@chrischall/eventbrite-mcp 0.3.1 → 0.3.2

package/dist/bundle.js

@@ -7287,19 +7287,207 @@ var init_errors = __esm({
   }
 });
 
+// node_modules/@fetchproxy/protocol/dist/crypto.js
+async function exportRaw(key, format) {
+  const buf = await subtle.exportKey(format, key);
+  return new Uint8Array(buf);
+}
+async function generateX25519() {
+  const kp = await subtle.generateKey({ name: "X25519" }, true, [
+    "deriveBits"
+  ]);
+  const priv = await exportRaw(kp.privateKey, "pkcs8");
+  const pub = await exportRaw(kp.publicKey, "raw");
+  return { privateKey: priv.slice(-32), publicKey: pub };
+}
+async function generateEd25519() {
+  const kp = await subtle.generateKey({ name: "Ed25519" }, true, [
+    "sign",
+    "verify"
+  ]);
+  const priv = await exportRaw(kp.privateKey, "pkcs8");
+  const pub = await exportRaw(kp.publicKey, "raw");
+  return { privateKey: priv.slice(-32), publicKey: pub };
+}
+async function importX25519Priv(raw) {
+  const prefix = new Uint8Array([
+    48,
+    46,
+    2,
+    1,
+    0,
+    48,
+    5,
+    6,
+    3,
+    43,
+    101,
+    110,
+    4,
+    34,
+    4,
+    32
+  ]);
+  const pkcs8 = new Uint8Array(prefix.length + raw.length);
+  pkcs8.set(prefix, 0);
+  pkcs8.set(raw, prefix.length);
+  return subtle.importKey("pkcs8", pkcs8, { name: "X25519" }, false, [
+    "deriveBits"
+  ]);
+}
+async function importX25519Pub(raw) {
+  return subtle.importKey("raw", raw, { name: "X25519" }, false, []);
+}
+async function importEd25519Priv(raw) {
+  const prefix = new Uint8Array([
+    48,
+    46,
+    2,
+    1,
+    0,
+    48,
+    5,
+    6,
+    3,
+    43,
+    101,
+    112,
+    4,
+    34,
+    4,
+    32
+  ]);
+  const pkcs8 = new Uint8Array(prefix.length + raw.length);
+  pkcs8.set(prefix, 0);
+  pkcs8.set(raw, prefix.length);
+  return subtle.importKey("pkcs8", pkcs8, { name: "Ed25519" }, false, ["sign"]);
+}
+async function importEd25519Pub(raw) {
+  return subtle.importKey("raw", raw, { name: "Ed25519" }, false, ["verify"]);
+}
+async function ecdhX25519(privRaw, pubRaw) {
+  const priv = await importX25519Priv(privRaw);
+  const pub = await importX25519Pub(pubRaw);
+  const bits = await subtle.deriveBits({ name: "X25519", public: pub }, priv, 256);
+  return new Uint8Array(bits);
+}
+async function ed25519Sign(privRaw, msg) {
+  const priv = await importEd25519Priv(privRaw);
+  const sig = await subtle.sign({ name: "Ed25519" }, priv, msg);
+  return new Uint8Array(sig);
+}
+async function ed25519Verify(pubRaw, msg, sig) {
+  const pub = await importEd25519Pub(pubRaw);
+  return subtle.verify({ name: "Ed25519" }, pub, sig, msg);
+}
+async function hkdfSha256(ikm, salt, info, lenBytes) {
+  const baseKey = await subtle.importKey("raw", ikm, { name: "HKDF" }, false, [
+    "deriveBits"
+  ]);
+  const bits = await subtle.deriveBits({
+    name: "HKDF",
+    hash: "SHA-256",
+    salt,
+    info
+  }, baseKey, lenBytes * 8);
+  return new Uint8Array(bits);
+}
+async function aesGcmSeal(key, iv, plaintext, aad) {
+  const k = await subtle.importKey("raw", key, { name: "AES-GCM" }, false, [
+    "encrypt"
+  ]);
+  const ct = await subtle.encrypt({ name: "AES-GCM", iv, additionalData: aad }, k, plaintext);
+  return new Uint8Array(ct);
+}
+async function aesGcmOpen(key, iv, ciphertext, aad) {
+  const k = await subtle.importKey("raw", key, { name: "AES-GCM" }, false, [
+    "decrypt"
+  ]);
+  const pt = await subtle.decrypt({ name: "AES-GCM", iv, additionalData: aad }, k, ciphertext);
+  return new Uint8Array(pt);
+}
+async function sha256(data) {
+  const h = await subtle.digest("SHA-256", data);
+  return new Uint8Array(h);
+}
+var subtle;
+var init_crypto = __esm({
+  "node_modules/@fetchproxy/protocol/dist/crypto.js"() {
+    subtle = globalThis.crypto.subtle;
+  }
+});
+
+// node_modules/@fetchproxy/protocol/dist/encoding.js
+function toB64(bytes) {
+  let s = "";
+  for (let i = 0; i < bytes.length; i++)
+    s += String.fromCharCode(bytes[i]);
+  return btoa(s);
+}
+function fromB64(s) {
+  const bin = atob(s);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++)
+    out[i] = bin.charCodeAt(i);
+  return out;
+}
+var init_encoding = __esm({
+  "node_modules/@fetchproxy/protocol/dist/encoding.js"() {
+  }
+});
+
 // node_modules/@fetchproxy/protocol/dist/frames.js
-function readySignaturePayload(mcpHelloNonce, extHelloNonce, extensionSessionPub) {
-  const out = new Uint8Array(mcpHelloNonce.length + extHelloNonce.length + extensionSessionPub.length);
+function helloSignaturePayload(mcpId, sessionNonce, sessionPub, answersExtNonce) {
+  const id = enc.encode(mcpId);
+  const out = new Uint8Array(id.length + sessionNonce.length + sessionPub.length + answersExtNonce.length);
+  out.set(id, 0);
+  out.set(sessionNonce, id.length);
+  out.set(sessionPub, id.length + sessionNonce.length);
+  out.set(answersExtNonce, id.length + sessionNonce.length + sessionPub.length);
+  return out;
+}
+function answersNoExtSession(answersExtNonce) {
+  let bytes;
+  try {
+    bytes = fromB64(answersExtNonce);
+  } catch {
+    return false;
+  }
+  if (bytes.length !== ANSWERS_NO_EXT_SESSION.length)
+    return false;
+  for (const b of bytes)
+    if (b !== 0)
+      return false;
+  return true;
+}
+function readySignaturePayload(mcpHelloNonce, extHelloNonce, extensionSessionPub, mcpSessionPub) {
+  const out = new Uint8Array(mcpHelloNonce.length + extHelloNonce.length + extensionSessionPub.length + mcpSessionPub.length);
   out.set(mcpHelloNonce, 0);
   out.set(extHelloNonce, mcpHelloNonce.length);
   out.set(extensionSessionPub, mcpHelloNonce.length + extHelloNonce.length);
+  out.set(mcpSessionPub, mcpHelloNonce.length + extHelloNonce.length + extensionSessionPub.length);
   return out;
 }
-var PROTOCOL_VERSION, HKDF_SESSION_INFO, KNOWN_CAPABILITIES;
+async function transcriptHash(mcpNonce, extNonce, mcpSessionPub, extSessionPub) {
+  const out = new Uint8Array(mcpNonce.length + extNonce.length + mcpSessionPub.length + extSessionPub.length);
+  out.set(mcpNonce, 0);
+  out.set(extNonce, mcpNonce.length);
+  out.set(mcpSessionPub, mcpNonce.length + extNonce.length);
+  out.set(extSessionPub, mcpNonce.length + extNonce.length + mcpSessionPub.length);
+  return sha256(out);
+}
+function frameAad(mcpId, seq, direction) {
+  return enc.encode(`fetchproxy/4/frame\0${mcpId}\0${seq}\0${direction}`);
+}
+var PROTOCOL_VERSION, HKDF_SESSION_INFO, enc, ANSWERS_NO_EXT_SESSION, KNOWN_CAPABILITIES;
 var init_frames = __esm({
   "node_modules/@fetchproxy/protocol/dist/frames.js"() {
-    PROTOCOL_VERSION = 3;
-    HKDF_SESSION_INFO = "fetchproxy/1.0.0/session";
+    init_crypto();
+    init_encoding();
+    PROTOCOL_VERSION = 4;
+    HKDF_SESSION_INFO = "fetchproxy/4.0.0/session";
+    enc = new TextEncoder();
+    ANSWERS_NO_EXT_SESSION = new Uint8Array(32);
     KNOWN_CAPABILITIES = /* @__PURE__ */ new Set([
       "fetch",
       "fetch_in_page",
@@ -7381,6 +7569,143 @@ var init_json_pointer = __esm({
   }
 });
 
+// node_modules/@fetchproxy/protocol/dist/public-suffix.js
+function isPublicSuffix(host) {
+  const normalised = host.trim().toLowerCase().replace(/\.$/, "");
+  if (normalised === "")
+    return false;
+  const labels = normalised.split(".");
+  if (labels.some((l) => l === ""))
+    return false;
+  if (labels.length === 1)
+    return true;
+  if (LISTED_PUBLIC_SUFFIXES.has(normalised))
+    return true;
+  if (labels.length === 2) {
+    const [secondLevel, tld] = labels;
+    if (secondLevel && tld && /^[a-z]{2}$/.test(tld) && CCTLD_ADMIN_LABELS.has(secondLevel)) {
+      return true;
+    }
+  }
+  return false;
+}
+var CCTLD_ADMIN_LABELS, LISTED_PUBLIC_SUFFIXES;
+var init_public_suffix = __esm({
+  "node_modules/@fetchproxy/protocol/dist/public-suffix.js"() {
+    CCTLD_ADMIN_LABELS = /* @__PURE__ */ new Set([
+      "ac",
+      "co",
+      "com",
+      "edu",
+      "gob",
+      "gov",
+      "mil",
+      "net",
+      "nom",
+      "org",
+      "sch"
+    ]);
+    LISTED_PUBLIC_SUFFIXES = /* @__PURE__ */ new Set([
+      // --- ICANN, under ccTLDs, outside CCTLD_ADMIN_LABELS ---
+      "ad.jp",
+      "ed.jp",
+      "gr.jp",
+      "lg.jp",
+      "ne.jp",
+      "or.jp",
+      "go.kr",
+      "ne.kr",
+      "or.kr",
+      "pe.kr",
+      "re.kr",
+      "go.id",
+      "my.id",
+      "or.id",
+      "web.id",
+      "go.th",
+      "in.th",
+      "or.th",
+      "me.uk",
+      "ltd.uk",
+      "plc.uk",
+      "nhs.uk",
+      "mod.uk",
+      "police.uk",
+      "parliament.uk",
+      "asn.au",
+      "id.au",
+      "gen.in",
+      "ind.in",
+      "firm.in",
+      "eu.org",
+      // --- Vendor ("private") suffixes: one entry = every customer's site ---
+      "github.io",
+      "githubusercontent.com",
+      "gitlab.io",
+      "bitbucket.io",
+      "pages.dev",
+      "workers.dev",
+      "r2.dev",
+      "trycloudflare.com",
+      "vercel.app",
+      "now.sh",
+      "netlify.app",
+      "netlify.live",
+      "herokuapp.com",
+      "herokussl.com",
+      "appspot.com",
+      "web.app",
+      "firebaseapp.com",
+      "cloudfunctions.net",
+      "blogspot.com",
+      "azurewebsites.net",
+      "azurestaticapps.net",
+      "azureedge.net",
+      "azurecontainer.io",
+      "cloudapp.azure.com",
+      "trafficmanager.net",
+      "s3.amazonaws.com",
+      "compute.amazonaws.com",
+      "compute-1.amazonaws.com",
+      "elasticbeanstalk.com",
+      "cloudfront.net",
+      "awsapprunner.com",
+      "amplifyapp.com",
+      "fly.dev",
+      "onrender.com",
+      "railway.app",
+      "koyeb.app",
+      "deno.dev",
+      "replit.dev",
+      "repl.co",
+      "glitch.me",
+      "surge.sh",
+      "neocities.org",
+      "pythonanywhere.com",
+      "readthedocs.io",
+      "gitbook.io",
+      "myshopify.com",
+      "wixsite.com",
+      "editorx.io",
+      "webflow.io",
+      "bubbleapps.io",
+      "notion.site",
+      "framer.app",
+      "framer.website",
+      "ngrok.io",
+      "ngrok.app",
+      "ngrok-free.app",
+      "loca.lt",
+      "duckdns.org",
+      "ddns.net",
+      "no-ip.org",
+      "dyndns.org",
+      "hopto.org",
+      "zapto.org"
+    ]);
+  }
+});
+
 // node_modules/@fetchproxy/protocol/dist/validate.js
 function assertObject(x, label) {
   if (typeof x !== "object" || x === null || Array.isArray(x)) {
@@ -7405,6 +7730,18 @@ function assertBase64(x, label) {
   if (!BASE64_RE.test(x))
     throw new ProtocolError(`${label}: invalid base64`);
 }
+function base64ByteLength(s) {
+  if (s.length % 4 !== 0)
+    return null;
+  const pad = s.endsWith("==") ? 2 : s.endsWith("=") ? 1 : 0;
+  return s.length / 4 * 3 - pad;
+}
+function assertBase64Bytes(x, label, bytes) {
+  assertBase64(x, label);
+  if (base64ByteLength(x) !== bytes) {
+    throw new ProtocolError(`${label}: expected base64 of ${bytes} raw bytes`);
+  }
+}
 function assertBoolean(x, label) {
   if (typeof x !== "boolean") {
     throw new ProtocolError(`${label}: must be boolean`);
@@ -7733,6 +8070,9 @@ function validateHello(raw) {
       if (!HOSTNAME_RE.test(d)) {
         throw new ProtocolError(`hello.domains: invalid hostname ${JSON.stringify(d)}`);
       }
+      if (isPublicSuffix(d)) {
+        throw new ProtocolError(`hello.domains: ${JSON.stringify(d)} is a public suffix \u2014 declare a registrable domain (e.g. "example.${d}"), not the suffix every site under it shares`);
+      }
     }
     if (raw.capabilities !== void 0) {
       if (!Array.isArray(raw.capabilities)) {
@@ -7790,6 +8130,8 @@ function validateHello(raw) {
     assertBase64(raw.identityX25519Pub, "hello.identityX25519Pub");
     assertBase64(raw.identityEd25519Pub, "hello.identityEd25519Pub");
     assertBase64(raw.sessionNonce, "hello.sessionNonce");
+    assertBase64Bytes(raw.sessionPub, "hello.sessionPub", 32);
+    assertBase64Bytes(raw.answersExtNonce, "hello.answersExtNonce", 32);
     assertBase64(raw.sessionSig, "hello.sessionSig");
     return raw;
   }
@@ -7807,11 +8149,34 @@ function validateHello(raw) {
   }
   throw new ProtocolError(`hello.role: must be 'server' or 'extension', got ${String(role)}`);
 }
+function peekHelloVersion(raw) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw))
+    return null;
+  const frame = raw;
+  if (frame.type !== "hello")
+    return null;
+  const protocolVersion = frame.protocolVersion;
+  if (typeof protocolVersion !== "number" || !Number.isInteger(protocolVersion))
+    return null;
+  const accepts = [];
+  if (Array.isArray(frame.accepts)) {
+    for (const a of frame.accepts) {
+      if (typeof a === "string")
+        accepts.push(a);
+    }
+  }
+  return {
+    protocolVersion,
+    mcpId: isValidMcpId(frame.mcpId) ? frame.mcpId : null,
+    accepts
+  };
+}
 function validateReady(raw) {
   assertString(raw.mcpId, "ready.mcpId");
   if (!isValidMcpId(raw.mcpId))
     throw new ProtocolError("ready.mcpId: invalid format");
   assertBase64(raw.extensionSessionPub, "ready.extensionSessionPub");
+  assertBase64Bytes(raw.mcpSessionPub, "ready.mcpSessionPub", 32);
   assertBase64(raw.sessionSig, "ready.sessionSig");
   return raw;
 }
@@ -7830,7 +8195,7 @@ function validatePairPending(raw) {
     throw new ProtocolError("pair-pending.mcpId: invalid format");
   assertString(raw.pairCode, "pair-pending.pairCode");
   if (!PAIR_CODE_RE.test(raw.pairCode)) {
-    throw new ProtocolError(`pair-pending.pairCode: must match XXX-XXX, got ${String(raw.pairCode)}`);
+    throw new ProtocolError(`pair-pending.pairCode: must match XXXX-XXXX, got ${String(raw.pairCode)}`);
   }
   return { type: "pair-pending", mcpId: raw.mcpId, pairCode: raw.pairCode };
 }
@@ -8279,6 +8644,7 @@ var init_validate = __esm({
     init_frames();
     init_mcp_id();
     init_json_pointer();
+    init_public_suffix();
     ProtocolError = class extends Error {
       constructor(message) {
         super(message);
@@ -8292,10 +8658,10 @@ var init_validate = __esm({
     HEADER_NAME_RE = /^[A-Za-z0-9_\-]{1,128}$/;
     HOSTNAME_RE = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/i;
     CAPTURE_PATH_RE = /^\/[A-Za-z0-9._~%\-/]*\*?$/;
-    DOM_SELECTOR_RE = /^[^-]{1,512}$/;
+    DOM_SELECTOR_RE = /^[^\x00-\x1f\x7f]{1,512}$/;
     DOM_ATTRIBUTE_RE = /^[A-Za-z_:][A-Za-z0-9_:.\-]{0,127}$/;
     GRAPHQL_OP_NAME_RE = /^[_A-Za-z][_0-9A-Za-z]{0,127}$/;
-    PAIR_CODE_RE = /^\d{3}-\d{3}$/;
+    PAIR_CODE_RE = /^\d{4}-\d{4}$/;
     KNOWN_RESPONSE_OPS = /* @__PURE__ */ new Set([
       ...KNOWN_CAPABILITIES,
       "graphql_query"
@@ -8303,180 +8669,33 @@ var init_validate = __esm({
   }
 });
 
-// node_modules/@fetchproxy/protocol/dist/crypto.js
-async function exportRaw(key, format) {
-  const buf = await subtle.exportKey(format, key);
-  return new Uint8Array(buf);
-}
-async function generateX25519() {
-  const kp = await subtle.generateKey({ name: "X25519" }, true, [
-    "deriveBits"
-  ]);
-  const priv = await exportRaw(kp.privateKey, "pkcs8");
-  const pub = await exportRaw(kp.publicKey, "raw");
-  return { privateKey: priv.slice(-32), publicKey: pub };
-}
-async function generateEd25519() {
-  const kp = await subtle.generateKey({ name: "Ed25519" }, true, [
-    "sign",
-    "verify"
-  ]);
-  const priv = await exportRaw(kp.privateKey, "pkcs8");
-  const pub = await exportRaw(kp.publicKey, "raw");
-  return { privateKey: priv.slice(-32), publicKey: pub };
-}
-async function importX25519Priv(raw) {
-  const prefix = new Uint8Array([
-    48,
-    46,
-    2,
-    1,
-    0,
-    48,
-    5,
-    6,
-    3,
-    43,
-    101,
-    110,
-    4,
-    34,
-    4,
-    32
-  ]);
-  const pkcs8 = new Uint8Array(prefix.length + raw.length);
-  pkcs8.set(prefix, 0);
-  pkcs8.set(raw, prefix.length);
-  return subtle.importKey("pkcs8", pkcs8, { name: "X25519" }, false, [
-    "deriveBits"
-  ]);
-}
-async function importX25519Pub(raw) {
-  return subtle.importKey("raw", raw, { name: "X25519" }, false, []);
-}
-async function importEd25519Priv(raw) {
-  const prefix = new Uint8Array([
-    48,
-    46,
-    2,
-    1,
-    0,
-    48,
-    5,
-    6,
-    3,
-    43,
-    101,
-    112,
-    4,
-    34,
-    4,
-    32
-  ]);
-  const pkcs8 = new Uint8Array(prefix.length + raw.length);
-  pkcs8.set(prefix, 0);
-  pkcs8.set(raw, prefix.length);
-  return subtle.importKey("pkcs8", pkcs8, { name: "Ed25519" }, false, ["sign"]);
-}
-async function importEd25519Pub(raw) {
-  return subtle.importKey("raw", raw, { name: "Ed25519" }, false, ["verify"]);
-}
-async function ecdhX25519(privRaw, pubRaw) {
-  const priv = await importX25519Priv(privRaw);
-  const pub = await importX25519Pub(pubRaw);
-  const bits = await subtle.deriveBits({ name: "X25519", public: pub }, priv, 256);
-  return new Uint8Array(bits);
-}
-async function ed25519Sign(privRaw, msg) {
-  const priv = await importEd25519Priv(privRaw);
-  const sig = await subtle.sign({ name: "Ed25519" }, priv, msg);
-  return new Uint8Array(sig);
-}
-async function ed25519Verify(pubRaw, msg, sig) {
-  const pub = await importEd25519Pub(pubRaw);
-  return subtle.verify({ name: "Ed25519" }, pub, sig, msg);
-}
-async function hkdfSha256(ikm, salt, info, lenBytes) {
-  const baseKey = await subtle.importKey("raw", ikm, { name: "HKDF" }, false, [
-    "deriveBits"
-  ]);
-  const bits = await subtle.deriveBits({
-    name: "HKDF",
-    hash: "SHA-256",
-    salt,
-    info
-  }, baseKey, lenBytes * 8);
-  return new Uint8Array(bits);
-}
-async function aesGcmSeal(key, iv, plaintext) {
-  const k = await subtle.importKey("raw", key, { name: "AES-GCM" }, false, [
-    "encrypt"
-  ]);
-  const ct = await subtle.encrypt({ name: "AES-GCM", iv }, k, plaintext);
-  return new Uint8Array(ct);
-}
-async function aesGcmOpen(key, iv, ciphertext) {
-  const k = await subtle.importKey("raw", key, { name: "AES-GCM" }, false, [
-    "decrypt"
-  ]);
-  const pt = await subtle.decrypt({ name: "AES-GCM", iv }, k, ciphertext);
-  return new Uint8Array(pt);
-}
-async function sha256(data) {
-  const h = await subtle.digest("SHA-256", data);
-  return new Uint8Array(h);
-}
-var subtle;
-var init_crypto = __esm({
-  "node_modules/@fetchproxy/protocol/dist/crypto.js"() {
-    subtle = globalThis.crypto.subtle;
-  }
-});
-
-// node_modules/@fetchproxy/protocol/dist/encoding.js
-function toB64(bytes) {
-  let s = "";
-  for (let i = 0; i < bytes.length; i++)
-    s += String.fromCharCode(bytes[i]);
-  return btoa(s);
-}
-function fromB64(s) {
-  const bin = atob(s);
-  const out = new Uint8Array(bin.length);
-  for (let i = 0; i < bin.length; i++)
-    out[i] = bin.charCodeAt(i);
-  return out;
-}
-function concatBytes(a, b) {
-  const out = new Uint8Array(a.length + b.length);
-  out.set(a, 0);
-  out.set(b, a.length);
-  return out;
-}
-var init_encoding = __esm({
-  "node_modules/@fetchproxy/protocol/dist/encoding.js"() {
-  }
-});
-
 // node_modules/@fetchproxy/protocol/dist/pair-code.js
-async function derivePairCode(pub) {
-  const h = await sha256(pub);
-  const b0 = h[0] ?? 0;
-  const b1 = h[1] ?? 0;
-  const b2 = h[2] ?? 0;
-  const b3 = h[3] ?? 0;
-  const u32 = (b0 << 24 | b1 << 16 | b2 << 8 | b3) >>> 0;
-  const n = u32 % 1e6;
-  const s = n.toString().padStart(6, "0");
-  return `${s.slice(0, 3)}-${s.slice(3)}`;
-}
-async function derivePairCodeFromIds(mcpPub, extPub) {
-  return derivePairCode(concatBytes(mcpPub, extPub));
-}
+async function pairTranscript(mcpIdentityPub, extIdentityPub, mcpNonce, extNonce, mcpSessionPub) {
+  const label = enc2.encode(PAIR_LABEL);
+  const parts = [mcpIdentityPub, extIdentityPub, mcpNonce, extNonce, mcpSessionPub];
+  const out = new Uint8Array(label.length + 1 + parts.reduce((n, p) => n + p.length, 0));
+  out.set(label, 0);
+  out[label.length] = 0;
+  let at = label.length + 1;
+  for (const p of parts) {
+    out.set(p, at);
+    at += p.length;
+  }
+  return digits(await sha256(out));
+}
+function digits(hash2) {
+  let n = 0n;
+  for (let i = 0; i < 8; i++)
+    n = n << 8n | BigInt(hash2[i] ?? 0);
+  const s = (n % 100000000n).toString().padStart(8, "0");
+  return `${s.slice(0, 4)}-${s.slice(4)}`;
+}
+var enc2, PAIR_LABEL;
 var init_pair_code = __esm({
   "node_modules/@fetchproxy/protocol/dist/pair-code.js"() {
     init_crypto();
-    init_encoding();
+    enc2 = new TextEncoder();
+    PAIR_LABEL = "fetchproxy/4/pair";
   }
 });
 
@@ -8486,10 +8705,24 @@ function randomIv() {
   globalThis.crypto.getRandomValues(iv);
   return iv;
 }
-async function sealInnerFrame(sessionKey, mcpId, seq, inner) {
+function base64Length(byteLength) {
+  return Math.ceil(byteLength / 3) * 4;
+}
+function encodeInnerFrame(inner) {
+  return enc3.encode(JSON.stringify(inner));
+}
+function plaintextOf(inner) {
+  return inner instanceof Uint8Array ? inner : encodeInnerFrame(inner);
+}
+function sealedFrameWireBytes(mcpId, seq, inner) {
+  const plaintext = plaintextOf(inner).length;
+  const envelope = enc3.encode(JSON.stringify({ type: "frame", mcpId, seq, iv: "", ciphertext: "" })).length;
+  return envelope + IV_B64_BYTES + base64Length(plaintext + AES_GCM_TAG_BYTES);
+}
+async function sealInnerFrame(sessionKey, mcpId, seq, inner, direction) {
   const iv = randomIv();
-  const pt = enc.encode(JSON.stringify(inner));
-  const ct = await aesGcmSeal(sessionKey, iv, pt);
+  const pt = plaintextOf(inner);
+  const ct = await aesGcmSeal(sessionKey, iv, pt, frameAad(mcpId, seq, direction));
   return {
     type: "frame",
     mcpId,
@@ -8498,18 +8731,18 @@ async function sealInnerFrame(sessionKey, mcpId, seq, inner) {
     ciphertext: toB64(ct)
   };
 }
-async function openEncryptedFrame(sessionKey, frame) {
-  const result = await openEncryptedFrameDetailed(sessionKey, frame);
+async function openEncryptedFrame(sessionKey, frame, direction) {
+  const result = await openEncryptedFrameDetailed(sessionKey, frame, direction);
   if (result.stage === "ok")
     return result.inner;
   throw result.error instanceof Error ? result.error : new Error(String(result.error));
 }
-async function openEncryptedFrameDetailed(sessionKey, frame) {
+async function openEncryptedFrameDetailed(sessionKey, frame, direction) {
   let pt;
   try {
     const iv = fromB64(frame.iv);
     const ct = fromB64(frame.ciphertext);
-    pt = await aesGcmOpen(sessionKey, iv, ct);
+    pt = await aesGcmOpen(sessionKey, iv, ct, frameAad(frame.mcpId, frame.seq, direction));
   } catch (error61) {
     return { stage: "decrypt-failed", error: error61 };
   }
@@ -8527,14 +8760,18 @@ async function openEncryptedFrameDetailed(sessionKey, frame) {
     return { stage: "validation-failed", error: error61, recoveredId };
   }
 }
-var enc, dec;
+var enc3, dec, AES_GCM_TAG_BYTES, IV_B64_BYTES, MAX_FRAME_BYTES;
 var init_seal = __esm({
   "node_modules/@fetchproxy/protocol/dist/seal.js"() {
     init_crypto();
     init_encoding();
+    init_frames();
     init_validate();
-    enc = new TextEncoder();
+    enc3 = new TextEncoder();
     dec = new TextDecoder();
+    AES_GCM_TAG_BYTES = 16;
+    IV_B64_BYTES = 16;
+    MAX_FRAME_BYTES = 42 * 1024 * 1024;
   }
 });
 
@@ -8548,6 +8785,7 @@ var init_dist = __esm({
     init_pair_code();
     init_seal();
     init_encoding();
+    init_public_suffix();
     init_json_pointer();
   }
 });
@@ -12297,7 +12535,7 @@ var init_wrapper = __esm({
 async function buildServerHello(opts) {
   const sessionNonce = new Uint8Array(32);
   globalThis.crypto.getRandomValues(sessionNonce);
-  const sig = await ed25519Sign(opts.identity.ed25519Priv, concatBytes(new TextEncoder().encode(opts.mcpId), sessionNonce));
+  const sig = await ed25519Sign(opts.identity.ed25519Priv, helloSignaturePayload(opts.mcpId, sessionNonce, opts.sessionPub, opts.answersExtNonce));
   const hello = {
     type: "hello",
     protocolVersion: PROTOCOL_VERSION,
@@ -12310,6 +12548,8 @@ async function buildServerHello(opts) {
     identityX25519Pub: toB64(opts.identity.x25519Pub),
     identityEd25519Pub: toB64(opts.identity.ed25519Pub),
     sessionNonce: toB64(sessionNonce),
+    sessionPub: toB64(opts.sessionPub),
+    answersExtNonce: toB64(opts.answersExtNonce),
     sessionSig: toB64(sig)
   };
   if (opts.accepts && opts.accepts.length > 0)
@@ -12371,14 +12611,31 @@ var init_build_server_hello = __esm({
   }
 });
 
+// node_modules/@fetchproxy/server/dist/frame-size.js
+function encodeOutboundInnerFrame(mcpId, inner) {
+  const plaintext = encodeInnerFrame(inner);
+  const wireBytes = sealedFrameWireBytes(mcpId, Number.MAX_SAFE_INTEGER, plaintext);
+  if (wireBytes > MAX_FRAME_BYTES) {
+    throw new Error(`fetchproxy: this request is too large for one bridge frame: ${wireBytes} bytes on the wire, cap ${MAX_FRAME_BYTES}. The request is refused; the bridge is not closed, so other calls and other MCPs on it are unaffected.`);
+  }
+  return plaintext;
+}
+var init_frame_size = __esm({
+  "node_modules/@fetchproxy/server/dist/frame-size.js"() {
+    init_dist();
+  }
+});
+
 // node_modules/@fetchproxy/server/dist/session.js
-var SessionState;
+var MAX_INFLIGHT_INBOUND_SEQS, SessionState;
 var init_session = __esm({
   "node_modules/@fetchproxy/server/dist/session.js"() {
+    MAX_INFLIGHT_INBOUND_SEQS = 1024;
     SessionState = class {
       sessionKey;
       outboundSeq = 0;
       lastInboundSeq = 0;
+      inflightInbound = /* @__PURE__ */ new Set();
       constructor(sessionKey) {
         this.sessionKey = sessionKey;
       }
@@ -12386,17 +12643,55 @@ var init_session = __esm({
         this.outboundSeq += 1;
         return this.outboundSeq;
       }
-      acceptInboundSeq(seq) {
+      /**
+       * Take this seq out of circulation for the frame about to be opened, and
+       * say whether it was available. SYNCHRONOUS and single-shot: call it before
+       * the first `await` of the receive path, or a duplicate frame read in the
+       * same pass will be judged against a counter neither frame has moved yet.
+       *
+       * Answering false means "not this frame's to process" — replayed, or a
+       * duplicate of one still in flight. Every true MUST be answered by exactly
+       * one {@link commitInboundSeq} or {@link releaseInboundSeq}.
+       */
+      claimInboundSeq(seq) {
         if (seq <= this.lastInboundSeq)
           return false;
-        this.lastInboundSeq = seq;
+        if (this.inflightInbound.has(seq))
+          return false;
+        if (this.inflightInbound.size >= MAX_INFLIGHT_INBOUND_SEQS)
+          return false;
+        this.inflightInbound.add(seq);
         return true;
       }
+      /**
+       * Give a claim back without spending the seq — for a frame that did not
+       * authenticate, which is a frame that never happened. The counter does not
+       * move, so the genuine frames behind it, carrying lower numbers, are still
+       * accepted. Idempotent, so a caller may release in a `catch` after a commit
+       * it is not sure ran.
+       */
+      releaseInboundSeq(seq) {
+        this.inflightInbound.delete(seq);
+      }
+      /**
+       * Record a seq as spent. Call only for a frame that authenticated. Never
+       * moves the counter backwards, so an out-of-order commit cannot reopen a
+       * seq an earlier one already closed.
+       */
+      commitInboundSeq(seq) {
+        this.inflightInbound.delete(seq);
+        if (seq > this.lastInboundSeq)
+          this.lastInboundSeq = seq;
+      }
     };
   }
 });
 
 // node_modules/@fetchproxy/server/dist/session-ready.js
+function protocolVersionCloseReason(info) {
+  const far = info.peer === "extension" ? "the extension" : "the other MCP";
+  return `protocol version mismatch: this MCP speaks ${info.ourVersion}, ${far} speaks ${info.theirVersion}`;
+}
 async function awaitSessionReady(ready, opts) {
   const ms = opts.timeoutMs ?? SESSION_READY_TIMEOUT_MS;
   if (ms <= 0)
@@ -12415,7 +12710,7 @@ async function awaitSessionReady(ready, opts) {
       clearTimeout(timer);
   }
 }
-var SESSION_READY_TIMEOUT_MS, FetchproxySessionNotReadyError, FetchproxyHelloRejectedError;
+var SESSION_READY_TIMEOUT_MS, FetchproxySessionNotReadyError, FetchproxyHelloRejectedError, MIN_VERSION, FetchproxyProtocolVersionError;
 var init_session_ready = __esm({
   "node_modules/@fetchproxy/server/dist/session-ready.js"() {
     SESSION_READY_TIMEOUT_MS = 3e4;
@@ -12447,6 +12742,23 @@ var init_session_ready = __esm({
         Object.setPrototypeOf(this, new.target.prototype);
       }
     };
+    MIN_VERSION = "3.0.0";
+    FetchproxyProtocolVersionError = class extends Error {
+      /** The protocol version this process speaks. */
+      ourVersion;
+      /** The protocol version the far end announced in the hello we refused. */
+      theirVersion;
+      peer;
+      constructor(info) {
+        const far = info.peer === "extension" ? `the attached browser extension speaks ${info.theirVersion} \u2014 update Transporter (the fetchproxy extension) to ${MIN_VERSION} or later` : `the MCP holding the bridge port speaks ${info.theirVersion} \u2014 upgrade @fetchproxy/server to ${MIN_VERSION} or later in that MCP`;
+        super(`protocol version mismatch: this MCP speaks fetchproxy protocol ${info.ourVersion}, ${far}`);
+        this.name = "FetchproxyProtocolVersionError";
+        this.ourVersion = info.ourVersion;
+        this.theirVersion = info.theirVersion;
+        this.peer = info.peer;
+        Object.setPrototypeOf(this, new.target.prototype);
+      }
+    };
   }
 });
 
@@ -12536,13 +12848,32 @@ var init_identity = __esm({
 
 // node_modules/@fetchproxy/server/dist/extension-trust.js
 import { readFile as readFile2, writeFile as writeFile2, rename, unlink, mkdir as mkdir2, chmod as chmod2 } from "node:fs/promises";
-import { join as join3 } from "node:path";
+import { isAbsolute as isAbsolute2, join as join3 } from "node:path";
+function envTrustDir(env = process.env) {
+  const raw = env[TRUST_DIR_ENV];
+  if (raw === void 0)
+    return void 0;
+  const dir = raw.trim();
+  if (dir !== "" && isAbsolute2(dir))
+    return dir;
+  console.warn(`[fetchproxy] ignoring ${TRUST_DIR_ENV}=${JSON.stringify(raw)}: it is not an absolute path. The extension pin will be written beside the identity instead, which is not where you pointed it \u2014 if that directory is read-only, no pin is ever kept.`);
+  return void 0;
+}
+function resolveTrustDir(explicit, identityDir) {
+  if (explicit !== void 0)
+    return explicit;
+  return envTrustDir() ?? identityDir ?? defaultIdentityDir();
+}
+function defaultTrustDir() {
+  return resolveTrustDir();
+}
 function fileExtensionTrust(args) {
+  const dir = resolveTrustDir(args.trustDir, args.dir);
   return {
     allowNew: args.allowNew,
-    location: extensionTrustPath(args.serverName, args.dir ?? defaultIdentityDir()),
-    read: () => readExtensionPin(args.serverName, args.dir ?? defaultIdentityDir()),
-    write: (pin) => writeExtensionPin(args.serverName, pin, args.dir ?? defaultIdentityDir())
+    location: extensionTrustPath(args.serverName, dir),
+    read: () => readExtensionPin(args.serverName, dir),
+    write: (pin) => writeExtensionPin(args.serverName, pin, dir)
   };
 }
 function allowNewExtensionIdentity(explicit, env = process.env) {
@@ -12569,14 +12900,14 @@ function decideExtensionTrust(args) {
     message: `[fetchproxy] ${serverName}: refusing an extension whose identity is not the one this MCP paired with. If you re-installed the extension or moved to another browser, re-pair deliberately: run this MCP once with ${TRUST_NEW_EXTENSION_ENV}=1, or delete ${trustPath}. If you did neither, something else is answering as your browser.`
   };
 }
-function extensionTrustPath(serverName, dir = defaultIdentityDir()) {
+function extensionTrustPath(serverName, dir = defaultTrustDir()) {
   return join3(dir, `${safeIdentityFileBase(serverName)}.extension-trust.json`);
 }
 function extensionTrustPathHint(serverName) {
   try {
     return extensionTrustPath(serverName);
   } catch {
-    return join3(defaultIdentityDir(), "<server-name>.extension-trust.json");
+    return join3(defaultTrustDir(), "<server-name>.extension-trust.json");
   }
 }
 function isPin(x) {
@@ -12585,7 +12916,7 @@ function isPin(x) {
   const r = x;
   return typeof r.identityX25519Pub === "string" && typeof r.identityEd25519Pub === "string" && typeof r.pinnedAt === "number";
 }
-async function readExtensionPin(serverName, dir = defaultIdentityDir()) {
+async function readExtensionPin(serverName, dir = defaultTrustDir()) {
   const path = extensionTrustPath(serverName, dir);
   let raw;
   try {
@@ -12610,7 +12941,7 @@ async function readExtensionPin(serverName, dir = defaultIdentityDir()) {
     pinnedAt: parsed.pinnedAt
   };
 }
-async function writeExtensionPin(serverName, pin, dir = defaultIdentityDir()) {
+async function writeExtensionPin(serverName, pin, dir = defaultTrustDir()) {
   const path = extensionTrustPath(serverName, dir);
   await mkdir2(dir, { recursive: true, mode: 448 });
   const tmp = `${path}.tmp`;
@@ -12618,28 +12949,67 @@ async function writeExtensionPin(serverName, pin, dir = defaultIdentityDir()) {
   await chmod2(tmp, 384);
   await rename(tmp, path);
 }
-var TRUST_NEW_EXTENSION_ENV;
+var TRUST_DIR_ENV, TRUST_NEW_EXTENSION_ENV;
 var init_extension_trust = __esm({
   "node_modules/@fetchproxy/server/dist/extension-trust.js"() {
     init_identity();
+    TRUST_DIR_ENV = "FETCHPROXY_TRUST_DIR";
     TRUST_NEW_EXTENSION_ENV = "FETCHPROXY_TRUST_NEW_EXTENSION";
   }
 });
 
 // node_modules/@fetchproxy/server/dist/host.js
+function envAllowsLocalOrigins(env = process.env) {
+  const raw = env[ALLOW_LOCAL_ORIGINS_ENV];
+  if (raw === void 0 || raw.trim() === "")
+    return false;
+  if (raw.trim() === "1")
+    return true;
+  console.warn(`[fetchproxy] ignoring ${ALLOW_LOCAL_ORIGINS_ENV}=${JSON.stringify(raw)}: the only value that turns it on is 1. Upgrades from a null or localhost origin stay refused.`);
+  return false;
+}
+function originVerdict(origin, allowLocal) {
+  if (origin === void 0)
+    return { allow: true };
+  if (HTTP_ORIGIN_RE.test(origin)) {
+    if (PUBLIC_ORIGIN_RE.test(origin)) {
+      return { allow: false, reason: "origin not allowed", escapable: false };
+    }
+    return allowLocal ? { allow: true } : { allow: false, reason: "localhost page origin not allowed", escapable: true };
+  }
+  if (origin.toLowerCase() === OPAQUE_ORIGIN) {
+    return allowLocal ? { allow: true } : { allow: false, reason: "opaque (null) origin not allowed", escapable: true };
+  }
+  if (EXTENSION_ORIGIN_RE.test(origin))
+    return { allow: true };
+  return { allow: false, reason: "origin not allowed", escapable: false };
+}
 async function startHost(opts) {
+  const allowLocalOrigins = envAllowsLocalOrigins();
+  if (allowLocalOrigins) {
+    console.warn(`[fetchproxy] ${ALLOW_LOCAL_ORIGINS_ENV}=1: accepting WebSocket upgrades from null and localhost page origins. This is a development escape \u2014 any local page the browser has open can reach this concentrator while it is set.`);
+  }
+  const warnedOrigins = /* @__PURE__ */ new Set();
   const wss = new import_websocket_server.default({
     server: opts.httpServer,
+    maxPayload: opts.maxPayloadBytes ?? MAX_PAYLOAD_BYTES,
     verifyClient: (info, cb) => {
       const origin = info.req.headers.origin;
-      if (origin && PUBLIC_ORIGIN_RE.test(origin)) {
-        cb(false, 403, "origin not allowed");
+      const verdict = originVerdict(origin, allowLocalOrigins);
+      if (verdict.allow) {
+        cb(true);
         return;
       }
-      cb(true);
+      if (verdict.escapable && origin !== void 0 && warnedOrigins.size < 8) {
+        if (!warnedOrigins.has(origin)) {
+          warnedOrigins.add(origin);
+          console.warn(`[fetchproxy] refused a WebSocket upgrade from ${JSON.stringify(origin)}: ${verdict.reason}. If that is you, developing against the bridge, set ${ALLOW_LOCAL_ORIGINS_ENV}=1 on this MCP \u2014 never on a deployed one.`);
+        }
+      }
+      cb(false, 403, verdict.reason);
     }
   });
-  const ownHello = await buildServerHello({
+  const ownHelloBase = {
     // 2.6.0: tell the extension it can say WHY it refused a hello, instead of
     // leaving us to time out and guess.
     accepts: ["hello-rejected"],
@@ -12658,14 +13028,26 @@ async function startHost(opts) {
     sessionStoragePointers: opts.ownSessionStoragePointers,
     domSelectors: opts.ownDomSelectors,
     graphqlOps: opts.ownGraphqlOps
-  });
-  const ownSessionNonce = fromB64(ownHello.sessionNonce);
+  };
+  const generateSessionKeypair = opts.generateSessionKeypair ?? generateX25519;
   let extensionWs = null;
   const peers = /* @__PURE__ */ new Map();
   const ownInnerListeners = [];
   const disconnectListeners = [];
   const pendingPairListeners = [];
   let ownSession = null;
+  let ownEphemeral = null;
+  function dropOwnSessionAndEphemeral() {
+    if (ownEphemeral)
+      ownEphemeral.priv.fill(0);
+    ownEphemeral = null;
+    return null;
+  }
+  function installOwnEphemeral(next) {
+    if (ownEphemeral)
+      ownEphemeral.priv.fill(0);
+    ownEphemeral = next;
+  }
   let ownPendingPairCode = null;
   let resolveOwnSession;
   let rejectOwnSession;
@@ -12679,21 +13061,74 @@ async function startHost(opts) {
     });
   }
   resetSessionPromise();
+  let ownSessionRefusal = null;
+  function refuseVersionMismatch(ws, raw, identified) {
+    const peek = peekHelloVersion(raw);
+    if (!peek || peek.protocolVersion === PROTOCOL_VERSION)
+      return false;
+    const err = new FetchproxyProtocolVersionError({
+      ourVersion: PROTOCOL_VERSION,
+      theirVersion: peek.protocolVersion,
+      peer: peek.mcpId === null ? "extension" : "mcp"
+    });
+    console.warn(`[fetchproxy] host: ${err.message}`);
+    const nothingBetterAttached = extensionWs === null && extensionClaim === null && ownSession === null;
+    if (err.peer === "extension" && identified !== "peer" && nothingBetterAttached) {
+      ownSessionRefusal = err;
+      rejectOwnSession(err);
+      resetSessionPromise();
+      rejectOwnSession(err);
+    }
+    try {
+      ws.close(1002, protocolVersionCloseReason(err));
+    } catch {
+    }
+    return true;
+  }
   let extensionHello = null;
   let extensionClaim = null;
+  const pairCodeFor = async (hello, mint) => {
+    if (!mint)
+      return null;
+    try {
+      return await pairTranscript(opts.ownIdentity.x25519Pub, fromB64(hello.identityX25519Pub), mint.nonce, fromB64(hello.sessionNonce), mint.pub);
+    } catch (e) {
+      console.error("[fetchproxy] could not derive the pair code:", e);
+      return null;
+    }
+  };
   wss.on("connection", (ws) => {
     let identified = null;
     let peerMcpId = null;
     let closed = false;
     let pinOnReady = false;
+    const handshakeTimer = setTimeout(() => {
+      if (identified || closed)
+        return;
+      try {
+        ws.close(1008, "handshake timeout");
+      } catch {
+      }
+    }, opts.handshakeTimeoutMs ?? HANDSHAKE_TIMEOUT_MS);
+    handshakeTimer.unref?.();
+    ws.on("error", (e) => {
+      console.warn(`[fetchproxy] host: socket error: ${String(e)}`);
+    });
     ws.on("message", async (data) => {
       try {
+        let raw;
+        try {
+          raw = JSON.parse(data.toString());
+        } catch {
+          ws.close(1002, "protocol error");
+          return;
+        }
         let frame;
         try {
-          const raw = JSON.parse(data.toString());
           frame = validateFrame(raw);
         } catch {
-          ws.close(1002, "protocol error");
+          if (!refuseVersionMismatch(ws, raw, identified))
+            ws.close(1002, "protocol error");
           return;
         }
         if (frame.type === "hello" && frame.role === "extension") {
@@ -12737,25 +13172,43 @@ async function startHost(opts) {
           identified = "extension";
           extensionWs = ws;
           extensionHello = frame;
-          if (opts.onPairCode) {
+          if (ownSessionRefusal) {
+            ownSessionRefusal = null;
+            resetSessionPromise();
+          }
+          const mintedKeypair = await generateSessionKeypair();
+          const mintedHello = await buildServerHello({
+            ...ownHelloBase,
+            sessionPub: mintedKeypair.publicKey,
+            // The echo Rule B's gate reads, inside the signed payload: this
+            // hello answers the extension session whose hello triggered it.
+            answersExtNonce: fromB64(frame.sessionNonce)
+          });
+          if (extensionWs !== ws) {
+            mintedKeypair.privateKey.fill(0);
+            return;
+          }
+          const mint = {
+            nonce: fromB64(mintedHello.sessionNonce),
+            pub: mintedKeypair.publicKey
+          };
+          installOwnEphemeral({ ...mint, priv: mintedKeypair.privateKey });
+          for (const slot of peers.values())
+            slot.ws.send(JSON.stringify(frame));
+          ws.send(JSON.stringify(mintedHello));
+          const helloPairCode = await pairCodeFor(frame, mint);
+          if (opts.onPairCode && helloPairCode !== null) {
             try {
-              const code = await derivePairCodeFromIds(opts.ownIdentity.x25519Pub, fromB64(frame.identityX25519Pub));
-              opts.onPairCode(code);
+              opts.onPairCode(helloPairCode);
             } catch (e) {
               console.error("[fetchproxy] onPairCode threw:", e);
             }
           }
-          for (const slot of peers.values())
-            slot.ws.send(JSON.stringify(frame));
-          ws.send(JSON.stringify(ownHello));
-          for (const slot of peers.values()) {
-            ws.send(JSON.stringify(slot.helloFrame));
-          }
           return;
         }
         if (frame.type === "hello" && frame.role === "server") {
           const peerEdPub = fromB64(frame.identityEd25519Pub);
-          const peerSigMsg = concatBytes(enc2.encode(frame.mcpId), fromB64(frame.sessionNonce));
+          const peerSigMsg = helloSignaturePayload(frame.mcpId, fromB64(frame.sessionNonce), fromB64(frame.sessionPub), fromB64(frame.answersExtNonce));
           const peerSig = fromB64(frame.sessionSig);
           let peerSigOk = false;
           try {
@@ -12780,10 +13233,12 @@ async function startHost(opts) {
           identified = "peer";
           peerMcpId = frame.mcpId;
           peers.set(frame.mcpId, { ws, helloFrame: frame });
-          if (extensionWs)
-            extensionWs.send(JSON.stringify(frame));
-          if (extensionHello)
+          if (extensionHello && answersNoExtSession(frame.answersExtNonce)) {
             ws.send(JSON.stringify(extensionHello));
+          }
+          if (extensionWs && extensionHello && frame.answersExtNonce === extensionHello.sessionNonce) {
+            extensionWs.send(JSON.stringify(frame));
+          }
           return;
         }
         if (frame.type === "ready") {
@@ -12793,9 +13248,14 @@ async function startHost(opts) {
               ws.close(1002, "ready before extension hello");
               return;
             }
+            const held = ownEphemeral;
+            if (!held || frame.mcpSessionPub !== toB64(held.pub)) {
+              console.warn("[fetchproxy] discarding a ready for a session ephemeral this host no longer holds (the extension reconnected while a hello was in flight)");
+              return;
+            }
             const extEdPub = fromB64(extensionHello.identityEd25519Pub);
             const extNonce = fromB64(extensionHello.sessionNonce);
-            const msg = readySignaturePayload(ownSessionNonce, extNonce, fromB64(frame.extensionSessionPub));
+            const msg = readySignaturePayload(held.nonce, extNonce, fromB64(frame.extensionSessionPub), held.pub);
             const sig = fromB64(frame.sessionSig);
             let sigOk = false;
             try {
@@ -12821,8 +13281,9 @@ async function startHost(opts) {
               }
             }
             const extPub = fromB64(frame.extensionSessionPub);
-            const shared = await ecdhX25519(opts.ownIdentity.x25519Priv, extPub);
-            const key = await hkdfSha256(shared, ownSessionNonce, enc2.encode(HKDF_SESSION_INFO), 32);
+            const shared = await ecdhX25519(held.priv, extPub);
+            const salt = await transcriptHash(held.nonce, extNonce, held.pub, extPub);
+            const key = await hkdfSha256(shared, salt, enc4.encode(HKDF_SESSION_INFO), 32);
             if (extensionWs !== ws)
               return;
             ownSession = new SessionState(key);
@@ -12838,11 +13299,19 @@ async function startHost(opts) {
         if (frame.type === "frame") {
           if (identified === "extension") {
             if (frame.mcpId === opts.ownMcpId) {
-              if (!ownSession)
+              const session = ownSession;
+              if (!session)
                 return;
-              if (!ownSession.acceptInboundSeq(frame.seq))
+              if (!session.claimInboundSeq(frame.seq))
                 return;
-              const inner = await openEncryptedFrame(ownSession.sessionKey, frame);
+              let inner;
+              try {
+                inner = await openEncryptedFrame(session.sessionKey, frame, "e2s");
+              } catch (e) {
+                session.releaseInboundSeq(frame.seq);
+                throw e;
+              }
+              session.commitInboundSeq(frame.seq);
               ownInnerListeners.forEach((cb) => cb(inner));
             } else {
               const slot = peers.get(frame.mcpId);
@@ -12866,8 +13335,16 @@ async function startHost(opts) {
         }
         if (frame.type === "pair-pending" && identified === "extension") {
           if (frame.mcpId === opts.ownMcpId) {
-            ownPendingPairCode = frame.pairCode;
-            pendingPairListeners.forEach((cb) => cb(frame.pairCode));
+            const hello = extensionHello;
+            const mint = ownEphemeral;
+            const derived = hello === null ? null : await pairCodeFor(hello, mint);
+            if (derived === null || frame.pairCode !== derived) {
+              console.error(`[fetchproxy] ${opts.ownServerName}: the extension's pair code (${frame.pairCode}) does not match the one this MCP derived from the pair transcript` + (derived === null ? " (none \u2014 this MCP could not derive its own)" : ` (${derived})`) + " \u2014 refusing to pair (possible MITM between this MCP and the extension)");
+              ws.close(1008, "pair code mismatch");
+              return;
+            }
+            ownPendingPairCode = derived;
+            pendingPairListeners.forEach((cb) => cb(derived));
           } else {
             const slot = peers.get(frame.mcpId);
             if (slot)
@@ -12884,6 +13361,7 @@ async function startHost(opts) {
     });
     ws.on("close", () => {
       closed = true;
+      clearTimeout(handshakeTimer);
       if (extensionClaim === ws)
         extensionClaim = null;
       if (identified === "extension" && extensionWs === ws) {
@@ -12892,7 +13370,7 @@ async function startHost(opts) {
         if (!ownSession) {
           rejectOwnSession(new Error("extension disconnected before ready"));
         }
-        ownSession = null;
+        ownSession = dropOwnSessionAndEphemeral();
         ownPendingPairCode = null;
         resetSessionPromise();
         disconnectListeners.forEach((cb) => cb());
@@ -12931,7 +13409,8 @@ async function startHost(opts) {
       });
       if (!extensionWs)
         throw new Error("host: no extension connected");
-      const sealed = await sealInnerFrame(session.sessionKey, opts.ownMcpId, session.nextOutboundSeq(), inner);
+      const plaintext = encodeOutboundInnerFrame(opts.ownMcpId, inner);
+      const sealed = await sealInnerFrame(session.sessionKey, opts.ownMcpId, session.nextOutboundSeq(), plaintext, "s2e");
       extensionWs.send(JSON.stringify(sealed));
     },
     onOwnInner: (cb) => {
@@ -12948,17 +13427,24 @@ async function startHost(opts) {
     sessionLinked: () => ownSession !== null
   };
 }
-var PUBLIC_ORIGIN_RE, enc2;
+var HTTP_ORIGIN_RE, PUBLIC_ORIGIN_RE, EXTENSION_ORIGIN_RE, OPAQUE_ORIGIN, ALLOW_LOCAL_ORIGINS_ENV, HANDSHAKE_TIMEOUT_MS, MAX_PAYLOAD_BYTES, enc4;
 var init_host = __esm({
   "node_modules/@fetchproxy/server/dist/host.js"() {
     init_wrapper();
     init_dist();
     init_build_server_hello();
+    init_frame_size();
     init_session();
     init_session_ready();
     init_extension_trust();
-    PUBLIC_ORIGIN_RE = /^https?:\/\/(?!(127\.0\.0\.1|localhost)(:|$))/i;
-    enc2 = new TextEncoder();
+    HTTP_ORIGIN_RE = /^https?:\/\//i;
+    PUBLIC_ORIGIN_RE = /^https?:\/\/(?!(127\.0\.0\.1|localhost|\[::1\])(:|$))/i;
+    EXTENSION_ORIGIN_RE = /^(chrome-extension|moz-extension|safari-web-extension):\/\//i;
+    OPAQUE_ORIGIN = "null";
+    ALLOW_LOCAL_ORIGINS_ENV = "FETCHPROXY_ALLOW_LOCAL_ORIGINS";
+    HANDSHAKE_TIMEOUT_MS = 15e3;
+    MAX_PAYLOAD_BYTES = MAX_FRAME_BYTES;
+    enc4 = new TextEncoder();
   }
 });
 
@@ -12966,10 +13452,26 @@ var init_host = __esm({
 async function startPeer(opts) {
   const ws = new import_websocket.default(`ws://${opts.host}:${opts.port}`);
   await new Promise((resolve, reject) => {
-    ws.once("open", () => resolve());
-    ws.once("error", reject);
+    const onOpen = () => {
+      cleanup();
+      resolve();
+    };
+    const onError = (e) => {
+      cleanup();
+      reject(e);
+    };
+    const cleanup = () => {
+      ws.off("open", onOpen);
+      ws.off("error", onError);
+    };
+    ws.once("open", onOpen);
+    ws.once("error", onError);
   });
-  const hello = await buildServerHello({
+  ws.on("error", (e) => {
+    console.warn(`[fetchproxy] peer: socket error: ${String(e)}`);
+  });
+  const generateSessionKeypair = opts.generateSessionKeypair ?? generateX25519;
+  const helloBase = {
     identity: opts.identity,
     mcpId: opts.mcpId,
     serverName: opts.serverName,
@@ -12989,15 +13491,39 @@ async function startPeer(opts) {
     // `extensionConnected()` / `sessionLinked()` can go back to false.
     // 2.6.0: `hello-rejected` for the same reason, from the extension.
     accepts: ["extension-disconnected", "hello-rejected"]
+  };
+  const bootstrapKeypair = await generateSessionKeypair();
+  let bootstrapPriv = bootstrapKeypair.privateKey;
+  const hello = await buildServerHello({
+    ...helloBase,
+    sessionPub: bootstrapKeypair.publicKey,
+    // At dial this peer has been told of no extension session, and saying so
+    // is what keeps the host from forwarding a hello whose ephemeral is not
+    // one a session may be opened from.
+    answersExtNonce: ANSWERS_NO_EXT_SESSION
   });
-  const sessionNonce = fromB64(hello.sessionNonce);
   ws.send(JSON.stringify(hello));
   const innerListeners = [];
   const renegotiateListeners = [];
   const pendingPairListeners = [];
   const closeListeners = [];
   let session = null;
+  let sessionEphemeral = null;
+  function dropSessionEphemeral() {
+    if (sessionEphemeral)
+      sessionEphemeral.priv.fill(0);
+    sessionEphemeral = null;
+  }
+  function installSessionEphemeral(next) {
+    dropSessionEphemeral();
+    if (bootstrapPriv) {
+      bootstrapPriv.fill(0);
+      bootstrapPriv = null;
+    }
+    sessionEphemeral = next;
+  }
   let pendingPairCode = null;
+  let warnedUnverifiablePairCode = false;
   let resolveFirstReady;
   let rejectFirstReady;
   const sessionPromise = new Promise((resolve, reject) => {
@@ -13006,58 +13532,60 @@ async function startPeer(opts) {
   });
   let extensionHello = null;
   let extensionGone = false;
-  let warnedUnverifiable = false;
   let cachedPin = void 0;
-  const authenticateExtension = async (sessionSig, extensionSessionPub) => {
-    if (!extensionHello) {
-      if (opts.requireExtensionIdentity) {
-        console.error(`[fetchproxy] ${opts.serverName}: the concentrator does not forward the extension's identity, so this session cannot be verified \u2014 refusing. Upgrade the MCP holding the bridge port to 1.12.0 or later.`);
-        return false;
-      }
-      if (!warnedUnverifiable) {
-        warnedUnverifiable = true;
-        console.warn(`[fetchproxy] ${opts.serverName}: the concentrator does not forward the extension's identity (pre-1.12.0), so this peer cannot verify which browser it is talking to. Upgrade the MCP holding the bridge port to close this.`);
-      }
-      return true;
+  const pairCodeFor = async (hello2, mint) => {
+    if (!mint)
+      return null;
+    try {
+      return await pairTranscript(opts.identity.x25519Pub, fromB64(hello2.identityX25519Pub), mint.nonce, fromB64(hello2.sessionNonce), mint.pub);
+    } catch (e) {
+      console.error("[fetchproxy] could not derive the pair code:", e);
+      return null;
     }
-    const payload = readySignaturePayload(sessionNonce, fromB64(extensionHello.sessionNonce), fromB64(extensionSessionPub));
+  };
+  const authenticateExtension = async (sessionSig, extensionSessionPub, held, hello2) => {
+    if (!hello2) {
+      console.error(`[fetchproxy] ${opts.serverName}: no extension hello has been relayed to this peer, so there is nothing to derive a v4 session from \u2014 refusing. Upgrade the MCP holding the bridge port to 3.0.0 or later.`);
+      return null;
+    }
+    const payload = readySignaturePayload(held.nonce, fromB64(hello2.sessionNonce), fromB64(extensionSessionPub), held.pub);
     let sigOk = false;
     try {
-      sigOk = await ed25519Verify(fromB64(extensionHello.identityEd25519Pub), payload, fromB64(sessionSig));
+      sigOk = await ed25519Verify(fromB64(hello2.identityEd25519Pub), payload, fromB64(sessionSig));
     } catch {
       sigOk = false;
     }
     if (!sigOk) {
       console.warn(`[fetchproxy] ${opts.serverName}: extension session signature invalid \u2014 refusing (the concentrator may be answering in the browser's place)`);
-      return false;
+      return null;
     }
     if (cachedPin === void 0) {
       try {
         cachedPin = await opts.extensionTrust.read();
       } catch (e) {
         console.error(`[fetchproxy] ${String(e)}`);
-        return false;
+        return null;
       }
     }
     const pin = cachedPin;
     const outcome = decideExtensionTrust({
       pin,
-      hello: extensionHello,
+      hello: hello2,
       allowNew: opts.extensionTrust.allowNew,
       serverName: opts.serverName,
       location: opts.extensionTrust.location
     });
     if (outcome.decision === "refused") {
       console.warn(outcome.message);
-      return false;
+      return null;
     }
     if (outcome.decision === "replace")
       console.warn(outcome.message);
     if (outcome.decision !== "pinned") {
       try {
         const written = {
-          identityX25519Pub: extensionHello.identityX25519Pub,
-          identityEd25519Pub: extensionHello.identityEd25519Pub,
+          identityX25519Pub: hello2.identityX25519Pub,
+          identityEd25519Pub: hello2.identityEd25519Pub,
           pinnedAt: Date.now()
         };
         await opts.extensionTrust.write(written);
@@ -13066,32 +13594,62 @@ async function startPeer(opts) {
         console.error(`[fetchproxy] could not persist the extension pin: ${String(e)}`);
       }
     }
-    return true;
+    return hello2;
   };
   const onMessage = async (data) => {
+    let raw;
     try {
-      const raw = JSON.parse(data.toString());
+      raw = JSON.parse(data.toString());
       const frame = validateFrame(raw);
       if (frame.type === "hello" && frame.role === "extension") {
         extensionHello = frame;
+        const mintedKeypair = await generateSessionKeypair();
+        const mintedHello = await buildServerHello({
+          ...helloBase,
+          sessionPub: mintedKeypair.publicKey,
+          answersExtNonce: fromB64(frame.sessionNonce)
+        });
+        if (extensionHello !== frame) {
+          mintedKeypair.privateKey.fill(0);
+          return;
+        }
+        installSessionEphemeral({
+          nonce: fromB64(mintedHello.sessionNonce),
+          pub: mintedKeypair.publicKey,
+          priv: mintedKeypair.privateKey
+        });
+        ws.send(JSON.stringify(mintedHello));
         return;
       }
       if (frame.type === "extension-disconnected") {
         extensionHello = null;
         extensionGone = true;
+        dropSessionEphemeral();
         pendingPairCode = null;
         return;
       }
       if (frame.type === "ready" && frame.mcpId === opts.mcpId) {
-        const authorised = await authenticateExtension(frame.sessionSig, frame.extensionSessionPub);
-        if (!authorised) {
+        const held = sessionEphemeral;
+        const heldExtHello = extensionHello;
+        if (!held || frame.mcpSessionPub !== toB64(held.pub)) {
+          console.warn(`[fetchproxy] ${opts.serverName}: discarding a ready for a session ephemeral this peer no longer holds (the extension reconnected while a hello was in flight)`);
+          return;
+        }
+        const authenticated = await authenticateExtension(frame.sessionSig, frame.extensionSessionPub, held, heldExtHello);
+        if (!authenticated) {
           ws.close(1008, "extension identity refused");
           rejectFirstReady(new Error("peer: extension identity refused"));
           return;
         }
         const extPub = fromB64(frame.extensionSessionPub);
-        const shared = await ecdhX25519(opts.identity.x25519Priv, extPub);
-        const sessionKey = await hkdfSha256(shared, sessionNonce, enc3.encode(HKDF_SESSION_INFO), 32);
+        const extNonce = fromB64(authenticated.sessionNonce);
+        const shared = await ecdhX25519(held.priv, extPub);
+        const salt = await transcriptHash(held.nonce, extNonce, held.pub, extPub);
+        const sessionKey = await hkdfSha256(shared, salt, enc5.encode(HKDF_SESSION_INFO), 32);
+        if (sessionEphemeral !== held) {
+          console.warn(`[fetchproxy] ${opts.serverName}: dropping a session derived against an ephemeral that was superseded while it was being derived`);
+          return;
+        }
         const isRenegotiation = session !== null;
         session = new SessionState(sessionKey);
         extensionGone = false;
@@ -13107,16 +13665,42 @@ async function startPeer(opts) {
         rejectFirstReady(new FetchproxyHelloRejectedError({ mcpId: frame.mcpId, reason: frame.reason }));
       }
       if (frame.type === "pair-pending" && frame.mcpId === opts.mcpId) {
-        pendingPairCode = frame.pairCode;
-        pendingPairListeners.forEach((cb) => cb(frame.pairCode));
+        const hello2 = extensionHello;
+        const mint = sessionEphemeral;
+        const derived = hello2 === null ? null : await pairCodeFor(hello2, mint);
+        if (derived === null) {
+          if (!warnedUnverifiablePairCode) {
+            warnedUnverifiablePairCode = true;
+            console.warn(`[fetchproxy] ${opts.serverName}: a pair code arrived that this peer cannot derive for itself (no extension identity has been relayed to it, or no session ephemeral has been minted in answer to one), so it is not being shown. If the MCP holding the bridge port is older than 1.12.0, upgrading it closes this.`);
+          }
+          return;
+        }
+        if (frame.pairCode !== derived) {
+          console.error(`[fetchproxy] ${opts.serverName}: the extension's pair code (${frame.pairCode}) does not match the one this peer derived from the pair transcript (${derived}) \u2014 refusing to pair (possible MITM between this MCP and the extension)`);
+          ws.close(1008, "pair code mismatch");
+          return;
+        }
+        pendingPairCode = derived;
+        pendingPairListeners.forEach((cb) => cb(derived));
         return;
       }
       if (frame.type === "frame" && frame.mcpId === opts.mcpId) {
-        if (!session)
+        const inboundSession = session;
+        if (!inboundSession)
           return;
-        if (!session.acceptInboundSeq(frame.seq))
+        if (!inboundSession.claimInboundSeq(frame.seq))
           return;
-        const result = await openEncryptedFrameDetailed(session.sessionKey, frame);
+        let result;
+        try {
+          result = await openEncryptedFrameDetailed(inboundSession.sessionKey, frame, "e2s");
+        } catch (e) {
+          inboundSession.releaseInboundSeq(frame.seq);
+          throw e;
+        }
+        if (result.stage !== "decrypt-failed")
+          inboundSession.commitInboundSeq(frame.seq);
+        else
+          inboundSession.releaseInboundSeq(frame.seq);
         if (result.stage === "ok") {
           innerListeners.forEach((cb) => cb(result.inner));
         } else if (result.stage === "decrypt-failed") {
@@ -13133,12 +13717,25 @@ async function startPeer(opts) {
         }
       }
     } catch (e) {
-      rejectFirstReady(e instanceof Error ? e : new Error(String(e)));
+      const peek = peekHelloVersion(raw);
+      const mismatch = peek && peek.protocolVersion !== PROTOCOL_VERSION ? new FetchproxyProtocolVersionError({
+        ourVersion: PROTOCOL_VERSION,
+        theirVersion: peek.protocolVersion,
+        peer: peek.mcpId === null ? "extension" : "mcp"
+      }) : null;
+      if (mismatch)
+        console.warn(`[fetchproxy] ${opts.serverName}: ${mismatch.message}`);
+      rejectFirstReady(mismatch ?? (e instanceof Error ? e : new Error(String(e))));
     }
   };
   ws.on("message", onMessage);
   ws.once("close", () => {
     rejectFirstReady(new Error("peer WS closed before ready"));
+    dropSessionEphemeral();
+    if (bootstrapPriv) {
+      bootstrapPriv.fill(0);
+      bootstrapPriv = null;
+    }
     closeListeners.forEach((cb) => cb());
   });
   sessionPromise.catch(() => {
@@ -13152,7 +13749,8 @@ async function startPeer(opts) {
         pendingPairCode: () => pendingPairCode
       });
       const s = session;
-      const sealed = await sealInnerFrame(s.sessionKey, opts.mcpId, s.nextOutboundSeq(), inner);
+      const plaintext = encodeOutboundInnerFrame(opts.mcpId, inner);
+      const sealed = await sealInnerFrame(s.sessionKey, opts.mcpId, s.nextOutboundSeq(), plaintext, "s2e");
       ws.send(JSON.stringify(sealed));
     },
     onInner: (cb) => {
@@ -13174,16 +13772,17 @@ async function startPeer(opts) {
   };
   return handle;
 }
-var enc3;
+var enc5;
 var init_peer = __esm({
   "node_modules/@fetchproxy/server/dist/peer.js"() {
     init_wrapper();
     init_dist();
     init_build_server_hello();
+    init_frame_size();
     init_session();
     init_session_ready();
     init_extension_trust();
-    enc3 = new TextEncoder();
+    enc5 = new TextEncoder();
   }
 });
 
@@ -13225,6 +13824,8 @@ function classifyBridgeError(err) {
     return "session_not_ready";
   if (err instanceof FetchproxyTimeoutError)
     return "timeout";
+  if (err instanceof FetchproxyWaitedError)
+    return "timeout";
   if (err instanceof FetchproxyBridgeDownError)
     return "bridge_down";
   if (err instanceof FetchproxyHttpError)
@@ -13262,7 +13863,19 @@ function envWsHost() {
     return void 0;
   return host;
 }
-function protocolErrorFrom(error61) {
+function waitedHint(op) {
+  const tail = " This is not a version problem and does not need an update.";
+  if (op === "capture" || op === "capture_redirect") {
+    return "nothing matched before the window closed. Is a tab open on the declared domain and signed in? The wait resolves on the NEXT matching request the PAGE makes, so an idle tab times out however long you wait \u2014 interact with the page, or raise the window." + tail;
+  }
+  if (op === "download") {
+    return "the download did not finish before the window closed. Is a tab open on the declared domain and signed in, and is the file still transferring?" + tail;
+  }
+  return "the extension waited and nothing arrived. Is a tab open on the declared domain and signed in?" + tail;
+}
+function protocolErrorFrom(error61, op) {
+  if (error61 === "timeout")
+    return new FetchproxyWaitedError(error61, op);
   if (SCOPE_REJECTION.test(error61))
     return new FetchproxyScopeError(error61);
   if (TAB_OPENING_REJECTION.test(error61))
@@ -13271,6 +13884,11 @@ function protocolErrorFrom(error61) {
     return new FetchproxyNoTabError(error61);
   return new FetchproxyProtocolError(error61);
 }
+function verbDeadlineMs(transportMs, requestedMs, graceMs = VERB_DEADLINE_GRACE_MS) {
+  if (requestedMs === void 0)
+    return transportMs;
+  return Math.max(requestedMs + graceMs, transportMs);
+}
 function normalizeCookiePath(path) {
   if (path === void 0 || path === "")
     return void 0;
@@ -13306,7 +13924,7 @@ function assertUrlInDomains(field, url2, domains) {
   const declared = domains.map((d) => JSON.stringify(d)).join(", ");
   throw new Error(`FetchproxyServer: ${field} host "${host}" is outside declared domains [${declared}] \u2014 must be one of them or a subdomain`);
 }
-var FetchproxyProtocolError, FetchproxyHttpError, FetchproxyBridgeDownError, FetchproxyHintedError, FetchproxyScopeError, FetchproxyNoTabError, FetchproxyTabOpeningError, SCOPE_REJECTION, NO_TAB_REJECTION, TAB_OPENING_REJECTION, FetchproxyTimeoutError, SUBDOMAIN_LABEL_RE, DEFAULT_JSON_OK_STATUSES, FetchproxyServer;
+var FetchproxyProtocolError, FetchproxyHttpError, FetchproxyBridgeDownError, FetchproxyHintedError, FetchproxyScopeError, FetchproxyNoTabError, FetchproxyTabOpeningError, FetchproxyWaitedError, SCOPE_REJECTION, NO_TAB_REJECTION, TAB_OPENING_REJECTION, VERB_DEADLINE_GRACE_MS, FetchproxyTimeoutError, SUBDOMAIN_LABEL_RE, DEFAULT_JSON_OK_STATUSES, FetchproxyServer;
 var init_ws_server = __esm({
   "node_modules/@fetchproxy/server/dist/ws-server.js"() {
     init_dist();
@@ -13388,9 +14006,16 @@ var init_ws_server = __esm({
         this.name = "FetchproxyTabOpeningError";
       }
     };
+    FetchproxyWaitedError = class extends FetchproxyHintedError {
+      constructor(originalError, op) {
+        super(originalError, waitedHint(op));
+        this.name = "FetchproxyWaitedError";
+      }
+    };
     SCOPE_REJECTION = /not in declared/;
     NO_TAB_REJECTION = /no tab matching (?!.*(content script loaded|one is still opening))/;
     TAB_OPENING_REJECTION = /no tab matching .*one is still opening/;
+    VERB_DEADLINE_GRACE_MS = 15e3;
     FetchproxyTimeoutError = class extends FetchproxyProtocolError {
       url;
       timeoutMs;
@@ -13409,16 +14034,20 @@ var init_ws_server = __esm({
        */
       retryAttempted;
       /**
-       * 2.4.2+ (#277): what the CALL asked for, when that is more than the
-       * deadline that actually fired. A per-call `timeoutMs` is forwarded to the
-       * extension but does not raise this server's `fetchTimeoutMs`, so the
-       * shorter deadline wins — and used to report only its own number, a value
-       * the caller never supplied, from an option the message never named.
+       * 2.4.2+ (#277): what the CALL asked for, whenever it asked for anything.
+       *
+       * Until #237 this was recorded only when the call asked for MORE than the
+       * deadline, because asking for more is what the cap silently ignored. The
+       * cap is gone — the call's own `timeoutMs` now GOVERNS its deadline
+       * (`verbDeadlineMs`) — so the interesting case inverted: a timeout here
+       * means the bridge did not answer within the window the CALLER chose, and
+       * the message says which number that was and where it came from.
        */
       requestedTimeoutMs;
       constructor(args) {
-        const capped = args.requestedTimeoutMs !== void 0 && args.requestedTimeoutMs > args.timeoutMs;
-        super(`fetchproxy: ${args.url} did not respond within ${args.timeoutMs}ms` + (capped ? ` \u2014 that is this server's fetchTimeoutMs, not the ${args.requestedTimeoutMs}ms this call asked for. A per-call timeoutMs cannot exceed it; raise fetchTimeoutMs on the transport to wait longer.` : ""));
+        const graceMs = args.graceMs ?? VERB_DEADLINE_GRACE_MS;
+        const callerChose = args.requestedTimeoutMs !== void 0 && args.timeoutMs === args.requestedTimeoutMs + graceMs;
+        super(`fetchproxy: ${args.url} did not respond within ${args.timeoutMs}ms` + (callerChose ? ` \u2014 the ${args.requestedTimeoutMs}ms this call asked for, plus ${graceMs}ms for the reply to reach this server. The extension runs its own timer on the value you passed, so a window that is genuinely too short reports what did not happen rather than this.` : ""));
         this.name = "FetchproxyTimeoutError";
         this.url = args.url;
         this.timeoutMs = args.timeoutMs;
@@ -13516,6 +14145,11 @@ var init_ws_server = __esm({
         if (!Array.isArray(opts.domains) || opts.domains.length === 0) {
           throw new Error("FetchproxyServer: opts.domains must be a non-empty array of hostnames");
         }
+        for (const d of opts.domains) {
+          if (typeof d === "string" && isPublicSuffix(d)) {
+            throw new Error(`FetchproxyServer: opts.domains entry ${JSON.stringify(d)} is a public suffix \u2014 declare a registrable domain (e.g. "example.${d}"), not the suffix every site under it shares`);
+          }
+        }
         let capabilities;
         if (opts.capabilities === void 0) {
           capabilities = ["fetch"];
@@ -13581,6 +14215,7 @@ var init_ws_server = __esm({
           // back-door is `0` (explicit opt-out) if a caller genuinely wants
           // the legacy hang-forever / fail-once-on-SW-eviction behavior.
           fetchTimeoutMs: opts.fetchTimeoutMs ?? 3e4,
+          verbDeadlineGraceMs: opts.verbDeadlineGraceMs ?? VERB_DEADLINE_GRACE_MS,
           bridgeReviveDelayMs: opts.bridgeReviveDelayMs ?? 2e3,
           // 0.10.0+ (#72): keep-alive defaults to 25s — round-3 #71 cohort
           // wave showed every Pattern A consumer was opting into this same
@@ -13599,6 +14234,7 @@ var init_ws_server = __esm({
           keepAliveIntervalMs: opts.keepAliveIntervalMs ?? 2e4,
           keepAliveMaxIdleMs: opts.keepAliveMaxIdleMs ?? 5 * 60 * 1e3,
           identityDir: opts.identityDir,
+          trustDir: opts.trustDir,
           allowNewExtensionIdentity: opts.allowNewExtensionIdentity,
           requireExtensionIdentity: opts.requireExtensionIdentity,
           onPairCode: opts.onPairCode
@@ -13875,7 +14511,9 @@ var init_ws_server = __esm({
       }
       /**
        * #208: this MCP's pin on the extension's identity, stored beside its own
-       * identity key and so following `identityDir` wherever the caller put it.
+       * identity key and so following `identityDir` wherever the caller put it —
+       * unless `trustDir` (or `FETCHPROXY_TRUST_DIR`) says otherwise, which is
+       * what a host that provisions the identity read-only has to say.
        *
        * `allowNewExtensionIdentity` falls back to an environment variable when the
        * caller expressed no opinion, because the thirteen MCPs that construct this
@@ -13887,6 +14525,7 @@ var init_ws_server = __esm({
         return fileExtensionTrust({
           serverName: this.opts.serverName,
           dir: this.opts.identityDir,
+          trustDir: this.opts.trustDir,
           allowNew: allowNewExtensionIdentity(this.opts.allowNewExtensionIdentity)
         });
       }
@@ -14049,9 +14688,11 @@ var init_ws_server = __esm({
         return pending;
       }
       async _withVerbTimeout(pending, pendingMap, id, url2, requestedTimeoutMs) {
-        const timeoutMs = this.opts.fetchTimeoutMs;
-        if (timeoutMs === void 0 || timeoutMs <= 0)
+        const transportMs = this.opts.fetchTimeoutMs;
+        if (transportMs === void 0 || transportMs <= 0)
           return pending;
+        const graceMs = this.opts.verbDeadlineGraceMs;
+        const timeoutMs = verbDeadlineMs(transportMs, requestedTimeoutMs, graceMs);
         let timer;
         const start = Date.now();
         try {
@@ -14067,6 +14708,7 @@ var init_ws_server = __esm({
                   port: this.opts.port,
                   elapsedMs: Date.now() - start,
                   retryAttempted: false,
+                  graceMs,
                   ...requestedTimeoutMs !== void 0 ? { requestedTimeoutMs } : {}
                 }));
               }, timeoutMs);
@@ -14127,9 +14769,9 @@ var init_ws_server = __esm({
         if (opts.subdomain !== void 0)
           assertSubdomainLabel(opts.subdomain);
         const baseDomain = this.resolveBaseDomain(opts.domain);
-        const isAbsolute2 = path.startsWith("http://") || path.startsWith("https://");
+        const isAbsolute3 = path.startsWith("http://") || path.startsWith("https://");
         let host;
-        if (isAbsolute2) {
+        if (isAbsolute3) {
           try {
             host = new URL(path).host;
           } catch {
@@ -14138,7 +14780,7 @@ var init_ws_server = __esm({
         } else {
           host = opts.subdomain ? `${opts.subdomain}.${baseDomain}` : baseDomain;
         }
-        const url2 = isAbsolute2 ? path : `https://${host}${path}`;
+        const url2 = isAbsolute3 ? path : `https://${host}${path}`;
         assertUrlInDomains("request url", url2, this.opts.domains);
         let tabUrl = `https://${host}/`;
         if (opts.viaTab !== void 0) {
@@ -14627,8 +15269,9 @@ var init_ws_server = __esm({
           this.pendingCapture,
           id,
           `https://${opts.host}${opts.path ?? "/*"}`,
-          // #277: not to extend the deadline — so a timeout can say the deadline,
-          // and not the value asked for here, is what fired.
+          // #237: this GOVERNS the deadline (window + reply grace, floored at the
+          // transport bound). Under #277 it did not, and was passed only so the
+          // timeout could name the number that actually fired.
           opts.timeoutMs
         );
       }
@@ -14720,8 +15363,9 @@ var init_ws_server = __esm({
           this.pendingRedirect,
           id,
           `https://${opts.host}${opts.path ?? "/*"}`,
-          // #277: not to extend the deadline — so a timeout can say the deadline,
-          // and not the value asked for here, is what fired.
+          // #237: this GOVERNS the deadline (window + reply grace, floored at the
+          // transport bound). Under #277 it did not, and was passed only so the
+          // timeout could name the number that actually fired.
           opts.timeoutMs
         );
       }
@@ -14810,10 +15454,11 @@ var init_ws_server = __esm({
           this.pendingDownload,
           id,
           opts.url,
-          // #277, same as the two capture verbs: `download` takes a per-call
-          // timeoutMs too, so it hits the identical cap and needs the identical
-          // explanation. Missing it was the point of #279 — "both verbs" was
-          // counted off the two call sites in view rather than off the type.
+          // `download` takes a per-call timeoutMs like the two capture verbs, so
+          // it is governed by it like them (#237). It used to hit the identical
+          // CAP and need the identical explanation; missing it then was the point
+          // of #279 — "both verbs" was counted off the two call sites in view
+          // rather than off the type. Three is still the number.
           opts.timeoutMs
         );
       }
@@ -15042,7 +15687,7 @@ var init_ws_server = __esm({
               captureCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on capture awaiter`));
             }
           } else {
-            captureCb.reject(protocolErrorFrom(inner.error));
+            captureCb.reject(protocolErrorFrom(inner.error, "capture"));
           }
           return;
         }
@@ -15056,7 +15701,7 @@ var init_ws_server = __esm({
               redirectCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on capture_redirect awaiter`));
             }
           } else {
-            redirectCb.reject(protocolErrorFrom(inner.error));
+            redirectCb.reject(protocolErrorFrom(inner.error, "capture_redirect"));
           }
           return;
         }
@@ -15084,7 +15729,7 @@ var init_ws_server = __esm({
               downloadCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on download awaiter`));
             }
           } else {
-            downloadCb.reject(protocolErrorFrom(inner.error));
+            downloadCb.reject(protocolErrorFrom(inner.error, "download"));
           }
           return;
         }
@@ -15187,11 +15832,21 @@ var init_ws_server = __esm({
       /**
        * 2.5.0: the extension link as {@link BridgeSessionState}, read off
        * whichever handle is live. A pending pair code outranks "extension not
-       * seen" because the code could only have come from the extension — a
-       * peer behind an older host never sees the extension hello but does see
-       * pair-pending frames. Where the extension is KNOWN to be gone (a host's
+       * seen" because a code could only have come from a `pair-pending` frame
+       * the extension sent. Where the extension is KNOWN to be gone (a host's
        * socket closed, a peer told by a 2.5.0+ host) the handle has already
        * dropped the code, so the precedence never lies there (#283).
+       *
+       * M1 (bridge review 2026-09-10): a code is now only ever present when the
+       * handle DERIVED it from both identity pubs, and both handles set and clear
+       * that derivation in lockstep with the extension hello — so the precedence
+       * has nothing left to decide: a pair code implies the hello, which implies
+       * `extensionConnected`. A peer behind a pre-1.12.0 host is relayed no
+       * extension hello, cannot derive, and therefore reports
+       * `extension_disconnected` with a null code where it used to report the
+       * wire's number as `pair_pending` — the honest state for a peer that has
+       * never been told an extension is there. That is the trade: a number nobody
+       * can check is worse than no number.
        */
       sessionSnapshot() {
         const handle = this.hostHandle ?? this.peerHandle;
@@ -22806,12 +23461,12 @@ var $ZodE164 = /* @__PURE__ */ $constructor("$ZodE164", (inst, def) => {
   $ZodStringFormat.init(inst, def);
 });
 var CC_SANITIZE = /[- ]/g;
-function isLuhnAlgo(digits) {
-  let length = digits.length;
+function isLuhnAlgo(digits2) {
+  let length = digits2.length;
   let bit = 1;
   let sum = 0;
   while (length) {
-    const value = +digits[--length];
+    const value = +digits2[--length];
     bit ^= 1;
     sum += bit ? [0, 2, 4, 6, 8, 1, 3, 5, 7, 9][value] : value;
   }
@@ -37543,8 +38198,8 @@ function hex2(_params) {
   return _stringFormat(ZodCustomStringFormat, "hex", regexes_exports.hex, _params);
 }
 function hash(alg, params) {
-  const enc5 = params?.enc ?? "hex";
-  const format = `${alg}_${enc5}`;
+  const enc7 = params?.enc ?? "hex";
+  const format = `${alg}_${enc7}`;
   const regex = regexes_exports[format];
   if (!regex)
     throw new Error(`Unrecognized hash format: ${format}`);
@@ -45018,7 +45673,7 @@ var pageSchema = {
 init_errors();
 
 // src/version.ts
-var VERSION = "0.3.1";
+var VERSION = "0.3.2";
 
 // src/client.ts
 import { dirname, join } from "path";
@@ -45577,7 +46232,7 @@ var schemaEventStatus = external_exports.enum(["all", "live", "draft", "started"
 function qs(params) {
   return params.size > 0 ? `?${params}` : "";
 }
-function enc4(id) {
+function enc6(id) {
   if (/^\.+$/.test(id)) {
     throw new McpToolError(`Invalid id '${id}'.`, {
       hint: "Ids must be Eventbrite object ids (normally digits), not path segments."
@@ -45659,7 +46314,7 @@ function registerAccountTools(server, deps) {
       if (continuation) params.set("continuation", continuation);
       const data = await client2.request(
         "GET",
-        `/organizations/${enc4(org_id)}/events/${qs(params)}`
+        `/organizations/${enc6(org_id)}/events/${qs(params)}`
       );
       return viewResponse(view, data);
     }
@@ -45682,7 +46337,7 @@ function registerAccountTools(server, deps) {
       if (continuation) params.set("continuation", continuation);
       const data = await client2.request(
         "GET",
-        `/organizations/${enc4(org_id)}/attendees/${qs(params)}`
+        `/organizations/${enc6(org_id)}/attendees/${qs(params)}`
       );
       return viewResponse(view, data);
     }
@@ -45703,7 +46358,7 @@ function registerAccountTools(server, deps) {
       if (continuation) params.set("continuation", continuation);
       const data = await client2.request(
         "GET",
-        `/organizations/${enc4(org_id)}/orders/${qs(params)}`
+        `/organizations/${enc6(org_id)}/orders/${qs(params)}`
       );
       return viewResponse(view, data);
     }
@@ -45743,7 +46398,7 @@ function registerAccountTools(server, deps) {
         if (continuation) params.set("continuation", continuation);
         return viewResponse(
           view,
-          await client2.request("GET", `/organizations/${enc4(org_id)}/${noun}/${qs(params)}`)
+          await client2.request("GET", `/organizations/${enc6(org_id)}/${noun}/${qs(params)}`)
         );
       }
     );
@@ -45773,7 +46428,7 @@ function registerAccountTools(server, deps) {
       if (continuation) params.set("continuation", continuation);
       return viewResponse(
         view,
-        await client2.request("GET", `/organizations/${enc4(org_id)}/reports/${kind}/${qs(params)}`)
+        await client2.request("GET", `/organizations/${enc6(org_id)}/reports/${kind}/${qs(params)}`)
       );
     }
   );
@@ -45877,7 +46532,7 @@ function registerEventTools(server, deps) {
       if (continuation) params.set("continuation", continuation);
       return viewResponse(
         view,
-        await client2.request("GET", `/events/${enc4(event_id)}/attendees/${qs(params)}`)
+        await client2.request("GET", `/events/${enc6(event_id)}/attendees/${qs(params)}`)
       );
     }
   );
@@ -45894,7 +46549,7 @@ function registerEventTools(server, deps) {
     },
     async ({ event_id, attendee_id, view }) => viewResponse(
       view,
-      await client2.request("GET", `/events/${enc4(event_id)}/attendees/${enc4(attendee_id)}/`)
+      await client2.request("GET", `/events/${enc6(event_id)}/attendees/${enc6(attendee_id)}/`)
     )
   );
   server.registerTool(
@@ -45917,7 +46572,7 @@ function registerEventTools(server, deps) {
       if (continuation) params.set("continuation", continuation);
       return viewResponse(
         view,
-        await client2.request("GET", `/events/${enc4(event_id)}/orders/${qs(params)}`)
+        await client2.request("GET", `/events/${enc6(event_id)}/orders/${qs(params)}`)
       );
     }
   );
@@ -45936,7 +46591,7 @@ function registerEventTools(server, deps) {
       view,
       await client2.request(
         "GET",
-        `/events/${enc4(event_id)}/ticket_classes/${enc4(ticket_class_id)}/`
+        `/events/${enc6(event_id)}/ticket_classes/${enc6(ticket_class_id)}/`
       )
     )
   );
@@ -45955,7 +46610,7 @@ function registerEventTools(server, deps) {
       view,
       await client2.request(
         "GET",
-        `/events/${enc4(event_id)}/${canned ? "canned_questions" : "questions"}/`
+        `/events/${enc6(event_id)}/${canned ? "canned_questions" : "questions"}/`
       )
     )
   );
@@ -45978,7 +46633,7 @@ function registerLookupTools(server, deps) {
     async ({ order_id, expand, view }) => {
       const params = new URLSearchParams();
       if (expand) params.set("expand", expand);
-      return viewResponse(view, await client2.request("GET", `/orders/${enc4(order_id)}/${qs(params)}`));
+      return viewResponse(view, await client2.request("GET", `/orders/${enc6(order_id)}/${qs(params)}`));
     }
   );
   server.registerTool(
@@ -45991,7 +46646,7 @@ function registerLookupTools(server, deps) {
         view: viewArg()
       }
     },
-    async ({ venue_id, view }) => viewResponse(view, await client2.request("GET", `/venues/${enc4(venue_id)}/`))
+    async ({ venue_id, view }) => viewResponse(view, await client2.request("GET", `/venues/${enc6(venue_id)}/`))
   );
   server.registerTool(
     "eb_venue_events",
@@ -46011,7 +46666,7 @@ function registerLookupTools(server, deps) {
       if (continuation) params.set("continuation", continuation);
       return viewResponse(
         view,
-        await client2.request("GET", `/venues/${enc4(venue_id)}/events/${qs(params)}`)
+        await client2.request("GET", `/venues/${enc6(venue_id)}/events/${qs(params)}`)
       );
     }
   );
@@ -46025,7 +46680,7 @@ function registerLookupTools(server, deps) {
         view: viewArg()
       }
     },
-    async ({ organizer_id, view }) => viewResponse(view, await client2.request("GET", `/organizers/${enc4(organizer_id)}/`))
+    async ({ organizer_id, view }) => viewResponse(view, await client2.request("GET", `/organizers/${enc6(organizer_id)}/`))
   );
   server.registerTool(
     "eb_organizer_events",
@@ -46047,7 +46702,7 @@ function registerLookupTools(server, deps) {
       if (continuation) params.set("continuation", continuation);
       return viewResponse(
         view,
-        await client2.request("GET", `/organizers/${enc4(organizer_id)}/events/${qs(params)}`)
+        await client2.request("GET", `/organizers/${enc6(organizer_id)}/events/${qs(params)}`)
       );
     }
   );
@@ -46069,7 +46724,7 @@ function registerLookupTools(server, deps) {
       if (continuation) params.set("continuation", continuation);
       return viewResponse(
         view,
-        await client2.request("GET", `/series/${enc4(series_id)}/events/${qs(params)}`)
+        await client2.request("GET", `/series/${enc6(series_id)}/events/${qs(params)}`)
       );
     }
   );
@@ -46083,7 +46738,7 @@ function registerLookupTools(server, deps) {
         view: viewArg()
       }
     },
-    async ({ user_id, view }) => viewResponse(view, await client2.request("GET", `/users/${enc4(user_id)}/`))
+    async ({ user_id, view }) => viewResponse(view, await client2.request("GET", `/users/${enc6(user_id)}/`))
   );
 }