@wenathlan/extension 1.1.54 → 1.1.56

package/extension/dist/background.js

@@ -2438,6 +2438,183 @@ var sessionmemory = class {
   async listtoolcalls() {
     return await this.adapter.get("mcptoolcalls") ?? [];
   }
+  /** Returns every stored session token of paired remote clients; the records carry only their tokenhash form so raw tokens never persist. */
+  async getsessiontokens() {
+    return await this.adapter.get("mcpsessiontokens") ?? [];
+  }
+  /** Replaces the stored session token set after one issue, revocation or expiry sweep. */
+  async setsessiontokens(tokens) {
+    return this.adapter.set("mcpsessiontokens", tokens);
+  }
+  /** Returns every stored pairing code with its single use state, newest first. */
+  async getpairingcodes() {
+    return await this.adapter.get("mcppairingcodes") ?? [];
+  }
+  /** Records one issued pairing code for the one time client pairing. */
+  async addpairingcode(code) {
+    return this.adapter.set("mcppairingcodes", [code, ...(await this.getpairingcodes()).filter((candidate) => candidate.code !== code.code)]);
+  }
+  /** Marks one pairing code used so it never pairs a second client; an unknown code stays untouched. */
+  async usepairingcode(code, now) {
+    await this.adapter.set("mcppairingcodes", (await this.getpairingcodes()).map((candidate) => candidate.code === code ? { ...candidate, usedat: now } : candidate));
+  }
+  /** Returns every client allowlist entry with its grant history. */
+  async getallowlist() {
+    return await this.adapter.get("mcpallowlist") ?? [];
+  }
+  /** Upserts one client allowlist entry by its fingerprint with the grant history riding the record. */
+  async setallowlistentry(entry) {
+    await this.adapter.set("mcpallowlist", [entry, ...(await this.getallowlist()).filter((candidate) => candidate.fingerprint !== entry.fingerprint)]);
+  }
+  /** Removes one client allowlist entry so its fingerprint stops passing the allowlist check. */
+  async removeallowlistentry(fingerprint) {
+    await this.adapter.set("mcpallowlist", (await this.getallowlist()).filter((entry) => entry.fingerprint !== fingerprint));
+  }
+  /** Returns every approval gate with its decision state — the pending and resolved gates of the approval view. */
+  async listapprovals() {
+    return await this.adapter.get("mcpapprovals") ?? [];
+  }
+  /** Records one raised approval gate or its resolved state, keyed by the gate id. */
+  async setapproval(request) {
+    await this.adapter.set("mcpapprovals", [request, ...(await this.listapprovals()).filter((candidate) => candidate.id !== request.id)]);
+  }
+  /** Records one approval execution — the decision, the actor, the time and the latency — beside its gate. */
+  async addapprovalexec(exec) {
+    return this.adapter.set("mcpapprovalexecs", [exec, ...await this.adapter.get("mcpapprovalexecs") ?? []]);
+  }
+  /** Returns every approval execution record, newest first. */
+  async listapprovalexecs() {
+    return await this.adapter.get("mcpapprovalexecs") ?? [];
+  }
+  /** Records one auth handshake event with its issued, verified or refused outcome. */
+  async addauthhandshake(event) {
+    return this.adapter.set("mcpauthhandshakes", [event, ...await this.adapter.get("mcpauthhandshakes") ?? []]);
+  }
+  /** Returns every auth handshake event with its outcome, newest first. */
+  async listauthhandshakes() {
+    return await this.adapter.get("mcpauthhandshakes") ?? [];
+  }
+  /** Returns every stored client identity with its fingerprint for allowlist matching. */
+  async getclientidentities() {
+    return await this.adapter.get("mcpidentities") ?? [];
+  }
+  /** Upserts one client identity by its fingerprint so the allowlist matches it. */
+  async setclientidentity(identity) {
+    await this.adapter.set("mcpidentities", [identity, ...(await this.getclientidentities()).filter((candidate) => candidate.fingerprint !== identity.fingerprint)]);
+  }
+  /** Returns every open and closed stream channel of the http stream transport. */
+  async getstreamchannels() {
+    return await this.adapter.get("mcpchannels") ?? [];
+  }
+  /** Replaces the stored stream channel set after one open, heartbeat or close sweep. */
+  async setstreamchannels(channels) {
+    return this.adapter.set("mcpchannels", channels);
+  }
+  /** Returns every client event subscription with its kinds and filters, newest first. */
+  async geteventsubscriptions() {
+    return await this.adapter.get("mcpeventsubscriptions") ?? [];
+  }
+  /** Replaces the stored event subscription set after one subscribe, unsubscribe or delivery sweep. */
+  async seteventsubscriptions(subscriptions) {
+    return this.adapter.set("mcpeventsubscriptions", subscriptions);
+  }
+  /** Returns every page state resource watcher with its baseline, newest first. */
+  async getresourcewatches() {
+    return await this.adapter.get("mcpresourcewatches") ?? [];
+  }
+  /** Replaces the stored resource watcher set after one watch, unwatch or delta push. */
+  async setresourcewatches(watches) {
+    return this.adapter.set("mcpresourcewatches", watches);
+  }
+  /** Returns every sampling request with its provenance, newest first. */
+  async getsamplingrequests() {
+    return await this.adapter.get("mcpsampling") ?? [];
+  }
+  /** Replaces the stored sampling request set after one request or answer. */
+  async setsamplingrequests(requests) {
+    return this.adapter.set("mcpsampling", requests);
+  }
+  /** Returns every stored idempotency record for replay, newest first. */
+  async getidempotencyrecords() {
+    return await this.adapter.get("mcpidempotency") ?? [];
+  }
+  /** Replaces the stored idempotency record set after one store or expiry sweep. */
+  async setidempotencyrecords(records) {
+    return this.adapter.set("mcpidempotency", records);
+  }
+  /** Returns every per client rate limit counter with its window and budget. */
+  async getcallratelimits() {
+    return await this.adapter.get("mcpcallratelimits") ?? [];
+  }
+  /** Replaces the stored per client rate limit set after one configuration or counted call. */
+  async setcallratelimits(limits) {
+    return this.adapter.set("mcpcallratelimits", limits);
+  }
+  /** Returns every stored batch call with its per item outcomes, newest first. */
+  async getbatchcalls() {
+    return await this.adapter.get("mcpbatchcalls") ?? [];
+  }
+  /** Upserts one batch call by its id with the per item outcomes riding the record. */
+  async setbatchcall(batch) {
+    await this.adapter.set("mcpbatchcalls", [batch, ...(await this.getbatchcalls()).filter((candidate) => candidate.id !== batch.id)]);
+  }
+  /** Returns every call context of the call runtime, newest first. */
+  async getcallcontexts() {
+    return await this.adapter.get("mcpcallcontexts") ?? [];
+  }
+  /** Replaces the stored call context set after one begin, end or cancellation. */
+  async setcallcontexts(contexts) {
+    return this.adapter.set("mcpcallcontexts", contexts);
+  }
+  /** Returns every stored tool mock for client testing. */
+  async gettoolmocks() {
+    return await this.adapter.get("mcptoolmocks") ?? [];
+  }
+  /** Upserts one tool mock by its tool name or removes it when the canned result is absent. */
+  async settoolmock(mock) {
+    await this.adapter.set("mcptoolmocks", [mock, ...(await this.gettoolmocks()).filter((candidate) => candidate.tool !== mock.tool)]);
+  }
+  /** Removes one tool mock so its tool returns to the real gates. */
+  async removetoolmock(tool) {
+    await this.adapter.set("mcptoolmocks", (await this.gettoolmocks()).filter((candidate) => candidate.tool !== tool));
+  }
+  /** Stores one stream chunk of a progressive tool result under the recent chunk window of 25 records. */
+  async addstreamchunk(chunk) {
+    await this.adapter.set("mcpstreamchunks", [chunk, ...(await this.getstreamchunks()).slice(0, 24)]);
+  }
+  /** Returns the recent stream chunks of progressive tool results, newest first. */
+  async getstreamchunks() {
+    return await this.adapter.get("mcpstreamchunks") ?? [];
+  }
+  /** Replaces the recent stream chunk window after one streaming sweep. */
+  async setstreamchunks(chunks) {
+    return this.adapter.set("mcpstreamchunks", chunks);
+  }
+  /** Returns the audited tool call log under the requested filters: the client, the tool, the outcome, the time floor and the newest bound, all optional. */
+  async getcalllog(filters) {
+    let records = await this.listtoolcalls();
+    if (filters?.clientid !== void 0) records = records.filter((record2) => record2.clientid === filters.clientid);
+    if (filters?.tool !== void 0) records = records.filter((record2) => record2.tool === filters.tool);
+    if (filters?.ok !== void 0) records = records.filter((record2) => record2.ok === filters.ok);
+    if (filters?.since !== void 0) records = records.filter((record2) => record2.at >= (filters.since ?? 0));
+    return filters?.limit !== void 0 ? records.slice(0, filters.limit) : records;
+  }
+  /** Stores one progress notice of a long tool call under the recent notice window of 25 records. */
+  async addprogressnotice(notice) {
+    await this.adapter.set("mcpprogressnotices", [notice, ...(await this.getprogressnotices()).slice(0, 24)]);
+  }
+  /** Returns the recent progress notices of long tool calls, newest first. */
+  async getprogressnotices() {
+    return await this.adapter.get("mcpprogressnotices") ?? [];
+  }
+  /** Returns the tool dry run toggle of the next call: true once the user armed the dry run in the panel. */
+  async getdryruntoggle() {
+    return await this.adapter.get("mcpdryruntoggle") === true;
+  }
+  /** Arms or disarms the tool dry run of the next call. */
+  async setdryruntoggle(enabled) {
+    return this.adapter.set("mcpdryruntoggle", enabled);
+  }
 };
 function mediakindof(record2) {
   if ("pages" in record2) return "pdf";
@@ -2491,7 +2668,7 @@ function readtool(name, kind, description, inputs = {}) {
   return { name, version: toolcatalogversion, description, inputschema: toolschemaof({ target: { type: "string", description: "Reviewed css selector the tool addresses." }, value: { type: "string", description: "Reviewed literal value the tool carries." }, options: { type: "object", description: "Reviewed json options of the wrapped action kind with the empty default.", default: {} }, ...inputs }), kind, risk: "read" };
 }
 function gatedtool(name, kind, risk, description, review) {
-  return { name, version: toolcatalogversion, description, inputschema: toolschemaof({ stepid: { type: "string", description: "Id of the approved plan step this tool executes.", required: true } }), kind, risk, consentmeta: { review } };
+  return { name, version: toolcatalogversion, description, inputschema: toolschemaof({ stepid: { type: "string", description: "Id of the approved plan step this tool executes.", required: true } }), kind, risk, consentmeta: { review, riskclass: risk, approvalrequired: true, originscope: "session" } };
 }
 function browserdomain() {
   return {
@@ -2567,6 +2744,10 @@ function resolvetool(catalog, name) {
   const matches = alltools(catalog).filter((tool) => tool.name.split(".")[1] === name);
   return matches.length === 1 ? matches[0] : void 0;
 }
+function namespaceof(name) {
+  const head = name.split(".")[0];
+  return toolnamespaces.includes(head) ? head : void 0;
+}
 
 // socketbus.ts
 var socketkinds = ["opensocket", "sendmessage", "waitmessage", "subscribesse", "longpoll"];
@@ -8276,6 +8457,8 @@ function serverenablementgate(config) {
   if (typeof config.port !== "number" || !Number.isFinite(config.port) || config.port <= 0 || config.port > 65535) return { allowed: false, reason: "The http listener port must be a valid port number." };
   if (config.framesize !== void 0 && (typeof config.framesize !== "number" || !Number.isFinite(config.framesize) || config.framesize <= 0)) return { allowed: false, reason: "The user configured frame size must stay a positive number with no code ceiling." };
   if (config.queuedepth !== void 0 && (typeof config.queuedepth !== "number" || !Number.isFinite(config.queuedepth) || config.queuedepth <= 0)) return { allowed: false, reason: "The user configured queue depth must stay a positive number with no code ceiling." };
+  const remote = remoteenablementgate(config);
+  if (!remote.allowed) return remote;
   return { allowed: true };
 }
 function tooldispatchgate(input) {
@@ -8292,6 +8475,77 @@ function tooldispatchgate(input) {
   if (step.kind !== input.tool.kind) return { allowed: false, reason: `The tool call names the step ${input.stepid} whose kind ${String(step.kind)} does not match the ${input.tool.name} tool.` };
   return { allowed: true };
 }
+function allowlistentryvalid(entry, identities) {
+  if (typeof entry.fingerprint !== "string" || entry.fingerprint.trim() === "") return { allowed: false, reason: "The allowlist entry needs the client fingerprint it grants." };
+  if (!identities.some((identity) => identity.fingerprint === entry.fingerprint)) return { allowed: false, reason: `The allowlist entry ${entry.fingerprint} matches no known client identity.` };
+  if (typeof entry.displayname !== "string" || entry.displayname.trim() === "") return { allowed: false, reason: `The allowlist entry ${entry.fingerprint} needs its display name.` };
+  if (!Array.isArray(entry.namespaces) || entry.namespaces.length === 0) return { allowed: false, reason: `The allowlist entry ${entry.displayname} grants no tool namespace.` };
+  if (!entry.namespaces.every((namespace) => toolnamespaces.includes(namespace))) return { allowed: false, reason: `The allowlist entry ${entry.displayname} grants an unreviewed namespace.` };
+  return { allowed: true };
+}
+function tokenlifetimevalid(lifetime) {
+  if (lifetime === void 0) return { allowed: true };
+  if (typeof lifetime !== "number" || !Number.isFinite(lifetime) || lifetime <= 0) return { allowed: false, reason: "The token lifetime must stay a positive user value with no code ceiling." };
+  return { allowed: true };
+}
+function remotetransporttls(config) {
+  const bind = config.bind !== void 0 && config.bind.trim() !== "" ? config.bind.trim() : "127.0.0.1";
+  const local = bind === "127.0.0.1" || bind === "localhost" || bind === "::1";
+  const tls = config.remoteaccess?.tls ?? config.httpstream?.tls;
+  if ((config.remoteaccess !== void 0 || !local) && (tls === void 0 || tls.mode === "off")) return { allowed: false, reason: `The ${config.remoteaccess !== void 0 ? "remote transport" : `bind ${bind}`} leaves localhost and every non localhost transport requires tls before any remote traffic.` };
+  return { allowed: true };
+}
+function pairingreadinessgate(session, now) {
+  if (!session || session.stoppedat || session.pausedat) return { allowed: false, reason: "The pairing flow needs the live browser session before any code issues." };
+  if (session.expiresat <= now) return { allowed: false, reason: "The browser session has expired and the pairing flow is refused." };
+  return { allowed: true };
+}
+function remoteenablementgate(config) {
+  if (config.remoteaccess === void 0) return { allowed: true };
+  if (config.remote !== true) return { allowed: false, reason: "The remote transport enablement is a sensitive user choice and needs the explicit remote review." };
+  const tls = remotetransporttls(config);
+  if (!tls.allowed) return tls;
+  if (typeof config.remoteaccess.endpoint !== "string" || config.remoteaccess.endpoint.trim() === "") return { allowed: false, reason: "The remote access policy needs its user configured endpoint." };
+  if (config.remoteaccess.maxclients !== void 0 && (typeof config.remoteaccess.maxclients !== "number" || !Number.isFinite(config.remoteaccess.maxclients) || config.remoteaccess.maxclients <= 0)) return { allowed: false, reason: "The user configured client ceiling must stay a positive value with no code ceiling." };
+  const lifetime = tokenlifetimevalid(config.remoteaccess.tokenlifetimems);
+  if (!lifetime.allowed) return lifetime;
+  const timeout = approvaltimeoutvalid(config.remoteaccess.approvaltimeout);
+  if (!timeout.allowed) return timeout;
+  return { allowed: true };
+}
+function approvaltimeoutvalid(timeout) {
+  if (timeout === void 0) return { allowed: true };
+  if (typeof timeout.windowms !== "number" || !Number.isFinite(timeout.windowms) || timeout.windowms <= 0) return { allowed: false, reason: "The approval timeout must stay a positive user window with no code ceiling." };
+  if (timeout.ontimeout !== "refuse") return { allowed: false, reason: "The documented disposition of an unanswered approval gate is refusal." };
+  return { allowed: true };
+}
+function revocationgate() {
+  return { allowed: true };
+}
+function subscriptiongrade(subscription) {
+  if (!Array.isArray(subscription.kinds) || subscription.kinds.length === 0) return { allowed: false, reason: "An event subscription needs at least one protocol event kind." };
+  if (subscription.kinds.includes("callstarted") && subscription.origin === void 0 && subscription.tool === void 0) return { allowed: false, reason: "An event subscription that mirrors the callstarted events of tools with side effects needs its origin or tool filter so it never widens what the session grants." };
+  return { allowed: true };
+}
+function callratelimitvalid(limit) {
+  if (limit === void 0) return { allowed: true };
+  if (typeof limit.windowms !== "number" || !Number.isFinite(limit.windowms) || limit.windowms <= 0) return { allowed: false, reason: "The rate limit window must stay a positive user value with no code ceiling." };
+  if (limit.budget !== void 0 && (typeof limit.budget !== "number" || !Number.isFinite(limit.budget) || limit.budget <= 0)) return { allowed: false, reason: "The rate limit budget must stay a positive user value with no code ceiling." };
+  if (limit.clientid.trim() === "") return { allowed: false, reason: "A per client rate limit needs the client it counts." };
+  return { allowed: true };
+}
+function batchgrade(input) {
+  if (input.calls.length === 0) return { allowed: false, reason: "A batch call needs at least one ordered tool call." };
+  const sensitive = input.calls.some((call) => call.risk === "sensitive");
+  if (sensitive && !input.approved) return { allowed: false, reason: "The batch grades sensitive through its most sensitive member and runs only behind the approval gates." };
+  return { allowed: true };
+}
+function mockusagevalid(mock) {
+  if (mock.testcontext !== true) return { allowed: false, reason: `The ${mock.tool} mock stays outside a test context and is refused; tool mocks never answer real calls.` };
+  if (mock.tool.trim() === "") return { allowed: false, reason: "A tool mock needs the namespaced tool it stands in for." };
+  if (typeof mock.result.content !== "string") return { allowed: false, reason: "A tool mock needs its canned result content." };
+  return { allowed: true };
+}
 
 // progress.ts
 function emptyprogress(planid, now) {
@@ -8471,11 +8725,432 @@ function recordtoolcall(progress, planid, stepid, entry, now) {
 }
 
 // version.ts
-var packageversion = "1.1.54";
+var packageversion = "1.1.56";
 
 // types.ts
 var protocolversion = packageversion;
 
+// clientauth.ts
+var tokenhashprefix = "sha256:";
+var defaulttokenlifetimems = 36e5;
+var defaultpairinglifetimems = 3e5;
+var defaultchallengelifetimems = 12e4;
+var authrefusedmessage = "The remote frame failed its authentication handshake.";
+async function tokenhashof(raw) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(raw));
+  return tokenhashprefix + [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function issuepairingcode(input) {
+  const scopes = input.scopes.filter((scope) => toolnamespaces.includes(scope));
+  return { code: input.code ?? `DT-${randomid().replace(/-/g, "").slice(0, 8).toUpperCase()}`, scopes, issuedat: input.now, expiresat: input.now + (input.lifetime ?? defaultpairinglifetimems) };
+}
+function redeempairingcode(input) {
+  const match = input.codes.find((candidate) => candidate.code === input.code);
+  if (match === void 0) return { reason: authrefusedmessage };
+  if (match.usedat !== void 0) return { reason: "The pairing code was already used once and never pairs a second client." };
+  if (input.now >= match.expiresat) return { reason: "The pairing code expired before the exchange completed." };
+  return { code: { ...match, usedat: input.now } };
+}
+async function issuetoken(input) {
+  const raw = input.raw ?? `${randomid()}.${randomid()}`;
+  const token = { id: input.id ?? randomid(), clientid: input.clientid, hash: await tokenhashof(raw), scopes: input.scopes.filter((scope) => toolnamespaces.includes(scope)), issuedat: input.now, expiresat: input.now + (input.lifetime ?? defaulttokenlifetimems) };
+  return { token, raw };
+}
+async function verifytoken(input) {
+  const hash = await tokenhashof(input.raw);
+  const match = input.tokens.find((candidate) => candidate.hash === hash);
+  if (match === void 0) return { reason: authrefusedmessage };
+  if (match.revokedat !== void 0) return { reason: authrefusedmessage };
+  if (input.now >= match.expiresat) return { reason: authrefusedmessage };
+  return { token: match };
+}
+function revokeclient(tokens, clientid, now) {
+  return tokens.map((token) => token.clientid === clientid && token.revokedat === void 0 ? { ...token, revokedat: now } : token);
+}
+function checkallowlist(input) {
+  const entry = input.entries.find((candidate) => candidate.fingerprint === input.fingerprint);
+  if (entry === void 0) return { allowed: false, reason: `The client fingerprint ${input.fingerprint} is not on the allowlist and is refused.` };
+  if (input.namespace !== void 0 && !entry.namespaces.includes(input.namespace)) return { allowed: false, reason: `The allowlist entry ${entry.displayname} grants no ${input.namespace} tools.` };
+  return { allowed: true };
+}
+function grantallowlistentry(input) {
+  const scopes = input.namespaces.filter((scope) => toolnamespaces.includes(scope));
+  const existing = input.entries.find((entry) => entry.fingerprint === input.identity.fingerprint);
+  if (existing === void 0) {
+    return [{ fingerprint: input.identity.fingerprint, displayname: input.identity.displayname, namespaces: scopes, grantedat: input.now, history: [{ at: input.now, actor: input.actor, change: `Granted the ${scopes.length > 0 ? scopes.join(", ") : "no"} namespaces.` }] }, ...input.entries];
+  }
+  return input.entries.map((entry) => entry.fingerprint !== input.identity.fingerprint ? entry : { ...entry, displayname: input.identity.displayname, namespaces: scopes, history: [{ at: input.now, actor: input.actor, change: `Rescoped to ${scopes.length > 0 ? scopes.join(", ") : "no"} namespaces.` }, ...entry.history] });
+}
+function issuechallenge(input) {
+  return { nonce: input.nonce ?? randomid(), method: input.method, issuedat: input.now, expiresat: input.now + (input.lifetime ?? defaultchallengelifetimems) };
+}
+function scopecheck(token, namespace) {
+  if (namespace === void 0) return { allowed: false, fast: true, reason: "The tool call names no reviewed namespace." };
+  if (token === void 0) return { allowed: false, reason: "The tool call carries no verified session token." };
+  if (!token.scopes.includes(namespace)) return { allowed: false, reason: `The session token grants no ${namespace} tools.` };
+  return { allowed: true };
+}
+function tlsstateof(tls) {
+  return { mode: tls.mode, certificaterequired: tls.mode === "required" || tls.certificatefingerprint !== void 0, verified: tls.verifiedat !== void 0 };
+}
+
+// agentstream.ts
+var protocoleventkinds = ["callstarted", "callresult", "streamchunk", "progress", "resourcedelta", "sampling", "cancellation"];
+var readonlyeventkinds = ["callresult", "streamchunk", "progress", "resourcedelta", "sampling", "cancellation"];
+function subscriberegister(input) {
+  if (input.clientid.trim() === "") return { reason: "The event subscription needs the paired client it belongs to." };
+  const kinds = input.kinds === void 0 || input.kinds.length === 0 ? [...readonlyeventkinds] : [...new Set(input.kinds)];
+  for (const kind of kinds) {
+    if (!protocoleventkinds.includes(kind)) return { reason: `The event kind ${kind} is not a protocol event kind.` };
+  }
+  if (input.origin !== void 0 && input.origin.trim() === "") return { reason: "The origin filter of an event subscription must name an origin or stay absent." };
+  if (input.tool !== void 0 && input.tool.trim() === "") return { reason: "The tool filter of an event subscription must name a tool or stay absent." };
+  return { subscription: { id: input.id ?? randomid(), clientid: input.clientid, kinds, ...input.origin !== void 0 ? { origin: input.origin } : {}, ...input.tool !== void 0 ? { tool: input.tool } : {}, createdat: input.now } };
+}
+function unsubscriberegister(subscriptions, id, now) {
+  return subscriptions.map((subscription) => subscription.id === id && subscription.canceledat === void 0 ? { ...subscription, canceledat: now } : subscription);
+}
+function notifyevent(input) {
+  const deliveries = [];
+  const subscriptions = input.subscriptions.map((subscription) => {
+    if (subscription.canceledat !== void 0) return subscription;
+    if (!subscription.kinds.includes(input.kind)) return subscription;
+    if (subscription.origin !== void 0 && input.origin !== void 0 && subscription.origin !== input.origin) return subscription;
+    if (subscription.tool !== void 0 && input.tool !== void 0 && subscription.tool !== input.tool) return subscription;
+    deliveries.push({ subscriptionid: subscription.id, clientid: subscription.clientid, frame: { jsonrpc: "2.0", method: "events/notify", params: { subscriptionid: subscription.id, kind: input.kind, ...input.origin !== void 0 ? { origin: input.origin } : {}, ...input.tool !== void 0 ? { tool: input.tool } : {}, ...input.payload !== void 0 ? { payload: input.payload } : {}, at: input.now } } });
+    return { ...subscription, lastdeliveredat: input.now };
+  });
+  return { deliveries, subscriptions };
+}
+function watchresource(input) {
+  if (input.clientid.trim() === "") return { reason: "The resource watcher needs the paired client it belongs to." };
+  if (input.resource.trim() === "") return { reason: "The resource watcher needs the page state resource it watches." };
+  return { watch: { id: input.id ?? randomid(), clientid: input.clientid, resource: input.resource, baseline: input.state ?? {}, createdat: input.now } };
+}
+function unwatchresource(watches, id, now) {
+  return watches.map((watch) => watch.id === id && watch.canceledat === void 0 ? { ...watch, canceledat: now } : watch);
+}
+function notifyresource(input) {
+  const deliveries = [];
+  const watches = input.watches.map((watch) => {
+    if (watch.canceledat !== void 0 || watch.resource !== input.resource) return watch;
+    const delta = {};
+    for (const [key, value] of Object.entries(input.state)) {
+      if (!(key in watch.baseline) || watch.baseline[key] !== value) delta[key] = value;
+    }
+    if (Object.keys(delta).length === 0) return watch;
+    deliveries.push({ watchid: watch.id, clientid: watch.clientid, delta });
+    return { ...watch, baseline: { ...input.state }, lastdeliveredat: input.now };
+  });
+  return { deliveries, watches };
+}
+function requestsampling(input) {
+  if (input.clientid.trim() === "") return { reason: "The sampling callback needs the paired client it addresses." };
+  if (input.prompt.trim() === "") return { reason: "The sampling callback needs its prompt." };
+  if (input.capabilities?.sampling === false) return { reason: "The client declared no sampling capability and the callback is refused." };
+  if (input.maxtokens !== void 0 && (!Number.isFinite(input.maxtokens) || input.maxtokens <= 0)) return { reason: "The granted maximum tokens of a sampling callback must stay a positive user value." };
+  const granted = input.pagegrant === true;
+  const pagecontent = granted ? input.pagecontent : void 0;
+  const prompt = granted || input.pagecontent === void 0 ? input.prompt : `${input.prompt}
+The page content stays stripped because the user granted none.`;
+  return { request: { id: input.id ?? randomid(), clientid: input.clientid, prompt, ...input.system !== void 0 ? { system: input.system } : {}, ...pagecontent !== void 0 ? { pagecontent } : {}, ...input.maxtokens !== void 0 ? { maxtokens: input.maxtokens } : {}, state: "pending", requestedat: input.now } };
+}
+function answersampling(input) {
+  const match = input.requests.find((request2) => request2.id === input.id);
+  if (match === void 0) return { requests: input.requests, reason: "The sampling answer names no stored request." };
+  if (match.state !== "pending") return { requests: input.requests, reason: "The sampling request already closed its round trip." };
+  const request = { ...match, state: input.refused === true ? "refused" : "answered", answeredat: input.now, ...input.refused !== true && input.answer !== void 0 ? { answer: input.answer } : {} };
+  return { requests: input.requests.map((candidate) => candidate.id === input.id ? request : candidate), request };
+}
+function listprompts() {
+  return [
+    { name: "runreview", description: "Renders the run review prompt that asks the user model to summarize the executed steps of the approved plan behind the consent gates.", arguments: [{ name: "objective", description: "The objective of the approved plan under review.", required: true }, { name: "steps", description: "The executed step summaries the review covers.", required: true }, { name: "tone", description: "The tone of the summary.", default: "plain" }], template: "Review the run of the objective {{objective}}. Summarize the executed steps: {{steps}}. Keep the tone {{tone}} and state every refusal the consent gates raised." },
+    { name: "pagesummary", description: "Renders the page summary prompt that condenses the observed page state of the session tab into the summary the client model asked for.", arguments: [{ name: "url", description: "The url of the observed page.", required: true }, { name: "observations", description: "The observed page state sections the summary condenses.", required: true }], template: "Summarize the page at {{url}} from the observations: {{observations}}. Name nothing the observations leave out." },
+    { name: "failuretriage", description: "Renders the failure triage prompt that classifies a failed tool call through the retry hints of the structured error it produced.", arguments: [{ name: "tool", description: "The namespaced tool that failed.", required: true }, { name: "error", description: "The structured error of the failed call.", required: true }], template: "Triage the failure of the {{tool}} tool: {{error}}. Classify it as retryable, a busy window or a consent refusal and propose the next reviewed step." }
+  ];
+}
+function renderprompt(prompt, args) {
+  return prompt.template.replace(/\{\{\s*([a-z0-9]+)\s*\}\}/g, (whole, name) => {
+    const value = args[name];
+    if (value === void 0 || value === null) return whole;
+    return typeof value === "string" ? value : JSON.stringify(value);
+  });
+}
+function callprompt(input) {
+  const prompt = listprompts().find((candidate) => candidate.name === input.name);
+  if (prompt === void 0) return { reason: `The server exposes no prompt named ${input.name}.` };
+  const args = input.args ?? {};
+  const findings = [];
+  const resolved = {};
+  for (const argument of prompt.arguments) {
+    const value = args[argument.name];
+    if (value === void 0 || value === null || typeof value === "string" && value.trim() === "") {
+      if (argument.default !== void 0) resolved[argument.name] = argument.default;
+      else if (argument.required === true) findings.push(`The prompt argument ${argument.name} is required and stays empty.`);
+      else resolved[argument.name] = "";
+    } else {
+      resolved[argument.name] = value;
+    }
+  }
+  if (findings.length > 0) return { reason: findings.join(" ") };
+  return { rendered: renderprompt(prompt, resolved), toolcall: { name: `prompts.${prompt.name}`, params: { prompt: prompt.name, arguments: resolved, rendered: renderprompt(prompt, resolved) } } };
+}
+function streamchunkof(input) {
+  return { callid: input.callid, seq: input.seq, content: input.content, done: input.done === true, at: input.now };
+}
+function chunkcontent(input) {
+  const size = input.size !== void 0 && Number.isFinite(input.size) && input.size > 0 ? Math.floor(input.size) : 80;
+  const parts = [];
+  for (let index = 0; index < input.content.length; index += size) parts.push(input.content.slice(index, index + size));
+  const slices = parts.length > 0 ? parts : [""];
+  return slices.map((content, index) => streamchunkof({ callid: input.callid, seq: index + 1, content, done: index === slices.length - 1, now: input.now + index }));
+}
+function notifyprogress(input) {
+  return { callid: input.callid, ...input.percent !== void 0 ? { percent: input.percent } : {}, message: input.message, cancellable: input.cancellable !== false, at: input.now };
+}
+function canceltool(input) {
+  const match = input.contexts.find((context2) => context2.callid === input.callid);
+  if (match === void 0) return { contexts: input.contexts, reason: `The cancellation frame names no call context ${input.callid}.` };
+  if (match.state !== "inflight") return { contexts: input.contexts, reason: `The call ${input.callid} already left the in flight state.` };
+  const context = { ...match, state: "cancelled", endedat: input.now, ...input.partial !== void 0 ? { partial: input.partial } : {} };
+  return { contexts: input.contexts.map((candidate) => candidate.callid === input.callid ? context : candidate), context };
+}
+
+// mcpserver.ts
+var localhostbind = "127.0.0.1";
+var defaultmcpport = 7436;
+function rpcerrorof(code, message, data) {
+  return { code, message, ...data !== void 0 ? { data } : {} };
+}
+function defaultmcpconfig() {
+  return { port: defaultmcpport, transports: ["stdio", "http"], enabled: false };
+}
+function unwraphttppost(value) {
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    const candidate = value;
+    if (candidate.transport === "http" && candidate.frame && typeof candidate.frame === "object" && !Array.isArray(candidate.frame)) return candidate.frame;
+  }
+  return value;
+}
+function parseframe(raw) {
+  const parsed = unwraphttppost(JSON.parse(raw));
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("A json rpc frame must be an object.");
+  return parsed;
+}
+function serializeframe(frame) {
+  return JSON.stringify(frame);
+}
+function validateframe(frame, methods, config) {
+  if (frame.jsonrpc !== "2.0") return rpcerrorof("parse", "The frame must carry the jsonrpc 2.0 tag.");
+  if (frame.id !== void 0 && typeof frame.id !== "number" && typeof frame.id !== "string" && frame.id !== null) return rpcerrorof("parse", "The frame id must be a number, a string or null.");
+  if (frame.method === void 0 || frame.method.trim() === "") return rpcerrorof("method", "The frame carries no method to route.");
+  if (!methods.some((entry) => entry.method === frame.method)) return rpcerrorof("method", `The server routes no method named ${frame.method}.`);
+  if (frame.params !== void 0 && (typeof frame.params !== "object" || Array.isArray(frame.params))) return rpcerrorof("params", "The frame params must be an object.");
+  if (config?.framesize !== void 0 && serializeframe(frame).length > config.framesize) return rpcerrorof("params", `The serialized frame exceeds the user configured frame size of ${config.framesize} characters.`);
+  return void 0;
+}
+function respond(input) {
+  return { jsonrpc: "2.0", ...input.id === void 0 ? input.error !== void 0 ? { id: null } : {} : { id: input.id }, ...input.error !== void 0 ? { error: input.error } : { result: input.result } };
+}
+function servermethods() {
+  return [
+    { method: "initialize", handler: "initialize", description: "Completes the mcp handshake and returns the server info." },
+    { method: "ping", handler: "ping", description: "Answers keepalive frames with pong." },
+    { method: "tools/list", handler: "listtools", description: "Returns every tool with its version and json schema inputs." },
+    { method: "negotiate", handler: "negotiate", description: "Exchanges capability sets with the client." },
+    { method: "tools/call", handler: "dispatch", description: "Invokes one tool behind the consent gates." },
+    { method: "prompts/list", handler: "listprompts", description: "Lists the prompt defs the server exposes as callable tools." },
+    { method: "prompts/call", handler: "callprompt", description: "Renders one prompt and returns its arguments as a tool call." },
+    { method: "calls/cancel", handler: "cancel", description: "Aborts one in flight tool call and preserves its partial result." }
+  ];
+}
+function servercapabilities(input) {
+  return { protocolversion, name: "devthink", version: protocolversion, toolversion: input.catalog.version, tools: alltools(input.catalog).length, namespaces: toolnamespaces, transports: input.config.transports };
+}
+function initialize(input) {
+  void input.params;
+  return { serverinfo: servercapabilities({ config: input.config, catalog: input.catalog }), protocolversion, instructions: "Devthink serves browser tools behind the human review gates: read only tools run once a session is approved while every tool with side effects executes exactly the approved plan step it names. No endpoint, provider or key is hardcoded; the user pairs every client." };
+}
+function ping(input) {
+  return { pong: true, at: input.now };
+}
+function listtools(catalog) {
+  return { tools: alltools(catalog).map((tool) => ({ name: tool.name, version: tool.version, description: tool.description, inputschema: tool.inputschema, risk: tool.risk, ...tool.consentmeta !== void 0 ? { consentmeta: { review: tool.consentmeta.review, riskclass: tool.consentmeta.riskclass ?? tool.risk, approvalrequired: tool.consentmeta.approvalrequired ?? true, originscope: tool.consentmeta.originscope ?? "session" } } : {} })) };
+}
+function negotiate(input) {
+  const client = input.client;
+  if (client?.protocolversion !== void 0 && client.protocolversion !== input.server.protocolversion) return { agreed: false, mismatch: `The client speaks protocol version ${String(client.protocolversion)} while the server offers ${input.server.protocolversion}.` };
+  if (client?.toolversion !== void 0 && client.toolversion > input.server.toolversion) return { agreed: false, mismatch: `The client requires tool version ${String(client.toolversion)} while the server offers ${String(input.server.toolversion)}.` };
+  if (client?.transports !== void 0 && client.transports.some((transport) => !input.server.transports.includes(transport))) return { agreed: false, mismatch: "The client requires a transport the server configuration does not allow." };
+  return { agreed: true, capabilities: input.server };
+}
+function connectclient(input) {
+  return { id: input.id ?? `client-${input.now}`, transport: input.transport, paired: false, connectedat: input.now };
+}
+function disconnectclient(clients, id, now) {
+  return clients.map((client) => client.id === id && client.disconnectedat === void 0 ? { ...client, disconnectedat: now } : client);
+}
+function negotiatetoolfloor(clientfloor, catalogversion) {
+  if (clientfloor === void 0) return { floor: catalogversion };
+  if (clientfloor > catalogversion) return { mismatch: `The client requires the tool version floor ${clientfloor} while the catalog serves version ${catalogversion}.` };
+  return { floor: clientfloor };
+}
+async function dispatchtool(input) {
+  const params = input.params;
+  if (!params || typeof params !== "object" || Array.isArray(params)) return { error: rpcerrorof("params", "The tool call needs its params object.") };
+  if (typeof params.name !== "string" || !params.name.trim()) return { error: rpcerrorof("params", "The tool call needs the namespaced name of the tool it invokes.") };
+  const tool = resolvetool(input.catalog, params.name.trim());
+  if (tool === void 0) return { error: rpcerrorof("params", `The catalog holds no unambiguous tool named ${params.name.trim()}.`) };
+  const namespace = namespaceof(tool.name);
+  if (namespace === void 0) return { error: rpcerrorof("params", `The tool ${tool.name} carries no reviewed namespace.`) };
+  if (input.scopes !== void 0 && !input.scopes.includes(namespace)) return { error: rpcerrorof("consentrefused", `The session token grants no ${namespace} tools.`) };
+  const floor = input.client.toolfloor ?? input.client.capabilities?.toolversion ?? input.catalog.version;
+  if (tool.version < floor) return { error: rpcerrorof("params", `The tool ${tool.name} of version ${tool.version} stays below the negotiated compatibility floor of ${floor}.`) };
+  const stepid = typeof params.stepid === "string" ? params.stepid : void 0;
+  const gate = tooldispatchgate({ client: input.client, tool, session: input.session, plan: input.plan, origin: input.origin, ...stepid !== void 0 ? { stepid } : {}, now: input.now });
+  if (!gate.allowed) return { error: rpcerrorof("consentrefused", gate.reason ?? "The consent gates refused the tool call.") };
+  const step = tool.risk === "read" ? { id: `mcp-${input.client.id}-${input.now}`, kind: tool.kind, summary: tool.description.split(".")[0] ?? tool.description, risk: "read", ...typeof params.target === "string" ? { target: params.target } : {}, ...typeof params.value === "string" ? { value: params.value } : {}, ...params.options !== void 0 && typeof params.options === "object" && !Array.isArray(params.options) ? { options: JSON.stringify(params.options) } : {} } : input.plan?.steps.find((candidate) => candidate.id === stepid);
+  if (step === void 0) return { error: rpcerrorof("consentrefused", "The tool call names a step the approved plan does not carry.") };
+  try {
+    const result = await input.execute(step);
+    return { result, step };
+  } catch (error) {
+    return { error: rpcerrorof("internal", error instanceof Error ? error.message : String(error)) };
+  }
+}
+async function handleframe(input) {
+  if (input.raw !== void 0 && input.config.framesize !== void 0 && input.raw.length > input.config.framesize) return respond({ id: null, error: rpcerrorof("params", `The wire frame exceeds the user configured frame size of ${input.config.framesize} characters.`) });
+  let frame;
+  if (input.raw !== void 0) {
+    try {
+      frame = parseframe(input.raw);
+    } catch {
+      return respond({ id: null, error: rpcerrorof("parse", "The wire frame does not parse as json.") });
+    }
+  } else if (input.frame !== void 0) {
+    frame = input.frame;
+  } else {
+    return respond({ id: null, error: rpcerrorof("parse", "The server received no frame to route.") });
+  }
+  const invalid = validateframe(frame, servermethods(), input.config);
+  if (invalid !== void 0) return respond({ ...frame.id !== void 0 ? { id: frame.id } : {}, error: invalid });
+  const entry = servermethods().find((candidate) => candidate.method === frame.method);
+  if (entry === void 0) return respond({ ...frame.id !== void 0 ? { id: frame.id } : {}, error: rpcerrorof("method", `The server routes no method named ${String(frame.method)}.`) });
+  const params = frame.params;
+  if (entry.handler === "initialize") return respond({ ...frame.id !== void 0 ? { id: frame.id } : {}, result: initialize({ ...params !== void 0 ? { params } : {}, config: input.config, catalog: input.catalog }) });
+  if (entry.handler === "ping") return respond({ ...frame.id !== void 0 ? { id: frame.id } : {}, result: ping({ now: input.now }) });
+  if (entry.handler === "listtools") return respond({ ...frame.id !== void 0 ? { id: frame.id } : {}, result: listtools(input.catalog) });
+  if (entry.handler === "negotiate") {
+    const server = servercapabilities({ config: input.config, catalog: input.catalog });
+    const clientcaps = params?.capabilities && typeof params.capabilities === "object" && !Array.isArray(params.capabilities) ? params.capabilities : void 0;
+    const outcome = negotiate({ ...clientcaps !== void 0 ? { client: clientcaps } : {}, server });
+    return respond({ ...frame.id !== void 0 ? { id: frame.id } : {}, ...outcome.agreed ? { result: outcome.capabilities } : { error: rpcerrorof("params", outcome.mismatch ?? "The capability negotiation did not agree.") } });
+  }
+  if (entry.handler === "listprompts") return respond({ ...frame.id !== void 0 ? { id: frame.id } : {}, result: { prompts: listprompts() } });
+  if (entry.handler === "callprompt") {
+    const name = typeof params?.name === "string" ? params.name : "";
+    const args = params?.arguments && typeof params.arguments === "object" && !Array.isArray(params.arguments) ? params.arguments : void 0;
+    const called = name === "" ? { reason: "The prompt call needs the prompt name." } : callprompt({ name, ...args !== void 0 ? { args } : {} });
+    if (called.toolcall === void 0) return respond({ ...frame.id !== void 0 ? { id: frame.id } : {}, error: rpcerrorof("params", called.reason ?? "The prompt call did not render.") });
+    return respond({ ...frame.id !== void 0 ? { id: frame.id } : {}, result: { toolcall: called.toolcall, rendered: called.rendered } });
+  }
+  if (entry.handler === "cancel") {
+    const callid = typeof params?.callid === "string" ? params.callid : "";
+    const reason = typeof params?.reason === "string" ? params.reason : void 0;
+    if (callid.trim() === "") return respond({ ...frame.id !== void 0 ? { id: frame.id } : {}, error: rpcerrorof("params", "The cancellation frame needs the call id it aborts.") });
+    const aborted = canceltool({ contexts: input.contexts ?? [], callid, ...reason !== void 0 ? { reason } : {}, now: input.now });
+    if (aborted.context === void 0) return respond({ ...frame.id !== void 0 ? { id: frame.id } : {}, error: rpcerrorof("params", aborted.reason ?? "The cancellation frame named no in flight tool call.") });
+    return respond({ ...frame.id !== void 0 ? { id: frame.id } : {}, result: { cancelled: true, callid, ...reason !== void 0 ? { reason } : {}, ...aborted.context.partial !== void 0 ? { partial: aborted.context.partial } : {} } });
+  }
+  const dispatched = await dispatchtool({ ...params !== void 0 ? { params } : {}, client: input.client, catalog: input.catalog, ...input.session !== void 0 ? { session: input.session } : {}, ...input.plan !== void 0 ? { plan: input.plan } : {}, ...input.scopes !== void 0 ? { scopes: input.scopes } : {}, origin: input.origin, now: input.now, execute: input.execute });
+  return respond({ ...frame.id !== void 0 ? { id: frame.id } : {}, ...dispatched.error !== void 0 ? { error: dispatched.error } : { result: dispatched.result } });
+}
+function bindlocalhost(config) {
+  const bind = config.bind !== void 0 && config.bind.trim() !== "" ? config.bind.trim() : localhostbind;
+  return { bind, port: config.port, localhost: bind === localhostbind || bind === "localhost" || bind === "::1" };
+}
+function launchbridge(input) {
+  return { id: input.id ?? `bridge-${input.now}`, host: input.host, connected: true, ...input.pid !== void 0 ? { pid: input.pid } : {}, startedat: input.now, restarts: 0, received: 0, sent: 0 };
+}
+function relayframe(input) {
+  return { ...input.bridge, connected: true, received: input.bridge.received + (input.direction === "inbound" ? 1 : 0), sent: input.bridge.sent + (input.direction === "outbound" ? 1 : 0), lastframeat: input.now };
+}
+function toolcallevent(input) {
+  return { id: input.id, clientid: input.clientid, tool: input.tool, origin: input.origin, ok: input.ok, ...input.code !== void 0 ? { code: input.code } : {}, at: input.now, ...input.callid !== void 0 ? { callid: input.callid } : {}, ...input.idempotencykey !== void 0 && input.idempotencykey.trim() !== "" ? { idempotencykey: input.idempotencykey } : {}, ...input.dryrun === true ? { dryrun: true } : {}, ...input.mocked === true ? { mocked: true } : {}, ...input.batchid !== void 0 ? { batchid: input.batchid } : {}, ...input.replayed === true ? { replayed: true } : {} };
+}
+
+// httpstream.ts
+var defaultheartbeatms = 3e4;
+var defaultidlewindowms = 9e4;
+function defaulthttpstream() {
+  return { endpoint: "/mcp", streampath: "/mcp/stream", tls: { mode: "off" }, heartbeatms: defaultheartbeatms, idlewindowms: defaultidlewindowms };
+}
+function openstreamchannel(input) {
+  return { id: input.id ?? `channel-${randomchannelid()}`, clientid: input.clientid, openedat: input.now, lastbeatat: input.now };
+}
+function randomchannelid() {
+  return crypto.randomUUID();
+}
+function heartbeat(input) {
+  return input.channels.map((channel) => channel.clientid === input.clientid && channel.closedat === void 0 ? { ...channel, lastbeatat: input.now } : channel);
+}
+function channellive(channel, now, idlewindow) {
+  if (channel.closedat !== void 0) return false;
+  return now - channel.lastbeatat < (idlewindow ?? defaultidlewindowms);
+}
+function closeidlechannels(input) {
+  return input.channels.map((channel) => channel.closedat === void 0 && !channellive(channel, input.now, input.idlewindow) ? { ...channel, closedat: input.now } : channel);
+}
+function starttls(input) {
+  if (input.config.mode === "off") return { tls: false, verified: false };
+  if (input.config.mode === "required" && input.presented?.fingerprint === void 0) return { tls: false, verified: false, reason: "The remote transport requires tls and the peer presented no certificate." };
+  if (input.config.certificatefingerprint !== void 0 && input.presented?.fingerprint !== input.config.certificatefingerprint) return { tls: false, verified: false, reason: "The peer certificate does not match the user configured fingerprint and the remote traffic is refused." };
+  return { tls: true, verified: true };
+}
+function enforcemaxclients(input) {
+  if (input.maxclients === void 0) return { allowed: true };
+  const connected = input.clients.filter((client) => client.disconnectedat === void 0).length;
+  if (connected >= input.maxclients) return { allowed: false, reason: `The user configured maximum of ${input.maxclients} remote clients is reached and the connection is refused.` };
+  return { allowed: true };
+}
+function listremotestatus(input) {
+  const stream = input.config.httpstream ?? defaulthttpstream();
+  const remote = input.config.remoteaccess;
+  const idlewindow = stream.idlewindowms;
+  const open = input.channels.filter((channel) => channellive(channel, input.now, idlewindow));
+  return { endpoint: remote?.endpoint ?? stream.endpoint, tls: tlsstateof(remote?.tls ?? stream.tls), clients: input.clients.filter((client) => client.disconnectedat === void 0).length, paired: input.clients.filter((client) => client.paired && client.disconnectedat === void 0).length, channelsopen: open.length, channelsdead: input.channels.length - open.length, tokenslive: input.tokens.filter((token) => token.revokedat === void 0 && input.now < token.expiresat).length };
+}
+async function httpframepipeline(input) {
+  const stream = input.config.httpstream ?? defaulthttpstream();
+  const tls = starttls({ config: input.config.remoteaccess?.tls ?? stream.tls, ...input.presented !== void 0 ? { presented: input.presented } : {}, now: input.now });
+  if (tls.reason !== void 0) return { error: rpcerrorof("consentrefused", tls.reason) };
+  if (input.rawtoken === void 0) return { error: rpcerrorof("consentrefused", authrefusedmessage) };
+  const verified = await verifytoken({ tokens: input.tokens, raw: input.rawtoken, now: input.now });
+  if (verified.token === void 0) return { error: rpcerrorof("consentrefused", verified.reason ?? authrefusedmessage) };
+  const namespace = input.toolname !== void 0 ? namespaceof(input.toolname) : void 0;
+  const listed = checkallowlist({ entries: input.allowlist, fingerprint: input.fingerprint, ...namespace !== void 0 ? { namespace } : {} });
+  if (!listed.allowed) return { error: rpcerrorof("consentrefused", listed.reason ?? "The allowlist refused the client.") };
+  const scoped = scopecheck(verified.token, namespace);
+  if (!scoped.allowed) return { error: rpcerrorof(scoped.fast === true ? "params" : "consentrefused", scoped.reason ?? "The tool call stayed outside the granted scopes.") };
+  return { token: verified.token };
+}
+
+// approvalgate.ts
+var defaultapprovalwindowms = 12e4;
+function requireapproval(input) {
+  return { id: input.id ?? randomid(), clientid: input.clientid, tool: input.tool, reason: input.reason, params: input.params, ...input.secretfields !== void 0 && input.secretfields.length > 0 ? { secretfields: input.secretfields } : {}, state: "pending", raisedat: input.now, ...input.timeout !== void 0 ? { timeoutat: input.now + input.timeout } : {} };
+}
+function resolveapproval(input) {
+  const gate = input.requests.find((request) => request.id === input.id);
+  if (gate === void 0 || gate.state !== "pending") return { requests: input.requests };
+  const decision = input.decision;
+  const requests = input.requests.map((request) => request.id === input.id ? { ...request, state: decision, decidedat: input.now, actor: input.actor } : request);
+  return { requests, exec: { requestid: input.id, decision, actor: input.actor, at: input.now, latencyms: input.now - gate.raisedat } };
+}
+function expireapprovals(requests, now) {
+  return requests.map((request) => request.state === "pending" && request.timeoutat !== void 0 && now >= request.timeoutat ? { ...request, state: "expired" } : request);
+}
+
 // protocol.ts
 function record(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Protocol message must be an object.");
@@ -10072,140 +10747,88 @@ function yamlscalarvalue(text2) {
   return text2;
 }
 
-// mcpserver.ts
-var localhostbind = "127.0.0.1";
-var defaultmcpport = 7436;
-function rpcerrorof(code, message, data) {
-  return { code, message, ...data !== void 0 ? { data } : {} };
-}
-function defaultmcpconfig() {
-  return { port: defaultmcpport, transports: ["stdio", "http"], enabled: false };
-}
-function unwraphttppost(value) {
-  if (value && typeof value === "object" && !Array.isArray(value)) {
-    const candidate = value;
-    if (candidate.transport === "http" && candidate.frame && typeof candidate.frame === "object" && !Array.isArray(candidate.frame)) return candidate.frame;
-  }
-  return value;
-}
-function parseframe(raw) {
-  const parsed = unwraphttppost(JSON.parse(raw));
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("A json rpc frame must be an object.");
-  return parsed;
-}
-function serializeframe(frame) {
-  return JSON.stringify(frame);
-}
-function validateframe(frame, methods, config) {
-  if (frame.jsonrpc !== "2.0") return rpcerrorof("parse", "The frame must carry the jsonrpc 2.0 tag.");
-  if (frame.id !== void 0 && typeof frame.id !== "number" && typeof frame.id !== "string" && frame.id !== null) return rpcerrorof("parse", "The frame id must be a number, a string or null.");
-  if (frame.method === void 0 || frame.method.trim() === "") return rpcerrorof("method", "The frame carries no method to route.");
-  if (!methods.some((entry) => entry.method === frame.method)) return rpcerrorof("method", `The server routes no method named ${frame.method}.`);
-  if (frame.params !== void 0 && (typeof frame.params !== "object" || Array.isArray(frame.params))) return rpcerrorof("params", "The frame params must be an object.");
-  if (config?.framesize !== void 0 && serializeframe(frame).length > config.framesize) return rpcerrorof("params", `The serialized frame exceeds the user configured frame size of ${config.framesize} characters.`);
-  return void 0;
-}
-function respond(input) {
-  return { jsonrpc: "2.0", ...input.id === void 0 ? input.error !== void 0 ? { id: null } : {} : { id: input.id }, ...input.error !== void 0 ? { error: input.error } : { result: input.result } };
-}
-function servermethods() {
-  return [
-    { method: "initialize", handler: "initialize", description: "Completes the mcp handshake and returns the server info." },
-    { method: "ping", handler: "ping", description: "Answers keepalive frames with pong." },
-    { method: "tools/list", handler: "listtools", description: "Returns every tool with its version and json schema inputs." },
-    { method: "negotiate", handler: "negotiate", description: "Exchanges capability sets with the client." },
-    { method: "tools/call", handler: "dispatch", description: "Invokes one tool behind the consent gates." }
-  ];
-}
-function servercapabilities(input) {
-  return { protocolversion, name: "devthink", version: protocolversion, toolversion: input.catalog.version, tools: alltools(input.catalog).length, namespaces: toolnamespaces, transports: input.config.transports };
-}
-function initialize(input) {
-  void input.params;
-  return { serverinfo: servercapabilities({ config: input.config, catalog: input.catalog }), protocolversion, instructions: "Devthink serves browser tools behind the human review gates: read only tools run once a session is approved while every tool with side effects executes exactly the approved plan step it names. No endpoint, provider or key is hardcoded; the user pairs every client." };
-}
-function ping(input) {
-  return { pong: true, at: input.now };
-}
-function listtools(catalog) {
-  return { tools: alltools(catalog).map((tool) => ({ name: tool.name, version: tool.version, description: tool.description, inputschema: tool.inputschema, risk: tool.risk, ...tool.consentmeta !== void 0 ? { consentmeta: tool.consentmeta.review } : {} })) };
-}
-function negotiate(input) {
-  const client = input.client;
-  if (client?.protocolversion !== void 0 && client.protocolversion !== input.server.protocolversion) return { agreed: false, mismatch: `The client speaks protocol version ${String(client.protocolversion)} while the server offers ${input.server.protocolversion}.` };
-  if (client?.toolversion !== void 0 && client.toolversion > input.server.toolversion) return { agreed: false, mismatch: `The client requires tool version ${String(client.toolversion)} while the server offers ${String(input.server.toolversion)}.` };
-  if (client?.transports !== void 0 && client.transports.some((transport) => !input.server.transports.includes(transport))) return { agreed: false, mismatch: "The client requires a transport the server configuration does not allow." };
-  return { agreed: true, capabilities: input.server };
-}
-function connectclient(input) {
-  return { id: input.id ?? `client-${input.now}`, transport: input.transport, paired: false, connectedat: input.now };
-}
-function disconnectclient(clients, id, now) {
-  return clients.map((client) => client.id === id && client.disconnectedat === void 0 ? { ...client, disconnectedat: now } : client);
-}
-async function dispatchtool(input) {
-  const params = input.params;
-  if (!params || typeof params !== "object" || Array.isArray(params)) return { error: rpcerrorof("params", "The tool call needs its params object.") };
-  if (typeof params.name !== "string" || !params.name.trim()) return { error: rpcerrorof("params", "The tool call needs the namespaced name of the tool it invokes.") };
-  const tool = resolvetool(input.catalog, params.name.trim());
-  if (tool === void 0) return { error: rpcerrorof("params", `The catalog holds no unambiguous tool named ${params.name.trim()}.`) };
-  const floor = input.client.capabilities?.toolversion ?? input.catalog.version;
-  if (tool.version < floor) return { error: rpcerrorof("params", `The tool ${tool.name} of version ${tool.version} stays below the negotiated compatibility floor of ${floor}.`) };
-  const stepid = typeof params.stepid === "string" ? params.stepid : void 0;
-  const gate = tooldispatchgate({ client: input.client, tool, session: input.session, plan: input.plan, origin: input.origin, ...stepid !== void 0 ? { stepid } : {}, now: input.now });
-  if (!gate.allowed) return { error: rpcerrorof("consentrefused", gate.reason ?? "The consent gates refused the tool call.") };
-  const step = tool.risk === "read" ? { id: `mcp-${input.client.id}-${input.now}`, kind: tool.kind, summary: tool.description.split(".")[0] ?? tool.description, risk: "read", ...typeof params.target === "string" ? { target: params.target } : {}, ...typeof params.value === "string" ? { value: params.value } : {}, ...params.options !== void 0 && typeof params.options === "object" && !Array.isArray(params.options) ? { options: JSON.stringify(params.options) } : {} } : input.plan?.steps.find((candidate) => candidate.id === stepid);
-  if (step === void 0) return { error: rpcerrorof("consentrefused", "The tool call names a step the approved plan does not carry.") };
-  try {
-    const result = await input.execute(step);
-    return { result, step };
-  } catch (error) {
-    return { error: rpcerrorof("internal", error instanceof Error ? error.message : String(error)) };
-  }
-}
-async function handleframe(input) {
-  if (input.raw !== void 0 && input.config.framesize !== void 0 && input.raw.length > input.config.framesize) return respond({ id: null, error: rpcerrorof("params", `The wire frame exceeds the user configured frame size of ${input.config.framesize} characters.`) });
-  let frame;
-  if (input.raw !== void 0) {
-    try {
-      frame = parseframe(input.raw);
-    } catch {
-      return respond({ id: null, error: rpcerrorof("parse", "The wire frame does not parse as json.") });
-    }
-  } else if (input.frame !== void 0) {
-    frame = input.frame;
-  } else {
-    return respond({ id: null, error: rpcerrorof("parse", "The server received no frame to route.") });
-  }
-  const invalid = validateframe(frame, servermethods(), input.config);
-  if (invalid !== void 0) return respond({ ...frame.id !== void 0 ? { id: frame.id } : {}, error: invalid });
-  const entry = servermethods().find((candidate) => candidate.method === frame.method);
-  if (entry === void 0) return respond({ ...frame.id !== void 0 ? { id: frame.id } : {}, error: rpcerrorof("method", `The server routes no method named ${String(frame.method)}.`) });
-  const params = frame.params;
-  if (entry.handler === "initialize") return respond({ ...frame.id !== void 0 ? { id: frame.id } : {}, result: initialize({ ...params !== void 0 ? { params } : {}, config: input.config, catalog: input.catalog }) });
-  if (entry.handler === "ping") return respond({ ...frame.id !== void 0 ? { id: frame.id } : {}, result: ping({ now: input.now }) });
-  if (entry.handler === "listtools") return respond({ ...frame.id !== void 0 ? { id: frame.id } : {}, result: listtools(input.catalog) });
-  if (entry.handler === "negotiate") {
-    const server = servercapabilities({ config: input.config, catalog: input.catalog });
-    const clientcaps = params?.capabilities && typeof params.capabilities === "object" && !Array.isArray(params.capabilities) ? params.capabilities : void 0;
-    const outcome = negotiate({ ...clientcaps !== void 0 ? { client: clientcaps } : {}, server });
-    return respond({ ...frame.id !== void 0 ? { id: frame.id } : {}, ...outcome.agreed ? { result: outcome.capabilities } : { error: rpcerrorof("params", outcome.mismatch ?? "The capability negotiation did not agree.") } });
-  }
-  const dispatched = await dispatchtool({ ...params !== void 0 ? { params } : {}, client: input.client, catalog: input.catalog, ...input.session !== void 0 ? { session: input.session } : {}, ...input.plan !== void 0 ? { plan: input.plan } : {}, origin: input.origin, now: input.now, execute: input.execute });
-  return respond({ ...frame.id !== void 0 ? { id: frame.id } : {}, ...dispatched.error !== void 0 ? { error: dispatched.error } : { result: dispatched.result } });
-}
-function bindlocalhost(config) {
-  const bind = config.bind !== void 0 && config.bind.trim() !== "" ? config.bind.trim() : localhostbind;
-  return { bind, port: config.port, localhost: bind === localhostbind || bind === "localhost" || bind === "::1" };
-}
-function launchbridge(input) {
-  return { id: input.id ?? `bridge-${input.now}`, host: input.host, connected: true, ...input.pid !== void 0 ? { pid: input.pid } : {}, startedat: input.now, restarts: 0, received: 0, sent: 0 };
-}
-function relayframe(input) {
-  return { ...input.bridge, connected: true, received: input.bridge.received + (input.direction === "inbound" ? 1 : 0), sent: input.bridge.sent + (input.direction === "outbound" ? 1 : 0), lastframeat: input.now };
-}
-function toolcallevent(input) {
-  return { id: input.id, clientid: input.clientid, tool: input.tool, origin: input.origin, ok: input.ok, ...input.code !== void 0 ? { code: input.code } : {}, at: input.now };
+// toolcalls.ts
+var defaultidempotencywindowms = 3e5;
+function applyratelimit(input) {
+  const existing = input.limits.find((limit2) => limit2.clientid === input.clientid);
+  if (existing === void 0) return { allowed: true, used: 0, limits: input.limits };
+  const elapsed = input.now - existing.windowstartedat;
+  const limit = elapsed >= existing.windowms ? { ...existing, windowstartedat: input.now, used: 0 } : existing;
+  if (limit.budget !== void 0 && limit.used >= limit.budget) {
+    const retryafter = Math.max(0, limit.windowms - (input.now - limit.windowstartedat));
+    return { allowed: false, used: limit.used, budget: limit.budget, retryafter, limits: input.limits.map((candidate) => candidate.clientid === input.clientid ? limit : candidate) };
+  }
+  const counted = { ...limit, used: limit.used + 1 };
+  return { allowed: true, used: counted.used, ...counted.budget !== void 0 ? { budget: counted.budget } : {}, limit: counted, limits: input.limits.map((candidate) => candidate.clientid === input.clientid ? counted : candidate) };
+}
+function structurederrorof(input) {
+  return { code: input.code, message: input.message, retryhint: input.retryhint, ...input.retryafter !== void 0 ? { retryafter: input.retryafter } : {} };
+}
+function retryhintof(failure) {
+  const text2 = `${failure.code ?? ""} ${failure.message ?? ""}`.toLowerCase();
+  if (text2.includes("consent") || text2.includes("refus") || text2.includes("unpaired") || text2.includes("unapproved") || text2.includes("grant")) return "none";
+  if (text2.includes("rate") || text2.includes("busy") || text2.includes("queue") || text2.includes("window")) return "wait";
+  if (text2.includes("timeout") || text2.includes("timed out") || text2.includes("internal") || text2.includes("network")) return "retry";
+  return "none";
+}
+function checkidempotency(input) {
+  const match = input.records.find((record2) => record2.key === input.key);
+  if (match === void 0) return { reason: "The idempotency key names no stored record." };
+  if (match.clientid !== input.clientid) return { reason: "The idempotency key belongs to another client and never replays across clients." };
+  if (input.now >= match.expiresat) return { reason: "The idempotency record expired past its window and the call runs again." };
+  return { replay: match.result, record: match };
+}
+function recordidempotency(input) {
+  const record2 = { key: input.key, clientid: input.clientid, tool: input.tool, result: input.result, createdat: input.now, expiresat: input.now + (input.window ?? defaultidempotencywindowms) };
+  return [record2, ...input.records.filter((candidate) => !(candidate.key === input.key && candidate.clientid === input.clientid))];
+}
+function expireidempotency(records, now) {
+  return records.filter((record2) => now < record2.expiresat);
+}
+async function runbatch(input) {
+  const outcomes = [];
+  for (let index = 0; index < input.calls.length; index += 1) {
+    const call = input.calls[index];
+    if (call === void 0) continue;
+    const outcome = await input.execute(call, index);
+    outcomes.push({ callid: call.id, tool: call.name, ok: outcome.ok, ...outcome.result !== void 0 ? { result: outcome.result } : {}, ...outcome.error !== void 0 ? { error: outcome.error } : {}, at: input.now + index });
+    if (!outcome.ok && input.stoponerror) return { outcomes, stoppedat: call.id };
+  }
+  return { outcomes };
+}
+function dryruntool(input) {
+  const findings = [];
+  for (const required of input.tool.inputschema.required) {
+    const value = input.params[required];
+    if (value === void 0 || value === null || typeof value === "string" && value.trim() === "") findings.push(`The required argument ${required} of ${input.tool.name} stays empty.`);
+  }
+  for (const [name, property] of Object.entries(input.tool.inputschema.properties)) {
+    const value = input.params[name];
+    if (value === void 0 || value === null) continue;
+    const expected = property.type;
+    const actual = Array.isArray(value) ? "array" : typeof value;
+    if (actual !== expected) findings.push(`The argument ${name} of ${input.tool.name} carries a ${actual} value where the schema asks a ${expected}.`);
+  }
+  const stepid = input.stepid !== void 0 ? input.stepid : typeof input.params.stepid === "string" ? input.params.stepid : void 0;
+  const gate = tooldispatchgate({ client: input.client, tool: input.tool, session: input.session, plan: input.plan, origin: input.origin, ...stepid !== void 0 ? { stepid } : {}, now: input.now });
+  if (!gate.allowed) findings.push(gate.reason ?? `The consent gates refused the ${input.tool.name} dry run.`);
+  return { callid: input.callid ?? randomid(), tool: input.tool.name, argsvalid: findings.length === 0, consentok: gate.allowed, findings, executed: false, mutations: [], at: input.now };
+}
+function applymock(input) {
+  const mock = input.mocks.find((candidate) => candidate.tool === input.tool);
+  if (mock === void 0) return {};
+  if (mock.testcontext !== true) return { reason: `The ${input.tool} mock stays outside a test context and is refused; mocks never answer real calls.` };
+  return { result: mock.result };
+}
+function begincall(input) {
+  return { callid: input.callid ?? randomid(), clientid: input.clientid, tool: input.tool, state: "inflight", startedat: input.now, ...input.idempotencykey !== void 0 && input.idempotencykey.trim() !== "" ? { idempotencykey: input.idempotencykey } : {}, ...input.dryrun === true ? { dryrun: true } : {}, ...input.batchid !== void 0 ? { batchid: input.batchid } : {}, chunks: 0 };
+}
+function endcall(input) {
+  const match = input.contexts.find((context2) => context2.callid === input.callid);
+  if (match === void 0) return { contexts: input.contexts, reason: `The call context ${input.callid} never opened.` };
+  if (match.state !== "inflight") return { contexts: input.contexts, context: match };
+  const context = { ...match, state: input.ok ? "done" : "failed", endedat: input.now, ...input.errorcode !== void 0 ? { errorcode: input.errorcode } : {}, ...input.partial !== void 0 ? { partial: input.partial } : {} };
+  return { contexts: input.contexts.map((candidate) => candidate.callid === input.callid ? context : candidate), context };
 }
 
 // extension/pagesession.ts
@@ -18272,7 +18895,270 @@ async function handlerequest(message, sender) {
       const inputframe = message;
       if (typeof inputframe.raw !== "string" || inputframe.raw.trim() === "") throw new Error("The mcp frame intake needs the raw wire frame.");
       const transport = inputframe.transport === "http" ? "http" : "stdio";
-      return processmcpframe(inputframe.raw, inputframe.clientid ?? "", transport);
+      return processmcpframe(inputframe.raw, inputframe.clientid ?? "", transport, inputframe.token, inputframe.fingerprint);
+    }
+    case "mcppairing": {
+      const inputpairing = message;
+      const scopes = (Array.isArray(inputpairing.scopes) ? inputpairing.scopes : []).filter((scope) => ["browser", "workflow", "memory", "system"].includes(scope));
+      const code = await issuepairingcodehandler(scopes);
+      return { code: code.code, scopes: code.scopes, issuedat: code.issuedat, expiresat: code.expiresat };
+    }
+    case "mcpchallenge": {
+      const state = await memory.getmcpstate();
+      if (state?.state !== "running") throw new Error("The auth challenge needs the running mcp server.");
+      const now = Date.now();
+      const challenge = issuechallenge({ method: "pairingcode", now });
+      await memory.setmcpstate({ ...state, challenge });
+      await memory.addauthhandshake({ id: randomid(), clientid: "new", method: "pairingcode", outcome: "issued", at: now });
+      await audit("protocol", "The server issued one auth challenge to a new remote client; the handshake verifies the single use nonce before any pairing exchange.", {});
+      return { nonce: challenge.nonce, method: challenge.method, expiresat: challenge.expiresat };
+    }
+    case "mcpexchange": {
+      const inputexchange = message;
+      const state = await memory.getmcpstate();
+      if (state?.state !== "running") throw new Error("The pairing exchange needs the running mcp server.");
+      const now = Date.now();
+      const challenge = state.challenge;
+      const fingerprint = typeof inputexchange.fingerprint === "string" && inputexchange.fingerprint.trim() !== "" ? inputexchange.fingerprint.trim() : "";
+      const refuseexchange = async () => {
+        await memory.addauthhandshake({ id: randomid(), clientid: "new", method: "pairingcode", outcome: "refused", at: now });
+        await audit("protocol", "The pairing exchange failed its auth handshake and was refused; the fixed refusal carries no pairing state.", {});
+        throw new Error("The remote frame failed its authentication handshake.");
+      };
+      if (fingerprint === "" || challenge === void 0 || inputexchange.nonce !== challenge.nonce || now >= challenge.expiresat) await refuseexchange();
+      const redeemed = redeempairingcode({ codes: await memory.getpairingcodes(), code: inputexchange.code ?? "", now });
+      if (redeemed.code === void 0) {
+        await memory.addauthhandshake({ id: randomid(), clientid: "new", method: "pairingcode", outcome: "refused", at: now });
+        await audit("protocol", "The pairing exchange presented a code that does not pair and was refused; a used or expired code never pairs a second client.", {});
+        throw new Error(redeemed.reason ?? "The remote frame failed its authentication handshake.");
+      }
+      await memory.usepairingcode(redeemed.code.code, now);
+      const identity = { fingerprint, displayname: typeof inputexchange.displayname === "string" && inputexchange.displayname.trim() !== "" ? inputexchange.displayname.trim() : `Client ${fingerprint.slice(0, 8)}` };
+      await memory.setclientidentity(identity);
+      await memory.setallowlistentry(grantallowlistentry({ entries: await memory.getallowlist(), identity, namespaces: redeemed.code.scopes, actor: "pairing", now })[0]);
+      const config = await mcpconfigof();
+      const clientid = `client-${now}`;
+      const issued = await issuetoken({ clientid, scopes: redeemed.code.scopes, now, ...config.remoteaccess?.tokenlifetimems !== void 0 ? { lifetime: config.remoteaccess.tokenlifetimems } : { lifetime: defaulttokenlifetimems } });
+      const client = { ...connectclient({ transport: "http", now, id: clientid }), fingerprint, paired: true, pairedat: now };
+      await memory.setclient(client);
+      await memory.setsessiontokens([...await memory.getsessiontokens(), issued.token]);
+      await memory.addauthhandshake({ id: randomid(), clientid, method: "pairingcode", outcome: "verified", at: now });
+      await audit("protocol", `The client ${identity.displayname} (${fingerprint}) exchanged its single use pairing code for a session token of the ${redeemed.code.scopes.join(", ") || "no"} namespace${redeemed.code.scopes.length === 1 ? "" : "s"}; the raw token leaves exactly once and only its digest persists.`, {});
+      return { clientid, token: issued.raw, scopes: issued.token.scopes, expiresat: issued.token.expiresat };
+    }
+    case "mcpremoteconfig": {
+      const inputremote = message;
+      const current = await mcpconfigof();
+      const endpoint = typeof inputremote.endpoint === "string" && inputremote.endpoint.trim() !== "" ? inputremote.endpoint.trim() : current.remoteaccess?.endpoint ?? "https://127.0.0.1:7436";
+      const tlsmode = inputremote.tlsmode === "off" || inputremote.tlsmode === "on" || inputremote.tlsmode === "required" ? inputremote.tlsmode : current.remoteaccess?.tls.mode ?? "off";
+      const certificatefingerprint = typeof inputremote.certificatefingerprint === "string" && inputremote.certificatefingerprint.trim() !== "" ? inputremote.certificatefingerprint.trim() : current.remoteaccess?.tls.certificatefingerprint;
+      const config = {
+        ...current,
+        ...inputremote.reviewed === true || current.remote === true ? { remote: true } : {},
+        httpstream: {
+          endpoint: current.httpstream?.endpoint ?? "/mcp",
+          streampath: typeof inputremote.streampath === "string" && inputremote.streampath.trim() !== "" ? inputremote.streampath.trim() : current.httpstream?.streampath ?? "/mcp/stream",
+          tls: { mode: tlsmode, ...certificatefingerprint !== void 0 ? { certificatefingerprint } : {}, ...current.httpstream?.tls.verifiedat !== void 0 ? { verifiedat: current.httpstream.tls.verifiedat } : {} },
+          ...inputremote.heartbeatms !== void 0 ? { heartbeatms: inputremote.heartbeatms } : current.httpstream?.heartbeatms !== void 0 ? { heartbeatms: current.httpstream.heartbeatms } : {},
+          ...inputremote.idlewindowms !== void 0 ? { idlewindowms: inputremote.idlewindowms } : current.httpstream?.idlewindowms !== void 0 ? { idlewindowms: current.httpstream.idlewindowms } : {}
+        },
+        remoteaccess: {
+          endpoint,
+          tls: { mode: tlsmode, ...certificatefingerprint !== void 0 ? { certificatefingerprint } : {} },
+          ...inputremote.maxclients !== void 0 ? { maxclients: inputremote.maxclients } : current.remoteaccess?.maxclients !== void 0 ? { maxclients: current.remoteaccess.maxclients } : {},
+          ...inputremote.tokenlifetime !== void 0 ? { tokenlifetimems: inputremote.tokenlifetime } : current.remoteaccess?.tokenlifetimems !== void 0 ? { tokenlifetimems: current.remoteaccess.tokenlifetimems } : {},
+          ...inputremote.approvaltimeoutms !== void 0 ? { approvaltimeout: { windowms: inputremote.approvaltimeoutms, ontimeout: "refuse" } } : current.remoteaccess?.approvaltimeout !== void 0 ? { approvaltimeout: current.remoteaccess.approvaltimeout } : {}
+        }
+      };
+      const gate = remoteenablementgate(config);
+      if (!gate.allowed) throw new Error(gate.reason ?? "The remote transport config failed its gate.");
+      const enablement = serverenablementgate(config);
+      if (!enablement.allowed) throw new Error(enablement.reason ?? "The remote transport config failed the enablement gate.");
+      await memory.setmcpconfig(config);
+      await audit("protocol", `The user configured the remote transport for the endpoint ${endpoint} with the ${tlsmode} tls mode${certificatefingerprint !== void 0 ? " and the reviewed certificate fingerprint" : ""}${config.remoteaccess?.maxclients !== void 0 ? `, a client ceiling of ${config.remoteaccess.maxclients}` : " and no client ceiling"}${config.remoteaccess?.tokenlifetimems !== void 0 ? `, a token lifetime of ${config.remoteaccess.tokenlifetimems} milliseconds` : ""}${config.remoteaccess?.approvaltimeout !== void 0 ? ` and an approval window of ${config.remoteaccess.approvaltimeout.windowms} milliseconds` : ""}; every value stays the user choice.`, {});
+      return mcpstateof();
+    }
+    case "mcpallowlist": {
+      const inputallow = message;
+      const fingerprint = typeof inputallow.fingerprint === "string" && inputallow.fingerprint.trim() !== "" ? inputallow.fingerprint.trim() : "";
+      if (fingerprint === "") throw new Error("The allowlist edit needs the client fingerprint.");
+      const now = Date.now();
+      if (inputallow.remove === true) {
+        const entries2 = await memory.getallowlist();
+        const removed = entries2.find((entry) => entry.fingerprint === fingerprint);
+        await memory.removeallowlistentry(fingerprint);
+        await audit("protocol", `The user refused the client ${removed?.displayname ?? fingerprint} its allowlist entry; its fingerprint stops passing the allowlist check.`, {});
+        return mcpstateof();
+      }
+      const namespaces = (Array.isArray(inputallow.namespaces) ? inputallow.namespaces : []).filter((scope) => ["browser", "workflow", "memory", "system"].includes(scope));
+      const identities = await memory.getclientidentities();
+      const known = identities.find((identity2) => identity2.fingerprint === fingerprint);
+      const identity = { fingerprint, displayname: typeof inputallow.displayname === "string" && inputallow.displayname.trim() !== "" ? inputallow.displayname.trim() : known?.displayname ?? `Client ${fingerprint.slice(0, 8)}` };
+      await memory.setclientidentity(identity);
+      const entries = grantallowlistentry({ entries: await memory.getallowlist(), identity, namespaces, actor: "user", now });
+      const granted = entries[0];
+      if (granted === void 0) throw new Error("The allowlist grant failed.");
+      const valid = allowlistentryvalid(granted, await memory.getclientidentities());
+      if (!valid.allowed) throw new Error(valid.reason ?? "The allowlist entry failed its validation.");
+      await memory.setallowlistentry(granted);
+      await audit("protocol", `The user allowed the client ${identity.displayname} (${fingerprint}) the ${namespaces.join(", ") || "no"} namespace${namespaces.length === 1 ? "" : "s"}; the grant history rides the record.`, {});
+      return mcpstateof();
+    }
+    case "mcprevokeclient": {
+      const inputrevoke = message;
+      const clientid = inputrevoke.clientid ?? "";
+      if (clientid === "") throw new Error("The revocation needs the client id.");
+      const gate = revocationgate();
+      if (!gate.allowed) throw new Error(gate.reason ?? "The revocation failed.");
+      const now = Date.now();
+      const tokens = revokeclient(await memory.getsessiontokens(), clientid, now);
+      await memory.setsessiontokens(tokens);
+      const client = (await memory.getclients()).find((entry) => entry.id === clientid);
+      if (client !== void 0 && client.disconnectedat === void 0) await memory.setclient(disconnectclient(await memory.getclients(), clientid, now).find((entry) => entry.id === clientid));
+      const revoked = tokens.filter((token) => token.clientid === clientid && token.revokedat === now).length;
+      await audit("protocol", `The user revoked the paired client ${clientid}; ${revoked} session token${revoked === 1 ? "" : "s"} stopped verifying and every further frame of the client refuses \u2014 the revocation stays available at any time.`, {});
+      return mcpstateof();
+    }
+    case "mcpapprovaldecision": {
+      const inputapproval = message;
+      const approvalid = inputapproval.approvalid ?? "";
+      if (approvalid === "" || typeof inputapproval.approved !== "boolean") throw new Error("The approval decision needs the gate id and the reviewed approved flag.");
+      const now = Date.now();
+      const stored = await memory.listapprovals();
+      const outcome = resolveapproval({ requests: stored, id: approvalid, decision: inputapproval.approved ? "approved" : "refused", actor: "user", now });
+      if (outcome.exec === void 0) throw new Error(`No pending approval gate matches ${approvalid}.`);
+      for (const request of outcome.requests) await memory.setapproval(request);
+      await memory.addapprovalexec(outcome.exec);
+      const gate = stored.find((request) => request.id === approvalid);
+      if (gate !== void 0 && inputapproval.approved) {
+        const tool = resolvetool(buildtoolcatalog(), gate.tool);
+        const stepid = typeof gate.params.stepid === "string" ? gate.params.stepid : void 0;
+        const plan = await memory.getplan();
+        const step = tool !== void 0 && tool.risk !== "read" && plan !== void 0 && stepid !== void 0 ? plan.steps.find((candidate) => candidate.id === stepid) : void 0;
+        if (step === void 0) throw new Error("The approved gate names no step the approved plan carries; the call refuses.");
+        const result = await executemcpstep(step);
+        await memory.addtoolcall(toolcallevent({ id: randomid(), clientid: gate.clientid, tool: gate.tool, origin: (await memory.getsession())?.origin ?? "", ok: !result.iserror, now }));
+        await audit("tool", `The approval gate ${approvalid} executed the ${gate.tool} call of the client ${gate.clientid} after the user approved it in ${outcome.exec.latencyms} milliseconds; no payload rides the record.`, {});
+      } else {
+        await audit("protocol", `The user refused the approval gate ${approvalid} for the ${gate?.tool ?? "tool"} call of the client ${gate?.clientid ?? "unknown"}; the pending call never executes.`, {});
+      }
+      return mcpstateof();
+    }
+    case "mcpsubscribe": {
+      const inputsub = message;
+      const clientid = inputsub.clientid?.trim() ?? "";
+      if (clientid === "") throw new Error("The event subscription needs the paired client.");
+      const now = Date.now();
+      if (inputsub.unsubscribe === true) {
+        const subscriptionid = inputsub.subscriptionid?.trim() ?? "";
+        if (subscriptionid === "") throw new Error("The unsubscribe needs the subscription id.");
+        await memory.seteventsubscriptions(unsubscriberegister(await memory.geteventsubscriptions(), subscriptionid, now));
+        await audit("protocol", `The user cancelled the event subscription ${subscriptionid} of the client ${clientid}; the record stays for the audit trail.`, {});
+        return mcpstateof();
+      }
+      const registered = subscriberegister({ clientid, ...Array.isArray(inputsub.kinds) ? { kinds: inputsub.kinds } : {}, ...inputsub.origin !== void 0 && inputsub.origin.trim() !== "" ? { origin: inputsub.origin.trim() } : {}, ...inputsub.tool !== void 0 && inputsub.tool.trim() !== "" ? { tool: inputsub.tool.trim() } : {}, now });
+      if (registered.subscription === void 0) throw new Error(registered.reason ?? "The event subscription did not register.");
+      const grade = subscriptiongrade(registered.subscription);
+      if (!grade.allowed) throw new Error(grade.reason ?? "The event subscription failed its gate.");
+      await memory.seteventsubscriptions([registered.subscription, ...await memory.geteventsubscriptions()]);
+      await audit("protocol", `The user subscribed the client ${clientid} to the ${registered.subscription.kinds.join(", ")} event kinds${registered.subscription.origin !== void 0 ? ` of the origin ${registered.subscription.origin}` : ""}${registered.subscription.tool !== void 0 ? ` for the tool ${registered.subscription.tool}` : ""}.`, {});
+      return mcpstateof();
+    }
+    case "mcpresource": {
+      const inputwatch = message;
+      const clientid = inputwatch.clientid?.trim() ?? "";
+      if (clientid === "") throw new Error("The resource watcher needs the paired client.");
+      const now = Date.now();
+      if (inputwatch.unwatch === true) {
+        const watchid = inputwatch.watchid?.trim() ?? "";
+        if (watchid === "") throw new Error("The unwatch needs the watcher id.");
+        await memory.setresourcewatches(unwatchresource(await memory.getresourcewatches(), watchid, now));
+        await audit("protocol", `The user cancelled the resource watcher ${watchid} of the client ${clientid}; the record stays for the audit trail.`, {});
+        return mcpstateof();
+      }
+      const watched = watchresource({ clientid, resource: inputwatch.resource?.trim() ?? "", ...inputwatch.state !== void 0 ? { state: inputwatch.state } : {}, now });
+      if (watched.watch === void 0) throw new Error(watched.reason ?? "The resource watcher did not start.");
+      await memory.setresourcewatches([watched.watch, ...await memory.getresourcewatches()]);
+      await audit("protocol", `The user started the ${watched.watch.resource} resource watcher for the client ${clientid} with its page state baseline; the deltas compare against it.`, {});
+      return mcpstateof();
+    }
+    case "mcpsampling": {
+      const inputsample = message;
+      const now = Date.now();
+      if (inputsample.respond === true) {
+        const samplingid = inputsample.samplingid?.trim() ?? "";
+        if (samplingid === "") throw new Error("The sampling answer needs the request id.");
+        const outcome = answersampling({ requests: await memory.getsamplingrequests(), id: samplingid, ...inputsample.answer !== void 0 ? { answer: inputsample.answer } : {}, ...inputsample.refused === true ? { refused: true } : {}, now });
+        if (outcome.request === void 0) throw new Error(outcome.reason ?? "The sampling answer closed no request.");
+        await memory.setsamplingrequests(outcome.requests);
+        await audit("protocol", `The sampling callback ${samplingid} of the client ${outcome.request.clientid} closed its round trip with the client answer; the provenance times ride the record.`, {});
+        return mcpstateof();
+      }
+      const clientid = inputsample.clientid?.trim() ?? "";
+      if (clientid === "") throw new Error("The sampling callback needs the paired client it addresses.");
+      const client = (await memory.getclients()).find((entry) => entry.id === clientid);
+      const requested = requestsampling({ clientid, ...client?.capabilities !== void 0 ? { capabilities: client.capabilities } : {}, prompt: inputsample.prompt ?? "", ...inputsample.system !== void 0 ? { system: inputsample.system } : {}, ...inputsample.pagecontent !== void 0 ? { pagecontent: inputsample.pagecontent } : {}, pagegrant: inputsample.pagegrant === true, ...inputsample.maxtokens !== void 0 ? { maxtokens: inputsample.maxtokens } : {}, now });
+      if (requested.request === void 0) throw new Error(requested.reason ?? "The sampling callback was refused.");
+      await memory.setsamplingrequests([requested.request, ...await memory.getsamplingrequests()]);
+      await audit("protocol", `The user sent one sampling callback to the client ${clientid}: the prompt leaves the browser${requested.request.pagecontent !== void 0 ? " with the page content the user granted" : " with the page content stripped because the user granted none"}, and the exact payload rides the panel.`, {});
+      return mcpstateof();
+    }
+    case "mcpcancelcall": {
+      const inputcancel = message;
+      const callid = inputcancel.callid?.trim() ?? "";
+      if (callid === "") throw new Error("The cancellation needs the call id.");
+      const now = Date.now();
+      const contexts = await memory.getcallcontexts();
+      const chunks = (await memory.getstreamchunks()).filter((chunk) => chunk.callid === callid);
+      const partial = chunks.length > 0 ? { content: chunks.map((chunk) => chunk.content).join(""), iserror: false } : void 0;
+      const aborted = canceltool({ contexts, callid, ...inputcancel.reason !== void 0 ? { reason: inputcancel.reason } : {}, ...partial !== void 0 ? { partial } : {}, now });
+      if (aborted.context === void 0) throw new Error(aborted.reason ?? "The cancellation named no in flight call.");
+      await memory.setcallcontexts(aborted.contexts);
+      await audit("protocol", `The user cancelled the in flight ${aborted.context.tool} call ${callid}${partial !== void 0 ? " with its partial result preserved" : ""}; the cooperative flag stops the page executor and the workflow engine keeps its own pause machinery.`, {});
+      return mcpstateof();
+    }
+    case "mcpmock": {
+      const inputmock = message;
+      const toolname = inputmock.tool?.trim() ?? "";
+      if (toolname === "") throw new Error("The tool mock needs the namespaced tool it stands in for.");
+      const now = Date.now();
+      if (inputmock.remove === true) {
+        await memory.removetoolmock(toolname);
+        await audit("protocol", `The user removed the ${toolname} tool mock; the tool returns to the real gates.`, {});
+        return mcpstateof();
+      }
+      if (resolvetool(buildtoolcatalog(), toolname) === void 0) throw new Error(`The catalog holds no unambiguous tool named ${toolname}.`);
+      const mock = { tool: toolname, result: { content: inputmock.content ?? `The ${toolname} mock answered from the test context.`, iserror: false }, testcontext: true, createdat: now };
+      const valid = mockusagevalid(mock);
+      if (!valid.allowed) throw new Error(valid.reason ?? "The tool mock failed its validation.");
+      await memory.settoolmock(mock);
+      await audit("protocol", `The user registered the ${toolname} tool mock of a test context; mocks answer with canned results and never touch the browser.`, {});
+      return mcpstateof();
+    }
+    case "mcpratelimit": {
+      const inputlimit = message;
+      const clientid = inputlimit.clientid?.trim() ?? "";
+      if (clientid === "") throw new Error("The per client rate limit needs the client it counts.");
+      const now = Date.now();
+      const limits = (await memory.getcallratelimits()).filter((limit2) => limit2.clientid !== clientid);
+      if (inputlimit.remove === true) {
+        await memory.setcallratelimits(limits);
+        await audit("protocol", `The user removed the rate limit of the client ${clientid}; the client stays unbounded because no silent default applies.`, {});
+        return mcpstateof();
+      }
+      const limit = { clientid, windowms: inputlimit.windowms ?? 6e4, ...inputlimit.budget !== void 0 ? { budget: inputlimit.budget } : {}, windowstartedat: now, used: 0 };
+      const valid = callratelimitvalid(limit);
+      if (!valid.allowed) throw new Error(valid.reason ?? "The rate limit failed its validation.");
+      await memory.setcallratelimits([limit, ...limits]);
+      await audit("protocol", `The user limited the client ${clientid} to ${limit.budget !== void 0 ? `${limit.budget} call${limit.budget === 1 ? "" : "s"} per ${limit.windowms} millisecond window` : `a ${limit.windowms} millisecond window with no call budget`}; every value stays the user choice.`, {});
+      return mcpstateof();
+    }
+    case "mcpdryrun": {
+      const inputdry = message;
+      const enabled = inputdry.enabled === true;
+      await memory.setdryruntoggle(enabled);
+      await audit("protocol", `The user ${enabled ? "armed the tool dry run of the next call: it evaluates arguments and consent with no side effects" : "disarmed the tool dry run; the next call executes behind the gates"}.`, {});
+      return mcpstateof();
     }
     case "runtobreakpoint": {
       const inputdebug = message;
@@ -18644,7 +19530,70 @@ async function mcpstateof() {
   const config = await mcpconfigof();
   const state = await memory.getmcpstate();
   const binding = bindlocalhost(config);
-  return { state: state?.state ?? "stopped", config, bind: binding.bind, port: binding.port, localhost: binding.localhost, clients: await memory.listclients(), ...state?.bridge !== void 0 ? { bridge: state.bridge } : {}, calls: (await memory.listtoolcalls()).slice(0, 25), catalog: listtools(buildtoolcatalog()), launches: (await memory.listbridgelaunches()).slice(0, 10) };
+  const now = Date.now();
+  await mcpmaintenance(now);
+  const tokens = await memory.getsessiontokens();
+  const clients = await memory.listclients();
+  const channels = closeidlechannels({ channels: await memory.getstreamchannels(), now, ...config.httpstream?.idlewindowms !== void 0 ? { idlewindow: config.httpstream.idlewindowms } : {} });
+  await memory.setstreamchannels(channels);
+  const streamstatus = listremotestatus;
+  const watches = await pushresourcestate(now);
+  const contexts = await memory.getcallcontexts();
+  const dryruntoggle = await memory.getdryruntoggle();
+  return { state: state?.state ?? "stopped", config, bind: binding.bind, port: binding.port, localhost: binding.localhost, clients, ...state?.bridge !== void 0 ? { bridge: state.bridge } : {}, calls: (await memory.listtoolcalls()).slice(0, 25), calllog: await memory.getcalllog({ limit: 25 }), catalog: listtools(buildtoolcatalog()), launches: (await memory.listbridgelaunches()).slice(0, 10), remote: streamstatus({ config, channels, clients, tokens, now }), pairing: (await memory.getpairingcodes()).filter((code) => code.usedat === void 0 && now < code.expiresat), allowlist: await memory.getallowlist(), tokens, identities: await memory.getclientidentities(), handshakes: (await memory.listauthhandshakes()).slice(0, 10), channels, approvals: await memory.listapprovals(), subscriptions: (await memory.geteventsubscriptions()).filter((subscription) => subscription.canceledat === void 0), watches: watches.filter((watch) => watch.canceledat === void 0), sampling: (await memory.getsamplingrequests()).slice(0, 10), limits: await memory.getcallratelimits(), contexts: contexts.slice(0, 25), inflight: contexts.filter((context) => context.state === "inflight"), batches: (await memory.getbatchcalls()).slice(0, 10), chunks: (await memory.getstreamchunks()).slice(0, 25), progressnotices: (await memory.getprogressnotices()).slice(0, 25), mocks: await memory.gettoolmocks(), dryruntoggle, idempotency: expireidempotency(await memory.getidempotencyrecords(), now) };
+}
+async function pushresourcestate(now) {
+  const watches = await memory.getresourcewatches();
+  const active = watches.filter((watch) => watch.canceledat === void 0);
+  if (active.length === 0) return watches;
+  const session = await memory.getsession();
+  const state = { origin: session?.origin ?? "", mutations: (await memory.getmutationevents()).length, diffs: (await memory.getdiffs()).length };
+  const pushed = notifyresource({ watches, resource: "page", state, now });
+  if (pushed.deliveries.length > 0) {
+    await memory.setresourcewatches(pushed.watches);
+    await audit("protocol", `${pushed.deliveries.length} page state delta${pushed.deliveries.length === 1 ? "" : "s"} reached the resource watcher${pushed.deliveries.length === 1 ? "" : "s"} of ${[...new Set(pushed.deliveries.map((delivery) => delivery.clientid))].join(", ")}; the baselines absorbed the new page state.`, {});
+  }
+  return pushed.watches;
+}
+async function mcpmaintenance(now) {
+  const tokens = await memory.getsessiontokens();
+  const expired = tokens.filter((token) => token.revokedat === void 0 && now >= token.expiresat);
+  if (expired.length > 0) {
+    await memory.setsessiontokens(tokens.map((token) => expired.includes(token) ? { ...token, revokedat: now } : token));
+    await audit("protocol", `${expired.length} session token${expired.length === 1 ? "" : "s"} reached the user configured lifetime and the server refused ${expired.length === 1 ? "it" : "them"}; the records stay for the audit trail.`, {});
+  }
+  const storedrecords = await memory.getidempotencyrecords();
+  const liverecords = expireidempotency(storedrecords, now);
+  if (liverecords.length !== storedrecords.length) {
+    await memory.setidempotencyrecords(liverecords);
+    await audit("protocol", `${storedrecords.length - liverecords.length} idempotency record${storedrecords.length - liverecords.length === 1 ? "" : "s"} expired past the user configured window and the key${storedrecords.length - liverecords.length === 1 ? " never replays" : "s never replay"}.`, {});
+  }
+  const stored = await memory.listapprovals();
+  const approvals = expireapprovals(stored, now);
+  for (let index = 0; index < approvals.length; index += 1) {
+    const request = approvals[index];
+    if (request !== void 0 && request.state === "expired" && stored[index]?.state === "pending") {
+      await memory.setapproval(request);
+      await audit("protocol", `The approval gate ${request.id} for the ${request.tool} call of the client ${request.clientid} expired unanswered and refused by default; the call never executes.`, {});
+    }
+  }
+}
+async function issuepairingcodehandler(scopes) {
+  const session = await memory.getsession();
+  const gate = pairingreadinessgate(session, Date.now());
+  if (!gate.allowed) throw new Error(gate.reason ?? "The pairing flow is refused.");
+  const code = issuepairingcode({ now: Date.now(), scopes });
+  await memory.addpairingcode(code);
+  await audit("protocol", `The user issued the pairing code for the ${code.scopes.join(", ") || "no"} namespace${code.scopes.length === 1 ? "" : "s"}; the code pairs one client once and expires in ${Math.round((code.expiresat - code.issuedat) / 1e3)} seconds.`, {});
+  return code;
+}
+async function raiseremoteapproval(clientid, toolname, params, step) {
+  const config = await mcpconfigof();
+  const tool = resolvetool(buildtoolcatalog(), toolname);
+  const request = requireapproval({ clientid, tool: toolname, reason: tool?.consentmeta?.review ?? `The ${toolname} tool has side effects and needs the approval gate.`, params: { ...params, stepid: step.id }, now: Date.now(), ...config.remoteaccess?.approvaltimeout !== void 0 ? { timeout: config.remoteaccess.approvaltimeout.windowms } : { timeout: defaultapprovalwindowms } });
+  await memory.setapproval(request);
+  await audit("protocol", `Raised the approval gate ${request.id} for the ${toolname} call of the remote client ${clientid}; the gate refuses by default after its window and no payload rides the audit.`, {});
+  return { content: `The approval gate ${request.id} holds the ${toolname} call; it executes once the user approves it in the panel.`, payload: { approvalid: request.id, state: "pending", ...request.timeoutat !== void 0 ? { timeoutat: request.timeoutat } : {} }, iserror: false };
 }
 async function executelistruns(step, session) {
   const options = stepoptions2(step);
@@ -18691,11 +19640,13 @@ async function trybridgelaunch(restart) {
 function restartbridgeof(bridge) {
   return { ...bridge, connected: true, restarts: bridge.restarts + 1, startedat: Date.now() };
 }
-async function routemcpframe(client, frame, config) {
+var mcpcancelledcalls = /* @__PURE__ */ new Set();
+async function routemcpframe(client, frame, config, scopes) {
   const session = await memory.getsession();
   const plan = await memory.getplan();
   const catalog = buildtoolcatalog();
-  const response = await handleframe({ frame, client, catalog, config, ...session !== void 0 ? { session } : {}, ...plan !== void 0 ? { plan } : {}, origin: session?.origin ?? "", tabid: session?.tabid ?? 0, now: Date.now(), execute: executemcpstep });
+  if (frame.method === "tools/call") return await routetoolcall(client, frame, config, scopes, session, plan, catalog);
+  const response = await handleframe({ frame, client, catalog, config, ...session !== void 0 ? { session } : {}, ...plan !== void 0 ? { plan } : {}, ...scopes !== void 0 ? { scopes } : {}, origin: session?.origin ?? "", tabid: session?.tabid ?? 0, now: Date.now(), execute: executemcpstep });
   const now = Date.now();
   if (frame.method === "initialize") {
     const clientinfo = frame.params?.clientinfo && typeof frame.params.clientinfo === "object" && !Array.isArray(frame.params.clientinfo) ? frame.params.clientinfo : void 0;
@@ -18709,23 +19660,200 @@ async function routemcpframe(client, frame, config) {
   if (frame.method === "tools/list") await audit("protocol", `The mcp client ${client.id} listed the tool catalog of ${listtools(catalog).tools.length} tools with their json schema inputs; the listing carries no page data.`, {});
   if (frame.method === "negotiate") {
     const agreed = response.error === void 0;
-    if (agreed && response.result !== void 0) await memory.setclientcapabilities(client.id, response.result);
-    await audit("protocol", `The mcp client ${client.id} ${agreed ? "negotiated its capability set with the server and the negotiated floor stays stored on its record" : `failed the capability negotiation: ${response.error?.message ?? "the sets did not agree"}`}.`, {});
-  }
-  if (frame.method === "tools/call") {
-    const name = typeof frame.params?.name === "string" ? frame.params.name : "";
-    const code = response.error?.code;
-    const ok = response.error === void 0 && response.result?.iserror !== true;
-    await memory.addtoolcall(toolcallevent({ id: randomid(), clientid: client.id, tool: name, origin: session?.origin ?? "", ok, now, ...code !== void 0 ? { code } : {} }));
-    if (plan !== void 0) {
-      const stepid = typeof frame.params?.stepid === "string" ? frame.params.stepid : "mcp";
-      await memory.setprogress(recordtoolcall(await memory.getprogress(), plan.id, stepid, { clientid: client.id, tool: name, ok, ...code !== void 0 ? { code } : {} }, now));
+    if (agreed && response.result !== void 0) {
+      await memory.setclientcapabilities(client.id, response.result);
+      const clientcaps = frame.params?.capabilities && typeof frame.params.capabilities === "object" && !Array.isArray(frame.params.capabilities) ? frame.params.capabilities : void 0;
+      const clientversion = typeof clientcaps?.toolversion === "number" && Number.isFinite(clientcaps.toolversion) ? clientcaps.toolversion : void 0;
+      const floor = negotiatetoolfloor(clientversion, catalog.version);
+      if ("floor" in floor) {
+        const stored = (await memory.getclients()).find((entry) => entry.id === client.id);
+        if (stored !== void 0) await memory.setclient({ ...stored, toolfloor: floor.floor });
+      }
     }
-    await audit("tool", `The mcp client ${client.id} called the ${name} tool on ${session?.origin ?? "no origin"} and ${ok ? "it ran behind the consent gates" : `it was refused${code !== void 0 ? ` with the ${code} error` : ""}`}; no payload rides the record.`, {});
+    await audit("protocol", `The mcp client ${client.id} ${agreed ? "negotiated its capability set with the server and the negotiated floor stays stored on its record" : `failed the capability negotiation: ${response.error?.message ?? "the sets did not agree"}`}.`, {});
   }
   return response;
 }
-async function processmcpframe(raw, clientid, transport) {
+async function routetoolcall(client, frame, config, scopes, session, plan, catalog) {
+  const now = Date.now();
+  const params = frame.params ?? {};
+  const name = typeof params.name === "string" ? params.name : "";
+  const origin = session?.origin ?? "";
+  const answerframe = (result2, error) => ({ jsonrpc: "2.0", ...frame.id !== void 0 ? { id: frame.id } : error !== void 0 ? { id: null } : {}, ...error !== void 0 ? { error: { code: error.code, message: error.message, ...error.data !== void 0 ? { data: error.data } : {} } } : { result: result2 } });
+  const refuse = async (code, message, data) => {
+    await memory.addtoolcall(toolcallevent({ id: randomid(), clientid: client.id, tool: name, origin, ok: false, now: Date.now(), code }));
+    await audit("tool", `The mcp client ${client.id} called the ${name} tool on ${origin || "no origin"} and was refused with the ${code} error; no payload rides the record.`, {});
+    return answerframe(void 0, { code, message, ...data !== void 0 ? { data } : {} });
+  };
+  const counted = applyratelimit({ limits: await memory.getcallratelimits(), clientid: client.id, now });
+  await memory.setcallratelimits(counted.limits);
+  if (!counted.allowed) {
+    const error = structurederrorof({ code: "ratelimited", message: `The client ${client.id} spent its user configured call budget of ${counted.budget ?? 0} inside the window.`, retryhint: "wait", ...counted.retryafter !== void 0 ? { retryafter: counted.retryafter } : {} });
+    await audit("protocol", `The per client rate limit refused the ${name} call of the client ${client.id}: the budget of ${counted.budget ?? 0} calls is spent and the retry hint waits ${counted.retryafter ?? 0} milliseconds.`, {});
+    return refuse("consentrefused", `${error.message} Retry: wait${error.retryafter !== void 0 ? ` after ${error.retryafter} milliseconds` : ""}.`, { retryhint: error.retryhint, ...error.retryafter !== void 0 ? { retryafter: error.retryafter } : {} });
+  }
+  const key = typeof params.idempotencykey === "string" && params.idempotencykey.trim() !== "" ? params.idempotencykey.trim() : void 0;
+  if (key !== void 0) {
+    const replay = checkidempotency({ records: await memory.getidempotencyrecords(), key, clientid: client.id, now });
+    if (replay.replay !== void 0 && replay.record !== void 0) {
+      await memory.addtoolcall(toolcallevent({ id: randomid(), clientid: client.id, tool: name, origin, ok: !replay.replay.iserror, now: Date.now(), idempotencykey: key, replayed: true }));
+      await audit("tool", `The mcp client ${client.id} repeated the idempotency key of the ${name} call and the server replayed the stored result instead of executing; no payload rides the record.`, {});
+      return answerframe({ ...replay.replay, replayed: true, idempotencykey: key, originalat: replay.record.createdat });
+    }
+  }
+  const tool = name !== "" ? resolvetool(catalog, name) : void 0;
+  const mock = tool !== void 0 ? applymock({ mocks: await memory.gettoolmocks(), tool: tool.name }) : void 0;
+  if (mock?.result !== void 0) {
+    await memory.addtoolcall(toolcallevent({ id: randomid(), clientid: client.id, tool: name, origin, ok: !mock.result.iserror, now: Date.now(), mocked: true }));
+    await audit("tool", `A tool mock of a test context answered the ${name} call of the client ${client.id} with its canned result; the browser was never touched.`, {});
+    return answerframe({ ...mock.result, mocked: true });
+  }
+  if (mock?.reason !== void 0) return await refuse("consentrefused", mock.reason);
+  let dryrun = params.dryrun === true;
+  if (!dryrun && await memory.getdryruntoggle()) {
+    dryrun = true;
+    await memory.setdryruntoggle(false);
+  }
+  if (dryrun && tool !== void 0) {
+    const dry = dryruntool({ tool, params, client, ...session !== void 0 ? { session } : {}, ...plan !== void 0 ? { plan } : {}, origin, now });
+    await memory.addtoolcall(toolcallevent({ id: randomid(), clientid: client.id, tool: name, origin, ok: dry.argsvalid && dry.consentok, now: Date.now(), dryrun: true }));
+    await audit("tool", `The mcp client ${client.id} dry ran the ${name} tool: ${dry.findings.length} finding${dry.findings.length === 1 ? "" : "s"} and no page mutation because a dry run never executes anything.`, {});
+    return answerframe({ content: `The ${name} dry run found ${dry.findings.length} issue${dry.findings.length === 1 ? "" : "s"}.`, payload: { dryrun: dry }, iserror: false });
+  }
+  const context = begincall({ clientid: client.id, tool: name, ...key !== void 0 ? { idempotencykey: key } : {}, now });
+  await memory.setcallcontexts([context, ...await memory.getcallcontexts()]);
+  const started = notifyevent({ subscriptions: await memory.geteventsubscriptions(), kind: "callstarted", ...origin !== "" ? { origin } : {}, ...name !== "" ? { tool: name } : {}, payload: { callid: context.callid, clientid: client.id }, now });
+  await memory.seteventsubscriptions(started.subscriptions);
+  const notice = notifyprogress({ callid: context.callid, percent: 10, message: `The ${name} call started behind the consent gates.`, now });
+  await memory.addprogressnotice(notice);
+  const progressed = notifyevent({ subscriptions: started.subscriptions, kind: "progress", ...origin !== "" ? { origin } : {}, ...name !== "" ? { tool: name } : {}, payload: { callid: notice.callid, percent: notice.percent, message: notice.message, cancellable: notice.cancellable }, now });
+  await memory.seteventsubscriptions(progressed.subscriptions);
+  const gatedname = client.transport === "http" && tool !== void 0 && tool.risk !== "read" ? tool.name : void 0;
+  const execute = gatedname !== void 0 ? (step) => raiseremoteapproval(client.id, gatedname, params, step) : async (step) => {
+    if (mcpcancelledcalls.has(context.callid)) throw new Error(`The ${name} call was cancelled before the page executor ran.`);
+    const result2 = await executemcpstep(step);
+    if (mcpcancelledcalls.has(context.callid)) throw new Error(`The ${name} call was cancelled in flight; the partial result stays preserved.`);
+    return result2;
+  };
+  const response = await handleframe({ frame, client, catalog, config, ...session !== void 0 ? { session } : {}, ...plan !== void 0 ? { plan } : {}, ...scopes !== void 0 ? { scopes } : {}, origin, tabid: session?.tabid ?? 0, now: Date.now(), contexts: await memory.getcallcontexts(), execute });
+  const after = Date.now();
+  const ok = response.error === void 0 && (response.result?.iserror ?? true) !== true;
+  const result = response.error === void 0 ? response.result : void 0;
+  const closed = endcall({ contexts: await memory.getcallcontexts(), callid: context.callid, ok, ...response.error !== void 0 ? { errorcode: response.error.code } : {}, ...result !== void 0 ? { partial: result } : {}, now: after });
+  if (closed.contexts !== void 0) await memory.setcallcontexts(closed.contexts);
+  if (result !== void 0 && typeof result.content === "string" && result.content.length > 0) {
+    const chunks = chunkcontent({ callid: context.callid, content: result.content, now: after });
+    for (const chunk of chunks) await memory.addstreamchunk(chunk);
+    const streamed = notifyevent({ subscriptions: await memory.geteventsubscriptions(), kind: "streamchunk", ...origin !== "" ? { origin } : {}, ...name !== "" ? { tool: name } : {}, payload: { callid: context.callid, chunks: chunks.length, done: true }, now: after });
+    await memory.seteventsubscriptions(streamed.subscriptions);
+  }
+  const finished = notifyevent({ subscriptions: await memory.geteventsubscriptions(), kind: "callresult", ...origin !== "" ? { origin } : {}, ...name !== "" ? { tool: name } : {}, payload: { callid: context.callid, ok }, now: after });
+  await memory.seteventsubscriptions(finished.subscriptions);
+  if (key !== void 0 && result !== void 0 && !result.iserror) await memory.setidempotencyrecords(recordidempotency({ records: await memory.getidempotencyrecords(), key, clientid: client.id, tool: name, result, now: after }));
+  await memory.addtoolcall(toolcallevent({ id: randomid(), clientid: client.id, tool: name, origin, ok, now: after, ...response.error !== void 0 ? { code: response.error.code } : {}, callid: context.callid, ...key !== void 0 ? { idempotencykey: key } : {} }));
+  if (plan !== void 0) {
+    const stepid = typeof params.stepid === "string" ? params.stepid : "mcp";
+    await memory.setprogress(recordtoolcall(await memory.getprogress(), plan.id, stepid, { clientid: client.id, tool: name, ok, ...response.error !== void 0 ? { code: response.error.code } : {} }, after));
+  }
+  await audit("tool", `The mcp client ${client.id} called the ${name} tool on ${origin || "no origin"} and ${ok ? gatedname !== void 0 ? "its approval gate waits for the user decision" : `it ran behind the consent gates as the call ${context.callid}` : `it was refused${response.error !== void 0 ? ` with the ${response.error.code} error` : ""}`}${key !== void 0 ? " under its idempotency key" : ""}; no payload rides the record.`, {});
+  return response;
+}
+async function routeprotocolframe(client, frame, config, scopes) {
+  void config;
+  void scopes;
+  const params = frame.params ?? {};
+  const now = Date.now();
+  const answerframe = (result, error) => ({ jsonrpc: "2.0", ...frame.id !== void 0 ? { id: frame.id } : error !== void 0 ? { id: null } : {}, ...error !== void 0 ? { error: { code: error.code, message: error.message } } : { result } });
+  if (frame.method === "events/subscribe") {
+    const kinds = Array.isArray(params.kinds) ? params.kinds.filter((kind) => typeof kind === "string") : void 0;
+    const registered = subscriberegister({ clientid: client.id, ...kinds !== void 0 ? { kinds } : {}, ...typeof params.origin === "string" && params.origin.trim() !== "" ? { origin: params.origin.trim() } : {}, ...typeof params.tool === "string" && params.tool.trim() !== "" ? { tool: params.tool.trim() } : {}, now });
+    if (registered.subscription === void 0) return answerframe(void 0, { code: "params", message: registered.reason ?? "The event subscription did not register." });
+    const grade = subscriptiongrade(registered.subscription);
+    if (!grade.allowed) return answerframe(void 0, { code: "consentrefused", message: grade.reason ?? "The event subscription failed its gate." });
+    await memory.seteventsubscriptions([registered.subscription, ...await memory.geteventsubscriptions()]);
+    await audit("protocol", `The client ${client.id} subscribed to the ${registered.subscription.kinds.join(", ")} event kinds${registered.subscription.origin !== void 0 ? ` of the origin ${registered.subscription.origin}` : ""}${registered.subscription.tool !== void 0 ? ` for the tool ${registered.subscription.tool}` : ""}; the subscription grades read only.`, {});
+    return answerframe({ subscriptionid: registered.subscription.id, kinds: registered.subscription.kinds });
+  }
+  if (frame.method === "events/unsubscribe") {
+    const subscriptionid = typeof params.subscriptionid === "string" ? params.subscriptionid : "";
+    await memory.seteventsubscriptions(unsubscriberegister(await memory.geteventsubscriptions(), subscriptionid, now));
+    await audit("protocol", `The client ${client.id} cancelled its event subscription ${subscriptionid}; the record stays for the audit trail.`, {});
+    return answerframe({ unsubscribed: true, subscriptionid });
+  }
+  if (frame.method === "resources/watch") {
+    const resource = typeof params.resource === "string" ? params.resource.trim() : "";
+    const state = params.state !== void 0 && typeof params.state === "object" && !Array.isArray(params.state) ? params.state : void 0;
+    const watched = watchresource({ clientid: client.id, resource, ...state !== void 0 ? { state } : {}, now });
+    if (watched.watch === void 0) return answerframe(void 0, { code: "params", message: watched.reason ?? "The resource watcher did not start." });
+    await memory.setresourcewatches([watched.watch, ...await memory.getresourcewatches()]);
+    await audit("protocol", `The client ${client.id} started the ${watched.watch.resource} resource watcher with its page state baseline; the deltas compare against it.`, {});
+    return answerframe({ watchid: watched.watch.id, resource: watched.watch.resource });
+  }
+  if (frame.method === "resources/unwatch") {
+    const watchid = typeof params.watchid === "string" ? params.watchid : "";
+    await memory.setresourcewatches(unwatchresource(await memory.getresourcewatches(), watchid, now));
+    await audit("protocol", `The client ${client.id} cancelled its resource watcher ${watchid}; the record stays for the audit trail.`, {});
+    return answerframe({ unwatched: true, watchid });
+  }
+  if (frame.method === "sampling/answer") {
+    const samplingid = typeof params.samplingid === "string" ? params.samplingid : "";
+    const clientanswer = typeof params.answer === "string" ? params.answer : void 0;
+    const outcome = answersampling({ requests: await memory.getsamplingrequests(), id: samplingid, ...clientanswer !== void 0 ? { answer: clientanswer } : {}, ...params.refused === true ? { refused: true } : {}, now });
+    if (outcome.request === void 0) return answerframe(void 0, { code: "params", message: outcome.reason ?? "The sampling answer closed no request." });
+    await memory.setsamplingrequests(outcome.requests);
+    await audit("protocol", `The sampling callback ${samplingid} of the client ${client.id} closed its round trip with the client answer; the provenance times ride the record.`, {});
+    return answerframe({ samplingid, state: outcome.request.state });
+  }
+  if (frame.method === "calls/cancel") {
+    const callid = typeof params.callid === "string" ? params.callid : "";
+    const reason = typeof params.reason === "string" ? params.reason : void 0;
+    if (callid.trim() === "") return answerframe(void 0, { code: "params", message: "The cancellation frame needs the call id it aborts." });
+    const chunks = (await memory.getstreamchunks()).filter((chunk) => chunk.callid === callid);
+    const partial = chunks.length > 0 ? { content: chunks.map((chunk) => chunk.content).join(""), iserror: false } : void 0;
+    const aborted = canceltool({ contexts: await memory.getcallcontexts(), callid, ...reason !== void 0 ? { reason } : {}, ...partial !== void 0 ? { partial } : {}, now });
+    if (aborted.context === void 0) return answerframe(void 0, { code: "params", message: aborted.reason ?? "The cancellation frame named no in flight tool call." });
+    await memory.setcallcontexts(aborted.contexts);
+    mcpcancelledcalls.add(callid);
+    const cancelled = notifyevent({ subscriptions: await memory.geteventsubscriptions(), kind: "cancellation", payload: { callid, reason: reason ?? "cancelled by the client" }, now });
+    await memory.seteventsubscriptions(cancelled.subscriptions);
+    await audit("protocol", `The client ${client.id} cancelled the in flight ${aborted.context.tool} call ${callid}${partial !== void 0 ? " with its partial result preserved" : ""}; the cooperative flag stops the page executor between chunks and the workflow engine keeps its own pause machinery.`, {});
+    return answerframe({ cancelled: true, callid, ...aborted.context.partial !== void 0 ? { partial: aborted.context.partial } : {} });
+  }
+  if (frame.method === "calls/batch") {
+    const members = (Array.isArray(params.calls) ? params.calls : []).filter((entry) => entry !== null && typeof entry === "object" && !Array.isArray(entry)).map((entry, index) => ({ id: typeof entry.id === "string" && entry.id.trim() !== "" ? entry.id.trim() : `member-${index + 1}`, name: typeof entry.name === "string" ? entry.name : "", params: entry.params !== void 0 && typeof entry.params === "object" && !Array.isArray(entry.params) ? entry.params : {} }));
+    const stoponerror = params.stoponerror === true;
+    const session = await memory.getsession();
+    const plan = await memory.getplan();
+    const catalog = buildtoolcatalog();
+    const risks = members.map((member) => {
+      const tool = resolvetool(catalog, member.name);
+      return { risk: tool?.risk ?? "read" };
+    });
+    const approved = plan?.state === "approved" && members.every((member) => {
+      const tool = resolvetool(catalog, member.name);
+      return tool === void 0 || tool.risk === "read" || typeof member.params.stepid === "string" && plan.steps.some((step) => step.id === member.params.stepid);
+    });
+    const gate = batchgrade({ calls: risks, approved });
+    const batch = { id: randomid(), clientid: client.id, calls: members, stoponerror, state: gate.allowed ? "running" : "stopped", createdat: now, outcomes: [] };
+    await memory.setbatchcall(batch);
+    if (!gate.allowed) {
+      await audit("protocol", `The batch call of the client ${client.id} was refused: ${gate.reason ?? "the batch failed its grade."}`, {});
+      return answerframe(void 0, { code: "consentrefused", message: gate.reason ?? "The batch call failed its grade." });
+    }
+    const outcome = await runbatch({ calls: members, stoponerror, now, execute: async (member) => {
+      const response = await routemcpframe(client, { jsonrpc: "2.0", ...frame.id !== void 0 ? { id: frame.id } : {}, method: "tools/call", params: { ...member.params, name: member.name } }, config, scopes);
+      const ok = response.error === void 0 && (response.result?.iserror ?? true) !== true;
+      return { ok, ...response.result !== void 0 ? { result: response.result } : {}, ...response.error !== void 0 ? { error: structurederrorof({ code: response.error.code, message: response.error.message, retryhint: retryhintof({ code: response.error.code, message: response.error.message }) }) } : {} };
+    } });
+    const storedbatch = { ...batch, state: outcome.stoppedat !== void 0 ? "stopped" : "done", outcomes: outcome.outcomes, finishedat: Date.now() };
+    await memory.setbatchcall(storedbatch);
+    const ran = outcome.outcomes.filter((entry) => entry.ok).length;
+    await audit("protocol", `The client ${client.id} ran the batch ${batch.id} of ${members.length} ordered call${members.length === 1 ? "" : "s"}${outcome.stoppedat !== void 0 ? ` and stopped at the member ${outcome.stoppedat} on its first error as the flag requested` : ""}; ${ran} of ${members.length} members ran behind the gates.`, {});
+    return answerframe({ batchid: batch.id, state: storedbatch.state, stoponerror, outcomes: storedbatch.outcomes });
+  }
+  return void 0;
+}
+async function processmcpframe(raw, clientid, transport, rawtoken, fingerprint) {
   const state = await memory.getmcpstate();
   if (state?.state !== "running") return { jsonrpc: "2.0", id: null, error: rpcerrorof("consentrefused", "The mcp server is not running and no frame is routed.") };
   const config = await mcpconfigof();
@@ -18737,14 +19865,41 @@ async function processmcpframe(raw, clientid, transport) {
     await audit("protocol", "The mcp server refused a wire frame that does not parse as json; the parse error answered the client.", {});
     return { jsonrpc: "2.0", id: null, error: rpcerrorof("parse", "The wire frame does not parse as json.") };
   }
-  let client = (await memory.getclients()).find((entry) => entry.id === clientid && entry.disconnectedat === void 0);
+  let scopes;
+  let routedclient = clientid;
+  if (transport === "http") {
+    const now = Date.now();
+    const ceiling = enforcemaxclients({ clients: await memory.getclients(), ...config.remoteaccess?.maxclients !== void 0 ? { maxclients: config.remoteaccess.maxclients } : {} });
+    if (!ceiling.allowed) {
+      await audit("protocol", `The remote connection of the client ${clientid || "unknown"} was refused because the user configured client ceiling is reached.`, {});
+      return { jsonrpc: "2.0", id: frame.id ?? null, error: rpcerrorof("consentrefused", ceiling.reason ?? "The remote connection was refused.") };
+    }
+    const toolname = frame.method === "tools/call" && typeof frame.params?.name === "string" ? frame.params.name : void 0;
+    const pipeline = await httpframepipeline({ config, ...fingerprint !== void 0 ? { presented: { fingerprint } } : {}, tokens: await memory.getsessiontokens(), ...rawtoken !== void 0 ? { rawtoken } : {}, allowlist: await memory.getallowlist(), fingerprint: fingerprint ?? "", ...toolname !== void 0 ? { toolname } : {}, now });
+    if (pipeline.error !== void 0) {
+      await memory.addauthhandshake({ id: randomid(), clientid: clientid || "unknown", method: "token", outcome: "refused", at: now });
+      await audit("protocol", `The remote frame of the client ${clientid || "unknown"} failed the ordered intake pipeline and was refused with the ${pipeline.error.code} error; no pairing state rides the record.`, {});
+      return { jsonrpc: "2.0", id: frame.id ?? null, error: pipeline.error };
+    }
+    scopes = pipeline.token?.scopes;
+    routedclient = pipeline.token?.clientid ?? clientid;
+    const channels = await memory.getstreamchannels();
+    const open = channels.filter((channel) => channel.clientid === routedclient && channel.closedat === void 0);
+    await memory.setstreamchannels(open.length > 0 ? heartbeat({ channels, clientid: routedclient, now }) : [...channels, openstreamchannel({ clientid: routedclient, now })]);
+  }
+  let client = (await memory.getclients()).find((entry) => entry.id === routedclient && entry.disconnectedat === void 0);
   if (client === void 0) {
+    if (transport === "http") return { jsonrpc: "2.0", id: frame.id ?? null, error: rpcerrorof("consentrefused", "The remote frame names no paired client; pair the client through the pairing exchange first.") };
     client = connectclient({ transport, now: Date.now(), ...clientid !== "" ? { id: clientid } : {} });
     await memory.setclient(client);
     await audit("protocol", `A new mcp client ${client.id} connected on the ${transport} transport and waits for the pairing approval; unpaired clients never dispatch tools.`, {});
   }
   const previous = mcpclientchains.get(client.id) ?? Promise.resolve();
-  const task = previous.catch(() => void 0).then(async () => await routemcpframe(client, frame, config));
+  const task = previous.catch(() => void 0).then(async () => {
+    const protocol = await routeprotocolframe(client, frame, config, scopes);
+    if (protocol !== void 0) return protocol;
+    return await routemcpframe(client, frame, config, scopes);
+  });
   mcpclientchains.set(client.id, task);
   return task;
 }