@chrischall/office-outlook-mcp 0.3.1 → 0.3.2

package/dist/bundle.js

@@ -20542,10 +20542,10 @@ var init_v4 = __esm({
   }
 });
 
-// node_modules/@modelcontextprotocol/core/dist/auth-CUe6YdwF.mjs
+// node_modules/@modelcontextprotocol/server/node_modules/@modelcontextprotocol/core/dist/auth-CGP0BDVq.mjs
 var LATEST_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, RELATED_TASK_META_KEY, PROTOCOL_VERSION_META_KEY, CLIENT_INFO_META_KEY, SERVER_INFO_META_KEY, CLIENT_CAPABILITIES_META_KEY, SUBSCRIPTION_ID_META_KEY, LOG_LEVEL_META_KEY, JSONRPC_VERSION, JSONValueSchema, JSONObjectSchema, JSONArraySchema, ProgressTokenSchema, CursorSchema, TaskMetadataSchema, RelatedTaskMetadataSchema, RequestMetaSchema, BaseRequestParamsSchema, TaskAugmentedRequestParamsSchema, RequestSchema, NotificationsParamsSchema, NotificationSchema, ResultMetaObjectSchema, ResultSchema, RequestIdSchema, JSONRPCRequestSchema, JSONRPCNotificationSchema, JSONRPCResultResponseSchema, JSONRPCErrorResponseSchema, JSONRPCMessageSchema, JSONRPCResponseSchema, EmptyResultSchema, CancelledNotificationParamsSchema, CancelledNotificationSchema, IconSchema, IconsSchema, BaseMetadataSchema, ImplementationSchema, FormElicitationCapabilitySchema, ElicitationCapabilitySchema, ClientTasksCapabilitySchema, ServerTasksCapabilitySchema, ClientCapabilitiesSchema, InitializeRequestParamsSchema, InitializeRequestSchema, ServerCapabilitiesSchema, InitializeResultSchema, InitializedNotificationSchema, DiscoverRequestSchema, DiscoverResultSchema, PingRequestSchema, ProgressSchema, ProgressNotificationParamsSchema, ProgressNotificationSchema, PaginatedRequestParamsSchema, PaginatedRequestSchema, PaginatedResultSchema, ResourceContentsSchema, TextResourceContentsSchema, Base64Schema, BlobResourceContentsSchema, RoleSchema, AnnotationsSchema, ResourceSchema, ResourceTemplateSchema, ListResourcesRequestSchema, ListResourcesResultSchema, ListResourceTemplatesRequestSchema, ListResourceTemplatesResultSchema, ResourceRequestParamsSchema, ReadResourceRequestParamsSchema, ReadResourceRequestSchema, ReadResourceResultSchema, ResourceListChangedNotificationSchema, SubscribeRequestParamsSchema, SubscribeRequestSchema, UnsubscribeRequestParamsSchema, UnsubscribeRequestSchema, SubscriptionFilterSchema, SubscriptionsListenRequestParamsSchema, SubscriptionsListenRequestSchema, SubscriptionsAcknowledgedNotificationParamsSchema, SubscriptionsAcknowledgedNotificationSchema, SubscriptionsListenResultMetaSchema, SubscriptionsListenResultSchema, ResourceUpdatedNotificationParamsSchema, ResourceUpdatedNotificationSchema, PromptArgumentSchema, PromptSchema, ListPromptsRequestSchema, ListPromptsResultSchema, GetPromptRequestParamsSchema, GetPromptRequestSchema, TextContentSchema, ImageContentSchema, AudioContentSchema, ToolUseContentSchema, EmbeddedResourceSchema, ResourceLinkSchema, ContentBlockSchema, PromptMessageSchema, GetPromptResultSchema, PromptListChangedNotificationSchema, ToolAnnotationsSchema, ToolExecutionSchema, ToolSchema, ListToolsRequestSchema, ListToolsResultSchema, CallToolResultSchema, CompatibilityCallToolResultSchema, CallToolRequestParamsSchema, CallToolRequestSchema, ToolListChangedNotificationSchema, ListChangedOptionsBaseSchema, LoggingLevelSchema, SetLevelRequestParamsSchema, SetLevelRequestSchema, LoggingMessageNotificationParamsSchema, LoggingMessageNotificationSchema, ModelHintSchema, ModelPreferencesSchema, ToolChoiceSchema, ToolResultContentSchema, SamplingContentSchema, SamplingMessageContentBlockSchema, SamplingMessageSchema, CreateMessageRequestParamsSchema, CreateMessageRequestSchema, CreateMessageResultSchema, CreateMessageResultWithToolsSchema, BooleanSchemaSchema, StringSchemaSchema, NumberSchemaSchema, UntitledSingleSelectEnumSchemaSchema, TitledSingleSelectEnumSchemaSchema, LegacyTitledEnumSchemaSchema, SingleSelectEnumSchemaSchema, UntitledMultiSelectEnumSchemaSchema, TitledMultiSelectEnumSchemaSchema, MultiSelectEnumSchemaSchema, EnumSchemaSchema, PrimitiveSchemaDefinitionSchema, ElicitRequestFormParamsSchema, ElicitRequestURLParamsSchema, ElicitRequestParamsSchema, ElicitRequestSchema, ElicitationCompleteNotificationParamsSchema, ElicitationCompleteNotificationSchema, ElicitResultSchema, ResourceTemplateReferenceSchema, PromptReferenceSchema, CompleteRequestParamsSchema, CompleteRequestSchema, CompleteResultSchema, RootSchema, ListRootsRequestSchema, ListRootsResultSchema, RootsListChangedNotificationSchema, TaskCreationParamsSchema, TaskStatusSchema, TaskSchema, CreateTaskResultSchema, TaskStatusNotificationParamsSchema, TaskStatusNotificationSchema, GetTaskRequestSchema, GetTaskResultSchema, GetTaskPayloadRequestSchema, GetTaskPayloadResultSchema, ListTasksRequestSchema, ListTasksResultSchema, CancelTaskRequestSchema, CancelTaskResultSchema, ClientRequestSchema, ClientNotificationSchema, ClientResultSchema, ServerRequestSchema, ServerNotificationSchema, ServerResultSchema, SafeUrlSchema, OAuthProtectedResourceMetadataSchema, OAuthMetadataSchema, OpenIdProviderMetadataSchema, OpenIdProviderDiscoveryMetadataSchema, OAuthTokensSchema, IdJagTokenExchangeResponseSchema, OAuthErrorResponseSchema, OptionalSafeUrlSchema, OAuthClientMetadataSchema, OAuthClientInformationSchema, OAuthClientInformationFullSchema, OAuthClientRegistrationErrorSchema, OAuthTokenRevocationRequestSchema;
-var init_auth_CUe6YdwF = __esm({
-  "node_modules/@modelcontextprotocol/core/dist/auth-CUe6YdwF.mjs"() {
+var init_auth_CGP0BDVq = __esm({
+  "node_modules/@modelcontextprotocol/server/node_modules/@modelcontextprotocol/core/dist/auth-CGP0BDVq.mjs"() {
     init_v4();
     LATEST_PROTOCOL_VERSION = "2025-11-25";
     SUPPORTED_PROTOCOL_VERSIONS = [
@@ -21383,7 +21383,8 @@ var init_auth_CUe6YdwF = __esm({
       introspection_endpoint_auth_signing_alg_values_supported: array(string2()).optional(),
       code_challenge_methods_supported: array(string2()).optional(),
       client_id_metadata_document_supported: boolean2().optional(),
-      authorization_response_iss_parameter_supported: boolean2().optional().catch(void 0)
+      authorization_response_iss_parameter_supported: boolean2().optional().catch(void 0),
+      dpop_signing_alg_values_supported: array(string2()).optional()
     });
     OpenIdProviderMetadataSchema = looseObject({
       issuer: string2(),
@@ -21486,14 +21487,14 @@ var init_auth_CUe6YdwF = __esm({
   }
 });
 
-// node_modules/@modelcontextprotocol/core/dist/internal.mjs
+// node_modules/@modelcontextprotocol/server/node_modules/@modelcontextprotocol/core/dist/internal.mjs
 var init_internal = __esm({
-  "node_modules/@modelcontextprotocol/core/dist/internal.mjs"() {
-    init_auth_CUe6YdwF();
+  "node_modules/@modelcontextprotocol/server/node_modules/@modelcontextprotocol/core/dist/internal.mjs"() {
+    init_auth_CGP0BDVq();
   }
 });
 
-// node_modules/@modelcontextprotocol/server/dist/src-CX2iR2pK.mjs
+// node_modules/@modelcontextprotocol/server/dist/src-D-y6h4N7.mjs
 function stampErrorBrands(instance, ctor) {
   const brands = /* @__PURE__ */ new Set();
   let current = ctor;
@@ -24265,8 +24266,8 @@ function normalizeRawShapeSchema(schema) {
   return schema;
 }
 var BRANDS, OAuthError, SdkErrorCode, SdkError, SdkHttpError, FIRST_MODERN_PROTOCOL_VERSION, SUPPORTED_MODERN_PROTOCOL_VERSIONS, TOOL_RESULT_FOREIGN_FAMILY_KEYS, memo$1, REF_REWRITE_DATA_POSITION_KEYS, REF_REWRITE_NAME_MAP_KEYS, requestMethodKeys$1, notificationMethodKeys$1, resultMethodKeys, maps$1, rev2025RequestMethods, rev2025NotificationMethods, NOT_IN_ERA$1, rev2025Codec, memo2, CACHEABLE_RESULT_METHODS, RESULT_CACHE_HINT_FALLBACK, ProtocolErrorCode, ProtocolError, ResourceNotFoundError, UrlElicitationRequiredError, UnsupportedProtocolVersionError, MissingRequiredClientCapabilityError, DEFAULT_CACHE_TTL_MS, DEFAULT_CACHE_SCOPE, EXTENDED_RESULT_TYPE_METHODS, INPUT_REQUEST_METHODS_2026, maps, requestMethodKeys, notificationMethodKeys, rev2026RequestMethods, rev2026NotificationMethods, NOT_IN_ERA, REQUIRED_ENVELOPE_KEYS, rev2026Codec, wireResultSchemasMemo, MODERN_WIRE_REVISION, ALL_CODECS, schemas_exports3, isJSONRPCRequest, isJSONRPCNotification, isJSONRPCResultResponse, isJSONRPCErrorResponse, isInputRequiredResult, X_MCP_HEADER_KEY, RFC9110_TOKEN, PERMITTED_X_MCP_HEADER_TYPES, NON_REACHABLE_SUBSCHEMA_KEYWORDS, OBJECT_VALUED_SUBSCHEMA_KEYWORDS, HEADER_MISMATCH_ERROR_CODE, INBOUND_VALIDATION_LADDER, LADDER_ERROR_HTTP_STATUS, warnedZodFallback, JSON_SCHEMA_CONVERSION_TARGET, DATETIME_FRACTION_DIGITS, ANNOTATION_ONLY_JSON_SCHEMA_KEYWORDS, ROOT_KEYS, PROPERTY_KEYS_BY_TYPE, SUPPORTED_STRING_FORMATS, inputRequired, REQUEST_STATE_ONLY_LEG_PACING_MS, SPEC_SCHEMA_KEYS, authSchemas, _specTypeSchemas, _isSpecType, specTypeSchemas, isSpecType, DEFAULT_REQUEST_TIMEOUT_MSEC, RESERVED_ENVELOPE_META_KEYS, RETRY_PARAMS_KEYS, NO_REQUEST_STATE, writeNegotiatedProtocolVersion, Protocol, require_content_type, import_content_type, STDIO_DEFAULT_MAX_BUFFER_SIZE, ReadBuffer, TOOL_NAME_REGEX;
-var init_src_CX2iR2pK = __esm({
-  "node_modules/@modelcontextprotocol/server/dist/src-CX2iR2pK.mjs"() {
+var init_src_D_y6h4N7 = __esm({
+  "node_modules/@modelcontextprotocol/server/dist/src-D-y6h4N7.mjs"() {
     init_chunk_Br0eD_fh();
     init_dialects_DoSzNhcb();
     init_internal();
@@ -24359,8 +24360,18 @@ var init_src_CX2iR2pK = __esm({
         if (typeof this !== "function") throw new TypeError("isInstance must be called on the class (e.g. `SdkError.isInstance(value)`); for callbacks use `v => SdkError.isInstance(v)`");
         return brandedHasInstance(this, value);
       }
-      constructor(code, message, data) {
-        super(message);
+      /**
+      * @param code - Stable string code identifying the failure ({@linkcode SdkErrorCode}).
+      * @param message - Human-readable description.
+      * @param data - Optional structured payload (for example the HTTP status carried by
+      * {@linkcode SdkHttpError}). Opaque to the SDK: a `cause` key inside `data` is not
+      * promoted to `Error.cause`.
+      * @param options - Standard `ErrorOptions`, forwarded to `Error`. Pass the underlying
+      * failure as `{ cause }` so it is reachable through the `Error.cause` chain that
+      * loggers and error trackers walk.
+      */
+      constructor(code, message, data, options) {
+        super(message, options);
         this.code = code;
         this.data = data;
         this.name = "SdkError";
@@ -24371,8 +24382,11 @@ var init_src_CX2iR2pK = __esm({
       static {
         Object.defineProperty(this, "mcpBrand", { value: "mcp.SdkHttpError" });
       }
-      constructor(code, message, data) {
-        super(code, message, data);
+      /**
+      * @param options - Standard `ErrorOptions`, forwarded to `Error` (see {@linkcode SdkError}).
+      */
+      constructor(code, message, data, options) {
+        super(code, message, data, options);
         this.name = "SdkHttpError";
       }
       get status() {
@@ -25070,7 +25084,7 @@ var init_src_CX2iR2pK = __esm({
         evaluatedAt: "pre-dispatch",
         codes: [HEADER_MISMATCH_ERROR_CODE],
         conformance: ["http-header-validation"],
-        rationale: "SEP-2243 standard `Mcp-Method` / `Mcp-Name` headers \u2014 presence, sentinel decoding, and `Mcp-Name` \u2194 body cross-check \u2014 are validated by the HTTP entry on a modern-classified request after the supported-revision gate and before dispatch. The classifier\u2019s own header-mismatch cells (protocol-version, `Mcp-Method` mismatch) stay on the edge `era-classification` rung; this rung carries the entry-layer presence/`Mcp-Name` half. Evaluated before the capability gate, the factory call, and the `Mcp-Param-*` rung so a request that fails several rungs is answered by the standard-header rung first. The documented order (after method-registry 5 and request-params 6) is NOT the observed precedence: serveModern evaluates this rung immediately after the supported-revision gate, so a request that also fails a dispatch rung is answered here before the dispatch rungs (5\u20136) are consulted."
+        rationale: "SEP-2243 standard `MCP-Protocol-Version` / `Mcp-Method` / `Mcp-Name` headers \u2014 presence, sentinel decoding, and `Mcp-Name` \u2194 body cross-check \u2014 are validated by the HTTP entry on a modern-classified request after the supported-revision gate and before dispatch. The spec requires `MCP-Protocol-Version` and `Mcp-Method` on every modern *request* POST (`Mcp-Name` only for the methods that mirror `params.name` / `params.uri` / `params.taskId`, see `MCP_NAME_HEADER_SOURCE`) and names them in that order, so a request missing several is answered by the earliest. Notification POSTs are exempt: the presence half runs on requests only, so a modern-enveloped notification is dispatched even with no standard headers at all. The classifier\u2019s own header-mismatch cells (protocol-version, `Mcp-Method` mismatch) stay on the edge `era-classification` rung; this rung carries the entry-layer presence/`Mcp-Name` half \u2014 including the missing `MCP-Protocol-Version` cell, which cannot live on the edge rung without breaking body-primary classification. Evaluated before the capability gate, the factory call, and the `Mcp-Param-*` rung so a request that fails several rungs is answered by the standard-header rung first. The documented order (after method-registry 5 and request-params 6) is NOT the observed precedence: serveModern evaluates this rung immediately after the supported-revision gate, so a request that also fails a dispatch rung is answered here before the dispatch rungs (5\u20136) are consulted."
       },
       {
         rung: "client-capabilities",
@@ -25486,7 +25500,7 @@ var init_src_CX2iR2pK = __esm({
         return this._requestHandlers.get(method);
       }
       async _oncancel(notification) {
-        if (!notification.params.requestId) return;
+        if (notification.params.requestId === void 0) return;
         this._requestHandlerAbortControllers.get(notification.params.requestId)?.abort(notification.params.reason);
       }
       _setupTimeout(messageId, timeout, maxTotalTimeout, onTimeout, resetTimeoutOnProgress = false) {
@@ -25885,19 +25899,20 @@ var init_src_CX2iR2pK = __esm({
           const cancel = (reason) => {
             if (responseReceived) return;
             this._progressHandlers.delete(messageId);
-            if (requestAbort === void 0) this._transport?.send(this._envelopeOutbound({
-              jsonrpc: "2.0",
-              method: "notifications/cancelled",
-              params: {
-                requestId: messageId,
-                reason: String(reason)
-              }
-            }), {
-              relatedRequestId,
-              resumptionToken,
-              onresumptiontoken
-            }).catch((error62) => this._onerror(/* @__PURE__ */ new Error(`Failed to send cancellation: ${error62}`)));
-            else requestAbort.abort();
+            if (requestAbort === void 0) {
+              if (request.method !== "initialize") this._transport?.send(this._envelopeOutbound({
+                jsonrpc: "2.0",
+                method: "notifications/cancelled",
+                params: {
+                  requestId: messageId,
+                  reason: String(reason)
+                }
+              }), {
+                relatedRequestId,
+                resumptionToken,
+                onresumptiontoken
+              }).catch((error62) => this._onerror(/* @__PURE__ */ new Error(`Failed to send cancellation: ${error62}`)));
+            } else requestAbort.abort();
             reject(reason instanceof SdkError ? reason : new SdkError(SdkErrorCode.RequestTimeout, String(reason)));
           };
           this._responseHandlers.set(messageId, (response) => {
@@ -25977,7 +25992,7 @@ var init_src_CX2iR2pK = __esm({
           jsonrpc: "2.0",
           ...notification
         });
-        if ((this._options?.debouncedNotificationMethods ?? []).includes(notification.method) && !notification.params && !options?.relatedRequestId) {
+        if ((this._options?.debouncedNotificationMethods ?? []).includes(notification.method) && !notification.params && options?.relatedRequestId === void 0) {
           if (this._pendingDebouncedNotifications.has(notification.method)) return;
           this._pendingDebouncedNotifications.add(notification.method);
           Promise.resolve().then(() => {
@@ -33181,7 +33196,7 @@ var init_shimsNode = __esm({
   }
 });
 
-// node_modules/@modelcontextprotocol/server/dist/mcp-DXXb3Vv3.mjs
+// node_modules/@modelcontextprotocol/server/dist/mcp-Dw2OlZ1f.mjs
 function isCompletable(schema) {
   return !!schema && typeof schema === "object" && COMPLETABLE_SYMBOL in schema;
 }
@@ -33240,6 +33255,9 @@ function notificationToServerEvent(method, uri) {
       };
   }
 }
+function supportsScopeChallengeResolver(transport) {
+  return typeof transport === "object" && transport !== null && "setScopeChallengeResolver" in transport && typeof transport.setScopeChallengeResolver === "function";
+}
 function resolveLegacyShimOptions(options) {
   if (options?.maxRounds !== void 0 && (!Number.isInteger(options.maxRounds) || options.maxRounds < 1)) throw new RangeError(`inputRequired.maxRounds must be a positive integer (got ${options.maxRounds})`);
   if (options?.roundTimeoutMs !== void 0 && (!Number.isFinite(options.roundTimeoutMs) || options.roundTimeoutMs <= 0)) throw new RangeError(`inputRequired.roundTimeoutMs must be a positive number (got ${options.roundTimeoutMs})`);
@@ -33338,9 +33356,9 @@ function unwrapOptionalSchema(schema) {
   return schema.def?.innerType ?? schema;
 }
 var COMPLETABLE_SYMBOL, MAX_TIMER_DELAY_MS, DEFAULT_MAX_SUBSCRIPTIONS, CHANGE_NOTIFICATION_METHODS, StdioListenRouter, DEFAULT_LEGACY_SHIM_MAX_ROUNDS, DEFAULT_LEGACY_SHIM_ROUND_TIMEOUT_MS, LegacyInputRequiredShim, INPUT_REQUIRED_CAPABLE_METHODS, writeClientIdentity, installDiscoverHandler, readServerIdentity, Server, McpServer, EMPTY_OBJECT_JSON_SCHEMA, EMPTY_COMPLETION_RESULT;
-var init_mcp_DXXb3Vv3 = __esm({
-  "node_modules/@modelcontextprotocol/server/dist/mcp-DXXb3Vv3.mjs"() {
-    init_src_CX2iR2pK();
+var init_mcp_Dw2OlZ1f = __esm({
+  "node_modules/@modelcontextprotocol/server/dist/mcp-Dw2OlZ1f.mjs"() {
+    init_src_D_y6h4N7();
     init_shimsNode();
     COMPLETABLE_SYMBOL = /* @__PURE__ */ Symbol.for("mcp.completable");
     MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
@@ -34235,6 +34253,7 @@ var init_mcp_DXXb3Vv3 = __esm({
       * ```
       */
       async connect(transport) {
+        if (supportsScopeChallengeResolver(transport)) transport.setScopeChallengeResolver((context) => this.resolveScopeChallenge(context));
         return await this.server.connect(transport);
       }
       /**
@@ -34243,6 +34262,41 @@ var init_mcp_DXXb3Vv3 = __esm({
       async close() {
         await this.server.close();
       }
+      /** @internal */
+      resolveScopeChallenge = (context) => {
+        switch (context.request.method) {
+          case "tools/call": {
+            const toolName = context.request.params?.name;
+            if (typeof toolName !== "string") return;
+            const tool = this._registeredTools[toolName];
+            if (tool === void 0 || !tool.enabled) return;
+            return tool.scopeChallenge?.(context);
+          }
+          case "resources/read": {
+            const resourceUri = context.request.params?.uri;
+            if (typeof resourceUri !== "string") return;
+            let uri;
+            try {
+              uri = new URL(resourceUri);
+            } catch {
+              return;
+            }
+            const resource = this._registeredResources[uri.toString()];
+            if (resource !== void 0) return resource.enabled ? resource.scopeChallenge?.(context) : void 0;
+            for (const template of Object.values(this._registeredResourceTemplates)) if (template.resourceTemplate.uriTemplate.match(uri.toString())) return template.enabled ? template.scopeChallenge?.(context) : void 0;
+            return;
+          }
+          case "prompts/get": {
+            const promptName = context.request.params?.name;
+            if (typeof promptName !== "string") return;
+            const prompt = this._registeredPrompts[promptName];
+            if (prompt === void 0 || !prompt.enabled) return;
+            return prompt.scopeChallenge?.(context);
+          }
+          default:
+            return;
+        }
+      };
       _toolHandlersInitialized = false;
       setToolRequestHandlers() {
         if (this._toolHandlersInitialized) return;
@@ -34409,7 +34463,10 @@ var init_mcp_DXXb3Vv3 = __esm({
           }
           for (const template of Object.values(this._registeredResourceTemplates)) {
             const variables = template.resourceTemplate.uriTemplate.match(uri.toString());
-            if (variables) return attachCacheHintFallback(await template.readCallback(uri, variables, ctx), template.cacheHint);
+            if (variables) {
+              if (!template.enabled) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Resource template ${template.resourceTemplate.uriTemplate} disabled`);
+              return attachCacheHintFallback(await template.readCallback(uri, variables, ctx), template.cacheHint);
+            }
           }
           throw new ResourceNotFoundError(request.params.uri);
         });
@@ -34440,36 +34497,32 @@ var init_mcp_DXXb3Vv3 = __esm({
         this._promptHandlersInitialized = true;
       }
       registerResource(name, uriOrTemplate, config2, readCallback) {
-        const cacheHint = config2.cacheHint;
-        let metadata = config2;
-        if (cacheHint !== void 0) {
-          assertValidCacheHint(cacheHint, `resource ${name}`);
-          const rest = { ...config2 };
-          delete rest.cacheHint;
-          metadata = rest;
-        }
+        const { cacheHint, scopeChallenge, ...resourceMetadata } = config2;
+        const metadata = resourceMetadata;
+        if (cacheHint !== void 0) assertValidCacheHint(cacheHint, `resource ${name}`);
         if (typeof uriOrTemplate === "string") {
           if (this._registeredResources[uriOrTemplate]) throw new Error(`Resource ${uriOrTemplate} is already registered`);
-          const registeredResource = this._createRegisteredResource(name, config2.title, uriOrTemplate, metadata, readCallback);
+          const registeredResource = this._createRegisteredResource(name, config2.title, uriOrTemplate, metadata, scopeChallenge, readCallback);
           if (cacheHint !== void 0) registeredResource.cacheHint = cacheHint;
           this.setResourceRequestHandlers();
           this.sendResourceListChanged();
           return registeredResource;
         } else {
           if (this._registeredResourceTemplates[name]) throw new Error(`Resource template ${name} is already registered`);
-          const registeredResourceTemplate = this._createRegisteredResourceTemplate(name, config2.title, uriOrTemplate, metadata, readCallback);
+          const registeredResourceTemplate = this._createRegisteredResourceTemplate(name, config2.title, uriOrTemplate, metadata, scopeChallenge, readCallback);
           if (cacheHint !== void 0) registeredResourceTemplate.cacheHint = cacheHint;
           this.setResourceRequestHandlers();
           this.sendResourceListChanged();
           return registeredResourceTemplate;
         }
       }
-      _createRegisteredResource(name, title, uri, metadata, readCallback) {
+      _createRegisteredResource(name, title, uri, metadata, scopeChallenge, readCallback) {
         const registeredResource = {
           name,
           title,
           metadata,
           readCallback,
+          scopeChallenge,
           enabled: true,
           disable: () => registeredResource.update({ enabled: false }),
           enable: () => registeredResource.update({ enabled: true }),
@@ -34483,6 +34536,7 @@ var init_mcp_DXXb3Vv3 = __esm({
             if (updates.title !== void 0) registeredResource.title = updates.title;
             if (updates.metadata !== void 0) registeredResource.metadata = updates.metadata;
             if (updates.callback !== void 0) registeredResource.readCallback = updates.callback;
+            if (updates.scopeChallenge !== void 0) registeredResource.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
             if (updates.enabled !== void 0) registeredResource.enabled = updates.enabled;
             this.sendResourceListChanged();
           }
@@ -34490,12 +34544,13 @@ var init_mcp_DXXb3Vv3 = __esm({
         this._registeredResources[uri] = registeredResource;
         return registeredResource;
       }
-      _createRegisteredResourceTemplate(name, title, template, metadata, readCallback) {
+      _createRegisteredResourceTemplate(name, title, template, metadata, scopeChallenge, readCallback) {
         const registeredResourceTemplate = {
           resourceTemplate: template,
           title,
           metadata,
           readCallback,
+          scopeChallenge,
           enabled: true,
           disable: () => registeredResourceTemplate.update({ enabled: false }),
           enable: () => registeredResourceTemplate.update({ enabled: true }),
@@ -34509,6 +34564,7 @@ var init_mcp_DXXb3Vv3 = __esm({
             if (updates.template !== void 0) registeredResourceTemplate.resourceTemplate = updates.template;
             if (updates.metadata !== void 0) registeredResourceTemplate.metadata = updates.metadata;
             if (updates.callback !== void 0) registeredResourceTemplate.readCallback = updates.callback;
+            if (updates.scopeChallenge !== void 0) registeredResourceTemplate.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
             if (updates.enabled !== void 0) registeredResourceTemplate.enabled = updates.enabled;
             this.sendResourceListChanged();
           }
@@ -34518,7 +34574,7 @@ var init_mcp_DXXb3Vv3 = __esm({
         if (Array.isArray(variableNames) && variableNames.some((v) => !!template.completeCallback(v))) this.setCompletionRequestHandler();
         return registeredResourceTemplate;
       }
-      _createRegisteredPrompt(name, title, description, argsSchema, callback, icons, _meta) {
+      _createRegisteredPrompt(name, title, description, argsSchema, callback, icons, scopeChallenge, _meta) {
         let currentArgsSchema = argsSchema;
         let currentCallback = callback;
         const registeredPrompt = {
@@ -34526,6 +34582,7 @@ var init_mcp_DXXb3Vv3 = __esm({
           description,
           argsSchema,
           icons,
+          scopeChallenge,
           _meta,
           handler: createPromptHandler(name, argsSchema, callback),
           enabled: true,
@@ -34540,6 +34597,7 @@ var init_mcp_DXXb3Vv3 = __esm({
             if (updates.title !== void 0) registeredPrompt.title = updates.title;
             if (updates.description !== void 0) registeredPrompt.description = updates.description;
             if (updates.icons !== void 0) registeredPrompt.icons = updates.icons;
+            if (updates.scopeChallenge !== void 0) registeredPrompt.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
             if (updates._meta !== void 0) registeredPrompt._meta = updates._meta;
             let needsHandlerRegen = false;
             if (updates.argsSchema !== void 0) {
@@ -34567,7 +34625,7 @@ var init_mcp_DXXb3Vv3 = __esm({
         }
         return registeredPrompt;
       }
-      _createRegisteredTool(name, title, description, inputSchema, outputSchema, annotations, icons, execution, _meta, handler) {
+      _createRegisteredTool(name, title, description, inputSchema, outputSchema, annotations, icons, execution, scopeChallenge, _meta, handler) {
         validateAndWarnToolName(name);
         if (inputSchema !== void 0) try {
           const json2 = standardSchemaToJsonSchema(inputSchema, "input");
@@ -34586,6 +34644,7 @@ var init_mcp_DXXb3Vv3 = __esm({
           annotations,
           icons,
           execution,
+          scopeChallenge,
           _meta,
           handler,
           executor: createToolExecutor(inputSchema, handler),
@@ -34624,6 +34683,7 @@ var init_mcp_DXXb3Vv3 = __esm({
             }
             if (updates.annotations !== void 0) registeredTool.annotations = updates.annotations;
             if (updates.icons !== void 0) registeredTool.icons = updates.icons;
+            if (updates.scopeChallenge !== void 0) registeredTool.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
             if (updates._meta !== void 0) registeredTool._meta = updates._meta;
             if (updates.enabled !== void 0) registeredTool.enabled = updates.enabled;
             this.sendToolListChanged();
@@ -34636,13 +34696,13 @@ var init_mcp_DXXb3Vv3 = __esm({
       }
       registerTool(name, config2, cb) {
         if (this._registeredTools[name]) throw new Error(`Tool ${name} is already registered`);
-        const { title, description, inputSchema, outputSchema, annotations, icons, _meta } = config2;
-        return this._createRegisteredTool(name, title, description, normalizeRawShapeSchema(inputSchema), normalizeRawShapeSchema(outputSchema), annotations, icons, void 0, _meta, cb);
+        const { title, description, inputSchema, outputSchema, annotations, icons, scopeChallenge, _meta } = config2;
+        return this._createRegisteredTool(name, title, description, normalizeRawShapeSchema(inputSchema), normalizeRawShapeSchema(outputSchema), annotations, icons, void 0, scopeChallenge, _meta, cb);
       }
       registerPrompt(name, config2, cb) {
         if (this._registeredPrompts[name]) throw new Error(`Prompt ${name} is already registered`);
-        const { title, description, argsSchema, icons, _meta } = config2;
-        const registeredPrompt = this._createRegisteredPrompt(name, title, description, normalizeRawShapeSchema(argsSchema), cb, icons, _meta);
+        const { title, description, argsSchema, icons, scopeChallenge, _meta } = config2;
+        const registeredPrompt = this._createRegisteredPrompt(name, title, description, normalizeRawShapeSchema(argsSchema), cb, icons, scopeChallenge, _meta);
         this.setPromptRequestHandlers();
         this.sendPromptListChanged();
         return registeredPrompt;
@@ -34868,6 +34928,7 @@ function serveStdio(factory, options = {}) {
         return;
       }
       if (state.era === "modern" && await tryServeListen(message)) return;
+      if (isTornDown()) return;
       state.instance.channel.deliver(message);
       return;
     }
@@ -34934,6 +34995,7 @@ function serveStdio(factory, options = {}) {
           };
         }
         if (await tryServeListen(message)) return;
+        if (isTornDown()) return;
         state.instance.channel.deliver(message, { classification: opening.classification });
         return;
       case "legacy": {
@@ -35019,12 +35081,13 @@ function serveStdio(factory, options = {}) {
 function toError(value) {
   return value instanceof Error ? value : new Error(String(value));
 }
-var StdioServerTransport, DISCARD_ANSWER_TIMEOUT_MS, StdioConnectionChannel;
+var swallowsErrorsAfterClose, StdioServerTransport, DISCARD_ANSWER_TIMEOUT_MS, StdioConnectionChannel;
 var init_stdio = __esm({
   "node_modules/@modelcontextprotocol/server/dist/stdio.mjs"() {
-    init_mcp_DXXb3Vv3();
-    init_src_CX2iR2pK();
+    init_mcp_Dw2OlZ1f();
+    init_src_D_y6h4N7();
     init_shimsNode();
+    swallowsErrorsAfterClose = /* @__PURE__ */ Symbol("swallowsErrorsAfterClose");
     StdioServerTransport = class {
       _readBuffer;
       _started = false;
@@ -35051,18 +35114,27 @@ var init_stdio = __esm({
         this.onerror?.(error62);
       };
       _onstdouterror = (error62) => {
+        if (this._closed) return;
         this.onerror?.(error62);
         this.close().catch(() => {
         });
       };
+      _onstdinclose = () => {
+        this.close().catch(() => {
+        });
+      };
       /**
       * Starts listening for messages on `stdin`.
       */
       async start() {
         if (this._started) throw new Error("StdioServerTransport already started! If using Server class, note that connect() calls start() automatically.");
         this._started = true;
+        for (const listener of this._stdout.listeners("error")) if (listener[swallowsErrorsAfterClose]) this._stdout.off("error", listener);
+        if (this._stdin.readableEnded || this._stdin.destroyed) setImmediate(this._onstdinclose);
         this._stdin.on("data", this._ondata);
         this._stdin.on("error", this._onerror);
+        this._stdin.on("end", this._onstdinclose);
+        this._stdin.on("close", this._onstdinclose);
         this._stdout.on("error", this._onstdouterror);
       }
       processReadBuffer() {
@@ -35079,7 +35151,9 @@ var init_stdio = __esm({
         this._closed = true;
         this._stdin.off("data", this._ondata);
         this._stdin.off("error", this._onerror);
-        this._stdout.off("error", this._onstdouterror);
+        this._stdin.off("end", this._onstdinclose);
+        this._stdin.off("close", this._onstdinclose);
+        this._onstdouterror[swallowsErrorsAfterClose] = true;
         if (this._stdin.listenerCount("data") === 0) this._stdin.pause();
         this._readBuffer.clear();
         this.onclose?.();
@@ -35199,21 +35273,35 @@ var init_stdio = __esm({
 });
 
 // node_modules/@modelcontextprotocol/server/dist/index.mjs
+var DEFAULT_MAX_REQUEST_BODY_SIZE;
 var init_dist = __esm({
   "node_modules/@modelcontextprotocol/server/dist/index.mjs"() {
-    init_mcp_DXXb3Vv3();
-    init_src_CX2iR2pK();
+    init_mcp_Dw2OlZ1f();
+    init_src_D_y6h4N7();
     init_shimsNode();
+    DEFAULT_MAX_REQUEST_BODY_SIZE = 4 * 1024 * 1024;
   }
 });
 
 // node_modules/@chrischall/mcp-utils/dist/errors/index.js
+function redactJsonCookie(quote) {
+  const stringRe = quote === '"' ? DQ_STRING_RE : SQ_STRING_RE;
+  return (_m, prefix, key, value) => {
+    const setCookie = key.toLowerCase() === "set-cookie";
+    const redacted = value.replace(stringRe, (_s, body) => {
+      const out = setCookie ? body.replace(/^(\s*[^=;]+)=[^;]*/, "$1=[REDACTED]") : body.replace(/=[^;]*/g, "=[REDACTED]");
+      return `${quote}${out}${quote}`;
+    });
+    return `${prefix}${redacted}`;
+  };
+}
 function redactSecrets(text) {
-  return text.replace(BEARER_RE, "$1[REDACTED]").replace(BASIC_AUTH_RE, "$1[REDACTED]").replace(SET_COOKIE_RE, "$1$2=[REDACTED]").replace(COOKIE_HEADER_RE, (_m, prefix, pairs) => `${prefix}${pairs.replace(/=[^;,\s]*/g, "=[REDACTED]")}`).replace(API_KEY_RE, "[REDACTED]").replace(HEADER_SECRET_RE, "$1[REDACTED]").replace(QUERY_SECRET_RE, "$1[REDACTED]").replace(OAUTH_CODE_RE, "$1[REDACTED]").replace(FORM_PASSWORD_RE, "$1[REDACTED]").replace(AWS_SIGV4_RE, "$1[REDACTED]").replace(JSON_SECRET_DQ_RE, "$1[REDACTED]$2").replace(JSON_SECRET_SQ_RE, "$1[REDACTED]$2").replace(JWT_RE, "[REDACTED]");
+  return text.replace(BEARER_RE, "$1[REDACTED]").replace(BASIC_AUTH_RE, "$1[REDACTED]").replace(SET_COOKIE_RE, "$1$2=[REDACTED]").replace(COOKIE_HEADER_RE, (_m, prefix, pairs) => `${prefix}${pairs.replace(/=[^;,\s]*/g, "=[REDACTED]")}`).replace(API_KEY_RE, "[REDACTED]").replace(HEADER_SECRET_RE, "$1[REDACTED]").replace(QUERY_SECRET_RE, "$1[REDACTED]").replace(OAUTH_CODE_RE, "$1[REDACTED]").replace(FORM_PASSWORD_RE, "$1[REDACTED]").replace(AWS_SIGV4_RE, "$1[REDACTED]").replace(JSON_COOKIE_DQ_RE, redactJsonCookie('"')).replace(JSON_COOKIE_SQ_RE, redactJsonCookie("'")).replace(JSON_SECRET_DQ_RE, "$1[REDACTED]$2").replace(JSON_SECRET_SQ_RE, "$1[REDACTED]$2").replace(JSON_SECRET_NUM_RE, "$1[REDACTED]").replace(JWT_RE, "[REDACTED]");
 }
 function truncateErrorMessage(text, max = DEFAULT_ERROR_MESSAGE_MAX) {
   const str = text === null || text === void 0 ? "" : String(text);
-  const redacted = redactSecrets(str);
+  const cap = Math.max(ERROR_REDACTION_INPUT_MAX, max);
+  const redacted = redactSecrets(str.length > cap ? str.slice(0, cap) : str);
   if (redacted.length <= max)
     return redacted;
   return `${redacted.slice(0, max)}\u2026 [truncated]`;
@@ -35223,7 +35311,7 @@ function messageOf(err) {
     return err.message;
   return String(err);
 }
-var DEFAULT_ERROR_MESSAGE_MAX, McpToolError, BEARER_RE, JWT_RE, BASIC_AUTH_RE, SET_COOKIE_RE, COOKIE_HEADER_RE, API_KEY_RE, QUERY_SECRET_RE, OAUTH_CODE_RE, FORM_PASSWORD_RE, HEADER_SECRET_RE, AWS_SIGV4_RE, JSON_SECRET_KEYS, JSON_SECRET_DQ_RE, JSON_SECRET_SQ_RE;
+var DEFAULT_ERROR_MESSAGE_MAX, McpToolError, HEADER_NAME_RUN, BEARER_RE, JWT_RE, BASIC_AUTH_RE, SET_COOKIE_RE, COOKIE_HEADER_RE, API_KEY_RE, QUERY_SECRET_RE, OAUTH_CODE_RE, FORM_PASSWORD_RE, HEADER_SECRET_RE, AWS_SIGV4_RE, JSON_SECRET_KEYS, JSON_SECRET_DQ_RE, JSON_SECRET_SQ_RE, JSON_SECRET_NUM_RE, JSON_COOKIE_DQ_RE, JSON_COOKIE_SQ_RE, DQ_STRING_RE, SQ_STRING_RE, ERROR_REDACTION_INPUT_MAX;
 var init_errors3 = __esm({
   "node_modules/@chrischall/mcp-utils/dist/errors/index.js"() {
     DEFAULT_ERROR_MESSAGE_MAX = 500;
@@ -35238,11 +35326,12 @@ var init_errors3 = __esm({
         Object.setPrototypeOf(this, new.target.prototype);
       }
     };
+    HEADER_NAME_RUN = "[a-z0-9_-]{0,40}";
     BEARER_RE = /(bearer\s+)[A-Za-z0-9._~+/=-]{8,}/gi;
-    JWT_RE = /\b[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{8,}\b/g;
+    JWT_RE = /(?<![A-Za-z0-9_-])[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{8,}(?![A-Za-z0-9_-])/g;
     BASIC_AUTH_RE = /(authorization\s*:\s*basic\s+)[A-Za-z0-9+/=_-]{6,}/gi;
-    SET_COOKIE_RE = /(\bset-cookie\s*:\s*)([^=;,\s]+)=[^;,\s]*/gi;
-    COOKIE_HEADER_RE = /((?<!set-)\bcookie\s*:\s*)((?:[^=;,\s]+=[^;,\s]*)(?:;\s*[^=;,\s]+=[^;,\s]*)*)/gi;
+    SET_COOKIE_RE = /(\bset-cookie\s*:\s*)([^=;,:\s]+)=[^;,\s]*/gi;
+    COOKIE_HEADER_RE = /((?<!set-)\bcookie\s*:\s*)((?:[^=;,:\s]+=[^;,\s]*)(?:;\s*[^=;,:\s]+=[^;,\s]*)*)/gi;
     API_KEY_RE = new RegExp([
       "sk-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])",
       // OpenAI / Anthropic (incl. sk-ant-…)
@@ -35257,10 +35346,10 @@ var init_errors3 = __esm({
       "whsec_[A-Za-z0-9]{16,}\\b"
       // webhook signing secret (Stripe-style)
     ].map((p) => `\\b${p}`).join("|"), "g");
-    QUERY_SECRET_RE = /([?&](?:(?:access|refresh|id|auth|session|csrf|xsrf)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|token|key|sig)=)[^&#\s"'<>`]+/gi;
+    QUERY_SECRET_RE = new RegExp(`([?&](?:(?:access|refresh|id|auth|session|csrf|xsrf)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|token|key|sig|(?:php|j)?sess(?:ion)?[_-]?id|sid|x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN})=)[^&#\\s"'<>\`]+`, "gi");
     OAUTH_CODE_RE = /([?&]code=)(?=[^&#\s"'<>`]{16,})[^&#\s"'<>`]+/gi;
     FORM_PASSWORD_RE = /((?:^|[\s,;:"'(\[{])(?:password|passwd)=)[^&#\s"'<>`]+/gim;
-    HEADER_SECRET_RE = /(\b(?:x[-_][a-z0-9_-]*?(?:api[-_]?key|token|secret|auth)[a-z0-9_-]*|api[-_]?key)\s*:\s*)[^\s,;"'<>`]+/gi;
+    HEADER_SECRET_RE = new RegExp(`(\\b(?:x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN}|api[-_]?key)\\s*:\\s*)[^\\s,;"'<>\`]+`, "gi");
     AWS_SIGV4_RE = /([?&]X-Amz-(?:Signature|Security-Token|Credential)=)[^&#\s"'<>`]+/gi;
     JSON_SECRET_KEYS = [
       "(?:access|refresh|id|auth|session|bearer|csrf|xsrf)[_-]?token",
@@ -35268,7 +35357,8 @@ var init_errors3 = __esm({
       "api[_-]?secret",
       "(?:x[_-])?api[_-]?key",
       "private[_-]?key",
-      "x[_-][a-z0-9_-]*?(?:api[_-]?key|token|secret|auth)[a-z0-9_-]*",
+      `x[_-]${HEADER_NAME_RUN}?(?:api[_-]?key|token|secret|auth)${HEADER_NAME_RUN}`,
+      // bounded like HEADER_SECRET_RE
       "(?:proxy-)?authorization",
       "password",
       "passwd",
@@ -35277,6 +35367,12 @@ var init_errors3 = __esm({
     ].join("|");
     JSON_SECRET_DQ_RE = new RegExp(`("(?:${JSON_SECRET_KEYS})"\\s*:\\s*")(?:[^"\\\\]|\\\\.)*(")`, "gi");
     JSON_SECRET_SQ_RE = new RegExp(`('(?:${JSON_SECRET_KEYS})'\\s*:\\s*')(?:[^'\\\\]|\\\\.)*(')`, "gi");
+    JSON_SECRET_NUM_RE = new RegExp(`(["'](?:${JSON_SECRET_KEYS})["']\\s*:\\s*)-?\\d+(?:\\.\\d+)?(?![\\d.])`, "gi");
+    JSON_COOKIE_DQ_RE = /("((?:set-)?cookie)"\s*:\s*)("(?:[^"\\]|\\.)*"|\[\s*"(?:[^"\\]|\\.)*"(?:\s*,\s*"(?:[^"\\]|\\.)*")*)/gi;
+    JSON_COOKIE_SQ_RE = /('((?:set-)?cookie)'\s*:\s*)('(?:[^'\\]|\\.)*'|\[\s*'(?:[^'\\]|\\.)*'(?:\s*,\s*'(?:[^'\\]|\\.)*')*)/gi;
+    DQ_STRING_RE = /"((?:[^"\\]|\\.)*)"/g;
+    SQ_STRING_RE = /'((?:[^'\\]|\\.)*)'/g;
+    ERROR_REDACTION_INPUT_MAX = 64 * 1024;
   }
 });
 
@@ -35635,6 +35731,9 @@ async function tokenConfirmation(action, fb) {
   const subject = await fb.subject();
   if (isToolResult(subject))
     return subject;
+  if (subject.payload === void 0) {
+    throw new TypeError(`confirm token: ${fb.tool}'s subject() returned no payload. Bind what the call will do (the arguments or the request body), or pass \`args\` to confirmationFromEnv.`);
+  }
   const binding = {
     tool: fb.tool,
     ...fb.account === void 0 ? {} : { account: fb.account },
@@ -35796,9 +35895,19 @@ function readConfirmMode(env = process.env) {
   }
   return "refuse";
 }
-function confirmTtlFromEnv(env = process.env) {
+function readConfirmTtl(env) {
   const raw = readEnvVar("MCP_CONFIRM_TTL_SECONDS", { env })?.trim();
-  return raw && /^[1-9]\d*$/.test(raw) ? Number(raw) : DEFAULT_TTL_SECONDS2;
+  if (!raw)
+    return DEFAULT_TTL_SECONDS2;
+  if (/^[1-9]\d*$/.test(raw))
+    return Number(raw);
+  const key = `ttl:${raw}`;
+  if (!warned.has(key)) {
+    warned.add(key);
+    process.stderr.write(`MCP_CONFIRM_TTL_SECONDS="${raw}" is not a positive whole number of seconds; gated writes will refuse on clients that cannot show a confirmation prompt until it is fixed.
+`);
+  }
+  return void 0;
 }
 function confirmKeyFromEnv(env = process.env) {
   const secret = readEnvVar("MCP_CONFIRM_SECRET", { env });
@@ -35807,15 +35916,32 @@ function confirmKeyFromEnv(env = process.env) {
   processKey ??= randomBytes2(32);
   return processKey;
 }
+function boundArgs(args) {
+  if (args === null || typeof args !== "object" || Array.isArray(args) || !("confirmToken" in args))
+    return args;
+  const { confirmToken, ...rest } = args;
+  void confirmToken;
+  return rest;
+}
 function confirmationFromEnv(options) {
-  const { tool, account, confirmToken, subject, instruction, spent, env = process.env, ...confirmation } = options;
+  const { tool, account, confirmToken, subject, instruction, spent, args, env = process.env, ...rest } = options;
   const mode = readConfirmMode(env);
-  if (mode === "refuse") {
+  const ttlSeconds = readConfirmTtl(env);
+  const bound = args === void 0 ? void 0 : boundArgs(args);
+  const confirmation = bound === void 0 || rest.binding ? rest : { ...rest, binding: { key: confirmKeyFromEnv(env), args: bound, ttlSeconds: ttlSeconds ?? DEFAULT_TTL_SECONDS2 } };
+  if (mode === "refuse" || ttlSeconds === void 0) {
+    const hint = mode === "refuse" ? REFUSE_HINT : BAD_TTL_HINT;
     return {
       ...confirmation,
-      unsupportedNote: confirmation.unsupportedNote ? `${confirmation.unsupportedNote} ${REFUSE_HINT}` : REFUSE_HINT
+      unsupportedNote: confirmation.unsupportedNote ? `${confirmation.unsupportedNote} ${hint}` : hint
     };
   }
+  const boundSubject = bound === void 0 ? subject : async () => {
+    const read = await subject();
+    if ("content" in read)
+      return read;
+    return { ...read, payload: { payload: read.payload, args: bound } };
+  };
   return {
     ...confirmation,
     tokenFallback: {
@@ -35823,14 +35949,14 @@ function confirmationFromEnv(options) {
       tool,
       ...account === void 0 ? {} : { account },
       ...confirmToken === void 0 ? {} : { confirmToken },
-      subject,
-      ttlSeconds: confirmTtlFromEnv(env),
+      subject: boundSubject,
+      ttlSeconds,
       instruction: mode === "auto" ? CONFIRM_TOKEN_AUTO_INSTRUCTION : instruction ?? CONFIRM_TOKEN_INSTRUCTION,
       ...spent === void 0 ? {} : { spent }
     }
   };
 }
-var MODES, DEFAULT_TTL_SECONDS2, warned, processKey, CONFIRM_TOKEN_AUTO_INSTRUCTION, REFUSE_HINT;
+var MODES, DEFAULT_TTL_SECONDS2, warned, processKey, CONFIRM_TOKEN_AUTO_INSTRUCTION, REFUSE_HINT, BAD_TTL_HINT;
 var init_confirm_env = __esm({
   "node_modules/@chrischall/mcp-utils/dist/server/confirm-env.js"() {
     init_config();
@@ -35840,6 +35966,7 @@ var init_confirm_env = __esm({
     warned = /* @__PURE__ */ new Set();
     CONFIRM_TOKEN_AUTO_INSTRUCTION = "Nothing has been done yet. Review this preview; if it is what was intended, call again with the same arguments plus confirmToken. (This server runs with MCP_CONFIRM_MODE=auto, so the user's approval in chat is not required.)";
     REFUSE_HINT = "Set MCP_CONFIRM_MODE=ask-user on the server to allow two-step confirmation instead.";
+    BAD_TTL_HINT = "MCP_CONFIRM_TTL_SECONDS on the server is not a positive whole number of seconds; fix it to allow two-step confirmation.";
   }
 });
 
@@ -35954,6 +36081,8 @@ function withGracefulShutdown(target, opts = {}) {
   };
   const handler = (signal) => {
     if (shuttingDown) {
+      if (signal === "stdin-eof")
+        return;
       if (Date.now() - firstSignalAt < repeatGraceMs)
         return;
       if (shouldExit) {
@@ -35989,6 +36118,10 @@ function withGracefulShutdown(target, opts = {}) {
   };
   process.on("SIGINT", () => handler("SIGINT"));
   process.on("SIGTERM", () => handler("SIGTERM"));
+  if (opts.stdin) {
+    opts.stdin.once("end", () => handler("stdin-eof"));
+    opts.stdin.once("close", () => handler("stdin-eof"));
+  }
 }
 function runMcp(opts) {
   if (opts.banner !== void 0) {
@@ -36007,7 +36140,8 @@ function runMcp(opts) {
   });
   const shutdown = opts.shutdown ?? true;
   if (shutdown !== false) {
-    withGracefulShutdown(handle, shutdown === true ? {} : shutdown);
+    const stdinDefault = spec === "stdio" ? { stdin: process.stdin } : {};
+    withGracefulShutdown(handle, { ...stdinDefault, ...shutdown === true ? {} : shutdown });
   }
   return handle;
 }
@@ -36480,7 +36614,7 @@ var init_version = __esm({
   "src/version.ts"() {
     "use strict";
     PACKAGE_NAME = "office-outlook-mcp";
-    VERSION = "0.3.1";
+    VERSION = "0.3.2";
   }
 });
 
@@ -36703,6 +36837,35 @@ var init_frames = __esm({
   }
 });
 
+// node_modules/@fetchproxy/protocol/dist/capability-availability.js
+function capabilityUnavailableMessage(capability, platform) {
+  return `capability ${JSON.stringify(capability)} is not available in this browser (${platform})`;
+}
+function parseCapabilityUnavailable(error62) {
+  const m = UNAVAILABLE_RE.exec(error62);
+  if (!m)
+    return null;
+  return { capability: m[1], platform: m[2] ?? null };
+}
+function parseUnsupportedCapabilityReason(reason) {
+  if (!reason.startsWith(UNSUPPORTED_CAPABILITY_REASON_PREFIX))
+    return null;
+  const rest = reason.slice(UNSUPPORTED_CAPABILITY_REASON_PREFIX.length).replace(/\s*\(not available in this browser\)\s*$/, "").trim();
+  if (rest === "")
+    return [];
+  return rest.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+}
+var CAPABILITY_UNAVAILABLE_CODE, MAX_UNAVAILABLE_CAPABILITIES, MAX_CAPABILITY_NAME_LENGTH, UNSUPPORTED_CAPABILITY_REASON_PREFIX, UNAVAILABLE_RE;
+var init_capability_availability = __esm({
+  "node_modules/@fetchproxy/protocol/dist/capability-availability.js"() {
+    CAPABILITY_UNAVAILABLE_CODE = "capability_unavailable";
+    MAX_UNAVAILABLE_CAPABILITIES = 32;
+    MAX_CAPABILITY_NAME_LENGTH = 64;
+    UNSUPPORTED_CAPABILITY_REASON_PREFIX = "unsupported-capability:";
+    UNAVAILABLE_RE = /^capability "([^"]{1,64})" is not available in this browser(?: \(([^)]{1,32})\))?/;
+  }
+});
+
 // node_modules/@fetchproxy/protocol/dist/mcp-id.js
 function generateMcpId(serverName, version2) {
   if (serverName.includes(":")) {
@@ -37415,6 +37578,9 @@ function validateHello(raw) {
     assertBase64(raw.sessionNonce, "hello.sessionNonce");
     if (raw.accepts !== void 0)
       assertAcceptsList(raw.accepts);
+    if (raw.unavailableCapabilities !== void 0) {
+      assertUnavailableCapabilities(raw.unavailableCapabilities);
+    }
     return raw;
   }
   throw new ProtocolError3(`hello.role: must be 'server' or 'extension', got ${String(role)}`);
@@ -37479,6 +37645,22 @@ function assertAcceptsList(accepts) {
     }
   }
 }
+function assertUnavailableCapabilities(list) {
+  const label = "hello.unavailableCapabilities";
+  if (!Array.isArray(list))
+    throw new ProtocolError3(`${label}: expected array`);
+  if (list.length > MAX_UNAVAILABLE_CAPABILITIES) {
+    throw new ProtocolError3(`${label}: at most ${MAX_UNAVAILABLE_CAPABILITIES} entries, got ${list.length}`);
+  }
+  for (const c of list) {
+    if (typeof c !== "string") {
+      throw new ProtocolError3(`${label}: entry must be string, got ${typeof c}`);
+    }
+    if (c.length < 1 || c.length > MAX_CAPABILITY_NAME_LENGTH) {
+      throw new ProtocolError3(`${label}: entry must be 1-${MAX_CAPABILITY_NAME_LENGTH} characters, got ${c.length}`);
+    }
+  }
+}
 function validatePeerGone(raw) {
   assertString(raw.mcpId, "peer-gone.mcpId");
   if (!isValidMcpId(raw.mcpId))
@@ -37950,6 +38132,8 @@ function validateInnerResponse(raw) {
   }
   if (raw.ok === false) {
     assertString(raw.error, "inner.error");
+    if (raw.code !== void 0)
+      assertString(raw.code, "inner.code");
     if (raw.op !== void 0) {
       if (typeof raw.op !== "string" || !KNOWN_RESPONSE_OPS.has(raw.op)) {
         throw new ProtocolError3(`inner.op: unknown response op ${JSON.stringify(raw.op)}`);
@@ -37963,6 +38147,7 @@ var ProtocolError3, FORBIDDEN_KEYS, BASE64_RE, SCOPE_KEY_RE, SCOPE_KEY_GLOB_RE,
 var init_validate = __esm({
   "node_modules/@fetchproxy/protocol/dist/validate.js"() {
     init_frames();
+    init_capability_availability();
     init_mcp_id();
     init_json_pointer();
     init_public_suffix();
@@ -38094,6 +38279,7 @@ var init_seal = __esm({
 var init_dist3 = __esm({
   "node_modules/@fetchproxy/protocol/dist/index.js"() {
     init_frames();
+    init_capability_availability();
     init_validate();
     init_crypto();
     init_mcp_id();
@@ -38105,6 +38291,43 @@ var init_dist3 = __esm({
   }
 });
 
+// node_modules/@fetchproxy/server/dist/session-info.js
+function sessionInfoFromHello(hello) {
+  const raw = hello.unavailableCapabilities;
+  const known = /* @__PURE__ */ new Set();
+  if (Array.isArray(raw)) {
+    for (const c of raw) {
+      if (typeof c === "string" && KNOWN_CAPABILITIES.has(c))
+        known.add(c);
+    }
+  }
+  return { platform: hello.platform, unavailableCapabilities: [...known].sort() };
+}
+function capabilitiesForRequest(inner) {
+  if (inner.type !== "request")
+    return [];
+  if (inner.op === "graphql_query")
+    return ["graphql"];
+  if (inner.op === "fetch") {
+    return inner.init.inPage === true ? ["fetch", "fetch_in_page"] : ["fetch"];
+  }
+  return [inner.op];
+}
+function unavailableCapabilityFor(inner, info) {
+  if (!info || info.unavailableCapabilities.length === 0)
+    return null;
+  for (const c of capabilitiesForRequest(inner)) {
+    if (info.unavailableCapabilities.includes(c))
+      return c;
+  }
+  return null;
+}
+var init_session_info = __esm({
+  "node_modules/@fetchproxy/server/dist/session-info.js"() {
+    init_dist3();
+  }
+});
+
 // node_modules/@fetchproxy/server/dist/election.js
 import { createServer, Server as HttpServer } from "node:http";
 async function electRole(opts) {
@@ -42059,9 +42282,10 @@ async function awaitSessionReady(ready, opts) {
       clearTimeout(timer);
   }
 }
-var SESSION_READY_TIMEOUT_MS, FetchproxySessionNotReadyError, FetchproxyHelloRejectedError, MIN_VERSION, FetchproxyProtocolVersionError;
+var SESSION_READY_TIMEOUT_MS, FetchproxySessionNotReadyError, FetchproxyHelloRejectedError, MIN_SERVER_VERSION, FetchproxyProtocolVersionError;
 var init_session_ready = __esm({
   "node_modules/@fetchproxy/server/dist/session-ready.js"() {
+    init_dist3();
     SESSION_READY_TIMEOUT_MS = 3e4;
     FetchproxySessionNotReadyError = class extends Error {
       reason;
@@ -42070,7 +42294,7 @@ var init_session_ready = __esm({
       hint;
       constructor(info) {
         const pairing = info.pairCode !== null && info.pairCode !== "";
-        const hint = pairing ? `Open the Transporter extension popup and approve pair code ${info.pairCode} for "${info.mcpId}", then retry.` : `The extension is connected but hasn't confirmed a session for "${info.mcpId}" \u2014 sign in to the target site in that browser (and approve the requested scope if it changed), then retry.`;
+        const hint = pairing ? `Open the ContextMint Bridge extension popup and approve pair code ${info.pairCode} for "${info.mcpId}", then retry.` : `The extension is connected but hasn't confirmed a session for "${info.mcpId}" \u2014 sign in to the target site in that browser (and approve the requested scope if it changed), then retry.`;
         super(`fetchproxy: ${pairing ? "pairing not yet approved" : "no confirmed browser session"} for "${info.mcpId}". ${hint}`);
         this.name = "FetchproxySessionNotReadyError";
         this.reason = pairing ? "pair-required" : "not-ready";
@@ -42083,15 +42307,35 @@ var init_session_ready = __esm({
     FetchproxyHelloRejectedError = class extends Error {
       mcpId;
       reason;
+      /**
+       * #418: when the reason is `unsupported-capability: a, b (not available in
+       * this browser)` — every capability this MCP declared is one the browser
+       * cannot serve — those capabilities, parsed out of it. Empty otherwise.
+       */
+      unavailableCapabilities;
+      /** #418: the refusing browser's platform, when this bridge knew it. */
+      platform;
+      /**
+       * #418: the remedy, when the reason is one this package knows how to
+       * explain — today only `unsupported-capability`, which blames the browser
+       * rather than the MCP. `null` otherwise.
+       */
+      hint;
       constructor(info) {
-        super(`fetchproxy: the extension refused the connection for "${info.mcpId}": ${info.reason}. This is the extension's own reason \u2014 it is not a timeout, and retrying unchanged will be refused the same way.`);
+        const unavailable = parseUnsupportedCapabilityReason(info.reason);
+        const platform = info.platform ?? null;
+        const hint = unavailable !== null ? `${platform ? `this browser (${platform})` : "this browser"} cannot serve any of the capabilities this MCP needs (${unavailable.join(", ")}) \u2014 ContextMint Bridge checked for the browser APIs and they are missing. Nothing is wrong with the MCP or your pairing, and updating will not change it: use this MCP from a browser that provides them (for example Chrome).` : null;
+        super(`fetchproxy: the extension refused the connection for "${info.mcpId}": ${info.reason}. ` + (hint !== null ? hint : `This is the extension's own reason \u2014 it is not a timeout, and retrying unchanged will be refused the same way.`));
         this.name = "FetchproxyHelloRejectedError";
         this.mcpId = info.mcpId;
         this.reason = info.reason;
+        this.unavailableCapabilities = unavailable ?? [];
+        this.platform = platform;
+        this.hint = hint;
         Object.setPrototypeOf(this, new.target.prototype);
       }
     };
-    MIN_VERSION = "3.0.0";
+    MIN_SERVER_VERSION = "3.0.0";
     FetchproxyProtocolVersionError = class extends Error {
       /** The protocol version this process speaks. */
       ourVersion;
@@ -42099,7 +42343,7 @@ var init_session_ready = __esm({
       theirVersion;
       peer;
       constructor(info) {
-        const far = info.peer === "extension" ? `the attached browser extension speaks ${info.theirVersion} \u2014 update Transporter (the fetchproxy extension) to ${MIN_VERSION} or later` : `the MCP holding the bridge port speaks ${info.theirVersion} \u2014 upgrade @fetchproxy/server to ${MIN_VERSION} or later in that MCP`;
+        const far = info.peer === "extension" ? `the attached browser extension speaks ${info.theirVersion} \u2014 update ContextMint Bridge to a release that speaks fetchproxy protocol ${info.ourVersion}` : `the MCP holding the bridge port speaks ${info.theirVersion} \u2014 upgrade @fetchproxy/server to ${MIN_SERVER_VERSION} or later in that MCP`;
         super(`protocol version mismatch: this MCP speaks fetchproxy protocol ${info.ourVersion}, ${far}`);
         this.name = "FetchproxyProtocolVersionError";
         this.ourVersion = info.ourVersion;
@@ -42207,6 +42451,7 @@ async function loadOrCreateIdentity(serverName, dir = defaultIdentityDir()) {
       throw e;
   }
   let unreadable = null;
+  let recovered = false;
   for (let attempt = 0; attempt < 5; attempt++) {
     const id = await generateIdentity();
     if (await publishIdentityIfAbsent(dir, serverName, id))
@@ -42220,6 +42465,11 @@ async function loadOrCreateIdentity(serverName, dir = defaultIdentityDir()) {
       if (!(e instanceof SyntaxError))
         throw e;
       unreadable = e;
+      if (!recovered && await removeAbandonedIdentity(path)) {
+        recovered = true;
+        attempt--;
+        continue;
+      }
       await new Promise((r) => setTimeout(r, 20 * (attempt + 1)));
     }
   }
@@ -42260,7 +42510,60 @@ async function publishIdentityIfAbsent(dir, serverName, id) {
     await rm(tmp, { force: true });
   }
 }
-var SAFE_PLAIN, SAFE_SCOPED, STAGING_BYTES, NO_HARD_LINKS;
+function looksAbandoned(text) {
+  const t = text.trim();
+  return t === "" || t.startsWith("{") && !t.endsWith("}");
+}
+function sameFile(a, b) {
+  return a.dev === b.dev && a.ino === b.ino && a.size === b.size && a.mtimeMs === b.mtimeMs;
+}
+async function takeRecoveryLock(lock) {
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      await writeFile(lock, `${process.pid}
+`, { mode: 384, flag: "wx" });
+      return await lstat(lock);
+    } catch (e) {
+      if (e.code !== "EEXIST")
+        return null;
+      const st = await lstat(lock).catch(() => null);
+      if (st === null)
+        continue;
+      if (Date.now() - st.mtimeMs < RECOVERY_LOCK_STALE_MS)
+        return null;
+      const again = await lstat(lock).catch(() => null);
+      if (again === null || !sameFile(st, again))
+        continue;
+      await unlink(lock).catch(() => void 0);
+    }
+  }
+  return null;
+}
+async function removeAbandonedIdentity(path) {
+  const lock = `${path}.recover.lock`;
+  const held = await takeRecoveryLock(lock);
+  if (held === null)
+    return false;
+  try {
+    const before = await lstat(path);
+    if (!before.isFile() || Date.now() - before.mtimeMs < ABANDONED_IDENTITY_MS)
+      return false;
+    if (!looksAbandoned(await readFile(path, "utf8")))
+      return false;
+    const now = await lstat(path);
+    if (!sameFile(before, now))
+      return false;
+    await unlink(path);
+    return true;
+  } catch {
+    return false;
+  } finally {
+    const st = await lstat(lock).catch(() => null);
+    if (st !== null && sameFile(held, st))
+      await unlink(lock).catch(() => void 0);
+  }
+}
+var SAFE_PLAIN, SAFE_SCOPED, STAGING_BYTES, NO_HARD_LINKS, ABANDONED_IDENTITY_MS, RECOVERY_LOCK_STALE_MS;
 var init_identity = __esm({
   "node_modules/@fetchproxy/server/dist/identity.js"() {
     init_dist3();
@@ -42268,13 +42571,153 @@ var init_identity = __esm({
     SAFE_SCOPED = /^@[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
     STAGING_BYTES = 6;
     NO_HARD_LINKS = /* @__PURE__ */ new Set(["EPERM", "ENOTSUP", "EOPNOTSUPP", "ENOSYS"]);
+    ABANDONED_IDENTITY_MS = 5e3;
+    RECOVERY_LOCK_STALE_MS = 3e4;
+  }
+});
+
+// node_modules/@fetchproxy/server/dist/extension-pins.js
+import { readFile as readFile2 } from "node:fs/promises";
+import { join as join3 } from "node:path";
+function malformed(why) {
+  return new ExtensionPinsError("EXTENSION_PINS_MALFORMED", `malformed extension pin set: ${why}`);
+}
+function isKey(x) {
+  if (typeof x !== "string" || x === "")
+    return false;
+  let raw;
+  try {
+    raw = fromB64(x);
+  } catch {
+    return false;
+  }
+  return raw.length === 32 && toB64(raw) === x;
+}
+function parseExtensionPins(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw malformed("not JSON");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw malformed("not an object");
+  }
+  const r = parsed;
+  if (r.v !== EXTENSION_PINS_FILE_VERSION) {
+    throw malformed(`"v" is not ${EXTENSION_PINS_FILE_VERSION}`);
+  }
+  if (r.managed !== true)
+    throw malformed('"managed" is not true');
+  if (r.managedBy !== void 0 && typeof r.managedBy !== "string") {
+    throw malformed('"managedBy" is not a string');
+  }
+  if (!Array.isArray(r.extensions))
+    throw malformed('"extensions" is not an array');
+  const extensions = r.extensions.map((e, i) => {
+    if (!e || typeof e !== "object" || Array.isArray(e)) {
+      throw malformed(`extensions[${i}] is not an object`);
+    }
+    const x = e;
+    if (!isKey(x.x25519Pub)) {
+      throw malformed(`extensions[${i}].x25519Pub is not canonical base64 of 32 bytes`);
+    }
+    if (!isKey(x.ed25519Pub)) {
+      throw malformed(`extensions[${i}].ed25519Pub is not canonical base64 of 32 bytes`);
+    }
+    if (x.label !== void 0 && typeof x.label !== "string") {
+      throw malformed(`extensions[${i}].label is not a string`);
+    }
+    return {
+      x25519Pub: x.x25519Pub,
+      ed25519Pub: x.ed25519Pub,
+      ...x.label !== void 0 ? { label: x.label } : {}
+    };
+  });
+  return {
+    v: EXTENSION_PINS_FILE_VERSION,
+    managed: true,
+    ...r.managedBy !== void 0 ? { managedBy: r.managedBy } : {},
+    extensions
+  };
+}
+function extensionPinsPath(serverName, trustDir) {
+  return join3(trustDir, `${safeIdentityFileBase(serverName)}.extension-pins.json`);
+}
+async function readExtensionPinsAt(path) {
+  let text;
+  try {
+    text = await readFile2(path, "utf8");
+  } catch (e) {
+    const code = e.code ?? "read failed";
+    throw new ExtensionPinsError("EXTENSION_PINS_MISSING", `no managed extension pin set at ${path} (${code})`);
+  }
+  try {
+    return parseExtensionPins(text);
+  } catch (e) {
+    const why = e instanceof ExtensionPinsError ? e.message : "malformed extension pin set";
+    throw new ExtensionPinsError("EXTENSION_PINS_MALFORMED", `${why} at ${path}`);
+  }
+}
+function decideManagedExtensionTrust(args) {
+  const { set: set2, hello, serverName } = args;
+  const listed = set2.extensions.some((e) => e.x25519Pub === hello.identityX25519Pub && e.ed25519Pub === hello.identityEd25519Pub);
+  if (listed)
+    return { decision: "pinned" };
+  return {
+    decision: "refused",
+    code: "EXTENSION_NOT_PINNED",
+    message: `[fetchproxy] ${serverName}: refusing an extension that is not in the host-managed pin set${args.location ? ` (${args.location})` : ""}. The host that runs this MCP decides which browsers it accepts; confirm this browser there.`
+  };
+}
+async function evaluateManagedExtensionTrust(port, hello, serverName) {
+  let set2;
+  try {
+    set2 = await port.read();
+  } catch (e) {
+    const code = e instanceof ExtensionPinsError ? e.code : "EXTENSION_PINS_MISSING";
+    const detail = e instanceof ExtensionPinsError ? e.message : `could not read ${port.location}`;
+    return {
+      decision: "refused",
+      code,
+      message: `[fetchproxy] ${serverName}: ${code}: ${detail} \u2014 refusing every extension until the host that manages this MCP's pins writes a valid set.`
+    };
+  }
+  return decideManagedExtensionTrust({ set: set2, hello, serverName, location: port.location });
+}
+function resolveExtensionPinsMode(explicit, env = process.env) {
+  if (explicit === "managed")
+    return "managed";
+  const raw = env[EXTENSION_PINS_ENV];
+  if (raw === void 0 || raw.trim() === "")
+    return "first-use";
+  if (raw === "managed")
+    return "managed";
+  console.warn(`[fetchproxy] ${EXTENSION_PINS_ENV}=${JSON.stringify(raw)} is not "managed" \u2014 treating it as managed anyway, because a set variable means a host manages this MCP's extension pins. Unset it for trust on first use.`);
+  return "managed";
+}
+var EXTENSION_PINS_FILE_VERSION, EXTENSION_PINS_ENV, ExtensionPinsError;
+var init_extension_pins = __esm({
+  "node_modules/@fetchproxy/server/dist/extension-pins.js"() {
+    init_dist3();
+    init_identity();
+    EXTENSION_PINS_FILE_VERSION = 1;
+    EXTENSION_PINS_ENV = "FETCHPROXY_EXTENSION_PINS";
+    ExtensionPinsError = class extends Error {
+      code;
+      constructor(code, message) {
+        super(message);
+        this.name = "ExtensionPinsError";
+        this.code = code;
+      }
+    };
   }
 });
 
 // node_modules/@fetchproxy/server/dist/extension-trust.js
-import { readFile as readFile2, writeFile as writeFile2, rename as rename2, unlink as unlink2, mkdir as mkdir2, chmod as chmod2, rm as rm2 } from "node:fs/promises";
+import { readFile as readFile3, writeFile as writeFile2, rename as rename2, unlink as unlink2, mkdir as mkdir2, chmod as chmod2, rm as rm2 } from "node:fs/promises";
 import { randomBytes as randomBytes5 } from "node:crypto";
-import { isAbsolute as isAbsolute2, join as join3 } from "node:path";
+import { isAbsolute as isAbsolute2, join as join4 } from "node:path";
 function envTrustDir(env = process.env) {
   const raw = env[TRUST_DIR_ENV];
   if (raw === void 0)
@@ -42295,6 +42738,22 @@ function defaultTrustDir() {
 }
 function fileExtensionTrust(args) {
   const dir = resolveTrustDir(args.trustDir, args.dir);
+  if (args.extensionPins === "managed") {
+    const location = extensionPinsPath(args.serverName, dir);
+    return {
+      // Managed mode has no first-use pin: nothing to read, nothing to write,
+      // and no operator override. `write` REJECTS rather than no-ops, so a
+      // path that ever reached it would log the attempt instead of silently
+      // pretending to have pinned.
+      allowNew: false,
+      location,
+      read: async () => null,
+      write: async () => {
+        throw new Error(`refusing to write an extension pin: ${location} is host-managed and this MCP never pins on first use`);
+      },
+      managed: { location, read: () => readExtensionPinsAt(location) }
+    };
+  }
   return {
     allowNew: args.allowNew,
     location: extensionTrustPath(args.serverName, dir),
@@ -42327,13 +42786,13 @@ function decideExtensionTrust(args) {
   };
 }
 function extensionTrustPath(serverName, dir = defaultTrustDir()) {
-  return join3(dir, `${safeIdentityFileBase(serverName)}.extension-trust.json`);
+  return join4(dir, `${safeIdentityFileBase(serverName)}.extension-trust.json`);
 }
 function extensionTrustPathHint(serverName) {
   try {
     return extensionTrustPath(serverName);
   } catch {
-    return join3(defaultTrustDir(), "<server-name>.extension-trust.json");
+    return join4(defaultTrustDir(), "<server-name>.extension-trust.json");
   }
 }
 function isPin(x) {
@@ -42346,7 +42805,7 @@ async function readExtensionPin(serverName, dir = defaultTrustDir()) {
   const path = extensionTrustPath(serverName, dir);
   let raw;
   try {
-    raw = await readFile2(path, "utf8");
+    raw = await readFile3(path, "utf8");
   } catch (e) {
     if (e.code === "ENOENT")
       return null;
@@ -42384,6 +42843,7 @@ var TRUST_DIR_ENV, TRUST_NEW_EXTENSION_ENV;
 var init_extension_trust = __esm({
   "node_modules/@fetchproxy/server/dist/extension-trust.js"() {
     init_identity();
+    init_extension_pins();
     TRUST_DIR_ENV = "FETCHPROXY_TRUST_DIR";
     TRUST_NEW_EXTENSION_ENV = "FETCHPROXY_TRUST_NEW_EXTENSION";
   }
@@ -42518,6 +42978,7 @@ async function startHost(opts) {
     return true;
   }
   let extensionHello = null;
+  let ownSessionInfo = null;
   let extensionClaim = null;
   const pairCodeFor = async (hello, mint) => {
     if (!mint)
@@ -42536,6 +42997,7 @@ async function startHost(opts) {
       return;
     console.warn(`[fetchproxy] ${opts.ownServerName}: ${OWN_DECRYPT_FAILURES_BEFORE_REHANDSHAKE} frames in a row from the extension failed authentication under this MCP's session key \u2014 re-handshaking this MCP's session (the extension stays connected).`);
     ownSession = dropOwnSessionAndEphemeral();
+    ownSessionInfo = null;
     resetSessionPromise();
     const mintedKeypair = await generateSessionKeypair();
     const mintedHello = await buildServerHello({
@@ -42594,28 +43056,39 @@ async function startHost(opts) {
             return;
           }
           extensionClaim = ws;
-          let pin;
-          try {
-            pin = await opts.extensionTrust.read();
-          } catch (e) {
-            console.error(`[fetchproxy] ${String(e)}`);
-            if (extensionClaim === ws)
-              extensionClaim = null;
-            ws.close(1008, "extension pin unreadable");
-            return;
+          const managed = opts.extensionTrust.managed;
+          let outcome;
+          let refusalReason = "extension identity is not the pinned one";
+          if (managed) {
+            const decided = await evaluateManagedExtensionTrust(managed, frame, opts.ownServerName);
+            outcome = decided;
+            if (decided.decision === "refused") {
+              refusalReason = decided.code === "EXTENSION_NOT_PINNED" ? "extension identity is not in the managed pin set" : "extension pin set unavailable";
+            }
+          } else {
+            let pin;
+            try {
+              pin = await opts.extensionTrust.read();
+            } catch (e) {
+              console.error(`[fetchproxy] ${String(e)}`);
+              if (extensionClaim === ws)
+                extensionClaim = null;
+              ws.close(1008, "extension pin unreadable");
+              return;
+            }
+            outcome = decideExtensionTrust({
+              pin,
+              hello: frame,
+              allowNew: opts.extensionTrust.allowNew,
+              serverName: opts.ownServerName,
+              location: opts.extensionTrust.location
+            });
           }
-          const outcome = decideExtensionTrust({
-            pin,
-            hello: frame,
-            allowNew: opts.extensionTrust.allowNew,
-            serverName: opts.ownServerName,
-            location: opts.extensionTrust.location
-          });
           if (outcome.decision === "refused") {
             console.warn(outcome.message);
             if (extensionClaim === ws)
               extensionClaim = null;
-            ws.close(1008, "extension identity is not the pinned one");
+            ws.close(1008, refusalReason);
             return;
           }
           if (outcome.decision === "replace")
@@ -42710,8 +43183,9 @@ async function startHost(opts) {
               console.warn("[fetchproxy] discarding a ready for a session ephemeral this host no longer holds (the extension reconnected while a hello was in flight)");
               return;
             }
-            const extEdPub = fromB64(extensionHello.identityEd25519Pub);
-            const extNonce = fromB64(extensionHello.sessionNonce);
+            const verifiedHello = extensionHello;
+            const extEdPub = fromB64(verifiedHello.identityEd25519Pub);
+            const extNonce = fromB64(verifiedHello.sessionNonce);
             const msg = readySignaturePayload(held.nonce, extNonce, fromB64(frame.extensionSessionPub), held.pub);
             const sig = fromB64(frame.sessionSig);
             let sigOk = false;
@@ -42744,6 +43218,7 @@ async function startHost(opts) {
             if (extensionWs !== ws)
               return;
             ownSession = new SessionState(key);
+            ownSessionInfo = sessionInfoFromHello(verifiedHello);
             ownDecryptFailures = 0;
             ownPendingPairCode = null;
             resolveOwnSession(ownSession);
@@ -42814,7 +43289,11 @@ async function startHost(opts) {
         }
         if (frame.type === "hello-rejected" && identified === "extension") {
           if (frame.mcpId === opts.ownMcpId) {
-            rejectOwnSession(new FetchproxyHelloRejectedError({ mcpId: frame.mcpId, reason: frame.reason }));
+            rejectOwnSession(new FetchproxyHelloRejectedError({
+              mcpId: frame.mcpId,
+              reason: frame.reason,
+              platform: extensionHello?.platform ?? null
+            }));
           } else {
             const slot = peers.get(frame.mcpId);
             if (slot?.helloFrame.accepts?.includes("hello-rejected")) {
@@ -42860,6 +43339,7 @@ async function startHost(opts) {
           rejectOwnSession(new Error("extension disconnected before ready"));
         }
         ownSession = dropOwnSessionAndEphemeral();
+        ownSessionInfo = null;
         ownDecryptFailures = 0;
         ownPendingPairCode = null;
         resetSessionPromise();
@@ -42906,6 +43386,7 @@ async function startHost(opts) {
       });
       if (!extensionWs)
         throw new Error("host: no extension connected");
+      opts.refuseOutbound?.(inner, ownSessionInfo);
       const plaintext = encodeOutboundInnerFrame(opts.ownMcpId, inner);
       const sealed = await sealInnerFrame(session.sessionKey, opts.ownMcpId, session.nextOutboundSeq(), plaintext, "s2e");
       extensionWs.send(JSON.stringify(sealed));
@@ -42921,7 +43402,8 @@ async function startHost(opts) {
     },
     pendingPairCode: () => ownPendingPairCode,
     extensionConnected: () => extensionWs !== null,
-    sessionLinked: () => ownSession !== null
+    sessionLinked: () => ownSession !== null,
+    sessionInfo: () => ownSession !== null ? ownSessionInfo : null
   };
 }
 var HTTP_ORIGIN_RE, PUBLIC_ORIGIN_RE, EXTENSION_ORIGIN_RE, OPAQUE_ORIGIN, ALLOW_LOCAL_ORIGINS_ENV, HANDSHAKE_TIMEOUT_MS, MAX_PAYLOAD_BYTES, enc4, OWN_DECRYPT_FAILURES_BEFORE_REHANDSHAKE;
@@ -42934,6 +43416,8 @@ var init_host = __esm({
     init_session();
     init_session_ready();
     init_extension_trust();
+    init_extension_pins();
+    init_session_info();
     HTTP_ORIGIN_RE = /^https?:\/\//i;
     PUBLIC_ORIGIN_RE = /^https?:\/\/(?!(127\.0\.0\.1|localhost|\[::1\])(:|$))/i;
     EXTENSION_ORIGIN_RE = /^(chrome-extension|moz-extension|safari-web-extension):\/\//i;
@@ -43025,6 +43509,7 @@ async function startPeer(opts) {
   const closeListeners = [];
   const extensionDisconnectListeners = [];
   let session = null;
+  let sessionInfo = null;
   let sessionEphemeral = null;
   function dropSessionEphemeral() {
     if (sessionEphemeral)
@@ -43090,6 +43575,15 @@ async function startPeer(opts) {
       console.warn(`[fetchproxy] ${opts.serverName}: extension session signature invalid \u2014 refusing (the concentrator may be answering in the browser's place)`);
       return null;
     }
+    const managed = opts.extensionTrust.managed;
+    if (managed) {
+      const decided = await evaluateManagedExtensionTrust(managed, hello2, opts.serverName);
+      if (decided.decision === "refused") {
+        console.warn(decided.message);
+        return null;
+      }
+      return hello2;
+    }
     if (cachedPin === void 0) {
       try {
         cachedPin = await opts.extensionTrust.read();
@@ -43157,6 +43651,7 @@ async function startPeer(opts) {
         extensionGone = true;
         dropSessionEphemeral();
         pendingPairCode = null;
+        sessionInfo = null;
         if (session !== null) {
           session = null;
           if (sessionPromiseSettled)
@@ -43189,6 +43684,7 @@ async function startPeer(opts) {
         }
         const isRenegotiation = session !== null;
         session = new SessionState(sessionKey);
+        sessionInfo = sessionInfoFromHello(authenticated);
         extensionGone = false;
         pendingPairCode = null;
         if (isRenegotiation) {
@@ -43199,7 +43695,11 @@ async function startPeer(opts) {
         return;
       }
       if (frame.type === "hello-rejected" && frame.mcpId === opts.mcpId) {
-        rejectFirstReady(new FetchproxyHelloRejectedError({ mcpId: frame.mcpId, reason: frame.reason }));
+        rejectFirstReady(new FetchproxyHelloRejectedError({
+          mcpId: frame.mcpId,
+          reason: frame.reason,
+          platform: extensionHello?.platform ?? null
+        }));
       }
       if (frame.type === "pair-pending" && frame.mcpId === opts.mcpId) {
         const hello2 = extensionHello;
@@ -43299,6 +43799,7 @@ async function startPeer(opts) {
       const s = session;
       if (s === null)
         throw new Error("peer: extension disconnected");
+      opts.refuseOutbound?.(inner, sessionInfo);
       const plaintext = encodeOutboundInnerFrame(opts.mcpId, inner);
       const sealed = await sealInnerFrame(s.sessionKey, opts.mcpId, s.nextOutboundSeq(), plaintext, "s2e");
       if (ws.readyState !== import_websocket.default.OPEN)
@@ -43317,6 +43818,7 @@ async function startPeer(opts) {
     pendingPairCode: () => pendingPairCode,
     extensionConnected: () => extensionHello !== null,
     sessionLinked: () => session !== null && !extensionGone,
+    sessionInfo: () => session !== null && !extensionGone ? sessionInfo : null,
     onClose: (cb) => {
       closeListeners.push(cb);
     },
@@ -43337,14 +43839,18 @@ var init_peer = __esm({
     init_host();
     init_session();
     init_session_ready();
+    init_session_info();
     init_extension_trust();
+    init_extension_pins();
     PEER_DIAL_TIMEOUT_MS = 5e3;
     enc5 = new TextEncoder();
   }
 });
 
 // node_modules/@fetchproxy/server/dist/error-kind.js
-function classifyFetchError(error62) {
+function classifyFetchError(error62, code) {
+  if (code === CAPABILITY_UNAVAILABLE_CODE)
+    return "capability_unavailable";
   if (/^(in-page )?fetch threw:/.test(error62)) {
     return "tab_fetch_failed";
   }
@@ -43360,6 +43866,9 @@ function classifyFetchError(error62) {
   if (/not in domains \[/.test(error62)) {
     return "domain_denied";
   }
+  if (parseCapabilityUnavailable(error62) !== null) {
+    return "capability_unavailable";
+  }
   if (/^capability .+ not granted/.test(error62)) {
     return "capability_denied";
   }
@@ -43370,6 +43879,7 @@ function classifyFetchError(error62) {
 }
 var init_error_kind = __esm({
   "node_modules/@fetchproxy/server/dist/error-kind.js"() {
+    init_dist3();
   }
 });
 
@@ -43430,7 +43940,15 @@ function waitedHint(op) {
   }
   return "the extension waited and nothing arrived. Is a tab open on the declared domain and signed in?" + tail;
 }
-function protocolErrorFrom(error62, op) {
+function protocolErrorFrom(error62, op, response) {
+  const unavailable = parseCapabilityUnavailable(error62);
+  if (unavailable !== null || response?.code === CAPABILITY_UNAVAILABLE_CODE) {
+    const fromOp = response?.op === "graphql_query" ? "graphql" : response?.op ?? "unknown";
+    return new FetchproxyCapabilityUnavailableError(error62, {
+      capability: unavailable?.capability ?? fromOp,
+      platform: unavailable?.platform ?? null
+    });
+  }
   if (error62 === "timeout")
     return new FetchproxyWaitedError(error62, op);
   if (SCOPE_REJECTION.test(error62))
@@ -43446,6 +43964,9 @@ function verbDeadlineMs(transportMs, requestedMs, graceMs = VERB_DEADLINE_GRACE_
     return transportMs;
   return Math.max(requestedMs + graceMs, transportMs);
 }
+function withNotResentNote(message) {
+  return `${message}${message.endsWith(".") ? " " : ". "}${TIMEOUT_NOT_RESENT_NOTE}`;
+}
 function normalizeCookiePath(path) {
   if (path === void 0 || path === "")
     return void 0;
@@ -43506,15 +44027,17 @@ function isResendableRequest(inner) {
       return true;
   }
 }
-var FetchproxyProtocolError, FetchproxyHttpError, FetchproxyBridgeDownError, FetchproxyHintedError, FetchproxyScopeError, FetchproxyNoTabError, FetchproxyTabOpeningError, FetchproxyWaitedError, SCOPE_REJECTION, NO_TAB_REJECTION, TAB_OPENING_REJECTION, VERB_DEADLINE_GRACE_MS, FetchproxyTimeoutError, SUBDOMAIN_LABEL_RE, DEFAULT_JSON_OK_STATUSES, TIMEOUT_RETRY_SAFE_METHODS, FetchproxyServer;
+var FetchproxyProtocolError, FetchproxyHttpError, FetchproxyBridgeDownError, FetchproxyHintedError, FetchproxyScopeError, FetchproxyNoTabError, FetchproxyTabOpeningError, FetchproxyWaitedError, FetchproxyCapabilityUnavailableError, SCOPE_REJECTION, NO_TAB_REJECTION, TAB_OPENING_REJECTION, VERB_DEADLINE_GRACE_MS, FetchproxyTimeoutError, TIMEOUT_NOT_RESENT_NOTE, SUBDOMAIN_LABEL_RE, DEFAULT_JSON_OK_STATUSES, TIMEOUT_RETRY_SAFE_METHODS, FetchproxyServer;
 var init_ws_server = __esm({
   "node_modules/@fetchproxy/server/dist/ws-server.js"() {
     init_dist3();
+    init_session_info();
     init_election();
     init_host();
     init_peer();
     init_identity();
     init_extension_trust();
+    init_extension_pins();
     init_error_kind();
     init_classify_bridge_error();
     FetchproxyProtocolError = class extends Error {
@@ -43545,7 +44068,7 @@ var init_ws_server = __esm({
         const retryAttempted = args.retryAttempted ?? false;
         const op = args.op ?? "fetch";
         const retryClause = retryAttempted ? `Server already burned a one-shot lazy-revive retry; SW is still down. ` : `Server lazy-revive retry was disabled (bridgeReviveDelayMs unset/0). `;
-        const hint = `the fetchproxy extension's service worker is not responding ("${args.originalError}"). Chrome evicts extension service workers after ~30s idle by default. ${retryClause}Make sure a tab for this domain is open, fully loaded, and signed in (the bridge fetches through that tab) \u2014 then retry. If it keeps happening, reload the extension from chrome://extensions and reload the tab.`;
+        const hint = `ContextMint Bridge's service worker is not responding ("${args.originalError}"). Chrome evicts extension service workers after ~30s idle by default. ${retryClause}Make sure a tab for this domain is open, fully loaded, and signed in (the bridge fetches through that tab) \u2014 then retry. If it keeps happening, reload the extension from chrome://extensions and reload the tab.`;
         super(`fetchproxy bridge down during ${op}${args.url ? ` (${args.url})` : ""}. ${hint}`);
         this.name = "FetchproxyBridgeDownError";
         this.originalError = args.originalError;
@@ -43572,7 +44095,7 @@ var init_ws_server = __esm({
     };
     FetchproxyScopeError = class extends FetchproxyHintedError {
       constructor(originalError) {
-        super(originalError, "the declared scope changed since you paired, so the extension is refusing the request. Revoke this MCP in the Transporter extension popup, then re-run \u2014 you will be asked to approve the new scope. This is not a version problem and does not need an update.");
+        super(originalError, "the declared scope changed since you paired, so the extension is refusing the request. Revoke this MCP in the ContextMint Bridge extension popup, then re-run \u2014 you will be asked to approve the new scope. This is not a version problem and does not need an update.");
         this.name = "FetchproxyScopeError";
       }
     };
@@ -43594,6 +44117,19 @@ var init_ws_server = __esm({
         this.name = "FetchproxyWaitedError";
       }
     };
+    FetchproxyCapabilityUnavailableError = class extends FetchproxyHintedError {
+      /** The capability the browser cannot serve (`graphql` for a `graphql_query`). */
+      capability;
+      /** The browser, when known (`'safari'`); `null` when the extension did not say. */
+      platform;
+      constructor(originalError, info) {
+        const where = info.platform ? `this browser (${info.platform})` : "this browser";
+        super(originalError, `${where} cannot serve the "${info.capability}" capability \u2014 ContextMint Bridge checked for the browser API it needs and it is missing. The rest of this MCP still works here. Nothing is wrong with the MCP's code or your pairing, and neither updating nor re-approving will change it: use this tool from a browser that provides the API (for example Chrome).`);
+        this.name = "FetchproxyCapabilityUnavailableError";
+        this.capability = info.capability;
+        this.platform = info.platform;
+      }
+    };
     SCOPE_REJECTION = /not in declared/;
     NO_TAB_REJECTION = /no tab matching (?!.*(content script loaded|one is still opening))/;
     TAB_OPENING_REJECTION = /no tab matching .*one is still opening/;
@@ -43640,7 +44176,8 @@ var init_ws_server = __esm({
       constructor(args) {
         const graceMs = args.graceMs ?? VERB_DEADLINE_GRACE_MS;
         const callerChose = args.requestedTimeoutMs !== void 0 && args.timeoutMs === args.requestedTimeoutMs + graceMs;
-        super(`fetchproxy: ${args.url} did not respond within ${args.timeoutMs}ms` + (callerChose ? ` \u2014 the ${args.requestedTimeoutMs}ms this call asked for, plus ${graceMs}ms for the reply to reach this server. The extension runs its own timer on the value you passed, so a window that is genuinely too short reports what did not happen rather than this.` : ""));
+        const base = `fetchproxy: ${args.url} did not respond within ${args.timeoutMs}ms` + (callerChose ? ` \u2014 the ${args.requestedTimeoutMs}ms this call asked for, plus ${graceMs}ms for the reply to reach this server. The extension runs its own timer on the value you passed, so a window that is genuinely too short reports what did not happen rather than this.` : "");
+        super(args.retrySafe === false ? withNotResentNote(base) : base);
         this.name = "FetchproxyTimeoutError";
         this.url = args.url;
         this.timeoutMs = args.timeoutMs;
@@ -43652,6 +44189,7 @@ var init_ws_server = __esm({
         this.retrySafe = args.retrySafe ?? true;
       }
     };
+    TIMEOUT_NOT_RESENT_NOTE = "It was not re-sent because it may already have run in the browser \u2014 check before retrying.";
     SUBDOMAIN_LABEL_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/i;
     DEFAULT_JSON_OK_STATUSES = [200, 201, 202, 204];
     TIMEOUT_RETRY_SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
@@ -43851,6 +44389,7 @@ var init_ws_server = __esm({
           identityDir: opts.identityDir,
           trustDir: opts.trustDir,
           allowNewExtensionIdentity: opts.allowNewExtensionIdentity,
+          extensionPins: opts.extensionPins,
           requireExtensionIdentity: opts.requireExtensionIdentity,
           onPairCode: opts.onPairCode
         };
@@ -43936,6 +44475,7 @@ var init_ws_server = __esm({
           this.role = "host";
           this.hostHandle = await startHost({
             httpServer: el.server,
+            refuseOutbound: (inner, info) => this.refuseIfUnavailable(inner, info),
             ownIdentity: identity,
             ownMcpId: mcpId,
             ownServerName: this.opts.serverName,
@@ -43966,6 +44506,7 @@ var init_ws_server = __esm({
         } else {
           this.role = "peer";
           this.peerHandle = await startPeer({
+            refuseOutbound: (inner, info) => this.refuseIfUnavailable(inner, info),
             host: this.opts.host,
             port: this.opts.port,
             identity,
@@ -44014,7 +44555,7 @@ var init_ws_server = __esm({
         }
       }
       pairingErrorMessage(code) {
-        return `fetchproxy transport error: pairing required for ${this.opts.serverName}. Tell the user to open the Transporter browser extension popup and approve the pair request. The pair code is: ${code} \u2014 display this code to the user so they can verify it matches.`;
+        return `fetchproxy transport error: pairing required for ${this.opts.serverName}. Tell the user to open the ContextMint Bridge browser extension popup and approve the pair request. The pair code is: ${code} \u2014 display this code to the user so they can verify it matches.`;
       }
       /**
        * Raw single-shot fetch through the bridge. Most callers should prefer
@@ -44144,13 +44685,28 @@ var init_ws_server = __esm({
        * every one of them.
        */
       extensionTrust() {
+        const allowNew = allowNewExtensionIdentity(this.opts.allowNewExtensionIdentity);
+        if (resolveExtensionPinsMode(this.opts.extensionPins) === "managed") {
+          if (allowNew && !this.warnedAllowNewIgnored) {
+            this.warnedAllowNewIgnored = true;
+            console.warn(`[fetchproxy] ${this.opts.serverName}: ignoring ${TRUST_NEW_EXTENSION_ENV} / allowNewExtensionIdentity \u2014 this MCP's extension pins are host-managed (${EXTENSION_PINS_ENV}=managed), so only the host's pin set decides which browsers it accepts.`);
+          }
+          return fileExtensionTrust({
+            serverName: this.opts.serverName,
+            dir: this.opts.identityDir,
+            trustDir: this.opts.trustDir,
+            allowNew: false,
+            extensionPins: "managed"
+          });
+        }
         return fileExtensionTrust({
           serverName: this.opts.serverName,
           dir: this.opts.identityDir,
           trustDir: this.opts.trustDir,
-          allowNew: allowNewExtensionIdentity(this.opts.allowNewExtensionIdentity)
+          allowNew
         });
       }
+      warnedAllowNewIgnored = false;
       noteActivityForKeepalive() {
         const intervalMs = this.opts.keepAliveIntervalMs;
         if (intervalMs <= 0)
@@ -44244,6 +44800,15 @@ var init_ws_server = __esm({
             resendable: isRetrySafeOnTimeout(init.method, fetchOpts.retryOnTimeout)
           });
         } catch (err) {
+          if (err instanceof FetchproxyCapabilityUnavailableError) {
+            return {
+              ok: false,
+              error: err.originalError,
+              kind: "capability_unavailable",
+              retryAttempted: false,
+              cause: err
+            };
+          }
           return {
             ok: false,
             error: err instanceof Error ? err.message : String(err),
@@ -44264,7 +44829,8 @@ var init_ws_server = __esm({
               timer = setTimeout(() => {
                 this.pending.delete(id);
                 const elapsedMs = Date.now() - start;
-                const error62 = `fetchproxy: ${init.url} did not respond within ${timeoutMs}ms`;
+                const base = `fetchproxy: ${init.url} did not respond within ${timeoutMs}ms`;
+                const error62 = isRetrySafeOnTimeout(init.method, fetchOpts.retryOnTimeout) ? base : withNotResentNote(base);
                 resolve2({
                   ok: false,
                   error: error62,
@@ -44386,6 +44952,9 @@ var init_ws_server = __esm({
             port: this.opts.port
           });
         }
+        if (result.kind === "capability_unavailable") {
+          return protocolErrorFrom(result.error, void 0, { code: CAPABILITY_UNAVAILABLE_CODE, op });
+        }
         return protocolErrorFrom(result.error);
       }
       /**
@@ -44452,6 +45021,9 @@ var init_ws_server = __esm({
           if (result.kind === "session_not_ready" && result.cause instanceof Error) {
             throw result.cause;
           }
+          if (result.kind === "capability_unavailable" && result.cause instanceof FetchproxyCapabilityUnavailableError) {
+            throw result.cause;
+          }
           throw this._typedErrorFor(result, init.url, "fetch", result.retryAttempted ?? false, isRetrySafeOnTimeout(method, opts.retryOnTimeout));
         }
         const response = {
@@ -44634,7 +45206,9 @@ var init_ws_server = __esm({
             session_state: health.session.state,
             pending_pair_code: health.session.pairCode,
             extension_connected: health.session.extensionConnected,
-            last_extension_message_at: health.lastExtensionMessageAt
+            last_extension_message_at: health.lastExtensionMessageAt,
+            unavailable_capabilities: health.session.unavailableCapabilities,
+            platform: health.session.platform
           },
           ...error62 ? { error: error62 } : {}
         };
@@ -45280,7 +45854,7 @@ var init_ws_server = __esm({
             fetchCb({
               ok: false,
               error: inner.error,
-              kind: classifyFetchError(inner.error),
+              kind: classifyFetchError(inner.error, inner.code),
               retryAttempted: false
             });
           }
@@ -45296,7 +45870,7 @@ var init_ws_server = __esm({
               storageCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on storage awaiter`));
             }
           } else {
-            storageCb.reject(protocolErrorFrom(inner.error));
+            storageCb.reject(protocolErrorFrom(inner.error, void 0, inner));
           }
           return;
         }
@@ -45310,7 +45884,7 @@ var init_ws_server = __esm({
               captureCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on capture awaiter`));
             }
           } else {
-            captureCb.reject(protocolErrorFrom(inner.error, "capture"));
+            captureCb.reject(protocolErrorFrom(inner.error, "capture", inner));
           }
           return;
         }
@@ -45324,7 +45898,7 @@ var init_ws_server = __esm({
               redirectCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on capture_redirect awaiter`));
             }
           } else {
-            redirectCb.reject(protocolErrorFrom(inner.error, "capture_redirect"));
+            redirectCb.reject(protocolErrorFrom(inner.error, "capture_redirect", inner));
           }
           return;
         }
@@ -45338,7 +45912,7 @@ var init_ws_server = __esm({
               idbCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on read_indexed_db awaiter`));
             }
           } else {
-            idbCb.reject(protocolErrorFrom(inner.error));
+            idbCb.reject(protocolErrorFrom(inner.error, void 0, inner));
           }
           return;
         }
@@ -45352,7 +45926,7 @@ var init_ws_server = __esm({
               domListCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on read_dom_list awaiter`));
             }
           } else {
-            domListCb.reject(protocolErrorFrom(inner.error));
+            domListCb.reject(protocolErrorFrom(inner.error, void 0, inner));
           }
           return;
         }
@@ -45366,7 +45940,7 @@ var init_ws_server = __esm({
               downloadCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on download awaiter`));
             }
           } else {
-            downloadCb.reject(protocolErrorFrom(inner.error, "download"));
+            downloadCb.reject(protocolErrorFrom(inner.error, "download", inner));
           }
           return;
         }
@@ -45380,7 +45954,7 @@ var init_ws_server = __esm({
               graphqlCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on graphql_query awaiter`));
             }
           } else {
-            graphqlCb.reject(protocolErrorFrom(inner.error));
+            graphqlCb.reject(protocolErrorFrom(inner.error, void 0, inner));
           }
           return;
         }
@@ -45390,7 +45964,7 @@ var init_ws_server = __esm({
           if (inner.ok && inner.op === "write_cookies") {
             writeCookiesCb.resolve([...inner.written]);
           } else {
-            writeCookiesCb.reject(protocolErrorFrom(inner.ok ? "write_cookies response had the wrong op" : inner.error));
+            writeCookiesCb.reject(inner.ok ? protocolErrorFrom("write_cookies response had the wrong op") : protocolErrorFrom(inner.error, void 0, inner));
           }
           return;
         }
@@ -45580,11 +46154,38 @@ var init_ws_server = __esm({
         const handle = this.hostHandle ?? this.peerHandle;
         const pairCode = this.currentPendingPairCode();
         if (!handle || this.role === null) {
-          return { state: "not_listening", pairCode, extensionConnected: false };
+          return {
+            state: "not_listening",
+            pairCode,
+            extensionConnected: false,
+            unavailableCapabilities: [],
+            platform: null
+          };
         }
+        const info = handle.sessionInfo?.() ?? null;
         const extensionConnected = handle.extensionConnected();
         const state = handle.sessionLinked() ? "linked" : pairCode !== null ? "pair_pending" : !extensionConnected ? "extension_disconnected" : "no_session";
-        return { state, pairCode, extensionConnected };
+        return {
+          state,
+          pairCode,
+          extensionConnected,
+          unavailableCapabilities: info ? [...info.unavailableCapabilities] : [],
+          platform: info?.platform ?? null
+        };
+      }
+      /**
+       * #418: refuse, before a seq is claimed, a request whose capability the
+       * extension said this browser cannot serve. Called by the host / peer
+       * handle once the session is ready, so it judges against the list from the
+       * hello that session was verified against. Advisory: the list is unsigned,
+       * so it may only ever make this MCP refuse MORE — the extension still
+       * enforces from its own runtime check for anything that gets through.
+       */
+      refuseIfUnavailable(inner, info) {
+        const cap = unavailableCapabilityFor(inner, info);
+        if (cap === null || info === null)
+          return;
+        throw new FetchproxyCapabilityUnavailableError(capabilityUnavailableMessage(cap, info.platform), { capability: cap, platform: info.platform });
       }
       /**
        * 0.5.2+: throw `FetchproxyProtocolError` with the actionable pair-code
@@ -45684,6 +46285,7 @@ var init_dist4 = __esm({
     init_parse_html();
     init_batch();
     init_extension_trust();
+    init_extension_pins();
     init_identity();
   }
 });
@@ -47520,7 +48122,7 @@ await runMcp({
 });
 /*! Bundled license information:
 
-@modelcontextprotocol/server/dist/src-CX2iR2pK.mjs:
+@modelcontextprotocol/server/dist/src-D-y6h4N7.mjs:
   (*!
   * content-type
   * Copyright(c) 2015 Douglas Christopher Wilson