gogcli-mcp-classroom 4.5.0 → 4.5.2

package/dist/index.js

@@ -956,14 +956,14 @@ function promiseAllObject(promisesObj) {
 }
 function randomString(length = 10) {
   const chars = "abcdefghijklmnopqrstuvwxyz";
-  let str = "";
+  let str2 = "";
   for (let i = 0; i < length; i++) {
-    str += chars[Math.floor(Math.random() * chars.length)];
+    str2 += chars[Math.floor(Math.random() * chars.length)];
   }
-  return str;
+  return str2;
 }
-function esc(str) {
-  return JSON.stringify(str);
+function esc(str2) {
+  return JSON.stringify(str2);
 }
 function slugify(input2) {
   return input2.toLowerCase().trim().replace(/[^\w\s-]/g, "").replace(/[\s_-]+/g, "-").replace(/^-+|-+$/g, "");
@@ -1077,8 +1077,8 @@ var primitiveTypes = /* @__PURE__ */ new Set([
   "symbol",
   "undefined"
 ]);
-function escapeRegex(str) {
-  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function escapeRegex(str2) {
+  return str2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function clone(inst, def, params) {
   const cl = new inst._zod.constr(def ?? inst._zod.def);
@@ -1332,13 +1332,13 @@ function getSizableOrigin(input2) {
   return "unknown";
 }
 var highSurrogate = /[\uD800-\uDBFF]/;
-function codePointLength(str) {
-  const units = str.length;
-  if (!highSurrogate.test(str))
+function codePointLength(str2) {
+  const units = str2.length;
+  if (!highSurrogate.test(str2))
     return units;
   let count = units;
   for (let i = 0; i < units - 1; i++) {
-    if ((str.charCodeAt(i) & 64512) === 55296 && (str.charCodeAt(i + 1) & 64512) === 56320) {
+    if ((str2.charCodeAt(i) & 64512) === 55296 && (str2.charCodeAt(i + 1) & 64512) === 56320) {
       count--;
       i++;
     }
@@ -19790,7 +19790,7 @@ function date4(params) {
   return _coercedDate(ZodDate, params);
 }
 
-// ../../node_modules/@modelcontextprotocol/core/dist/auth-CUe6YdwF.mjs
+// ../../node_modules/@modelcontextprotocol/server/node_modules/@modelcontextprotocol/core/dist/auth-CGP0BDVq.mjs
 var LATEST_PROTOCOL_VERSION = "2025-11-25";
 var SUPPORTED_PROTOCOL_VERSIONS = [
   LATEST_PROTOCOL_VERSION,
@@ -20627,7 +20627,8 @@ var OAuthMetadataSchema = looseObject({
   introspection_endpoint_auth_signing_alg_values_supported: array(string2()).optional(),
   code_challenge_methods_supported: array(string2()).optional(),
   client_id_metadata_document_supported: boolean2().optional(),
-  authorization_response_iss_parameter_supported: boolean2().optional().catch(void 0)
+  authorization_response_iss_parameter_supported: boolean2().optional().catch(void 0),
+  dpop_signing_alg_values_supported: array(string2()).optional()
 });
 var OpenIdProviderMetadataSchema = looseObject({
   issuer: string2(),
@@ -20728,7 +20729,7 @@ var OAuthTokenRevocationRequestSchema = object({
   token_type_hint: string2().optional()
 }).strip();
 
-// ../../node_modules/@modelcontextprotocol/server/dist/src-CX2iR2pK.mjs
+// ../../node_modules/@modelcontextprotocol/server/dist/src-D-y6h4N7.mjs
 var BRANDS = /* @__PURE__ */ Symbol.for("mcp.sdk.errorBrands");
 function stampErrorBrands(instance, ctor) {
   const brands = /* @__PURE__ */ new Set();
@@ -20842,8 +20843,18 @@ var SdkError = class extends Error {
     if (typeof this !== "function") throw new TypeError("isInstance must be called on the class (e.g. `SdkError.isInstance(value)`); for callbacks use `v => SdkError.isInstance(v)`");
     return brandedHasInstance(this, value);
   }
-  constructor(code, message, data) {
-    super(message);
+  /**
+  * @param code - Stable string code identifying the failure ({@linkcode SdkErrorCode}).
+  * @param message - Human-readable description.
+  * @param data - Optional structured payload (for example the HTTP status carried by
+  * {@linkcode SdkHttpError}). Opaque to the SDK: a `cause` key inside `data` is not
+  * promoted to `Error.cause`.
+  * @param options - Standard `ErrorOptions`, forwarded to `Error`. Pass the underlying
+  * failure as `{ cause }` so it is reachable through the `Error.cause` chain that
+  * loggers and error trackers walk.
+  */
+  constructor(code, message, data, options) {
+    super(message, options);
     this.code = code;
     this.data = data;
     this.name = "SdkError";
@@ -20854,8 +20865,11 @@ var SdkHttpError = class extends SdkError {
   static {
     Object.defineProperty(this, "mcpBrand", { value: "mcp.SdkHttpError" });
   }
-  constructor(code, message, data) {
-    super(code, message, data);
+  /**
+  * @param options - Standard `ErrorOptions`, forwarded to `Error` (see {@linkcode SdkError}).
+  */
+  constructor(code, message, data, options) {
+    super(code, message, data, options);
     this.name = "SdkHttpError";
   }
   get status() {
@@ -23806,7 +23820,7 @@ var INBOUND_VALIDATION_LADDER = [
     evaluatedAt: "pre-dispatch",
     codes: [HEADER_MISMATCH_ERROR_CODE],
     conformance: ["http-header-validation"],
-    rationale: "SEP-2243 standard `Mcp-Method` / `Mcp-Name` headers \u2014 presence, sentinel decoding, and `Mcp-Name` \u2194 body cross-check \u2014 are validated by the HTTP entry on a modern-classified request after the supported-revision gate and before dispatch. The classifier\u2019s own header-mismatch cells (protocol-version, `Mcp-Method` mismatch) stay on the edge `era-classification` rung; this rung carries the entry-layer presence/`Mcp-Name` half. Evaluated before the capability gate, the factory call, and the `Mcp-Param-*` rung so a request that fails several rungs is answered by the standard-header rung first. The documented order (after method-registry 5 and request-params 6) is NOT the observed precedence: serveModern evaluates this rung immediately after the supported-revision gate, so a request that also fails a dispatch rung is answered here before the dispatch rungs (5\u20136) are consulted."
+    rationale: "SEP-2243 standard `MCP-Protocol-Version` / `Mcp-Method` / `Mcp-Name` headers \u2014 presence, sentinel decoding, and `Mcp-Name` \u2194 body cross-check \u2014 are validated by the HTTP entry on a modern-classified request after the supported-revision gate and before dispatch. The spec requires `MCP-Protocol-Version` and `Mcp-Method` on every modern *request* POST (`Mcp-Name` only for the methods that mirror `params.name` / `params.uri` / `params.taskId`, see `MCP_NAME_HEADER_SOURCE`) and names them in that order, so a request missing several is answered by the earliest. Notification POSTs are exempt: the presence half runs on requests only, so a modern-enveloped notification is dispatched even with no standard headers at all. The classifier\u2019s own header-mismatch cells (protocol-version, `Mcp-Method` mismatch) stay on the edge `era-classification` rung; this rung carries the entry-layer presence/`Mcp-Name` half \u2014 including the missing `MCP-Protocol-Version` cell, which cannot live on the edge rung without breaking body-primary classification. Evaluated before the capability gate, the factory call, and the `Mcp-Param-*` rung so a request that fails several rungs is answered by the standard-header rung first. The documented order (after method-registry 5 and request-params 6) is NOT the observed precedence: serveModern evaluates this rung immediately after the supported-revision gate, so a request that also fails a dispatch rung is answered here before the dispatch rungs (5\u20136) are consulted."
   },
   {
     rung: "client-capabilities",
@@ -24607,7 +24621,7 @@ var Protocol = class {
     return this._requestHandlers.get(method);
   }
   async _oncancel(notification) {
-    if (!notification.params.requestId) return;
+    if (notification.params.requestId === void 0) return;
     this._requestHandlerAbortControllers.get(notification.params.requestId)?.abort(notification.params.reason);
   }
   _setupTimeout(messageId, timeout, maxTotalTimeout, onTimeout, resetTimeoutOnProgress = false) {
@@ -25006,19 +25020,20 @@ var Protocol = class {
       const cancel = (reason) => {
         if (responseReceived) return;
         this._progressHandlers.delete(messageId);
-        if (requestAbort === void 0) this._transport?.send(this._envelopeOutbound({
-          jsonrpc: "2.0",
-          method: "notifications/cancelled",
-          params: {
-            requestId: messageId,
-            reason: String(reason)
-          }
-        }), {
-          relatedRequestId,
-          resumptionToken,
-          onresumptiontoken
-        }).catch((error62) => this._onerror(/* @__PURE__ */ new Error(`Failed to send cancellation: ${error62}`)));
-        else requestAbort.abort();
+        if (requestAbort === void 0) {
+          if (request.method !== "initialize") this._transport?.send(this._envelopeOutbound({
+            jsonrpc: "2.0",
+            method: "notifications/cancelled",
+            params: {
+              requestId: messageId,
+              reason: String(reason)
+            }
+          }), {
+            relatedRequestId,
+            resumptionToken,
+            onresumptiontoken
+          }).catch((error62) => this._onerror(/* @__PURE__ */ new Error(`Failed to send cancellation: ${error62}`)));
+        } else requestAbort.abort();
         reject(reason instanceof SdkError ? reason : new SdkError(SdkErrorCode.RequestTimeout, String(reason)));
       };
       this._responseHandlers.set(messageId, (response) => {
@@ -25098,7 +25113,7 @@ var Protocol = class {
       jsonrpc: "2.0",
       ...notification
     });
-    if ((this._options?.debouncedNotificationMethods ?? []).includes(notification.method) && !notification.params && !options?.relatedRequestId) {
+    if ((this._options?.debouncedNotificationMethods ?? []).includes(notification.method) && !notification.params && options?.relatedRequestId === void 0) {
       if (this._pendingDebouncedNotifications.has(notification.method)) return;
       this._pendingDebouncedNotifications.add(notification.method);
       Promise.resolve().then(() => {
@@ -25451,7 +25466,7 @@ var require_code$1 = /* @__PURE__ */ __commonJSMin(((exports) => {
   }
   exports._ = _;
   const plus = new _Code("+");
-  function str(strs, ...args) {
+  function str2(strs, ...args) {
     const expr = [safeStringify(strs[0])];
     let i = 0;
     while (i < args.length) {
@@ -25462,7 +25477,7 @@ var require_code$1 = /* @__PURE__ */ __commonJSMin(((exports) => {
     optimize(expr);
     return new _Code(expr);
   }
-  exports.str = str;
+  exports.str = str2;
   function addCodeArg(code, arg) {
     if (arg instanceof _Code) code.push(...arg._items);
     else if (arg instanceof Name) code.push(arg);
@@ -25495,7 +25510,7 @@ var require_code$1 = /* @__PURE__ */ __commonJSMin(((exports) => {
     if (typeof b == "string" && b[0] === '"' && !(a instanceof Name)) return `"${a}${b.slice(1)}`;
   }
   function strConcat(c1, c2) {
-    return c2.emptyStr() ? c1 : c1.emptyStr() ? c2 : str`${c1}${c2}`;
+    return c2.emptyStr() ? c1 : c1.emptyStr() ? c2 : str2`${c1}${c2}`;
   }
   exports.strConcat = strConcat;
   function interpolate(x) {
@@ -26374,21 +26389,21 @@ var require_util = /* @__PURE__ */ __commonJSMin(((exports) => {
     return (0, codegen_1._)`${topSchemaRef}${schemaPath}${(0, codegen_1.getProperty)(keyword)}`;
   }
   exports.schemaRefOrVal = schemaRefOrVal;
-  function unescapeFragment(str) {
-    return unescapeJsonPointer(decodeURIComponent(str));
+  function unescapeFragment(str2) {
+    return unescapeJsonPointer(decodeURIComponent(str2));
   }
   exports.unescapeFragment = unescapeFragment;
-  function escapeFragment(str) {
-    return encodeURIComponent(escapeJsonPointer(str));
+  function escapeFragment(str2) {
+    return encodeURIComponent(escapeJsonPointer(str2));
   }
   exports.escapeFragment = escapeFragment;
-  function escapeJsonPointer(str) {
-    if (typeof str == "number") return `${str}`;
-    return str.replace(/~/g, "~0").replace(/\//g, "~1");
+  function escapeJsonPointer(str2) {
+    if (typeof str2 == "number") return `${str2}`;
+    return str2.replace(/~/g, "~0").replace(/\//g, "~1");
   }
   exports.escapeJsonPointer = escapeJsonPointer;
-  function unescapeJsonPointer(str) {
-    return str.replace(/~1/g, "/").replace(/~0/g, "~");
+  function unescapeJsonPointer(str2) {
+    return str2.replace(/~1/g, "/").replace(/~0/g, "~");
   }
   exports.unescapeJsonPointer = unescapeJsonPointer;
   function eachItem(xs, f) {
@@ -27274,8 +27289,8 @@ var require_json_schema_traverse = /* @__PURE__ */ __commonJSMin(((exports, modu
       post(schema, jsonPtr, rootSchema, parentJsonPtr, parentKeyword, parentSchema, keyIndex);
     }
   }
-  function escapeJsonPtr(str) {
-    return str.replace(/~/g, "~0").replace(/\//g, "~1");
+  function escapeJsonPtr(str2) {
+    return str2.replace(/~/g, "~0").replace(/\//g, "~1");
   }
 }));
 var require_resolve = /* @__PURE__ */ __commonJSMin(((exports) => {
@@ -28167,9 +28182,9 @@ var require_utils = /* @__PURE__ */ __commonJSMin(((exports, module) => {
       isIPV6: false
     };
   }
-  function findToken(str, token) {
+  function findToken(str2, token) {
     let ind = 0;
-    for (let i = 0; i < str.length; i++) if (str[i] === token) ind++;
+    for (let i = 0; i < str2.length; i++) if (str2[i] === token) ind++;
     return ind;
   }
   function removeDotSegments(path) {
@@ -28684,7 +28699,7 @@ var require_core$3 = /* @__PURE__ */ __commonJSMin(((exports) => {
   const util_1 = require_util();
   const $dataRefSchema = require_data();
   const uri_1 = require_uri();
-  const defaultRegExp = (str, flags) => new RegExp(str, flags);
+  const defaultRegExp = (str2, flags) => new RegExp(str2, flags);
   defaultRegExp.code = "new RegExp";
   const META_IGNORE_OPTIONS = [
     "removeAdditional",
@@ -29390,16 +29405,16 @@ var require_multipleOf = /* @__PURE__ */ __commonJSMin(((exports) => {
 }));
 var require_ucs2length = /* @__PURE__ */ __commonJSMin(((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
-  function ucs2length(str) {
-    const len = str.length;
+  function ucs2length(str2) {
+    const len = str2.length;
     let length = 0;
     let pos2 = 0;
     let value;
     while (pos2 < len) {
       length++;
-      value = str.charCodeAt(pos2++);
+      value = str2.charCodeAt(pos2++);
       if (value >= 55296 && value <= 56319 && pos2 < len) {
-        value = str.charCodeAt(pos2);
+        value = str2.charCodeAt(pos2);
         if ((value & 64512) === 56320) pos2++;
       }
     }
@@ -32110,8 +32125,8 @@ var require_formats = /* @__PURE__ */ __commonJSMin(((exports) => {
     30,
     31
   ];
-  function date5(str) {
-    const matches = DATE.exec(str);
+  function date5(str2) {
+    const matches = DATE.exec(str2);
     if (!matches) return false;
     const year = +matches[1];
     const month = +matches[2];
@@ -32126,8 +32141,8 @@ var require_formats = /* @__PURE__ */ __commonJSMin(((exports) => {
   }
   const TIME = /^(\d\d):(\d\d):(\d\d(?:\.\d+)?)(z|([+-])(\d\d)(?::?(\d\d))?)?$/i;
   function getTime(strictTimeZone) {
-    return function time3(str) {
-      const matches = TIME.exec(str);
+    return function time3(str2) {
+      const matches = TIME.exec(str2);
       if (!matches) return false;
       const hr = +matches[1];
       const min = +matches[2];
@@ -32164,8 +32179,8 @@ var require_formats = /* @__PURE__ */ __commonJSMin(((exports) => {
   const DATE_TIME_SEPARATOR = /t|\s/i;
   function getDateTime(strictTimeZone) {
     const time3 = getTime(strictTimeZone);
-    return function date_time(str) {
-      const dateTime = str.split(DATE_TIME_SEPARATOR);
+    return function date_time(str2) {
+      const dateTime = str2.split(DATE_TIME_SEPARATOR);
       return dateTime.length === 2 && date5(dateTime[0]) && time3(dateTime[1]);
     };
   }
@@ -32186,13 +32201,13 @@ var require_formats = /* @__PURE__ */ __commonJSMin(((exports) => {
   }
   const NOT_URI_FRAGMENT = /\/|:/;
   const URI = /^(?:[a-z][a-z0-9+\-.]*:)(?:\/?\/(?:(?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9a-f]{2})*@)?(?:\[(?:(?:(?:(?:[0-9a-f]{1,4}:){6}|::(?:[0-9a-f]{1,4}:){5}|(?:[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){4}|(?:(?:[0-9a-f]{1,4}:){0,1}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){3}|(?:(?:[0-9a-f]{1,4}:){0,2}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){2}|(?:(?:[0-9a-f]{1,4}:){0,3}[0-9a-f]{1,4})?::[0-9a-f]{1,4}:|(?:(?:[0-9a-f]{1,4}:){0,4}[0-9a-f]{1,4})?::)(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?))|(?:(?:[0-9a-f]{1,4}:){0,5}[0-9a-f]{1,4})?::[0-9a-f]{1,4}|(?:(?:[0-9a-f]{1,4}:){0,6}[0-9a-f]{1,4})?::)|[Vv][0-9a-f]+\.[a-z0-9\-._~!$&'()*+,;=:]+)\]|(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9a-f]{2})*)(?::\d*)?(?:\/(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})*)*|\/(?:(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})+(?:\/(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})*)*)?|(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})+(?:\/(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})*)*)(?:\?(?:[a-z0-9\-._~!$&'()*+,;=:@/?]|%[0-9a-f]{2})*)?(?:#(?:[a-z0-9\-._~!$&'()*+,;=:@/?]|%[0-9a-f]{2})*)?$/i;
-  function uri(str) {
-    return NOT_URI_FRAGMENT.test(str) && URI.test(str);
+  function uri(str2) {
+    return NOT_URI_FRAGMENT.test(str2) && URI.test(str2);
   }
   const BYTE = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/gm;
-  function byte(str) {
+  function byte(str2) {
     BYTE.lastIndex = 0;
-    return BYTE.test(str);
+    return BYTE.test(str2);
   }
   const MIN_INT32 = -(2 ** 31);
   const MAX_INT32 = 2 ** 31 - 1;
@@ -32206,10 +32221,10 @@ var require_formats = /* @__PURE__ */ __commonJSMin(((exports) => {
     return true;
   }
   const Z_ANCHOR = /[^\\]\\Z/;
-  function regex(str) {
-    if (Z_ANCHOR.test(str)) return false;
+  function regex(str2) {
+    if (Z_ANCHOR.test(str2)) return false;
     try {
-      new RegExp(str);
+      new RegExp(str2);
       return true;
     } catch (e) {
       return false;
@@ -32401,7 +32416,7 @@ var Ajv = import_ajv.Ajv;
 // ../../node_modules/@modelcontextprotocol/server/dist/shimsNode.mjs
 import process2 from "node:process";
 
-// ../../node_modules/@modelcontextprotocol/server/dist/mcp-DXXb3Vv3.mjs
+// ../../node_modules/@modelcontextprotocol/server/dist/mcp-Dw2OlZ1f.mjs
 var COMPLETABLE_SYMBOL = /* @__PURE__ */ Symbol.for("mcp.completable");
 function isCompletable(schema) {
   return !!schema && typeof schema === "object" && COMPLETABLE_SYMBOL in schema;
@@ -32594,6 +32609,9 @@ function notificationToServerEvent(method, uri) {
       };
   }
 }
+function supportsScopeChallengeResolver(transport) {
+  return typeof transport === "object" && transport !== null && "setScopeChallengeResolver" in transport && typeof transport.setScopeChallengeResolver === "function";
+}
 var DEFAULT_LEGACY_SHIM_MAX_ROUNDS = 8;
 var DEFAULT_LEGACY_SHIM_ROUND_TIMEOUT_MS = 6e5;
 function resolveLegacyShimOptions(options) {
@@ -33404,6 +33422,7 @@ var McpServer = class {
   * ```
   */
   async connect(transport) {
+    if (supportsScopeChallengeResolver(transport)) transport.setScopeChallengeResolver((context) => this.resolveScopeChallenge(context));
     return await this.server.connect(transport);
   }
   /**
@@ -33412,6 +33431,41 @@ var McpServer = class {
   async close() {
     await this.server.close();
   }
+  /** @internal */
+  resolveScopeChallenge = (context) => {
+    switch (context.request.method) {
+      case "tools/call": {
+        const toolName = context.request.params?.name;
+        if (typeof toolName !== "string") return;
+        const tool = this._registeredTools[toolName];
+        if (tool === void 0 || !tool.enabled) return;
+        return tool.scopeChallenge?.(context);
+      }
+      case "resources/read": {
+        const resourceUri = context.request.params?.uri;
+        if (typeof resourceUri !== "string") return;
+        let uri;
+        try {
+          uri = new URL(resourceUri);
+        } catch {
+          return;
+        }
+        const resource = this._registeredResources[uri.toString()];
+        if (resource !== void 0) return resource.enabled ? resource.scopeChallenge?.(context) : void 0;
+        for (const template of Object.values(this._registeredResourceTemplates)) if (template.resourceTemplate.uriTemplate.match(uri.toString())) return template.enabled ? template.scopeChallenge?.(context) : void 0;
+        return;
+      }
+      case "prompts/get": {
+        const promptName = context.request.params?.name;
+        if (typeof promptName !== "string") return;
+        const prompt = this._registeredPrompts[promptName];
+        if (prompt === void 0 || !prompt.enabled) return;
+        return prompt.scopeChallenge?.(context);
+      }
+      default:
+        return;
+    }
+  };
   _toolHandlersInitialized = false;
   setToolRequestHandlers() {
     if (this._toolHandlersInitialized) return;
@@ -33578,7 +33632,10 @@ var McpServer = class {
       }
       for (const template of Object.values(this._registeredResourceTemplates)) {
         const variables = template.resourceTemplate.uriTemplate.match(uri.toString());
-        if (variables) return attachCacheHintFallback(await template.readCallback(uri, variables, ctx), template.cacheHint);
+        if (variables) {
+          if (!template.enabled) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Resource template ${template.resourceTemplate.uriTemplate} disabled`);
+          return attachCacheHintFallback(await template.readCallback(uri, variables, ctx), template.cacheHint);
+        }
       }
       throw new ResourceNotFoundError(request.params.uri);
     });
@@ -33609,36 +33666,32 @@ var McpServer = class {
     this._promptHandlersInitialized = true;
   }
   registerResource(name, uriOrTemplate, config2, readCallback) {
-    const cacheHint = config2.cacheHint;
-    let metadata = config2;
-    if (cacheHint !== void 0) {
-      assertValidCacheHint(cacheHint, `resource ${name}`);
-      const rest = { ...config2 };
-      delete rest.cacheHint;
-      metadata = rest;
-    }
+    const { cacheHint, scopeChallenge, ...resourceMetadata } = config2;
+    const metadata = resourceMetadata;
+    if (cacheHint !== void 0) assertValidCacheHint(cacheHint, `resource ${name}`);
     if (typeof uriOrTemplate === "string") {
       if (this._registeredResources[uriOrTemplate]) throw new Error(`Resource ${uriOrTemplate} is already registered`);
-      const registeredResource = this._createRegisteredResource(name, config2.title, uriOrTemplate, metadata, readCallback);
+      const registeredResource = this._createRegisteredResource(name, config2.title, uriOrTemplate, metadata, scopeChallenge, readCallback);
       if (cacheHint !== void 0) registeredResource.cacheHint = cacheHint;
       this.setResourceRequestHandlers();
       this.sendResourceListChanged();
       return registeredResource;
     } else {
       if (this._registeredResourceTemplates[name]) throw new Error(`Resource template ${name} is already registered`);
-      const registeredResourceTemplate = this._createRegisteredResourceTemplate(name, config2.title, uriOrTemplate, metadata, readCallback);
+      const registeredResourceTemplate = this._createRegisteredResourceTemplate(name, config2.title, uriOrTemplate, metadata, scopeChallenge, readCallback);
       if (cacheHint !== void 0) registeredResourceTemplate.cacheHint = cacheHint;
       this.setResourceRequestHandlers();
       this.sendResourceListChanged();
       return registeredResourceTemplate;
     }
   }
-  _createRegisteredResource(name, title, uri, metadata, readCallback) {
+  _createRegisteredResource(name, title, uri, metadata, scopeChallenge, readCallback) {
     const registeredResource = {
       name,
       title,
       metadata,
       readCallback,
+      scopeChallenge,
       enabled: true,
       disable: () => registeredResource.update({ enabled: false }),
       enable: () => registeredResource.update({ enabled: true }),
@@ -33652,6 +33705,7 @@ var McpServer = class {
         if (updates.title !== void 0) registeredResource.title = updates.title;
         if (updates.metadata !== void 0) registeredResource.metadata = updates.metadata;
         if (updates.callback !== void 0) registeredResource.readCallback = updates.callback;
+        if (updates.scopeChallenge !== void 0) registeredResource.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
         if (updates.enabled !== void 0) registeredResource.enabled = updates.enabled;
         this.sendResourceListChanged();
       }
@@ -33659,12 +33713,13 @@ var McpServer = class {
     this._registeredResources[uri] = registeredResource;
     return registeredResource;
   }
-  _createRegisteredResourceTemplate(name, title, template, metadata, readCallback) {
+  _createRegisteredResourceTemplate(name, title, template, metadata, scopeChallenge, readCallback) {
     const registeredResourceTemplate = {
       resourceTemplate: template,
       title,
       metadata,
       readCallback,
+      scopeChallenge,
       enabled: true,
       disable: () => registeredResourceTemplate.update({ enabled: false }),
       enable: () => registeredResourceTemplate.update({ enabled: true }),
@@ -33678,6 +33733,7 @@ var McpServer = class {
         if (updates.template !== void 0) registeredResourceTemplate.resourceTemplate = updates.template;
         if (updates.metadata !== void 0) registeredResourceTemplate.metadata = updates.metadata;
         if (updates.callback !== void 0) registeredResourceTemplate.readCallback = updates.callback;
+        if (updates.scopeChallenge !== void 0) registeredResourceTemplate.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
         if (updates.enabled !== void 0) registeredResourceTemplate.enabled = updates.enabled;
         this.sendResourceListChanged();
       }
@@ -33687,7 +33743,7 @@ var McpServer = class {
     if (Array.isArray(variableNames) && variableNames.some((v) => !!template.completeCallback(v))) this.setCompletionRequestHandler();
     return registeredResourceTemplate;
   }
-  _createRegisteredPrompt(name, title, description, argsSchema, callback, icons, _meta) {
+  _createRegisteredPrompt(name, title, description, argsSchema, callback, icons, scopeChallenge, _meta) {
     let currentArgsSchema = argsSchema;
     let currentCallback = callback;
     const registeredPrompt = {
@@ -33695,6 +33751,7 @@ var McpServer = class {
       description,
       argsSchema,
       icons,
+      scopeChallenge,
       _meta,
       handler: createPromptHandler(name, argsSchema, callback),
       enabled: true,
@@ -33709,6 +33766,7 @@ var McpServer = class {
         if (updates.title !== void 0) registeredPrompt.title = updates.title;
         if (updates.description !== void 0) registeredPrompt.description = updates.description;
         if (updates.icons !== void 0) registeredPrompt.icons = updates.icons;
+        if (updates.scopeChallenge !== void 0) registeredPrompt.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
         if (updates._meta !== void 0) registeredPrompt._meta = updates._meta;
         let needsHandlerRegen = false;
         if (updates.argsSchema !== void 0) {
@@ -33736,7 +33794,7 @@ var McpServer = class {
     }
     return registeredPrompt;
   }
-  _createRegisteredTool(name, title, description, inputSchema, outputSchema, annotations, icons, execution, _meta, handler) {
+  _createRegisteredTool(name, title, description, inputSchema, outputSchema, annotations, icons, execution, scopeChallenge, _meta, handler) {
     validateAndWarnToolName(name);
     if (inputSchema !== void 0) try {
       const json2 = standardSchemaToJsonSchema(inputSchema, "input");
@@ -33755,6 +33813,7 @@ var McpServer = class {
       annotations,
       icons,
       execution,
+      scopeChallenge,
       _meta,
       handler,
       executor: createToolExecutor(inputSchema, handler),
@@ -33793,6 +33852,7 @@ var McpServer = class {
         }
         if (updates.annotations !== void 0) registeredTool.annotations = updates.annotations;
         if (updates.icons !== void 0) registeredTool.icons = updates.icons;
+        if (updates.scopeChallenge !== void 0) registeredTool.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
         if (updates._meta !== void 0) registeredTool._meta = updates._meta;
         if (updates.enabled !== void 0) registeredTool.enabled = updates.enabled;
         this.sendToolListChanged();
@@ -33805,13 +33865,13 @@ var McpServer = class {
   }
   registerTool(name, config2, cb) {
     if (this._registeredTools[name]) throw new Error(`Tool ${name} is already registered`);
-    const { title, description, inputSchema, outputSchema, annotations, icons, _meta } = config2;
-    return this._createRegisteredTool(name, title, description, normalizeRawShapeSchema(inputSchema), normalizeRawShapeSchema(outputSchema), annotations, icons, void 0, _meta, cb);
+    const { title, description, inputSchema, outputSchema, annotations, icons, scopeChallenge, _meta } = config2;
+    return this._createRegisteredTool(name, title, description, normalizeRawShapeSchema(inputSchema), normalizeRawShapeSchema(outputSchema), annotations, icons, void 0, scopeChallenge, _meta, cb);
   }
   registerPrompt(name, config2, cb) {
     if (this._registeredPrompts[name]) throw new Error(`Prompt ${name} is already registered`);
-    const { title, description, argsSchema, icons, _meta } = config2;
-    const registeredPrompt = this._createRegisteredPrompt(name, title, description, normalizeRawShapeSchema(argsSchema), cb, icons, _meta);
+    const { title, description, argsSchema, icons, scopeChallenge, _meta } = config2;
+    const registeredPrompt = this._createRegisteredPrompt(name, title, description, normalizeRawShapeSchema(argsSchema), cb, icons, scopeChallenge, _meta);
     this.setPromptRequestHandlers();
     this.sendPromptListChanged();
     return registeredPrompt;
@@ -33923,6 +33983,7 @@ function unwrapOptionalSchema(schema) {
 }
 
 // ../../node_modules/@modelcontextprotocol/server/dist/stdio.mjs
+var swallowsErrorsAfterClose = /* @__PURE__ */ Symbol("swallowsErrorsAfterClose");
 var StdioServerTransport = class {
   _readBuffer;
   _started = false;
@@ -33949,18 +34010,27 @@ var StdioServerTransport = class {
     this.onerror?.(error62);
   };
   _onstdouterror = (error62) => {
+    if (this._closed) return;
     this.onerror?.(error62);
     this.close().catch(() => {
     });
   };
+  _onstdinclose = () => {
+    this.close().catch(() => {
+    });
+  };
   /**
   * Starts listening for messages on `stdin`.
   */
   async start() {
     if (this._started) throw new Error("StdioServerTransport already started! If using Server class, note that connect() calls start() automatically.");
     this._started = true;
+    for (const listener of this._stdout.listeners("error")) if (listener[swallowsErrorsAfterClose]) this._stdout.off("error", listener);
+    if (this._stdin.readableEnded || this._stdin.destroyed) setImmediate(this._onstdinclose);
     this._stdin.on("data", this._ondata);
     this._stdin.on("error", this._onerror);
+    this._stdin.on("end", this._onstdinclose);
+    this._stdin.on("close", this._onstdinclose);
     this._stdout.on("error", this._onstdouterror);
   }
   processReadBuffer() {
@@ -33977,7 +34047,9 @@ var StdioServerTransport = class {
     this._closed = true;
     this._stdin.off("data", this._ondata);
     this._stdin.off("error", this._onerror);
-    this._stdout.off("error", this._onstdouterror);
+    this._stdin.off("end", this._onstdinclose);
+    this._stdin.off("close", this._onstdinclose);
+    this._onstdouterror[swallowsErrorsAfterClose] = true;
     if (this._stdin.listenerCount("data") === 0) this._stdin.pause();
     this._readBuffer.clear();
     this.onclose?.();
@@ -34254,6 +34326,7 @@ function serveStdio(factory, options = {}) {
         return;
       }
       if (state.era === "modern" && await tryServeListen(message)) return;
+      if (isTornDown()) return;
       state.instance.channel.deliver(message);
       return;
     }
@@ -34320,6 +34393,7 @@ function serveStdio(factory, options = {}) {
           };
         }
         if (await tryServeListen(message)) return;
+        if (isTornDown()) return;
         state.instance.channel.deliver(message, { classification: opening.classification });
         return;
       case "legacy": {
@@ -34406,6 +34480,9 @@ function toError(value) {
   return value instanceof Error ? value : new Error(String(value));
 }
 
+// ../../node_modules/@modelcontextprotocol/server/dist/index.mjs
+var DEFAULT_MAX_REQUEST_BODY_SIZE = 4 * 1024 * 1024;
+
 // ../../node_modules/@chrischall/mcp-utils/dist/errors/index.js
 var McpToolError = class extends Error {
   /** Actionable remediation text, when one applies. */
@@ -35896,6 +35973,7 @@ async function diagnose(err) {
   const isAuthError = !isTransientError && AUTH_ERROR_PATTERN.test(errText);
   const isGridLimitError = GRID_LIMIT_ERROR_PATTERN.test(errText);
   const hint = isInvalidGrant ? INVALID_GRANT_HINT : isAuthError ? AUTH_HINT : isTransientError ? TRANSIENT_HINT : isGridLimitError ? GRID_LIMIT_HINT : "";
+  if (!isAuthError && !isInvalidGrant) return errorResult(`${errText}${hint}`);
   try {
     const accounts = formatAccountList(await run(["auth", "list"]));
     return errorResult(`${errText}
@@ -35999,12 +36077,24 @@ function bodyPreview(text) {
 }
 var CONFIRM_ACTION_INSTRUCTION = CONFIRM_TOKEN_INSTRUCTION;
 var CONFIRM_FALLBACK_DESCRIPTION = ' If the client cannot show that prompt (no MCP elicitation, e.g. claude.ai), a two-step flow applies instead: call WITHOUT confirmToken and nothing is sent or changed \u2014 the result has status "confirmation-required", the full preview and a confirmToken. Follow its instruction (by default: show the preview to the user verbatim and only after they explicitly approve it in chat, call again with the SAME arguments plus confirmToken). The tool re-reads what it would act on and refuses (DRAFT_CHANGED, with a fresh preview and token) if it changed; TOKEN_EXPIRED / TOKEN_REUSED / TOKEN_INVALID also do nothing. A server set to MCP_CONFIRM_MODE=refuse refuses instead.';
+function refusedInRun(what, via, does, instead) {
+  return `${what} ${does} and is not available through ${via}. ${instead}`;
+}
 function gatedElsewhere(what, via, does, tool) {
-  return `${what} ${does} and is not available through ${via}. Use ${tool}, which asks the user to confirm.`;
+  return refusedInRun(what, via, does, `Use ${tool}, which asks the user to confirm.`);
 }
 function hasCommandWord(args, words) {
   return args.find((a) => words.has(a.toLowerCase()));
 }
+function flagValue(args, name) {
+  const flag = `--${name}`;
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === flag) return args[i + 1] ?? "";
+    if (a.startsWith(`${flag}=`)) return a.slice(flag.length + 1);
+  }
+  return void 0;
+}
 async function requireDispatchConfirmation(ctx, options) {
   const { action, fallback } = options;
   const confirmation = {
@@ -36165,6 +36255,27 @@ function authToolsFor(defaultServices) {
 }
 
 // ../gogcli-mcp/src/tools/calendar.ts
+var ASKS = (tool) => `Use ${tool}, which asks the user to confirm.`;
+var CALENDAR_REFUSED = {
+  create: { does: "can change what guests see", instead: ASKS("gog_calendar_create") },
+  add: { does: "can change what guests see", instead: ASKS("gog_calendar_create") },
+  new: { does: "can change what guests see", instead: ASKS("gog_calendar_create") },
+  update: { does: "can change what guests see", instead: ASKS("gog_calendar_update") },
+  edit: { does: "can change what guests see", instead: ASKS("gog_calendar_update") },
+  set: { does: "can change what guests see", instead: ASKS("gog_calendar_update") },
+  respond: { does: "can change what guests see", instead: ASKS("gog_calendar_respond") },
+  rsvp: { does: "can change what guests see", instead: ASKS("gog_calendar_respond") },
+  reply: { does: "can change what guests see", instead: ASKS("gog_calendar_respond") },
+  move: { does: "moves an event off guests' calendars (and can email them)", instead: ASKS("gog_calendar_move") },
+  transfer: { does: "moves an event off guests' calendars (and can email them)", instead: ASKS("gog_calendar_move") },
+  delete: { does: "removes an event from every guest's calendar (the whole series by default)", instead: ASKS("gog_calendar_delete") },
+  del: { does: "removes an event from every guest's calendar (the whole series by default)", instead: ASKS("gog_calendar_delete") },
+  rm: { does: "removes an event from every guest's calendar (the whole series by default)", instead: ASKS("gog_calendar_delete") },
+  remove: { does: "removes an event from every guest's calendar (the whole series by default)", instead: ASKS("gog_calendar_delete") },
+  "delete-calendar": { does: "deletes a calendar and every event on it", instead: ASKS("gog_calendar_delete_calendar") },
+  "out-of-office": { does: "auto-declines invitations and notifies their organizers", instead: ASKS("gog_calendar_out_of_office") },
+  ooo: { does: "auto-declines invitations and notifies their organizers", instead: ASKS("gog_calendar_out_of_office") }
+};
 var reminderParams = {
   reminders: external_exports.array(external_exports.string()).max(5).optional().describe(
     `Reminders as method:duration, e.g. ["popup:30m", "email:1d"]. Method is popup or email; duration accepts m/h/d (max 40320 minutes = 4 weeks). Google allows at most 5. These REPLACE the event's reminders \u2014 on update, pass an EMPTY array to drop custom reminders and go back to the calendar's defaults. Cannot be combined with noReminders.`
@@ -36196,20 +36307,85 @@ var attachInlineParam = external_exports.array(inlineAttachmentSchema).optional(
 
 // ../gogcli-mcp/src/tools/classroom.ts
 var CLASSROOM_CREATE_WORDS = /* @__PURE__ */ new Set(["create", "add", "new"]);
-var CLASSROOM_GATED = {
-  announcements: { does: "posts to a class", tool: "gog_classroom_announcements_create" },
-  announcement: { does: "posts to a class", tool: "gog_classroom_announcements_create" },
-  ann: { does: "posts to a class", tool: "gog_classroom_announcements_create" },
-  invitations: { does: "invites someone to a class", tool: "gog_classroom_invitations_create" },
-  invitation: { does: "invites someone to a class", tool: "gog_classroom_invitations_create" },
-  invites: { does: "invites someone to a class", tool: "gog_classroom_invitations_create" }
+var CLASSROOM_DELETE_WORDS = /* @__PURE__ */ new Set(["delete", "rm", "del", "remove"]);
+var CLASSROOM_UPDATE_WORDS = /* @__PURE__ */ new Set(["update", "edit", "set"]);
+var CLASSROOM_RETURN_WORDS = /* @__PURE__ */ new Set(["return", "send"]);
+var CLASSROOM_ASSIGNEE_WORDS = /* @__PURE__ */ new Set(["assignees", "assign"]);
+var CLASSROOM_GROUPS = {
+  courses: "courses",
+  course: "courses",
+  announcements: "announcements",
+  announcement: "announcements",
+  ann: "announcements",
+  invitations: "invitations",
+  invitation: "invitations",
+  invites: "invitations",
+  coursework: "coursework",
+  work: "coursework",
+  materials: "materials",
+  material: "materials",
+  students: "students",
+  student: "students",
+  teachers: "teachers",
+  teacher: "teachers",
+  submissions: "submissions",
+  submission: "submissions",
+  "guardian-invitations": "guardian-invitations",
+  "guardian-invites": "guardian-invitations"
 };
+function publishesToStudents(args) {
+  return flagValue(args, "state")?.toUpperCase() === "PUBLISHED" || flagValue(args, "scheduled") !== void 0;
+}
+function createsVisibleWork(args) {
+  return flagValue(args, "state")?.toUpperCase() !== "DRAFT" || flagValue(args, "scheduled") !== void 0;
+}
+function widensAssignees(args) {
+  return flagValue(args, "mode")?.toUpperCase() === "ALL_STUDENTS" || flagValue(args, "add-student") !== void 0;
+}
 function vetClassroomRun(subcommand, args) {
   const sub = subcommand.toLowerCase();
-  const gated = Object.hasOwn(CLASSROOM_GATED, sub) ? CLASSROOM_GATED[sub] : void 0;
-  if (!gated) return void 0;
-  const word = hasCommandWord(args, CLASSROOM_CREATE_WORDS);
-  return word ? gatedElsewhere(`gog classroom ${sub} ${word.toLowerCase()}`, "gog_classroom_run", gated.does, gated.tool) : void 0;
+  if (!Object.hasOwn(CLASSROOM_GROUPS, sub)) return void 0;
+  const group = CLASSROOM_GROUPS[sub];
+  const via = "gog_classroom_run";
+  const what = (word) => `gog classroom ${sub} ${word.toLowerCase()}`;
+  const create = hasCommandWord(args, CLASSROOM_CREATE_WORDS);
+  const update = hasCommandWord(args, CLASSROOM_UPDATE_WORDS);
+  const remove = hasCommandWord(args, CLASSROOM_DELETE_WORDS);
+  const widenedAssignees = () => {
+    const word = hasCommandWord(args, CLASSROOM_ASSIGNEE_WORDS);
+    return word && widensAssignees(args) ? refusedInRun(what(word), via, "shows it to more students", "Ask the user to change who it is assigned to from Classroom.") : void 0;
+  };
+  switch (group) {
+    case "courses":
+      return remove ? gatedElsewhere(what(remove), via, "deletes a course", "gog_classroom_courses_delete") : void 0;
+    case "announcements":
+      if (create) return gatedElsewhere(what(create), via, "posts to a class", "gog_classroom_announcements_create");
+      if (update && publishesToStudents(args)) return gatedElsewhere(what(update), via, "publishes an announcement to a class", "gog_classroom_announcements_update");
+      return widenedAssignees();
+    case "invitations":
+      return create ? gatedElsewhere(what(create), via, "invites someone to a class", "gog_classroom_invitations_create") : void 0;
+    case "coursework":
+      if (create && createsVisibleWork(args)) return gatedElsewhere(what(create), via, "posts coursework to a class", "gog_classroom_coursework_create");
+      if (remove) return gatedElsewhere(what(remove), via, "deletes coursework and every submission to it", "gog_classroom_coursework_delete");
+      if (update && publishesToStudents(args)) return gatedElsewhere(what(update), via, "publishes work to students", "gog_classroom_coursework_update");
+      return widenedAssignees();
+    case "materials":
+      if (create && createsVisibleWork(args)) {
+        return refusedInRun(what(create), via, "publishes material to students", "Create it with --state=DRAFT and no --scheduled; ask the user to publish it from Classroom.");
+      }
+      if (update && publishesToStudents(args)) return refusedInRun(what(update), via, "publishes material to students", "Ask the user to publish it from Classroom.");
+      return void 0;
+    case "students":
+      return create ? gatedElsewhere(what(create), via, "enrols someone in a class", "gog_classroom_students_add") : void 0;
+    case "teachers":
+      return create ? gatedElsewhere(what(create), via, "gives someone a teacher's access to a class and its roster", "gog_classroom_teachers_add") : void 0;
+    case "submissions": {
+      const word = hasCommandWord(args, CLASSROOM_RETURN_WORDS);
+      return word ? gatedElsewhere(what(word), via, "returns work to a student, who is notified", "gog_classroom_submissions_return") : void 0;
+    }
+    case "guardian-invitations":
+      return create ? refusedInRun(what(create), via, "emails a guardian invitation", "Ask the user to invite the guardian from Classroom.") : void 0;
+  }
 }
 async function readCourse(courseId, account, runner = runOrDiagnose) {
   const got = await runner(["classroom", "courses", "get", pos(courseId)], { account });
@@ -36228,6 +36404,63 @@ async function readCourse(courseId, account, runner = runOrDiagnose) {
     }
   };
 }
+function nested(raw, key) {
+  try {
+    const parsed = JSON.parse(raw);
+    const inner = parsed?.[key];
+    return inner && typeof inner === "object" ? inner : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var str = (v) => typeof v === "string" ? v : void 0;
+var num = (v) => typeof v === "number" ? v : void 0;
+async function readCoursework(courseId, courseworkId, account, runner = runOrDiagnose) {
+  const got = await runner(["classroom", "coursework", "get", pos(courseId), pos(courseworkId)], { account });
+  if (got.isError) return { error: got };
+  const work = nested(resultText(got), "coursework");
+  const title = str(work?.title);
+  return { coursework: { id: courseworkId, ...title !== void 0 ? { title } : {} } };
+}
+async function readClassroomWork(kind, courseId, itemId, account, runner = runOrDiagnose) {
+  const got = await runner(["classroom", kind, "get", pos(courseId), pos(itemId)], { account });
+  if (got.isError) return { error: got };
+  const item = nested(resultText(got), kind === "announcements" ? "announcement" : "coursework");
+  const work = { id: itemId };
+  for (const key of ["text", "title", "description", "state", "updateTime"]) {
+    const value = str(item?.[key]);
+    if (value !== void 0) work[key] = value;
+  }
+  return { work };
+}
+async function readSubmission(courseId, courseworkId, submissionId, account, runner = runOrDiagnose) {
+  const got = await runner(["classroom", "submissions", "get", pos(courseId), pos(courseworkId), pos(submissionId)], { account });
+  if (got.isError) return { error: got };
+  const sub = nested(resultText(got), "submission");
+  const fields = {
+    student: str(sub?.userId),
+    state: str(sub?.state),
+    draftGrade: num(sub?.draftGrade),
+    assignedGrade: num(sub?.assignedGrade)
+  };
+  const updateTime = str(sub?.updateTime);
+  return {
+    submission: {
+      id: submissionId,
+      ...Object.fromEntries(Object.entries(fields).filter(([, v]) => v !== void 0))
+    },
+    ...updateTime !== void 0 ? { updateTime } : {}
+  };
+}
+async function studentLabel(courseId, userId, account, runner = runOrDiagnose) {
+  const got = await runner(["classroom", "students", "get", pos(courseId), pos(userId)], { account });
+  if (got.isError) return userId;
+  const profile = nested(resultText(got), "student")?.profile;
+  const name = str(profile?.name?.fullName);
+  const email3 = str(profile?.emailAddress);
+  if (name && email3) return `${name} <${email3}>`;
+  return name ?? email3 ?? userId;
+}
 function registerClassroomTools(server) {
   server.registerTool("gog_classroom_courses_list", {
     description: "List Google Classroom courses.",
@@ -36440,15 +36673,38 @@ function registerClassroomTools(server) {
     return runOrDiagnose(args, { account });
   });
   server.registerTool("gog_classroom_submissions_return", {
-    description: "Return a graded submission to the student.",
+    description: "Return a graded submission to the student, who is notified and sees the grade. Reads the course, the coursework and the submission and asks the MCP host to show the user a confirmation prompt with the class, the assignment, the student and the grade being returned; nothing is returned unless they accept." + CONFIRM_FALLBACK_DESCRIPTION,
     annotations: { destructiveHint: true },
     inputSchema: external_exports.object({
       courseId: external_exports.string().describe("Course ID"),
       courseworkId: external_exports.string().describe("Coursework ID"),
       submissionId: external_exports.string().describe("Submission ID"),
-      account: accountParam
+      account: accountParam,
+      confirmToken: confirmTokenParam
     })
-  }, async ({ courseId, courseworkId, submissionId, account }) => {
+  }, async ({ courseId, courseworkId, submissionId, account, confirmToken }, ctx) => {
+    const course = await readCourse(courseId, account);
+    if (course.error) return course.error;
+    const work = await readCoursework(courseId, courseworkId, account);
+    if (work.error) return work.error;
+    const sub = await readSubmission(courseId, courseworkId, submissionId, account);
+    if (sub.error) return sub.error;
+    const submission = sub.submission.student ? { ...sub.submission, student: await studentLabel(courseId, sub.submission.student, account) } : sub.submission;
+    const view = { course: course.course, coursework: work.coursework, submission };
+    const confirmation = await requireDispatchConfirmation(ctx, {
+      action: "classroom.submission-return",
+      message: "Review and confirm returning this work \u2014 the student is notified and sees the grade:",
+      confirmationLabel: "Confirm that this submission should be returned to the student now.",
+      details: view,
+      unsupportedNote: "Ask the user to return it from Classroom.",
+      fallback: {
+        tool: "gog_classroom_submissions_return",
+        account,
+        confirmToken,
+        subject: () => ({ target: `${courseId}/${courseworkId}/${submissionId}`, revision: sub.updateTime, payload: view, preview: view })
+      }
+    });
+    if (confirmation) return confirmation;
     return runOrDiagnose(["classroom", "submissions", "return", pos(courseId), pos(courseworkId), pos(submissionId)], { account });
   });
   server.registerTool("gog_classroom_submissions_turn_in", {
@@ -36510,13 +36766,13 @@ function registerClassroomTools(server) {
     return runOrDiagnose(["classroom", "announcements", "get", pos(courseId), pos(announcementId)], { account });
   });
   server.registerTool("gog_classroom_announcements_create", {
-    description: "Create an announcement in a Google Classroom course. Unless state is DRAFT (which students cannot see), this reads the course and asks the MCP host to show the user a confirmation prompt with the class, the full text and when it publishes; nothing is posted unless they accept. To stage one without asking, pass state DRAFT." + CONFIRM_FALLBACK_DESCRIPTION,
+    description: "Create an announcement in a Google Classroom course. Unless state is DRAFT with no scheduled time (which students cannot see; a scheduled draft publishes itself), this reads the course and asks the MCP host to show the user a confirmation prompt with the class, the full text and when it publishes; nothing is posted unless they accept. To stage one without asking, pass state DRAFT and no scheduled time." + CONFIRM_FALLBACK_DESCRIPTION,
     annotations: { destructiveHint: true },
     inputSchema: external_exports.object({
       courseId: external_exports.string().describe("Course ID"),
       text: external_exports.string().describe("Announcement text"),
-      state: external_exports.enum(["PUBLISHED", "DRAFT"]).optional().describe("State (DRAFT is visible only to teachers and needs no confirmation)"),
-      scheduled: external_exports.string().optional().describe("Scheduled publish time"),
+      state: external_exports.enum(["PUBLISHED", "DRAFT"]).optional().describe("State (an unscheduled DRAFT is visible only to teachers and needs no confirmation)"),
+      scheduled: external_exports.string().optional().describe("Scheduled publish time (asks the user to confirm, even for a DRAFT)"),
       account: accountParam,
       confirmToken: confirmTokenParam
     })
@@ -36524,7 +36780,7 @@ function registerClassroomTools(server) {
     const args = ["classroom", "announcements", "create", pos(courseId), `--text=${text}`];
     if (state) args.push(`--state=${state}`);
     if (scheduled) args.push(`--scheduled=${scheduled}`);
-    if (state !== "DRAFT") {
+    if (state !== "DRAFT" || scheduled) {
       const read = await readCourse(courseId, account);
       if (read.error) return read.error;
       const publishes = scheduled ? `at ${scheduled}` : "immediately";
@@ -36673,7 +36929,7 @@ var failIfNotEmptyParam = external_exports.boolean().optional().describe(
 );
 
 // ../gogcli-mcp/src/server.ts
-var VERSION = true ? "4.5.0" : "0.0.0";
+var VERSION = true ? "4.5.2" : "0.0.0";
 
 // ../gogcli-mcp/src/bootstrap-auth.ts
 import { join as join5 } from "node:path";
@@ -36751,6 +37007,11 @@ var MAX_BLOB_UPLOAD_BYTES = 100 * 1024 * 1024;
 var courseState = external_exports.enum(["ACTIVE", "ARCHIVED", "PROVISIONED", "DECLINED", "SUSPENDED"]);
 var workState = external_exports.enum(["PUBLISHED", "DRAFT"]);
 var workType = external_exports.enum(["ASSIGNMENT", "SHORT_ANSWER_QUESTION", "MULTIPLE_CHOICE_QUESTION"]);
+function publishesWhen(state, scheduled) {
+  if (scheduled) return `at ${scheduled}`;
+  return state === "PUBLISHED" ? "immediately" : void 0;
+}
+var PUBLISH_DESCRIPTION = " Publishing it (state PUBLISHED, or a scheduled time) reads the course and the item and asks the MCP host to show the user a confirmation prompt with the class and what students will see; nothing is published unless they accept. Other edits, and a return to DRAFT, need no confirmation." + CONFIRM_FALLBACK_DESCRIPTION;
 var courseSharedFields = {
   owner: external_exports.string().optional().describe('Owner user ID (default "me" on create)'),
   section: external_exports.string().optional().describe("Section"),
@@ -36810,13 +37071,31 @@ function registerExtraClassroomTools(server) {
     return runOrDiagnose(args, { account });
   });
   server.registerTool("gog_classroom_courses_delete", {
-    description: "Delete a Google Classroom course.",
+    description: "Delete a Google Classroom course \u2014 its coursework, submissions and grades go with it, for good. Reads the course and asks the MCP host to show the user a confirmation prompt naming it first; nothing is deleted unless they accept. gog_classroom_courses_archive is the reversible alternative." + CONFIRM_FALLBACK_DESCRIPTION,
     annotations: { destructiveHint: true },
     inputSchema: external_exports.object({
       courseId: external_exports.string().describe("Course ID"),
-      account: accountParam
+      account: accountParam,
+      confirmToken: confirmTokenParam
     })
-  }, async ({ courseId, account }) => {
+  }, async ({ courseId, account, confirmToken }, ctx) => {
+    const read = await readCourse(courseId, account, runOrDiagnose);
+    if (read.error) return read.error;
+    const view = { course: read.course, deletes: "the course with all of its coursework, submissions and grades, for good" };
+    const confirmation = await requireDispatchConfirmation(ctx, {
+      action: "classroom.course-delete",
+      message: "Review and confirm PERMANENTLY deleting this course:",
+      confirmationLabel: "Confirm that this course should be deleted now.",
+      details: view,
+      unsupportedNote: "Archive it with gog_classroom_courses_archive instead, or ask the user to delete it from Classroom.",
+      fallback: {
+        tool: "gog_classroom_courses_delete",
+        account,
+        confirmToken,
+        subject: () => ({ target: courseId, payload: view, preview: view })
+      }
+    });
+    if (confirmation) return confirmation;
     return runOrDiagnose(["classroom", "courses", "delete", pos(courseId), "--force"], { account });
   });
   server.registerTool("gog_classroom_courses_archive", {
@@ -36840,17 +37119,37 @@ function registerExtraClassroomTools(server) {
     return runOrDiagnose(["classroom", "courses", "unarchive", pos(courseId)], { account });
   });
   server.registerTool("gog_classroom_students_add", {
-    description: "Add a student to a Google Classroom course.",
+    description: 'Add a student to a Google Classroom course. Adding someone else gives them the class stream and materials, so this reads the course and asks the MCP host to show the user a confirmation prompt with the class and the student first; enrolling yourself ("me") does not ask.' + CONFIRM_FALLBACK_DESCRIPTION,
     annotations: { destructiveHint: true },
     inputSchema: external_exports.object({
       courseId: external_exports.string().describe("Course ID"),
-      userId: external_exports.string().describe('Student user ID (or "me")'),
+      userId: external_exports.string().describe('Student user ID or email (or "me")'),
       enrollmentCode: external_exports.string().optional().describe("Enrollment code (required if adding self via code)"),
-      account: accountParam
+      account: accountParam,
+      confirmToken: confirmTokenParam
     })
-  }, async ({ courseId, userId, enrollmentCode, account }) => {
+  }, async ({ courseId, userId, enrollmentCode, account, confirmToken }, ctx) => {
     const args = ["classroom", "students", "add", pos(courseId), pos(userId)];
     if (enrollmentCode) args.push(`--enrollment-code=${enrollmentCode}`);
+    if (userId.toLowerCase() !== "me") {
+      const read = await readCourse(courseId, account, runOrDiagnose);
+      if (read.error) return read.error;
+      const view = { course: read.course, student: userId };
+      const confirmation = await requireDispatchConfirmation(ctx, {
+        action: "classroom.student-add",
+        message: "Review and confirm adding this student to the class:",
+        confirmationLabel: "Confirm that this person should be added to the class now.",
+        details: view,
+        unsupportedNote: "Ask the user to add them from Classroom, or invite them with gog_classroom_invitations_create.",
+        fallback: {
+          tool: "gog_classroom_students_add",
+          account,
+          confirmToken,
+          subject: () => ({ target: `${courseId}/${userId}`, payload: view, preview: view })
+        }
+      });
+      if (confirmation) return confirmation;
+    }
     return runOrDiagnose(args, { account });
   });
   server.registerTool("gog_classroom_students_remove", {
@@ -36865,14 +37164,32 @@ function registerExtraClassroomTools(server) {
     return runOrDiagnose(["classroom", "students", "remove", pos(courseId), pos(userId), "--force"], { account });
   });
   server.registerTool("gog_classroom_teachers_add", {
-    description: "Add a teacher to a Google Classroom course.",
+    description: "Add a teacher to a Google Classroom course. A co-teacher sees every student's work and grades, so this reads the course and asks the MCP host to show the user a confirmation prompt with the class and the teacher first; nothing changes unless they accept." + CONFIRM_FALLBACK_DESCRIPTION,
     annotations: { destructiveHint: true },
     inputSchema: external_exports.object({
       courseId: external_exports.string().describe("Course ID"),
-      userId: external_exports.string().describe("Teacher user ID"),
-      account: accountParam
+      userId: external_exports.string().describe("Teacher user ID or email"),
+      account: accountParam,
+      confirmToken: confirmTokenParam
     })
-  }, async ({ courseId, userId, account }) => {
+  }, async ({ courseId, userId, account, confirmToken }, ctx) => {
+    const read = await readCourse(courseId, account, runOrDiagnose);
+    if (read.error) return read.error;
+    const view = { course: read.course, teacher: userId, grants: "teacher access: every student's work, grades and roster" };
+    const confirmation = await requireDispatchConfirmation(ctx, {
+      action: "classroom.teacher-add",
+      message: "Review and confirm giving this person teacher access to the class:",
+      confirmationLabel: "Confirm that this person should become a teacher of the class now.",
+      details: view,
+      unsupportedNote: "Ask the user to add them from Classroom, or invite them with gog_classroom_invitations_create.",
+      fallback: {
+        tool: "gog_classroom_teachers_add",
+        account,
+        confirmToken,
+        subject: () => ({ target: `${courseId}/${userId}`, payload: view, preview: view })
+      }
+    });
+    if (confirmation) return confirmation;
     return runOrDiagnose(["classroom", "teachers", "add", pos(courseId), pos(userId)], { account });
   });
   server.registerTool("gog_classroom_teachers_remove", {
@@ -36887,15 +37204,16 @@ function registerExtraClassroomTools(server) {
     return runOrDiagnose(["classroom", "teachers", "remove", pos(courseId), pos(userId), "--force"], { account });
   });
   server.registerTool("gog_classroom_coursework_create", {
-    description: "Create a new coursework item (assignment, question, etc.) in a course.",
+    description: "Create a new coursework item (assignment, question, etc.) in a course. Unless state is DRAFT with no scheduled time (which students cannot see; a scheduled draft publishes itself), the class is notified, so this reads the course and asks the MCP host to show the user a confirmation prompt with the class, the title, the text, the due date and when it publishes; nothing is posted unless they accept. To stage one without asking, pass state DRAFT and no scheduled time." + CONFIRM_FALLBACK_DESCRIPTION,
     annotations: { destructiveHint: true },
     inputSchema: external_exports.object({
       courseId: external_exports.string().describe("Course ID"),
       title: external_exports.string().describe("Coursework title"),
       ...courseworkSharedFields,
-      account: accountParam
+      account: accountParam,
+      confirmToken: confirmTokenParam
     })
-  }, async ({ courseId, title, description, type, state, maxPoints, due, dueDate, dueTime, scheduled, topic, account }) => {
+  }, async ({ courseId, title, description, type, state, maxPoints, due, dueDate, dueTime, scheduled, topic, account, confirmToken }, ctx) => {
     const args = ["classroom", "coursework", "create", pos(courseId), `--title=${title}`];
     if (description) args.push(`--description=${description}`);
     if (type) args.push(`--type=${type}`);
@@ -36906,19 +37224,49 @@ function registerExtraClassroomTools(server) {
     if (dueTime) args.push(`--due-time=${dueTime}`);
     if (scheduled) args.push(`--scheduled=${scheduled}`);
     if (topic) args.push(`--topic=${topic}`);
+    if (state !== "DRAFT" || scheduled) {
+      const read = await readCourse(courseId, account, runOrDiagnose);
+      if (read.error) return read.error;
+      const work = {
+        course: read.course,
+        title,
+        type: type ?? "ASSIGNMENT",
+        publishes: scheduled ? `at ${scheduled}` : "immediately",
+        due: due ?? ([dueDate, dueTime].filter(Boolean).join(" ") || void 0),
+        maxPoints
+      };
+      const confirmation = await requireDispatchConfirmation(ctx, {
+        action: "classroom.coursework-create",
+        message: "Review and confirm posting this coursework to the class:",
+        confirmationLabel: "Confirm that this coursework should be posted to the class.",
+        details: { ...work, descriptionPreview: bodyPreview(description) },
+        unsupportedNote: "Create it with state DRAFT instead; the user can review and post it from Classroom.",
+        fallback: {
+          tool: "gog_classroom_coursework_create",
+          account,
+          confirmToken,
+          subject: () => {
+            const view = { ...work, description };
+            return { target: courseId, payload: view, preview: view };
+          }
+        }
+      });
+      if (confirmation) return confirmation;
+    }
     return runOrDiagnose(args, { account });
   });
   server.registerTool("gog_classroom_coursework_update", {
-    description: "Update an existing coursework item.",
+    description: "Update an existing coursework item." + PUBLISH_DESCRIPTION,
     annotations: { destructiveHint: true },
     inputSchema: external_exports.object({
       courseId: external_exports.string().describe("Course ID"),
       courseworkId: external_exports.string().describe("Coursework ID"),
       title: external_exports.string().optional().describe("New title"),
       ...courseworkSharedFields,
-      account: accountParam
+      account: accountParam,
+      confirmToken: confirmTokenParam
     })
-  }, async ({ courseId, courseworkId, title, description, type, state, maxPoints, due, dueDate, dueTime, scheduled, topic, account }) => {
+  }, async ({ courseId, courseworkId, title, description, type, state, maxPoints, due, dueDate, dueTime, scheduled, topic, account, confirmToken }, ctx) => {
     const args = ["classroom", "coursework", "update", pos(courseId), pos(courseworkId)];
     if (title) args.push(`--title=${title}`);
     if (description) args.push(`--description=${description}`);
@@ -36930,35 +37278,123 @@ function registerExtraClassroomTools(server) {
     if (dueTime) args.push(`--due-time=${dueTime}`);
     if (scheduled) args.push(`--scheduled=${scheduled}`);
     if (topic) args.push(`--topic=${topic}`);
+    const publishes = publishesWhen(state, scheduled);
+    if (publishes) {
+      const read = await readCourse(courseId, account, runOrDiagnose);
+      if (read.error) return read.error;
+      const current = await readClassroomWork("coursework", courseId, courseworkId, account, runOrDiagnose);
+      if (current.error) return current.error;
+      const published = description || current.work.description;
+      const publishedTitle = title || current.work.title;
+      const view = {
+        course: read.course,
+        coursework: { id: courseworkId, title: publishedTitle, state: current.work.state },
+        publishes,
+        descriptionPreview: bodyPreview(published)
+      };
+      const confirmation = await requireDispatchConfirmation(ctx, {
+        action: "classroom.coursework-publish",
+        message: "Review and confirm publishing this Classroom coursework to students:",
+        confirmationLabel: "Confirm that this coursework should be published to the class.",
+        details: view,
+        unsupportedNote: "Leave it as a DRAFT; the user can review and publish it from Classroom.",
+        fallback: {
+          tool: "gog_classroom_coursework_update",
+          account,
+          confirmToken,
+          subject: () => ({
+            target: `${courseId}/${courseworkId}`,
+            revision: current.work.updateTime,
+            payload: { course: read.course, courseworkId, title: publishedTitle, description: published, type, state, maxPoints, due, dueDate, dueTime, scheduled, topic },
+            preview: view
+          })
+        }
+      });
+      if (confirmation) return confirmation;
+    }
     return runOrDiagnose(args, { account });
   });
   server.registerTool("gog_classroom_coursework_delete", {
-    description: "Delete a coursework item.",
+    description: "Delete a coursework item \u2014 every student submission to it goes too, for good. Reads the course and the coursework and asks the MCP host to show the user a confirmation prompt naming both first; nothing is deleted unless they accept." + CONFIRM_FALLBACK_DESCRIPTION,
     annotations: { destructiveHint: true },
     inputSchema: external_exports.object({
       courseId: external_exports.string().describe("Course ID"),
       courseworkId: external_exports.string().describe("Coursework ID"),
-      account: accountParam
+      account: accountParam,
+      confirmToken: confirmTokenParam
     })
-  }, async ({ courseId, courseworkId, account }) => {
+  }, async ({ courseId, courseworkId, account, confirmToken }, ctx) => {
+    const course = await readCourse(courseId, account, runOrDiagnose);
+    if (course.error) return course.error;
+    const work = await readCoursework(courseId, courseworkId, account, runOrDiagnose);
+    if (work.error) return work.error;
+    const view = { course: course.course, coursework: work.coursework, deletes: "the coursework and every student submission to it, for good" };
+    const confirmation = await requireDispatchConfirmation(ctx, {
+      action: "classroom.coursework-delete",
+      message: "Review and confirm PERMANENTLY deleting this coursework and its submissions:",
+      confirmationLabel: "Confirm that this coursework should be deleted now.",
+      details: view,
+      unsupportedNote: "Ask the user to delete it from Classroom.",
+      fallback: {
+        tool: "gog_classroom_coursework_delete",
+        account,
+        confirmToken,
+        subject: () => ({ target: `${courseId}/${courseworkId}`, payload: view, preview: view })
+      }
+    });
+    if (confirmation) return confirmation;
     return runOrDiagnose(["classroom", "coursework", "delete", pos(courseId), pos(courseworkId), "--force"], { account });
   });
   server.registerTool("gog_classroom_announcements_update", {
-    description: "Update an existing announcement.",
+    description: "Update an existing announcement." + PUBLISH_DESCRIPTION,
     annotations: { destructiveHint: true },
     inputSchema: external_exports.object({
       courseId: external_exports.string().describe("Course ID"),
       announcementId: external_exports.string().describe("Announcement ID"),
       text: external_exports.string().optional().describe("New text"),
-      state: workState.optional().describe("State"),
-      scheduled: external_exports.string().optional().describe("Scheduled publish time"),
-      account: accountParam
+      state: workState.optional().describe("State (PUBLISHED asks the user to confirm; DRAFT does not)"),
+      scheduled: external_exports.string().optional().describe("Scheduled publish time (asks the user to confirm)"),
+      account: accountParam,
+      confirmToken: confirmTokenParam
     })
-  }, async ({ courseId, announcementId, text, state, scheduled, account }) => {
+  }, async ({ courseId, announcementId, text, state, scheduled, account, confirmToken }, ctx) => {
     const args = ["classroom", "announcements", "update", pos(courseId), pos(announcementId)];
     if (text) args.push(`--text=${text}`);
     if (state) args.push(`--state=${state}`);
     if (scheduled) args.push(`--scheduled=${scheduled}`);
+    const publishes = publishesWhen(state, scheduled);
+    if (publishes) {
+      const read = await readCourse(courseId, account, runOrDiagnose);
+      if (read.error) return read.error;
+      const current = await readClassroomWork("announcements", courseId, announcementId, account, runOrDiagnose);
+      if (current.error) return current.error;
+      const published = text || current.work.text;
+      const view = {
+        course: read.course,
+        announcement: { id: announcementId, state: current.work.state },
+        publishes,
+        textPreview: bodyPreview(published)
+      };
+      const confirmation = await requireDispatchConfirmation(ctx, {
+        action: "classroom.announcement-publish",
+        message: "Review and confirm publishing this Classroom announcement to the class:",
+        confirmationLabel: "Confirm that this announcement should be published to the class.",
+        details: view,
+        unsupportedNote: "Leave it as a DRAFT; the user can review and publish it from Classroom.",
+        fallback: {
+          tool: "gog_classroom_announcements_update",
+          account,
+          confirmToken,
+          subject: () => ({
+            target: `${courseId}/${announcementId}`,
+            revision: current.work.updateTime,
+            payload: { course: read.course, announcementId, text: published, state, scheduled },
+            preview: view
+          })
+        }
+      });
+      if (confirmation) return confirmation;
+    }
     return runOrDiagnose(args, { account });
   });
   server.registerTool("gog_classroom_announcements_delete", {
@@ -37057,7 +37493,7 @@ await runMcp({
 });
 /*! Bundled license information:
 
-@modelcontextprotocol/server/dist/src-CX2iR2pK.mjs:
+@modelcontextprotocol/server/dist/src-D-y6h4N7.mjs:
   (*!
   * content-type
   * Copyright(c) 2015 Douglas Christopher Wilson