feat(webfont-mcp): add MCP server, was tools, and public exports

.cursor/mcp.json

@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "webfont": {
+      "command": "node",
+      "args": ["${workspaceFolder}/packages/webfont-mcp/dist/main.js"],
+      "env": {
+        "WEBFONT_MCP_WORKSPACE_ROOT": "${workspaceFolder}"
+      }
+    }
+  }
+}

AGENTS.md

@@ -160,10 +160,11 @@ Example (`round`, [#569](https://github.com/itgalaxy/webfont/issues/569)): `CliL
 
 ### Config mapping, CLI bundles, and user input
 
-Patterns below come from assistant/CLI review on [#797](https://github.com/itgalaxy/webfont/pull/797) and apply to **any** code that loads external config (`.was`, cosmiconfig, MCP tool args, wizard answers).
+Patterns below come from assistant/CLI review on [#797](https://github.com/itgalaxy/webfont/pull/797) and MCP tool review on [#796](https://github.com/itgalaxy/webfont/pull/796). They apply to **any** code that loads external config (`.was`, cosmiconfig, MCP tool args, wizard answers).
 
 - **Do not override `webfont()` defaults when mapping external configs** unless the source file **explicitly** sets the field. Omit optional keys so `defaultWebfontOptions()` and runtime validation apply — forcing values like `fixedWidth: true` or `fontHeight: 1000` on minimal legacy configs changes font output unexpectedly.
 - **Normalize untrusted JSON before property access.** Loaded configs are parsed with `JSON.parse` — validate or defensively coerce fields (for example `formats` must be a non-empty array) before reading `.length` or spreading; prefer falling back or `webfont` validation over `TypeError` at map time. Optional `.was` basename fields (`prefix`, legacy `fontName`, `fontId`, `templateFontName`) must be validated as strings before calling string methods — throw `Invalid .was config: "{field}" must be a string` rather than opaque errors like `trim is not a function`.
+- **Distinguish presence from truthiness for mutually exclusive string inputs.** When callers must supply exactly one of two optional string fields (for example MCP `wasConfigPath` vs `wasConfigJson`), use `field !== undefined` for the exclusivity check — not `if (field)`. An empty string is “provided” for exclusivity; after that check, reject empty/whitespace with a clear `{field} must be a non-empty string` error instead of falling through to the other branch (`JSON.parse(undefined)`, cryptic parse errors). See `loadWasConfigsFromInput`.
 - **Guard loaded config JSON in a dedicated module** (for example `guardWasConfigLoad.ts`) so parse/validation logic is reusable: wrap `JSON.parse`, require object shape, validate required string fields (`dest`, `files`, `name`, `template`, …), and include `configPath` (and array index when relevant) in every error.
 - **Use `clean`, not `sanitize`, in our identifiers and docs.** Helpers like `cleanWasConfigBasename` express intent; reserve “sanitize” for quoting third-party APIs only.
 - **Clean user-derived path segments** before building output filenames. Use `path.basename()` (or equivalent) on names that become `{name}.was`, font basenames, or other disk paths; reject empty, `.`, and `..` basenames. Wizard answers and loaded JSON configs are untrusted input.