@chrischall/eventbrite-mcp 0.3.0 → 0.3.1

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Eventbrite — your tickets and orders, organizer data, and public event discovery",
-    "version": "0.3.0"
+    "version": "0.3.1"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Eventbrite",
       "source": "./",
       "description": "MCP server for Eventbrite — tickets, orders, organizer data, and public event search. Account tools use a personal API token; discovery search routes through the user's signed-in eventbrite.com tab via the fetchproxy bridge, reusing their authenticated session.",
-      "version": "0.3.0",
+      "version": "0.3.1",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "eventbrite-mcp",
   "displayName": "Eventbrite",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "MCP server for Eventbrite — your tickets and orders, organizer data, and public event discovery",
   "author": {
     "name": "Chris Hall",

package/dist/bundle.js

@@ -7302,6 +7302,7 @@ var init_frames = __esm({
     HKDF_SESSION_INFO = "fetchproxy/1.0.0/session";
     KNOWN_CAPABILITIES = /* @__PURE__ */ new Set([
       "fetch",
+      "fetch_in_page",
       "read_cookies",
       "read_local_storage",
       "read_session_storage",
@@ -7404,6 +7405,11 @@ function assertBase64(x, label) {
   if (!BASE64_RE.test(x))
     throw new ProtocolError(`${label}: invalid base64`);
 }
+function assertBoolean(x, label) {
+  if (typeof x !== "boolean") {
+    throw new ProtocolError(`${label}: must be boolean`);
+  }
+}
 function assertPositiveInt(x, label) {
   if (typeof x !== "number" || !Number.isInteger(x) || x <= 0) {
     throw new ProtocolError(`${label}: expected positive integer`);
@@ -7697,6 +7703,10 @@ function validateFrame(raw) {
     return validateEncrypted(raw);
   if (t === "pair-pending")
     return validatePairPending(raw);
+  if (t === "hello-rejected")
+    return validateHelloRejected(raw);
+  if (t === "extension-disconnected")
+    return { type: "extension-disconnected" };
   throw new ProtocolError(`unknown frame type: ${String(t)}`);
 }
 function validateHello(raw) {
@@ -7764,6 +7774,16 @@ function validateHello(raw) {
     if (raw.domSelectors !== void 0) {
       assertDomSelectorsArray(raw.domSelectors, "hello.domSelectors");
     }
+    if (raw.accepts !== void 0) {
+      if (!Array.isArray(raw.accepts)) {
+        throw new ProtocolError("hello.accepts: expected array");
+      }
+      for (const a of raw.accepts) {
+        if (typeof a !== "string") {
+          throw new ProtocolError(`hello.accepts: entry must be string, got ${typeof a}`);
+        }
+      }
+    }
     if (raw.graphqlOps !== void 0) {
       assertGraphqlOpsArray(raw.graphqlOps, "hello.graphqlOps");
     }
@@ -7814,6 +7834,16 @@ function validatePairPending(raw) {
   }
   return { type: "pair-pending", mcpId: raw.mcpId, pairCode: raw.pairCode };
 }
+function validateHelloRejected(raw) {
+  assertString(raw.mcpId, "hello-rejected.mcpId");
+  if (!isValidMcpId(raw.mcpId))
+    throw new ProtocolError("hello-rejected.mcpId: invalid format");
+  assertString(raw.reason, "hello-rejected.reason");
+  if (raw.reason.length > 200) {
+    throw new ProtocolError("hello-rejected.reason: must be at most 200 characters");
+  }
+  return { type: "hello-rejected", mcpId: raw.mcpId, reason: raw.reason };
+}
 function validateInnerFrame(raw) {
   assertObject(raw, "inner");
   const t = raw.type;
@@ -7845,6 +7875,14 @@ function validateInnerRequest(raw) {
     if (raw.init.body !== void 0) {
       assertString(raw.init.body, "inner.init.body");
     }
+    if (raw.init.inPage !== void 0) {
+      assertBoolean(raw.init.inPage, "inner.init.inPage");
+    }
+    if (raw.init.credentials !== void 0) {
+      if (raw.init.credentials !== "include" && raw.init.credentials !== "omit") {
+        throw new ProtocolError("inner.init.credentials: must be 'include' or 'omit'");
+      }
+    }
     return raw;
   }
   if (raw.op === "read_cookies") {
@@ -12274,6 +12312,8 @@ async function buildServerHello(opts) {
     sessionNonce: toB64(sessionNonce),
     sessionSig: toB64(sig)
   };
+  if (opts.accepts && opts.accepts.length > 0)
+    hello.accepts = [...opts.accepts];
   if (opts.cookieKeys && opts.cookieKeys.length > 0) {
     hello.cookieKeys = [...opts.cookieKeys];
   }
@@ -12375,7 +12415,7 @@ async function awaitSessionReady(ready, opts) {
       clearTimeout(timer);
   }
 }
-var SESSION_READY_TIMEOUT_MS, FetchproxySessionNotReadyError;
+var SESSION_READY_TIMEOUT_MS, FetchproxySessionNotReadyError, FetchproxyHelloRejectedError;
 var init_session_ready = __esm({
   "node_modules/@fetchproxy/server/dist/session-ready.js"() {
     SESSION_READY_TIMEOUT_MS = 3e4;
@@ -12396,15 +12436,35 @@ var init_session_ready = __esm({
         Object.setPrototypeOf(this, new.target.prototype);
       }
     };
+    FetchproxyHelloRejectedError = class extends Error {
+      mcpId;
+      reason;
+      constructor(info) {
+        super(`fetchproxy: the extension refused the connection for "${info.mcpId}": ${info.reason}. This is the extension's own reason \u2014 it is not a timeout, and retrying unchanged will be refused the same way.`);
+        this.name = "FetchproxyHelloRejectedError";
+        this.mcpId = info.mcpId;
+        this.reason = info.reason;
+        Object.setPrototypeOf(this, new.target.prototype);
+      }
+    };
   }
 });
 
 // node_modules/@fetchproxy/server/dist/identity.js
 import { readFile, writeFile, mkdir, chmod } from "node:fs/promises";
-import { join as join2 } from "node:path";
+import { isAbsolute, join as join2 } from "node:path";
 import { homedir } from "node:os";
+function envIdentityDir() {
+  const raw = process.env.FETCHPROXY_IDENTITY_DIR;
+  if (raw === void 0)
+    return void 0;
+  const dir = raw.trim();
+  if (dir === "" || !isAbsolute(dir))
+    return void 0;
+  return dir;
+}
 function defaultIdentityDir() {
-  return join2(homedir(), ".fetchproxy", "identity");
+  return envIdentityDir() ?? join2(homedir(), ".fetchproxy", "identity");
 }
 function safeIdentityFileBase(serverName) {
   if (!serverName || serverName === ".." || serverName.includes("..") || !SAFE_PLAIN.test(serverName) && !SAFE_SCOPED.test(serverName)) {
@@ -12412,42 +12472,57 @@ function safeIdentityFileBase(serverName) {
   }
   return serverName.replace(/\//g, "_");
 }
-async function loadOrCreateIdentity(serverName, dir = defaultIdentityDir()) {
-  const safeFile = safeIdentityFileBase(serverName);
-  const path = join2(dir, `${safeFile}.json`);
-  await mkdir(dir, { recursive: true, mode: 448 });
-  try {
-    const raw = await readFile(path, "utf8");
-    const j2 = JSON.parse(raw);
-    return {
-      x25519Priv: fromB64(j2.x25519Priv),
-      x25519Pub: fromB64(j2.x25519Pub),
-      ed25519Priv: fromB64(j2.ed25519Priv),
-      ed25519Pub: fromB64(j2.ed25519Pub),
-      createdAt: j2.createdAt
-    };
-  } catch (e) {
-    if (e.code !== "ENOENT")
-      throw e;
-  }
+function identityFilePath(dir, serverName) {
+  return join2(dir, `${safeIdentityFileBase(serverName)}.json`);
+}
+async function generateIdentity() {
   const x = await generateX25519();
   const ed = await generateEd25519();
-  const id = {
+  return {
     x25519Priv: x.privateKey,
     x25519Pub: x.publicKey,
     ed25519Priv: ed.privateKey,
     ed25519Pub: ed.publicKey,
     createdAt: Date.now()
   };
-  const j = {
+}
+function serializeIdentity(id) {
+  return JSON.stringify({
     x25519Priv: toB64(id.x25519Priv),
     x25519Pub: toB64(id.x25519Pub),
     ed25519Priv: toB64(id.ed25519Priv),
     ed25519Pub: toB64(id.ed25519Pub),
     createdAt: id.createdAt
+  }, null, 2);
+}
+function parseIdentity(text) {
+  const j = JSON.parse(text);
+  return {
+    x25519Priv: fromB64(j.x25519Priv),
+    x25519Pub: fromB64(j.x25519Pub),
+    ed25519Priv: fromB64(j.ed25519Priv),
+    ed25519Pub: fromB64(j.ed25519Pub),
+    createdAt: j.createdAt
   };
-  await writeFile(path, JSON.stringify(j, null, 2), { mode: 384 });
+}
+async function writeIdentityFile(dir, serverName, id) {
+  const path = identityFilePath(dir, serverName);
+  await mkdir(dir, { recursive: true, mode: 448 });
+  await writeFile(path, serializeIdentity(id), { mode: 384 });
   await chmod(path, 384);
+  return path;
+}
+async function loadOrCreateIdentity(serverName, dir = defaultIdentityDir()) {
+  const path = identityFilePath(dir, serverName);
+  await mkdir(dir, { recursive: true, mode: 448 });
+  try {
+    return parseIdentity(await readFile(path, "utf8"));
+  } catch (e) {
+    if (e.code !== "ENOENT")
+      throw e;
+  }
+  const id = await generateIdentity();
+  await writeIdentityFile(dir, serverName, id);
   return id;
 }
 var SAFE_PLAIN, SAFE_SCOPED;
@@ -12565,6 +12640,9 @@ async function startHost(opts) {
     }
   });
   const ownHello = await buildServerHello({
+    // 2.6.0: tell the extension it can say WHY it refused a hello, instead of
+    // leaving us to time out and guess.
+    accepts: ["hello-rejected"],
     identity: opts.ownIdentity,
     mcpId: opts.ownMcpId,
     serverName: opts.ownServerName,
@@ -12776,6 +12854,16 @@ async function startHost(opts) {
               extensionWs.send(JSON.stringify(frame));
           }
         }
+        if (frame.type === "hello-rejected" && identified === "extension") {
+          if (frame.mcpId === opts.ownMcpId) {
+            rejectOwnSession(new FetchproxyHelloRejectedError({ mcpId: frame.mcpId, reason: frame.reason }));
+          } else {
+            const slot = peers.get(frame.mcpId);
+            if (slot?.helloFrame.accepts?.includes("hello-rejected")) {
+              slot.ws.send(JSON.stringify(frame));
+            }
+          }
+        }
         if (frame.type === "pair-pending" && identified === "extension") {
           if (frame.mcpId === opts.ownMcpId) {
             ownPendingPairCode = frame.pairCode;
@@ -12805,8 +12893,18 @@ async function startHost(opts) {
           rejectOwnSession(new Error("extension disconnected before ready"));
         }
         ownSession = null;
+        ownPendingPairCode = null;
         resetSessionPromise();
         disconnectListeners.forEach((cb) => cb());
+        const notice = JSON.stringify({ type: "extension-disconnected" });
+        for (const slot of peers.values()) {
+          if (slot.helloFrame.accepts?.includes("extension-disconnected")) {
+            try {
+              slot.ws.send(notice);
+            } catch {
+            }
+          }
+        }
       }
       if (identified === "peer" && peerMcpId) {
         if (peers.get(peerMcpId)?.ws === ws)
@@ -12845,7 +12943,9 @@ async function startHost(opts) {
     onPendingPair: (cb) => {
       pendingPairListeners.push(cb);
     },
-    pendingPairCode: () => ownPendingPairCode
+    pendingPairCode: () => ownPendingPairCode,
+    extensionConnected: () => extensionWs !== null,
+    sessionLinked: () => ownSession !== null
   };
 }
 var PUBLIC_ORIGIN_RE, enc2;
@@ -12884,7 +12984,11 @@ async function startPeer(opts) {
     domSelectors: opts.domSelectors,
     localStoragePointers: opts.localStoragePointers,
     sessionStoragePointers: opts.sessionStoragePointers,
-    graphqlOps: opts.graphqlOps
+    graphqlOps: opts.graphqlOps,
+    // 2.5.0: let a host ≥2.5.0 tell us when the extension leaves, so
+    // `extensionConnected()` / `sessionLinked()` can go back to false.
+    // 2.6.0: `hello-rejected` for the same reason, from the extension.
+    accepts: ["extension-disconnected", "hello-rejected"]
   });
   const sessionNonce = fromB64(hello.sessionNonce);
   ws.send(JSON.stringify(hello));
@@ -12901,6 +13005,7 @@ async function startPeer(opts) {
     rejectFirstReady = reject;
   });
   let extensionHello = null;
+  let extensionGone = false;
   let warnedUnverifiable = false;
   let cachedPin = void 0;
   const authenticateExtension = async (sessionSig, extensionSessionPub) => {
@@ -12971,6 +13076,12 @@ async function startPeer(opts) {
         extensionHello = frame;
         return;
       }
+      if (frame.type === "extension-disconnected") {
+        extensionHello = null;
+        extensionGone = true;
+        pendingPairCode = null;
+        return;
+      }
       if (frame.type === "ready" && frame.mcpId === opts.mcpId) {
         const authorised = await authenticateExtension(frame.sessionSig, frame.extensionSessionPub);
         if (!authorised) {
@@ -12983,6 +13094,7 @@ async function startPeer(opts) {
         const sessionKey = await hkdfSha256(shared, sessionNonce, enc3.encode(HKDF_SESSION_INFO), 32);
         const isRenegotiation = session !== null;
         session = new SessionState(sessionKey);
+        extensionGone = false;
         pendingPairCode = null;
         if (isRenegotiation) {
           renegotiateListeners.forEach((cb) => cb());
@@ -12991,6 +13103,9 @@ async function startPeer(opts) {
         }
         return;
       }
+      if (frame.type === "hello-rejected" && frame.mcpId === opts.mcpId) {
+        rejectFirstReady(new FetchproxyHelloRejectedError({ mcpId: frame.mcpId, reason: frame.reason }));
+      }
       if (frame.type === "pair-pending" && frame.mcpId === opts.mcpId) {
         pendingPairCode = frame.pairCode;
         pendingPairListeners.forEach((cb) => cb(frame.pairCode));
@@ -13050,6 +13165,8 @@ async function startPeer(opts) {
       pendingPairListeners.push(cb);
     },
     pendingPairCode: () => pendingPairCode,
+    extensionConnected: () => extensionHello !== null,
+    sessionLinked: () => session !== null && !extensionGone,
     onClose: (cb) => {
       closeListeners.push(cb);
     },
@@ -13078,7 +13195,7 @@ function classifyFetchError(error61) {
   if (/^tab fetch failed:/.test(error61)) {
     return "tab_fetch_failed";
   }
-  if (/^fetch threw:/.test(error61)) {
+  if (/^(in-page )?fetch threw:/.test(error61)) {
     return "tab_fetch_failed";
   }
   if (/^no tab matching /.test(error61)) {
@@ -13102,6 +13219,10 @@ var init_error_kind = __esm({
 
 // node_modules/@fetchproxy/server/dist/classify-bridge-error.js
 function classifyBridgeError(err) {
+  if (err instanceof FetchproxyHelloRejectedError)
+    return "hello_rejected";
+  if (err instanceof FetchproxySessionNotReadyError)
+    return "session_not_ready";
   if (err instanceof FetchproxyTimeoutError)
     return "timeout";
   if (err instanceof FetchproxyBridgeDownError)
@@ -13115,6 +13236,7 @@ function classifyBridgeError(err) {
 var init_classify_bridge_error = __esm({
   "node_modules/@fetchproxy/server/dist/classify-bridge-error.js"() {
     init_ws_server();
+    init_session_ready();
   }
 });
 
@@ -13143,6 +13265,8 @@ function envWsHost() {
 function protocolErrorFrom(error61) {
   if (SCOPE_REJECTION.test(error61))
     return new FetchproxyScopeError(error61);
+  if (TAB_OPENING_REJECTION.test(error61))
+    return new FetchproxyTabOpeningError(error61);
   if (NO_TAB_REJECTION.test(error61))
     return new FetchproxyNoTabError(error61);
   return new FetchproxyProtocolError(error61);
@@ -13182,7 +13306,7 @@ function assertUrlInDomains(field, url2, domains) {
   const declared = domains.map((d) => JSON.stringify(d)).join(", ");
   throw new Error(`FetchproxyServer: ${field} host "${host}" is outside declared domains [${declared}] \u2014 must be one of them or a subdomain`);
 }
-var FetchproxyProtocolError, FetchproxyHttpError, FetchproxyBridgeDownError, FetchproxyHintedError, FetchproxyScopeError, FetchproxyNoTabError, SCOPE_REJECTION, NO_TAB_REJECTION, FetchproxyTimeoutError, SUBDOMAIN_LABEL_RE, DEFAULT_JSON_OK_STATUSES, FetchproxyServer;
+var FetchproxyProtocolError, FetchproxyHttpError, FetchproxyBridgeDownError, FetchproxyHintedError, FetchproxyScopeError, FetchproxyNoTabError, FetchproxyTabOpeningError, SCOPE_REJECTION, NO_TAB_REJECTION, TAB_OPENING_REJECTION, FetchproxyTimeoutError, SUBDOMAIN_LABEL_RE, DEFAULT_JSON_OK_STATUSES, FetchproxyServer;
 var init_ws_server = __esm({
   "node_modules/@fetchproxy/server/dist/ws-server.js"() {
     init_dist();
@@ -13258,8 +13382,15 @@ var init_ws_server = __esm({
         this.name = "FetchproxyNoTabError";
       }
     };
+    FetchproxyTabOpeningError = class extends FetchproxyHintedError {
+      constructor(originalError) {
+        super(originalError, "the extension is opening that tab now \u2014 retry in a few seconds. You do not need to open one yourself, and this is not a version problem.");
+        this.name = "FetchproxyTabOpeningError";
+      }
+    };
     SCOPE_REJECTION = /not in declared/;
-    NO_TAB_REJECTION = /no tab matching (?!.*content script loaded)/;
+    NO_TAB_REJECTION = /no tab matching (?!.*(content script loaded|one is still opening))/;
+    TAB_OPENING_REJECTION = /no tab matching .*one is still opening/;
     FetchproxyTimeoutError = class extends FetchproxyProtocolError {
       url;
       timeoutMs;
@@ -13277,8 +13408,17 @@ var init_ws_server = __esm({
        * the first attempt.
        */
       retryAttempted;
+      /**
+       * 2.4.2+ (#277): what the CALL asked for, when that is more than the
+       * deadline that actually fired. A per-call `timeoutMs` is forwarded to the
+       * extension but does not raise this server's `fetchTimeoutMs`, so the
+       * shorter deadline wins — and used to report only its own number, a value
+       * the caller never supplied, from an option the message never named.
+       */
+      requestedTimeoutMs;
       constructor(args) {
-        super(`fetchproxy: ${args.url} did not respond within ${args.timeoutMs}ms`);
+        const capped = args.requestedTimeoutMs !== void 0 && args.requestedTimeoutMs > args.timeoutMs;
+        super(`fetchproxy: ${args.url} did not respond within ${args.timeoutMs}ms` + (capped ? ` \u2014 that is this server's fetchTimeoutMs, not the ${args.requestedTimeoutMs}ms this call asked for. A per-call timeoutMs cannot exceed it; raise fetchTimeoutMs on the transport to wait longer.` : ""));
         this.name = "FetchproxyTimeoutError";
         this.url = args.url;
         this.timeoutMs = args.timeoutMs;
@@ -13286,6 +13426,7 @@ var init_ws_server = __esm({
         this.port = args.port ?? 0;
         this.elapsedMs = args.elapsedMs ?? args.timeoutMs;
         this.retryAttempted = args.retryAttempted ?? false;
+        this.requestedTimeoutMs = args.requestedTimeoutMs ?? null;
       }
     };
     SUBDOMAIN_LABEL_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/i;
@@ -13694,6 +13835,7 @@ var init_ws_server = __esm({
           lastFailureReason: this.lastFailureReason,
           consecutiveFailures: this.consecutiveFailures,
           lastExtensionMessageAt: this.lastExtensionMessageAt,
+          session: this.sessionSnapshot(),
           keepAlive: {
             enabled: intervalMs > 0,
             intervalMs,
@@ -13829,9 +13971,9 @@ var init_ws_server = __esm({
       async _fetchOnceWithTimeout(init) {
         const id = this.nextRequestId++;
         const inner = { type: "request", id, op: "fetch", init };
-        const pending = new Promise((resolve) => {
+        const pending = this.guardPending(new Promise((resolve) => {
           this.pending.set(id, resolve);
-        });
+        }));
         await this.sendInnerFrame(inner);
         const timeoutMs = this.opts.fetchTimeoutMs;
         if (timeoutMs === void 0 || timeoutMs <= 0)
@@ -13878,7 +14020,35 @@ var init_ws_server = __esm({
        * already surface for fetch timeouts). `0`/unset opts out (unbounded),
        * matching the fetch path.
        */
-      async _withVerbTimeout(pending, pendingMap, id, url2) {
+      /**
+       * Register a verb's pending promise and keep an early rejection from being
+       * fatal.
+       *
+       * Every verb stores its resolver, then AWAITS `sendInnerFrame` before the
+       * caller attaches a handler — and that send does real work (sealing, a
+       * socket write), so it yields across event-loop turns. Anything that drains
+       * the pending maps inside that window rejects a promise nothing is
+       * listening to yet: a refused pairing (`rejectAllPending(pairingErrorMessage
+       * (code))`), an extension disconnect, a `close()`. Under Node's default
+       * `--unhandled-rejections=throw` that ends the PROCESS, so an MCP that
+       * should have reported "approve pair code NNN-NN" dies instead, and each
+       * respawn mints a fresh code nobody can approve (#329).
+       *
+       * The no-op catch is a listener, not a swallow. `.catch()` derives a NEW
+       * promise and leaves this one's rejection intact, so `_withVerbTimeout` and
+       * the caller still see it — the only thing that changes is that the
+       * rejection is never unhandled.
+       *
+       * This is the same hazard `_withVerbTimeout`'s timer already guards against
+       * from the other side, where it drops the resolver "so a late bridge
+       * response doesn't become an unhandled promise that crashes the host".
+       */
+      guardPending(pending) {
+        pending.catch(() => {
+        });
+        return pending;
+      }
+      async _withVerbTimeout(pending, pendingMap, id, url2, requestedTimeoutMs) {
         const timeoutMs = this.opts.fetchTimeoutMs;
         if (timeoutMs === void 0 || timeoutMs <= 0)
           return pending;
@@ -13896,7 +14066,8 @@ var init_ws_server = __esm({
                   role: this.role,
                   port: this.opts.port,
                   elapsedMs: Date.now() - start,
-                  retryAttempted: false
+                  retryAttempted: false,
+                  ...requestedTimeoutMs !== void 0 ? { requestedTimeoutMs } : {}
                 }));
               }, timeoutMs);
             })
@@ -13956,9 +14127,9 @@ var init_ws_server = __esm({
         if (opts.subdomain !== void 0)
           assertSubdomainLabel(opts.subdomain);
         const baseDomain = this.resolveBaseDomain(opts.domain);
-        const isAbsolute = path.startsWith("http://") || path.startsWith("https://");
+        const isAbsolute2 = path.startsWith("http://") || path.startsWith("https://");
         let host;
-        if (isAbsolute) {
+        if (isAbsolute2) {
           try {
             host = new URL(path).host;
           } catch {
@@ -13967,7 +14138,7 @@ var init_ws_server = __esm({
         } else {
           host = opts.subdomain ? `${opts.subdomain}.${baseDomain}` : baseDomain;
         }
-        const url2 = isAbsolute ? path : `https://${host}${path}`;
+        const url2 = isAbsolute2 ? path : `https://${host}${path}`;
         assertUrlInDomains("request url", url2, this.opts.domains);
         let tabUrl = `https://${host}/`;
         if (opts.viaTab !== void 0) {
@@ -13984,7 +14155,15 @@ var init_ws_server = __esm({
           method,
           tabUrl,
           headers: opts.headers,
-          body: opts.body
+          body: opts.body,
+          // Spread rather than `inPage: opts.inPage`: the wire's validator treats
+          // the key's PRESENCE as the request, and a literal `undefined` would
+          // both serialize away inconsistently and read as "asked for" here.
+          ...opts.inPage === true ? { inPage: true } : {},
+          // Spread for the reason `inPage` is: only a deliberate 'omit' goes on
+          // the wire, so an untouched request serialises byte-identically to
+          // every version before this option existed.
+          ...opts.credentials === "omit" ? { credentials: "omit" } : {}
         };
         const result = await this.fetch(init);
         if (!result.ok) {
@@ -14158,7 +14337,11 @@ var init_ws_server = __esm({
             last_success_at: health.lastSuccessAt,
             last_failure_at: health.lastFailureAt,
             last_failure_reason: health.lastFailureReason,
-            consecutive_failures: health.consecutiveFailures
+            consecutive_failures: health.consecutiveFailures,
+            session_state: health.session.state,
+            pending_pair_code: health.session.pairCode,
+            extension_connected: health.session.extensionConnected,
+            last_extension_message_at: health.lastExtensionMessageAt
           },
           ...error61 ? { error: error61 } : {}
         };
@@ -14208,9 +14391,9 @@ var init_ws_server = __esm({
           const tabUrl = `https://${host}/`;
           inner = { type: "request", id, op: "read_cookies", init: { tabUrl } };
         }
-        const pending = new Promise((resolve) => {
+        const pending = this.guardPending(new Promise((resolve) => {
           this.pendingReadCookies.set(id, resolve);
-        });
+        }));
         await this.sendInnerFrame(inner);
         const result = await this._withVerbTimeout(pending, this.pendingReadCookies, id, `https://${host}`);
         if (!result.ok) {
@@ -14267,9 +14450,9 @@ var init_ws_server = __esm({
             ...cookiePath !== void 0 ? { path: cookiePath } : {}
           }
         };
-        const pending = new Promise((resolve, reject) => {
+        const pending = this.guardPending(new Promise((resolve, reject) => {
           this.pendingWriteCookies.set(id, { resolve, reject });
-        });
+        }));
         await this.sendInnerFrame(inner);
         return this._withVerbTimeout(pending, this.pendingWriteCookies, id, `https://${host}`);
       }
@@ -14330,9 +14513,9 @@ var init_ws_server = __esm({
             ...opts.pointers ? { pointers: { ...opts.pointers } } : {}
           }
         };
-        const pending = new Promise((resolve, reject) => {
+        const pending = this.guardPending(new Promise((resolve, reject) => {
           this.pendingStorage.set(id, { resolve, reject });
-        });
+        }));
         await this.sendInnerFrame(inner);
         return this._withVerbTimeout(pending, this.pendingStorage, id, `https://${host}`);
       }
@@ -14435,11 +14618,19 @@ var init_ws_server = __esm({
             ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
           }
         };
-        const pending = new Promise((resolve, reject) => {
+        const pending = this.guardPending(new Promise((resolve, reject) => {
           this.pendingCapture.set(id, { resolve, reject });
-        });
+        }));
         await this.sendInnerFrame(inner);
-        return this._withVerbTimeout(pending, this.pendingCapture, id, `https://${opts.host}${opts.path ?? "/*"}`);
+        return this._withVerbTimeout(
+          pending,
+          this.pendingCapture,
+          id,
+          `https://${opts.host}${opts.path ?? "/*"}`,
+          // #277: not to extend the deadline — so a timeout can say the deadline,
+          // and not the value asked for here, is what fired.
+          opts.timeoutMs
+        );
       }
       /**
        * Snapshot the redirect target URL of the next request the browser
@@ -14520,11 +14711,19 @@ var init_ws_server = __esm({
             ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
           }
         };
-        const pending = new Promise((resolve, reject) => {
+        const pending = this.guardPending(new Promise((resolve, reject) => {
           this.pendingRedirect.set(id, { resolve, reject });
-        });
+        }));
         await this.sendInnerFrame(inner);
-        return this._withVerbTimeout(pending, this.pendingRedirect, id, `https://${opts.host}${opts.path ?? "/*"}`);
+        return this._withVerbTimeout(
+          pending,
+          this.pendingRedirect,
+          id,
+          `https://${opts.host}${opts.path ?? "/*"}`,
+          // #277: not to extend the deadline — so a timeout can say the deadline,
+          // and not the value asked for here, is what fired.
+          opts.timeoutMs
+        );
       }
       /**
        * Download `url` through the BROWSER's own network stack via
@@ -14602,11 +14801,21 @@ var init_ws_server = __esm({
             ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
           }
         };
-        const pending = new Promise((resolve, reject) => {
+        const pending = this.guardPending(new Promise((resolve, reject) => {
           this.pendingDownload.set(id, { resolve, reject });
-        });
+        }));
         await this.sendInnerFrame(inner);
-        return this._withVerbTimeout(pending, this.pendingDownload, id, opts.url);
+        return this._withVerbTimeout(
+          pending,
+          this.pendingDownload,
+          id,
+          opts.url,
+          // #277, same as the two capture verbs: `download` takes a per-call
+          // timeoutMs too, so it hits the identical cap and needs the identical
+          // explanation. Missing it was the point of #279 — "both verbs" was
+          // counted off the two call sites in view rather than off the type.
+          opts.timeoutMs
+        );
       }
       /**
        * 0.4.0+: read declared IndexedDB keys from the user's signed-in
@@ -14650,9 +14859,9 @@ var init_ws_server = __esm({
             keys: [...opts.keys]
           }
         };
-        const pending = new Promise((resolve, reject) => {
+        const pending = this.guardPending(new Promise((resolve, reject) => {
           this.pendingIdb.set(id, { resolve, reject });
-        });
+        }));
         await this.sendInnerFrame(inner);
         return this._withVerbTimeout(pending, this.pendingIdb, id, origin);
       }
@@ -14690,9 +14899,9 @@ var init_ws_server = __esm({
           op: "read_dom",
           init: { origin, names: [...opts.names] }
         };
-        const pending = new Promise((resolve, reject) => {
+        const pending = this.guardPending(new Promise((resolve, reject) => {
           this.pendingStorage.set(id, { resolve, reject });
-        });
+        }));
         await this.sendInnerFrame(inner);
         return this._withVerbTimeout(pending, this.pendingStorage, id, origin);
       }
@@ -14736,9 +14945,9 @@ var init_ws_server = __esm({
             ...opts.tabUrl !== void 0 ? { tabUrl: opts.tabUrl } : {}
           }
         };
-        const pending = new Promise((resolve, reject) => {
+        const pending = this.guardPending(new Promise((resolve, reject) => {
           this.pendingGraphql.set(id, { resolve, reject });
-        });
+        }));
         await this.sendInnerFrame(inner);
         return this._withVerbTimeout(pending, this.pendingGraphql, id, opts.name);
       }
@@ -14975,6 +15184,25 @@ var init_ws_server = __esm({
           return this.peerHandle.pendingPairCode();
         return null;
       }
+      /**
+       * 2.5.0: the extension link as {@link BridgeSessionState}, read off
+       * whichever handle is live. A pending pair code outranks "extension not
+       * seen" because the code could only have come from the extension — a
+       * peer behind an older host never sees the extension hello but does see
+       * pair-pending frames. Where the extension is KNOWN to be gone (a host's
+       * socket closed, a peer told by a 2.5.0+ host) the handle has already
+       * dropped the code, so the precedence never lies there (#283).
+       */
+      sessionSnapshot() {
+        const handle = this.hostHandle ?? this.peerHandle;
+        const pairCode = this.currentPendingPairCode();
+        if (!handle || this.role === null) {
+          return { state: "not_listening", pairCode, extensionConnected: false };
+        }
+        const extensionConnected = handle.extensionConnected();
+        const state = handle.sessionLinked() ? "linked" : pairCode !== null ? "pair_pending" : !extensionConnected ? "extension_disconnected" : "no_session";
+        return { state, pairCode, extensionConnected };
+      }
       /**
        * 0.5.2+: throw `FetchproxyProtocolError` with the actionable pair-code
        * message if the bridge is waiting on user approval. Used by the verb
@@ -15346,6 +15574,10 @@ function credentialHint(arm, prefix, hostLabel, source) {
       return `No credential resolved. Nothing was available to authenticate with \u2014 sign in and reconnect the connector so ${prefix} receives a token, or set the documented environment variable.`;
     case "credential_rejected":
       return `${hostLabel} rejected the credential from '${source}'. It is present but no longer valid \u2014 most often expired or revoked upstream. Re-authenticate and reconnect; retrying will not fix it.`;
+    case "session_expired":
+      return `The credential from '${source}' is configured, but no session is live \u2014 ${hostLabel} served a sign-in page rather than the data. Sign in again; a cookie-session portal expires these on its own, so this recurs between uses.`;
+    case "verification_pending":
+      return `${hostLabel} is holding the sign-in on a second factor rather than refusing it. Supply the verification code the ACCOUNT HOLDER received \u2014 the credential itself is not the problem, so changing it will not help.`;
     case "timeout":
       return `The credential from '${source}' resolved, but ${hostLabel} did not answer in time. Usually transient \u2014 retry. If it persists, ${hostLabel} is slow or unreachable from here.`;
     case "http":
@@ -15356,12 +15588,102 @@ function credentialHint(arm, prefix, hostLabel, source) {
       return `Unexpected failure \u2014 see error.message.`;
   }
 }
+function credentialHealthcheckDescription(hostLabel) {
+  return `Resolves the credential the way real tools do, then makes one authenticated request to ${hostLabel}. Reports which source supplied the credential, whether ${hostLabel} accepted it, the round-trip time, and a plain-English hint distinguishing 'no credential' from 'credential rejected' from 'a ${hostLabel}-side problem'. Read-only; never returns the credential itself.`;
+}
+async function runCredentialHealthcheck(args) {
+  const { prefix, hostLabel, probePath, resolveCredential, probeFn, classifyThrown, hints } = args;
+  const probeUrl = probePath ? `https://${hostLabel}${probePath.startsWith("/") ? "" : "/"}${probePath}` : void 0;
+  let probeStarted = 0;
+  let state;
+  try {
+    state = await resolveCredential();
+  } catch (e) {
+    const classified = classifyThrown?.(e);
+    const result2 = {
+      ok: false,
+      // Still false, and still no source: a classification explains WHY
+      // nothing resolved, it does not invent a credential that did.
+      credential: { source: null, resolved: false },
+      // No `url`: nothing was probed, and naming one implies it was tried.
+      probe: { elapsed_ms: 0 },
+      error: {
+        kind: classified?.kind ?? "no_credential",
+        message: truncateErrorMessage(messageOf(e)),
+        ...classified?.detail !== void 0 ? { detail: classified.detail } : {}
+      },
+      // The hint must follow the KIND beside it. Falling back to
+      // `no_credential`'s copy under a classified kind would state a cause
+      // the kind contradicts — the same disagreement this path exists to
+      // remove. So: an inline hint wins; else the classified arm's own
+      // copy (consumer override first); else, for a kind this module has
+      // no copy for, the neutral `unknown` text rather than one that
+      // asserts a cause; else the unclassified `no_credential` default.
+      hint: classified?.hint ?? (isArm(classified?.kind) ? hints?.[classified.kind] ?? credentialHint(classified.kind, prefix, hostLabel, null) : classified !== void 0 ? credentialHint("unknown", prefix, hostLabel, null) : hints?.no_credential ?? credentialHint("no_credential", prefix, hostLabel, null))
+    };
+    return { content: [{ type: "text", text: JSON.stringify(result2, null, 2) }] };
+  }
+  const credential = {
+    source: state.source,
+    resolved: state.source !== null,
+    ...state.detail !== void 0 ? { detail: state.detail } : {}
+  };
+  if (!credential.resolved) {
+    const result2 = {
+      ok: false,
+      credential,
+      probe: { elapsed_ms: 0 },
+      error: { kind: "no_credential", message: "no credential source resolved" },
+      hint: hints?.no_credential ?? credentialHint("no_credential", prefix, hostLabel, null)
+    };
+    return { content: [{ type: "text", text: JSON.stringify(result2, null, 2) }] };
+  }
+  let arm = "ok";
+  let error61;
+  let status;
+  let customHint;
+  probeStarted = Date.now();
+  try {
+    await probeFn();
+  } catch (e) {
+    status = statusOf(e);
+    const aborted2 = e instanceof Error && e.name === "AbortError";
+    arm = status === 401 || status === 403 ? "credential_rejected" : status !== void 0 ? "http" : aborted2 || /timeout|timed out|ETIMEDOUT/i.test(messageOf(e)) ? "timeout" : /fetch failed|ENOTFOUND|ECONNREFUSED|ECONNRESET|network/i.test(messageOf(e)) ? "transport" : "unknown";
+    let kind = arm;
+    let detail;
+    const custom2 = classifyThrown?.(e);
+    if (custom2) {
+      kind = custom2.kind;
+      customHint = custom2.hint;
+      detail = custom2.detail;
+      arm = isArm(kind) ? kind : "unknown";
+    }
+    error61 = {
+      kind,
+      // Redacted AND bounded before it reaches the result: an upstream
+      // failure routinely quotes what it was sent, and a healthcheck is
+      // the tool people paste into a chat when something is broken.
+      message: truncateErrorMessage(messageOf(e)),
+      ...detail !== void 0 ? { detail } : {}
+    };
+  }
+  const result = {
+    ok: error61 === void 0,
+    credential,
+    probe: {
+      ...probeUrl ? { url: probeUrl } : {},
+      elapsed_ms: Date.now() - probeStarted,
+      ...status !== void 0 ? { status } : {}
+    },
+    ...error61 ? { error: error61 } : {},
+    hint: customHint ?? hints?.[arm] ?? credentialHint(arm, prefix, hostLabel, state.source)
+  };
+  return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+}
 function registerCredentialHealthcheckTool(args) {
-  const { server, prefix, hostLabel, probePath, resolveCredential, probeFn, classifyThrown, hints } = args;
-  const probeUrl = probePath ? `https://${hostLabel}${probePath}` : void 0;
-  server.registerTool(`${prefix}_healthcheck`, {
+  args.server.registerTool(`${args.prefix}_healthcheck`, {
     title: "Verify credentials and upstream reachability",
-    description: `Resolves the credential the way real tools do, then makes one authenticated request to ${hostLabel}. Reports which source supplied the credential, whether ${hostLabel} accepted it, the round-trip time, and a plain-English hint distinguishing 'no credential' from 'credential rejected' from 'a ${hostLabel}-side problem'. Call this when a real tool fails and you want to know which hop broke. Read-only; never returns the credential itself.`,
+    description: `${credentialHealthcheckDescription(args.hostLabel)} Call this when a real tool fails and you want to know which hop broke.`,
     annotations: {
       title: "Verify credentials and upstream reachability",
       readOnlyHint: true,
@@ -15369,92 +15691,7 @@ function registerCredentialHealthcheckTool(args) {
       openWorldHint: true
     },
     inputSchema: {}
-  }, async () => {
-    let probeStarted = 0;
-    let state;
-    try {
-      state = await resolveCredential();
-    } catch (e) {
-      const classified = classifyThrown?.(e);
-      const result2 = {
-        ok: false,
-        // Still false, and still no source: a classification explains WHY
-        // nothing resolved, it does not invent a credential that did.
-        credential: { source: null, resolved: false },
-        // No `url`: nothing was probed, and naming one implies it was tried.
-        probe: { elapsed_ms: 0 },
-        error: {
-          kind: classified?.kind ?? "no_credential",
-          message: truncateErrorMessage(messageOf(e)),
-          ...classified?.detail !== void 0 ? { detail: classified.detail } : {}
-        },
-        // The hint must follow the KIND beside it. Falling back to
-        // `no_credential`'s copy under a classified kind would state a cause
-        // the kind contradicts — the same disagreement this path exists to
-        // remove. So: an inline hint wins; else the classified arm's own
-        // copy (consumer override first); else, for a kind this module has
-        // no copy for, the neutral `unknown` text rather than one that
-        // asserts a cause; else the unclassified `no_credential` default.
-        hint: classified?.hint ?? (isArm(classified?.kind) ? hints?.[classified.kind] ?? credentialHint(classified.kind, prefix, hostLabel, null) : classified !== void 0 ? credentialHint("unknown", prefix, hostLabel, null) : hints?.no_credential ?? credentialHint("no_credential", prefix, hostLabel, null))
-      };
-      return { content: [{ type: "text", text: JSON.stringify(result2, null, 2) }] };
-    }
-    const credential = {
-      source: state.source,
-      resolved: state.source !== null,
-      ...state.detail !== void 0 ? { detail: state.detail } : {}
-    };
-    if (!credential.resolved) {
-      const result2 = {
-        ok: false,
-        credential,
-        probe: { elapsed_ms: 0 },
-        error: { kind: "no_credential", message: "no credential source resolved" },
-        hint: hints?.no_credential ?? credentialHint("no_credential", prefix, hostLabel, null)
-      };
-      return { content: [{ type: "text", text: JSON.stringify(result2, null, 2) }] };
-    }
-    let arm = "ok";
-    let error61;
-    let status;
-    let customHint;
-    probeStarted = Date.now();
-    try {
-      await probeFn();
-    } catch (e) {
-      status = statusOf(e);
-      const aborted2 = e instanceof Error && e.name === "AbortError";
-      arm = status === 401 || status === 403 ? "credential_rejected" : status !== void 0 ? "http" : aborted2 || /timeout|timed out|ETIMEDOUT/i.test(messageOf(e)) ? "timeout" : /fetch failed|ENOTFOUND|ECONNREFUSED|ECONNRESET|network/i.test(messageOf(e)) ? "transport" : "unknown";
-      let kind = arm;
-      let detail;
-      const custom2 = classifyThrown?.(e);
-      if (custom2) {
-        kind = custom2.kind;
-        customHint = custom2.hint;
-        detail = custom2.detail;
-      }
-      error61 = {
-        kind,
-        // Redacted AND bounded before it reaches the result: an upstream
-        // failure routinely quotes what it was sent, and a healthcheck is
-        // the tool people paste into a chat when something is broken.
-        message: truncateErrorMessage(messageOf(e)),
-        ...detail !== void 0 ? { detail } : {}
-      };
-    }
-    const result = {
-      ok: error61 === void 0,
-      credential,
-      probe: {
-        ...probeUrl ? { url: probeUrl } : {},
-        elapsed_ms: Date.now() - probeStarted,
-        ...status !== void 0 ? { status } : {}
-      },
-      ...error61 ? { error: error61 } : {},
-      hint: customHint ?? hints?.[arm] ?? credentialHint(arm, prefix, hostLabel, state.source)
-    };
-    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
-  });
+  }, async () => runCredentialHealthcheck(args));
 }
 var CREDENTIAL_ARMS;
 var init_healthcheck = __esm({
@@ -15464,6 +15701,8 @@ var init_healthcheck = __esm({
       "ok",
       "no_credential",
       "credential_rejected",
+      "session_expired",
+      "verification_pending",
       "timeout",
       "http",
       "transport",
@@ -15485,6 +15724,7 @@ __export(fetchproxy_exports, {
   TokenBucket: () => TokenBucket,
   backoffDelayMs: () => backoffDelayMs,
   bridgeErrorInfo: () => bridgeErrorInfo,
+  bridgeHealthcheckDescription: () => bridgeHealthcheckDescription,
   chunk: () => chunk,
   classifyBotWall: () => classifyBotWall,
   classifyBridgeError: () => classifyBridgeError,
@@ -15497,9 +15737,11 @@ __export(fetchproxy_exports, {
   extractImgTags: () => extractImgTags,
   lastPathSegment: () => lastPathSegment,
   mapWithConcurrency: () => mapWithConcurrency,
+  registerAdaptiveHealthcheckTool: () => registerAdaptiveHealthcheckTool,
   registerBridgeHealthcheckTool: () => registerBridgeHealthcheckTool,
   registerCredentialHealthcheckTool: () => registerCredentialHealthcheckTool,
   retryOnceOnTimeout: () => retryOnceOnTimeout,
+  runBridgeHealthcheck: () => runBridgeHealthcheck,
   sleep: () => sleep,
   withDeadline: () => withDeadline
 });
@@ -15535,9 +15777,9 @@ function createFetchproxyTransport(opts) {
     async start() {
       await server.listen();
       if (logListening) {
-        console.error(`[${serverOpts.serverName}:bridge] listening on 127.0.0.1:${server.bridgeHealth().port} (role=${server.role ?? "unknown"}, version=${serverOpts.version})`);
+        console.error(`[${serverOpts.serverName}:bridge] ready \u2014 127.0.0.1:${server.bridgeHealth().port} binds on the first request (version=${serverOpts.version})`);
       } else if (debug) {
-        console.error(`[${serverOpts.serverName}:bridge] listening (role=${server.role ?? "unknown"}, version=${serverOpts.version})`);
+        console.error(`[${serverOpts.serverName}:bridge] ready \u2014 binds on the first request (version=${serverOpts.version})`);
       }
     },
     async close() {
@@ -15716,13 +15958,122 @@ function projectBridgeStatus(health) {
     } : {}
   };
 }
-function registerBridgeHealthcheckTool(args) {
-  const { server, prefix, probePath, hostLabel, probeFn, classifyThrown, hints, path } = args;
-  const probeUrl = `https://${hostLabel}${probePath}`;
+function probeDisplayUrl(hostLabel, probePath) {
+  return `https://${hostLabel}${probePath.startsWith("/") ? "" : "/"}${probePath}`;
+}
+function bridgeHealthcheckDescription(hostLabel, probePath) {
+  return `Round-trips a small public ${hostLabel} URL (${probePath}) through the fetchproxy bridge and returns diagnostics: the bridge's role (host/peer/null), port, version, the extension link (linked / pair pending / not attached / never answered), the elapsed round-trip time, and a plain-English hint distinguishing 'bridge never came up' from 'extension not connected' from 'real ${hostLabel}-side problem'. Read-only, no auth required.`;
+}
+async function runBridgeHealthcheck(args) {
+  const { prefix, probePath, hostLabel, probeFn, classifyThrown, hints, path } = args;
+  const probeUrl = probeDisplayUrl(hostLabel, probePath);
   const resolveTransport = () => typeof args.transport === "function" ? args.transport() : args.transport;
-  server.registerTool(`${prefix}_healthcheck`, {
+  let probeBody = "";
+  let thrown;
+  const wrappedProbe = async (p) => {
+    try {
+      probeBody = await probeFn(p);
+      return probeBody;
+    } catch (e) {
+      thrown = e;
+      throw e;
+    }
+  };
+  let ok;
+  let elapsedMs;
+  let bridge;
+  let rawError;
+  let pathNow;
+  if (path) {
+    const start = Date.now();
+    try {
+      await wrappedProbe(probePath);
+      ok = true;
+    } catch (e) {
+      ok = false;
+      rawError = { kind: classifyBridgeError(e), message: truncateErrorMessage(messageOf(e)) };
+    }
+    elapsedMs = Date.now() - start;
+    pathNow = path();
+    const transport2 = resolveTransport();
+    bridge = transport2 ? projectBridgeStatus(transport2.status()) : void 0;
+  } else {
+    const transport2 = resolveTransport();
+    if (!transport2) {
+      throw new Error("bridge healthcheck: transport() returned nothing and no `path` was supplied \u2014 a bridge-only healthcheck needs its bridge.");
+    }
+    const probeResult = await transport2.runProbe(wrappedProbe, probePath);
+    ok = probeResult.ok;
+    elapsedMs = probeResult.elapsed_ms;
+    bridge = {
+      ...probeResult.bridge,
+      last_extension_message_at: transport2.status().lastExtensionMessageAt
+    };
+    rawError = probeResult.error;
+  }
+  const probe = ok ? { url: probeUrl, elapsed_ms: elapsedMs, status: 200, body_length: probeBody.length } : { url: probeUrl, elapsed_ms: elapsedMs };
+  let error61;
+  let bridgeHint;
+  let customHint;
+  let customDetail;
+  if (rawError) {
+    let kind = rawError.kind === "other" ? "unknown" : rawError.kind;
+    if (thrown instanceof FetchproxySessionNotReadyError) {
+      kind = "session_not_ready";
+      bridgeHint = thrown.hint;
+    } else if (thrown instanceof FetchproxyBridgeDownError) {
+      bridgeHint = thrown.hint;
+    }
+    if (thrown !== void 0 && classifyThrown) {
+      const custom2 = classifyThrown(thrown);
+      if (custom2) {
+        kind = custom2.kind;
+        customHint = custom2.hint;
+        customDetail = custom2.detail;
+      }
+    }
+    error61 = {
+      kind,
+      message: rawError.message,
+      ...bridgeHint !== void 0 ? { bridge_hint: bridgeHint } : {},
+      ...customDetail !== void 0 ? { detail: customDetail } : {}
+    };
+  }
+  const direct = pathNow ? pathNow.transport === "direct" : bridge === void 0;
+  const arm = ok ? "ok" : error61?.kind === "session_not_ready" ? "session_not_ready" : error61?.kind === "bridge_down" ? "bridge_down" : direct ? "direct" : bridge === void 0 || bridge.role === null ? "no_role" : error61?.kind === "timeout" ? "timeout" : error61?.kind === "protocol" || error61?.kind === "http" ? "protocol" : "unknown";
+  const defaultHint = healthcheckHint({
+    ok,
+    role: bridge?.role ?? null,
+    // The real configured port from bridgeHealth(), never a literal 37149.
+    port: bridge?.port ?? null,
+    hostLabel,
+    prefix,
+    probePath,
+    errorKind: error61?.kind,
+    bridgeHint: error61?.kind === "bridge_down" ? bridgeHint : void 0,
+    session: {
+      ...bridge?.session_state !== void 0 ? { state: bridge.session_state } : {},
+      pairCode: bridge?.pending_pair_code ?? (thrown instanceof FetchproxySessionNotReadyError ? thrown.pairCode : null)
+    },
+    direct
+  });
+  const result = {
+    ok,
+    ...bridge ? { bridge } : {},
+    ...pathNow ? { transport: pathNow } : {},
+    probe,
+    ...error61 ? { error: error61 } : {},
+    // Precedence: classifyThrown's hint > per-arm override > default ladder.
+    hint: customHint ?? hints?.[arm] ?? defaultHint
+  };
+  return {
+    content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+  };
+}
+function registerBridgeHealthcheckTool(args) {
+  args.server.registerTool(`${args.prefix}_healthcheck`, {
     title: "Verify the fetchproxy bridge end-to-end",
-    description: `Round-trips a small public ${hostLabel} URL (${probePath}) through the fetchproxy bridge and returns diagnostics: the bridge's role (host/peer/null), port, version, the extension link (linked / pair pending / not attached / never answered), the elapsed round-trip time, and a plain-English hint distinguishing 'bridge never came up' from 'extension not connected' from 'real ${hostLabel}-side problem'. Call this when a real tool fails and you want to know which hop broke. Read-only, no auth required.`,
+    description: `${bridgeHealthcheckDescription(args.hostLabel, args.probePath)} Call this when a real tool fails and you want to know which hop broke.`,
     annotations: {
       title: "Verify the fetchproxy bridge end-to-end",
       readOnlyHint: true,
@@ -15730,109 +16081,21 @@ function registerBridgeHealthcheckTool(args) {
       openWorldHint: true
     },
     inputSchema: {}
-  }, async () => {
-    let probeBody = "";
-    let thrown;
-    const wrappedProbe = async (p) => {
-      try {
-        probeBody = await probeFn(p);
-        return probeBody;
-      } catch (e) {
-        thrown = e;
-        throw e;
-      }
-    };
-    let ok;
-    let elapsedMs;
-    let bridge;
-    let rawError;
-    let pathNow;
-    if (path) {
-      const start = Date.now();
-      try {
-        await wrappedProbe(probePath);
-        ok = true;
-      } catch (e) {
-        ok = false;
-        rawError = { kind: classifyBridgeError(e), message: truncateErrorMessage(messageOf(e)) };
-      }
-      elapsedMs = Date.now() - start;
-      pathNow = path();
-      const transport2 = resolveTransport();
-      bridge = transport2 ? projectBridgeStatus(transport2.status()) : void 0;
-    } else {
-      const transport2 = resolveTransport();
-      if (!transport2) {
-        throw new Error("registerBridgeHealthcheckTool: transport() returned nothing and no `path` was supplied \u2014 a bridge-only healthcheck needs its bridge.");
-      }
-      const probeResult = await transport2.runProbe(wrappedProbe, probePath);
-      ok = probeResult.ok;
-      elapsedMs = probeResult.elapsed_ms;
-      bridge = {
-        ...probeResult.bridge,
-        last_extension_message_at: transport2.status().lastExtensionMessageAt
-      };
-      rawError = probeResult.error;
-    }
-    const probe = ok ? { url: probeUrl, elapsed_ms: elapsedMs, status: 200, body_length: probeBody.length } : { url: probeUrl, elapsed_ms: elapsedMs };
-    let error61;
-    let bridgeHint;
-    let customHint;
-    let customDetail;
-    if (rawError) {
-      let kind = rawError.kind === "other" ? "unknown" : rawError.kind;
-      if (thrown instanceof FetchproxySessionNotReadyError) {
-        kind = "session_not_ready";
-        bridgeHint = thrown.hint;
-      } else if (thrown instanceof FetchproxyBridgeDownError) {
-        bridgeHint = thrown.hint;
-      }
-      if (thrown !== void 0 && classifyThrown) {
-        const custom2 = classifyThrown(thrown);
-        if (custom2) {
-          kind = custom2.kind;
-          customHint = custom2.hint;
-          customDetail = custom2.detail;
-        }
-      }
-      error61 = {
-        kind,
-        message: rawError.message,
-        ...bridgeHint !== void 0 ? { bridge_hint: bridgeHint } : {},
-        ...customDetail !== void 0 ? { detail: customDetail } : {}
-      };
-    }
-    const direct = pathNow ? pathNow.transport === "direct" : bridge === void 0;
-    const arm = ok ? "ok" : error61?.kind === "session_not_ready" ? "session_not_ready" : error61?.kind === "bridge_down" ? "bridge_down" : direct ? "direct" : bridge === void 0 || bridge.role === null ? "no_role" : error61?.kind === "timeout" ? "timeout" : error61?.kind === "protocol" || error61?.kind === "http" ? "protocol" : "unknown";
-    const defaultHint = healthcheckHint({
-      ok,
-      role: bridge?.role ?? null,
-      // The real configured port from bridgeHealth(), never a literal 37149.
-      port: bridge?.port ?? null,
-      hostLabel,
-      prefix,
-      probePath,
-      errorKind: error61?.kind,
-      bridgeHint: error61?.kind === "bridge_down" ? bridgeHint : void 0,
-      session: {
-        ...bridge?.session_state !== void 0 ? { state: bridge.session_state } : {},
-        pairCode: bridge?.pending_pair_code ?? (thrown instanceof FetchproxySessionNotReadyError ? thrown.pairCode : null)
-      },
-      direct
-    });
-    const result = {
-      ok,
-      ...bridge ? { bridge } : {},
-      ...pathNow ? { transport: pathNow } : {},
-      probe,
-      ...error61 ? { error: error61 } : {},
-      // Precedence: classifyThrown's hint > per-arm override > default ladder.
-      hint: customHint ?? hints?.[arm] ?? defaultHint
-    };
-    return {
-      content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
-    };
-  });
+  }, async () => runBridgeHealthcheck(args));
+}
+function registerAdaptiveHealthcheckTool(args) {
+  const { server, prefix, hostLabel, usingBridge, bridge, credential } = args;
+  server.registerTool(`${prefix}_healthcheck`, {
+    title: "Verify this server can reach its upstream",
+    description: `Reports which hop is broken when a real tool fails, for whichever path this server is actually using. Relaying through your signed-in browser tab: ${bridgeHealthcheckDescription(hostLabel, bridge.probePath)} Signing in server-side with configured credentials: ${credentialHealthcheckDescription(hostLabel)}`,
+    annotations: {
+      title: "Verify this server can reach its upstream",
+      readOnlyHint: true,
+      idempotentHint: true,
+      openWorldHint: true
+    },
+    inputSchema: {}
+  }, async () => usingBridge() ? runBridgeHealthcheck({ server, prefix, hostLabel, ...bridge }) : runCredentialHealthcheck({ server, prefix, hostLabel, ...credential }));
 }
 var PLACEHOLDER_RE2;
 var init_fetchproxy = __esm({
@@ -15841,6 +16104,7 @@ var init_fetchproxy = __esm({
     init_errors();
     init_dist2();
     init_healthcheck();
+    init_healthcheck();
     PLACEHOLDER_RE2 = /^\$\{[^}]*\}$/;
   }
 });
@@ -44754,7 +45018,7 @@ var pageSchema = {
 init_errors();
 
 // src/version.ts
-var VERSION = "0.3.0";
+var VERSION = "0.3.1";
 
 // src/client.ts
 import { dirname, join } from "path";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = '0.3.0'; // x-release-please-version
+export const VERSION = '0.3.1'; // x-release-please-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrischall/eventbrite-mcp",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "mcpName": "io.github.chrischall/eventbrite-mcp",
   "description": "Eventbrite MCP server for Claude — developed and maintained by AI (Claude Code)",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -45,18 +45,18 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^0.23.2",
-    "@fetchproxy/server": "^2.2.0",
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@chrischall/mcp-utils": "^0.26.1",
+    "@fetchproxy/server": "^2.10.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "dotenv": "^17.4.0",
-    "zod": "^4.4.2"
+    "zod": "^4.5.4"
   },
   "devDependencies": {
     "@types/node": "^26.0.0",
-    "@vitest/coverage-v8": "^4.1.2",
+    "@vitest/coverage-v8": "^5.0.0",
     "esbuild": "^0.28.0",
     "typescript": "^7.0.2",
-    "vitest": "^4.1.2"
+    "vitest": "^5.0.0"
   },
   "allowScripts": {
     "esbuild@0.28.1": true

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/eventbrite-mcp",
     "source": "github"
   },
-  "version": "0.3.0",
+  "version": "0.3.1",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@chrischall/eventbrite-mcp",
-      "version": "0.3.0",
+      "version": "0.3.1",
       "transport": {
         "type": "stdio"
       },