC,CAAC;YACV,OAAO;QACX,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,OAAO,EAAE,CAAC;QACvC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC5D,IAAI,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO;IACjD,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;IAE9B,mDAAmD;IACnD,4DAA4D;IAC5D,yDAAyD;IACzD,4DAA4D;IAC5D,2CAA2C;IAC3C,EAAE;IACF,8DAA8D;IAC9D,gEAAgE;IAChE,iEAAiE;IACjE,mEAAmE;IACnE,6DAA6D;IAC7D,+CAA+C;IAC/C,IAAI,QAAsB,CAAC;IAC3B,IAAI,CAAC;QACD,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,8DAA8D;QAC9D,yDAAyD;QACzD,0DAA0D;QAC1D,kEAAkE;QAClE,kEAAkE;QAClE,gEAAgE;QAChE,kEAAkE;QAClE,kEAAkE;QAClE,gEAAgE;QAChE,+DAA+D;QAC/D,+DAA+D;QAC/D,gEAAgE;QAChE,kEAAkE;QAClE,yBAAyB;QACzB,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,CAAC,YAAY,WAAW;YACjC,CAAC,CAAC,uBAAuB;YACzB,CAAC,CAAC,wCAAwC,CAAC;QAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,IAAI,MAAM,GAAG,IAAI,CAAC,CAAC;QAC5D,QAAQ,GAAG,IAAI,YAAY,CAAC;YACxB,cAAc,EAAE,CAAC;YACjB,eAAe,EAAE,IAAI;YACrB,KAAK,EAAE,EAAE;SACZ,CAAC,CAAC;IACP,CAAC;IAED,MAAM,cAAc,GAAG,qBAAqB,EAAE,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAEtD,gEAAgE;IAChE,kEAAkE;IAClE,gEAAgE;IAChE,8DAA8D;IAC9D,oEAAoE;IACpE,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAE1B,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAE9C,IAAI,QAAQ,EAAE,CAAC;QACX,kEAAkE;QAClE,yDAAyD;QACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,gCAAgC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAC7E,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,GAAG,EAAE,CAAC;IACzC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;QACxB,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,OAAO,IAAI,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;AACP,CAAC;AAED,OAAO,EAAE,IAAI,EAAE,CAAC"}

package/dist/net/proxy-dispatcher.d.ts

@@ -12,6 +12,13 @@ export interface ProxyDispatcherDeps {
     /** Defaults to `console.error`. */
     stderr?: (message: string) => void;
 }
+/**
+ * Is any forward-proxy configured in the environment? Exported so the setup
+ * wizard's P0.1 default-on CA bake can reuse the SAME definition of "a corporate
+ * proxy is present" (one source of truth — no drift between the dispatcher and
+ * the installer).
+ */
+export declare function hasProxyConfigured(env: NodeJS.ProcessEnv): boolean;
 /**
  * Install a process-global undici dispatcher that honors the enterprise
  * `HTTP_PROXY` / `HTTPS_PROXY` / `NO_PROXY` environment variables at request

package/dist/net/proxy-dispatcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy-dispatcher.d.ts","sourceRoot":"","sources":["../../src/net/proxy-dispatcher.ts"],"names":[],"mappings":"AACA,OAAO,EAAuE,KAAK,UAAU,EAAE,MAAM,QAAQ,CAAC;AAI9G;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAChC,kEAAkE;IAClE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,8DAA8D;IAC9D,mBAAmB,CAAC,EAAE,CAAC,UAAU,EAAE,UAAU,KAAK,IAAI,CAAC;IACvD,mDAAmD;IACnD,qBAAqB,CAAC,EAAE,MAAM,UAAU,CAAC;IACzC,mCAAmC;IACnC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC;AAOD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAkCpF"}
+{"version":3,"file":"proxy-dispatcher.d.ts","sourceRoot":"","sources":["../../src/net/proxy-dispatcher.ts"],"names":[],"mappings":"AACA,OAAO,EAAuE,KAAK,UAAU,EAAE,MAAM,QAAQ,CAAC;AAI9G;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAChC,kEAAkE;IAClE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,8DAA8D;IAC9D,mBAAmB,CAAC,EAAE,CAAC,UAAU,EAAE,UAAU,KAAK,IAAI,CAAC;IACvD,mDAAmD;IACnD,qBAAqB,CAAC,EAAE,MAAM,UAAU,CAAC;IACzC,mCAAmC;IACnC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAElE;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAkCpF"}

package/dist/net/proxy-dispatcher.js

@@ -1,8 +1,13 @@
 // packages/mcp/src/net/proxy-dispatcher.ts
 import { EnvHttpProxyAgent, setGlobalDispatcher as undiciSetGlobalDispatcher } from 'undici';
 import { deriveNoProxyForInternalSite } from './internal-host.js';
-/** Is any forward-proxy configured in the environment? */
-function hasProxyConfigured(env) {
+/**
+ * Is any forward-proxy configured in the environment? Exported so the setup
+ * wizard's P0.1 default-on CA bake can reuse the SAME definition of "a corporate
+ * proxy is present" (one source of truth — no drift between the dispatcher and
+ * the installer).
+ */
+export function hasProxyConfigured(env) {
     return Boolean(env.HTTPS_PROXY ?? env.https_proxy ?? env.HTTP_PROXY ?? env.http_proxy);
 }
 /**

package/dist/net/proxy-dispatcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"proxy-dispatcher.js","sourceRoot":"","sources":["../../src/net/proxy-dispatcher.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,IAAI,yBAAyB,EAAmB,MAAM,QAAQ,CAAC;AAE9G,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAgBlE,0DAA0D;AAC1D,SAAS,kBAAkB,CAAC,GAAsB;IAC9C,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAA4B,EAAE;IACvE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,sEAAsE;QACtE,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,IAAI,yBAAyB,CAAC;IAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,qBAAqB,IAAI,CAAC,GAAe,EAAE,CAAC,IAAI,iBAAiB,EAAE,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,OAAe,EAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAEhF,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,OAAO,GAAG,4BAA4B,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACrF,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnD,oEAAoE;QACpE,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,wCAAwC,OAAO,CAAC,SAAS,IAAI,EAAE,0DAA0D,CAAC,CAAC;IACpI,CAAC;IAED,IAAI,CAAC;QACD,aAAa,CAAC,SAAS,EAAE,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,mEAAmE;QACnE,IAAI,CAAC,wFAAwF,OAAO,EAAE,CAAC,CAAC;QACxG,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC"}
+{"version":3,"file":"proxy-dispatcher.js","sourceRoot":"","sources":["../../src/net/proxy-dispatcher.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,IAAI,yBAAyB,EAAmB,MAAM,QAAQ,CAAC;AAE9G,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAgBlE;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAsB;IACrD,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAA4B,EAAE;IACvE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,sEAAsE;QACtE,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,IAAI,yBAAyB,CAAC;IAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,qBAAqB,IAAI,CAAC,GAAe,EAAE,CAAC,IAAI,iBAAiB,EAAE,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,OAAe,EAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAEhF,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,OAAO,GAAG,4BAA4B,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACrF,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnD,oEAAoE;QACpE,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,wCAAwC,OAAO,CAAC,SAAS,IAAI,EAAE,0DAA0D,CAAC,CAAC;IACpI,CAAC;IAED,IAAI,CAAC;QACD,aAAa,CAAC,SAAS,EAAE,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,mEAAmE;QACnE,IAAI,CAAC,wFAAwF,OAAO,EAAE,CAAC,CAAC;QACxG,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC"}

package/dist/net/site-basic-auth.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Parse `YTB_MCP_SITE_BASIC_AUTH` ('user:pass') into URL **userinfo** that is
+ * injected into the upstream request URL (`https://user:pass@host/…`) on BOTH
+ * transports (fat-mode {@link RestClient} base URL and proxy-mode endpoint URL).
+ *
+ * Why this exists (U3 — Glöckle post-cert QA blocker): a site fronted by a pure
+ * HTTP **Basic-Auth realm** (e.g. `qa.gloeckle.de`) requires
+ * `Authorization: Basic …`. But the plugin Bearer already owns the single
+ * `Authorization` header on every outbound request, and `YTB_MCP_EXTRA_HEADERS`
+ * HARD-FORBIDS an `Authorization` key (see {@link parseExtraHeaders}) — so Basic
+ * and the Bearer collide on the one header and the site is unreachable.
+ *
+ * The fix routes the site-level Basic credentials on a **separate transport**:
+ * URL userinfo. Userinfo and the `Authorization` header are independent — undici
+ * / fetch turn `https://user:pass@host` into an `Authorization: Basic …` toward
+ * the **gateway/realm**, while we keep emitting `Authorization: Bearer …` toward
+ * the **plugin** behind it. The Bearer is never touched; the realm and the
+ * plugin each get the credential they expect.
+ *
+ * ── Accepted format ─────────────────────────────────────────────────────────
+ *   `user:pass` — split on the FIRST colon (passwords may contain colons).
+ *     - The username MUST be non-empty.
+ *     - The password MAY be empty (some realms use a user-only token).
+ *   Both halves are percent-encoded for userinfo via the WHATWG URL encoder, so
+ *   reserved chars (`@`, `/`, `:`, space, …) survive into a valid URL.
+ *
+ * ── Security invariants ─────────────────────────────────────────────────────
+ *   - The credential value is **NEVER** echoed in a warning or logged. Malformed
+ *     input yields a generic "missing colon / empty username" warning only.
+ *   - This channel NEVER touches the `Authorization` header — it rides URL
+ *     userinfo exclusively, so the Bearer always wins (orthogonal transports).
+ *
+ * Pure + deterministic. `warnings` collects non-fatal issues; the caller (the
+ * server boot path) surfaces them once to stderr.
+ *
+ * @license MIT
+ */
+/** Canonical env-var name for the site-level HTTP Basic-Auth feature. */
+export declare const ENV_SITE_BASIC_AUTH = "YTB_MCP_SITE_BASIC_AUTH";
+export interface ParsedSiteBasicAuth {
+    /**
+     * Percent-encoded `user:pass` userinfo ready to splice into a URL, or
+     * `null` when the env var is unset/blank/malformed. NEVER contains the raw
+     * (un-encoded) credential beyond what userinfo requires.
+     */
+    readonly userinfo: string | null;
+    /** Non-fatal issues (missing colon, empty username). Never echo the secret. */
+    readonly warnings: readonly string[];
+}
+/**
+ * Parse `YTB_MCP_SITE_BASIC_AUTH` from `env` (default `process.env`). Returns
+ * `{ userinfo: null, warnings: [] }` when unset/blank, and a generic warning
+ * (never containing the secret) when the value is malformed.
+ */
+export declare function parseSiteBasicAuth(env?: NodeJS.ProcessEnv): ParsedSiteBasicAuth;
+/**
+ * Splice `userinfo` (a percent-encoded `user:pass`) into `url`, returning the
+ * resulting href. When `userinfo` is `null`, the URL is returned unchanged
+ * (string form). Any pre-existing userinfo on the URL is overwritten.
+ *
+ * This is the ONLY mutation the site-Basic channel performs — it never adds or
+ * alters a header, so the Bearer in `Authorization` is untouched.
+ */
+export declare function applyUserinfoToUrl(url: string | URL, userinfo: string | null): string;
+//# sourceMappingURL=site-basic-auth.d.ts.map

package/dist/net/site-basic-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"site-basic-auth.d.ts","sourceRoot":"","sources":["../../src/net/site-basic-auth.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,yEAAyE;AACzE,eAAO,MAAM,mBAAmB,4BAA4B,CAAC;AAE7D,MAAM,WAAW,mBAAmB;IAChC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAqBD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,mBAAmB,CA8B5F;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAgBrF"}

package/dist/net/site-basic-auth.js

@@ -0,0 +1,118 @@
+// packages/mcp/src/net/site-basic-auth.ts
+/**
+ * Parse `YTB_MCP_SITE_BASIC_AUTH` ('user:pass') into URL **userinfo** that is
+ * injected into the upstream request URL (`https://user:pass@host/…`) on BOTH
+ * transports (fat-mode {@link RestClient} base URL and proxy-mode endpoint URL).
+ *
+ * Why this exists (U3 — Glöckle post-cert QA blocker): a site fronted by a pure
+ * HTTP **Basic-Auth realm** (e.g. `qa.gloeckle.de`) requires
+ * `Authorization: Basic …`. But the plugin Bearer already owns the single
+ * `Authorization` header on every outbound request, and `YTB_MCP_EXTRA_HEADERS`
+ * HARD-FORBIDS an `Authorization` key (see {@link parseExtraHeaders}) — so Basic
+ * and the Bearer collide on the one header and the site is unreachable.
+ *
+ * The fix routes the site-level Basic credentials on a **separate transport**:
+ * URL userinfo. Userinfo and the `Authorization` header are independent — undici
+ * / fetch turn `https://user:pass@host` into an `Authorization: Basic …` toward
+ * the **gateway/realm**, while we keep emitting `Authorization: Bearer …` toward
+ * the **plugin** behind it. The Bearer is never touched; the realm and the
+ * plugin each get the credential they expect.
+ *
+ * ── Accepted format ─────────────────────────────────────────────────────────
+ *   `user:pass` — split on the FIRST colon (passwords may contain colons).
+ *     - The username MUST be non-empty.
+ *     - The password MAY be empty (some realms use a user-only token).
+ *   Both halves are percent-encoded for userinfo via the WHATWG URL encoder, so
+ *   reserved chars (`@`, `/`, `:`, space, …) survive into a valid URL.
+ *
+ * ── Security invariants ─────────────────────────────────────────────────────
+ *   - The credential value is **NEVER** echoed in a warning or logged. Malformed
+ *     input yields a generic "missing colon / empty username" warning only.
+ *   - This channel NEVER touches the `Authorization` header — it rides URL
+ *     userinfo exclusively, so the Bearer always wins (orthogonal transports).
+ *
+ * Pure + deterministic. `warnings` collects non-fatal issues; the caller (the
+ * server boot path) surfaces them once to stderr.
+ *
+ * @license MIT
+ */
+/** Canonical env-var name for the site-level HTTP Basic-Auth feature. */
+export const ENV_SITE_BASIC_AUTH = 'YTB_MCP_SITE_BASIC_AUTH';
+/**
+ * Encode a single userinfo component (username or password) exactly as the
+ * WHATWG URL serializer would. Using the URL setter (rather than
+ * `encodeURIComponent`) guarantees the result is byte-for-byte what lands on a
+ * real request URL, and is idempotent if the value is already encoded.
+ */
+function encodeUserinfoComponent(part, value) {
+    const u = new URL('https://x.invalid/');
+    if (part === 'username') {
+        u.username = value;
+        return u.username;
+    }
+    // A password-only set still needs a (placeholder) username for the URL to be
+    // valid; read back ONLY the password component.
+    u.username = 'x';
+    u.password = value;
+    return u.password;
+}
+/**
+ * Parse `YTB_MCP_SITE_BASIC_AUTH` from `env` (default `process.env`). Returns
+ * `{ userinfo: null, warnings: [] }` when unset/blank, and a generic warning
+ * (never containing the secret) when the value is malformed.
+ */
+export function parseSiteBasicAuth(env = process.env) {
+    const raw = (env[ENV_SITE_BASIC_AUTH] ?? '').trim();
+    if (raw === '') {
+        return { userinfo: null, warnings: [] };
+    }
+    const idx = raw.indexOf(':');
+    if (idx < 0) {
+        // Deliberately do NOT echo `raw` — it IS the credential.
+        return {
+            userinfo: null,
+            warnings: [
+                `${ENV_SITE_BASIC_AUTH}: ignored — expected "user:pass" (a ":" separating username from password). The credential value is not shown.`,
+            ],
+        };
+    }
+    const user = raw.slice(0, idx);
+    const password = raw.slice(idx + 1);
+    if (user === '') {
+        return {
+            userinfo: null,
+            warnings: [
+                `${ENV_SITE_BASIC_AUTH}: ignored — the username (before ":") is empty. Expected "user:pass". The credential value is not shown.`,
+            ],
+        };
+    }
+    const userinfo = `${encodeUserinfoComponent('username', user)}:${encodeUserinfoComponent('password', password)}`;
+    return { userinfo, warnings: [] };
+}
+/**
+ * Splice `userinfo` (a percent-encoded `user:pass`) into `url`, returning the
+ * resulting href. When `userinfo` is `null`, the URL is returned unchanged
+ * (string form). Any pre-existing userinfo on the URL is overwritten.
+ *
+ * This is the ONLY mutation the site-Basic channel performs — it never adds or
+ * alters a header, so the Bearer in `Authorization` is untouched.
+ */
+export function applyUserinfoToUrl(url, userinfo) {
+    const parsed = url instanceof URL ? new URL(url.href) : new URL(url);
+    if (userinfo === null) {
+        return parsed.href;
+    }
+    const sep = userinfo.indexOf(':');
+    if (sep < 0) {
+        // Defensive — parseSiteBasicAuth always produces a colon; a caller that
+        // hand-builds a userinfo without one gets username-only behaviour.
+        parsed.username = userinfo;
+        parsed.password = '';
+    }
+    else {
+        parsed.username = userinfo.slice(0, sep);
+        parsed.password = userinfo.slice(sep + 1);
+    }
+    return parsed.href;
+}
+//# sourceMappingURL=site-basic-auth.js.map

package/dist/net/site-basic-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"site-basic-auth.js","sourceRoot":"","sources":["../../src/net/site-basic-auth.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,yEAAyE;AACzE,MAAM,CAAC,MAAM,mBAAmB,GAAG,yBAAyB,CAAC;AAa7D;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,IAA6B,EAAE,KAAa;IACzE,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACxC,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACtB,CAAC,CAAC,QAAQ,GAAG,KAAK,CAAC;QACnB,OAAO,CAAC,CAAC,QAAQ,CAAC;IACtB,CAAC;IACD,6EAA6E;IAC7E,gDAAgD;IAChD,CAAC,CAAC,QAAQ,GAAG,GAAG,CAAC;IACjB,CAAC,CAAC,QAAQ,GAAG,KAAK,CAAC;IACnB,OAAO,CAAC,CAAC,QAAQ,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACb,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC5C,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QACV,yDAAyD;QACzD,OAAO;YACH,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE;gBACN,GAAG,mBAAmB,gHAAgH;aACzI;SACJ,CAAC;IACN,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QACd,OAAO;YACH,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE;gBACN,GAAG,mBAAmB,0GAA0G;aACnI;SACJ,CAAC;IACN,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,uBAAuB,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,uBAAuB,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;IACjH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAiB,EAAE,QAAuB;IACzE,MAAM,MAAM,GAAG,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrE,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC,IAAI,CAAC;IACvB,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QACV,wEAAwE;QACxE,mEAAmE;QACnE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC3B,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;IACzB,CAAC;SAAM,CAAC;QACJ,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACzC,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACvB,CAAC"}

package/dist/proxy/bridge.d.ts

@@ -44,8 +44,16 @@ export declare function bridgeTransports(local: Transport, remote: Transport): v
 interface ProxyConfig {
     endpointUrl: URL;
     token: string;
-    /** Extra headers from `YTB_MCP_EXTRA_HEADERS` (Basic-Auth / WAF / gateway). */
+    /** Extra headers from `YTB_MCP_EXTRA_HEADERS` (WAF / gateway secret). */
     extraHeaders?: Record<string, string>;
+    /**
+     * U3 — percent-encoded `user:pass` userinfo for a site-level HTTP Basic-Auth
+     * realm (`YTB_MCP_SITE_BASIC_AUTH`). Spliced into `endpointUrl`
+     * (`https://user:pass@host/…`) so the realm gets `Authorization: Basic …`
+     * while the Bearer header still reaches the plugin. Orthogonal transports —
+     * the Bearer is never overwritten.
+     */
+    siteBasicUserinfo?: string;
 }
 /**
  * Build the upstream `requestInit.headers` for proxy mode: the Bearer is
@@ -53,6 +61,15 @@ interface ProxyConfig {
  * `Authorization` can NEVER be overwritten. Exported for unit tests.
  */
 export declare function buildProxyRequestHeaders(config: ProxyConfig): Record<string, string>;
+/**
+ * Resolve the upstream endpoint URL the proxy connects to, splicing in the U3
+ * site-level HTTP Basic userinfo (`https://user:pass@host/…`) when configured so
+ * the realm gets `Authorization: Basic …`. The Bearer rides the Authorization
+ * header (see {@link buildProxyRequestHeaders}) — independent transport, never
+ * clobbered. Returns the original URL unchanged when no site-Basic is set.
+ * Exported for unit tests.
+ */
+export declare function resolveProxyEndpointUrl(config: ProxyConfig): URL;
 /** Build the real transports + bridge them; resolves when EITHER side closes. */
 export declare function runProxy(config: ProxyConfig, deps?: {
     makeTransports?: (c: ProxyConfig) => {

package/dist/proxy/bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../../src/proxy/bridge.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAgE/E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAoC5D;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,GAAG,IAAI,CAuD1E;AAED;;mDAEmD;AACnD,UAAU,WAAW;IACnB,WAAW,EAAE,GAAG,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAKpF;AAcD,iFAAiF;AACjF,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,WAAW,EACnB,IAAI,GAAE;IACJ,cAAc,CAAC,EAAE,CAAC,CAAC,EAAE,WAAW,KAAK;QACnC,KAAK,EAAE,SAAS,CAAC;QACjB,MAAM,EAAE,SAAS,CAAC;KACnB,CAAC;CACE,GACL,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,qFAAqF;AACrF,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAO,GAC1D,OAAO,CAAC,OAAO,CAAC,CAalB"}
+{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../../src/proxy/bridge.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAiE/E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAoC5D;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,GAAG,IAAI,CAuD1E;AAED;;mDAEmD;AACnD,UAAU,WAAW;IACnB,WAAW,EAAE,GAAG,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAKpF;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,WAAW,GAAG,GAAG,CAKhE;AAcD,iFAAiF;AACjF,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,WAAW,EACnB,IAAI,GAAE;IACJ,cAAc,CAAC,EAAE,CAAC,CAAC,EAAE,WAAW,KAAK;QACnC,KAAK,EAAE,SAAS,CAAC;QACjB,MAAM,EAAE,SAAS,CAAC;KACnB,CAAC;CACE,GACL,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,qFAAqF;AACrF,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAO,GAC1D,OAAO,CAAC,OAAO,CAAC,CAkBlB"}

package/dist/proxy/bridge.js

@@ -3,6 +3,7 @@ import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/
 import { resolveMode } from './mode.js';
 import { diagnoseNetworkError } from '../diagnostics/diagnose-network-error.js';
 import { mergeExtraHeaders, parseExtraHeaders } from '../net/extra-headers.js';
+import { applyUserinfoToUrl, parseSiteBasicAuth } from '../net/site-basic-auth.js';
 /** Narrow an unknown caught value to a human-readable message (no `any`). */
 function errorMessage(err) {
     if (err instanceof Error)
@@ -183,9 +184,23 @@ export function buildProxyRequestHeaders(config) {
         ? mergeExtraHeaders(base, config.extraHeaders)
         : base;
 }
+/**
+ * Resolve the upstream endpoint URL the proxy connects to, splicing in the U3
+ * site-level HTTP Basic userinfo (`https://user:pass@host/…`) when configured so
+ * the realm gets `Authorization: Basic …`. The Bearer rides the Authorization
+ * header (see {@link buildProxyRequestHeaders}) — independent transport, never
+ * clobbered. Returns the original URL unchanged when no site-Basic is set.
+ * Exported for unit tests.
+ */
+export function resolveProxyEndpointUrl(config) {
+    if (config.siteBasicUserinfo === undefined || config.siteBasicUserinfo === '') {
+        return config.endpointUrl;
+    }
+    return new URL(applyUserinfoToUrl(config.endpointUrl, config.siteBasicUserinfo));
+}
 /** Injection seam for tests — production builds the real SDK transports. */
 function defaultTransports(config) {
-    const remote = new StreamableHTTPClientTransport(config.endpointUrl, {
+    const remote = new StreamableHTTPClientTransport(resolveProxyEndpointUrl(config), {
         requestInit: { headers: buildProxyRequestHeaders(config) },
     });
     const local = new StdioServerTransport();
@@ -222,13 +237,18 @@ export async function maybeRunProxy(env, deps = {}) {
     if (resolved.mode !== 'proxy')
         return false;
     const run = deps.runProxy ?? runProxy;
-    // Glöckle gap #14 — attach corporate extra headers (Basic-Auth / WAF / gateway)
-    // to every upstream request. parseExtraHeaders reads YTB_MCP_EXTRA_HEADERS.
+    // Glöckle gap #14 — attach corporate extra headers (WAF / gateway secret) to
+    // every upstream request. parseExtraHeaders reads YTB_MCP_EXTRA_HEADERS.
     const { headers: extraHeaders } = parseExtraHeaders(env);
+    // U3 — a site-level HTTP Basic-Auth realm rides URL userinfo, not a header
+    // (the Bearer owns Authorization). parseSiteBasicAuth reads
+    // YTB_MCP_SITE_BASIC_AUTH; `null` when unset/malformed → no userinfo spliced.
+    const { userinfo: siteBasicUserinfo } = parseSiteBasicAuth(env);
     await run({
         endpointUrl: resolved.endpointUrl,
         token: resolved.token,
         ...(Object.keys(extraHeaders).length > 0 ? { extraHeaders } : {}),
+        ...(siteBasicUserinfo !== null ? { siteBasicUserinfo } : {}),
     });
     return true;
 }

package/dist/proxy/bridge.js.map

@@ -1 +1 @@
-{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../../src/proxy/bridge.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE/E,6EAA6E;AAC7E,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,eAAe,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC;QAC3D,MAAM,EAAE,GAAI,GAAuB,CAAC,EAAE,CAAC;QACvC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AASD,SAAS,kBAAkB,CAAC,CAAU;IACpC,OAAO,CACL,CAAC,KAAK,IAAI;QACV,OAAO,CAAC,KAAK,QAAQ;QACrB,OAAQ,CAAwB,CAAC,IAAI,KAAK,QAAQ;QAClD,OAAQ,CAAwB,CAAC,IAAI,KAAK,QAAQ,CACnD,CAAC;AACJ,CAAC;AAaD,SAAS,sBAAsB,CAAC,CAAU;IACxC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,OAAO,GAAI,CAA2B,CAAC,OAAO,CAAC;IACrD,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxD,MAAM,MAAM,GAAI,GAA4B,CAAC,MAAM,CAAC;IACpD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAE9D,4DAA4D;IAC5D,MAAM,OAAO,GAAI,MAAgC,CAAC,OAAO,CAAC;IAC1D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,CAAC;IAExC,6EAA6E;IAC7E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IACrC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,GAAG,CAAC;IAEpE,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,qCAAqC;QACrC,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAE/C,sEAAsE;IACtE,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,gBAAgB,GAA4B;QAChD,GAAI,MAAkC;QACtC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;IACF,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,gBAAgB,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC1E,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC1C,gBAAgB,CAAC,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,CAAC;IAC/D,CAAC;IACD,OAAO,EAAE,GAAI,GAA+B,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAgB,EAAE,MAAiB;IAClE,KAAK,CAAC,SAAS,GAAG,CAAC,GAAG,EAAE,EAAE;QACxB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtC,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YAClC,mEAAmE;YACnE,yEAAyE;YACzE,0EAA0E;YAC1E,gDAAgD;YAChD,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,gDAAgD,CAAC;YACnH,gDAAgD;YAChD,OAAO,CAAC,KAAK,CACX,0CAA0C,EAC1C,OAAO,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACrD,CAAC;YACF,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,8DAA8D;gBAC9D,MAAM,KAAK,GAAG;oBACZ,OAAO,EAAE,KAAK;oBACd,EAAE;oBACF,KAAK,EAAE;wBACL,IAAI,EAAE,CAAC,KAAK;wBACZ,OAAO,EAAE,yBAAyB,OAAO,KAAK,IAAI,EAAE;qBACrD;iBACF,CAAC;gBACF,KAAK,CAAC,IAAI,CAAC,KAAkC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAgB,EAAE,EAAE;oBACxE,OAAO,CAAC,KAAK,CAAC,mDAAmD,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC5F,CAAC,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,mEAAmE;gBACnE,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;YACtB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,MAAM,CAAC,SAAS,GAAG,CAAC,GAAG,EAAE,EAAE;QACzB,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAmB,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YAC5C,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;QACjF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,KAAK,CAAC,OAAO,GAAG,GAAG,EAAE;QACnB,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC,CAAC;IACF,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE;QACpB,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC,CAAC;IACF,KAAK,CAAC,OAAO,GAAG,CAAC,GAAG,EAAE,EAAE;QACtB,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1E,CAAC,CAAC;IACF,MAAM,CAAC,OAAO,GAAG,CAAC,GAAG,EAAE,EAAE;QACvB,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3E,CAAC,CAAC;AACJ,CAAC;AAYD;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAmB;IAC1D,MAAM,IAAI,GAA2B,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;IACjF,OAAO,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC;QACrF,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,CAAC;QAC9C,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,4EAA4E;AAC5E,SAAS,iBAAiB,CAAC,MAAmB;IAI5C,MAAM,MAAM,GAAG,IAAI,6BAA6B,CAAC,MAAM,CAAC,WAAW,EAAE;QACnE,WAAW,EAAE,EAAE,OAAO,EAAE,wBAAwB,CAAC,MAAM,CAAC,EAAE;KAC3D,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,oBAAoB,EAAE,CAAC;IACzC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,MAAmB,EACnB,OAKI,EAAE;IAEN,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;IAE7E,wEAAwE;IACxE,2EAA2E;IAC3E,oCAAoC;IACpC,MAAM,MAAM,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAC3C,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAChC,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC;QACrC,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC;QACvC,KAAK,CAAC,OAAO,GAAG,GAAG,EAAE;YACnB,cAAc,EAAE,EAAE,CAAC;YACnB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE;YACpB,eAAe,EAAE,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACpB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACrB,MAAM,MAAM,CAAC;AACf,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAsB,EACtB,OAAyD,EAAE;IAE3D,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;IACtC,gFAAgF;IAChF,4EAA4E;IAC5E,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACzD,MAAM,GAAG,CAAC;QACR,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../../src/proxy/bridge.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEnF,6EAA6E;AAC7E,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,eAAe,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC;QAC3D,MAAM,EAAE,GAAI,GAAuB,CAAC,EAAE,CAAC;QACvC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AASD,SAAS,kBAAkB,CAAC,CAAU;IACpC,OAAO,CACL,CAAC,KAAK,IAAI;QACV,OAAO,CAAC,KAAK,QAAQ;QACrB,OAAQ,CAAwB,CAAC,IAAI,KAAK,QAAQ;QAClD,OAAQ,CAAwB,CAAC,IAAI,KAAK,QAAQ,CACnD,CAAC;AACJ,CAAC;AAaD,SAAS,sBAAsB,CAAC,CAAU;IACxC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,OAAO,GAAI,CAA2B,CAAC,OAAO,CAAC;IACrD,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxD,MAAM,MAAM,GAAI,GAA4B,CAAC,MAAM,CAAC;IACpD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAE9D,4DAA4D;IAC5D,MAAM,OAAO,GAAI,MAAgC,CAAC,OAAO,CAAC;IAC1D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,CAAC;IAExC,6EAA6E;IAC7E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IACrC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,GAAG,CAAC;IAEpE,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,qCAAqC;QACrC,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAE/C,sEAAsE;IACtE,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,gBAAgB,GAA4B;QAChD,GAAI,MAAkC;QACtC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;IACF,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,gBAAgB,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC1E,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC1C,gBAAgB,CAAC,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,CAAC;IAC/D,CAAC;IACD,OAAO,EAAE,GAAI,GAA+B,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAgB,EAAE,MAAiB;IAClE,KAAK,CAAC,SAAS,GAAG,CAAC,GAAG,EAAE,EAAE;QACxB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtC,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YAClC,mEAAmE;YACnE,yEAAyE;YACzE,0EAA0E;YAC1E,gDAAgD;YAChD,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,gDAAgD,CAAC;YACnH,gDAAgD;YAChD,OAAO,CAAC,KAAK,CACX,0CAA0C,EAC1C,OAAO,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACrD,CAAC;YACF,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,8DAA8D;gBAC9D,MAAM,KAAK,GAAG;oBACZ,OAAO,EAAE,KAAK;oBACd,EAAE;oBACF,KAAK,EAAE;wBACL,IAAI,EAAE,CAAC,KAAK;wBACZ,OAAO,EAAE,yBAAyB,OAAO,KAAK,IAAI,EAAE;qBACrD;iBACF,CAAC;gBACF,KAAK,CAAC,IAAI,CAAC,KAAkC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAgB,EAAE,EAAE;oBACxE,OAAO,CAAC,KAAK,CAAC,mDAAmD,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC5F,CAAC,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,mEAAmE;gBACnE,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;YACtB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,MAAM,CAAC,SAAS,GAAG,CAAC,GAAG,EAAE,EAAE;QACzB,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAmB,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YAC5C,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;QACjF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,KAAK,CAAC,OAAO,GAAG,GAAG,EAAE;QACnB,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC,CAAC;IACF,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE;QACpB,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC,CAAC;IACF,KAAK,CAAC,OAAO,GAAG,CAAC,GAAG,EAAE,EAAE;QACtB,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1E,CAAC,CAAC;IACF,MAAM,CAAC,OAAO,GAAG,CAAC,GAAG,EAAE,EAAE;QACvB,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3E,CAAC,CAAC;AACJ,CAAC;AAoBD;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAmB;IAC1D,MAAM,IAAI,GAA2B,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;IACjF,OAAO,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC;QACrF,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,CAAC;QAC9C,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAmB;IACzD,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS,IAAI,MAAM,CAAC,iBAAiB,KAAK,EAAE,EAAE,CAAC;QAC9E,OAAO,MAAM,CAAC,WAAW,CAAC;IAC5B,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,4EAA4E;AAC5E,SAAS,iBAAiB,CAAC,MAAmB;IAI5C,MAAM,MAAM,GAAG,IAAI,6BAA6B,CAAC,uBAAuB,CAAC,MAAM,CAAC,EAAE;QAChF,WAAW,EAAE,EAAE,OAAO,EAAE,wBAAwB,CAAC,MAAM,CAAC,EAAE;KAC3D,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,oBAAoB,EAAE,CAAC;IACzC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,MAAmB,EACnB,OAKI,EAAE;IAEN,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;IAE7E,wEAAwE;IACxE,2EAA2E;IAC3E,oCAAoC;IACpC,MAAM,MAAM,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAC3C,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAChC,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC;QACrC,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC;QACvC,KAAK,CAAC,OAAO,GAAG,GAAG,EAAE;YACnB,cAAc,EAAE,EAAE,CAAC;YACnB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE;YACpB,eAAe,EAAE,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACpB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACrB,MAAM,MAAM,CAAC;AACf,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAsB,EACtB,OAAyD,EAAE;IAE3D,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;IACtC,6EAA6E;IAC7E,yEAAyE;IACzE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACzD,2EAA2E;IAC3E,4DAA4D;IAC5D,8EAA8E;IAC9E,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAChE,MAAM,GAAG,CAAC;QACR,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/setup-wizard-types.d.ts

@@ -200,6 +200,15 @@ export interface WizardDeps {
      * it on Node ≥ 22.15. Injectable so tests pin a version deterministically.
      */
     nodeVersion?: string;
+    /**
+     * P0.1 — process environment (default `process.env`) read ONLY to detect a
+     * corporate forward-proxy (`HTTP(S)_PROXY`) for the default-on CA bake: when
+     * no explicit `--ca` was given and a proxy is configured (or the health
+     * probe reported a TLS-trust failure), the wizard auto-bakes
+     * `NODE_OPTIONS=--use-system-ca` (Node ≥ 22.15) unattended. Injectable so
+     * tests drive the proxy-present branch deterministically.
+     */
+    processEnv?: NodeJS.ProcessEnv;
     /**
      * G-D #6 — prompt the user for a corporate-CA trust strategy when a probe
      * fails with a TLS-inspection error. `systemCaSupported` tells the prompt