brightspace-mcp-server 1.6.3 → 3.0.0

package/build/utils/browser-install.js

@@ -0,0 +1,33 @@
+/**
+ * Brightspace MCP Server. Copyright (c) 2026 Rohan Muppa. MIT licensed.
+ *
+ * Recognising a missing Playwright browser.
+ *
+ * This package's postinstall downloads Chromium. npm skips postinstall under
+ * `--ignore-scripts` and under the newer allow-scripts policy, both of which
+ * are common on global installs, so the package can land without a browser and
+ * fail only later, at first sign-in.
+ *
+ * Playwright's own message does say what to run, but by the time it has been
+ * wrapped in BrowserAuthError and then flattened into a generic
+ * "Authentication failed" by the auth runner, the actionable command is gone.
+ * Matching the error lets us keep the fix attached to the failure.
+ *
+ * Matching reactively rather than probing for the executable up front keeps us
+ * off Playwright's internals, and means no false positives: this only ever
+ * fires after a launch has genuinely failed.
+ */
+import { CLEAR_NPX_CACHE_COMMAND } from "./commands.js";
+export const PLAYWRIGHT_INSTALL_HINT = "Chromium is not installed, so sign-in cannot start. Your package manager " +
+    "skipped this package's postinstall script, which is what normally downloads it " +
+    "(common with --ignore-scripts or an allow-scripts policy). Run: " +
+    "npx playwright install chromium" +
+    `. If that does not help, reinstall and clear caches with ${CLEAR_NPX_CACHE_COMMAND}.`;
+/** True when an error is Playwright reporting that no browser binary exists. */
+export function isMissingBrowserError(error) {
+    const message = error instanceof Error ? error.message : typeof error === "string" ? error : "";
+    if (!message)
+        return false;
+    return /Executable doesn't exist|playwright install|Failed to launch.*because executable doesn't exist/i.test(message);
+}
+//# sourceMappingURL=browser-install.js.map

package/build/utils/browser-install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-install.js","sourceRoot":"","sources":["../../src/utils/browser-install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAExD,MAAM,CAAC,MAAM,uBAAuB,GAClC,2EAA2E;IAC3E,iFAAiF;IACjF,kEAAkE;IAClE,iCAAiC;IACjC,4DAA4D,uBAAuB,GAAG,CAAC;AAEzF,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,iGAAiG,CAAC,IAAI,CAC3G,OAAO,CACR,CAAC;AACJ,CAAC"}

package/build/utils/commands.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Brightspace MCP Server. Copyright (c) 2026 Rohan Muppa. MIT licensed.
+ *
+ * Canonical command strings shown to users.
+ *
+ * Every npx command here is pinned to @latest deliberately. Invoking npx with
+ * a bare package name, no version tag, prefers a binary already on PATH, so on
+ * a machine with an old global install it silently runs that stale copy
+ * instead of fetching the current release. That is exactly how a healthy
+ * v2.0.0 server ended up printing instructions that executed v1.2.6, whose
+ * sign-in flow no longer worked. Pinning makes every printed command
+ * self-updating.
+ *
+ * Import these instead of writing the command inline. A release test greps the
+ * source for untagged forms and fails the build if one reappears.
+ */
+export declare const PACKAGE_NAME = "brightspace-mcp-server";
+/** Re-authenticate. Always runs the current published release. */
+export declare const AUTH_COMMAND = "npx -y brightspace-mcp-server@latest auth";
+/** Re-run the setup wizard. Always runs the current published release. */
+export declare const SETUP_COMMAND = "npx -y brightspace-mcp-server@latest setup";
+/** Bring a global install up to date. The only fix for a stale `npm i -g` copy. */
+export declare const GLOBAL_INSTALL_COMMAND = "npm install -g brightspace-mcp-server@latest";
+/** Drop cached npx copies so the next `@latest` genuinely refetches. */
+export declare const CLEAR_NPX_CACHE_COMMAND = "npx clear-npx-cache";
+//# sourceMappingURL=commands.d.ts.map

package/build/utils/commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/utils/commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,YAAY,2BAA2B,CAAC;AAErD,kEAAkE;AAClE,eAAO,MAAM,YAAY,8CAAuC,CAAC;AAEjE,0EAA0E;AAC1E,eAAO,MAAM,aAAa,+CAAwC,CAAC;AAEnE,mFAAmF;AACnF,eAAO,MAAM,sBAAsB,iDAA0C,CAAC;AAE9E,wEAAwE;AACxE,eAAO,MAAM,uBAAuB,wBAAwB,CAAC"}

package/build/utils/commands.js

@@ -0,0 +1,26 @@
+/**
+ * Brightspace MCP Server. Copyright (c) 2026 Rohan Muppa. MIT licensed.
+ *
+ * Canonical command strings shown to users.
+ *
+ * Every npx command here is pinned to @latest deliberately. Invoking npx with
+ * a bare package name, no version tag, prefers a binary already on PATH, so on
+ * a machine with an old global install it silently runs that stale copy
+ * instead of fetching the current release. That is exactly how a healthy
+ * v2.0.0 server ended up printing instructions that executed v1.2.6, whose
+ * sign-in flow no longer worked. Pinning makes every printed command
+ * self-updating.
+ *
+ * Import these instead of writing the command inline. A release test greps the
+ * source for untagged forms and fails the build if one reappears.
+ */
+export const PACKAGE_NAME = "brightspace-mcp-server";
+/** Re-authenticate. Always runs the current published release. */
+export const AUTH_COMMAND = `npx -y ${PACKAGE_NAME}@latest auth`;
+/** Re-run the setup wizard. Always runs the current published release. */
+export const SETUP_COMMAND = `npx -y ${PACKAGE_NAME}@latest setup`;
+/** Bring a global install up to date. The only fix for a stale `npm i -g` copy. */
+export const GLOBAL_INSTALL_COMMAND = `npm install -g ${PACKAGE_NAME}@latest`;
+/** Drop cached npx copies so the next `@latest` genuinely refetches. */
+export const CLEAR_NPX_CACHE_COMMAND = "npx clear-npx-cache";
+//# sourceMappingURL=commands.js.map

package/build/utils/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../src/utils/commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,wBAAwB,CAAC;AAErD,kEAAkE;AAClE,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,YAAY,cAAc,CAAC;AAEjE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,YAAY,eAAe,CAAC;AAEnE,mFAAmF;AACnF,MAAM,CAAC,MAAM,sBAAsB,GAAG,kBAAkB,YAAY,SAAS,CAAC;AAE9E,wEAAwE;AACxE,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC"}

package/build/utils/config-store.d.ts

@@ -7,6 +7,7 @@
 export interface ConfigStoreData {
     baseUrl?: string;
     username?: string;
+    /** Read only for migration from v1. Never written by saveConfigStore. */
     password?: string;
     campus?: string;
     sessionDir?: string;

package/build/utils/config-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../../src/utils/config-store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,qDAAqD;AACrD,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAKD,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED,wBAAgB,eAAe,IAAI,eAAe,CAGjD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAU7D;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C"}
+{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../../src/utils/config-store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,qDAAqD;AACrD,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAKD,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED,wBAAgB,eAAe,IAAI,eAAe,CAGjD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAa7D;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C"}

package/build/utils/config-store.js

@@ -17,6 +17,9 @@ export function loadConfigStore() {
     return JSON.parse(raw);
 }
 export function saveConfigStore(config) {
+    if (config.password !== undefined) {
+        throw new Error("Passwords must be saved in the native credential store before saving configuration.");
+    }
     const isWindows = process.platform === "win32";
     if (!fs.existsSync(CONFIG_DIR)) {
         fs.mkdirSync(CONFIG_DIR, { recursive: true, ...(isWindows ? {} : { mode: 0o700 }) });

package/build/utils/config-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-store.js","sourceRoot":"","sources":["../../src/utils/config-store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAgBxD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,kBAAkB,CAAC,CAAC;AAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAEzD,MAAM,UAAU,iBAAiB;IAC/B,OAAO,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAuB;IACrD,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;IAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,mBAAmB,CACjB,WAAW,EACX,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EACtC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CACjC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,WAAW,CAAC;AACrB,CAAC"}
+{"version":3,"file":"config-store.js","sourceRoot":"","sources":["../../src/utils/config-store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAiBxD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,kBAAkB,CAAC,CAAC;AAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAEzD,MAAM,UAAU,iBAAiB;IAC/B,OAAO,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAuB;IACrD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;IAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,mBAAmB,CACjB,WAAW,EACX,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EACtC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CACjC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/build/utils/config.d.ts

@@ -4,6 +4,7 @@
  * Licensed under MIT — see LICENSE file for details.
  */
 import type { AppConfig } from "../types/index.js";
-export declare function loadConfig(): AppConfig;
+export declare function loadConfig(): Promise<AppConfig>;
+export declare function accountSessionDirectory(root: string, baseUrl: string, username?: string): string;
 export type { AppConfig };
 //# sourceMappingURL=config.d.ts.map

package/build/utils/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/utils/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAGnD,wBAAgB,UAAU,IAAI,SAAS,CAyDtC;AASD,YAAY,EAAE,SAAS,EAAE,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/utils/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAKnD,wBAAsB,UAAU,IAAI,OAAO,CAAC,SAAS,CAAC,CAsErD;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAIhG;AASD,YAAY,EAAE,SAAS,EAAE,CAAC"}

package/build/utils/config.js

@@ -5,8 +5,13 @@
  */
 import * as path from "node:path";
 import * as os from "node:os";
+import { createHash } from "node:crypto";
+import dotenv from "dotenv";
 import { configStoreExists, loadConfigStore } from "./config-store.js";
-export function loadConfig() {
+import { resolveStoredPassword } from "./secure-config.js";
+import { migrateLegacyState } from "../auth/legacy-state.js";
+export async function loadConfig() {
+    dotenv.config({ quiet: true });
     const store = configStoreExists() ? loadConfigStore() : null;
     if (store) {
         console.error("[config] Loaded base config from ~/.brightspace-mcp/config.json");
@@ -15,16 +20,15 @@ export function loadConfig() {
         console.error("[config] No config.json found, using environment variables");
     }
     // Resolve sessionDir: env > store > default
-    const sessionDir = process.env.D2L_SESSION_DIR
+    const sessionRoot = process.env.D2L_SESSION_DIR
         ? expandTilde(process.env.D2L_SESSION_DIR)
         : store?.sessionDir
             ? expandTilde(store.sessionDir)
             : path.join(os.homedir(), ".d2l-session");
-    // Resolve headless: env > store > default (false)
-    let headless = store?.headless ?? false;
-    if (process.env.D2L_HEADLESS !== undefined) {
-        headless = process.env.D2L_HEADLESS === "true";
-    }
+    // Code-entry and other interactive MFA methods need a visible browser.
+    const headless = process.env.D2L_HEADLESS !== undefined
+        ? process.env.D2L_HEADLESS !== "false"
+        : store?.headless ?? true;
     // Resolve tokenTtl: env > store > default (3600)
     const tokenTtl = process.env.D2L_TOKEN_TTL
         ? parseInt(process.env.D2L_TOKEN_TTL, 10)
@@ -42,13 +46,25 @@ export function loadConfig() {
     if (process.env.D2L_ACTIVE_ONLY !== undefined) {
         activeOnly = process.env.D2L_ACTIVE_ONLY !== 'false';
     }
+    const configuredUrl = new URL(process.env.D2L_BASE_URL || store?.baseUrl || "https://purdue.brightspace.com");
+    if (configuredUrl.protocol !== "https:" || configuredUrl.username || configuredUrl.password) {
+        throw new Error("The Brightspace URL must be an HTTPS school URL without embedded credentials.");
+    }
+    const baseUrl = configuredUrl.origin;
+    const username = process.env.D2L_USERNAME || store?.username;
+    const password = await resolveStoredPassword(baseUrl, username, store);
+    // A new account must never inherit another account's cookies, even at the same school.
+    const sessionDir = accountSessionDirectory(sessionRoot, baseUrl, username);
+    const legacyMigration = sessionDir !== sessionRoot ? await migrateLegacyState(sessionRoot) : undefined;
     return {
-        baseUrl: process.env.D2L_BASE_URL || store?.baseUrl || "https://purdue.brightspace.com",
+        baseUrl,
         sessionDir,
+        sessionRoot,
+        legacyBrowserStateMigrated: legacyMigration?.browserState === "encrypted",
         tokenTtl,
         headless,
-        username: process.env.D2L_USERNAME || store?.username,
-        password: process.env.D2L_PASSWORD || store?.password,
+        username,
+        password,
         campus: process.env.D2L_CAMPUS || store?.campus,
         courseFilter: {
             includeCourseIds,
@@ -57,6 +73,12 @@ export function loadConfig() {
         },
     };
 }
+export function accountSessionDirectory(root, baseUrl, username) {
+    if (!username)
+        return root;
+    const account = createHash("sha256").update(JSON.stringify([new URL(baseUrl).origin, username])).digest("hex");
+    return path.join(root, "accounts", account);
+}
 function expandTilde(filePath) {
     if (filePath.startsWith("~")) {
         return path.join(os.homedir(), filePath.slice(1));

package/build/utils/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/utils/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEvE,MAAM,UAAU,UAAU;IACxB,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAE7D,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACnF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC9E,CAAC;IAED,4CAA4C;IAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe;QAC5C,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAC1C,CAAC,CAAC,KAAK,EAAE,UAAU;YACjB,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC;YAC/B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;IAE9C,kDAAkD;IAClD,IAAI,QAAQ,GAAG,KAAK,EAAE,QAAQ,IAAI,KAAK,CAAC;IACxC,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC3C,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,MAAM,CAAC;IACjD,CAAC;IAED,iDAAiD;IACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa;QACxC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,CAAC;QACzC,CAAC,CAAC,KAAK,EAAE,QAAQ,IAAI,IAAI,CAAC;IAE5B,oDAAoD;IACpD,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB;QACtD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpG,CAAC,CAAC,KAAK,EAAE,cAAc,CAAC;IAE1B,oDAAoD;IACpD,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB;QACtD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpG,CAAC,CAAC,KAAK,EAAE,cAAc,CAAC;IAE1B,mDAAmD;IACnD,IAAI,UAAU,GAAG,KAAK,EAAE,UAAU,IAAI,IAAI,CAAC;IAC3C,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC9C,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,OAAO,CAAC;IACvD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,KAAK,EAAE,OAAO,IAAI,gCAAgC;QACvF,UAAU;QACV,QAAQ;QACR,QAAQ;QACR,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,KAAK,EAAE,QAAQ;QACrD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,KAAK,EAAE,QAAQ;QACrD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,KAAK,EAAE,MAAM;QAC/C,YAAY,EAAE;YACZ,gBAAgB;YAChB,gBAAgB;YAChB,UAAU;SACX;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB;IACnC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/utils/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAE7D,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACnF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC9E,CAAC;IAED,4CAA4C;IAC5C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe;QAC7C,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAC1C,CAAC,CAAC,KAAK,EAAE,UAAU;YACjB,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC;YAC/B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;IAE9C,uEAAuE;IACvE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,SAAS;QACrD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,OAAO;QACtC,CAAC,CAAC,KAAK,EAAE,QAAQ,IAAI,IAAI,CAAC;IAE5B,iDAAiD;IACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa;QACxC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,CAAC;QACzC,CAAC,CAAC,KAAK,EAAE,QAAQ,IAAI,IAAI,CAAC;IAE5B,oDAAoD;IACpD,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB;QACtD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpG,CAAC,CAAC,KAAK,EAAE,cAAc,CAAC;IAE1B,oDAAoD;IACpD,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB;QACtD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpG,CAAC,CAAC,KAAK,EAAE,cAAc,CAAC;IAE1B,mDAAmD;IACnD,IAAI,UAAU,GAAG,KAAK,EAAE,UAAU,IAAI,IAAI,CAAC;IAC3C,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC9C,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,OAAO,CAAC;IACvD,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,KAAK,EAAE,OAAO,IAAI,gCAAgC,CAAC,CAAC;IAC9G,IAAI,aAAa,CAAC,QAAQ,KAAK,QAAQ,IAAI,aAAa,CAAC,QAAQ,IAAI,aAAa,CAAC,QAAQ,EAAE,CAAC;QAC5F,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC;IACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,KAAK,EAAE,QAAQ,CAAC;IAC7D,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACvE,uFAAuF;IACvF,MAAM,UAAU,GAAG,uBAAuB,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC3E,MAAM,eAAe,GAAG,UAAU,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEvG,OAAO;QACL,OAAO;QACP,UAAU;QACV,WAAW;QACX,0BAA0B,EAAE,eAAe,EAAE,YAAY,KAAK,WAAW;QACzE,QAAQ;QACR,QAAQ;QACR,QAAQ;QACR,QAAQ;QACR,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,KAAK,EAAE,MAAM;QAC/C,YAAY,EAAE;YACZ,gBAAgB;YAChB,gBAAgB;YAChB,UAAU;SACX;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAY,EAAE,OAAe,EAAE,QAAiB;IACtF,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/G,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB;IACnC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/build/utils/download-errors.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Purdue Brightspace MCP Server
+ * Copyright (c) 2026 Rohan Muppa. All rights reserved.
+ * Licensed under MIT — see LICENSE file for details.
+ *
+ * Typed download failures.
+ *
+ * A download that failed validation used to throw a plain Error, which
+ * sanitizeError has no branch for, so every one of them reached the user as
+ * "An unexpected error occurred. Please try again." That is the least useful
+ * sentence available, and it hid a real bug for as long as the tool has
+ * existed: no legacy Office file could ever be downloaded.
+ *
+ * The guidance keyed off `kind` follows the same contract as the auth table:
+ * the text is chosen from a closed set this package controls, never built from
+ * a caught message. That matters here more than on the auth path, because a
+ * download error message can embed a MIME type and a filename that both
+ * originate from remote HTTP headers or remote file bytes.
+ */
+/** Closed set of ways a download can fail before the bytes reach disk. */
+export type DownloadFailureKind = "unsupportedType" | "undetectableType" | "badFilename" | "pathTraversal";
+export declare class DownloadError extends Error {
+    readonly kind: DownloadFailureKind;
+    /**
+     * One short fact worth showing the user, currently only a detected MIME
+     * type. Rendered only after isSafeDetail approves it, so a crafted
+     * Content-Disposition header or file body cannot put prose in a response.
+     */
+    readonly detail?: string | undefined;
+    constructor(kind: DownloadFailureKind, message: string, 
+    /**
+     * One short fact worth showing the user, currently only a detected MIME
+     * type. Rendered only after isSafeDetail approves it, so a crafted
+     * Content-Disposition header or file body cannot put prose in a response.
+     */
+    detail?: string | undefined);
+}
+/**
+ * True only for something shaped like a bare MIME type.
+ *
+ * This is the narrowest shape that still answers "what actually went wrong",
+ * and it admits no spaces, so no free text, path, or response body can pass.
+ */
+export declare function isSafeDetail(value: string): boolean;
+//# sourceMappingURL=download-errors.d.ts.map

package/build/utils/download-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"download-errors.d.ts","sourceRoot":"","sources":["../../src/utils/download-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,0EAA0E;AAC1E,MAAM,MAAM,mBAAmB,GAC3B,iBAAiB,GACjB,kBAAkB,GAClB,aAAa,GACb,eAAe,CAAC;AAEpB,qBAAa,aAAc,SAAQ,KAAK;aAEpB,IAAI,EAAE,mBAAmB;IAEzC;;;;OAIG;aACa,MAAM,CAAC,EAAE,MAAM;gBAPf,IAAI,EAAE,mBAAmB,EACzC,OAAO,EAAE,MAAM;IACf;;;;OAIG;IACa,MAAM,CAAC,EAAE,MAAM,YAAA;CAKlC;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEnD"}

package/build/utils/download-errors.js

@@ -0,0 +1,45 @@
+/**
+ * Purdue Brightspace MCP Server
+ * Copyright (c) 2026 Rohan Muppa. All rights reserved.
+ * Licensed under MIT — see LICENSE file for details.
+ *
+ * Typed download failures.
+ *
+ * A download that failed validation used to throw a plain Error, which
+ * sanitizeError has no branch for, so every one of them reached the user as
+ * "An unexpected error occurred. Please try again." That is the least useful
+ * sentence available, and it hid a real bug for as long as the tool has
+ * existed: no legacy Office file could ever be downloaded.
+ *
+ * The guidance keyed off `kind` follows the same contract as the auth table:
+ * the text is chosen from a closed set this package controls, never built from
+ * a caught message. That matters here more than on the auth path, because a
+ * download error message can embed a MIME type and a filename that both
+ * originate from remote HTTP headers or remote file bytes.
+ */
+export class DownloadError extends Error {
+    kind;
+    detail;
+    constructor(kind, message, 
+    /**
+     * One short fact worth showing the user, currently only a detected MIME
+     * type. Rendered only after isSafeDetail approves it, so a crafted
+     * Content-Disposition header or file body cannot put prose in a response.
+     */
+    detail) {
+        super(message);
+        this.kind = kind;
+        this.detail = detail;
+        this.name = "DownloadError";
+    }
+}
+/**
+ * True only for something shaped like a bare MIME type.
+ *
+ * This is the narrowest shape that still answers "what actually went wrong",
+ * and it admits no spaces, so no free text, path, or response body can pass.
+ */
+export function isSafeDetail(value) {
+    return value.length <= 64 && /^[a-z0-9][a-z0-9.+-]*\/[a-z0-9][a-z0-9.+-]*$/.test(value);
+}
+//# sourceMappingURL=download-errors.js.map

package/build/utils/download-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"download-errors.js","sourceRoot":"","sources":["../../src/utils/download-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AASH,MAAM,OAAO,aAAc,SAAQ,KAAK;IAEpB;IAOA;IARlB,YACkB,IAAyB,EACzC,OAAe;IACf;;;;OAIG;IACa,MAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QATC,SAAI,GAAJ,IAAI,CAAqB;QAOzB,WAAM,GAAN,MAAM,CAAS;QAG/B,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,MAAM,IAAI,EAAE,IAAI,8CAA8C,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1F,CAAC"}

package/build/utils/download-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"download-helpers.d.ts","sourceRoot":"","sources":["../../src/utils/download-helpers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CA8BjB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAiDxD"}
+{"version":3,"file":"download-helpers.d.ts","sourceRoot":"","sources":["../../src/utils/download-helpers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CA8BjB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAkDxD"}

package/build/utils/download-helpers.js

@@ -72,7 +72,8 @@ export async function secureDownload(options) {
     }
     log("DEBUG", `secureDownload: file size ${size} bytes (within limit)`);
     // Validate file type via magic bytes
-    const { mime } = await validateFileType(data, allowedTypes);
+    // The filename decides which legacy Office format a CFB container is.
+    const { mime } = await validateFileType(data, allowedTypes, filename);
     log("DEBUG", `secureDownload: file type validated as ${mime}`);
     // Validate download path (prevent path traversal)
     const validatedPath = validateDownloadPath(targetDir, filename);

package/build/utils/download-helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"download-helpers.js","sourceRoot":"","sources":["../../src/utils/download-helpers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC5F,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAW,EACX,QAAgB;IAEhB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAE1C,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1B,wCAAwC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,wCAAwC;QACxC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,yCAAyC;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAE9C,qCAAqC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,GAAG,QAAQ,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;QAC5C,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAEhD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAC/B,wBAAwB;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;YACpC,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAKpC;IACC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IAE5D,GAAG,CAAC,OAAO,EAAE,wCAAwC,QAAQ,OAAO,SAAS,EAAE,CAAC,CAAC;IAEjF,sDAAsD;IACtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,mCAAmC,SAAS,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,oCAAoC,SAAS,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,qBAAqB;IACrB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC;IAC7B,IAAI,IAAI,GAAG,aAAa,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,oCAAoC,aAAa,SAAS,CAC7E,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,OAAO,EAAE,6BAA6B,IAAI,uBAAuB,CAAC,CAAC;IAEvE,qCAAqC;IACrC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC5D,GAAG,CAAC,OAAO,EAAE,0CAA0C,IAAI,EAAE,CAAC,CAAC;IAE/D,kDAAkD;IAClD,MAAM,aAAa,GAAG,oBAAoB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAChE,GAAG,CAAC,OAAO,EAAE,qCAAqC,aAAa,EAAE,CAAC,CAAC;IAEnE,6BAA6B;IAC7B,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IACzD,GAAG,CAAC,OAAO,EAAE,wCAAwC,gBAAgB,EAAE,CAAC,CAAC;IAEzE,qBAAqB;IACrB,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACpC,GAAG,CAAC,MAAM,EAAE,sBAAsB,SAAS,KAAK,IAAI,WAAW,IAAI,GAAG,CAAC,CAAC;IAExE,OAAO;QACL,IAAI,EAAE,SAAS;QACf,IAAI;QACJ,IAAI;KACL,CAAC;AACJ,CAAC"}
+{"version":3,"file":"download-helpers.js","sourceRoot":"","sources":["../../src/utils/download-helpers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC5F,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAW,EACX,QAAgB;IAEhB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAE1C,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1B,wCAAwC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,wCAAwC;QACxC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,yCAAyC;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAE9C,qCAAqC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,GAAG,QAAQ,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;QAC5C,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAEhD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAC/B,wBAAwB;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;YACpC,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAKpC;IACC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IAE5D,GAAG,CAAC,OAAO,EAAE,wCAAwC,QAAQ,OAAO,SAAS,EAAE,CAAC,CAAC;IAEjF,sDAAsD;IACtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,mCAAmC,SAAS,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,oCAAoC,SAAS,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,qBAAqB;IACrB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC;IAC7B,IAAI,IAAI,GAAG,aAAa,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,oCAAoC,aAAa,SAAS,CAC7E,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,OAAO,EAAE,6BAA6B,IAAI,uBAAuB,CAAC,CAAC;IAEvE,qCAAqC;IACrC,sEAAsE;IACtE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IACtE,GAAG,CAAC,OAAO,EAAE,0CAA0C,IAAI,EAAE,CAAC,CAAC;IAE/D,kDAAkD;IAClD,MAAM,aAAa,GAAG,oBAAoB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAChE,GAAG,CAAC,OAAO,EAAE,qCAAqC,aAAa,EAAE,CAAC,CAAC;IAEnE,6BAA6B;IAC7B,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IACzD,GAAG,CAAC,OAAO,EAAE,wCAAwC,gBAAgB,EAAE,CAAC,CAAC;IAEzE,qBAAqB;IACrB,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACpC,GAAG,CAAC,MAAM,EAAE,sBAAsB,SAAS,KAAK,IAAI,WAAW,IAAI,GAAG,CAAC,CAAC;IAExE,OAAO;QACL,IAAI,EAAE,SAAS;QACf,IAAI;QACJ,IAAI;KACL,CAAC;AACJ,CAAC"}

package/build/utils/file-validator.d.ts

@@ -31,7 +31,7 @@ export declare function validateDownloadPath(baseDir: string, filename: string):
  * @returns Detected MIME type and extension
  * @throws Error if file type not allowed
  */
-export declare function validateFileType(buffer: Buffer, allowedTypes?: string[]): Promise<{
+export declare function validateFileType(buffer: Buffer, allowedTypes?: string[], filename?: string): Promise<{
     mime: string;
     ext: string;
 }>;

package/build/utils/file-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-validator.d.ts","sourceRoot":"","sources":["../../src/utils/file-validator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH;;;GAGG;AACH,eAAO,MAAM,aAAa,QAAmB,CAAC;AAE9C;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAM,EA4BtC,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,MAAM,CAwBR;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,YAAY,GAAE,MAAM,EAAuB,GAC1C,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAyCxC;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,OAAO,GAAG,MAAM,CAQrD;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,IAAI,CAM1E"}
+{"version":3,"file":"file-validator.d.ts","sourceRoot":"","sources":["../../src/utils/file-validator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA+BH;;;GAGG;AACH,eAAO,MAAM,aAAa,QAAmB,CAAC;AAE9C;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAM,EA4BtC,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,MAAM,CA+BR;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,YAAY,GAAE,MAAM,EAAuB,EAC3C,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAwDxC;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,OAAO,GAAG,MAAM,CAQrD;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,IAAI,CAM1E"}

package/build/utils/file-validator.js

@@ -6,6 +6,30 @@
 import path from "node:path";
 import { fileTypeFromBuffer } from "file-type";
 import sanitizeFilename from "sanitize-filename";
+import { DownloadError } from "./download-errors.js";
+/**
+ * file-type reports every OLE2 Compound File Binary container as
+ * application/x-cfb. It does not read the CFB directory, so it cannot tell a
+ * .doc from a .xls from an .msi. The three legacy Office entries in
+ * ALLOWED_MIME_TYPES were therefore unreachable and every legacy Office
+ * download failed with a generic error.
+ *
+ * Allowing application/x-cfb outright is not the fix: .msi installers are the
+ * same container, and letting one through under a .doc name is exactly what a
+ * magic-byte allowlist exists to prevent. Reconcile against the declared
+ * extension instead, which admits the formats the allowlist already intended
+ * and still refuses everything else.
+ */
+const CFB_MIME = "application/x-cfb";
+const CFB_EXTENSION_MIMES = {
+    ".doc": "application/msword",
+    ".dot": "application/msword",
+    ".xls": "application/vnd.ms-excel",
+    ".xlt": "application/vnd.ms-excel",
+    ".ppt": "application/vnd.ms-powerpoint",
+    ".pot": "application/vnd.ms-powerpoint",
+    ".pps": "application/vnd.ms-powerpoint",
+};
 /**
  * Maximum file size for downloads (50 MB).
  * Prevents memory exhaustion from malicious large file requests.
@@ -53,12 +77,20 @@ export const ALLOWED_MIME_TYPES = [
  * @throws Error if path traversal detected
  */
 export function validateDownloadPath(baseDir, filename) {
-    // Decode URL-encoded characters
-    const decoded = decodeURIComponent(filename);
+    // A filename carrying a bare '%' (say "100% Final.doc") makes
+    // decodeURIComponent throw URIError. Brightspace supplies these names, so
+    // that is remote input, and the raw name is the right fallback.
+    let decoded;
+    try {
+        decoded = decodeURIComponent(filename);
+    }
+    catch {
+        decoded = filename;
+    }
     // Sanitize filename (removes path separators, null bytes, etc.)
     const sanitized = sanitizeFilename(decoded);
     if (!sanitized || sanitized.length === 0) {
-        throw new Error("Invalid filename after sanitization");
+        throw new DownloadError("badFilename", "Invalid filename after sanitization");
     }
     // Resolve full path
     const fullPath = path.resolve(baseDir, sanitized);
@@ -66,7 +98,7 @@ export function validateDownloadPath(baseDir, filename) {
     // Verify resolved path is within base directory
     if (!fullPath.startsWith(resolvedBase + path.sep) &&
         fullPath !== resolvedBase) {
-        throw new Error("Path traversal detected");
+        throw new DownloadError("pathTraversal", "Path traversal detected");
     }
     return fullPath;
 }
@@ -79,12 +111,20 @@ export function validateDownloadPath(baseDir, filename) {
  * @returns Detected MIME type and extension
  * @throws Error if file type not allowed
  */
-export async function validateFileType(buffer, allowedTypes = ALLOWED_MIME_TYPES) {
+export async function validateFileType(buffer, allowedTypes = ALLOWED_MIME_TYPES, filename) {
     // Try magic byte detection first
     const detected = await fileTypeFromBuffer(buffer);
     if (detected) {
+        if (detected.mime === CFB_MIME) {
+            const ext = filename ? path.extname(filename).toLowerCase() : "";
+            const resolved = CFB_EXTENSION_MIMES[ext];
+            if (resolved && allowedTypes.includes(resolved)) {
+                return { mime: resolved, ext: ext.slice(1) };
+            }
+            throw new DownloadError("unsupportedType", `Compound File Binary with extension '${ext || "none"}' is not an allowed Office format`, CFB_MIME);
+        }
         if (!allowedTypes.includes(detected.mime)) {
-            throw new Error(`File type '${detected.mime}' not allowed. Allowed types: ${allowedTypes.join(", ")}`);
+            throw new DownloadError("unsupportedType", `File type '${detected.mime}' not allowed`, detected.mime);
         }
         return { mime: detected.mime, ext: detected.ext };
     }
@@ -109,7 +149,7 @@ export async function validateFileType(buffer, allowedTypes = ALLOWED_MIME_TYPES
             }
         }
     }
-    throw new Error("Could not determine file type or type not allowed");
+    throw new DownloadError("undetectableType", "Could not determine file type or type not allowed");
 }
 /**
  * Validate content ID is a positive integer.

package/build/utils/file-validator.js.map

@@ -1 +1 @@
-{"version":3,"file":"file-validator.js","sourceRoot":"","sources":["../../src/utils/file-validator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,gBAAgB,MAAM,mBAAmB,CAAC;AAEjD;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ;AAEvD;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAa;IAC1C,YAAY;IACZ,iBAAiB;IACjB,yEAAyE,EAAE,QAAQ;IACnF,2EAA2E,EAAE,QAAQ;IACrF,mEAAmE,EAAE,QAAQ;IAC7E,oBAAoB,EAAE,OAAO;IAC7B,+BAA+B,EAAE,OAAO;IACxC,0BAA0B,EAAE,OAAO;IACnC,SAAS;IACT,WAAW;IACX,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,eAAe;IACf,OAAO;IACP,YAAY;IACZ,UAAU;IACV,WAAW;IACX,OAAO;IACP,kBAAkB;IAClB,WAAW;IACX,iBAAiB;IACjB,8BAA8B;IAC9B,QAAQ;IACR,WAAW;IACX,YAAY;IACZ,WAAW;CACZ,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,QAAgB;IAEhB,gCAAgC;IAChC,MAAM,OAAO,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAE7C,gEAAgE;IAChE,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAE5C,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,oBAAoB;IACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAE3C,gDAAgD;IAChD,IACE,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC;QAC7C,QAAQ,KAAK,YAAY,EACzB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,eAAyB,kBAAkB;IAE3C,iCAAiC;IACjC,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAElD,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,cAAc,QAAQ,CAAC,IAAI,iCAAiC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;IACpD,CAAC;IAED,4EAA4E;IAC5E,+EAA+E;IAC/E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,IAAI,OAAO,GAAkB,IAAI,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,mCAAmC;QACrC,CAAC;QAED,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,KAAK,GACT,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YAChE,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC;YAC7C,MAAM,MAAM,GACV,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAChE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC;YACjD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YAEpC,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CACb,mDAAmD,CACpD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAW;IAC3C,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,eAAuB;IAClE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,uBAAuB,eAAe,UAAU,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"file-validator.js","sourceRoot":"","sources":["../../src/utils/file-validator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,gBAAgB,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD;;;;;;;;;;;;GAYG;AACH,MAAM,QAAQ,GAAG,mBAAmB,CAAC;AACrC,MAAM,mBAAmB,GAA2B;IAClD,MAAM,EAAE,oBAAoB;IAC5B,MAAM,EAAE,oBAAoB;IAC5B,MAAM,EAAE,0BAA0B;IAClC,MAAM,EAAE,0BAA0B;IAClC,MAAM,EAAE,+BAA+B;IACvC,MAAM,EAAE,+BAA+B;IACvC,MAAM,EAAE,+BAA+B;CACxC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ;AAEvD;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAa;IAC1C,YAAY;IACZ,iBAAiB;IACjB,yEAAyE,EAAE,QAAQ;IACnF,2EAA2E,EAAE,QAAQ;IACrF,mEAAmE,EAAE,QAAQ;IAC7E,oBAAoB,EAAE,OAAO;IAC7B,+BAA+B,EAAE,OAAO;IACxC,0BAA0B,EAAE,OAAO;IACnC,SAAS;IACT,WAAW;IACX,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,eAAe;IACf,OAAO;IACP,YAAY;IACZ,UAAU;IACV,WAAW;IACX,OAAO;IACP,kBAAkB;IAClB,WAAW;IACX,iBAAiB;IACjB,8BAA8B;IAC9B,QAAQ;IACR,WAAW;IACX,YAAY;IACZ,WAAW;CACZ,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,QAAgB;IAEhB,8DAA8D;IAC9D,0EAA0E;IAC1E,gEAAgE;IAChE,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,QAAQ,CAAC;IACrB,CAAC;IAED,gEAAgE;IAChE,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAE5C,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,aAAa,CAAC,aAAa,EAAE,qCAAqC,CAAC,CAAC;IAChF,CAAC;IAED,oBAAoB;IACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAE3C,gDAAgD;IAChD,IACE,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC;QAC7C,QAAQ,KAAK,YAAY,EACzB,CAAC;QACD,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,eAAyB,kBAAkB,EAC3C,QAAiB;IAEjB,iCAAiC;IACjC,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAElD,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,QAAQ,IAAI,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,CAAC;YACD,MAAM,IAAI,aAAa,CACrB,iBAAiB,EACjB,wCAAwC,GAAG,IAAI,MAAM,mCAAmC,EACxF,QAAQ,CACT,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,aAAa,CACrB,iBAAiB,EACjB,cAAc,QAAQ,CAAC,IAAI,eAAe,EAC1C,QAAQ,CAAC,IAAI,CACd,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;IACpD,CAAC;IAED,4EAA4E;IAC5E,+EAA+E;IAC/E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,IAAI,OAAO,GAAkB,IAAI,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,mCAAmC;QACrC,CAAC;QAED,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,KAAK,GACT,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YAChE,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC;YAC7C,MAAM,MAAM,GACV,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAChE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC;YACjD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YAEpC,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,IAAI,aAAa,CACrB,kBAAkB,EAClB,mDAAmD,CACpD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAW;IAC3C,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,eAAuB;IAClE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,uBAAuB,eAAe,UAAU,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC"}

package/build/utils/install-sites.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Brightspace MCP Server. Copyright (c) 2026 Rohan Muppa. MIT licensed.
+ *
+ * Find every copy of this package on the machine and report disagreement.
+ *
+ * A single machine can easily hold several copies at different versions: one
+ * per Node version under a version manager, one per npx cache entry, plus a
+ * local checkout. They are installed at different times and nothing keeps them
+ * in step. The failure that motivated this had a v2.0.0 MCP server running
+ * happily while the auth command typed in a shell resolved to v1.2.6, whose
+ * sign-in flow no longer worked, with no way to see the mismatch.
+ *
+ * This scan needs no network, so unlike the registry check it still works
+ * offline, and it catches the problem before anything fails rather than after.
+ *
+ * It reads package.json files and resolves symlinks. It never spawns a
+ * process, never runs npm, and never writes anything.
+ */
+export interface InstallSite {
+    kind: "global" | "npx-cache" | "self";
+    /** The package directory, i.e. .../node_modules/brightspace-mcp-server */
+    dir: string;
+    version: string | null;
+    /** The PATH entry that resolves here, when a shell command points at it. */
+    binPath?: string;
+    isSelf: boolean;
+}
+export interface InstallScanDeps {
+    env?: NodeJS.ProcessEnv;
+    platform?: NodeJS.Platform;
+    execPath?: string;
+    home?: string;
+    /** The running package directory, excluded from "other copies". */
+    selfDir?: string;
+    readVersion?: (packageJsonPath: string) => Promise<string | null>;
+    listDir?: (dir: string) => Promise<string[]>;
+    realpath?: (path: string) => Promise<string>;
+}
+/**
+ * Every copy of this package we can find, including the running one.
+ * Never throws; anything unreadable is simply omitted.
+ */
+export declare function scanInstallSites(deps?: InstallScanDeps): Promise<InstallSite[]>;
+/**
+ * Scan and format in one step. Returns null when there is nothing to say, and
+ * never throws, so callers can treat it as advisory.
+ *
+ * Honors D2L_NO_UPDATE_CHECK, which switches off every version-related notice.
+ */
+export declare function detectSkew(runningVersion: string, deps?: InstallScanDeps): Promise<string | null>;
+/**
+ * A warning about copies that disagree with the running version, or null when
+ * there is nothing worth saying.
+ *
+ * Deliberately quiet: it only speaks when another copy exists at a *different*
+ * version, since a machine with several copies all in step is fine. Copies a
+ * shell command actually resolves to are reported first, because those are the
+ * ones a user can trip over.
+ */
+export declare function formatSkewNotice(sites: InstallSite[], runningVersion: string, home?: string): string | null;
+//# sourceMappingURL=install-sites.d.ts.map

package/build/utils/install-sites.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-sites.d.ts","sourceRoot":"","sources":["../../src/utils/install-sites.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAaH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,WAAW,GAAG,MAAM,CAAC;IACtC,0EAA0E;IAC1E,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAClE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7C,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC9C;AAgFD;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAsEzF;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,cAAc,EAAE,MAAM,EACtB,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CASxB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,WAAW,EAAE,EACpB,cAAc,EAAE,MAAM,EACtB,IAAI,GAAE,MAAkB,GACvB,MAAM,GAAG,IAAI,CA4Bf"}