@wootsup/yt-builder-mcp 1.5.0 → 1.6.0

package/dist/diagnostics/startup-self-probe.d.ts

@@ -0,0 +1,39 @@
+/** A bounded TLS reachability probe of `url`. Resolves on any HTTP response
+ * (including 4xx/5xx — the TLS handshake succeeded), rejects on a transport
+ * failure (CA-trust, DNS, timeout, refused). */
+export type TlsProbe = (url: string, timeoutMs: number) => Promise<void>;
+export interface SelfProbeResult {
+    /** True → a TLS chain-of-trust failure was detected; the caller must exit. */
+    readonly caTrustFailure: boolean;
+    /** The actionable stderr message to print when `caTrustFailure` is true. */
+    readonly message?: string;
+}
+/** Default bound for the startup probe — short enough to beat the host's ~30s
+ * connect-timeout with wide margin, long enough for a real corporate proxy. */
+export declare const DEFAULT_SELF_PROBE_TIMEOUT_MS = 4000;
+/**
+ * The default probe: a bounded `fetch` (HEAD) of `url` with an AbortController
+ * timeout. Resolves on ANY response (the handshake completed); the only thing we
+ * care about is whether the connection rejects with a CA-trust error, which
+ * surfaces as a rejected promise whose `.cause` chain carries the TLS code.
+ */
+export declare const defaultTlsProbe: TlsProbe;
+/**
+ * Build the actionable stderr message for a CA-trust startup failure. Chooses
+ * the zero-export `--use-system-ca` remedy on Node ≥ 22.15, else the
+ * `NODE_EXTRA_CA_CERTS=<pem>` remedy. Never suggests disabling verification.
+ */
+export declare function caTrustStartupMessage(siteUrl: string, nodeVersion: string): string;
+/**
+ * Run the startup TLS self-probe against `siteUrl`. Returns `{ caTrustFailure:
+ * false }` for every outcome EXCEPT a TLS chain-of-trust rejection — only that
+ * one outcome is fail-fast-worthy (everything else must still let the server
+ * boot). When `siteUrl` is empty/undefined the probe is skipped (the
+ * boot-unconfigured path must stay).
+ */
+export declare function runStartupSelfProbe(siteUrl: string | undefined, deps?: {
+    readonly probe?: TlsProbe;
+    readonly nodeVersion?: string;
+    readonly timeoutMs?: number;
+}): Promise<SelfProbeResult>;
+//# sourceMappingURL=startup-self-probe.d.ts.map

package/dist/diagnostics/startup-self-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup-self-probe.d.ts","sourceRoot":"","sources":["../../src/diagnostics/startup-self-probe.ts"],"names":[],"mappings":"AA4BA;;gDAEgD;AAChD,MAAM,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAEzE,MAAM,WAAW,eAAe;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,4EAA4E;IAC5E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;+EAC+E;AAC/E,eAAO,MAAM,6BAA6B,OAAO,CAAC;AAElD;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,QAQ7B,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAUlF;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACrC,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,IAAI,GAAE;IACF,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC1B,GACP,OAAO,CAAC,eAAe,CAAC,CAoB1B"}

package/dist/diagnostics/startup-self-probe.js

@@ -0,0 +1,87 @@
+// packages/mcp/src/diagnostics/startup-self-probe.ts
+/**
+ * Startup TLS self-probe (P0.4 — fail-fast instead of a 30s /mcp hang).
+ *
+ * The Glöckle install-blocker: when the configured site sits behind a corporate
+ * TLS-inspection proxy whose root CA Node does not trust, the server opened
+ * stdio and waited — answering nothing — so the host's 30s `/mcp` connect-timeout
+ * fired with an opaque "Server disconnected" toast that "looked like an auth or
+ * server problem". The real cause (a self-signed cert in the chain) was invisible.
+ *
+ * This module sends ONE bounded HTTPS request to the configured site BEFORE the
+ * stdio transport is wired. If it rejects with a TLS chain-of-trust error
+ * (`isCaTrustError`), `main()` / the proxy bridge writes the actionable
+ * `--use-system-ca` / `NODE_EXTRA_CA_CERTS` fix to stderr and exits non-zero in
+ * < 2s — turning a silent 30s timeout into an immediate, copy-pasteable remedy.
+ * Any OTHER probe outcome (success, 401/404/5xx, DNS, plain timeout) is NOT a
+ * reason to abort: the server must still boot for those (auth can be fixed via a
+ * tool call; an unconfigured boot must stay). Never disables TLS verification.
+ *
+ * Pure + deps-injectable (the `probe` fn + `nodeVersion` + `now`) so it is
+ * unit-testable offline with no real network.
+ *
+ * @license MIT
+ */
+import { isCaTrustError, supportsSystemCa } from './ca-trust.js';
+/** Default bound for the startup probe — short enough to beat the host's ~30s
+ * connect-timeout with wide margin, long enough for a real corporate proxy. */
+export const DEFAULT_SELF_PROBE_TIMEOUT_MS = 4000;
+/**
+ * The default probe: a bounded `fetch` (HEAD) of `url` with an AbortController
+ * timeout. Resolves on ANY response (the handshake completed); the only thing we
+ * care about is whether the connection rejects with a CA-trust error, which
+ * surfaces as a rejected promise whose `.cause` chain carries the TLS code.
+ */
+export const defaultTlsProbe = async (url, timeoutMs) => {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        await fetch(url, { method: 'HEAD', signal: controller.signal, redirect: 'manual' });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+};
+/**
+ * Build the actionable stderr message for a CA-trust startup failure. Chooses
+ * the zero-export `--use-system-ca` remedy on Node ≥ 22.15, else the
+ * `NODE_EXTRA_CA_CERTS=<pem>` remedy. Never suggests disabling verification.
+ */
+export function caTrustStartupMessage(siteUrl, nodeVersion) {
+    const remedy = supportsSystemCa(nodeVersion)
+        ? 'set NODE_OPTIONS=--use-system-ca (Node ≥ 22.15 — reads your OS / corporate root CA store)'
+        : `set NODE_EXTRA_CA_CERTS=<path-to-corp-root-ca.pem> (this Node ${nodeVersion} is below 22.15, so --use-system-ca is unavailable)`;
+    return (`[yt-builder-mcp] fatal: self-signed cert in chain reaching ${siteUrl} — ` +
+        'a corporate TLS-inspection proxy is injecting its own root CA that Node does not trust. ' +
+        `Fix: ${remedy}, then restart your AI client. ` +
+        'Re-run `npx -y @wootsup/yt-builder-mcp setup` to bake this automatically. Never disable TLS verification.');
+}
+/**
+ * Run the startup TLS self-probe against `siteUrl`. Returns `{ caTrustFailure:
+ * false }` for every outcome EXCEPT a TLS chain-of-trust rejection — only that
+ * one outcome is fail-fast-worthy (everything else must still let the server
+ * boot). When `siteUrl` is empty/undefined the probe is skipped (the
+ * boot-unconfigured path must stay).
+ */
+export async function runStartupSelfProbe(siteUrl, deps = {}) {
+    const url = (siteUrl ?? '').trim();
+    if (url === '')
+        return { caTrustFailure: false };
+    const probe = deps.probe ?? defaultTlsProbe;
+    const nodeVersion = deps.nodeVersion ?? process.version;
+    const timeoutMs = deps.timeoutMs ?? DEFAULT_SELF_PROBE_TIMEOUT_MS;
+    try {
+        await probe(url, timeoutMs);
+        return { caTrustFailure: false };
+    }
+    catch (err) {
+        if (isCaTrustError(err)) {
+            return { caTrustFailure: true, message: caTrustStartupMessage(url, nodeVersion) };
+        }
+        // Any other failure (DNS, timeout, refused, plain abort) is NOT a
+        // boot-blocker — the server must still come up. The proxy bridge's
+        // first-frame catch already turns those into actionable JSON-RPC errors.
+        return { caTrustFailure: false };
+    }
+}
+//# sourceMappingURL=startup-self-probe.js.map

package/dist/diagnostics/startup-self-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup-self-probe.js","sourceRoot":"","sources":["../../src/diagnostics/startup-self-probe.ts"],"names":[],"mappings":"AAAA,qDAAqD;AAErD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAcjE;+EAC+E;AAC/E,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAElD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAa,KAAK,EAAE,GAAW,EAAE,SAAiB,EAAiB,EAAE;IAC7F,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC;QACD,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxF,CAAC;YAAS,CAAC;QACP,YAAY,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;AACL,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,WAAmB;IACtE,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC;QACxC,CAAC,CAAC,2FAA2F;QAC7F,CAAC,CAAC,iEAAiE,WAAW,qDAAqD,CAAC;IACxI,OAAO,CACH,8DAA8D,OAAO,KAAK;QAC1E,0FAA0F;QAC1F,QAAQ,MAAM,iCAAiC;QAC/C,2GAA2G,CAC9G,CAAC;AACN,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACrC,OAA2B,EAC3B,OAII,EAAE;IAEN,MAAM,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IAEjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,eAAe,CAAC;IAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IACxD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,6BAA6B,CAAC;IAElE,IAAI,CAAC;QACD,MAAM,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC5B,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;QACtF,CAAC;QACD,kEAAkE;QAClE,mEAAmE;QACnE,yEAAyE;QACzE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC;AACL,CAAC"}

package/dist/gateway/essentials.d.ts

@@ -15,11 +15,20 @@
  *                                 entirely (no forward, no capture) so the
  *                                 SDK never sees a duplicate registration.
  *
- * Why this split: Cursor caps MCP servers at ~40 tools. This adapter
- * declares 31 callable tools (26 domain L1/L3 + 4 advanced L2 + 1 gateway).
- * The 3-lane shape keeps `tools/list` at 24 (L1) + 2 (L3) + 1 (gateway) =
- * 27 entries, well under the cap, while every tool stays fully reachable
- * (advanced tools through `yootheme_builder_advanced`).
+ * Why this split: Cursor caps MCP servers at ~40 tools. The 3-lane shape
+ * keeps `tools/list` at 32 (L1) + 2 (L3) + 2 (gateways) = 36 entries, well
+ * under the cap, while every tool stays fully reachable (advanced tools
+ * through `yootheme_builder_advanced` / `yootheme_builder_advanced_read`).
+ * B4 (2026-06-27): element_get_binding promoted L2 → L1 (binding-read made
+ * first-class, mirroring the already-L1 element_bind_source write). L1 26 → 27.
+ * U4-L1 (Glöckle onboarding, 2026-06-27): source_get_schema promoted L2 → L1
+ * (the archive/category binding entry-point made first-class, mirroring how the
+ * bind→verify tools are already L1). L1 27 → 28.
+ * HANDOFF-4/5 L1 (Glöckle onboarding, 2026-06-28): render_preview,
+ * element_set_source, rename_source, template_set_type promoted L2 → L1 — the
+ * core write/refactor + render-verify tools the Glöckle HANDOFF-4/5 ask for,
+ * made first-class so a cold agent can discover them in tools/list (L2 was a
+ * discoverability workaround). L1 28 → 32, advanced 9 → 5.
  *
  * F116 (2026-06-11): the bind→save→publish chain (element_bind_source,
  * page_save, page_publish) was promoted from the advanced lane to L1. It is
@@ -42,7 +51,7 @@
  * L1 — Tools kept as first-class entries in `tools/list`.
  * Forwarded by the CapturingServer to the real McpServer.
  */
-export declare const ESSENTIAL_TOOLS: readonly ["yootheme_builder_pages_list", "yootheme_builder_pages_resolve", "yootheme_builder_get_etag", "yootheme_builder_element_list", "yootheme_builder_element_add", "yootheme_builder_element_update_settings", "yootheme_builder_sources_list", "yootheme_builder_element_types_list", "yootheme_builder_inspect_multi_items_binding", "yootheme_builder_element_get", "yootheme_builder_element_delete", "yootheme_builder_element_clone", "yootheme_builder_element_move", "yootheme_builder_page_get_layout", "yootheme_builder_template_summary", "yootheme_builder_element_type_get_schema", "yootheme_builder_sites_list", "yootheme_builder_sites_test", "yootheme_builder_use_site", "yootheme_builder_pages_create", "yootheme_builder_pages_delete", "yootheme_builder_element_bind_source", "yootheme_builder_page_save", "yootheme_builder_page_publish", "yootheme_builder_page_dynamize", "yootheme_builder_scaffold_section"];
+export declare const ESSENTIAL_TOOLS: readonly ["yootheme_builder_pages_list", "yootheme_builder_pages_resolve", "yootheme_builder_get_etag", "yootheme_builder_element_list", "yootheme_builder_element_add", "yootheme_builder_element_update_settings", "yootheme_builder_sources_list", "yootheme_builder_element_types_list", "yootheme_builder_inspect_multi_items_binding", "yootheme_builder_element_get", "yootheme_builder_element_delete", "yootheme_builder_element_clone", "yootheme_builder_element_move", "yootheme_builder_page_get_layout", "yootheme_builder_template_summary", "yootheme_builder_element_type_get_schema", "yootheme_builder_sites_list", "yootheme_builder_sites_test", "yootheme_builder_use_site", "yootheme_builder_pages_create", "yootheme_builder_pages_delete", "yootheme_builder_element_bind_source", "yootheme_builder_page_save", "yootheme_builder_page_publish", "yootheme_builder_element_get_binding", "yootheme_builder_page_dynamize", "yootheme_builder_scaffold_section", "yootheme_builder_source_get_schema", "yootheme_builder_render_preview", "yootheme_builder_element_set_source", "yootheme_builder_rename_source", "yootheme_builder_template_set_type"];
 /**
  * L3 — Tools registered DIRECTLY on the real McpServer, BEFORE the
  * CapturingServer wraps it. The CapturingServer treats these names as a

package/dist/gateway/essentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"essentials.d.ts","sourceRoot":"","sources":["../../src/gateway/essentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH;;;GAGG;AACH,eAAO,MAAM,eAAe,o5BAoFlB,CAAC;AAEX;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,mEAGzB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAC7D,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,gEAAgE;AAChE,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED,4DAA4D;AAC5D,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD"}
+{"version":3,"file":"essentials.d.ts","sourceRoot":"","sources":["../../src/gateway/essentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH;;;GAGG;AACH,eAAO,MAAM,eAAe,onCAyHlB,CAAC;AAEX;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,mEAGzB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAC7D,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,gEAAgE;AAChE,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED,4DAA4D;AAC5D,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD"}

package/dist/gateway/essentials.js

@@ -15,11 +15,20 @@
  *                                 entirely (no forward, no capture) so the
  *                                 SDK never sees a duplicate registration.
  *
- * Why this split: Cursor caps MCP servers at ~40 tools. This adapter
- * declares 31 callable tools (26 domain L1/L3 + 4 advanced L2 + 1 gateway).
- * The 3-lane shape keeps `tools/list` at 24 (L1) + 2 (L3) + 1 (gateway) =
- * 27 entries, well under the cap, while every tool stays fully reachable
- * (advanced tools through `yootheme_builder_advanced`).
+ * Why this split: Cursor caps MCP servers at ~40 tools. The 3-lane shape
+ * keeps `tools/list` at 32 (L1) + 2 (L3) + 2 (gateways) = 36 entries, well
+ * under the cap, while every tool stays fully reachable (advanced tools
+ * through `yootheme_builder_advanced` / `yootheme_builder_advanced_read`).
+ * B4 (2026-06-27): element_get_binding promoted L2 → L1 (binding-read made
+ * first-class, mirroring the already-L1 element_bind_source write). L1 26 → 27.
+ * U4-L1 (Glöckle onboarding, 2026-06-27): source_get_schema promoted L2 → L1
+ * (the archive/category binding entry-point made first-class, mirroring how the
+ * bind→verify tools are already L1). L1 27 → 28.
+ * HANDOFF-4/5 L1 (Glöckle onboarding, 2026-06-28): render_preview,
+ * element_set_source, rename_source, template_set_type promoted L2 → L1 — the
+ * core write/refactor + render-verify tools the Glöckle HANDOFF-4/5 ask for,
+ * made first-class so a cold agent can discover them in tools/list (L2 was a
+ * discoverability workaround). L1 28 → 32, advanced 9 → 5.
  *
  * F116 (2026-06-11): the bind→save→publish chain (element_bind_source,
  * page_save, page_publish) was promoted from the advanced lane to L1. It is
@@ -112,6 +121,16 @@ export const ESSENTIAL_TOOLS = [
     'yootheme_builder_element_bind_source',
     'yootheme_builder_page_save',
     'yootheme_builder_page_publish',
+    // B4 (Glöckle onboarding, 2026-06-27) — promote the binding READ to L1,
+    // mirroring its already-L1 WRITE sibling element_bind_source (F116). The
+    // READ stayed behind the advanced(-read) gateway: an agent that had just
+    // bound a relation traversal could not directly confirm query.field /
+    // arguments without first discovering the gateway — a 2-call discovery tax
+    // on the verify half of the bind→verify loop. Making binding-read
+    // first-class closes the asymmetry. This is a tier-LIST move (the catalog
+    // tool already exists); sync-catalog re-run flips its tier to essential.
+    // L1 surface 26 → 27.
+    'yootheme_builder_element_get_binding',
     // P-G (Goldstandard wave 3) — page_dynamize is THE canonical one-call
     // path to dynamize an existing designed section (copy byte-identically,
     // swap only mapped queries + leaf names). It MUST be L1 so an agent
@@ -126,6 +145,33 @@ export const ESSENTIAL_TOOLS = [
     // directly INSTEAD of hand-building (and tripping the guard on) an
     // invalid root/section/row placement. With the prior set L1 24 → 25.
     'yootheme_builder_scaffold_section',
+    // U4-L1 (Glöckle onboarding, 2026-06-27) — promote source_get_schema to L1.
+    // It is THE one-call entry-point for binding on an archive/category template
+    // (introspect a source's query methods + RELATIONS + the archive-context
+    // flag — turning a ~25-call code-dive into one). It stayed behind the
+    // advanced(-read) gateway, so a cold agent orienting toward a Term→Posts
+    // bind had to discover the gateway first — a 2-call discovery tax on the
+    // very first call of the canonical archive-binding workflow, whose write
+    // sibling element_bind_source is already L1 (F116). Making source-schema
+    // discovery first-class closes that asymmetry. This is a tier-LIST move
+    // (the catalog tool already exists); sync-catalog re-run flips its tier to
+    // essential. L1 surface 27 → 28.
+    'yootheme_builder_source_get_schema',
+    // HANDOFF-4/5 L1 (Glöckle onboarding, 2026-06-28) — promote the four core
+    // write/refactor + render-verify tools the Glöckle HANDOFF-4/5 explicitly
+    // ask for to L1. They were registered + reachable only via the advanced
+    // (-read) gateway, so a cold agent could not DISCOVER them in tools/list —
+    // L2 was a discoverability workaround, not a design choice. These ARE the
+    // canonical archive-rebind/refactor surface (set a precomposed source at a
+    // pointer; render-verify the saved page is not silently blank; rename a
+    // source/field template-wide after a taxonomy/CPT rename; re-type an
+    // orphaned archive/single template). Each is a tier-LIST move (the catalog
+    // tools already exist); sync-catalog re-run flips their tier to essential.
+    // L1 surface 28 → 32.
+    'yootheme_builder_render_preview',
+    'yootheme_builder_element_set_source',
+    'yootheme_builder_rename_source',
+    'yootheme_builder_template_set_type',
 ];
 /**
  * L3 — Tools registered DIRECTLY on the real McpServer, BEFORE the

package/dist/gateway/essentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"essentials.js","sourceRoot":"","sources":["../../src/gateway/essentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC3B,6BAA6B;IAC7B,qEAAqE;IACrE,qEAAqE;IACrE,uEAAuE;IACvE,mEAAmE;IACnE,gCAAgC;IAChC,2BAA2B;IAC3B,+BAA+B;IAC/B,8BAA8B;IAC9B,0CAA0C;IAC1C,+BAA+B;IAC/B,qCAAqC;IACrC,6DAA6D;IAC7D,kEAAkE;IAClE,6DAA6D;IAC7D,yCAAyC;IACzC,8CAA8C;IAC9C,iEAAiE;IACjE,4DAA4D;IAC5D,mEAAmE;IACnE,iEAAiE;IACjE,sEAAsE;IACtE,qEAAqE;IACrE,8BAA8B;IAC9B,iCAAiC;IACjC,gCAAgC;IAChC,+BAA+B;IAC/B,kCAAkC;IAClC,oEAAoE;IACpE,sEAAsE;IACtE,mCAAmC;IACnC,iEAAiE;IACjE,iEAAiE;IACjE,iEAAiE;IACjE,4DAA4D;IAC5D,4DAA4D;IAC5D,0CAA0C;IAC1C,mEAAmE;IACnE,oEAAoE;IACpE,mEAAmE;IACnE,kEAAkE;IAClE,uEAAuE;IACvE,6BAA6B;IAC7B,6BAA6B;IAC7B,mEAAmE;IACnE,oEAAoE;IACpE,oEAAoE;IACpE,8DAA8D;IAC9D,+BAA+B;IAC/B,2BAA2B;IAC3B,oEAAoE;IACpE,iEAAiE;IACjE,mEAAmE;IACnE,oEAAoE;IACpE,kEAAkE;IAClE,kCAAkC;IAClC,+BAA+B;IAC/B,+BAA+B;IAC/B,8EAA8E;IAC9E,sEAAsE;IACtE,uEAAuE;IACvE,oEAAoE;IACpE,oEAAoE;IACpE,yEAAyE;IACzE,kEAAkE;IAClE,yCAAyC;IACzC,sCAAsC;IACtC,4BAA4B;IAC5B,+BAA+B;IAC/B,sEAAsE;IACtE,wEAAwE;IACxE,oEAAoE;IACpE,qEAAqE;IACrE,kEAAkE;IAClE,oEAAoE;IACpE,gCAAgC;IAChC,wEAAwE;IACxE,oEAAoE;IACpE,wEAAwE;IACxE,wEAAwE;IACxE,mEAAmE;IACnE,qEAAqE;IACrE,mCAAmC;CAC7B,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IAClC,yBAAyB;IACzB,2BAA2B;CACrB,CAAC;AAKX,gEAAgE;AAChE,MAAM,UAAU,WAAW,CAAC,IAAY;IACpC,OAAQ,eAAqC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACjE,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB,CAAC,IAAY;IACzC,OAAQ,sBAA4C,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACxE,CAAC"}
+{"version":3,"file":"essentials.js","sourceRoot":"","sources":["../../src/gateway/essentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC3B,6BAA6B;IAC7B,qEAAqE;IACrE,qEAAqE;IACrE,uEAAuE;IACvE,mEAAmE;IACnE,gCAAgC;IAChC,2BAA2B;IAC3B,+BAA+B;IAC/B,8BAA8B;IAC9B,0CAA0C;IAC1C,+BAA+B;IAC/B,qCAAqC;IACrC,6DAA6D;IAC7D,kEAAkE;IAClE,6DAA6D;IAC7D,yCAAyC;IACzC,8CAA8C;IAC9C,iEAAiE;IACjE,4DAA4D;IAC5D,mEAAmE;IACnE,iEAAiE;IACjE,sEAAsE;IACtE,qEAAqE;IACrE,8BAA8B;IAC9B,iCAAiC;IACjC,gCAAgC;IAChC,+BAA+B;IAC/B,kCAAkC;IAClC,oEAAoE;IACpE,sEAAsE;IACtE,mCAAmC;IACnC,iEAAiE;IACjE,iEAAiE;IACjE,iEAAiE;IACjE,4DAA4D;IAC5D,4DAA4D;IAC5D,0CAA0C;IAC1C,mEAAmE;IACnE,oEAAoE;IACpE,mEAAmE;IACnE,kEAAkE;IAClE,uEAAuE;IACvE,6BAA6B;IAC7B,6BAA6B;IAC7B,mEAAmE;IACnE,oEAAoE;IACpE,oEAAoE;IACpE,8DAA8D;IAC9D,+BAA+B;IAC/B,2BAA2B;IAC3B,oEAAoE;IACpE,iEAAiE;IACjE,mEAAmE;IACnE,oEAAoE;IACpE,kEAAkE;IAClE,kCAAkC;IAClC,+BAA+B;IAC/B,+BAA+B;IAC/B,8EAA8E;IAC9E,sEAAsE;IACtE,uEAAuE;IACvE,oEAAoE;IACpE,oEAAoE;IACpE,yEAAyE;IACzE,kEAAkE;IAClE,yCAAyC;IACzC,sCAAsC;IACtC,4BAA4B;IAC5B,+BAA+B;IAC/B,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,sEAAsE;IACtE,2EAA2E;IAC3E,kEAAkE;IAClE,0EAA0E;IAC1E,yEAAyE;IACzE,sBAAsB;IACtB,sCAAsC;IACtC,sEAAsE;IACtE,wEAAwE;IACxE,oEAAoE;IACpE,qEAAqE;IACrE,kEAAkE;IAClE,oEAAoE;IACpE,gCAAgC;IAChC,wEAAwE;IACxE,oEAAoE;IACpE,wEAAwE;IACxE,wEAAwE;IACxE,mEAAmE;IACnE,qEAAqE;IACrE,mCAAmC;IACnC,4EAA4E;IAC5E,6EAA6E;IAC7E,yEAAyE;IACzE,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,wEAAwE;IACxE,2EAA2E;IAC3E,iCAAiC;IACjC,oCAAoC;IACpC,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,qEAAqE;IACrE,2EAA2E;IAC3E,2EAA2E;IAC3E,sBAAsB;IACtB,iCAAiC;IACjC,qCAAqC;IACrC,gCAAgC;IAChC,oCAAoC;CAC9B,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IAClC,yBAAyB;IACzB,2BAA2B;CACrB,CAAC;AAKX,gEAAgE;AAChE,MAAM,UAAU,WAAW,CAAC,IAAY;IACpC,OAAQ,eAAqC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACjE,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB,CAAC,IAAY;IACzC,OAAQ,sBAA4C,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACxE,CAAC"}

package/dist/index.d.ts

@@ -11,6 +11,7 @@
  *
  * @license MIT
  */
+import { type TlsProbe } from './diagnostics/startup-self-probe.js';
 export { createServer, SERVER_NAME, SERVER_VERSION } from './server.js';
 export { RestClient, REST_NAMESPACE_PATH, encodeElementPath } from './client.js';
 export { loadConfig, loadRegistry, isTestMode, ENV_SITE_URL, ENV_WP_URL, ENV_BEARER, ENV_SITES_FILE, ENV_PLATFORM, ENV_PROFILE, ENV_TEST_MODE, } from './auth.js';
@@ -25,6 +26,19 @@ export { ESSENTIAL_TOOLS, DIRECT_TOP_LEVEL_TOOLS, isEssential, isDirectTopLevel,
 export { CapturingServer, type AdvancedToolEntry, type CapturedToolHandler, type ToolRegistrar, } from './gateway/capturing-server.js';
 export { registerAdvancedTool } from './gateway/advanced-tool.js';
 export { collectAllRegisteredTools, findTool, type CollectedTool, } from './gateway/test-support.js';
-declare function main(): Promise<void>;
+/**
+ * Optional injection seam for {@link main} — lets the startup self-probe (P0.4)
+ * be driven deterministically in tests without a real network. Production passes
+ * nothing, so the real bounded `fetch` probe runs.
+ */
+export interface MainDeps {
+    /** Override the startup TLS self-probe (P0.4). Default: real bounded fetch. */
+    readonly selfProbe?: TlsProbe;
+    /** Override `process.version` for the self-probe's remedy choice. */
+    readonly nodeVersion?: string;
+    /** Override `process.exit` so a CA-trust abort is observable in tests. */
+    readonly exit?: (code: number) => never;
+}
+declare function main(deps?: MainDeps): Promise<void>;
 export { main };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAkBH,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EACH,UAAU,EACV,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,UAAU,EACV,UAAU,EACV,cAAc,EACd,YAAY,EACZ,WAAW,EACX,aAAa,GAChB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGjD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACxF,OAAO,EACH,eAAe,EACf,sBAAsB,EACtB,WAAW,EACX,gBAAgB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACH,eAAe,EACf,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,aAAa,GACrB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EACH,yBAAyB,EACzB,QAAQ,EACR,KAAK,aAAa,GACrB,MAAM,2BAA2B,CAAC;AAEnC,iBAAe,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAiHnC;AAkBD,OAAO,EAAE,IAAI,EAAE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,EAAuB,KAAK,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAczF,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EACH,UAAU,EACV,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,UAAU,EACV,UAAU,EACV,cAAc,EACd,YAAY,EACZ,WAAW,EACX,aAAa,GAChB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGjD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACxF,OAAO,EACH,eAAe,EACf,sBAAsB,EACtB,WAAW,EACX,gBAAgB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACH,eAAe,EACf,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,aAAa,GACrB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EACH,yBAAyB,EACzB,QAAQ,EACR,KAAK,aAAa,GACrB,MAAM,2BAA2B,CAAC;AAEnC;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACrB,+EAA+E;IAC/E,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,KAAK,CAAC;CAC3C;AAED,iBAAe,IAAI,CAAC,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAoJtD;AAkBD,OAAO,EAAE,IAAI,EAAE,CAAC"}

package/dist/index.js

@@ -12,7 +12,8 @@
  * @license MIT
  */
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { isTestMode, loadRegistry } from './auth.js';
+import { ENV_SITE_URL, ENV_WP_URL, isTestMode, loadRegistry } from './auth.js';
+import { runStartupSelfProbe } from './diagnostics/startup-self-probe.js';
 import { ConfigError } from './errors.js';
 import { installGlobalProxyDispatcher } from './net/proxy-dispatcher.js';
 import { SERVER_VERSION } from './server.js';
@@ -40,7 +41,7 @@ export { ESSENTIAL_TOOLS, DIRECT_TOP_LEVEL_TOOLS, isEssential, isDirectTopLevel,
 export { CapturingServer, } from './gateway/capturing-server.js';
 export { registerAdvancedTool } from './gateway/advanced-tool.js';
 export { collectAllRegisteredTools, findTool, } from './gateway/test-support.js';
-async function main() {
+async function main(deps = {}) {
     // Honor an enterprise HTTP(S)_PROXY / NO_PROXY before any outbound call —
     // BOTH proxy mode (below) and fat mode use Node's global fetch, which reads
     // this global dispatcher. Unconditional + passthrough-safe (no proxy env =
@@ -55,6 +56,13 @@ async function main() {
         for (const w of parseExtraHeaders().warnings) {
             process.stderr.write(`[yt-builder-mcp] ${w}\n`);
         }
+        // U3 — surface any YTB_MCP_SITE_BASIC_AUTH parse warning (missing colon /
+        // empty username) ONCE at startup. The warning NEVER contains the
+        // credential value (see net/site-basic-auth.ts).
+        const { parseSiteBasicAuth } = await import('./net/site-basic-auth.js');
+        for (const w of parseSiteBasicAuth().warnings) {
+            process.stderr.write(`[yt-builder-mcp] ${w}\n`);
+        }
     }
     // Update notice (non-blocking, cached 24h, fail-silent) — surfaces a newer
     // npm version to stderr without ever delaying serving or breaking behind a
@@ -71,6 +79,33 @@ async function main() {
             /* fail-silent — the notifier is a courtesy, never a dependency */
         });
     }
+    // P0.4 — bounded startup TLS self-probe. Before we open stdio (in EITHER
+    // proxy or fat mode), send ONE short HTTPS request to the configured site.
+    // If it rejects with a TLS chain-of-trust error (a corporate TLS-inspection
+    // proxy whose root CA Node doesn't trust), print the actionable
+    // --use-system-ca / NODE_EXTRA_CA_CERTS fix to stderr and exit fast (< 2s)
+    // instead of hanging until the host's ~30s /mcp connect-timeout. Skipped in
+    // test-mode (the smoke probe must not hit the network) and when no site is
+    // configured (the boot-unconfigured path must stay). Any non-CA outcome
+    // (success, 401/404/5xx, DNS, plain timeout) lets the server boot normally.
+    if (!isTestMode()) {
+        const siteUrl = process.env[ENV_SITE_URL] ?? process.env[ENV_WP_URL];
+        const probeResult = await runStartupSelfProbe(siteUrl, {
+            ...(deps.selfProbe !== undefined ? { probe: deps.selfProbe } : {}),
+            ...(deps.nodeVersion !== undefined ? { nodeVersion: deps.nodeVersion } : {}),
+        });
+        if (probeResult.caTrustFailure) {
+            process.stderr.write(`${probeResult.message ?? ''}\n`);
+            // Default exits the process (never returns). An injected stub in
+            // tests does NOT terminate, so we must still stop here — return
+            // BEFORE the call would be wrong (the real exit must fire), so we
+            // invoke then return. Typed `(code) => void` so the post-call return
+            // stays reachable for the stub path.
+            const doExit = deps.exit ?? ((code) => process.exit(code));
+            doExit(1);
+            return;
+        }
+    }
     // Proxy mode: forward stdio 1:1 to the plugin-served PHP MCP endpoint and
     // stop here — the fat catalog below is bypassed entirely. Default (fat) is
     // unchanged. The dynamic import is gated on the env so the fat path never

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9E,gFAAgF;AAChF,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EACH,UAAU,EACV,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,UAAU,EACV,UAAU,EACV,cAAc,EACd,YAAY,EACZ,WAAW,EACX,aAAa,GAChB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,mEAAmE;AACnE,+DAA+D;AAC/D,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACxF,OAAO,EACH,eAAe,EACf,sBAAsB,EACtB,WAAW,EACX,gBAAgB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACH,eAAe,GAIlB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EACH,yBAAyB,EACzB,QAAQ,GAEX,MAAM,2BAA2B,CAAC;AAEnC,KAAK,UAAU,IAAI;IACf,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,0EAA0E;IAC1E,+BAA+B;IAC/B,4BAA4B,EAAE,CAAC;IAE/B,6EAA6E;IAC7E,0EAA0E;IAC1E,+EAA+E;IAC/E,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QAChB,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACrE,KAAK,MAAM,CAAC,IAAI,iBAAiB,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,0DAA0D;IAC1D,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QAChB,KAAK,cAAc,CAAC,EAAE,cAAc,EAAE,cAAc,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;aACjF,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACb,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE;YACR,kEAAkE;QACtE,CAAC,CAAC,CAAC;IACX,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,OAAO,EAAE,CAAC;QACvC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC5D,IAAI,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO;IACjD,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;IAE9B,mDAAmD;IACnD,4DAA4D;IAC5D,yDAAyD;IACzD,4DAA4D;IAC5D,2CAA2C;IAC3C,EAAE;IACF,8DAA8D;IAC9D,gEAAgE;IAChE,iEAAiE;IACjE,mEAAmE;IACnE,6DAA6D;IAC7D,+CAA+C;IAC/C,IAAI,QAAsB,CAAC;IAC3B,IAAI,CAAC;QACD,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,8DAA8D;QAC9D,yDAAyD;QACzD,0DAA0D;QAC1D,kEAAkE;QAClE,kEAAkE;QAClE,gEAAgE;QAChE,kEAAkE;QAClE,kEAAkE;QAClE,gEAAgE;QAChE,+DAA+D;QAC/D,+DAA+D;QAC/D,gEAAgE;QAChE,kEAAkE;QAClE,yBAAyB;QACzB,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,CAAC,YAAY,WAAW;YACjC,CAAC,CAAC,uBAAuB;YACzB,CAAC,CAAC,wCAAwC,CAAC;QAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,IAAI,MAAM,GAAG,IAAI,CAAC,CAAC;QAC5D,QAAQ,GAAG,IAAI,YAAY,CAAC;YACxB,cAAc,EAAE,CAAC;YACjB,eAAe,EAAE,IAAI;YACrB,KAAK,EAAE,EAAE;SACZ,CAAC,CAAC;IACP,CAAC;IAED,MAAM,cAAc,GAAG,qBAAqB,EAAE,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAEtD,gEAAgE;IAChE,kEAAkE;IAClE,gEAAgE;IAChE,8DAA8D;IAC9D,oEAAoE;IACpE,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAE1B,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAE9C,IAAI,QAAQ,EAAE,CAAC;QACX,kEAAkE;QAClE,yDAAyD;QACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,gCAAgC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAC7E,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,GAAG,EAAE,CAAC;IACzC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;QACxB,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,OAAO,IAAI,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;AACP,CAAC;AAED,OAAO,EAAE,IAAI,EAAE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAiB,MAAM,qCAAqC,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9E,gFAAgF;AAChF,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EACH,UAAU,EACV,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,UAAU,EACV,UAAU,EACV,cAAc,EACd,YAAY,EACZ,WAAW,EACX,aAAa,GAChB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,mEAAmE;AACnE,+DAA+D;AAC/D,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACxF,OAAO,EACH,eAAe,EACf,sBAAsB,EACtB,WAAW,EACX,gBAAgB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACH,eAAe,GAIlB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EACH,yBAAyB,EACzB,QAAQ,GAEX,MAAM,2BAA2B,CAAC;AAgBnC,KAAK,UAAU,IAAI,CAAC,OAAiB,EAAE;IACnC,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,0EAA0E;IAC1E,+BAA+B;IAC/B,4BAA4B,EAAE,CAAC;IAE/B,6EAA6E;IAC7E,0EAA0E;IAC1E,+EAA+E;IAC/E,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QAChB,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACrE,KAAK,MAAM,CAAC,IAAI,iBAAiB,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QACD,0EAA0E;QAC1E,kEAAkE;QAClE,iDAAiD;QACjD,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACxE,KAAK,MAAM,CAAC,IAAI,kBAAkB,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,0DAA0D;IAC1D,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QAChB,KAAK,cAAc,CAAC,EAAE,cAAc,EAAE,cAAc,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;aACjF,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACb,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE;YACR,kEAAkE;QACtE,CAAC,CAAC,CAAC;IACX,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,gEAAgE;IAChE,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,wEAAwE;IACxE,4EAA4E;IAC5E,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrE,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE;YACnD,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/E,CAAC,CAAC;QACH,IAAI,WAAW,CAAC,cAAc,EAAE,CAAC;YAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,OAAO,IAAI,EAAE,IAAI,CAAC,CAAC;YACvD,iEAAiE;YACjE,gEAAgE;YAChE,kEAAkE;YAClE,qEAAqE;YACrE,qCAAqC;YACrC,MAAM,MAAM,GAA2B,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAY,EAAS,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAClG,MAAM,CAAC,CAAC,CAAC,CAAC;YACV,OAAO;QACX,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,OAAO,EAAE,CAAC;QACvC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC5D,IAAI,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO;IACjD,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;IAE9B,mDAAmD;IACnD,4DAA4D;IAC5D,yDAAyD;IACzD,4DAA4D;IAC5D,2CAA2C;IAC3C,EAAE;IACF,8DAA8D;IAC9D,gEAAgE;IAChE,iEAAiE;IACjE,mEAAmE;IACnE,6DAA6D;IAC7D,+CAA+C;IAC/C,IAAI,QAAsB,CAAC;IAC3B,IAAI,CAAC;QACD,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,8DAA8D;QAC9D,yDAAyD;QACzD,0DAA0D;QAC1D,kEAAkE;QAClE,kEAAkE;QAClE,gEAAgE;QAChE,kEAAkE;QAClE,kEAAkE;QAClE,gEAAgE;QAChE,+DAA+D;QAC/D,+DAA+D;QAC/D,gEAAgE;QAChE,kEAAkE;QAClE,yBAAyB;QACzB,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,CAAC,YAAY,WAAW;YACjC,CAAC,CAAC,uBAAuB;YACzB,CAAC,CAAC,wCAAwC,CAAC;QAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,IAAI,MAAM,GAAG,IAAI,CAAC,CAAC;QAC5D,QAAQ,GAAG,IAAI,YAAY,CAAC;YACxB,cAAc,EAAE,CAAC;YACjB,eAAe,EAAE,IAAI;YACrB,KAAK,EAAE,EAAE;SACZ,CAAC,CAAC;IACP,CAAC;IAED,MAAM,cAAc,GAAG,qBAAqB,EAAE,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAEtD,gEAAgE;IAChE,kEAAkE;IAClE,gEAAgE;IAChE,8DAA8D;IAC9D,oEAAoE;IACpE,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAE1B,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAE9C,IAAI,QAAQ,EAAE,CAAC;QACX,kEAAkE;QAClE,yDAAyD;QACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,gCAAgC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAC7E,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,GAAG,EAAE,CAAC;IACzC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;QACxB,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,OAAO,IAAI,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;AACP,CAAC;AAED,OAAO,EAAE,IAAI,EAAE,CAAC"}

package/dist/net/proxy-dispatcher.d.ts

@@ -12,6 +12,13 @@ export interface ProxyDispatcherDeps {
     /** Defaults to `console.error`. */
     stderr?: (message: string) => void;
 }
+/**
+ * Is any forward-proxy configured in the environment? Exported so the setup
+ * wizard's P0.1 default-on CA bake can reuse the SAME definition of "a corporate
+ * proxy is present" (one source of truth — no drift between the dispatcher and
+ * the installer).
+ */
+export declare function hasProxyConfigured(env: NodeJS.ProcessEnv): boolean;
 /**
  * Install a process-global undici dispatcher that honors the enterprise
  * `HTTP_PROXY` / `HTTPS_PROXY` / `NO_PROXY` environment variables at request

package/dist/net/proxy-dispatcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy-dispatcher.d.ts","sourceRoot":"","sources":["../../src/net/proxy-dispatcher.ts"],"names":[],"mappings":"AACA,OAAO,EAAuE,KAAK,UAAU,EAAE,MAAM,QAAQ,CAAC;AAI9G;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAChC,kEAAkE;IAClE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,8DAA8D;IAC9D,mBAAmB,CAAC,EAAE,CAAC,UAAU,EAAE,UAAU,KAAK,IAAI,CAAC;IACvD,mDAAmD;IACnD,qBAAqB,CAAC,EAAE,MAAM,UAAU,CAAC;IACzC,mCAAmC;IACnC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC;AAOD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAkCpF"}
+{"version":3,"file":"proxy-dispatcher.d.ts","sourceRoot":"","sources":["../../src/net/proxy-dispatcher.ts"],"names":[],"mappings":"AACA,OAAO,EAAuE,KAAK,UAAU,EAAE,MAAM,QAAQ,CAAC;AAI9G;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAChC,kEAAkE;IAClE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,8DAA8D;IAC9D,mBAAmB,CAAC,EAAE,CAAC,UAAU,EAAE,UAAU,KAAK,IAAI,CAAC;IACvD,mDAAmD;IACnD,qBAAqB,CAAC,EAAE,MAAM,UAAU,CAAC;IACzC,mCAAmC;IACnC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAElE;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAkCpF"}

package/dist/net/proxy-dispatcher.js

@@ -1,8 +1,13 @@
 // packages/mcp/src/net/proxy-dispatcher.ts
 import { EnvHttpProxyAgent, setGlobalDispatcher as undiciSetGlobalDispatcher } from 'undici';
 import { deriveNoProxyForInternalSite } from './internal-host.js';
-/** Is any forward-proxy configured in the environment? */
-function hasProxyConfigured(env) {
+/**
+ * Is any forward-proxy configured in the environment? Exported so the setup
+ * wizard's P0.1 default-on CA bake can reuse the SAME definition of "a corporate
+ * proxy is present" (one source of truth — no drift between the dispatcher and
+ * the installer).
+ */
+export function hasProxyConfigured(env) {
     return Boolean(env.HTTPS_PROXY ?? env.https_proxy ?? env.HTTP_PROXY ?? env.http_proxy);
 }
 /**

package/dist/net/proxy-dispatcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"proxy-dispatcher.js","sourceRoot":"","sources":["../../src/net/proxy-dispatcher.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,IAAI,yBAAyB,EAAmB,MAAM,QAAQ,CAAC;AAE9G,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAgBlE,0DAA0D;AAC1D,SAAS,kBAAkB,CAAC,GAAsB;IAC9C,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAA4B,EAAE;IACvE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,sEAAsE;QACtE,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,IAAI,yBAAyB,CAAC;IAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,qBAAqB,IAAI,CAAC,GAAe,EAAE,CAAC,IAAI,iBAAiB,EAAE,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,OAAe,EAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAEhF,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,OAAO,GAAG,4BAA4B,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACrF,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnD,oEAAoE;QACpE,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,wCAAwC,OAAO,CAAC,SAAS,IAAI,EAAE,0DAA0D,CAAC,CAAC;IACpI,CAAC;IAED,IAAI,CAAC;QACD,aAAa,CAAC,SAAS,EAAE,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,mEAAmE;QACnE,IAAI,CAAC,wFAAwF,OAAO,EAAE,CAAC,CAAC;QACxG,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC"}
+{"version":3,"file":"proxy-dispatcher.js","sourceRoot":"","sources":["../../src/net/proxy-dispatcher.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,IAAI,yBAAyB,EAAmB,MAAM,QAAQ,CAAC;AAE9G,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAgBlE;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAsB;IACrD,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAA4B,EAAE;IACvE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,sEAAsE;QACtE,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,IAAI,yBAAyB,CAAC;IAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,qBAAqB,IAAI,CAAC,GAAe,EAAE,CAAC,IAAI,iBAAiB,EAAE,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,OAAe,EAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAEhF,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,OAAO,GAAG,4BAA4B,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACrF,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnD,oEAAoE;QACpE,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,wCAAwC,OAAO,CAAC,SAAS,IAAI,EAAE,0DAA0D,CAAC,CAAC;IACpI,CAAC;IAED,IAAI,CAAC;QACD,aAAa,CAAC,SAAS,EAAE,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,mEAAmE;QACnE,IAAI,CAAC,wFAAwF,OAAO,EAAE,CAAC,CAAC;QACxG,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC"}

package/dist/net/site-basic-auth.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Parse `YTB_MCP_SITE_BASIC_AUTH` ('user:pass') into URL **userinfo** that is
+ * injected into the upstream request URL (`https://user:pass@host/…`) on BOTH
+ * transports (fat-mode {@link RestClient} base URL and proxy-mode endpoint URL).
+ *
+ * Why this exists (U3 — Glöckle post-cert QA blocker): a site fronted by a pure
+ * HTTP **Basic-Auth realm** (e.g. `qa.gloeckle.de`) requires
+ * `Authorization: Basic …`. But the plugin Bearer already owns the single
+ * `Authorization` header on every outbound request, and `YTB_MCP_EXTRA_HEADERS`
+ * HARD-FORBIDS an `Authorization` key (see {@link parseExtraHeaders}) — so Basic
+ * and the Bearer collide on the one header and the site is unreachable.
+ *
+ * The fix routes the site-level Basic credentials on a **separate transport**:
+ * URL userinfo. Userinfo and the `Authorization` header are independent — undici
+ * / fetch turn `https://user:pass@host` into an `Authorization: Basic …` toward
+ * the **gateway/realm**, while we keep emitting `Authorization: Bearer …` toward
+ * the **plugin** behind it. The Bearer is never touched; the realm and the
+ * plugin each get the credential they expect.
+ *
+ * ── Accepted format ─────────────────────────────────────────────────────────
+ *   `user:pass` — split on the FIRST colon (passwords may contain colons).
+ *     - The username MUST be non-empty.
+ *     - The password MAY be empty (some realms use a user-only token).
+ *   Both halves are percent-encoded for userinfo via the WHATWG URL encoder, so
+ *   reserved chars (`@`, `/`, `:`, space, …) survive into a valid URL.
+ *
+ * ── Security invariants ─────────────────────────────────────────────────────
+ *   - The credential value is **NEVER** echoed in a warning or logged. Malformed
+ *     input yields a generic "missing colon / empty username" warning only.
+ *   - This channel NEVER touches the `Authorization` header — it rides URL
+ *     userinfo exclusively, so the Bearer always wins (orthogonal transports).
+ *
+ * Pure + deterministic. `warnings` collects non-fatal issues; the caller (the
+ * server boot path) surfaces them once to stderr.
+ *
+ * @license MIT
+ */
+/** Canonical env-var name for the site-level HTTP Basic-Auth feature. */
+export declare const ENV_SITE_BASIC_AUTH = "YTB_MCP_SITE_BASIC_AUTH";
+export interface ParsedSiteBasicAuth {
+    /**
+     * Percent-encoded `user:pass` userinfo ready to splice into a URL, or
+     * `null` when the env var is unset/blank/malformed. NEVER contains the raw
+     * (un-encoded) credential beyond what userinfo requires.
+     */
+    readonly userinfo: string | null;
+    /** Non-fatal issues (missing colon, empty username). Never echo the secret. */
+    readonly warnings: readonly string[];
+}
+/**
+ * Parse `YTB_MCP_SITE_BASIC_AUTH` from `env` (default `process.env`). Returns
+ * `{ userinfo: null, warnings: [] }` when unset/blank, and a generic warning
+ * (never containing the secret) when the value is malformed.
+ */
+export declare function parseSiteBasicAuth(env?: NodeJS.ProcessEnv): ParsedSiteBasicAuth;
+/**
+ * Splice `userinfo` (a percent-encoded `user:pass`) into `url`, returning the
+ * resulting href. When `userinfo` is `null`, the URL is returned unchanged
+ * (string form). Any pre-existing userinfo on the URL is overwritten.
+ *
+ * This is the ONLY mutation the site-Basic channel performs — it never adds or
+ * alters a header, so the Bearer in `Authorization` is untouched.
+ */
+export declare function applyUserinfoToUrl(url: string | URL, userinfo: string | null): string;
+//# sourceMappingURL=site-basic-auth.d.ts.map

package/dist/net/site-basic-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"site-basic-auth.d.ts","sourceRoot":"","sources":["../../src/net/site-basic-auth.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,yEAAyE;AACzE,eAAO,MAAM,mBAAmB,4BAA4B,CAAC;AAE7D,MAAM,WAAW,mBAAmB;IAChC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAqBD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,mBAAmB,CA8B5F;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAgBrF"}