@oss-scout/mcp 0.11.0 → 0.12.1

package/dist/mcp-server.bundle.cjs

@@ -3100,16 +3100,18 @@ var require_data = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@4.1.2/node_modules/fast-uri/lib/utils.js
+// ../../node_modules/.pnpm/fast-uri@4.1.5/node_modules/fast-uri/lib/utils.js
 var require_utils = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@4.1.2/node_modules/fast-uri/lib/utils.js"(exports2, module2) {
+  "../../node_modules/.pnpm/fast-uri@4.1.5/node_modules/fast-uri/lib/utils.js"(exports2, module2) {
     "use strict";
     var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
     var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
+    var isPort = RegExp.prototype.test.bind(/^\d*$/u);
     var isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);
     var isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);
-    var isPathCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/]$/iu);
-    var isQueryFragmentCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/?]$/iu);
+    var isPathCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/]$/u);
+    var isQueryFragmentCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/?]$/u);
+    var isUserinfoCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:]$/u);
     function stringArrayToHexStripped(input) {
       let acc = "";
       let code = 0;
@@ -3134,91 +3136,110 @@ var require_utils = __commonJS({
       }
       return acc;
     }
+    var isHextet = RegExp.prototype.test.bind(/^[\dA-Fa-f]{1,4}$/);
+    var isIPvFuture = RegExp.prototype.test.bind(/^[vV][\dA-Fa-f]+\.[A-Za-z\d\-._~!$&'()*+,;=:]+$/);
+    var isZoneCharacter = RegExp.prototype.test.bind(/^[A-Za-z\d\-._~]$/);
     var nonSimpleDomain = RegExp.prototype.test.bind(/[^!"$&'()*+,\-.;=_`a-z{}~]/u);
-    function consumeIsZone(buffer) {
-      buffer.length = 0;
-      return true;
-    }
-    function consumeHextets(buffer, address, output) {
-      if (buffer.length) {
-        const hex3 = stringArrayToHexStripped(buffer);
-        if (hex3 !== "") {
-          address.push(hex3);
-        } else {
-          output.error = true;
-          return false;
+    var nonSimpleDomainChars = RegExp.prototype.test.bind(/[^\d!"$&'()*+,\-.;=_`a-z{}~]/u);
+    var numericLastLabel = RegExp.prototype.test.bind(/(?:^|\.)\d+$/u);
+    function nonSimpleMailtoDomain(domain2) {
+      return nonSimpleDomainChars(domain2) || numericLastLabel(domain2);
+    }
+    function isZoneIdentifier(zone) {
+      if (zone.length === 0) return false;
+      for (let i = 0; i < zone.length; i++) {
+        if (isZoneCharacter(zone[i])) continue;
+        if (zone[i] === "%" && i + 2 < zone.length && isHexPair(zone.slice(i + 1, i + 3))) {
+          i += 2;
+          continue;
         }
-        buffer.length = 0;
+        return false;
       }
       return true;
     }
-    function getIPV6(input) {
-      let tokenCount = 0;
-      const output = { error: false, address: "", zone: "" };
-      const address = [];
-      const buffer = [];
-      let endipv6Encountered = false;
-      let endIpv6 = false;
-      let consume = consumeHextets;
-      for (let i = 0; i < input.length; i++) {
-        const cursor = input[i];
-        if (cursor === "[" || cursor === "]") {
-          continue;
-        }
-        if (cursor === ":") {
-          if (endipv6Encountered === true) {
-            endIpv6 = true;
-          }
-          if (!consume(buffer, address, output)) {
-            break;
-          }
-          if (++tokenCount > 7) {
-            output.error = true;
-            break;
-          }
-          if (i > 0 && input[i - 1] === ":") {
-            endipv6Encountered = true;
-          }
-          address.push(":");
-          continue;
-        } else if (cursor === "%") {
-          if (!consume(buffer, address, output)) {
-            break;
+    function compressIPv6ZeroRun(hextets) {
+      let bestStart = -1;
+      let bestLength = 0;
+      let runStart = -1;
+      let runLength = 0;
+      for (let i = 0; i < hextets.length; i++) {
+        if (hextets[i] === "0") {
+          if (runStart === -1) runStart = i;
+          runLength++;
+          if (runLength > bestLength) {
+            bestLength = runLength;
+            bestStart = runStart;
           }
-          consume = consumeIsZone;
         } else {
-          buffer.push(cursor);
+          runStart = -1;
+          runLength = 0;
+        }
+      }
+      if (bestLength < 2) return hextets.join(":");
+      const head = hextets.slice(0, bestStart).join(":");
+      const tail = hextets.slice(bestStart + bestLength).join(":");
+      return head + "::" + tail;
+    }
+    function normalizeIPv6Address(input) {
+      const compression = input.indexOf("::");
+      if (compression !== -1 && input.indexOf("::", compression + 1) !== -1) return void 0;
+      const left = compression === -1 ? input.split(":") : input.slice(0, compression).split(":");
+      const right = compression === -1 ? [] : input.slice(compression + 2).split(":");
+      if (compression !== -1) {
+        if (left.length === 1 && left[0] === "") left.length = 0;
+        if (right.length === 1 && right[0] === "") right.length = 0;
+      }
+      const parts = left.concat(right);
+      let hextetCount = 0;
+      for (let i = 0; i < parts.length; i++) {
+        const part = parts[i];
+        if (part === "") return void 0;
+        if (part.indexOf(".") !== -1) {
+          if (i !== parts.length - 1 || compression !== -1 && right.length === 0 || !isIPv4(part)) return void 0;
+          hextetCount += 2;
           continue;
         }
+        if (!isHextet(part)) return void 0;
+        parts[i] = parseInt(part, 16).toString(16);
+        hextetCount++;
       }
-      if (buffer.length) {
-        if (consume === consumeIsZone) {
-          output.zone = buffer.join("");
-        } else if (endIpv6) {
-          address.push(buffer.join(""));
-        } else {
-          address.push(stringArrayToHexStripped(buffer));
-        }
+      if (compression === -1) {
+        if (hextetCount !== 8) return void 0;
+        return compressIPv6ZeroRun(parts);
       }
-      output.address = address.join("");
-      return output;
+      if (hextetCount >= 8) return void 0;
+      const expanded = parts.slice(0, left.length);
+      for (let i = hextetCount; i < 8; i++) expanded.push("0");
+      for (let i = left.length; i < parts.length; i++) expanded.push(parts[i]);
+      return compressIPv6ZeroRun(expanded);
     }
     function normalizeIPv6(host) {
-      if (findToken(host, ":") < 2) {
-        return { host, isIPV6: false };
-      }
-      const ipv63 = getIPV6(host);
-      if (!ipv63.error) {
-        let newHost = ipv63.address;
-        let escapedHost = ipv63.address;
-        if (ipv63.zone) {
-          newHost += "%" + ipv63.zone;
-          escapedHost += "%25" + ipv63.zone;
-        }
-        return { host: newHost, isIPV6: true, escapedHost };
-      } else {
-        return { host, isIPV6: false };
-      }
+      const bracketed = host[0] === "[" && host[host.length - 1] === "]";
+      const hasBracket = host[0] === "[" || host[host.length - 1] === "]";
+      if (hasBracket && !bracketed) return { host, isIPV6: false, error: true };
+      let input = bracketed ? host.slice(1, -1) : host;
+      if (bracketed && isIPvFuture(input)) {
+        input = input.toLowerCase();
+        return { host: `[${input}]`, escapedHost: input, isIPV6: false, isIPVFuture: true };
+      }
+      if (findToken(input, ":") < 2) {
+        return { host, isIPV6: false, error: bracketed };
+      }
+      let zoneIdentifier = "";
+      const zoneSeparator = input.indexOf("%");
+      if (zoneSeparator !== -1) {
+        const separatorLength = input.slice(zoneSeparator, zoneSeparator + 3).toLowerCase() === "%25" ? 3 : 1;
+        zoneIdentifier = input.slice(zoneSeparator + separatorLength);
+        if (!isZoneIdentifier(zoneIdentifier)) return { host, isIPV6: false, error: true };
+        input = input.slice(0, zoneSeparator);
+      }
+      const address = normalizeIPv6Address(input);
+      if (address === void 0) return { host, isIPV6: false, error: true };
+      return {
+        host: address + (zoneIdentifier ? "%" + zoneIdentifier : ""),
+        escapedHost: address + (zoneIdentifier ? "%25" + zoneIdentifier : ""),
+        isIPV6: true
+      };
     }
     function findToken(str, token) {
       let ind = 0;
@@ -3394,6 +3415,45 @@ var require_utils = __commonJS({
       }
       return output;
     }
+    function serializePathEncoding(input, pathNoScheme = false) {
+      let output = "";
+      let firstSegment = pathNoScheme && input[0] !== "/";
+      for (let i = 0; i < input.length; i++) {
+        const ch = input[i];
+        if (ch === "%" && i + 2 < input.length) {
+          const hex3 = input.slice(i + 1, i + 3);
+          if (isHexPair(hex3)) {
+            output += "%" + hex3.toUpperCase();
+            i += 2;
+            continue;
+          }
+        }
+        if (ch === "/") {
+          firstSegment = false;
+        }
+        if (isPathCharacter(ch) && (ch !== ":" || !firstSegment)) {
+          output += ch;
+        } else {
+          const code = input.charCodeAt(i);
+          if (code < 128) {
+            output += BYTE_HEX[code];
+          } else if (code < 55296 || code > 57343) {
+            output += percentEncodeNonAscii(code);
+          } else if (code <= 56319 && i + 1 < input.length) {
+            const low = input.charCodeAt(i + 1);
+            if (low >= 56320 && low <= 57343) {
+              output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+              i++;
+            } else {
+              output += percentEncodeNonAscii(65533);
+            }
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        }
+      }
+      return output;
+    }
     function normalizeQueryFragmentEncoding(input) {
       let output = "";
       for (let i = 0; i < input.length; i++) {
@@ -3435,6 +3495,50 @@ var require_utils = __commonJS({
       }
       return output;
     }
+    function encodeComponent(input, isAllowed) {
+      let output = "";
+      for (let i = 0; i < input.length; i++) {
+        const ch = input[i];
+        if (ch === "%" && i + 2 < input.length) {
+          const hex3 = input.slice(i + 1, i + 3);
+          if (isHexPair(hex3)) {
+            output += "%" + hex3.toUpperCase();
+            i += 2;
+            continue;
+          }
+        }
+        if (isAllowed(ch)) {
+          output += ch;
+        } else {
+          const code = input.charCodeAt(i);
+          if (code < 128) {
+            output += BYTE_HEX[code];
+          } else if (code < 55296 || code > 57343) {
+            output += percentEncodeNonAscii(code);
+          } else if (code <= 56319 && i + 1 < input.length) {
+            const low = input.charCodeAt(i + 1);
+            if (low >= 56320 && low <= 57343) {
+              output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+              i++;
+            } else {
+              output += percentEncodeNonAscii(65533);
+            }
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        }
+      }
+      return output;
+    }
+    function encodeUserinfo(input) {
+      return encodeComponent(input, isUserinfoCharacter);
+    }
+    function encodeQuery(input) {
+      return encodeComponent(input, isQueryFragmentCharacter);
+    }
+    function encodeFragment(input) {
+      return encodeComponent(input, isQueryFragmentCharacter);
+    }
     function escapePreservingEscapes(input) {
       let output = "";
       for (let i = 0; i < input.length; i++) {
@@ -3469,14 +3573,18 @@ var require_utils = __commonJS({
     function recomposeAuthority(component) {
       const uriTokens = [];
       if (component.userinfo !== void 0) {
-        uriTokens.push(component.userinfo);
+        uriTokens.push(encodeUserinfo(component.userinfo));
         uriTokens.push("@");
       }
       if (component.host !== void 0) {
-        let host = unescape(component.host);
+        let host = component.host;
         if (!isIPv4(host)) {
-          const ipV6res = normalizeIPv6(host);
-          if (ipV6res.isIPV6 === true) {
+          let ipV6res = normalizeIPv6(host);
+          if (ipV6res.isIPV6 !== true && ipV6res.isIPVFuture !== true) {
+            host = normalizePercentEncoding(host, true);
+            ipV6res = normalizeIPv6(host);
+          }
+          if (ipV6res.isIPV6 === true || ipV6res.isIPVFuture === true) {
             host = `[${ipV6res.escapedHost}]`;
           } else {
             host = reescapeHostDelimiters(host, false);
@@ -3485,18 +3593,29 @@ var require_utils = __commonJS({
         uriTokens.push(host);
       }
       if (typeof component.port === "number" || typeof component.port === "string") {
+        const port = String(component.port);
+        if (!isPort(port)) {
+          throw new TypeError("URI port is malformed.");
+        }
         uriTokens.push(":");
-        uriTokens.push(String(component.port));
+        uriTokens.push(port);
       }
       return uriTokens.length ? uriTokens.join("") : void 0;
     }
     module2.exports = {
+      BYTE_HEX,
+      percentEncodeNonAscii,
       nonSimpleDomain,
+      nonSimpleMailtoDomain,
       recomposeAuthority,
       reescapeHostDelimiters,
       normalizePercentEncoding,
       normalizePathEncoding,
+      serializePathEncoding,
       normalizeQueryFragmentEncoding,
+      encodeUserinfo,
+      encodeQuery,
+      encodeFragment,
       escapePreservingEscapes,
       removeDotSegments,
       isIPv4,
@@ -3507,12 +3626,12 @@ var require_utils = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@4.1.2/node_modules/fast-uri/lib/schemes.js
+// ../../node_modules/.pnpm/fast-uri@4.1.5/node_modules/fast-uri/lib/schemes.js
 var require_schemes = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@4.1.2/node_modules/fast-uri/lib/schemes.js"(exports2, module2) {
+  "../../node_modules/.pnpm/fast-uri@4.1.5/node_modules/fast-uri/lib/schemes.js"(exports2, module2) {
     "use strict";
-    var { isUUID } = require_utils();
-    var URN_REG = /([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-.:;=@]|%[\da-f]{2})+)/iu;
+    var { isUUID, BYTE_HEX, percentEncodeNonAscii, nonSimpleMailtoDomain } = require_utils();
+    var URN_REG = /^([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-./:;=@]|%[\da-f]{2})+)$/iu;
     var supportedSchemeNames = (
       /** @type {const} */
       [
@@ -3521,7 +3640,8 @@ var require_schemes = __commonJS({
         "ws",
         "wss",
         "urn",
-        "urn:uuid"
+        "urn:uuid",
+        "mailto"
       ]
     );
     function isValidSchemeName(name) {
@@ -3573,9 +3693,10 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path5, query] = wsComponent.resourceName.split("?");
+        const queryIndex = wsComponent.resourceName.indexOf("?");
+        const path5 = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
         wsComponent.path = path5 && path5 !== "/" ? path5 : void 0;
-        wsComponent.query = query;
+        wsComponent.query = queryIndex === -1 ? void 0 : wsComponent.resourceName.slice(queryIndex + 1);
         wsComponent.resourceName = void 0;
       }
       wsComponent.fragment = void 0;
@@ -3587,7 +3708,7 @@ var require_schemes = __commonJS({
         return urnComponent;
       }
       const matches = urnComponent.path.match(URN_REG);
-      if (matches) {
+      if (matches && matches[0] === urnComponent.path) {
         const scheme = options.scheme || urnComponent.scheme || "urn";
         urnComponent.nid = matches[1].toLowerCase();
         urnComponent.nss = matches[2];
@@ -3687,6 +3808,242 @@ var require_schemes = __commonJS({
         skipNormalize: true
       }
     );
+    var LOCAL_PART_ALLOWED = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~!$'()*+=";
+    var HFNAME_ALLOWED = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~!$'()*+,;:@";
+    var DTEXT_ALLOWED = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~!$'()*+;:";
+    function allowSet(chars, allowNonAscii = false) {
+      const table = new Uint8Array(128);
+      for (let i = 0; i < chars.length; i++) {
+        table[chars.charCodeAt(i)] = 1;
+      }
+      const escaped = chars.replace(/[\\\]^-]/gu, "\\$&");
+      const cls = allowNonAscii ? `[${escaped}]|[^\\0-\\x7F\\uD800-\\uDFFF]` : `[${escaped}]`;
+      return { all: new RegExp(`^(?:${cls})*$`, "u"), table, allowNonAscii };
+    }
+    var LOCAL_PART = allowSet(LOCAL_PART_ALLOWED);
+    var HFNAME = allowSet(HFNAME_ALLOWED);
+    var DTEXT = allowSet(DTEXT_ALLOWED);
+    var DTEXT_IRI = allowSet(DTEXT_ALLOWED, true);
+    var HEX_PAIR = /^[\da-f]{2}$/iu;
+    var MAILTO_DOMAIN_LITERAL = /^\[[\x21-\x5A\x5E-\x7E]*\]$/u;
+    var MAILTO_DOMAIN_ERROR = "URI mailto has an invalid recipient domain.";
+    var HAS_SURROGATE = /[\uD800-\uDFFF]/u;
+    function decodeHex(str) {
+      if (typeof str !== "string" || str.indexOf("%") === -1) {
+        return str;
+      }
+      try {
+        return decodeURIComponent(str);
+      } catch {
+        return str;
+      }
+    }
+    function replaceLoneSurrogates(input) {
+      let result = "";
+      for (let i = 0; i < input.length; i++) {
+        const code = input.charCodeAt(i);
+        if (code >= 55296 && code <= 56319 && i + 1 < input.length) {
+          const low = input.charCodeAt(i + 1);
+          if (low >= 56320 && low <= 57343) {
+            result += input[i] + input[i + 1];
+            i++;
+            continue;
+          }
+        }
+        result += code >= 55296 && code <= 57343 ? "\uFFFD" : input[i];
+      }
+      return result;
+    }
+    function encodeWithAllow(input, set2) {
+      if (set2.all.test(input)) {
+        return input;
+      }
+      const table = set2.table;
+      let result = "";
+      for (let i = 0; i < input.length; i++) {
+        const code = input.charCodeAt(i);
+        if (code < 128) {
+          if (table[code] === 1) {
+            result += input[i];
+          } else if (code === 37 && i + 2 < input.length && HEX_PAIR.test(input.slice(i + 1, i + 3))) {
+            result += "%" + input.slice(i + 1, i + 3).toUpperCase();
+            i += 2;
+          } else {
+            result += BYTE_HEX[code];
+          }
+          continue;
+        }
+        if (code < 55296 || code > 57343) {
+          result += set2.allowNonAscii ? input[i] : percentEncodeNonAscii(code);
+          continue;
+        }
+        if (code <= 56319 && i + 1 < input.length) {
+          const low = input.charCodeAt(i + 1);
+          if (low >= 56320 && low <= 57343) {
+            result += set2.allowNonAscii ? input[i] + input[i + 1] : percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+            i++;
+            continue;
+          }
+        }
+        result += set2.allowNonAscii ? "\uFFFD" : percentEncodeNonAscii(65533);
+      }
+      return result;
+    }
+    function mailtoNormalizeDomain(domain2, options, component) {
+      const normalizedDomain = String(domain2).toLowerCase();
+      if (MAILTO_DOMAIN_LITERAL.test(normalizedDomain)) {
+        return normalizedDomain;
+      }
+      if (normalizedDomain !== "" && !nonSimpleMailtoDomain(normalizedDomain)) {
+        return normalizedDomain;
+      }
+      try {
+        const parsedDomain = new URL("http://" + normalizedDomain);
+        if (parsedDomain.username || parsedDomain.password || parsedDomain.port || parsedDomain.pathname !== "/" || parsedDomain.search || parsedDomain.hash || !parsedDomain.hostname) {
+          throw new Error(MAILTO_DOMAIN_ERROR);
+        }
+        return options && options.unicodeSupport ? normalizedDomain : parsedDomain.hostname;
+      } catch {
+        if (component) {
+          component.error = component.error || MAILTO_DOMAIN_ERROR;
+        }
+        return normalizedDomain;
+      }
+    }
+    function mailtoEncodeDomain(domain2, options) {
+      const set2 = options && options.unicodeSupport ? DTEXT_IRI : DTEXT;
+      if (domain2.length > 1 && domain2[0] === "[" && domain2[domain2.length - 1] === "]") {
+        return "[" + encodeWithAllow(domain2.slice(1, -1), set2) + "]";
+      }
+      return encodeWithAllow(domain2, set2);
+    }
+    function mailtoParse(component, options) {
+      const mailtoComponent = component;
+      let rawPath = mailtoComponent.path;
+      let rawQuery = mailtoComponent.query;
+      if (rawPath && HAS_SURROGATE.test(rawPath)) rawPath = replaceLoneSurrogates(rawPath);
+      if (rawQuery && HAS_SURROGATE.test(rawQuery)) rawQuery = replaceLoneSurrogates(rawQuery);
+      const to = rawPath ? rawPath.indexOf(",") === -1 ? [rawPath] : rawPath.split(",") : [];
+      mailtoComponent.path = void 0;
+      if (rawQuery) {
+        let headers = null;
+        let start = 0;
+        while (start <= rawQuery.length) {
+          let end = rawQuery.indexOf("&", start);
+          if (end === -1) end = rawQuery.length;
+          const token = rawQuery.slice(start, end);
+          start = end + 1;
+          const eqIdx = token.indexOf("=");
+          if (eqIdx !== token.lastIndexOf("=")) {
+            mailtoComponent.error = mailtoComponent.error || "URI mailto has malformed header fields.";
+            continue;
+          }
+          const name = decodeHex(eqIdx === -1 ? token : token.slice(0, eqIdx));
+          const normalizedName = name.toLowerCase();
+          const value = eqIdx === -1 ? "" : token.slice(eqIdx + 1);
+          if (normalizedName === "to") {
+            const addrs = value.split(",");
+            for (let j = 0; j < addrs.length; j++) to.push(addrs[j]);
+            continue;
+          }
+          if (normalizedName === "subject") {
+            mailtoComponent.subject = decodeHex(value);
+            continue;
+          }
+          if (normalizedName === "body") {
+            mailtoComponent.body = decodeHex(value);
+            continue;
+          }
+          if (headers === null) headers = /** @type {Record<string,string>} */
+          /* @__PURE__ */ Object.create(null);
+          headers[name] = decodeHex(value);
+        }
+        if (headers !== null) mailtoComponent.headers = headers;
+      }
+      mailtoComponent.query = void 0;
+      for (let i = 0; i < to.length; i++) {
+        const rawAddr = to[i];
+        const atIdx = rawAddr.lastIndexOf("@");
+        if (atIdx < 0) {
+          mailtoComponent.error = mailtoComponent.error || MAILTO_DOMAIN_ERROR;
+          to[i] = decodeHex(rawAddr);
+          continue;
+        }
+        const local = decodeHex(rawAddr.slice(0, atIdx));
+        const domain2 = mailtoNormalizeDomain(decodeHex(rawAddr.slice(atIdx + 1)), options, mailtoComponent);
+        to[i] = local + "@" + domain2;
+      }
+      if (to.length) mailtoComponent.to = to;
+      return mailtoComponent;
+    }
+    function mailtoEncodeHeaderName(name) {
+      return encodeWithAllow(name.replace(/%/gu, "%25"), HFNAME);
+    }
+    function mailtoSerialize(component, options) {
+      const mailtoComponent = component;
+      const to = Array.isArray(mailtoComponent.to) ? mailtoComponent.to.slice() : [];
+      const sourceHeaders = mailtoComponent.headers && typeof mailtoComponent.headers === "object" ? Object.assign(/* @__PURE__ */ Object.create(null), mailtoComponent.headers) : /* @__PURE__ */ Object.create(null);
+      const headers = /* @__PURE__ */ Object.create(null);
+      for (const name in sourceHeaders) {
+        const normalizedName = name.toLowerCase();
+        if (normalizedName === "to") {
+          const addrs = String(sourceHeaders[name]).split(",");
+          for (let i = 0; i < addrs.length; i++) to.push(addrs[i]);
+        } else if (normalizedName === "subject" || normalizedName === "body") {
+          headers[normalizedName] = sourceHeaders[name];
+        } else {
+          headers[name] = sourceHeaders[name];
+        }
+      }
+      if (mailtoComponent.subject !== void 0) headers.subject = mailtoComponent.subject;
+      if (mailtoComponent.body !== void 0) headers.body = mailtoComponent.body;
+      mailtoComponent.headers = headers;
+      if (to.length) {
+        for (let i = 0; i < to.length; i++) {
+          const addr = String(to[i]);
+          const atIdx = addr.lastIndexOf("@");
+          const rawLocal = atIdx >= 0 ? addr.slice(0, atIdx) : addr;
+          const rawDomain = atIdx >= 0 ? addr.slice(atIdx + 1) : "";
+          const local = encodeWithAllow(rawLocal, LOCAL_PART);
+          const decodedDomain = decodeHex(rawDomain);
+          const normalizedDomain = mailtoNormalizeDomain(decodedDomain, options);
+          to[i] = local + "@" + mailtoEncodeDomain(normalizedDomain, options);
+        }
+        mailtoComponent.path = to.join(",");
+        options.skipEscape = true;
+      } else {
+        mailtoComponent.path = void 0;
+      }
+      let query = "";
+      let count = 0;
+      for (const name in headers) {
+        if (count++ !== 0) query += "&";
+        query += mailtoEncodeHeaderName(name) + "=" + encodeWithAllow(String(headers[name]), HFNAME);
+      }
+      if (count !== 0) {
+        mailtoComponent.query = query;
+      } else {
+        mailtoComponent.headers = void 0;
+      }
+      return mailtoComponent;
+    }
+    var mailto = (
+      /** @type {SchemeHandler} */
+      {
+        scheme: "mailto",
+        parse: mailtoParse,
+        serialize: mailtoSerialize,
+        domainHost: false,
+        unicodeSupport: true,
+        // `mailtoParse` re-derives every component from the raw path/query via
+        // `decodeHex`, which subsumes the generic normalizers, so running them first
+        // is wasted work (~28% of parsing a URI with header fields).
+        skipNormalize: true,
+        // A recipient list has no dot segments to remove, and `removeDotSegments`
+        // would rewrite a "./"-prefixed local part.
+        absolutePath: true
+      }
+    );
     var SCHEMES = (
       /** @type {Record<SchemeName, SchemeHandler>} */
       {
@@ -3695,7 +4052,8 @@ var require_schemes = __commonJS({
         ws,
         wss,
         urn,
-        "urn:uuid": urnuuid
+        "urn:uuid": urnuuid,
+        mailto
       }
     );
     Object.setPrototypeOf(SCHEMES, null);
@@ -3717,12 +4075,21 @@ var require_schemes = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@4.1.2/node_modules/fast-uri/index.js
+// ../../node_modules/.pnpm/fast-uri@4.1.5/node_modules/fast-uri/index.js
 var require_fast_uri = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@4.1.2/node_modules/fast-uri/index.js"(exports2, module2) {
+  "../../node_modules/.pnpm/fast-uri@4.1.5/node_modules/fast-uri/index.js"(exports2, module2) {
     "use strict";
-    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, normalizeQueryFragmentEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
+    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
     var { SCHEMES, getSchemeHandler } = require_schemes();
+    var VALID_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/u;
+    var MALFORMED_SCHEME_ERROR = "URI scheme is malformed.";
+    function decodeValidScheme(scheme) {
+      const decodedScheme = unescape(String(scheme));
+      if (!VALID_SCHEME.test(decodedScheme)) {
+        throw new TypeError(MALFORMED_SCHEME_ERROR);
+      }
+      return decodedScheme;
+    }
     function normalize(uri, options) {
       if (typeof uri === "string") {
         uri = /** @type {T} */
@@ -3735,12 +4102,34 @@ var require_fast_uri = __commonJS({
     }
     function resolve(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
-      const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions);
-      const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions);
-      if (baseMalformed || relativeMalformed) {
+      const {
+        parsed: baseParsed,
+        malformedAuthorityOrPort: baseMalformed,
+        malformedPercentEncoding: baseMalformedPercentEncoding,
+        malformedSchemeSpecific: baseMalformedSchemeSpecific,
+        malformedHost: baseMalformedHost,
+        malformedScheme: baseMalformedScheme
+      } = parseWithStatus(baseURI, schemelessOptions);
+      const {
+        parsed: relativeParsed,
+        malformedAuthorityOrPort: relativeMalformed,
+        malformedPercentEncoding: relativeMalformedPercentEncoding,
+        malformedSchemeSpecific: relativeMalformedSchemeSpecific,
+        malformedHost: relativeMalformedHost,
+        malformedScheme: relativeMalformedScheme
+      } = parseWithStatus(relativeURI, schemelessOptions);
+      if (baseMalformed || relativeMalformed || baseMalformedPercentEncoding || relativeMalformedPercentEncoding || baseMalformedSchemeSpecific || relativeMalformedSchemeSpecific || baseMalformedHost || relativeMalformedHost || baseMalformedScheme || relativeMalformedScheme) {
         throw new Error(baseParsed.error || relativeParsed.error || "URI is malformed.");
       }
       const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true);
+      const resolvedSchemeHandler = getSchemeHandler(options && options.scheme || resolved.scheme);
+      const resolvedHost = resolved.host;
+      const resolvedHostIsIP = resolvedHost !== void 0 && resolvedHost !== "" && (isIPv4(resolvedHost) || normalizeIPv6(resolvedHost).isIPV6);
+      canonicalizeHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP);
+      const encodedASCIIHost = resolvedHost && resolvedHost.indexOf("%") !== -1 && !new RegExp("\\P{ASCII}", "u").test(resolvedHost);
+      if (resolved.error && !encodedASCIIHost) {
+        throw new Error(resolved.error);
+      }
       schemelessOptions.skipEscape = true;
       return serialize(resolved, schemelessOptions);
     }
@@ -3800,7 +4189,7 @@ var require_fast_uri = __commonJS({
     function equal(uriA, uriB, options) {
       const normalizedA = normalizeComparableURI(uriA, options);
       const normalizedB = normalizeComparableURI(uriB, options);
-      return normalizedA !== void 0 && normalizedB !== void 0 && normalizedA.toLowerCase() === normalizedB.toLowerCase();
+      return normalizedA !== void 0 && normalizedB !== void 0 && normalizedA === normalizedB;
     }
     function serialize(cmpts, opts) {
       const component = {
@@ -3817,23 +4206,30 @@ var require_fast_uri = __commonJS({
         reference: cmpts.reference,
         resourceName: cmpts.resourceName,
         secure: cmpts.secure,
+        to: cmpts.to,
+        subject: cmpts.subject,
+        body: cmpts.body,
+        headers: cmpts.headers,
         error: ""
       };
       const options = Object.assign({}, opts);
       const uriTokens = [];
+      if (component.scheme) {
+        component.scheme = decodeValidScheme(component.scheme);
+      }
       const schemeHandler = getSchemeHandler(options.scheme || component.scheme);
       if (schemeHandler && schemeHandler.serialize) schemeHandler.serialize(component, options);
+      const hasAuthority = component.userinfo !== void 0 || component.host !== void 0 || component.port !== void 0;
+      const pathNoScheme = !options.skipEscape && component.scheme === void 0 && !hasAuthority;
       if (component.path !== void 0) {
         if (!options.skipEscape) {
-          component.path = escapePreservingEscapes(component.path);
-          if (component.scheme !== void 0) {
-            component.path = component.path.split("%3A").join(":");
-          }
+          component.path = serializePathEncoding(component.path, pathNoScheme);
         } else {
           component.path = normalizePercentEncoding(component.path);
         }
       }
       if (options.reference !== "suffix" && component.scheme) {
+        component.scheme = decodeValidScheme(component.scheme);
         uriTokens.push(component.scheme, ":");
       }
       const authority = recomposeAuthority(component);
@@ -3851,16 +4247,19 @@ var require_fast_uri = __commonJS({
         if (!options.absolutePath && (!schemeHandler || !schemeHandler.absolutePath)) {
           s = removeDotSegments(s);
         }
+        if (pathNoScheme) {
+          s = serializePathEncoding(s, true);
+        }
         if (authority === void 0 && s[0] === "/" && s[1] === "/") {
           s = "/%2F" + s.slice(2);
         }
         uriTokens.push(s);
       }
       if (component.query !== void 0) {
-        uriTokens.push("?", component.query);
+        uriTokens.push("?", encodeQuery(component.query));
       }
       if (component.fragment !== void 0) {
-        uriTokens.push("#", component.fragment);
+        uriTokens.push("#", encodeFragment(component.fragment));
       }
       return uriTokens.join("");
     }
@@ -3876,6 +4275,36 @@ var require_fast_uri = __commonJS({
       }
       return void 0;
     }
+    function hasMalformedPercentEncoding(component) {
+      if (component === void 0) return false;
+      let percent = component.indexOf("%");
+      while (percent !== -1) {
+        if (percent + 2 >= component.length || !/^[\da-f]{2}$/iu.test(component.slice(percent + 1, percent + 3))) {
+          return true;
+        }
+        percent = component.indexOf("%", percent + 3);
+      }
+      return false;
+    }
+    function isIPLiteral(host) {
+      return host[0] === "[" && host[host.length - 1] === "]";
+    }
+    function hasMalformedComponentPercentEncoding(matches) {
+      const host = matches[4];
+      return hasMalformedPercentEncoding(matches[3]) || host !== void 0 && !isIPLiteral(host) && hasMalformedPercentEncoding(host) || hasMalformedPercentEncoding(matches[6]) || hasMalformedPercentEncoding(matches[7]) || hasMalformedPercentEncoding(matches[8]);
+    }
+    function canonicalizeHost(parsed, options, schemeHandler, isIP) {
+      const bracketedIPLiteral = parsed.host && parsed.host[0] === "[" && parsed.host[parsed.host.length - 1] === "]";
+      if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && !bracketedIPLiteral && nonSimpleDomain(parsed.host)) {
+        try {
+          parsed.host = new URL("http://" + parsed.host).hostname;
+        } catch (e) {
+          parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
+          return true;
+        }
+      }
+      return false;
+    }
     function parseWithStatus(uri, opts) {
       const options = Object.assign({}, opts);
       const parsed = {
@@ -3888,6 +4317,11 @@ var require_fast_uri = __commonJS({
         fragment: void 0
       };
       let malformedAuthorityOrPort = false;
+      let malformedPercentEncoding = false;
+      let malformedSchemeSpecific = false;
+      let malformedHost = false;
+      let malformedIPLiteral = false;
+      let malformedScheme = false;
       let isIP = false;
       if (options.reference === "suffix") {
         if (options.scheme) {
@@ -3917,13 +4351,26 @@ var require_fast_uri = __commonJS({
       }
       const matches = uri.match(URI_PARSE);
       if (matches) {
-        parsed.scheme = matches[1] === void 0 ? void 0 : matches[1].toLowerCase();
+        parsed.scheme = matches[1];
         parsed.userinfo = matches[3];
         parsed.host = matches[4];
         parsed.port = parseInt(matches[5], 10);
         parsed.path = matches[6] || "";
         parsed.query = matches[7];
         parsed.fragment = matches[8];
+        if (parsed.scheme !== void 0) {
+          const decodedScheme = unescape(parsed.scheme);
+          if (VALID_SCHEME.test(decodedScheme)) {
+            parsed.scheme = decodedScheme.toLowerCase();
+          } else {
+            parsed.error = parsed.error || MALFORMED_SCHEME_ERROR;
+            malformedScheme = true;
+          }
+        }
+        malformedPercentEncoding = hasMalformedComponentPercentEncoding(matches);
+        if (malformedPercentEncoding) {
+          parsed.error = parsed.error || "URI contains malformed percent-encoding.";
+        }
         if (isNaN(parsed.port)) {
           parsed.port = matches[5];
         }
@@ -3935,9 +4382,16 @@ var require_fast_uri = __commonJS({
         if (parsed.host) {
           const ipv4result = isIPv4(parsed.host);
           if (ipv4result === false) {
+            const bracketedIPLiteral = isIPLiteral(parsed.host);
+            const hasIPLiteralBracket = parsed.host.indexOf("[") !== -1 || parsed.host.indexOf("]") !== -1;
             const ipv6result = normalizeIPv6(parsed.host);
-            parsed.host = ipv6result.host.toLowerCase();
-            isIP = ipv6result.isIPV6;
+            isIP = ipv6result.isIPV6 || ipv6result.isIPVFuture === true;
+            malformedIPLiteral = hasIPLiteralBracket && (!bracketedIPLiteral || ipv6result.error === true);
+            parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase();
+            if (malformedIPLiteral) {
+              parsed.error = parsed.error || "URI host is malformed.";
+              malformedAuthorityOrPort = true;
+            }
           } else {
             isIP = true;
           }
@@ -3955,24 +4409,17 @@ var require_fast_uri = __commonJS({
           parsed.error = parsed.error || "URI is not a " + options.reference + " reference.";
         }
         const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme);
-        if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
-          if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
-            try {
-              parsed.host = new URL("http://" + parsed.host).hostname;
-            } catch (e) {
-              parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
-            }
+        if (!malformedIPLiteral) {
+          malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP);
+        }
+        if (uri.indexOf("%") !== -1 && parsed.host !== void 0 && !malformedIPLiteral) {
+          let host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
+          if (!isIP) {
+            host = normalizePercentEncoding(host.toLowerCase());
           }
+          parsed.host = reescapeHostDelimiters(host, isIP);
         }
         if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
-          if (uri.indexOf("%") !== -1) {
-            if (parsed.scheme !== void 0) {
-              parsed.scheme = unescape(parsed.scheme);
-            }
-            if (parsed.host !== void 0) {
-              parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP);
-            }
-          }
           if (parsed.path) {
             parsed.path = normalizePathEncoding(parsed.path);
           }
@@ -3985,11 +4432,14 @@ var require_fast_uri = __commonJS({
         }
         if (schemeHandler && schemeHandler.parse) {
           schemeHandler.parse(parsed, options);
+          if (schemeHandler === SCHEMES.urn && parsed.nid === void 0) {
+            malformedSchemeSpecific = true;
+          }
         }
       } else {
         parsed.error = parsed.error || "URI can not be parsed.";
       }
-      return { parsed, malformedAuthorityOrPort };
+      return { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme };
     }
     function parse4(uri, opts) {
       return parseWithStatus(uri, opts).parsed;
@@ -3998,20 +4448,28 @@ var require_fast_uri = __commonJS({
       return normalizeStringWithStatus(uri, opts).normalized;
     }
     function normalizeStringWithStatus(uri, opts) {
-      const { parsed, malformedAuthorityOrPort } = parseWithStatus(uri, opts);
+      const { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = parseWithStatus(uri, opts);
       return {
-        normalized: malformedAuthorityOrPort ? uri : serialize(parsed, opts),
-        malformedAuthorityOrPort
+        normalized: malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? uri : serialize(parsed, opts),
+        malformedAuthorityOrPort,
+        malformedPercentEncoding,
+        malformedSchemeSpecific,
+        malformedHost,
+        malformedScheme
       };
     }
     function normalizeComparableURI(uri, opts) {
-      if (typeof uri === "string") {
-        const { normalized, malformedAuthorityOrPort } = normalizeStringWithStatus(uri, opts);
-        return malformedAuthorityOrPort ? void 0 : normalized;
+      if (typeof uri !== "string" && typeof uri !== "object") {
+        return void 0;
       }
-      if (typeof uri === "object") {
-        return serialize(uri, opts);
+      let value;
+      try {
+        value = typeof uri === "string" ? uri : serialize(uri, opts);
+      } catch {
+        return void 0;
       }
+      const { normalized, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = normalizeStringWithStatus(value, opts);
+      return malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? void 0 : normalized;
     }
     var fastUri = {
       SCHEMES,
@@ -23962,7 +24420,7 @@ function object(shape, params) {
   return new ZodMiniObject(def);
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.28.0_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
 function isZ4Schema(s) {
   const schema = s;
   return !!schema._zod;
@@ -24046,17 +24504,33 @@ function normalizeObjectSchema(schema) {
   }
   return void 0;
 }
+function getDotPath(path5) {
+  if (path5.length === 0) {
+    return "object root";
+  }
+  return path5.reduce((acc, seg, index) => {
+    if (index === 0) {
+      return String(seg);
+    }
+    if (typeof seg === "number") {
+      return `${acc}[${seg}]`;
+    }
+    return `${acc}.${seg}`;
+  }, "");
+}
 function getParseErrorMessage(error48) {
   if (error48 && typeof error48 === "object") {
+    if ("issues" in error48 && Array.isArray(error48.issues) && error48.issues.length > 0) {
+      return error48.issues.map((i) => {
+        if (!i.path?.length) {
+          return i.message;
+        }
+        return `${i.message} at ${getDotPath(i.path)}`;
+      }).join("\n");
+    }
     if ("message" in error48 && typeof error48.message === "string") {
       return error48.message;
     }
-    if ("issues" in error48 && Array.isArray(error48.issues) && error48.issues.length > 0) {
-      const firstIssue = error48.issues[0];
-      if (firstIssue && typeof firstIssue === "object" && "message" in firstIssue) {
-        return String(firstIssue.message);
-      }
-    }
     try {
       return JSON.stringify(error48);
     } catch {
@@ -26252,7 +26726,7 @@ function date4(params) {
 // ../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/classic/external.js
 config(en_default2());
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.28.0_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
 var LATEST_PROTOCOL_VERSION = "2025-11-25";
 var SUPPORTED_PROTOCOL_VERSIONS = [LATEST_PROTOCOL_VERSION, "2025-06-18", "2025-03-26", "2024-11-05", "2024-10-07"];
 var RELATED_TASK_META_KEY = "io.modelcontextprotocol/related-task";
@@ -26262,10 +26736,9 @@ var ProgressTokenSchema = union([string2(), number2().int()]);
 var CursorSchema = string2();
 var TaskCreationParamsSchema = looseObject({
   /**
-   * Time in milliseconds to keep task results available after completion.
-   * If null, the task has unlimited lifetime until manually cleaned up.
+   * Requested duration in milliseconds to retain task from creation.
    */
-  ttl: union([number2(), _null3()]).optional(),
+  ttl: number2().optional(),
   /**
    * Time in milliseconds to wait between task status requests.
    */
@@ -26565,7 +27038,11 @@ var ClientCapabilitiesSchema = object2({
   /**
    * Present if the client supports task creation.
    */
-  tasks: ClientTasksCapabilitySchema.optional()
+  tasks: ClientTasksCapabilitySchema.optional(),
+  /**
+   * Extensions that the client supports. Keys are extension identifiers (vendor-prefix/extension-name).
+   */
+  extensions: record(string2(), AssertObjectSchema).optional()
 });
 var InitializeRequestParamsSchema = BaseRequestParamsSchema.extend({
   /**
@@ -26626,7 +27103,11 @@ var ServerCapabilitiesSchema = object2({
   /**
    * Present if the server supports task creation.
    */
-  tasks: ServerTasksCapabilitySchema.optional()
+  tasks: ServerTasksCapabilitySchema.optional(),
+  /**
+   * Extensions that the server supports. Keys are extension identifiers (vendor-prefix/extension-name).
+   */
+  extensions: record(string2(), AssertObjectSchema).optional()
 });
 var InitializeResultSchema = ResultSchema.extend({
   /**
@@ -26818,6 +27299,12 @@ var ResourceSchema = object2({
    * The MIME type of this resource, if known.
    */
   mimeType: optional(string2()),
+  /**
+   * The size of the raw resource content, in bytes (i.e., before base64 encoding or any tokenization), if known.
+   *
+   * This can be used by Hosts to display file sizes and estimate context window usage.
+   */
+  size: optional(number2()),
   /**
    * Optional annotations for the client.
    */
@@ -27770,7 +28257,7 @@ var UrlElicitationRequiredError = class extends McpError {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.28.0_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/interfaces.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/interfaces.js
 function isTerminal(status) {
   return status === "completed" || status === "failed" || status === "cancelled";
 }
@@ -29059,7 +29546,7 @@ var zodToJsonSchema = (schema, options) => {
   return combined;
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.28.0_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js
 function mapMiniTarget(t) {
   if (!t)
     return "draft-7";
@@ -29101,7 +29588,7 @@ function parseWithCompat(schema, data) {
   return result.data;
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.28.0_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
 var DEFAULT_REQUEST_TIMEOUT_MSEC = 6e4;
 var Protocol = class {
   constructor(_options) {
@@ -29142,6 +29629,9 @@ var Protocol = class {
       this.setRequestHandler(GetTaskPayloadRequestSchema, async (request2, extra) => {
         const handleTaskResult = async () => {
           const taskId = request2.params.taskId;
+          if (!await this._taskStore.getTask(taskId, extra.sessionId)) {
+            throw new McpError(ErrorCode.InvalidParams, `Task not found: ${taskId}`);
+          }
           if (this._taskMessageQueue) {
             let queuedMessage;
             while (queuedMessage = await this._taskMessageQueue.dequeue(taskId, extra.sessionId)) {
@@ -29172,12 +29662,12 @@ var Protocol = class {
             throw new McpError(ErrorCode.InvalidParams, `Task not found: ${taskId}`);
           }
           if (!isTerminal(task.status)) {
-            await this._waitForTaskUpdate(taskId, extra.signal);
+            await this._waitForTaskUpdate(taskId, extra.signal, extra.sessionId);
             return await handleTaskResult();
           }
           if (isTerminal(task.status)) {
             const result = await this._taskStore.getTaskResult(taskId, extra.sessionId);
-            this._clearTaskQueue(taskId);
+            this._clearTaskQueue(taskId, extra.sessionId);
             return {
               ...result,
               _meta: {
@@ -29214,7 +29704,7 @@ var Protocol = class {
             throw new McpError(ErrorCode.InvalidParams, `Cannot cancel task in terminal status: ${task.status}`);
           }
           await this._taskStore.updateTaskStatus(request2.params.taskId, "cancelled", "Client cancelled task execution.", extra.sessionId);
-          this._clearTaskQueue(request2.params.taskId);
+          this._clearTaskQueue(request2.params.taskId, extra.sessionId);
           const cancelledTask = await this._taskStore.getTask(request2.params.taskId, extra.sessionId);
           if (!cancelledTask) {
             throw new McpError(ErrorCode.InvalidParams, `Task not found after cancellation: ${request2.params.taskId}`);
@@ -29342,6 +29832,19 @@ var Protocol = class {
     const handler2 = this._requestHandlers.get(request2.method) ?? this.fallbackRequestHandler;
     const capturedTransport = this._transport;
     const relatedTaskId = request2.params?._meta?.[RELATED_TASK_META_KEY]?.taskId;
+    const sessionId = capturedTransport?.sessionId;
+    const store = this._taskStore;
+    let relatedTaskFound = true;
+    let relatedTaskLookup;
+    if (relatedTaskId && store && this._taskMessageQueue && sessionId !== void 0) {
+      relatedTaskFound = false;
+      relatedTaskLookup = (async () => {
+        if (!await store.getTask(relatedTaskId, sessionId)) {
+          throw new McpError(ErrorCode.InvalidParams, `Task not found: ${relatedTaskId}`);
+        }
+        relatedTaskFound = true;
+      })();
+    }
     if (handler2 === void 0) {
       const errorResponse = {
         jsonrpc: "2.0",
@@ -29351,7 +29854,10 @@ var Protocol = class {
           message: "Method not found"
         }
       };
-      if (relatedTaskId && this._taskMessageQueue) {
+      if (relatedTaskId && relatedTaskLookup) {
+        const queuedError = { type: "error", message: errorResponse, timestamp: Date.now() };
+        relatedTaskLookup.then(() => this._enqueueTaskMessage(relatedTaskId, queuedError, sessionId), () => capturedTransport?.send(errorResponse)).catch((error48) => this._onerror(new Error(`Failed to send an error response: ${error48}`)));
+      } else if (relatedTaskId && this._taskMessageQueue) {
         this._enqueueTaskMessage(relatedTaskId, {
           type: "error",
           message: errorResponse,
@@ -29402,7 +29908,10 @@ var Protocol = class {
       closeSSEStream: extra?.closeSSEStream,
       closeStandaloneSSEStream: extra?.closeStandaloneSSEStream
     };
-    Promise.resolve().then(() => {
+    (relatedTaskLookup ?? Promise.resolve()).then(() => {
+      if (relatedTaskLookup && abortController.signal.aborted) {
+        throw new McpError(ErrorCode.ConnectionClosed, "Request was cancelled");
+      }
       if (taskCreationParams) {
         this.assertTaskHandlerCapability(request2.method);
       }
@@ -29437,7 +29946,7 @@ var Protocol = class {
           ...error48["data"] !== void 0 && { data: error48["data"] }
         }
       };
-      if (relatedTaskId && this._taskMessageQueue) {
+      if (relatedTaskId && this._taskMessageQueue && relatedTaskFound) {
         await this._enqueueTaskMessage(relatedTaskId, {
           type: "error",
           message: errorResponse,
@@ -29917,7 +30426,7 @@ var Protocol = class {
       throw new Error("Cannot enqueue task message: taskStore and taskMessageQueue are not configured");
     }
     const maxQueueSize = this._options?.maxTaskQueueSize;
-    await this._taskMessageQueue.enqueue(taskId, message, sessionId, maxQueueSize);
+    await this._taskMessageQueue.enqueue(taskId, message, sessionId ?? this._transport?.sessionId, maxQueueSize);
   }
   /**
    * Clears the message queue for a task and rejects any pending request resolvers.
@@ -29946,12 +30455,13 @@ var Protocol = class {
    * Uses polling to check for updates at the task's configured poll interval.
    * @param taskId The task ID to wait for
    * @param signal Abort signal to cancel the wait
+   * @param sessionId Session of the request that waits, passed to the task store
    * @returns Promise that resolves when an update occurs or rejects if aborted
    */
-  async _waitForTaskUpdate(taskId, signal) {
+  async _waitForTaskUpdate(taskId, signal, sessionId) {
     let interval = this._options?.defaultTaskPollInterval ?? 1e3;
     try {
-      const task = await this._taskStore?.getTask(taskId);
+      const task = await this._taskStore?.getTask(taskId, sessionId);
       if (task?.pollInterval) {
         interval = task.pollInterval;
       }
@@ -30055,7 +30565,7 @@ function mergeCapabilities(base, additional) {
   return result;
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.28.0_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/validation/ajv-provider.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/validation/ajv-provider.js
 var import_ajv = __toESM(require_ajv(), 1);
 var import_ajv_formats = __toESM(require_dist(), 1);
 function createDefaultAjvInstance() {
@@ -30123,7 +30633,7 @@ var AjvJsonSchemaValidator = class {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.28.0_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/server.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/server.js
 var ExperimentalServerTasks = class {
   constructor(_server) {
     this._server = _server;
@@ -30336,7 +30846,7 @@ var ExperimentalServerTasks = class {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.28.0_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/helpers.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/helpers.js
 function assertToolsCallTaskCapability(requests, method, entityName) {
   if (!requests) {
     throw new Error(`${entityName} does not support task creation (required for ${method})`);
@@ -30371,7 +30881,7 @@ function assertClientRequestTaskCapability(requests, method, entityName) {
   }
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.28.0_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js
 var Server = class extends Protocol {
   /**
    * Initializes this server with the given name and version information.
@@ -30437,16 +30947,7 @@ var Server = class extends Protocol {
     if (!methodSchema) {
       throw new Error("Schema is missing a method literal");
     }
-    let methodValue;
-    if (isZ4Schema(methodSchema)) {
-      const v4Schema = methodSchema;
-      const v4Def = v4Schema._zod?.def;
-      methodValue = v4Def?.value ?? v4Schema.value;
-    } else {
-      const v3Schema = methodSchema;
-      const legacyDef = v3Schema._def;
-      methodValue = legacyDef?.value ?? v3Schema.value;
-    }
+    const methodValue = getLiteralValue(methodSchema);
     if (typeof methodValue !== "string") {
       throw new Error("Schema method literal must be a string");
     }
@@ -30751,7 +31252,7 @@ var Server = class extends Protocol {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.28.0_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/server/completable.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/server/completable.js
 var COMPLETABLE_SYMBOL = /* @__PURE__ */ Symbol.for("mcp.completable");
 function isCompletable(schema) {
   return !!schema && typeof schema === "object" && COMPLETABLE_SYMBOL in schema;
@@ -30765,7 +31266,7 @@ var McpZodTypeKind;
   McpZodTypeKind2["Completable"] = "McpCompletable";
 })(McpZodTypeKind || (McpZodTypeKind = {}));
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.28.0_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/toolNameValidation.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/toolNameValidation.js
 var TOOL_NAME_REGEX = /^[A-Za-z0-9._-]{1,128}$/;
 function validateToolName(name) {
   const warnings = [];
@@ -30823,7 +31324,7 @@ function validateAndWarnToolName(name) {
   return result.isValid;
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.28.0_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/mcp-server.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/mcp-server.js
 var ExperimentalMcpServerTasks = class {
   constructor(_mcpServer) {
     this._mcpServer = _mcpServer;
@@ -30838,7 +31339,43 @@ var ExperimentalMcpServerTasks = class {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.28.0_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
+function toolInputElementCount(value, max) {
+  let count = 0;
+  const stack = [value];
+  while (stack.length > 0) {
+    const node = stack.pop();
+    if (node === null || typeof node !== "object")
+      continue;
+    if (Array.isArray(node)) {
+      for (const child of node) {
+        if (++count > max)
+          return count;
+        if (child !== null && typeof child === "object")
+          stack.push(child);
+      }
+    } else {
+      for (const key in node) {
+        if (!Object.prototype.hasOwnProperty.call(node, key))
+          continue;
+        if (++count > max)
+          return count;
+        const child = node[key];
+        if (child !== null && typeof child === "object")
+          stack.push(child);
+      }
+    }
+  }
+  return count;
+}
+function resolveMaxToolInputElements(value) {
+  if (value === void 0 || value === Infinity)
+    return void 0;
+  if (typeof value !== "number" || Number.isNaN(value) || value < 1) {
+    throw new RangeError(`maxToolInputElements must be a number of at least 1, or Infinity, got ${String(value)}`);
+  }
+  return value;
+}
 var McpServer = class {
   constructor(serverInfo, options) {
     this._registeredResources = {};
@@ -30850,6 +31387,7 @@ var McpServer = class {
     this._resourceHandlersInitialized = false;
     this._promptHandlersInitialized = false;
     this.server = new Server(serverInfo, options);
+    this._maxToolInputElements = resolveMaxToolInputElements(options?.maxToolInputElements);
   }
   /**
    * Access experimental features.
@@ -30980,12 +31518,15 @@ var McpServer = class {
    * Validates tool input arguments against the tool's input schema.
    */
   async validateToolInput(tool, args, toolName) {
+    if (this._maxToolInputElements !== void 0 && toolInputElementCount(args, this._maxToolInputElements) > this._maxToolInputElements) {
+      throw new McpError(ErrorCode.InvalidParams, `Invalid arguments for tool ${toolName}: arguments contain more than the maximum of ${this._maxToolInputElements} elements`);
+    }
     if (!tool.inputSchema) {
       return void 0;
     }
     const inputObj = normalizeObjectSchema(tool.inputSchema);
     const schemaToParse = inputObj ?? tool.inputSchema;
-    const parseResult = await safeParseAsync2(schemaToParse, args);
+    const parseResult = await safeParseAsync2(schemaToParse, args ?? {});
     if (!parseResult.success) {
       const error48 = "error" in parseResult ? parseResult.error : "Unknown error";
       const errorMessage2 = getParseErrorMessage(error48);
@@ -31223,7 +31764,7 @@ var McpServer = class {
       }
       if (prompt.argsSchema) {
         const argsObj = normalizeObjectSchema(prompt.argsSchema);
-        const parseResult = await safeParseAsync2(argsObj, request2.params.arguments);
+        const parseResult = await safeParseAsync2(argsObj, request2.params.arguments ?? {});
         if (!parseResult.success) {
           const error48 = "error" in parseResult ? parseResult.error : "Unknown error";
           const errorMessage2 = getParseErrorMessage(error48);
@@ -31630,12 +32171,21 @@ var EMPTY_COMPLETION_RESULT = {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.28.0_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
 var import_node_process = __toESM(require("node:process"), 1);
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.28.0_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
+var STDIO_DEFAULT_MAX_BUFFER_SIZE = 10 * 1024 * 1024;
 var ReadBuffer = class {
+  constructor(options) {
+    this._maxBufferSize = options?.maxBufferSize ?? STDIO_DEFAULT_MAX_BUFFER_SIZE;
+  }
   append(chunk) {
+    const newSize = (this._buffer?.length ?? 0) + chunk.length;
+    if (newSize > this._maxBufferSize) {
+      this.clear();
+      throw new Error(`ReadBuffer exceeded maximum size of ${this._maxBufferSize} bytes`);
+    }
     this._buffer = this._buffer ? Buffer.concat([this._buffer, chunk]) : chunk;
   }
   readMessage() {
@@ -31661,20 +32211,26 @@ function serializeMessage(message) {
   return JSON.stringify(message) + "\n";
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.28.0_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
 var StdioServerTransport = class {
-  constructor(_stdin = import_node_process.default.stdin, _stdout = import_node_process.default.stdout) {
+  constructor(_stdin = import_node_process.default.stdin, _stdout = import_node_process.default.stdout, options) {
     this._stdin = _stdin;
     this._stdout = _stdout;
-    this._readBuffer = new ReadBuffer();
     this._started = false;
     this._ondata = (chunk) => {
-      this._readBuffer.append(chunk);
-      this.processReadBuffer();
+      try {
+        this._readBuffer.append(chunk);
+        this.processReadBuffer();
+      } catch (error48) {
+        this.onerror?.(error48);
+        this.close().catch(() => {
+        });
+      }
     };
     this._onerror = (error48) => {
       this.onerror?.(error48);
     };
+    this._readBuffer = new ReadBuffer({ maxBufferSize: options?.maxBufferSize });
   }
   /**
    * Starts listening for messages on stdin.
@@ -36183,7 +36739,17 @@ var SkippedIssueSchema = external_exports3.looseObject({
   repo: external_exports3.string(),
   number: external_exports3.number(),
   title: external_exports3.string(),
-  skippedAt: external_exports3.string()
+  skippedAt: external_exports3.string(),
+  /** Why it was skipped: the vetter's reasons, or absent for a manual skip (#343). */
+  reason: external_exports3.string().optional(),
+  /**
+   * Whether this entry is permanent. Manual skips are permanent (true); vetter-
+   * derived skips for transient conditions (linked PR closed, own PR in flight,
+   * accumulated soft-skips) are non-permanent (false) and eligible for
+   * cullExpiredSkips. Entries without this field (written before #348) default
+   * to true so they are never silently dropped.
+   */
+  permanent: external_exports3.boolean().default(true)
 });
 var HorizonSchema = external_exports3.enum(["quick-win", "bigger-bet"]);
 var SavedCandidateSchema = external_exports3.looseObject({
@@ -36226,7 +36792,11 @@ var ScoutPreferencesSchema = external_exports3.looseObject({
   maxIssueAgeDays: external_exports3.number().default(90),
   includeDocIssues: external_exports3.boolean().default(true),
   minRepoScoreThreshold: external_exports3.number().default(4),
-  interPhaseDelayMs: external_exports3.number().min(0).max(12e4).default(3e4),
+  // Fixed pause before a search moves on to the next strategy. Defaults to
+  // 0 (#334): SearchBudgetTracker already paces every search call against
+  // the 30/min window and the pre-flight quota, so the old 30s pin only
+  // added wall clock. Retained as a knob for hosts that want spacing.
+  interPhaseDelayMs: external_exports3.number().min(0).max(12e4).default(0),
   persistence: PersistenceModeSchema.default("local"),
   defaultStrategy: external_exports3.array(SearchStrategySchema).optional(),
   /**
@@ -36281,8 +36851,17 @@ var ScoutPreferencesSchema = external_exports3.looseObject({
    */
   featuresSplitRatio: external_exports3.number().min(0).max(1).default(0.6)
 });
+var CURRENT_STATE_REVISION = 1;
 var ScoutStateSchema = external_exports3.looseObject({
   version: external_exports3.literal(1),
+  /**
+   * Highest compatible migration applied to this state (see
+   * `parseScoutState`). Unlike `version`, a bump here never locks out an
+   * older binary: the key round-trips through the loose schema, and every
+   * migration it tracks leaves the shape valid for version 1 readers.
+   * State written before the counter existed reads as 0.
+   */
+  stateRevision: external_exports3.number().int().min(0).default(CURRENT_STATE_REVISION),
   preferences: ScoutPreferencesSchema.default(() => ScoutPreferencesSchema.parse({})),
   repoScores: external_exports3.record(external_exports3.string(), RepoScoreSchema).default({}),
   starredRepos: external_exports3.array(external_exports3.string()).default([]),
@@ -36320,14 +36899,58 @@ var ScoutStateSchema = external_exports3.looseObject({
    * variant leads each run. `languageOffset` advances (no modulo; the
    * consumer wraps at use time so a shrinking language list never needs
    * clamping here).
+   *
+   * `phase0Offset`, `starredOffset` and `maintainedOffset` do the same for the
+   * repo lists those phases cap per run (#324, #333): each run searches the
+   * next window of the list instead of always the first N, so every
+   * contributed/starred repo gets searched within a few runs.
+   *
+   * `strategyOffset` is the round-robin cursor (#336): a position in
+   * CONCRETE_STRATEGIES. A search runs the first usable strategy from there,
+   * and the cursor moves to just after the strategy that led.
    */
   searchRotation: external_exports3.looseObject({
     languageOffset: external_exports3.number().int().min(0).default(0),
+    phase0Offset: external_exports3.number().int().min(0).default(0),
+    starredOffset: external_exports3.number().int().min(0).default(0),
+    maintainedOffset: external_exports3.number().int().min(0).default(0),
+    strategyOffset: external_exports3.number().int().min(0).default(0),
     lastRotatedAt: external_exports3.string().optional()
-  }).default(() => ({ languageOffset: 0 }))
+  }).default(() => ({
+    languageOffset: 0,
+    phase0Offset: 0,
+    starredOffset: 0,
+    maintainedOffset: 0,
+    strategyOffset: 0
+  }))
 });
 function parseScoutState(raw) {
-  return ScoutStateSchema.parse(raw);
+  return ScoutStateSchema.parse(migrateScoutState(raw));
+}
+var LEGACY_INTER_PHASE_DELAY_MS = 3e4;
+function migrateScoutState(raw) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    return raw;
+  }
+  const state = raw;
+  const revision = typeof state.stateRevision === "number" ? state.stateRevision : 0;
+  if (revision >= CURRENT_STATE_REVISION)
+    return raw;
+  let migrated = state;
+  if (revision < 1)
+    migrated = dropInheritedInterPhaseDelay(migrated);
+  return { ...migrated, stateRevision: CURRENT_STATE_REVISION };
+}
+function dropInheritedInterPhaseDelay(state) {
+  const prefs = state.preferences;
+  if (typeof prefs !== "object" || prefs === null || Array.isArray(prefs)) {
+    return state;
+  }
+  const preferences = prefs;
+  if (preferences.interPhaseDelayMs !== LEGACY_INTER_PHASE_DELAY_MS) {
+    return state;
+  }
+  return { ...state, preferences: { ...preferences, interPhaseDelayMs: 0 } };
 }
 
 // ../core/dist/core/issue-filtering.js
@@ -36346,6 +36969,18 @@ function isDocOnlyIssue(item) {
     return false;
   return nonEmptyLabels.every((n) => DOC_ONLY_LABELS.has(n));
 }
+var NON_ACTIONABLE_LABELS = /* @__PURE__ */ new Set(["question", "discussion", "support"]);
+function isNonActionableIssue(item) {
+  const labelNames = (item.labels ?? []).map((l) => (typeof l === "string" ? l : l.name || "").toLowerCase());
+  if (labelNames.some((n) => NON_ACTIONABLE_LABELS.has(n)))
+    return true;
+  const title = (item.title ?? "").trim();
+  if (title.endsWith("?"))
+    return true;
+  if (/^(how|why|what|when|where|which|who|is|are|does|do|can|could|should|would|will|has|have)\b/i.test(title))
+    return true;
+  return title.split(/\s+/).filter(Boolean).length < 3;
+}
 var BEGINNER_LABELS = /* @__PURE__ */ new Set([
   "good first issue",
   "hacktoberfest",
@@ -37054,16 +37689,10 @@ async function checkNotClaimed(octokit, owner, repo, issueNumber, commentCount)
 function analyzeRequirements(body) {
   if (!body || body.length < 50)
     return false;
-  const hasSteps = /\d\.|[-*]\s/.test(body);
-  const hasCodeBlock = /```/.test(body);
-  const hasExpectedBehavior = /expect|should|must|want/i.test(body);
-  const indicators = [
-    hasSteps,
-    hasCodeBlock,
-    hasExpectedBehavior,
-    body.length > 200
-  ];
-  return indicators.filter(Boolean).length >= 2;
+  const hasSteps = /(^|\n)\s*\d+[.)]\s/.test(body) || /steps?\s+to\s+reproduce|\brepro(duction)?\b/i.test(body);
+  const hasExpectedVsActual = /\b(expected|should)\b/i.test(body) && /\b(actual(ly)?|instead|but|currently|observed|got)\b/i.test(body);
+  const hasCodeRef = /```|`[^`\n]+`/.test(body) || /\b[\w/.-]+\.(ts|tsx|js|jsx|mjs|cjs|py|rb|go|rs|java|kt|swift|c|cc|cpp|h|hpp|cs|php|sh|vue|svelte)\b/.test(body) || /^\s+at\s+\S+\s+\(/m.test(body);
+  return hasCodeRef || hasSteps && hasExpectedVsActual;
 }
 
 // ../core/dist/core/probe-repo-file.js
@@ -38173,8 +38802,8 @@ var IssueVetter = class {
 
 // ../core/dist/core/search-phases.js
 var MODULE11 = "search-phases";
-var GITHUB_MAX_BOOLEAN_OPS = 5;
 var INTER_QUERY_DELAY_MS = 2e3;
+var KNOWN_REPO_PER_REPO_CAP = 2;
 var GRAPHQL_INTER_QUERY_DELAY_MS = 500;
 var graphqlSearchQueryCount = 0;
 function getGraphQLSearchQueryCount() {
@@ -38183,29 +38812,10 @@ function getGraphQLSearchQueryCount() {
 function resetGraphQLSearchQueryCount() {
   graphqlSearchQueryCount = 0;
 }
-function chunkLabels(labels, reservedOps = 0) {
-  const maxPerChunk = GITHUB_MAX_BOOLEAN_OPS - reservedOps + 1;
-  if (maxPerChunk < 1) {
-    if (labels.length > 0) {
-      warn(MODULE11, `Label filtering disabled: ${reservedOps} repo/org ORs exceed GitHub's ${GITHUB_MAX_BOOLEAN_OPS} operator limit. All ${labels.length} label(s) dropped from query.`);
-    }
-    return [[]];
-  }
-  if (labels.length <= maxPerChunk)
-    return [labels];
-  const chunks = [];
-  for (let i = 0; i < labels.length; i += maxPerChunk) {
-    chunks.push(labels.slice(i, i + maxPerChunk));
-  }
-  debug(MODULE11, `Split ${labels.length} labels into ${chunks.length} chunks (${reservedOps} ops reserved, max ${maxPerChunk} per chunk)`);
-  return chunks;
-}
 function buildLabelQuery(labels) {
   if (labels.length === 0)
     return "";
-  if (labels.length === 1)
-    return `label:"${labels[0]}"`;
-  return `(${labels.map((l) => `label:"${l}"`).join(" OR ")})`;
+  return `label:${labels.map((l) => JSON.stringify(l)).join(",")}`;
 }
 function buildEffectiveLabels(scopes, customLabels) {
   const labels = /* @__PURE__ */ new Set();
@@ -38369,9 +38979,9 @@ async function fetchIssuesFromKnownRepos(octokit, vetter, repos, labels, maxResu
       if (mapped.length > 0) {
         const filtered = filterFn(mapped);
         if (filtered.length > 0) {
-          const remainingNeeded = maxResults - candidates.length;
+          const remainingNeeded = Math.min(KNOWN_REPO_PER_REPO_CAP, maxResults - candidates.length);
           const { candidates: vetted, rateLimitHit: vetRateLimitHit } = await vetter.vetIssuesParallel(filtered.slice(0, remainingNeeded * 2).map((item) => item.html_url), remainingNeeded, priority);
-          candidates.push(...vetted);
+          candidates.push(...vetted.slice(0, remainingNeeded));
           if (vetRateLimitHit)
             rateLimitFailures++;
         }
@@ -38393,28 +39003,14 @@ async function fetchIssuesFromKnownRepos(octokit, vetter, repos, labels, maxResu
   }
   return { candidates, allReposFailed, rateLimitHit };
 }
-async function searchWithChunkedLabels(octokit, labels, reservedOps, buildQuery, perPage, tracker = getSearchBudgetTracker()) {
-  const labelChunks = chunkLabels(labels, reservedOps);
-  const seenUrls = /* @__PURE__ */ new Set();
-  const allItems = [];
-  for (let i = 0; i < labelChunks.length; i++) {
-    if (i > 0)
-      await sleep(GRAPHQL_INTER_QUERY_DELAY_MS);
-    const query = buildQuery(buildLabelQuery(labelChunks[i]));
-    const data = await searchIssuesGraphQLFirst(octokit, {
-      q: query,
-      sort: "created",
-      order: "desc",
-      per_page: perPage
-    }, tracker);
-    for (const item of data.items) {
-      if (!seenUrls.has(item.html_url)) {
-        seenUrls.add(item.html_url);
-        allItems.push(item);
-      }
-    }
-  }
-  return allItems;
+async function searchWithChunkedLabels(octokit, labels, _reservedOps, buildQuery, perPage, tracker = getSearchBudgetTracker()) {
+  const data = await searchIssuesGraphQLFirst(octokit, {
+    q: buildQuery(buildLabelQuery(labels)),
+    sort: "created",
+    order: "desc",
+    per_page: perPage
+  }, tracker);
+  return data.items;
 }
 function buildLanguageVariants(languages, isAnyLanguage, hasLabels) {
   if (isAnyLanguage || languages.length === 0)
@@ -38570,6 +39166,15 @@ var CRITICAL_BUDGET_THRESHOLD = 10;
 var PHASE0_PER_PAGE = 30;
 var CONTRIBUTED_REPO_MAX_AGE_DAYS = 365;
 var PHASE0_MAX_SHARE = 0.5;
+var PHASE0_REPOS_PER_RUN = 10;
+var STARRED_REPOS_PER_RUN = 10;
+var MAINTAINED_REPOS_PER_RUN = 15;
+function rotatingWindow(items, size, offset) {
+  if (items.length <= size)
+    return [...items];
+  const start = offset * size % items.length;
+  return Array.from({ length: size }, (_, i) => items[(start + i) % items.length]);
+}
 function buildIssueFilter(config2) {
   return (items) => {
     return items.filter((item) => {
@@ -38598,6 +39203,8 @@ function buildIssueFilter(config2) {
         return false;
       if (!config2.includeDocIssues && isDocOnlyIssue(item))
         return false;
+      if (isNonActionableIssue(item))
+        return false;
       return true;
     });
   };
@@ -38644,7 +39251,7 @@ async function runPhaseOrgs(octokit, vetter, orgs, languages, isAnyLanguage, lab
 async function runPhase1(octokit, vetter, repos, labels, maxResults, filterIssues) {
   info(MODULE12, `Phase 1: Searching issues in ${repos.length} starred repos...`);
   const phase1Labels = labels.slice(0, 3);
-  const reposToSearch = repos.slice(0, 10);
+  const reposToSearch = repos.slice(0, STARRED_REPOS_PER_RUN);
   const { candidates, allReposFailed, rateLimitHit } = await fetchIssuesFromKnownRepos(octokit, vetter, reposToSearch, phase1Labels, maxResults, "starred", filterIssues);
   info(MODULE12, `Found ${candidates.length} candidates from starred repos`);
   return {
@@ -38715,13 +39322,13 @@ async function runPhase2(octokit, vetter, scopes, labels, configLabels, language
     rateLimitHit
   };
 }
-async function runPhase3(octokit, vetter, langQuery, minStars, projectCategories, maxResults, phase0RepoSet, starredRepoSet, starredRepos, existingCandidates, filterIssues, tracker) {
+async function runPhase3(octokit, vetter, langQuery, minStars, projectCategories, maxResults, phase0RepoSet, starredRepoSet, starredRepos, existingCandidates, filterIssues, tracker, rotationOffset = 0) {
   info(MODULE12, "Phase 3: Searching actively maintained repos...");
   const seenRepos = new Set(existingCandidates.map((c) => c.issue.repo));
-  const eligibleStarred = starredRepos.filter((r) => !phase0RepoSet.has(r) && !seenRepos.has(r));
+  const eligibleStarred = rotatingWindow(starredRepos, MAINTAINED_REPOS_PER_RUN, rotationOffset).filter((r) => !phase0RepoSet.has(r) && !seenRepos.has(r));
   if (eligibleStarred.length > 0) {
     info(MODULE12, `Phase 3: Checking ${eligibleStarred.length} starred repos via REST API...`);
-    const restItems = await fetchIssuesFromMaintainedRepos(octokit, eligibleStarred.slice(0, 15), minStars, maxResults);
+    const restItems = await fetchIssuesFromMaintainedRepos(octokit, eligibleStarred, minStars, maxResults);
     if (restItems.length > 0) {
       try {
         const { candidates, allVetFailed, rateLimitHit: vetRateLimitHit } = await filterVetAndScore(vetter, restItems, filterIssues, [phase0RepoSet, seenRepos], maxResults, minStars, "Phase 3 (REST)");
@@ -38746,7 +39353,7 @@ async function runPhase3(octokit, vetter, langQuery, minStars, projectCategories
   const pushedSince = thirtyDaysAgo.toISOString().split("T")[0];
   const categoryTopics = getTopicsForCategories(projectCategories);
   const topicQuery = categoryTopics.length > 0 ? `topic:${categoryTopics[0]}` : "";
-  const phase3Query = `is:issue is:open no:assignee ${langQuery} ${topicQuery} stars:>=${minStars} pushed:>=${pushedSince} archived:false`.replace(/  +/g, " ").trim();
+  const phase3Query = `is:issue is:open no:assignee ${langQuery} ${topicQuery} pushed:>=${pushedSince} archived:false`.replace(/  +/g, " ").trim();
   try {
     const data = await searchIssuesGraphQLFirst(octokit, {
       q: phase3Query,
@@ -38839,7 +39446,7 @@ var IssueDiscovery = class {
     const labels = options.labels || (scopes ? buildEffectiveLabels(scopes, config2.labels) : config2.labels);
     const maxResults = options.maxResults || 10;
     const minStars = config2.minStars ?? 50;
-    const interPhaseDelay = options.interPhaseDelayMs ?? config2.interPhaseDelayMs ?? 3e4;
+    const interPhaseDelay = options.interPhaseDelayMs ?? config2.interPhaseDelayMs ?? 0;
     const ALL_STRATEGIES = CONCRETE_STRATEGIES;
     const pickStrategies = (...candidates) => candidates.find((c) => c && c.length > 0) ?? ["all"];
     const rawStrategies = pickStrategies(options.strategies, config2.defaultStrategy);
@@ -38919,85 +39526,110 @@ var IssueDiscovery = class {
       ...baseFilterConfig,
       maxAgeDays: CONTRIBUTED_REPO_MAX_AGE_DAYS
     });
-    const seenPhase0 = /* @__PURE__ */ new Set();
-    const phase0Repos = [];
-    for (const repo of [...mergedPRRepos, ...openPRRepos]) {
-      if (seenPhase0.has(repo))
-        continue;
-      seenPhase0.add(repo);
-      phase0Repos.push(repo);
-      if (phase0Repos.length >= 10)
-        break;
-    }
+    const repoRotation = options.repoRotationOffsets ?? {};
+    const phase0Repos = rotatingWindow([.../* @__PURE__ */ new Set([...mergedPRRepos, ...openPRRepos])], PHASE0_REPOS_PER_RUN, repoRotation.merged ?? 0);
     const phase0RepoSet = new Set(phase0Repos);
     const preferredOrgs = config2.preferredOrgs ?? [];
-    const orgsPhaseEnabled = preferredOrgs.length > 0 && enabledStrategies.has("orgs");
-    const otherStrategiesCanRun = orgsPhaseEnabled || starredRepos.length > 0 && enabledStrategies.has("starred") || enabledStrategies.has("broad") || enabledStrategies.has("maintained");
-    if (phase0Repos.length > 0 && enabledStrategies.has("merged")) {
-      const phase0Cap = otherStrategiesCanRun ? Math.max(1, Math.ceil(maxResults * PHASE0_MAX_SHARE)) : maxResults;
-      const remaining = Math.min(maxResults - allCandidates.length, phase0Cap);
-      if (remaining > 0) {
-        const result = await runPhase0(this.octokit, this.vetter, phase0Repos, remaining, filterIssuesPhase0);
-        recordPhaseResult("0", result);
-      }
-      strategiesUsed.push("merged");
-    }
-    if (allCandidates.length < maxResults && orgsPhaseEnabled) {
-      await applyInterPhaseDelay();
-      const remaining = maxResults - allCandidates.length;
-      const result = await runPhaseOrgs(this.octokit, this.vetter, preferredOrgs, languages, isAnyLanguage, labels, remaining, minStars, phase0RepoSet, starredRepoSet, filterIssues, tracker);
-      recordPhaseResult("orgs", result);
-      strategiesUsed.push("orgs");
-    }
-    if (allCandidates.length < maxResults && starredRepos.length > 0 && searchBudget >= CRITICAL_BUDGET_THRESHOLD && enabledStrategies.has("starred")) {
-      await applyInterPhaseDelay();
-      const reposToSearch = starredRepos.filter((r) => !phase0RepoSet.has(r));
-      if (reposToSearch.length > 0) {
-        const remaining = maxResults - allCandidates.length;
-        if (remaining > 0) {
-          const result = await runPhase1(this.octokit, this.vetter, reposToSearch, labels, remaining, filterIssues);
-          recordPhaseResult("1", result);
-          strategiesUsed.push("starred");
-        }
-      }
-    }
-    const broadDelay = options.broadPhaseDelayMs ?? config2.broadPhaseDelayMs ?? 9e4;
-    const configuredSkipThreshold = config2.skipBroadWhenSufficientResults ?? 8;
-    const skipThreshold = configuredSkipThreshold > 0 ? Math.min(configuredSkipThreshold, maxResults - 1) : 0;
-    const viableBeforeBroad = viableCandidateCount();
-    if (viableBeforeBroad >= maxResults && enabledStrategies.has("broad")) {
-      info(MODULE12, `Skipping broad search: ${viableBeforeBroad} viable candidate(s) already meet maxResults (${maxResults})`);
-    } else if (enabledStrategies.has("broad")) {
-      const preferredOrgSet = new Set(preferredOrgs.map((o) => o.toLowerCase()));
-      const newRepoCandidateCount = allCandidates.filter((c) => c.recommendation !== "skip" && !phase0RepoSet.has(c.issue.repo) && !starredRepoSet.has(c.issue.repo) && !preferredOrgSet.has(c.issue.repo.split("/")[0]?.toLowerCase() ?? "")).length;
-      if (skipThreshold > 0 && newRepoCandidateCount >= skipThreshold) {
-        info(MODULE12, `Skipping broad search: already found ${newRepoCandidateCount} viable candidate(s) from new repos (threshold: ${skipThreshold})`);
-      } else {
-        await applyInterPhaseDelay();
-        if (allCandidates.length > 0 && broadDelay > 0) {
-          info(MODULE12, `Waiting ${(broadDelay / 1e3).toFixed(0)}s for rate limit cooldown before broad search...`);
-          await sleep(broadDelay);
-        } else if (allCandidates.length === 0) {
-          info(MODULE12, `Skipping broad phase delay: no results from previous phases, proceeding immediately`);
-        }
-        const remaining = maxResults - viableBeforeBroad;
-        const result = await runPhase2(this.octokit, this.vetter, scopes, labels, config2.labels, languages, isAnyLanguage, remaining, minStars, phase0RepoSet, starredRepoSet, allCandidates, filterIssues, tracker, options.languageRotationOffset ?? 0);
-        recordPhaseResult("2", result);
+    const starredToSearch = rotatingWindow(starredRepos, STARRED_REPOS_PER_RUN, repoRotation.starred ?? 0).filter((r) => !phase0RepoSet.has(r));
+    const canRun = {
+      all: false,
+      merged: phase0Repos.length > 0,
+      orgs: preferredOrgs.length > 0,
+      starred: starredToSearch.length > 0 && searchBudget >= CRITICAL_BUDGET_THRESHOLD,
+      broad: true,
+      maintained: true
+    };
+    const broadDelay = options.broadPhaseDelayMs ?? config2.broadPhaseDelayMs ?? 0;
+    const runStrategy = {
+      merged: async (wanted) => {
+        recordPhaseResult("0", await runPhase0(this.octokit, this.vetter, phase0Repos, wanted, filterIssuesPhase0));
+        strategiesUsed.push("merged");
+      },
+      orgs: async (wanted) => {
+        recordPhaseResult("orgs", await runPhaseOrgs(this.octokit, this.vetter, preferredOrgs, languages, isAnyLanguage, labels, wanted, minStars, phase0RepoSet, starredRepoSet, filterIssues, tracker));
+        strategiesUsed.push("orgs");
+      },
+      starred: async (wanted) => {
+        recordPhaseResult("1", await runPhase1(this.octokit, this.vetter, starredToSearch, labels, wanted, filterIssues));
+        strategiesUsed.push("starred");
+      },
+      broad: async (wanted) => {
+        recordPhaseResult("2", await runPhase2(this.octokit, this.vetter, scopes, labels, config2.labels, languages, isAnyLanguage, wanted, minStars, phase0RepoSet, starredRepoSet, allCandidates, filterIssues, tracker, options.languageRotationOffset ?? 0));
         strategiesUsed.push("broad");
+      },
+      maintained: async (wanted) => {
+        recordPhaseResult("3", await runPhase3(this.octokit, this.vetter, langQuery, minStars, config2.projectCategories ?? [], wanted, phase0RepoSet, starredRepoSet, starredRepos, allCandidates, filterIssues, tracker, repoRotation.maintained ?? 0));
+        strategiesUsed.push("maintained");
+      }
+    };
+    let starredSkippedForBudget = searchBudget < CRITICAL_BUDGET_THRESHOLD;
+    if (options.strategyRotationOffset !== void 0) {
+      const cursor = options.strategyRotationOffset;
+      const n = CONCRETE_STRATEGIES.length;
+      const order = CONCRETE_STRATEGIES.map((_, i) => CONCRETE_STRATEGIES[(cursor + i) % n]).filter((s) => enabledStrategies.has(s));
+      starredSkippedForBudget = false;
+      for (const strategy of order) {
+        if (!canRun[strategy]) {
+          if (strategy === "starred" && starredToSearch.length > 0) {
+            starredSkippedForBudget = true;
+          }
+          continue;
+        }
+        if (strategiesUsed.length > 0)
+          await applyInterPhaseDelay();
+        info(MODULE12, `Round-robin: running the ${strategy} strategy`);
+        await runStrategy[strategy](maxResults - viableCandidateCount());
+        if (viableCandidateCount() > 0)
+          break;
+      }
+    } else {
+      const orgsPhaseEnabled = canRun.orgs && enabledStrategies.has("orgs");
+      const otherStrategiesCanRun = orgsPhaseEnabled || starredRepos.length > 0 && enabledStrategies.has("starred") || enabledStrategies.has("broad") || enabledStrategies.has("maintained");
+      if (canRun.merged && enabledStrategies.has("merged")) {
+        const phase0Cap = otherStrategiesCanRun ? Math.max(1, Math.ceil(maxResults * PHASE0_MAX_SHARE)) : maxResults;
+        await runStrategy.merged(Math.min(maxResults - allCandidates.length, phase0Cap));
+      }
+      if (allCandidates.length < maxResults && orgsPhaseEnabled) {
+        await applyInterPhaseDelay();
+        await runStrategy.orgs(maxResults - allCandidates.length);
+      }
+      if (allCandidates.length < maxResults && starredRepos.length > 0 && searchBudget >= CRITICAL_BUDGET_THRESHOLD && enabledStrategies.has("starred")) {
+        await applyInterPhaseDelay();
+        if (starredToSearch.length > 0) {
+          await runStrategy.starred(maxResults - allCandidates.length);
+        }
+      }
+      const configuredSkipThreshold = config2.skipBroadWhenSufficientResults ?? 8;
+      const skipThreshold = configuredSkipThreshold > 0 ? Math.min(configuredSkipThreshold, maxResults - 1) : 0;
+      const viableBeforeBroad = viableCandidateCount();
+      if (viableBeforeBroad >= maxResults && enabledStrategies.has("broad")) {
+        info(MODULE12, `Skipping broad search: ${viableBeforeBroad} viable candidate(s) already meet maxResults (${maxResults})`);
+      } else if (enabledStrategies.has("broad")) {
+        const preferredOrgSet = new Set(preferredOrgs.map((o) => o.toLowerCase()));
+        const newRepoCandidateCount = allCandidates.filter((c) => c.recommendation !== "skip" && !phase0RepoSet.has(c.issue.repo) && !starredRepoSet.has(c.issue.repo) && !preferredOrgSet.has(c.issue.repo.split("/")[0]?.toLowerCase() ?? "")).length;
+        if (skipThreshold > 0 && newRepoCandidateCount >= skipThreshold) {
+          info(MODULE12, `Skipping broad search: already found ${newRepoCandidateCount} viable candidate(s) from new repos (threshold: ${skipThreshold})`);
+        } else {
+          await applyInterPhaseDelay();
+          if (allCandidates.length > 0 && broadDelay > 0) {
+            info(MODULE12, `Waiting ${(broadDelay / 1e3).toFixed(0)}s for rate limit cooldown before broad search...`);
+            await sleep(broadDelay);
+          } else if (allCandidates.length === 0) {
+            info(MODULE12, `Skipping broad phase delay: no results from previous phases, proceeding immediately`);
+          }
+          await runStrategy.broad(maxResults - viableBeforeBroad);
+        }
+      }
+      const viableBeforeMaintained = viableCandidateCount();
+      if (viableBeforeMaintained >= maxResults && enabledStrategies.has("maintained")) {
+        info(MODULE12, `Skipping maintained search: ${viableBeforeMaintained} viable candidate(s) already meet maxResults (${maxResults})`);
+      } else if (enabledStrategies.has("maintained")) {
+        await applyInterPhaseDelay();
+        await runStrategy.maintained(maxResults - viableBeforeMaintained);
       }
     }
-    const viableBeforeMaintained = viableCandidateCount();
-    if (viableBeforeMaintained >= maxResults && enabledStrategies.has("maintained")) {
-      info(MODULE12, `Skipping maintained search: ${viableBeforeMaintained} viable candidate(s) already meet maxResults (${maxResults})`);
-    } else if (enabledStrategies.has("maintained")) {
-      await applyInterPhaseDelay();
-      const remaining = maxResults - viableBeforeMaintained;
-      const result = await runPhase3(this.octokit, this.vetter, langQuery, minStars, config2.projectCategories ?? [], remaining, phase0RepoSet, starredRepoSet, starredRepos, allCandidates, filterIssues, tracker);
-      recordPhaseResult("3", result);
-      strategiesUsed.push("maintained");
-    }
-    const phasesSkippedForBudget = searchBudget < CRITICAL_BUDGET_THRESHOLD;
-    const budgetNote = phasesSkippedForBudget ? preflightFailed ? " The starred-repo phase was skipped as a precaution because the rate-limit check failed (quota unknown); broad and maintained phases still ran on GraphQL." : ` The starred-repo phase was skipped due to critically low API quota (${searchBudget} remaining); broad and maintained phases still ran on GraphQL.` : "";
+    const phasesSkippedForBudget = starredSkippedForBudget;
+    const budgetNote = phasesSkippedForBudget ? preflightFailed ? " The starred-repo phase was skipped as a precaution because the rate-limit check failed (quota unknown); the other strategies don't use that quota." : ` The starred-repo phase was skipped due to critically low API quota (${searchBudget} remaining); the other strategies don't use that quota.` : "";
     if (allCandidates.length === 0) {
       const errorDetails = [
         phaseErrors["0"] ? `Phase 0 (merged-PR repos): ${phaseErrors["0"]}` : null,
@@ -39360,8 +39992,8 @@ var NO_BROAD_RESULTS_MESSAGE = "No open feature opportunities matched your filte
 var DEFAULT_BROAD_MAX_TO_VET = 30;
 function buildBroadFeatureSearchQuery(opts) {
   const parts = ["is:issue", "is:open", "no:assignee"];
-  const labelClause = FEATURE_LABELS.map((l) => `label:"${l}"`).join(" OR ");
-  parts.push(`(${labelClause})`);
+  const labelClause = `label:${FEATURE_LABELS.map((l) => JSON.stringify(l)).join(",")}`;
+  parts.push(labelClause);
   for (const excl of FEATURE_EXCLUSION_LABELS) {
     parts.push(`-label:"${excl}"`);
   }
@@ -39761,6 +40393,7 @@ function mergeStates(local, remote) {
     ...local,
     ...remote,
     version: 1,
+    stateRevision: Math.max(local.stateRevision, remote.stateRevision),
     preferences,
     preferencesUpdatedAt,
     tombstones,
@@ -40007,7 +40640,8 @@ var OssScout = class {
   }
   /**
    * Multi-strategy issue search. Returns scored, sorted candidates.
-   * Automatically culls expired skip entries and filters skipped issues.
+   * Skipped issues are excluded; permanent skips never re-surface; transient
+   * vetter skips age out after 90 days (#343, #348).
    */
   async search(options) {
     this.evictStaleCacheEntries();
@@ -40048,15 +40682,21 @@ var OssScout = class {
         diversityRatio,
         interPhaseDelayMs: options?.interPhaseDelayMs,
         broadPhaseDelayMs: options?.broadPhaseDelayMs,
-        languageRotationOffset: rotation.languageOffset
+        languageRotationOffset: rotation.languageOffset,
+        repoRotationOffsets: {
+          merged: rotation.phase0Offset ?? 0,
+          starred: rotation.starredOffset ?? 0,
+          maintained: rotation.maintainedOffset ?? 0
+        },
+        strategyRotationOffset: rotation.strategyOffset ?? 0
       }));
     } catch (err) {
       if (err instanceof ValidationError) {
-        this.advanceRotationIfBroadRan(rotation, err.strategiesUsed ?? []);
+        this.advanceRotation(rotation, err.strategiesUsed ?? []);
       }
       throw err;
     }
-    this.advanceRotationIfBroadRan(rotation, strategiesUsed);
+    this.advanceRotation(rotation, strategiesUsed);
     for (const c of candidates) {
       this.updateRepoSignalsFromHealth(c.projectHealth);
     }
@@ -40071,18 +40711,26 @@ var OssScout = class {
     };
   }
   /**
-   * Advance the language-rotation cursor when the broad phase actually ran.
-   * Called on both the success path and the zero-candidate ValidationError
-   * path — a broad phase that ran and found nothing must still rotate, or the
-   * same barren language slice would lead every subsequent run (#249
-   * follow-up). Skipped/gated broad phases don't burn a rotation slot.
+   * Advance the rotation cursor of each phase that actually ran: the language
+   * cursor for broad (#249 follow-up), the repo-window cursors for
+   * merged/starred/maintained (#324, #333). Called on both the success path
+   * and the zero-candidate ValidationError path — a phase that ran and found
+   * nothing must still rotate, or the same barren slice would lead every
+   * subsequent run. Skipped/gated phases don't burn a rotation slot. The
+   * round-robin strategy cursor (#336) moves to just after the strategy that
+   * led (the first one used), so the next search starts with the next one.
    */
-  advanceRotationIfBroadRan(rotation, strategiesUsed) {
-    if (!strategiesUsed.includes("broad"))
+  advanceRotation(rotation, strategiesUsed) {
+    const ran = (strategy) => strategiesUsed.includes(strategy) ? 1 : 0;
+    if (strategiesUsed.length === 0)
       return;
     this.state.searchRotation = {
       ...rotation,
-      languageOffset: rotation.languageOffset + 1,
+      languageOffset: rotation.languageOffset + ran("broad"),
+      phase0Offset: (rotation.phase0Offset ?? 0) + ran("merged"),
+      starredOffset: (rotation.starredOffset ?? 0) + ran("starred"),
+      maintainedOffset: (rotation.maintainedOffset ?? 0) + ran("maintained"),
+      strategyOffset: CONCRETE_STRATEGIES.indexOf(strategiesUsed[0]) + 1,
       lastRotatedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
     this.dirty = true;
@@ -40498,6 +41146,22 @@ var OssScout = class {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const existing = new Map((this.state.savedResults ?? []).map((r) => [r.issueUrl, r]));
     for (const c of candidates) {
+      if (c.recommendation === "skip") {
+        existing.delete(c.issue.url);
+        const TERMINAL_REASONS = /* @__PURE__ */ new Set([
+          "Issue is closed",
+          "Linked PR already merged"
+        ]);
+        const permanent = c.reasonsToSkip.some((r) => TERMINAL_REASONS.has(r));
+        this.skipIssue(c.issue.url, {
+          repo: c.issue.repo,
+          number: c.issue.number,
+          title: c.issue.title,
+          reason: c.reasonsToSkip.join("; ") || "vetter: skip",
+          permanent
+        });
+        continue;
+      }
       const prev = existing.get(c.issue.url);
       existing.set(c.issue.url, {
         issueUrl: c.issue.url,
@@ -40548,12 +41212,20 @@ var OssScout = class {
   }
   // ── Skip List ───────────────────────────────────────────────────────
   /**
-   * Skip an issue — excludes it from future searches. Auto-culled after 90 days.
+   * Skip an issue. Pass `permanent: false` for vetter-derived transient skips
+   * so they expire via cullExpiredSkips (#348); manual skips default to permanent.
    */
   skipIssue(url2, metadata) {
     const existing = this.state.skippedIssues ?? [];
-    if (existing.some((s) => s.url === url2))
+    const hit = existing.find((s) => s.url === url2);
+    if (hit) {
+      if (metadata?.permanent === true && hit.permanent !== true) {
+        hit.permanent = true;
+        this.dirty = true;
+      }
       return;
+    }
+    const permanent = metadata?.permanent ?? true;
     this.state.skippedIssues = [
       ...existing,
       {
@@ -40561,7 +41233,9 @@ var OssScout = class {
         repo: metadata?.repo ?? "",
         number: metadata?.number ?? 0,
         title: metadata?.title ?? "",
-        skippedAt: (/* @__PURE__ */ new Date()).toISOString()
+        skippedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        permanent,
+        ...metadata?.reason ? { reason: metadata.reason } : {}
       }
     ];
     if (this.state.savedResults) {
@@ -40594,7 +41268,11 @@ var OssScout = class {
     this.dirty = true;
   }
   /**
-   * Remove skipped issues older than maxDays (default 90). Called automatically during search.
+   * Remove non-permanent skipped issues older than maxDays (default 90).
+   * Called at the start of each search (#348) to re-surface issues whose
+   * transient block condition (closed competing PR, own in-flight PR, soft-skip
+   * accumulation) has aged out. Permanent entries (manual skips, terminal vetter
+   * reasons) are never touched.
    * @returns The number of expired entries that were removed.
    */
   cullExpiredSkips(maxDays = 90) {
@@ -40602,6 +41280,8 @@ var OssScout = class {
     cutoff.setDate(cutoff.getDate() - maxDays);
     const before = (this.state.skippedIssues ?? []).length;
     this.state.skippedIssues = (this.state.skippedIssues ?? []).filter((s) => {
+      if (s.permanent !== false)
+        return true;
       const d = new Date(s.skippedAt);
       if (isNaN(d.getTime())) {
         return true;
@@ -40924,6 +41604,7 @@ function registerTools(server, scout) {
           ]
         };
       } catch (err) {
+        if (scout.isDirty()) await scout.checkpoint().catch(() => false);
         const msg = err instanceof Error ? err.message : String(err);
         return {
           content: [{ type: "text", text: `Error: ${msg}` }],
@@ -41025,7 +41706,7 @@ function registerTools(server, scout) {
   );
   server.tool(
     "skip",
-    "Skip, unskip, list, or clear skipped issues. Skipped issues are excluded from future searches and auto-expire after 90 days.",
+    "Skip, unskip, list, or clear skipped issues. Skipped issues are excluded from future searches permanently.",
     {
       action: external_exports3.enum(["add", "remove", "list", "clear"]).default("add").describe("Action to perform (default: add)"),
       issueUrl: external_exports3.string().optional().describe("GitHub issue URL (required for add/remove actions)")
@@ -41203,7 +41884,7 @@ function registerResources(server, scout) {
 // src/index.ts
 var SERVER_INFO = {
   name: "oss-scout-mcp",
-  version: "0.11.0"
+  version: "0.12.1"
   // x-release-please-version
 };
 function createServer(scout) {